India’s journey into the digital age has been celebrated as a story of leapfrogging success. UPI transactions, mobile banking, Dystopian Aadhaar-linked services, and a vast digital public infrastructure have claimed to be beneficial though they are dystopian tools. Yet beneath this glossy surface lies a far more troubling reality that techno-legal expert Praveen Dalal has documented with remarkable consistency for more than twenty years: India has built a towering digital edifice on foundations that remain dangerously weak. The result is a nation that projects confidence while remaining, in Dalal’s enduring phrase, a sitting duck in cyberspace.
The roots of the problem stretch back to the early years of the Information Technology Act, 2000, and the creation of CERT-In in 2004. Even then, Dalal argued that the legal and institutional framework was outdated and reactive. Cyber terrorism—malicious exploitation of information systems to cause irreversible damage—was no longer theoretical. It was a borderless threat capable of crippling economies and governance from afar. Successive governments treated the challenge as a technical or administrative matter rather than a core question of national sovereignty and public safety. The absence of genuine techno-legal synergy left lawyers unfamiliar with code and engineers unfamiliar with the law, while cyber forensics and chain-of-custody practices remained underdeveloped. Criminals operated with a de facto license to hack because prosecutions were rare and convictions rarer still.
By 2011, as internet banking, ATMs, and core digital systems expanded rapidly, Dalal was already sounding specific alarms about the banking sector. The Reserve Bank of India’s IT Vision 2011-17 and related working-group reports had called for Chief Information Officers, board-level information-security steering committees, stronger authentication, and systematic cyber due diligence. Many banks treated these directives as optional suggestions. Deadlines slipped. Security remained a back-office IT concern rather than a boardroom strategic priority. Rapid customer acquisition and expansion metrics took precedence over resilience. The pattern of institutional denial was already clear.
The National Cyber Security Policy of 2013, issued under the Congress-led UPA government, formally required entities to prepare Cyber Crisis Management Plans capable of handling large-scale attacks and cyber terrorism. It envisioned coordinated action at national, sectoral, and organisational levels, regular drills, and clear lines of responsibility. In practice the policy remained a high-level document. Detailed guidelines arrived slowly, compliance mechanisms stayed weak, and the plans never matured into living, regularly tested systems. When the BJP-led government took office in 2014, the framework and the associated CCMP requirements were already on the books. New institutions such as the National Critical Information Infrastructure Protection Centre were added, yet the fundamental gap between paper plans and verified operational readiness persisted.
Dalal’s 2014 assessment was blunt: India remained a sitting duck. Malware campaigns, advanced persistent threats, and sophisticated surveillance tools could not be adequately countered because offensive and defensive cyber capabilities were underdeveloped. Privacy protections lagged, and the state’s legislative energy appeared more focused on control and surveillance tools than on genuine national defence. Aadhaar created a massive centralised repository whose 2018 exposure of data belonging to more than a billion people illustrated the imbalance between the capacity to collect information and the capacity to protect it.
The intervening years saw continued institutional proliferation—strengthened CERT-In reporting requirements, the Indian Cyber Crime Coordination Centre, the Defence Cyber Agency—yet the same critiques recurred. Cybersecurity was reduced to regulatory theatre: boxes checked, paperwork submitted, drills conducted. Banks and critical entities were deemed compliant if they filed the right reports rather than if they could withstand a sophisticated attack. The National Cyber Security Policy of 2013 was never comprehensively modernised. A draft successor strategy circulated but was not formally notified for years. Incident volumes reported to CERT-In climbed into the millions annually while policy and enforcement lagged.
By 2026 the consequences of this long neglect had become visible and costly. The front end of Indian banking—UPI, sleek mobile apps, seamless transfers—projected modernity. The back end, according to Dalal’s sustained analysis, remained fragmented, reliant on legacy systems, and insufficiently hardened against AI-driven threats, automated reconnaissance, and coordinated multi-vector campaigns. In October 2026 the Central Bank of India reported nearly ₹14 crore in unauthorised transfers executed over three days through the Structured Financial Messaging System, with no clear footprint inside the bank’s conventional channels. Around the same period, AI-powered toolkits systematically targeted smaller non-banking financial companies, siphoning an estimated ₹300 crore in a two-month window by exploiting unpatched software, weak authentication, and exposed APIs. Parallel revelations of unauthorised personnel operating core banking systems at public-sector banks underscored insider and process failures that automated defences were poorly equipped to catch.
