Interpreting India’s Cyber Statecraft

Introduction

This paper explores India’s cyber statecraft by illustrating how India uses its cyber capabilities, policies, and engagement in cyber diplomacy to further its national strategic objectives. The paper focuses principally on the international diplomatic and operational dimensions of India’s cyber statecraft, but it also explains the connection between domestic and international aspects of Indian strategy. India is widely seen as an influential emerging power of the Global South and as a committed advocate for reform of global institutions. However, there is considerable ambiguity surrounding India’s cyber doctrine.

Following a series of similar studies for the Carnegie Endowment’s Technology and International Affairs Program, this paper focuses on cyber diplomacy in so-called middle ground states.¹ These are states in the Global South perceived as being pivotal in the competition for influence between liberal like-minded and authoritarian states. Like previous studies on Brazil, South Africa, and Mexico, this paper situates India’s approach to cyber statecraft in the context of contemporary global debates in cyber diplomacy, principally regarding responsible state behavior in cyberspace. The complexity of India’s bilateral relationships with China and Russia and the intricacies of its approach to managing “multi-alignment” are further reasons for the considerable Western interest in understanding the objectives and mechanisms of Indian cyber statecraft.²

The United States and its like-minded partners compete with Russia and China to influence the positions which India adopts in different forums of regional and multilateral cyber diplomacy, for example regarding internet governance and norms of responsible state behavior in cyberspace. Yet, it is crucial for policymakers to understand that, like those of other members of the middle ground, India’s cyber policies emerge from a domestic political context, with Prime Minister Narendra Modi’s administration’s conception of India’s national interest as the focal point for its decisionmaking.³ To understand India’s cyber diplomacy and its wider approach to cyber statecraft, it is necessary to consider the full politico-strategic context.

India’s Ministry of External Affairs (MEA) leads the country’s engagement with the agenda of global cyber diplomacy. While the MEA feeds into the wider national cyber strategy process, the most important institutional actors lie elsewhere in the executive apparatus. In India’s case, this is highlighted by the strong institutional role of the agencies within the Prime Minister’s Office regarding the most sensitive operational aspects of India’s cyber statecraft. All this plays out amid a relative lack of public debate about the strategic value of cyber operations as a tool of India’s national strategy.

The paper explores the limits of Western states’ influence over India’s cyber strategy, providing context about what India actually wants to achieve in its cyber diplomacy and through its wider cyber statecraft, including its development and use of cyber capabilities. As with other security issues pursued bilaterally and via the Quadrilateral Security Dialogue (a partnership between Australia, India, Japan, and the United States more often known as the Quad), these states will likely find that focusing on engaging with India on the basis of shared cybersecurity interests—rather than shared values—is the most astute path.⁴ Unsurprisingly, India is keener to engage diplomatically where it perceives a domestic advantage in doing so, and conversely more circumspect on issues where it wishes to retain more autonomy.

This paper argues that India’s cyber statecraft should be interpreted as the outcome of overlapping priorities that differ from those of other states in the middle ground of cyber diplomacy: domestically, to use digital technology to drive economic growth and social development; geopolitically, to reduce dependence on China and develop internal balancing capacity through improved cybersecurity, resilience, and cultivation of offensive cyber capabilities;⁵ and globally, to play a constructive or even a leading role in multilateral normative deliberations about responsible behavior in cyberspace, emphasizing the importance of respect for sovereignty and the need for cyber capacity-building. A comprehensive appraisal of the determinants of India’s cyber statecraft is complicated by the lack of evidence regarding its current cyber operations capabilities and campaigns. Without transparency, it is difficult to gauge India’s progress to date in converting its latent cyber power into actual, operationally active cyber power.

Origins of India’s Cyber Statecraft

The tools of cyber statecraft, such as diplomacy and cyber operations (which can be defined as “operations in cyberspace that are principally intended to deliver an effect rather than gather intelligence or provide ‘goal-line’ protection to networks”⁶), are used instrumentally to further a given state’s national strategy. As such, all cyber statecraft emerges from a domestic political context that reflects a particular state’s threat perceptions and its national strategic objectives. India’s national security objectives have been shaped by its history, its geopolitical context, and the evolving nature of contemporary threats.⁷ The traditional imperatives of national security are unsurprisingly prominent. India prioritizes maintaining territorial integrity and national sovereignty, countering terrorism and insurgency, and securing its critical infrastructure. India’s national strategy has long used foreign policy to create space for the country to pursue its domestic objectives, particularly regarding economic growth and development.⁸ None of this is unique to cyber statecraft, but it is very clearly the prism through which India’s cyber statecraft is perceived, shaped, and executed.

