Mains · GS Paper III · 16 questions

Cyber security, media & money-laundering

Every question UPSC has set on this line of the GS Paper III syllabus, newest first — with an approach for each.

Asked in 10 of 11 years

UPSC syllabus (verbatim): “Challenges to internal security through communication networks, role of media and social networking sites in internal security challenges, basics of cyber security; money-laundering and its prevention.” Sub-topics in the detailed syllabus →

2026

GS Paper III 2026 · Q9

10 marks · 150 words

Explain how fake news and disinformation pose threat to Internal Security and Public Order in Indian context ? In this regard, discuss salient features of amendments in respect of Information Technology (Intermediatory Guidelines and Digital Media Ethics Code) Rules 2021.

🧭 How to think about this question · directive: “explain / discuss”

Decode the demand

Two directives, two parts: 'explain how' fake news and disinformation threaten internal security and public order; 'discuss salient features' of the amendments to the IT Rules, 2021. One heading each, neither optional.
The issue in one line: a rumour reaches the crowd before the correction does, so the State regulates intermediaries, and every amendment is tested against Article 19.
Must answer: the mechanisms of harm (mob, communal, hostile state, deepfake, trust); the key feature of each amendment year by year; the constitutional limit set by the courts.
The trap: writing 'social media is dangerous' in general terms, or listing the 2021 Rules themselves instead of the amendments, or leaving out the courts' pushback.

Think in a structure

Open with the speed gap between rumour and correction, then name the Rules and Article 19 in one line.
Threats in dimensions: one point per mechanism, each carrying a reason; a real court order or government action as the sub-point.
Amendments as a timeline, then one point per year with its defining feature; close the section with the Shreya Singhal test as the yardstick.
End positively: three things a district administrator can do, then Article 19(2) as the anchor that holds order and liberty together.

Facts checked at source (6)· open

The February 2026 amendment requires platforms to label permissible AI-generated content and attach traceable metadata.PIB — MeitY reply in Lok Sabha (25 March 2026) ↗“Platforms are also required to ensure clear labelling and traceable metadata for permissible AI-generated content, so that users can easily identify synthetically generated material and prevent deception or misuse”
Unlawful content must now be removed within three hours of a court order or a reasoned government intimation.PIB — MeitY reply in Lok Sabha (25 March 2026) ↗“Social media platforms and other intermediaries are required to remove unlawful content within three hours of the receipt of an order of a court of competent jurisdiction or a reasoned intimation by the Appropriate Government or its agency”
In Shreya Singhal (2015) the Supreme Court struck down Section 66A of the IT Act on substantive grounds.Supreme Court — Shreya Singhal v. Union of India (2015), via Indian Kanoon ↗“Having struck down Section 66A on substantive grounds, we need not decide the procedural”
The Court noted that Section 69A, unlike 66A, is tied to subject matters listed in Article 19(2).Supreme Court — Shreya Singhal v. Union of India (2015), via Indian Kanoon ↗“it provided for some of the subject matters contained in Article 19(2) in Section 69A . We would be doing complete violence to the language of Section 66A if we were to read into it”
In September 2024 the Bombay High Court declared the 2023 IT Rules amendment creating Fact Check Units unconstitutional and struck it down (LiveLaw report).LiveLaw (legal news) — Bombay High Court strikes down 2023 amendment to IT Rules on Fact Check Units ↗“the Bombay High Court division bench today declared amendment to the IT Rules, 2021, "unconstitutional" and struck down the said amendment, which allowed the Central government to establish Fact Check Units (FCUs)”
In June 2020 the Government blocked 59 mobile apps under Section 69A of the IT Act as prejudicial to sovereignty, integrity, security and public order.PIB — Government Bans 59 mobile apps (29 June 2020) ↗“has decided to block 59 apps”

Question: UPSC's CS (Main) 2026, GS Paper III — paper ↗. Guidance: Minimalist IAS, checked 8 Nov 2026 (how we verify). ·

Model answer· 373words · Minimalist IAS

A rumour reaches the crowd before the police do: forwarded messages have triggered lynchings, riots and panic within hours. The IT Rules, 2021, amended four times since, are the State's response, tested each time against Article 19.

How fake news and disinformation threaten internal security and public order

Mob violence: child-lifting rumours on messaging apps have turned crowds into lynch mobs before anyone could verify.
Communal incitement: doctored videos and old clips recast as fresh attacks turn local disputes into riots.
Hostile propaganda: adversary states and terror groups push narratives during conflicts to demoralise, recruit and radicalise.
- June 2020: 59 apps blocked under Section 69A as prejudicial to sovereignty, security and public order.
Deepfakes: synthetic voices of leaders or officials can spread false orders or fake surrenders.
Eroded trust: election misinformation and false claims against courts, agencies and vaccines weaken the consent on which order rests.

The full answer goes on to cover

Salient features of the amendments to the IT Rules, 2021
What a district administrator can do

With 1 timeline you can reproduce in the exam.

Read the full model answer (373 words) →

Prepared by Minimalist IAS to the answer standard of Shivam Singh (mentor, 7 years) · facts checked against official sources (how we verify) · updated 8 Nov 2026. UPSC publishes no model answers: compare your structure and coverage with this, then write your own.

GS Paper III 2026 · Q20

15 marks · 250 words X-Ray · Core #39

Discuss counterfeit currency and money laundering as major sources of terror funding in India. State the actions being taken at International level to check these menaces. Highlight the role of Financial Action Task Force (FATF) and methods of compliance by its member states in preventing terror funding.

🧭 How to think about this question · directive: “discuss / state / highlight”

Decode the demand

Three directives, three parts: 'discuss' the two funding channels with reasons and India's exposure; 'state' the international actions (a list, not an argument); 'highlight' FATF's role and how members comply. Each needs its own heading.
The issue in one line: terror runs on money, and fake notes plus laundered cash are the two pipes that India must choke along with the world.
The trap: writing a general essay on terrorism, or treating FATF as just 'the grey list'. The examiner wants the mechanics: how the money moves, which UN resolution binds whom, which FATF tools press states, and what compliance looks like in a bank or a ministry.
Carry data: India's 2024 FATF rating, Pakistan's exit from monitoring, one UN convention and two resolutions, the 40 Recommendations.

Think in a structure

Open with why finance matters to terror, then the paradox: India rated well by FATF yet both channels stay live.
Channels as dimensions: fake notes, hawala, charities and shells, narco and crypto; a flowchart of laundering shows you understand the process, not just the names.
International actions as a list, FATF as standard-setter plus peer pressure, compliance as a table of method, state action and India's instrument.
End from India's seat: five measures a Home or Finance ministry officer can act on, then close on the UN resolution that made terror finance every state's duty.

Facts checked at source (4)· open

FATF's 2024 Mutual Evaluation placed India in the 'regular follow-up' category, shared by only four other G20 countries.PIB — FATF adopts India's Mutual Evaluation Report (28 June 2024) ↗“places India in the ‘regular follow-up’ category, a distinction shared by only four other G20 countries.”
FATF Plenary, October 2022: Pakistan completed 34 action items under plans set in June 2018 and June 2021 and is no longer subject to increased monitoring.FATF — Outcomes of the FATF Plenary, 20-21 October 2022: jurisdictions no longer under increased monitoring ↗“Pakistan has strengthened the effectiveness of its AML/CFT regime and addressed technical deficiencies to meet the commitments of its action plans regarding strategic deficiencies that the FATF identified in June 2018 and June 2021, the latter of which was completed in advance of the deadlines, encompassing 34 action items in total.”
FATF's 2024 Mutual Evaluation recognised India's mitigation of ML/TF risks, including laundering of proceeds of corruption, fraud and organised crime, and its shift from a cash-based to a digital economy.PIB — FATF Mutual Evaluation Report places India in 'regular follow-up' (Ministry of Finance, June 2024) ↗“Mitigating the risks arising from ML/TF, including the laundering of proceeds from corruption, fraud, and organised crime. Effective measures implemented by India to transition from a cash-based to a digital economy to reduce ML/TF risks.”
FATF credited the JAM trinity and stringent cash-transaction regulations for raising financial inclusion and digital transactions, cutting ML/TF risk.PIB — FATF Mutual Evaluation Report on India (June 2024) ↗“Implementation of the JAM (Jan Dhan, Aadhaar, Mobile) Trinity, along with stringent regulations on cash transactions, has led to a significant increase in financial inclusion and digital”

Question: UPSC's CS (Main) 2026, GS Paper III — paper ↗. Guidance: Minimalist IAS, checked 8 Nov 2026 (how we verify). ·

Model answer· 589words · Minimalist IAS

Terror needs money for recruits, weapons and propaganda, so choking finance is as decisive as neutralising cadres. FATF's 2024 evaluation placed India in 'regular follow-up', a category shared by only four other G20 countries, yet fake notes and laundering keep the funding lines alive.

Counterfeit currency and money laundering as sources of terror funding

Counterfeit currency: high-quality fake Indian currency notes printed abroad enter through porous borders, paying operatives while eroding trust in the rupee.
- Entry points cluster along the Bangladesh and Nepal frontiers; the FICN Coordination Group pools BSF, NIA and state inputs.
Law treats it as terror: UAPA counts damage to monetary stability through high-quality counterfeit currency as a terrorist act, not mere forgery.
Hawala and cash couriers: value moves on trust without records, so funds reach cadres untraced and outside bank supervision.
Misuse of charities and shell firms: donations and front companies disguise terror money as welfare or trade.
Narco-terror and crypto-assets: heroin dropped by drones across the Punjab border and virtual assets fund networks beyond banks.
Risks FATF flagged: India's 2024 evaluation listed laundering of proceeds of corruption, fraud and organised crime among its main threats.

The full answer goes on to cover

Actions at the international level
Role of FATF
Methods of compliance by member states
Way forward for India

With 1 table you can reproduce in the exam.