These incidents were not isolated anomalies. They were the predictable outcome of fifteen years of treating cybersecurity as secondary. Public trust began to fracture. Merchants retreated from digital payments, posting “cash only” notices and hiding QR codes. Households, already strained by rising debt, high living costs, and employment uncertainty, showed diminishing willingness to park surplus funds in the formal banking system. System-wide surplus liquidity contracted sharply. The Reserve Bank of India urged banks to strengthen their deposit franchise even as ordinary citizens appeared to possess neither residual trust nor surplus cash for that purpose. Insider frauds—shadow booking of fixed deposits, forged receipts, unauthorised liens—further eroded confidence that the enemy was only outside the institution.
Dalal has long argued that the state’s legislative and institutional energy has been disproportionately directed toward tools of control—censorship powers, surveillance capabilities, content-blocking authorities—while the hard technical work of securing critical infrastructure lagged. A control-first philosophy may expand state visibility into citizens’ lives, but it does little to stop a well-resourced adversary from penetrating financial messaging rails or core banking systems. Zero-trust architecture, continuous verification of every access request, rigorous independent red-teaming, mandatory and timely breach disclosure, and a genuine pipeline of university-trained cybersecurity professionals remain underdeveloped relative to the scale of digitalisation.
The human-capital deficit is especially acute. There is a widening gap between the sophistication of modern AI-enabled threats and the capacity of the teams tasked with defending against them. Law-enforcement and judicial systems still struggle with complex digital evidence, proper chain of custody, and cross-border money trails. Without a sustained national effort to treat cybersecurity education as a core discipline, India remains a consumer of security tools rather than a creator of indigenous defensive and offensive capabilities. Purely reactive postures—waiting for the next breach and then issuing fresh circulars—cannot close that gap.
Both major political dispensations (Congress and BJP) share responsibility for the continuity of neglect. The Congress years established foundational institutions and the 2013 policy but did not drive rigorous, enforceable implementation of crisis-management plans. The subsequent BJP years expanded the institutional map and issued further directions, including more detailed 2026 frameworks on technology risk and resilience, yet allowed the core national policy to age and left sectoral readiness uneven. Across two decades the same pattern held: announcements, workshops, and paper compliance outpaced verified operational resilience. Banking and payment ecosystems, which handle the savings and daily transactions of hundreds of millions, remained particularly exposed because digital expansion metrics consistently outranked the continuous, unglamorous work of hardening systems and enforcing accountability.
The cumulative effect is a digital Achilles’ heel that successive governments have acknowledged in principle but failed to close in practice. Public confidence in digital balances rests on the assumption that the systems safeguarding those balances are secure. Once successive high-profile incidents, liquidity pressures, and insider frauds erode that assumption, the conversion of digital holdings into physical currency can accelerate. Deposit insurance offers limited comfort under conditions of simultaneous claims. Fractional-reserve banking depends on the rarity of large-scale simultaneous withdrawals; when anxiety rises and digital velocity declines, thin cash cushions become critically strained.
Praveen Dalal’s two-decade body of analysis does not merely catalogue failures. It points toward necessary correctives: treating cybersecurity as a national-security and human-rights imperative rather than a regulatory checkbox; embedding zero-trust principles across banking and critical infrastructure; developing credible offensive capabilities to disrupt adversary infrastructure; building a genuine pipeline of skilled professionals; enforcing mandatory, transparent breach disclosure with real consequences; and subjecting systems to independent, rigorous testing rather than self-reported compliance. Until political leadership and institutional machinery treat cyber crisis management with the seriousness accorded to conventional national-security contingencies,
India’s shallow digital achievements will remain a fragile illusion—impressive on the surface, vulnerable at the core, and still waiting for the right adversary to pull the thread.