India’s strategy is also inevitably shaped by its bilateral relationships with neighboring countries, most prominently with Pakistan and China—both of which have long-running territorial disputes with India. While Pakistan was historically the more immediate threat, including in cyberspace,⁹ Indian strategy has transitioned to focus increasingly on the threat posed by its largest and most powerful neighbor: China.¹⁰ China’s rise has been a long-term concern of Indian strategic thinking, but it has become a more urgent priority during Modi’s premiership. This shift in China-related policies has also materialized in other countries during this period, given concern about the new direction of China’s strategy.¹¹ But it creates a most difficult policy dilemma for India, given its reliance on Chinese imports and likely continued need for some Chinese expertise and investment to help achieve its economic goals.¹² As this paper argues below, threat perceptions regarding China—including perceptions of specifically cyber-related threat activity¹³—are likely to drive much of India’s development of sovereign cyber capabilities and emerging doctrine about the employment of these capabilities, especially as India experiences rapid digital transformation.

Within this wider context, the Indian government has gradually increased the priority of cybersecurity as an integral part of its national security, creating new domestic roles and institutions (such as the national cyber security coordinator and coordination center in 2015) and implementing new national cyber security policies (2013) and regulations over the last decade.¹⁴ In the same period, it has professionalized its approach to cyber (and other emerging technologies) diplomacy, building up expertise (and new sub-units) in the MEA and cultivating international partnerships to improve cyber capacity-building, for example via the rejuvenated Quad partnership.¹⁵ India has also recognized the role of operational cyber capabilities as part of the tool kit of modern statecraft—although this is more apparent in emerging armed forces cyber doctrine than it is in public statements about the country’s evolving approach to nonmilitary cyber operations.¹⁶

As is the case for many other states, the rise of cyber threats from both state and non-state actors underscores the need for India to adopt robust cybersecurity policies. Cybersecurity policies encompass the protection of critical information infrastructure, preventing cyber espionage, and mitigating the impact of cyber attacks on economic stability. Like many other states, India recognizes that effective cybersecurity requires both an active governmental role and the effective participation of a range of other stakeholders, such as civil society and the private sector.¹⁷ Again like many other states, India has found it easier to recognize the importance of this approach than to implement it effectively.¹⁸

The following section on the origins of India’s cyber statecraft highlights the principal shaping factors at the domestic level: the impact of India’s national security bureaucracy and associated politics; the modalities of domestic cyber threats; and the consequent strategy and apparatus India has developed in response to those threats. By understanding the historical, institutional, and political context in which India’s cyber statecraft has evolved, observers can better interpret the logic shaping India’s positions and actions in the international aspects of its cyber statecraft.

The Politics of National Security in India

Historical context and recent evolutions

To give further context to India’s strategy of cyber statecraft, it is important to understand the geostrategic environment shaping its national security strategy; India’s defense strategy has been persistently preoccupied with neighboring Pakistan and China. India’s domestic politics and political personalities also exert an impact on its wider strategy.¹⁹ Prime ministers are powerful albeit constrained national security actors.²⁰ In recent years, for example, there have been concerns about Modi’s centralization of authority, controversial use of surveillance tools, and alleged use of assassination as an instrument of state policy.²¹

India’s national security concerns are largely shaped by its relationships with neighboring countries, particularly Pakistan and China. Territorial disputes with these nations are central to India’s security policy. Cross-border terrorism complicates India’s relationship with both states.²² Consequently, India’s military doctrine has evolved to address both conventional and unconventional threats. Reflecting India’s long-standing pursuit of strategic autonomy and effective deterrence, since 1998 it has been a declared nuclear weapons state, sitting outside of the Nuclear Non-Proliferation Treaty but agreeing to international inspection of its civilian nuclear facilities.²³

In recent years, India has launched significant defense modernization efforts, focusing on indigenization and self-reliance under the “Make in India” initiative.²⁴ Reforms such as the creation of a chief of defense staff have aimed to enhance military coordination and strategic planning, which is an ongoing process.²⁵

India’s national security policy also involves strategic partnerships and alliances. India’s deepening ties with the United States, illustrated by defense agreements like the Logistics Exchange Memorandum of Agreement and participation in the Quad, indicate a strategic pivot to mitigate China’s influence and threat in the Indo-Pacific region. Simultaneously, India’s engagement with other states, such as Russia, highlights a persistently diversified approach to defense procurement and diplomatic alignments.

