Data Breaches: CERT-In Advisory and UPSC Angle

Data breaches are in focus after recent cybersecurity coverage highlighted fresh risks flagged by CERT-In. The editorial argues that India must strengthen detection, reporting, and public accountability before harm becomes visible.

What is data breaches?

Data breaches occur when unauthorised actors access, copy, alter, or expose protected information. The risk covers government networks, private platforms, and critical digital infrastructure.

In India, the issue now links cyber defence with AI-enabled threats, internal security controls, and legal compliance. The present debate also reflects a wider gap between incident reporting and actual breach detection.

Why in News?

The CERT-In advisory flagged two threat vectors: autonomous AI agents exceeding their operating limits, and hostile use of open-source agentic AI tools. The editorial says these concerns matter because recent breaches were not first found by the affected organisations.

Instead, disclosures by AI companies and CERT-In operations brought them to light. That raises questions about readiness, internal monitoring, and whether organisations can discover intrusions quickly enough to meet the six-hour reporting rule.

Key Features

• Detection gap — The core problem is not only reporting breaches, but finding them before outsiders do.
• AI-specific risk — Autonomous agents may act beyond intended limits or be misused for automated reconnaissance.
• Compliance pressure — The DPDP Act will impose stronger expectations on safeguards against breaches from 2027.
• Incident reporting rule — CERT-In requires reporting within six hours, but speed does not guarantee discovery.
• Public sector vulnerability — The editorial stresses better spotting of unauthorised access, especially in government systems.
• Transparency deficit — CERT-In does not routinely publish postmortem analyses, limiting public learning from incidents.

Challenges

• Fragmented framework — India’s cyber regime mixes enforceable rules, advisory standards, and narrow AI accountability.
• Weak detection culture — Many organisations still struggle to identify intrusions within their networks.
• Limited accountability — The legal boundaries for autonomous agents remain unclear when human intention is indirect or absent.
• Transparency limits — CERT-In is exempt from the RTI Act, reducing external scrutiny of outcomes.
• Research deterrence — Good-faith security research needs clearer safe-harbour protection to support disclosure and remediation.
• Known vulnerabilities — The advisory also points to old weaknesses such as exposed passwords, showing that basic cyber hygiene still matters.

Way Forward

India needs enforceable, risk-based rules for testing and defending against autonomous systems. It also needs stronger mechanisms for spotting unauthorised access, especially in public institutions.

Greater publication of anonymised remediation details would improve learning across sectors. A narrower approach to information secrecy, including a review of CERT-In’s RTI exemption, would support better cyber-defence without weakening security.

Source: The Hindu, October 21, 2026

FAQ