Read the full model answer (589 words) →

2024

GS Paper III 2024 · Q10

10 marks · 150 words

Describe the context and salient features of the Digital Personal Data Protection Act, 2023.

Approach · directive: “describe”

What it asks · Explain why India needed a data-protection law and list its main provisions.

It asks 2 things — answer each

Describe the context of the DPDP Act 2023: the privacy judgment, committee, earlier Bills and the digital economy's needs
Describe its salient features: scope, consent, rights, duties, children, cross-border transfer, Board, penalties and exemptions

Open with · Constitutional background: the Supreme Court's recognition of privacy as a fundamental right in K.S. Puttaswamy (2017) made a data-protection statute a constitutional necessity; the DPDP Act 2023 is India's first such law.

Cover

Context: Puttaswamy (2017), a large digital economy with breaches, the Justice B.N. Srikrishna Committee (2018), the 2019 Bill withdrawn in 2022 after JPC review.
Scope: digital personal data processed in India, and abroad if goods or services are offered to people in India.
Consent and 'legitimate uses' (Section 7); rights to access, correction, erasure, grievance redress and nomination; Consent Managers registered with the Board.
Duties: Data Fiduciaries secure data and report breaches; Significant Data Fiduciaries need a DPO, audits and impact assessments.
Children: under 18; verifiable parental consent; tracking and targeted advertising barred.
Cross-border transfer allowed except to notified countries (Section 16); Data Protection Board adjudicates; penalties up to ₹250 crore.
Concerns: wide State exemptions, executive-appointed Board, Section 44(3) narrowing RTI Act clause 8(1)(j) to 'information which relates to personal information'.

Close with · With its Rules notified on 14 November 2025, the Act's credibility rests on an independent Board and on State exemptions that honour the privacy standard Puttaswamy set.

Add value (verified)

The Act's Schedule sets its highest penalty — up to ₹250 crore — for a Data Fiduciary's failure to take reasonable security safeguards against a personal data breach.The Digital Personal Data Protection Act, 2023 (MeitY) ↗“May extend to two hundred and fifty crore rupees.”
Since then: the DPDP Rules, 2025 were notified on 14 November 2025, operationalising the Act.PIB — DPDP Rules, 2025 Notified (17 November 2025) ↗“The Government of India notified the Digital Personal Data Protection (DPDP) Rules, 2025 on 14 November 2025.”
DPDP Act 2023, Section 2(f): a child is an individual who has not completed eighteen years.The Digital Personal Data Protection Act, 2023 (Gazette text, MeitY), Section 2(f) ↗““child” means an individual who has not completed the age of eighteen years”
DPDP Act 2023, Section 9(1): verifiable consent of the parent or lawful guardian is required before processing a child's personal data.The Digital Personal Data Protection Act, 2023, Section 9(1) ↗“The Data Fiduciary shall, before processing any personal data of a child or a person with disability who has a lawful guardian obtain verifiable consent of the parent of such child or the lawful guardian, as the case may be, in such manner as may be prescribed.”
DPDP Act 2023, Section 2(g): a Consent Manager is registered with the Board and acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent.The Digital Personal Data Protection Act, 2023, Section 2(g) ↗““Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent”
DPDP Act 2023, Section 16(1): the Centre may by notification restrict transfer of personal data to notified countries or territories outside India.The Digital Personal Data Protection Act, 2023, Section 16(1) ↗“The Central Government may, by notification, restrict the transfer of personal data by a Data Fiduciary for processing to such country or territory outside India as may be so notified.”
DPDP Act 2023, Section 44(3): substitutes RTI Act Section 8(1)(j) with 'information which relates to personal information'.The Digital Personal Data Protection Act, 2023, Section 44(3) (amendment of the Right to Information Act, 2005) ↗“In section 8 of the Right to Information Act, 2005, in sub-section (1), for clause (j), the following clause shall be substituted, namely:— “(j) information which relates to personal information;”.”

Question: UPSC's CS (Main) 2024, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 227words · Minimalist IAS

The Supreme Court's recognition of privacy as a fundamental right in K.S. Puttaswamy (2017) made a data-protection law a constitutional necessity; the Digital Personal Data Protection Act, 2023 is India's first.

Context

Scale and long gestation: a vast digital economy with recurring breaches; the Justice B.N. Srikrishna Committee (2018) drafted the 2019 Bill, withdrawn in 2022 after Joint Parliamentary Committee review.

The full answer goes on to cover

Salient features

Read the full model answer (227 words) →

Prepared by Minimalist IAS to the answer standard of Shivam Singh (mentor, 7 years) · facts checked against official sources (how we verify) · updated 3 Oct 2026. UPSC publishes no model answers: compare your structure and coverage with this, then write your own.

GS Paper III 2024 · Q20

15 marks · 250 words

Social media and encrypting messaging services pose a serious security challenge. What measures have been adopted at various levels to address the security implications of social media? Also suggest any other remedies to address the problem.

Approach · directive: “what / suggest”

What it asks · Explain the security risks of social media and encrypted messaging, list legal, institutional and platform-level measures, and suggest further remedies.

It asks 3 things — answer each

Explain the security challenge posed by social media and encrypted messaging
What measures have been adopted at various levels: legal, institutional, platform and international
Suggest other remedies to address the problem

Open with · Puttaswamy (2017) made privacy 'an intrinsic part of the right to life and liberty', yet the same encrypted channels carry terror planning, disinformation and fraud: over ₹7,000 crore was saved from cyber fraud through I4C's reporting system by December 2025.

Cover

Challenges: fake news and deepfakes triggering violence, terror recruitment, cross-border propaganda, encrypted planning and platform-run frauds.
Legal: IT Act 2000, Section 69A blocking (upheld in Shreya Singhal, 2015); IT Rules 2021 on due diligence, grievance officers, takedowns and first-originator traceability.
Institutional: CERT-In, the Indian Cyber Crime Coordination Centre (I4C) with the 1930 helpline and CFCFRMS (2021), cyber cells, and Grievance Appellate Committees.
Platform level: Chief Compliance Officer resident in India, grievance acknowledged in 24 hours and resolved in 15 days, fact-checking partnerships.
International: MLATs and Interpol; the UN Convention against Cybercrime adopted in December 2024 and opened for signature at Hanoi in October 2025.
Remedies: digital literacy, AI tools against deepfakes, faster treaty-based evidence access, a cyber cadre, and lawful access that passes Puttaswamy's legality–need–proportionality test.

Close with · Security and privacy are conditions of each other: every measure should pass Puttaswamy's three-fold test of legality, need and proportionality, so that Digital India stays both safe and free.

Add value (verified)

The IT Rules 2021 require large messaging platforms to enable identification of the first originator of information for specified serious offences.PIB — Government notifies IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 ↗“Significant social media intermediaries providing services primarily in the nature of messaging shall enable identification of the first originator of the information”
Puttaswamy (2017): privacy is an intrinsic part of the right to life and liberty, subject to the same restraints as other Part III freedoms.Justice K.S. Puttaswamy v. Union of India (2017), Supreme Court judgment text (Indian Kanoon) ↗“The right to privacy, which is an intrinsic part of the right to life and liberty, and the freedoms embodied in Part III is subject to the same restraints which apply to those freedoms.”
Puttaswamy (2017): any invasion of life or liberty must meet the three-fold test of legality, need and proportionality.Justice K.S. Puttaswamy v. Union of India (2017), Supreme Court judgment text (Indian Kanoon) ↗“An invasion of life or personal liberty must meet the three-fold requirement of (i) legality, which postulates the existence of law; (ii) need, defined in terms of a legitimate state aim; and (iii) proportionality which ensures a rational nexus between the objects and the means adopted to achieve them”
IT Rules 2021: the grievance officer must acknowledge a complaint within 24 hours and resolve it within 15 days.PIB — Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 (25 Feb 2021) ↗“Grievance Officer shall acknowledge the complaint within twenty four hours and resolve it within fifteen days from its receipt.”
Over ₹7,000 crore saved in more than 23 lakh complaints through I4C's Citizen Financial Cyber Fraud Reporting and Management System (Rajya Sabha reply, December 2025).Akashvani News — Over Rs 7,000 crore saved through CFCFRMS (17 Dec 2025) ↗“more than seven thousand crore rupees have been saved in more than 23 lakh complaints so far through the Citizen Financial Cyber Fraud Reporting and Management System”
The UN Convention against Cybercrime was adopted on 24 December 2024 and opened for signature at Hanoi on 25 October 2025.UNODC — United Nations Convention against Cybercrime ↗“the Convention was adopted by the General Assembly on 24 December 2024, opened for signature on 25 October 2025 at a signing ceremony held in Hanoi, Viet Nam”

Question: UPSC's CS (Main) 2024, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 373words · Minimalist IAS

In Puttaswamy (2017) the Supreme Court held privacy to be an intrinsic part of 'life and personal liberty' under Article 21. Yet encrypted channels now carry terror planning, disinformation and fraud: I4C's reporting system had saved over ₹7,000 crore across 23 lakh complaints by December 2025. The State must see enough to protect without seeing everything.

The security challenge

Threats: fake news and deepfakes that trigger communal violence; terror recruitment and propaganda; cross-border influence operations; encrypted planning that evades interception; and cyber-frauds run through platforms.

The full answer goes on to cover

Measures adopted at various levels
Other remedies

With 1 table you can reproduce in the exam.

Read the full model answer (373 words) →

2023

GS Paper III 2023 · Q20

15 marks · 250 words X-Ray · Core #63

Give out the major sources of terror funding in India and the efforts being made to curtail these sources. In the light of this, also discuss the aim and objective of the ‘No Money for Terror (NMFT)’ Conference recently held at New Delhi in November 2022.

Approach · directive: “give out / discuss”

What it asks · Identify the main sources of terror funding, the measures taken to cut them, and explain the aim and objectives of the November 2022 'No Money for Terror' conference in New Delhi.

