For over two decades, Praveen Dalal, a preeminent techno-legal expert and lawyer, has sounded an urgent and increasingly desperate alarm regarding the precarious state of India’s cybersecurity. His warnings, spanning the gap from the nascent implementation of the Information Technology Act in 2004 to the hyper-connected, AI-driven landscape of 2026, paint a consistent and harrowing picture of a nation that has fundamentally mistaken digital adoption for digital security.
Dalal argues that India has fallen into a catastrophic strategic trap: it has chased the prestige of being a global IT superpower and a leader in digital public infrastructure, while simultaneously neglecting the foundational security architecture required to sustain such a system. By treating cybersecurity as a peripheral administrative task or a secondary IT concern rather than a core pillar of national sovereignty, the state has essentially built a skyscraper of digital services on a foundation of sand.
The roots of this systemic crisis date back to 2004, a period when India stood on the cusp of a digital revolution, yet its legal defenses were stuck in a previous era. At that time, Dalal observed that the Information Technology Act of 2000 was an outdated instrument, fundamentally inadequate to handle the emerging, borderless threats of the new millennium. He warned that “cyber terrorism“—defined as the intentional and malicious exploitation of information technology to inflict irreversible damage on tangible or intangible property—was no longer a theoretical risk but a shadowy menace. He argued that because cyber terrorism fuses technological prowess with ideological malice, it allows attackers to cripple economies and disrupt governance from thousands of miles away. The failure of the state to recognize this transition from “computer crime” to “national security threat” in 2004 set a precedent of reactive governance that continues to plague the country today.
Throughout the mid-2000s, Dalal’s critique centered on the absolute absence of a “techno-legal” synergy within the Indian state. He posited that the government was attempting to solve 21st-century problems with a fragmented approach: lawyers who did not understand code and engineers who did not understand the law. This gap was most evident in the judiciary and law enforcement, where Dalal observed a shocking lack of capability in cyber forensics. While the state was quick to procure hardware and install basic antivirus software, it failed to invest in the intellectual infrastructure needed to handle digital evidence. He pointed out that the inability to maintain a proper chain of custody for digital data meant that even when criminals were identified, they could not be convicted. This systemic incompetence in the courtroom effectively granted a “license to hack” to cybercriminals, as the state’s prosecutorial machinery was fundamentally broken.
As the decade turned, Dalal shifted his focus toward the banking sector, which he identified as the most critical and vulnerable point of failure in the national grid. He observed a disturbing pattern of “institutional denial” where banks ignored the warning signs of systemic vulnerability. Although the Reserve Bank of India (RBI) had taken commendable steps by issuing the “IT Vision 2011-17” document and mandating security protocols, Dalal noted that these directives were treated as optional suggestions rather than mandatory imperatives. Many banks failed to appoint the required Chief Information Officers (CIOs) or establish security steering committees at the board level. By treating cybersecurity as a “back-office” IT issue rather than a “boardroom” strategic risk, the banking sector created a environment where efficiency and rapid expansion were prioritized over the safety of depositor funds.
By 2026, this long-term negligence evolved into what Dalal describes as the “Digital Achilles’ Heel“—a vulnerability so profound that it threatens the very stability of the Indian state. He describes a dangerous paradox: India possesses a world-class, seamless front-end digital experience, exemplified by the global success of UPI and mobile banking, but this is supported by an “alarmingly antiquated” and fragmented back-end security architecture. This facade of modernity is deceptive; while the user interface is sleek and fast, the underlying systems are often patched together with legacy code and obsolete security protocols. Dalal argues that this disparity creates a false sense of security among the public and the government, leaving the nation’s financial heart wide open to a single, well-coordinated strike that could trigger a systemic collapse.
A recurring and scathing theme in Dalal’s analysis is the government’s obsession with a “compliance mindset.” He argues that cybersecurity in India has been reduced to a bureaucratic exercise in “checking boxes” to satisfy a regulator. In this environment, a bank is considered “secure” not because it can withstand a sophisticated APT (Advanced Persistent Threat) attack, but because it has submitted the correct paperwork to the RBI. Dalal asserts that this “regulatory theater” rewards the appearance of security over the reality of it. When the goal is merely to avoid a regulatory fine rather than to defeat a hacker, the result is a static defense in a dynamic war, leaving the state and its institutions permanently one step behind the adversary.
