Lok Sabha Question No. 1083 (UNSTARRED), answered on 2023-07-26
Subject: Cyber Attack on Government Website
Ministry: ELECTRONICS AND INFORMATION TECHNOLOGY
Asked by: P.R. Natarajan

## GOVERNMENT OF INDIA MINISTRY OF ELECTRONICS AND INFORMATION TECHNOLOGY

## LOK SABHA UNSTARRED QUESTION NO. 1083

TO BE ANSWERED ON: 26.07.2023

## CYBER ATTACK ON GOVERNMENT WEBSITE

## 1083.   SHRI NATARAJAN P.R.:

Will the Minister of Electronics and Information Technology be pleased to state:

- (a) whether the Government has introduced a new national cyber security policy in the light of recent cyber attacks on Government websites;
- (b) if so, the details thereof along with the proposed timelines for it's implementation and if not, the reasons therefor;
- (c)  whether  the  Government  has  taken  any  steps  in  this  regard  to  mitigate  citizens vulnerablity to cyber attacks;
- (a) whether the Government intends to co-ordinate with other countries to develop a global legal framework on cyber terrorism; and
- (e) if so, the details thereof?

## ANSWER

## MINISTER OF STATE FOR ELECTRONICS AND INFORMATION TECHNOLOGY (SHRI RAJEEV CHANDRASEKHAR)

- (a):The Government is committed to ensure that the Internet in India is Open, Safe & Trusted and  Accountable  for  all  users.  The  National  Security  Council  Secretariat  (NSCS)  has formulated  a  draft  National  Cyber  Security  Strategy  2021,  which  holistically  looks  at addressing the issues of security of national cyberspace.

(b):Cybersecurity is a continuous  area of  focus  for  various  Governmentministriesand departments,  with  the  active  involvement  of  Indian  Computer  Emergency  Response  Team (CERT-In) and National Informatics Centre (NIC).The CERT-In  is notified by the CentralGovernment under section 70B of the Information Technology Act, 2000 to serve as thenational agency for incident response. NIC provides secure IT and E-Governance services to Government departments.

(c):With  the  expansion  of  the  Internet  and  more  and  more  Indians  coming  online,  the possibility  that  Digital  Nagrik  or  citizens  being  exposed  to  user  harms  and  criminality  has also increased.  Government is fully cognizant and aware of various cyber security threats and has taken following measures to mitigate citizens vulnerability to cyber-attacks:

- i. On  observing  a  incident,  CERT-In  notifies  the  affected  organisations  along  with remedial  actions  to  be  taken,  and  coordinates  incident  response  measures  with affected organisations, service providers, respective sector regulators and law enforcement agencies.
- ii. CERT-In  operates  the  National  Cyber  Coordination  Centre  to  generate  situational awareness regarding existing and potential cyber security threats.
- iii. CERT-In  operates  an  automated  cyber-threat  exchange  platform  for  proactively collecting, analysing and sharing tailored alerts with organisations across sectors for proactive threat mitigation actions by them.
- iv. Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre) is operated by CERT-In to detect malicious programs and free tools to remove the same, and to provide cyber security tips and best practices for citizens and organisations.
- v. CERT-In  has  empanelled  150  security  auditing  organisations  to  support  and  audit implementation of Information Security Best Practices.
- vi. A Cyber Crisis Management Plan for countering  cyber-attacks  and cyber-terrorism, formulated by CERT-In, for implementation by all Ministries and Departments of the Central Government, State Governments and their organisations and critical sectors.
- vii. The  Indian  Cyber  Crime  Coordination  Centre  (I4C)  under  the  Ministry  of  Home Affairs  is  designated  as  the  nodal  point  in  the  fight  against  cybercrime.  A  tollfree number  1930  is  made  operational  for  citizens  to  get  assistance  in  lodging  online complaints in their own language. To spread awareness on cybercrime, the Ministry of Home  Affairs  has  taken  several  steps  that  include  dissemination  of  messages  on cybercrime through the Twitter handle @cyberDost and radio campaigns.
- viii. RBI has issued various instructions in respect of security and risk mitigation measures related to electronic/digital transactions. This cover  securing card transactions, securing payments through Internet banking / electronic payments, ATM transactions, prepaid  payment  instruments  (PPIs),  limiting  customer  liability  on  unauthorized electronic  banking  transactions,  including  PPIs  issued  by  authorised  non-banks, safeguarding against email spoofing attacks, etc.
- ix. CERT-In issues alerts and advisories regarding latest cyber threats/vulnerabilities and countermeasures to protect computers and networks, on an ongoing basis.
- x. Cyber  security  mock  drills  are  conducted  to  enable  assessment  of  cyber  security posture and preparedness of organisations in the government and critical sectors.
- xi. Regular  training  programmes  for  network  and  system  administrators  and  the  Chief Information  Security  Officers  of  government  and  critical  sector  organisations  are conducted  by  CERT-In,  for  securing  the  information  technology  infrastructure  and mitigating cyber-attacks.
- xii. The  Ministry  of  Electronics  and  Information  Technology  conducts  programmes  to generate information security awareness. Specific books, videos and online materials are  developed  for  children,  parents  and  general  users  about  information  security, which  are disseminated through portals such  as  www.infosecawareness.in  and www.csk.gov.in.

(d) and (e): Pursuant to United Nations General Assembly resolution 75/282, adopted in May 2021,  an  Ad  Hoc  Committee  to  elaborate  a  Comprehensive  International  Convention  on Countering the Use of Information and Communications Technologies for Criminal Purposes was established with all member states of the United Nations as part of the Ad Hoc Committee. India has proposed criminalisation of "cyber terrorism" under the Convention.

******