It asks 3 things — answer each

Identify the main sources of terror funding in India
Set out the measures taken to curtail those sources
Discuss the aim and objectives of the November 2022 'No Money for Terror' Conference in New Delhi

Open with · Terror groups need money as much as weapons; in June 2024 the FATF placed India in its 'regular follow-up' category, shared by only four other G20 countries, recognising a decade of work on choking terror funds.

Cover

Sources: state sponsorship, hawala and cash couriers, fake currency, drug trafficking and narco-terror, extortion by insurgent and Maoist groups, misuse of charities; new channels in crowdfunding, virtual assets, online payments and shell companies.
Legal steps: UAPA (amended 2004 and 2019; the 2019 Act passed on 2 August 2019) makes terror financing an offence; PMLA 2002, with virtual digital asset service providers brought in as reporting entities in March 2023.
Agencies and policy: FIU-IND, the NIA's terror-funding and fake-currency cell, ED and NCB; KYC and reporting norms, hawala monitoring, demonetisation 2016, FATF membership since 2010.
FATF 2024: Mutual Evaluation Report adopted at the June 2024 Singapore plenary placed India in 'regular follow-up', shared by only four other G20 countries.
NMFT (18-19 November 2022): third ministerial conference after Paris 2018 and Melbourne 2019; 75 countries and bodies; sessions on global trends, formal and informal channels, emerging technologies, international cooperation.
Permanence: India proposed a permanent NMFT secretariat.
Way forward: faster prosecutions, pressure on state sponsors, cross-border regulation of virtual assets, intelligence and legal cooperation.

Close with · Denying terrorists their money needs strict domestic enforcement and sustained international cooperation; a permanent No Money for Terror secretariat, as India offered in New Delhi, would make that cooperation institutional rather than episodic.

Add value (verified)

PIB records that the November 2022 conference built on the Paris (2018) and Melbourne (2019) meetings and aimed to strengthen global cooperation in denying finance to terrorists.PIB (Prime Minister's Office): PM attends third 'No Money for Terror' Ministerial Conference on Counter-Terrorism Financing in New Delhi ↗“The conference will build on gains and learnings of the previous two conferences (held in Paris in April 2018 and in Melbourne in November 2019) and will work towards enhancing global cooperation to deny finances to terrorists”
FATF Mutual Evaluation of India (PIB, 28 June 2024): the report adopted at the Singapore plenary of 26-28 June 2024 placed India in the 'regular follow-up' category, shared by only four other G20 countries.PIB: FATF adopts Mutual Evaluation Report of India in its June 2024 Plenary held in Singapore (Ministry of Finance) ↗“The Mutual Evaluation Report of India, which was adopted in the FATF plenary held in Singapore between June 26 th and June 28 th , 2024, places India in the ‘regular follow-up’ category, a distinction shared by only four other G20 countries.”
FIU-IND (PIB, December 2023): virtual digital asset service providers were brought under the AML-CFT framework of the Prevention of Money Laundering Act, 2002 in March 2023.PIB: FIU IND issues compliance Show Cause Notices to nine offshore Virtual Digital Assets Service Providers (Ministry of Finance) ↗“Virtual Digital Assets Service Providers (VDA SPs) were brought into the ambit of Anti Money Laundering/Counter Financing of Terrorism (AML-CFT) framework under the provisions of the Prevention of Money Laundering Act (PML) Act, 2002 in March 2023.”
MHA (PIB, November 2022): the third NMFT conference's deliberations covered global trends in terrorism and terrorist financing, formal and informal channels of funds, emerging technologies and international cooperation, with representatives of 75 countries and international bodies.PIB: 3rd Ministerial Conference on Countering Financing of Terrorism, No Money for Terror, to be held in New Delhi on November 18 and 19 (curtain raiser) ↗“use of formal and informal channels of funds for terrorism, emerging technologies and terrorist financing and requisite international co-operation to address related challenges. The Conference intends to bring together representatives of 75 countries and international bodies for extended deliberations over two days.”
Union Home Minister's concluding remarks at NMFT (19 November 2022): India sensed the need for permanency of the NMFT initiative and proposed a permanent secretariat.PIB: Union Home Minister delivered concluding remarks at the closing session of the 3rd No Money For Terror Conference, New Delhi ↗“India has sensed the need for permanency of this unique initiative of NMFT, in order to sustain the continued global focus on countering the financing of terrorism and now the time is ripe for a permanent Secretariat to be established.”
MHA backgrounder (2026): the Unlawful Activities (Prevention) Amendment Act, 2019, passed by Parliament on 2 August 2019, expanded the powers of the Central Government and investigative agencies.PIB press note: 12 Years of India's Zero Tolerance Against Terror (Ministry of Home Affairs), section on UAPA Amendment 2019 ↗“The Unlawful Activities (Prevention) Amendment Act, 2019 UAPA Amendment strengthened India’s anti-terror legal framework by expanding the powers of the Central Government and investigative agencies. It is the most significant legislative reform of this decade, passed by Parliament on 2 August 2019”

Question: UPSC's CS (Main) 2023, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 378words · Minimalist IAS

Terror groups need money as much as weapons, for recruits, arms, safe houses and propaganda. In June 2024 the FATF placed India in its 'regular follow-up' category, a distinction shared by only four other G20 countries, recognising a decade of work on exactly this front.

Major sources of terror funding in India

State sponsorship: cross-border support routed through handlers.
Hawala and cash: informal value-transfer networks and couriers.
Fake currency: counterfeit notes pushed across the border.
Narcotics: drug trafficking and narco-terror through Punjab and Jammu and Kashmir.
Extortion and charities: levies by insurgent and Maoist groups; misuse of non-profits.
New channels: crowdfunding, virtual assets, online payment platforms and shell companies.

Channel	Example	Counter-step
Informal	Hawala, cash couriers	PMLA reporting, FIU-IND analysis
Physical	Fake currency, drugs	Demonetisation 2016, NIA cell, NCB
Digital	Crypto, crowdfunding	Virtual-asset providers under PMLA, 2023

The full answer goes on to cover

Efforts to curtail these sources
Aim and objectives of the 'No Money for Terror' Conference, November 2022
Way forward

Read the full model answer (378 words) →

2022

GS Paper III 2022 · Q19

15 marks · 250 words

What are the different elements of cyber security ? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy.

Approach · directive: “what / examine the extent”

What it asks · List the elements of cyber security, then assess how far India has built a comprehensive national cyber security strategy in view of current challenges.

It asks 2 things — answer each

What: the different elements of cyber security
Examine, keeping the challenges in view, the extent to which India has developed a comprehensive National Cyber Security Strategy: what exists, what is missing and a verdict

Open with · Cyber security protects the networks, devices and data of government, business and citizens; a national strategy binds its technical, legal and institutional elements, and that strategy is the piece India still lacks.

Cover

Technical elements: network, application, endpoint and cloud security, identity and access control, data protection and encryption, incident response and recovery, and user awareness.
National elements: protection of critical information infrastructure, law and policy, institutions, a skilled workforce, research and international cooperation.
Challenges: state-linked and criminal attacks, ransomware and data breaches, dependence on foreign hardware and software, IoT and 5G expansion, skill shortages and under-reporting.
India's framework: IT Act, 2000 (amended 2008), CERT-In, NCIIPC for critical infrastructure, National Cyber Security Policy 2013, the Indian Cyber Crime Coordination Centre and the Defence Cyber Agency.
Gaps: the 2013 policy is dated and a full national strategy was still awaited at the time of the paper; agency roles overlap, and state capacity and private-sector obligations are limited.
Way forward: a published, funded strategy with clear roles, mandatory incident reporting, standards and audits, indigenous technology, skilling, public-private partnership and treaty cooperation.

Close with · A published, funded strategy that binds Centre, States and industry is the missing keystone; until then the pieces protect but do not secure Digital India.

Add value (verified)

CERT-In directions of 28 April 2022 (under section 70B(6) of the IT Act, 2000): service providers, intermediaries, data centres, body corporates and government organisations must report cyber incidents to CERT-In within 6 hours of noticing them.Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 — CERT-In, 28 April 2022 ↗“Any service provider, intermediary, data centre, body corporate and Government organisation shall mandatorily report cyber incidents as mentioned in Annexure I to CERT-In within 6 hours of noticing such incidents or being brought to notice about such incidents.”
PIB (March 2025): NCIIPC is the national nodal agency under section 70A of the IT Act for critical information infrastructure protection.PIB, MeitY (March 2025): Government taking measures to strengthen national preparedness against cybersecurity threats (Parliament reply) ↗“The National Critical Information Infrastructure Protection Centre (NCIIPC) has been notified as the national nodal agency under the provisions of section 70A of IT Act for Critical Information Infrastructure Protection.”
PIB (March 2025): CERT-In is the national agency for responding to cyber security incidents under section 70B of the IT Act, 2000.PIB, MeitY (March 2025): Government taking measures to strengthen national preparedness against cybersecurity threats (Parliament reply) ↗“The Indian Computer Emergency Response Team (CERT-In) is designated as the national agency under the provisions of section 70B of the Information Technology Act, 2000 for responding to cyber security incidents.”
PIB (March 2025): MeitY's Cyber Surakshit Bharat programme, in PPP mode, trains CISOs and the IT community of Central and State governments, banks and PSUs.PIB, MeitY (March 2025): Government taking measures to strengthen national preparedness against cybersecurity threats (Parliament reply) ↗“The Ministry of Electronics and Information Technology (MeitY) initiated Cyber Surakshit Bharat (CSB) programme in Public Private Partnership (PPP) mode to educate & enable the Chief Information Security Officers (CISOs) & broader IT community of Central/State Governments, Banks and PSUs to address the challenges of cyber security.”
PIB (March 2025): the MHA created the Indian Cybercrime Coordination Centre (I4C) to deal with cybercrimes in a coordinated way; CERT-In runs an automated threat-intelligence exchange.PIB, MeitY (March 2025): Government taking measures to strengthen national preparedness against cybersecurity threats (Parliament reply) ↗“Ministry of Home Affairs (MHA) has created Indian Cybercrime Coordination Centre (I4C) to deal with cybercrimes in a coordinated and effective manner. CERT-In operates an automated cyber threat intelligence exchange platform”
PIB (5 January 2025): the draft Digital Personal Data Protection Rules operationalise the Digital Personal Data Protection Act, 2023.PIB, MeitY (5 January 2025): Draft Digital Personal Data Protection Rules ↗“These rules seek to operationalize the Digital Personal Data Protection Act, 2023 (DPDP Act), in line with India’s commitment to create a robust framework for protecting digital personal data.”