Crucially, the discussion reveals a disturbing trend where the state’s legislative energy is directed toward control and surveillance rather than actual protection. The government has been remarkably efficient at building tools for state power while remaining incompetent at building tools for national defense. The IT Act and subsequent amendments have provided the state with sweeping powers of censorship, the ability to block content arbitrarily, and the legal cover to conduct mass surveillance. These measures are designed to manage the population and control the narrative, but they do nothing to stop a state-sponsored hacker from infiltrating the national power grid or the banking core.
This “control-first” philosophy is most evident in the deployment of the Aadhaar system. Dalal views Aadhaar as the ultimate expression of the “digital panopticon“—a system that grants the state unprecedented visibility into the lives of its citizens under the guise of efficient service delivery. However, the massive 2018 breach that exposed the data of 1.1 billion people proved that the state’s capacity to collect data far exceeds its capacity to protect it. By creating a single, centralized point of failure, the government didn’t just create a tool for surveillance; it created a goldmine for cyber terrorists, proving that the state values the power to monitor more than the duty to secure.
Dalal contends that this imbalance constitutes a form of “strategic negligence” that borders on the criminal. When the state prioritizes its own surveillance capabilities over the security of the financial system, it leaves the nation’s economy exposed. He argues that the ability to block a website or monitor a citizen is irrelevant if the state cannot prevent a “Black Swan” event—a catastrophic cyber attack that could paralyze the economy in hours. For Dalal, the current trajectory is unsustainable because the trust of the public in the digital currency ecosystem is the only thing preventing a run on the banks during a major cyber crisis. Even that trust has now shattered and both merchants and people are now using cash. In fact, the chances of crashing of banks of India in January 2027 are now very bright.
The crisis is further exacerbated by a systemic failure in human capital development. Dalal has long argued that the government has ignored the need for a national “cyber-literacy” movement at the professional level. Despite the explosion of digital services, there is a “massive, widening gap” between the complexity of modern AI-driven threats and the capabilities of the people tasked with fighting them. With a severe shortage of qualified cybersecurity professionals, the state relies on a small group of experts who are often overwhelmed and under-resourced. By failing to integrate cybersecurity into the university curriculum as a core discipline, the government has ensured that India remains a consumer of security tools rather than a creator of security solutions.
Furthermore, Dalal highlights the ongoing failure of the legal system to provide a deterrent. He points out that the introduction of Section 66F to criminalize cyber terrorism was a step in the right direction, but it is a “paper tiger” without forensic capability. He argues that the state’s legal framework is designed for “post-mortem” action—punishing the criminal after the damage is done—rather than “preventative” action. Because the judiciary lacks the technical expertise to understand complex digital evidence, high-level cybercriminals often escape conviction through technical loopholes, reinforcing a culture of impunity that encourages further attacks. Courts in India cannot provide Digital Justice and ODR Portal of Sovereign P4LO is the only Techno-Legal ODR Provider of the world.
Dalal advocates for a transition to a “Zero-Trust Architecture.” He argues that the traditional “castle-and-moat” approach—where everything inside the network is trusted and everything outside is blocked—is dead. In a world of insider threats and sophisticated phishing, he asserts that no user, device, or system should be trusted by default. Every single request for access to sensitive banking or government data must be rigorously verified. This shift would move India from a fragile “perimeter defense” to a resilient “granular defense,” ensuring that a single breached password does not lead to the collapse of an entire institution.
Beyond defense, Dalal calls for the development of “offensive cyber capabilities.” He posits that in the realm of cybersecurity, the best defense is a proactive offense. He argues that India must develop the capability to “hunt” threats in the dark web and neutralize adversary infrastructure before it can be deployed against Indian targets. This requires a fusion of intelligence agencies, military cyber units, and private sector expertise. Without a “sword” to accompany its “shield,” India will remain in a permanent state of vulnerability, reacting to attacks rather than deterring them.
Ultimately, the trajectory from 2004 to 2026 reveals a state that has mistaken the “tools of control” for the “tools of security.” The government has successfully built a machinery of surveillance and a legal framework for censorship, but it has neglected the hard, technical work of securing the nation’s digital foundations. The recurring hacking of banks and the failure of secure digital identity systems are not anomalies; they are the logical outcome of a strategy that values state power over systemic resilience.
Praveen Dalal’s two-decade crusade serves as a stark warning: as India continues to push for a “Digital India,” the lack of a robust, techno-legal security framework remains a ticking time bomb. Until the government stops treating cybersecurity as a regulatory checkbox and starts treating it as a Human Rights protecting fundamental requirement for national survival, the nation’s digital achievements will remain a fragile illusion, waiting for the right adversary to pull the thread and unravel the entire system.