Lok Sabha Question No. 673 (UNSTARRED), answered on 2017-07-19
Subject: Losses due to Cyber Attack
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: JYOTIRADITYA MADHAVRAO SCINDIA, KAMAL NATH

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA

## UNSTARRED QUESTION NO. 673

TO BE ANSWERED ON: 19.07.2017

## LOSSES DUE TO CYBER ATTACK

## 673 SHRI JYOTIRADITYA M. SCINDIA: SHRI KAMAL NATH:

Will the Minister of Electronics & Information Technology be pleased to state:-

- (a)    whether  the  Union  Government  is  aware  that  many  Indian  companies  are  losing  several crores every year due to cyber attacks;
- (b)  if so,  whether the Union Government in consultation with State Governments propose to strengthen the cyber attack laws;
- (c)   if so, the details thereof;
- (d)  whether any separate wing has been created to check such cyber attacks and to prosecute the culprits involved; and
- (e)   if so, the details thereof?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI P.P. CHAUDHARY)

(a): The field of Information Technology (IT) is characterized by rapid developments and fast changing obsolescence. With every IT product introduced into the market, newer vulnerabilities are  discovered,  leaving  scope  for  malicious  actions.  In  tune  with  the  dynamic  nature  of Information Technology, continuous efforts are required to be made to prevent and recover from cyber  attacks.  Malicious  users  continuously  target  India's  IT  infrastructure  to  infiltrate  and hamper the functionality of IT systems. As such, the protection of India's IT infrastructure in general and critical information infrastructure in particular is a dynamic activity and continuing process.  As  per  the  information  reported  to  and  tracked  by  Indian  Computer  Emergency Response  Team  (CERT-In),  a  total  no.  of  44679,  49455,  50362  and    27482  cyber  security incidents were observed during  the year 2014, 2015, 2016 and 2017 (till June)  respectively. The types of cyber security incidents include phishing, scanning/probing, website intrusions and defacements, virus/malicious code, ransomware, Denial of Service attacks, etc. No separate data with  regard  to  the  losses  incurred  by  the  Indian  companies  as  a  result  of  cyber  attacks  is maintained  by  Indian  Computer  Emergency  Response  Team  (CERT-In)  or  Ministry  of Corporate Affairs.

(b) and (c): The Information Technology Act, 2000, as amended from time to time,   provides legal framework to deal with the cyber security breaches.

(d) and (e): The Indian Computer Emergency Response Team (CERT-In) has been designated as the nodal agency for responding to cyber security incidents in the country as per provisions of Section 70B of the Information Technology Act, 2000 as amended from time to time. National Critical Information Infrastructure Protection Centre (NCIIPC) has been created as per provision of  Section  70A  of  the  Information  Technology  Act,  2000  to  act  as  the  nodal  agency  for protection of critical information infrastructure. Information Technology Act 2000 provides for punishment for various cyber crimes. CERT-In is  operating a round the clock incident response held  desk,  issuing  alerts  and  advisories  regarding  latest  cyber  threats/vulnerabilities  and countermeasures,  conducting  training  programs  on  specific areas of cyber  security  and conducting  mock  drills  to  enable  assessment  of  cyber  security  posture  and  preparedness  of organizations.

*******