Question: UPSC's CS (Main) 2022, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 372words · Minimalist IAS

Cyber security protects the networks, devices and data of government, business and citizens. A national strategy binds its technical, legal and institutional elements into one plan with clear accountability; India has many of the elements, not yet the strategy.

The different elements of cyber security

Technical: securing networks, applications, endpoints and the cloud; encryption; backup and recovery.
Human: user awareness, a skilled workforce and a security culture inside organisations.
National: protection of critical information infrastructure, law and policy, institutions, research and international cooperation.

The full answer goes on to cover

The challenges in cyber security
How far India has a comprehensive National Cyber Security Strategy
Way forward

Read the full model answer (372 words) →

2021

GS Paper III 2021 · Q9

10 marks · 150 words

Discuss how emerging technologies and globalisation contribute to money laundering. Elaborate measures to tackle the problem of money laundering both at national and international levels.

Approach · directive: “discuss / elaborate”

What it asks · Explain how new technologies and open borders help launderers, then set out the national and international measures against money laundering.

It asks 3 things — answer each

Discuss how emerging technologies and globalisation contribute to money laundering
Elaborate the measures to tackle money laundering at the national level
Elaborate the measures at the international level

Open with · Money laundering turns proceeds of crime into apparently clean assets through placement, layering and integration; technology and open borders speed every stage and blur the trail.

Cover

Technology: crypto assets and mixers, wallets, mule accounts, online gaming and online shell companies give speed, anonymity and layering.
Globalisation: open capital flows, offshore centres, correspondent banking and trade misinvoicing move funds across jurisdictions faster than agencies trace them.
National: PMLA 2002 (section 3 offence, attachment, reporting entities, ED); FIU-India (2004); KYC and beneficial-ownership norms.
Supporting laws: Benami Transactions (Prohibition) Amendment Act 2016, Black Money Act 2015, Fugitive Economic Offenders Act 2018; regulate virtual assets, use analytics.
International: FATF standards and mutual evaluations (India placed in 'regular follow-up' in 2024), Egmont Group, UN conventions, MLATs and tax-information exchange.

Close with · Criminals adapt faster than statutes; holding FATF's 'regular follow-up' rating through the next review needs laws, technology and cross-border cooperation upgraded together.

Add value (verified)

Section 3 of the Prevention of Money-laundering Act, 2002 defines the offence broadly, covering every stage from concealment and possession to use and projecting proceeds of crime as untainted.The Prevention of Money-laundering Act, 2002, Section 3: Offence of money-laundering (Financial Intelligence Unit-India) ↗“any process or activity connected with the proceeds of crime including its concealment, possession, acquisition or use and projecting or claiming it as untainted property shall be guilty of offence of money-laundering”
FATF adopted India's Mutual Evaluation Report at its June 2024 plenary and placed India in the regular follow-up category.News on AIR (Prasar Bharati): FATF adopts Mutual Evaluation Report of India, June 2024 ↗“India has been placed in the 'regular follow up category' in the "Mutual Evaluation Report of India" by Financial Action Task Force (FATF). The report was adopted in the FATF plenary held from the 26th to 28th June”

Question: UPSC's CS (Main) 2021, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 223words · Minimalist IAS

Money laundering turns proceeds of crime into apparently clean assets through placement, layering and integration; technology and open borders speed every stage and blur the trail.

How emerging technologies and globalisation help launderers

Crypto and mixers: move value outside banks; wallets, mule accounts and online gaming split sums below reporting thresholds.
Online shell companies: formed across jurisdictions in hours, hiding owners.
Open capital flows: offshore centres, correspondent banking and trade misinvoicing outrun investigators across borders.

The full answer goes on to cover

Measures at the national level
Measures at the international level

Read the full model answer (223 words) →

GS Paper III 2021 · Q10

10 marks · 150 words

Keeping in view India’s internal security, analyse the impact of cross-border cyber attacks. Also discuss defensive measures against these sophisticated attacks.

Approach · directive: “analyse / discuss”

What it asks · Analyse how cross-border cyber attacks threaten internal security (infrastructure, espionage, crime and terror, information) and discuss the defensive measures available.

It asks 2 things — answer each

Analyse the impact of cross-border cyber attacks on India's internal security: infrastructure, espionage, crime and terror, information, attribution
Discuss defensive measures against these attacks: institutions, law, the 2022 CERT-In directions and the way forward

Open with · In 2019 malware was found in the Kudankulam plant's administrative network, isolated from control systems according to NPCIL; as grids, payments and governance go digital, such cross-border attacks make cyberspace an internal-security front.

Cover

Critical infrastructure: power, nuclear, ports, banks and telecom can be halted remotely; Kudankulam 2019 malware in the administrative network.
Espionage against defence and strategic sectors; ransomware, fraud and crypto channels fund crime and terror; disinformation stokes unrest.
Attribution gap: proxies and foreign servers leave evidence and jurisdiction abroad, weakening deterrence.
Institutions: CERT-In (IT Act), NCIIPC (2014), Defence Cyber Agency (2018), I4C (January 2020).
Law: IT Act section 66F on cyber terrorism, security audits, trusted-source telecom rules, app blocking, data protection; CERT-In directions of 28 April 2022 require incident reporting within 6 hours.
Way forward: sectoral CERTs, skilled workforce, indigenous hardware and software, drills, partnerships on norms and evidence.

Close with · Resilience, not prevention alone, is the goal: assume breaches, detect within hours as the 2022 directions demand, recover fast and deter with partners.

Add value (verified)

CERT-In is the national agency designated under the Information Technology Act for collecting and analysing cyber-incident information and issuing alerts and emergency measures.RFC 2350 description of CERT-In, Indian Computer Emergency Response Team (Section 3.5: Functions and activities) ↗“The Information Technology Act 2000, designated CERT-In to serve as the national agency to perform the following functions in the area of cyber security: Collection, analysis and dissemination of information on cyber incidents. Forecast and alerts of cyber security incidents.”
CERT-In's directions of 28 April 2022 make service providers, intermediaries, data centres, companies and government bodies report cyber incidents within 6 hours.CERT-In Directions under section 70B(6) of the IT Act, 2000, 28 April 2022 ↗“service provider, intermediary, data centre, body corporate and Government organisation shall mandatorily report cyber incidents as mentioned in Annexure I to CERT-In within 6 hours of noticing such incidents or being brought to notice about such incidents.”
CERT-In's site describes the 2022 directions as issued under section 70B(6) of the IT Act on security practices, prevention, response and reporting of cyber incidents.CERT-In: Directions by CERT-In under section 70B of the IT Act, 2000 ↗“under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet (dated 28.04.2022)”

Question: UPSC's CS (Main) 2021, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 223words · Minimalist IAS

In 2019 malware was found in the Kudankulam plant's administrative network, isolated from control systems according to NPCIL. As grids, payments and governance go digital, such cross-border attacks make cyberspace an internal-security front.

Impact on India's internal security

Critical infrastructure: power, nuclear, ports, banks and telecom can be halted from abroad, deniably.
Espionage: state-linked groups target defence and strategic sectors, eroding military and diplomatic advantage.
Crime and terror finance: ransomware, fraud and crypto channels fund crime and terror.
Information war: disinformation and radicalisation on social media aim to trigger unrest.
Attribution gap: proxies and foreign servers put evidence and jurisdiction abroad, weakening deterrence.

The full answer goes on to cover

Defensive measures against sophisticated attacks
Way forward

With 1 table you can reproduce in the exam.

Read the full model answer (223 words) →

2020

GS Paper III 2020 · Q9

10 marks · 150 words

Discuss different types of cyber crimes and measures required to be taken to fight the menace.

Approach · directive: “discuss”

What it asks · Classify cyber crimes with examples, and list the legal, institutional, technical and awareness measures needed to check them.

It asks 2 things — answer each

Discuss the different types of cyber crime, with examples
Discuss the measures required to fight the menace

Open with · Cyber crime is any unlawful act in which a computer or network is the tool, the target or both. NCRB counted 50,035 such cases in 2020, rising to 65,893 by 2022, with fraud cases alone up from 10,395 to 17,470.

Cover

Against individuals: identity theft, phishing and online fraud, cyber stalking and bullying, sextortion, morphed images and data theft.
Against organisations and infrastructure: ransomware and malware, denial-of-service attacks, hacking, data breaches, and attacks on power grids, banks and hospitals.
Against the State and society: cyber terrorism, espionage, fake news and hate spread through social media, radicalisation, and cyber warfare.
Legal: the IT Act, 2000 (Sections 66C, 66D, 66F cover identity theft, cheating by personation, cyber terrorism) and penal law on fraud and stalking.
Institutions: CERT-In for incident response, NCIIPC for critical infrastructure, the Indian Cyber Crime Coordination Centre (I4C) and the national cyber crime reporting portal.
Prevention: cyber hygiene and public awareness, two-factor authentication, security audits, trained police and forensic labs, and cooperation with platforms and other countries.
Gaps: low reporting and conviction, cross-border jurisdiction, fast-changing technology, and a data-protection law that came late (Digital Personal Data Protection Act, 2023).

