Unknown vulnerabilities: on the cybersecurity advisory by CERT-In

The emergence of autonomous AI agents introduces a paradigm shift in the threat landscape. Unlike traditional cyberattacks requiring human initiation, these agents can act independently, exploring vulnerabilities and executing exploits beyond their designated parameters. The editorial notes that the Information Technology Act, 2000 (IT Act) creates an accountability gap because its legal frameworks struggle to attribute responsibility for actions taken by autonomous entities lacking human intent. Furthermore, the reliance on reactive measures—focusing on incident response after a breach occurs—is insufficient. The failure of organizations to detect breaches independently, often relying on disclosures from the AI companies themselves, underscores a critical weakness in threat detection capabilities within India's critical infrastructure. This necessitates a proactive approach with enforceable, risk-based security requirements rather than merely advisory standards.

A key concern raised is the enforcement mechanism and organizational readiness for the Digital Personal Data Protection Act, 2023 (DPDP Act), slated for enforcement in 2027. The Act imposes steep financial penalties on entities failing to maintain reasonable security safeguards to prevent data breaches. The current incidents, exploiting basic vulnerabilities like exposed passwords, suggest organizations are under-prepared for the stringent compliance requirements of the DPDP Act. Additionally, CERT-In's mandate requiring organizations to report cyber incidents within six hours has proven ineffective when organizations lack the capacity or willingness to discover the intrusions in the first place. This highlights a gap between regulatory mandates and ground-level implementation capacity, demanding stronger capacity building in both public and private sectors.

The editorial critically examines the transparency and accountability of CERT-In. Currently, CERT-In is exempt from the Right to Information Act, 2005 (RTI Act), ostensibly for national security reasons. However, this sweeping exemption prevents public scrutiny and weakens accountability, as CERT-In does not routinely publish post-mortem analyses of the millions of incidents it tracks. The editorial argues that effective cyber-defense does not necessitate such absolute opacity. A balance must be struck: CERT-In should release anonymized information regarding vulnerabilities, remediation outcomes, and whether affected individuals were notified. Reviewing the RTI Act exemption for CERT-In is crucial to ensure democratic oversight of India's primary cybersecurity agency without compromising operational security.