Close with · Sound law, capable institutions and alert citizens must move together, because technology changes faster than legislation; the DPDP Act's test now is enforcement.

Add value (verified)

PIB backgrounder (March 2025, citing NCRB's Crime in India): cyber crime cases registered were 50,035 in 2020, 52,974 in 2021 and 65,893 in 2022.PIB backgrounder on cyber crime (March 2025), Annexure citing NCRB Crime in India ↗“TOTAL (ALL INDIA) 50035 52974 65893 Source: ‘Crime in India’ published by NCRB.”
PIB backgrounder (March 2025, citing NCRB): cases registered under fraud among cyber crimes rose from 10,395 in 2020 to 14,007 in 2021 and 17,470 in 2022.PIB backgrounder on cyber crime (March 2025), Annexure II citing NCRB Crime in India ↗“TOTAL (ALL INDIA) 10395 14007 17470 Source: ‘Crime in India’ published by NCRB.”
Akashvani News (December 2025, on a Rajya Sabha reply): more than Rs 7,000 crore has been saved in more than 23 lakh complaints through the Citizen Financial Cyber Fraud Reporting and Management System, with the 1930 helpline for lodging complaints.Akashvani News: Over Rs 7,000 crore saved through Citizen Financial Cyber Fraud Reporting and Management System (17 December 2025) ↗“more than seven thousand crore rupees have been saved in more than 23 lakh complaints so far through the Citizen Financial Cyber Fraud Reporting and Management System.”

Question: UPSC's CS (Main) 2020, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 225words · Minimalist IAS

Cyber crime is any unlawful act in which a computer or network is the tool, the target or both. NCRB counted 50,035 such cases in 2020, rising to 65,893 by 2022, with fraud cases alone up from 10,395 to 17,470.

Different types of cyber crimes

Target	Main crimes	Legal hook
Individuals	Identity theft, phishing, stalking, sextortion	IT Act S. 66C, 66D
Organisations and infrastructure	Ransomware, denial-of-service, data breaches	CERT-In, NCIIPC
State and society	Cyber terrorism, espionage, fake news	IT Act S. 66F

Against individuals: online financial fraud, sextortion and morphed images, often targeting first-time users.

The full answer goes on to cover

Measures required to fight the menace

Read the full model answer (225 words) →

2019

GS Paper III 2019 · Q10

10 marks · 150 words

What is CyberDome Project? Explain how it can be useful in controlling internet crimes in India.

Approach · directive: “what / explain how”

What it asks · Say what CyberDome is, Kerala Police's cyber centre of excellence, and explain how such a hub, and the model behind it, can help India control internet crimes.

It asks 2 things — answer each

What CyberDome is
Explain how it can be useful in controlling internet crimes in India

Open with · Cyber crime cases registered in India rose from 52,974 in 2021 to 86,420 in 2023 (NCRB); policing at this scale needs skills the police alone lack, the gap Kerala Police's CyberDome was built to fill.

Cover

What: Kerala Police's cyber centre of excellence at Technopark, Thiruvananthapuram, a public-private partnership of departments, academia, research groups, NGOs, ethical hackers, private firms and international law-enforcement agencies.
Design: an online office of volunteer ethical hackers and cyber professionals that bridges the police's skill gap.
Prevention: threat intelligence and awareness; its Counter Child Sexual Exploitation Centre traces offenders and removes abuse material.
Investigation and capacity: forensic support, a Drone Forensic Lab for UAS and counter-UAS cases, police training and in-house tools at low cost.
National template: I4C under MHA with the cybercrime.gov.in portal, helpline 1930 and the Samanvaya analytics platform; its financial-fraud reporting system saved over Rs 8,690 crore in 24.65 lakh complaints by January 2026.
Limits: a state pilot cannot reach cross-border crime or encrypted, foreign-held data; it needs statutory backing, privacy safeguards and platform cooperation.

Close with · A CyberDome in every state, wired into I4C's Samanvaya platform and helpline 1930, turns scattered expertise into a national shield: 'a safe and secure cyber world for every citizen', Kerala's aim scaled to India.

Add value (verified)

Kerala Police's own description states the project's purpose and its public-private design.Cyberdome, Kerala Police Centre of Excellence (official website) ↗“Cyberdome is a Cyber Centre of Excellence of Kerala Police, envisaged as a high-tech public-private partnership centre of collaboration for different stakeholders in the domain of cyber security and handling of cyber crimes — in a proactive manner.”
PIB (MHA, Lok Sabha reply, 17 March 2026, NCRB Crime in India): cyber crime cases registered all-India were 52,974 in 2021, 65,893 in 2022 and 86,420 in 2023.PIB: Cyber Crime Cases (Lok Sabha, March 2026) ↗“TOTAL UT(S) 544 986 817 TOTAL (ALL INDIA) 52974 65893 86420 Source: ‘Crime in India’ published by NCRB.”
PIB (MHA, 2026): I4C's Citizen Financial Cyber Fraud Reporting and Management System had saved more than Rs 8,690 crore in over 24.65 lakh complaints by 31 January 2026; helpline 1930 takes complaints; 12.94 lakh SIM cards and 3.03 lakh IMEIs were blocked.PIB: Indian Cyber Crime Coordination Centre (2026) ↗“As per CFCFRMS operated by I4C, till 31.01.2026, financial amount of more than Rs. 8,690 Crore has been saved in more than 24.65 lakh complaints. A toll-free Helpline number ‘1930’ has been operationalized to get assistance in lodging online cyber complaints.Till 31.01.2026, more than 12.94 lakhs SIM cards and 3.03 lakhs IMEIs as reported by Police authorities have been blocked by Government of India.”
PIB (MHA, 2025): I4C's Samanvaya platform links criminals and crimes across states through analytics to strengthen cyber fraud investigations.PIB: Curbing Cyber Frauds in Digital India (2025) ↗“The Samanvaya Platform strengthens cyber fraud investigations by providing analytics-based interstate linkages of criminals and crimes.”
Kerala Police (cyberdome.kerala.gov.in): CyberDome coordinates government departments, academia, research groups, NGOs, individual experts, ethical hackers, private organisations and international law-enforcement agencies, with the aim of a safe and secure cyber world for every citizen in Kerala.Kerala Police: Cyberdome, Centre of Excellence ↗“We make collective coordination among government departments, academia, research groups, non-profit organisations, individual experts, ethical hackers, private organisations, and international law enforcement agencies — all with one aim: a safe and secure cyber world for every citizen in Kerala.”
Kerala Police (cyberdome.kerala.gov.in): flagship initiatives include the Counter Child Sexual Exploitation Centre (tracing offenders, removing CSAM) and a Drone Forensic Lab and Research Centre for UAS and counter-UAS applications in law enforcement.Kerala Police: Cyberdome, Flagship Initiatives ↗“CCSE Centre Counter Child Sexual Exploitation Centre - Preventing online crimes against children through awareness, tracing offenders and removing CSAM materials. Drone Forensic Lab & Research Centre A specialized facility for UAS and C-UAS applications in law enforcement”

Question: UPSC's CS (Main) 2019, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 218words · Minimalist IAS

Cyber crime cases registered in India rose from 52,974 in 2021 to 86,420 in 2023 (NCRB). Policing at this scale needs skills the police alone lack, the gap Kerala Police's CyberDome was built to fill.

What CyberDome is

Centre of excellence: Kerala Police's cyber hub at Technopark, Thiruvananthapuram, a public-private partnership with departments, academia, ethical hackers, industry and international law-enforcement agencies.
Design: an online office of ethical hackers and cyber professionals that bridges the police's skill gap.

The full answer goes on to cover

How it can help control internet crimes in India
Limits

With 1 table you can reproduce in the exam.

Read the full model answer (218 words) →

2018

GS Paper III 2018 · Q19

15 marks · 250 words

Data security has assumed significant importance in the digitized world due to rising cyber crimes. The Justice B. N. Srikrishna Committee Report addresses issues related to data security. What, in your view, are the strengths and weaknesses of the Report relating to protection of personal data in cyber space?

Approach · directive: “what are the strengths and weaknesses”

What it asks · Assess the Committee's report and draft Personal Data Protection Bill: its strengths (rights-based, consent, regulator, penalties) and weaknesses (State exemptions, localisation, oversight, autonomy).

It asks 3 things — answer each

Strengths of the Report in protecting personal data: coverage, rights, enforcement
Weaknesses of the Report: State exemptions, localisation, oversight, transparency and process
Your view: a verdict and what should change, with what has happened since

Open with · The Supreme Court held privacy a fundamental right in 2017; the Srikrishna Committee (July 2017) reported in July 2018 with a draft Personal Data Protection Bill aiming at 'a free and fair digital economy', and the Aadhaar judgment of 26 September 2018 commended a 'robust regime for data protection'.

Cover

Strength, coverage: one law for government and private data fiduciaries, with principles of consent, purpose and collection limitation, data minimisation and transparency, and reach over processing linked to business in India.
Strength, rights: individuals get access, correction, portability and a limited right to be forgotten; fiduciaries owe a duty of fair and reasonable processing, with privacy by design.
Strength, enforcement: an independent Data Protection Authority, breach reporting, impact assessments for significant fiduciaries, and penalties of up to ₹15 crore or 4 per cent of global turnover.
Weakness, State exemptions: wide grounds such as security of the State and public order, without prior judicial approval, weaken protection against the State itself, the largest data holder.
Weakness, localisation: a mandatory local copy of all personal data and local-only storage of 'critical' data raise costs for firms, and may not improve security; the Centre defines what is critical.
Weakness, gaps: the proposed change to the RTI Act's personal-information exemption may weaken transparency, and the regulator's independence from the executive was questioned.
Way forward: tighter checks on State access (necessity, proportionality, oversight), a truly independent regulator, workable localisation rules, and public consultation before the Bill is enacted.

Close with · A data protection law is only as strong as its limits on the State; the Court's standard of 'a careful balance between individual interests and legitimate State concerns' is the test the Srikrishna framework and its 2023 successor must keep meeting.

Add value (verified)

The Supreme Court's privacy ruling, reproduced in its Aadhaar judgment of 26 September 2018, asked the Union Government to put a robust data protection regime in place, with a careful balance between individual interests and legitimate State concerns.Justice K.S. Puttaswamy (Retd.) v. Union of India (Aadhaar), Writ Petition (Civil) No. 494 of 2012, Supreme Court of India, judgment of 26 September 2018 (reproducing the 2017 privacy ruling) ↗“We commend to the Union Government the need to examine and put into place a robust regime for data protection. The creation of such a regime requires a careful and sensitive balance between individual interests and legitimate concerns of the State.”
The Digital Personal Data Protection Bill, 2023 was passed by the Rajya Sabha on 8 August 2023; it provides obligations of data fiduciaries, rights and duties of data principals, financial penalties, and complaints to a Data Protection Board.IndiaAI (MeitY): Digital Personal Data Protection Bill passed in Indian parliament (10 August 2023) ↗“The Digital Personal Data Protection Bill, 2023, was passed by the Rajya Sabha on Wednesday, 8th August 2023.”
Under the 2023 Act an aggrieved data principal may complain against a data fiduciary to the Data Protection Board; processing detrimental to children, including tracking and targeted advertising, is not permitted.IndiaAI (MeitY): Digital Personal Data Protection Bill passed in Indian parliament (10 August 2023) ↗“he/she can complain against the Data Fiduciary to the Data Protection Board in a hassle-free manner. The bill also safeguards the personal data of children as well. It does not permit processing which is detrimental to the well-being of children or involves tracking, behavioural monitoring or targeted advertising.”

Question: UPSC's CS (Main) 2018, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 373words · Minimalist IAS

The Supreme Court held privacy a fundamental right in 2017; the Justice B.N. Srikrishna Committee (July 2017) reported in July 2018 with a draft Personal Data Protection Bill, seeking 'a free and fair digital economy'. The Aadhaar judgment of 26 September 2018 then commended a 'robust regime for data protection'; the report should be judged against that constitutional brief.

Strengths of the Report in protecting personal data

Coverage: one law binds government and private data fiduciaries alike, built on consent, purpose and collection limitation, data minimisation and transparency.
Rights: access, correction, portability and a limited right to be forgotten; fiduciaries owe fair and reasonable processing, with privacy by design.
Enforcement: an independent Data Protection Authority, breach reporting, impact assessments for significant fiduciaries, and penalties up to Rs 15 crore or 4 per cent of global turnover.

The full answer goes on to cover

Weaknesses of the Report
My view: what should change

With 1 table you can reproduce in the exam.

Read the full model answer (373 words) →

GS Paper III 2018 · Q20

15 marks · 250 words X-Ray · Core #39

India’s proximity to two of the world’s biggest illicit opium-growing states has enhanced her internal security concerns. Explain the linkages between drug trafficking and other illicit activities such as gunrunning, money laundering and human trafficking. What counter-measures should be taken to prevent the same?

Approach · directive: “explain / what counter-measures”

What it asks · Explain how narcotics trafficking links with gunrunning, money laundering, human trafficking and terror around India, and suggest counter-measures.

It asks 2 things — answer each

Explain the linkages between drug trafficking and gunrunning, money laundering, human trafficking and terror funding, with the enabling geography
What counter-measures should be taken: enforcement and coordination, financial tracking, borders, regional cooperation and demand reduction

Open with · India sits between the Golden Crescent and the Golden Triangle across a 3,323 km border with Pakistan and a 1,643 km border with Myanmar; the 2019 national survey counted about 2.26 crore opioid users, 77 lakh needing urgent help, so transit has become consumption and the trade feeds other crimes.

Cover

Terror link: drug money is used to fund insurgent and terrorist groups (narco-terrorism), and drugs are sometimes bartered for weapons, as reported along the western border and in the north-east.
Gunrunning: the routes and networks that bring heroin across the western and eastern borders also move arms, ammunition and explosives.
Money laundering: proceeds move through hawala, front companies, real estate and trade-based laundering, and can fund terror and other crime.
Human trafficking: the same organised networks exploit porous, unfenced borders to traffic women and children, and use victims as drug couriers; corruption in enforcement helps them.
Enabling factors: difficult terrain and open stretches on the Punjab-Pakistan and Myanmar borders, the Myanmar free movement regime, weak coastal surveillance, corruption, and domestic demand.
Counter-measures, enforcement: the NDPS Act, 1985 and PIT-NDPS Act, 1988; the Narcotics Control Bureau; the Prevention of Money Laundering Act, 2002 and FIU-India; joint action by NCB, BSF, customs, the Coast Guard and State police.
Counter-measures, wider: border fencing and surveillance, coastal security, financial tracking, intelligence-sharing with neighbours and UN conventions, and demand reduction, treatment and alternative livelihoods in poppy areas.

Close with · Drugs, arms, money and trafficked people move through one criminal system, so the response must be equally joined up: sealed borders, tracked money, regional cooperation and the drug-free India that Nasha Mukt Bharat intends, through treatment as much as enforcement.

Add value (verified)

MHA Border Management Division: India's border with Pakistan is 3,323 km along Gujarat, Rajasthan, Punjab, Jammu & Kashmir and Ladakh; with Myanmar 1,643 km along Arunachal Pradesh, Nagaland, Manipur and Mizoram.Ministry of Home Affairs, Department of Border Management: Annexure I, BM-I Division (2021) ↗“Myanmar 1643 kms running along Arunachal Pradesh, Nagaland, Manipur and Mizoram.”
The same MHA annexure lists the Pakistan border as 3,323 km along Gujarat, Rajasthan, Punjab, and the Union Territories of Jammu & Kashmir and Ladakh.Ministry of Home Affairs, Department of Border Management: Annexure I, BM-I Division (2021) ↗“Pakistan 3323 kms running along Gujarat, Rajasthan, Punjab, Union Territory of Jammu & Kashmir”
PIB (May 2025), citing the 2019 national survey: about 2.26 crore people use opioids, nearly 77 lakh needing urgent intervention; Nasha Mukt Bharat Abhiyaan was launched on 15 August 2020 in 272 high-risk districts.PIB backgrounder: Nasha Mukt Bharat Abhiyaan, a national movement towards a drug-free India (6 May 2025) ↗“Opioids, one of the most harmful categories of drugs, are used by approximately 2.26 crore individuals, with nearly 77 lakh requiring urgent intervention and support.”
Newspaper report (The Tribune, 8 February 2024): the Home Ministry decided to scrap the Free Movement Regime with Myanmar for internal security, and to fence the entire 1,643 km Indo-Myanmar border.The Tribune (newspaper report): Government scraps free movement between India and Myanmar to ensure internal security (8 February 2024) ↗“The Home Ministry has decided that the Free Movement Regime (FMR) between India and Myanmar be scrapped to ensure the internal security of the country”
PIB (October 2024): a four-tier NCORD mechanism, an NCORD portal and a Joint Coordination Committee coordinate the fight against narcotics under a whole-of-government approach.PIB backgrounder on the Government's fight against narcotics (October 2024) ↗“NCORD: A four-tier NCORD mechanism was established for coordination and collaboration. NCORD Portal: Functions as a data integration and knowledge management system. A Joint Coordination Committee (JCC) was formed for detailed investigations.”

Question: UPSC's CS (Main) 2018, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 371words · Minimalist IAS

India sits between the Golden Crescent (Afghanistan, Pakistan, Iran) and the Golden Triangle (Myanmar, Laos, Thailand), across a 3,323 km border with Pakistan and 1,643 km with Myanmar. The 2019 national survey counted about 2.26 crore opioid users, 77 lakh needing urgent help: transit has become consumption, and the trade feeds other crimes.

Linkages between drug trafficking and other illicit activities

Narco-terrorism: drug money funds insurgent and terrorist groups, and drugs are at times bartered for weapons along the western border and in the north-east.
Gunrunning: the routes, carriers and handlers that bring heroin across the borders also move arms, ammunition and explosives.
Money laundering: proceeds are washed through hawala, front companies, real estate and trade-based laundering, and the cleaned money finances further crime and terror.
Human trafficking: the same networks exploit porous borders to traffic women and children and use victims as couriers; corruption keeps the chain intact.
Enablers: difficult terrain, the Myanmar free movement regime, weak coastal surveillance and rising domestic demand.

✏️ Map to sketch in the exam · Drug entry routes into India

Shade: Punjab, Jammu and Kashmir, Ladakh, Rajasthan, Gujarat = Pakistan border (3,323 km): Golden Crescent routes
Shade: Arunachal Pradesh, Nagaland, Manipur, Mizoram = Myanmar border (1,643 km): Golden Triangle routes
Legend: border States as per MHA

Draw on India's official outline (Survey of India boundary).

The full answer goes on to cover

Counter-measures to prevent the nexus

Read the full model answer (371 words) →

2017

GS Paper III 2017 · Q9

10 marks · 150 words

Discuss the potential threats of Cyber attack and the security framework to prevent it.

Approach · directive: “discuss”

What it asks · Describe the kinds of cyber attack India faces and the legal, institutional and technical framework meant to prevent them.

It asks 2 things — answer each

Discuss the potential threats of cyber attack
Discuss the security framework to prevent it

Open with · Data opening: CERT-In tracked 15,92,917 cyber security incidents in 2023 and 20,41,360 in 2024, up sharply since the WannaCry year of 2017, as banking, power and governance moved online under Digital India.

Cover

Threats: ransomware such as WannaCry (2017), malware, phishing, denial-of-service attacks and financial fraud.
Larger threats: attacks on critical infrastructure such as power grids, telecom and banking, state-sponsored espionage and cyber terrorism.
Vulnerabilities: dependence on imported hardware and software, low awareness, shortage of skilled staff and poor reporting.
Law: the IT Act, 2000 (amended 2008) punishes hacking (S.66) and cyber terrorism (S.66F) and shields protected systems (S.70); the DPDP Act, 2023 fines up to Rs 250 crore for weak security safeguards.
Institutions: CERT-In with mandatory incident reporting since 2022, NCIIPC, the National Cyber Security Policy 2013, and the I4C (2018) whose 1930 helpline and fraud-reporting system have saved over Rs 8,690 crore.
Practice and gaps: RBI's cyber security framework for banks (2016), the Cyber Swachhta Kendra; few trained officials and India outside the Budapest Convention.

Close with · Cyber security is now national security; skilled manpower and public–private threat sharing will decide whether an 'Open, Safe and Trusted and Accountable Internet' survives 20 lakh incidents a year.

Add value (verified)

CERT-In incidents: 13,91,457 (2022), 15,92,917 (2023), 20,41,360 (2024).Government measures to protect critical infrastructure and private data against cyber attacks — PIB, MeitY (2025) ↗“the total number of cyber security incidents in the last three years are given below: Year Total number of cyber security incidents 2022 13,91,457 2023 15,92,917 2024 20,41,360”
Government goal: an Open, Safe and Trusted and Accountable Internet.Government measures to protect critical infrastructure and private data against cyber attacks — PIB, MeitY (2025) ↗“The policies of the Government are aimed at ensuring an Open, Safe and Trusted and Accountable Internet for its users.”
DPDP Act, 2023: highest penalty up to Rs 250 crore for failure to maintain reasonable security safeguards.DPDP Rules notified — PIB, MeitY (November 2025) ↗“The highest penalty up to ₹ 250 crore applies to failure of a Data Fiduciary to maintain reasonable security safeguards.”
I4C set up by MHA in 2018; its fraud-reporting system saved over Rs 8,690 crore till 31 January 2026; 1930 helpline.Indian Cyber Crime Coordination Centre — PIB, Ministry of Home Affairs (2026) ↗“As per CFCFRMS operated by I4C, till 31.01.2026, financial amount of more than Rs. 8,690 Crore has been saved in more than 24.65 lakh complaints. A toll-free Helpline number ‘1930’ has been operationalized”
CERT-In issued directions on reporting of cyber incidents on 28 April 2022.CERT-In issues directions on information security practices and reporting of cyber incidents — PIB, MeitY (April 2022) ↗“CERT-In issues directions relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet Posted On: 28 APR 2022”

Question: UPSC's CS (Main) 2017, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 225words · Minimalist IAS

CERT-In tracked 15,92,917 cyber security incidents in 2023 and 20,41,360 in 2024, up sharply since the WannaCry year of 2017, as banking, power and governance moved online under Digital India.

Potential threats of cyber attack

Malware and ransomware: WannaCry (2017) locked systems worldwide; phishing, denial-of-service and financial fraud hit banks and citizens.
Critical infrastructure: attacks on grids, telecom, banking and transport can paralyse the economy; state-backed espionage and cyber terrorism threaten security.
Vulnerabilities: imported hardware, weak awareness, skill shortage and poor incident reporting.

The full answer goes on to cover

Security framework to prevent it

With 1 diagram you can reproduce in the exam.

Read the full model answer (225 words) →

GS Paper III 2017 · Q19

15 marks · 250 words

Mob violence is emerging as a serious law and order problem in India. By giving suitable examples, analyze the causes and consequences of such violence.

Approach · directive: “analyse”

What it asks · Analyse why mob violence is rising and what it does to society and the State, citing examples.

It asks 2 things — answer each

Analyse the causes of mob violence, with suitable examples
Analyse the consequences of mob violence, with suitable examples

Open with · 'Lynching is an affront to the rule of law and to the exalted values of the Constitution itself,' the Supreme Court held in Tehseen Poonawalla (2018); mob violence is a crowd's unlawful force on rumour or suspicion, substituting its verdict for the courts and police.

Cover

Rumours and social media: false messages on child-lifting and cattle smuggling spread quickly; child-lifting rumours led to killings in Jharkhand in 2017.
Identity and vigilantism: self-styled cow protection groups, as in Dadri (2015) and Alwar (2017), target minorities and Dalits.
Weak law enforcement: slow trials, low conviction, police inaction and political patronage produce a sense of impunity.
Social factors: distrust of the police, prejudice, unemployment and frustration among youth, and a mob's anonymity reduce individual guilt.
Consequences: loss of life, fear among targeted groups, communal polarisation and damage to the State's monopoly over force.
Consequences: harm to the rule of law, livelihoods such as cattle trade, India's image and investment climate.
Response: quick FIRs and fast-track trials, accountable district officials, curbs on rumours online and fresh law; the Supreme Court gave directions in Tehseen Poonawalla (2018).

Close with · A mob is the failure of the State to be visibly present; swift, impartial policing, the Poonawalla directions and certain punishment under BNS Section 103(2) restore the constitutional promise that no citizen is judged by a crowd.

Add value (verified)

Supreme Court, Tehseen S. Poonawalla v Union of India (17 July 2018): 'Lynching is an affront to the rule of law and to the exalted values of the Constitution itself.'Tehseen S. Poonawalla v Union of India, W.P. (C) 754 of 2016, judgment of 17 July 2018 — Supreme Court of India ↗“Lynching is an affront to the rule of law and to the exalted values of the Constitution itself.”
Poonawalla (2018), preventive measure: States to nominate a senior police officer as Nodal Officer in each district to ensure vigilantes do not take the law into their own hands.Tehseen S. Poonawalla v Union of India, judgment of 17 July 2018 — Supreme Court of India ↗“will nominate a senior police officer of the Police Department as the Nodal Officer in each District, who shall ensure that these vigilantes do not take law unto themselves”
Poonawalla (2018), punitive measure: lynching and mob violence cases to be tried by designated fast-track courts in each district on a day-to-day basis.Tehseen S. Poonawalla v Union of India, judgment of 17 July 2018 — Supreme Court of India ↗“The cases of lynching and mob violence shall be specifically tried by designated court/Fast Track Courts earmarked for that purpose in each district. Such courts shall hold trial of the case on a day to day basis.”
Poonawalla (2018): the Court recommended that Parliament create a separate offence for lynching, as a special law 'would instill a sense of fear for law'.Tehseen S. Poonawalla v Union of India, judgment of 17 July 2018 — Supreme Court of India ↗“the Parliament, to create a separate offence for lynching and provide adequate punishment for the same. We have said so as a special law in this field would instill a sense of fear for law amongst the people who involve themselves in such kinds of activities.”
BNS 2023, Section 103(2): murder by a group of five or more persons acting in concert on grounds of race, caste or community, sex, place of birth, language, personal belief or similar ground is punishable with death or life imprisonment and fine.PIB: Mob lynching and snatching related provisions in new criminal laws (Ministry of Home Affairs, December 2024) ↗“Section 103(2) of BNS provides that when a group of five or more persons acting in concert commits murder on the ground of race, caste or community, sex, place of birth, language, personal belief or any other simil”

Question: UPSC's CS (Main) 2017, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 373words · Minimalist IAS

'Lynching is an affront to the rule of law and to the exalted values of the Constitution itself,' the Supreme Court held in Tehseen Poonawalla (2018). Mob violence is a crowd's unlawful use of force on rumour or suspicion, substituting its verdict for the courts and the police.

Causes of mob violence, with examples

Rumour on social media: WhatsApp messages about child-lifters led to beatings to death in Jharkhand in May 2017; forwarding outruns any police response.
Identity vigilantism: self-styled cow protectors killed Mohammad Akhlaq in Dadri (2015) and Pehlu Khan in Alwar (2017) and flogged Dalits in Una (2016).
Impunity: slow trials, low conviction, police delay or complicity and political patronage teach crowds that violence carries no cost.
Distrust of justice: crowds seek 'instant justice' against suspected thieves and witches, as when a rape accused was dragged from Dimapur jail and lynched (2015).
Crowd psychology: anonymity dissolves individual guilt; prejudice, unemployment and frustration among young men supply the tinder.

The full answer goes on to cover

Consequences of mob violence, with examples
Way forward

With 1 table you can reproduce in the exam.

Read the full model answer (373 words) →

GS Paper III 2017 · Q20

15 marks · 250 words X-Ray · Core #63

The scourge of terrorism is a grave challenge to national security. What solutions do you suggest to curb this growing menace ? What are the major sources of terrorist funding ?

Approach · directive: “what solutions / what are the major sources”

What it asks · Suggest measures to curb terrorism and name the main sources of terrorist funding.

It asks 2 things — answer each

Suggest solutions to curb terrorism
Identify the major sources of terrorist funding

Open with · Terrorism strikes at the State's first duty, the safety of its citizens, and survives on money, arms, ideology and safe havens; the FATF's 2024 evaluation placed India in 'regular follow-up', its highest category, while urging it to turn financial investigations into convictions.

Cover

Sources of funds: hawala and illegal money transfers, counterfeit currency, drug trafficking, smuggling, and extortion or ransom demands.
Sources of funds: misuse of charities and donations, state sponsorship, cyber fraud, front companies and, in some regions, extortion in mining and construction.
Intelligence and policing: better sharing among agencies and States, NIA and NATGRID, strong local police and border and coastal surveillance.
Legal and financial action: the Unlawful Activities (Prevention) Act provisions on raising funds, Prevention of Money Laundering Act, financial intelligence and FATF norms.
Countering radicalisation: community engagement, deradicalisation, monitoring of online recruitment, and education and jobs for vulnerable youth.
Diplomacy: pressure through the UN, FATF and bilateral cooperation to end safe havens; capacity building and quick response forces such as the NSG.
Balance: measures must respect due process and human rights so that action against terrorism does not erode trust of the affected communities.

Close with · Terrorism yields to a whole-of-nation response, sharp intelligence, dried-up finance, fair and fast justice and communities that trust the State, backed by the Comprehensive Convention on International Terrorism that India has long pressed for.

Add value (verified)

FATF adopted India's Mutual Evaluation Report in its June 2024 Plenary (Singapore), placing India in the 'regular follow-up' category.PIB: FATF adopts Mutual Evaluation Report of India in its June 2024 Plenary (Department of Revenue, 28 June 2024) ↗“FATF Places India in the ‘regular follow-up’ category Posted On: 28 JUN 2024 3:06PM by PIB Delhi India has achieved an outstanding outcome in the Mutual Evaluation conducted during 2023-24”
A Terror Funding and Fake Currency Cell has been set up in the National Investigation Agency to investigate terror funding cases.PIB: Strategy to deal with Terror Financing and Money Laundering (Ministry of Home Affairs) ↗“a Terror Funding and Fake Currency Cell has been set up in the National Investigation Agency to investigate Terror Funding cases.”
UAPA Section 17 (as amended in 2013): punishment for raising, providing or collecting funds for a terrorist act, from legitimate or illegitimate sources, in India or abroad.The Unlawful Activities (Prevention) Act, 1967, Section 17 — Ministry of Home Affairs (India Code text) ↗“17. Punishment for raising funds for terrorist act.—Whoever, in India or in a foreign country, directly or indirectly, raises or provides funds or collects funds, whether from a legitimate or illegitimate source”
The Prime Minister delivered the inaugural address at the third 'No Money for Terror' Ministerial Conference on Counter-Terrorism Financing in New Delhi on 18 November 2022.PMO: PM delivers the inaugural address at the third 'No Money for Terror' Ministerial Conference, New Delhi (18 November 2022) ↗“PM delivers the inaugural address at the third ‘No Money for Terror’ (NMFT) Ministerial Conference on Counter-Terrorism Financing, in New Delhi (November 18, 2022)”

Question: UPSC's CS (Main) 2017, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 371words · Minimalist IAS

Terrorism strikes at the State's first duty, the safety of its citizens, and survives on money, arms, ideology and safe havens. The FATF's 2024 evaluation placed India in 'regular follow-up', its highest category, while urging it to turn financial investigations into convictions.

Solutions to curb terrorism

Intelligence fusion: strengthen the Multi-Agency Centre and NATGRID, integrate State intelligence and share actionable inputs in real time.
Policing and borders: State police as first responders; fenced and electronically watched borders; coastal security with marine police and the Coast Guard; NSG hubs for rapid response.
Law and courts: the UAPA, fast-track terror trials, witness protection and NIA reach across States.
Financial choke: PMLA, the Financial Intelligence Unit and FATF standards to trace and freeze funds; NIA's Terror Funding and Fake Currency Cell investigates terror-funding cases.
Counter-radicalisation: monitor online recruitment, engage community leaders, run deradicalisation, and expand education and jobs in Jammu and Kashmir, the Northeast and LWE districts.
Diplomacy: press the Comprehensive Convention on International Terrorism at the UN; use FATF and UN sanctions listings; India hosted the third 'No Money for Terror' ministerial conference in New Delhi (November 2022).
Rights and trust: due process, no collective punishment and accountable forces, so counter-terrorism does not create the next recruit.

The full answer goes on to cover

Major sources of terrorist funding

With 1 diagram you can reproduce in the exam.

Read the full model answer (371 words) →

2016

GS Paper III 2016 · Q20

12½ marks · 200 words

Use of Internet and social media by non-state actors for subversive activities is a major security concern. How have these been misused in the recent past? Suggest effective guidelines to curb the above threat.

Approach · directive: “how / suggest”

What it asks · Describe how terrorists, insurgents and other non-state actors have misused the internet and social media, and suggest guidelines that reduce the threat without harming freedom of speech.

It asks 2 things — answer each

How: the internet and social media have been misused by non-state actors in the recent past
Suggest: effective guidelines to curb the threat without harming free speech

Open with · A paradox: the network that lets a village sell online also lets a handful of people reach millions anonymously for propaganda, recruitment and rumour; since speech may be curbed only on Article 19(2) grounds, guidelines must be lawful as well as effective.

Cover

Misuse, radicalisation: propaganda videos, online recruitment and grooming of young people by terror groups such as ISIS, including through encrypted messaging apps.
Misuse, rumours and hate: fake news and doctored videos that incite panic and communal violence, as in the 2012 exodus of northeast people from some cities.
Misuse, mobilisation and crime: coordination of protests and violence, funding through crowdfunding and crypto assets, arms and drug trade on the dark web, and cyber attacks and hacking.
Legal tools: the Information Technology Act, 2000, including blocking under section 69A with safeguards, monitoring and interception, and the Unlawful Activities (Prevention) Act.
Guidelines, platforms: due diligence, quick takedown and grievance redressal by intermediaries, cooperation on user information, and transparency, as in the 2021 IT Rules.
Guidelines, capacity: strong cyber units, CERT-In and a national cyber crime coordination centre, monitoring of extremist content and counter-narratives, and digital literacy.
Safeguards: any restriction must be lawful, necessary and proportionate, since free speech can be restricted only on the grounds listed in Article 19(2).

Close with · Online security rests on institutions as much as takedowns; SDG 16.a asks States to strengthen national institutions to prevent violence and combat terrorism and crime, and a trained I4C-police-platform chain under judicial oversight is India's version of it.

Add value (verified)

Article 19(2) lists the only grounds on which free speech may be restricted, including security of the State and public order, so online controls must fall within them.The Constitution of India (as on 1 May 2024), Article 19(2) — Legislative Department ↗“the security of the State, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence”
IT Rules, 2021 (PIB, 25 February 2021): significant social media intermediaries must appoint a resident Chief Compliance Officer and a 24x7 nodal contact for law enforcement.PIB: Government notifies Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 ↗“Appoint a Chief Compliance Officer who shall be responsible for ensuring compliance with the Act and Rules. Such a person should be a resident in India. Appoint a Nodal Contact Person for 24x7 coordination with law enforcement agencies.”
IT Rules, 2021: grievances acknowledged within 24 hours and resolved within 15 days.PIB: IT Rules 2021 notification, grievance redressal ↗“acknowledge the complaint within twenty four hours and resolve it within fifteen days from its receipt.”
MHA: components of the I4C scheme, including the Threat Analytics Unit, the National Cybercrime Reporting Portal and the joint investigation platform.MHA: Details about Indian Cybercrime Coordination Centre (I4C) Scheme ↗“Components of the I4C Scheme 1 National Cybercrime Threat Analytics Unit (TAU) 2 National Cybercrime Reporting Portal ( www.cybercrime.gov.in ) 3 Platform for Joint Cybercrime Investigation Team 4 National Cybercrime Forensic Laboratory”
Anuradha Bhasin v Union of India (2020): an indefinite suspension of internet services is impermissible.Supreme Court, Anuradha Bhasin v Union of India (10 January 2020), judgment text hosted on Indian Kanoon ↗“we are of the opinion that an order suspending the aforesaid services indefinitely is impermissible.”
SDG 16.a wording for the conclusion.UN SDG 16 targets (sdgs.un.org) ↗“Target 16.a Strengthen relevant national institutions, including through international cooperation, for building capacity at all levels, in particular in developing countries, to prevent violence and combat terrorism and crime”

Question: UPSC's CS (Main) 2016, GS Paper III — paper ↗. Approach: Minimalist IAS, checked 3 Oct 2026 (how we verify) — UPSC publishes no model answers. ·

Model answer· 298words · Minimalist IAS

The network that lets a village sell online also lets a few people reach millions anonymously for propaganda, recruitment and rumour. Since speech may be curbed only on Article 19(2) grounds, guidelines must be lawful as well as effective.

How non-state actors misused the internet in the recent past

Radicalisation: ISIS used videos, online magazines and encrypted apps to recruit, including a few Indian youth.
Rumour and riot: doctored images and mass messages drove the 2012 exodus of north-eastern people from Bengaluru; a fake video fed the 2013 Muzaffarnagar riots.
Mobilisation: separatists used social media to organise stone-pelting in Kashmir in 2016.
Crime and espionage: crowdfunding and virtual currencies for terror funds, dark-web arms and drugs, and honey-trapping of defence personnel.

The full answer goes on to cover

Effective guidelines to curb the threat

With 1 flowchart you can reproduce in the exam.

Read the full model answer (298 words) →

The Syllabus X-Ray of this syllabus line

2 of its 7 sub-topics are High

0 Core · 2 High · 3 Steady · 2 Rare

HighCybersecurity & critical infrastructure · 5 questions
HighMoney laundering & terror financing · 5 questions

The X-Ray ranks all 928 sub-topics of the UPSC syllabus by what UPSC has asked since 2016. The 78 Mains Core sub-topics are behind 66% of Mains questions.

See the whole X-Ray →

The same ground in Prelims

IT, computing & emerging technologiesPrelims PYQs

More of GS Paper III

Quick answers

How many UPSC Mains questions have been asked on Cyber security, media & money-laundering?

16 questions in GS Paper III from 2016 to 2026, asked in 10 of 11 years, most recently in 2026. Each is above, newest first, with the demand, an approach and a model answer.

What does the UPSC syllabus say on Cyber security, media & money-laundering?

The GS Paper III syllabus line reads, in UPSC's words: “Challenges to internal security through communication networks, role of media and social networking sites in internal security challenges, basics of cyber security; money-laundering and its prevention.”

Where are the GS Paper III PYQs topic-wise as a free PDF?

The GS Paper III syllabus-wise PDF — every question since 2016 under its syllabus line, with an approach — is a free download on the Vault's downloads page (one sign-up, no cost).

Free · Daily Updates Join Minimalist IAS on Telegram or WhatsApp A PYQ every morning, the Daily Brief and the Sunday quiz. Free, no sign-up. Join Telegram Join on WhatsApp →