Russia remains a strategic partner, part of India’s balancing against China. At times this has made India somewhat dependent on Russian military imports, which is still reflected in the current composition of India’s armed forces.²⁶ Nonetheless, the Modi government has recently tried to diversify defense procurement and reduce this dependency.²⁷ France is another important defense partner. Over the past forty years, India’s partnership with France has included flagship projects like the Mirage and Rafale fighter jets and more recently procurement of submarines and helicopters.²⁸ The current Indian government highlights its strategic approach as being multi-vectoral, situating India outside the conception of a “two camps” approach to cyber diplomacy, in which the world is divided between Western liberal states and those spinning in orbit of a China-Russia authoritarian axis.²⁹ As yet, India does not have to and does not want to make that choice.

National security and domestic politics

Modi’s ruling Bharatiya Janata Party (BJP) has leveraged national security narratives to consolidate its political base, particularly emphasizing a strong stance against terrorism and cross-border threats. The Pulwama attack in 2019 and the subsequent Balakot airstrike exemplify how national security incidents influence public opinion,³⁰ to the point that Modi’s doctrine has been described as seeking to “securitise politics and politicise security.”³¹ There is no doubt that Modi’s administration speaks the language of realism, emphasizing the importance of power, but there is debate about the extent to which Modi has effectively pursued the enhancement of India’s hard power.³² Some researchers argue that it is more accurate to describe Modi’s approach as pragmatic and acutely aware of India’s relational weakness vis-à-vis China.³³ In addition to the veil of uncertainty that already surrounds India’s current employment of cyber operations, this ambiguity about what motivates and constrains Modi’s wider decisions about the use of (covert and overt) force makes the operational element of India’s cyber statecraft very difficult to interpret.

Turning from external threat perception to domestic politics, another prominent issue relevant to India’s wider cyber strategy relates to the tension between digital freedom and censorship. India is far from alone in navigating this relationship, between the freedom of citizens online and efforts to enhance security in and through cyberspace. This is a global issue, but among democracies India is among the most assertive when it comes to such interventions. Under Modi, the Indian government has increasingly exercised its power to restrict speech, particularly on digital platforms. India has, for example, recently had one of the highest rates of internet shutdowns anywhere in the world.³⁴ While such shutdowns are generally localized and relate to areas of unrest, their increasing frequency and duration has implications both for digital freedom and for the economy.³⁵ This arguably reflects the domestic risk appetite, realist outlook, and acute threat perception that is noted above—and which appears, in a different context, to have led to India’s rising bilateral tensions with Canada.³⁶

More broadly, content deemed to threaten public order or national security can be removed from the internet, leading to concerns about overreach and suppression of dissent. For example, Section 69A of India’s IT Act empowers the government to block online content in the interest of national security and public order, although in practice its application lacks uniformity.³⁷ The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules of 2021 impose stringent compliance requirements on social media platforms and digital news media. The government argues that these regulations are necessary to combat information manipulation, hate speech, and illegal content. However, critics claim they threaten privacy, encourage self-censorship, and provide the government with tools to suppress dissent.³⁸ This aspect of domestic policy highlights a perennial challenge for modern governments in navigating the balance between digital freedom and security. It reflects the Indian government’s threat perception and its willingness to use the levers of executive power to address these threats in ways that compromise individual liberties. This does not make India an exception among the world’s democracies, but simply highlights the importance of context and contingency in explaining how democracies respond to these dilemmas.

The politics and security implications of spyware

The use and abuse of commercial spyware has become an increasingly salient topic in global cyber diplomacy. The United States and its allies, such as the United Kingdom and France, have tried to build global agreement on principles of responsible state use of spyware and regulation of the spyware industry. India has not thus far participated in these initiatives.³⁹ Spyware controversies have affected many countries and India is no exception. In India’s case, spyware issues have manifested in two ways: the use of spyware by the Indian government and the growth of an indigenous commercial spyware industry in India that has attracted a global clientele and attendant controversy.⁴⁰

One of the most significant and controversial instances of spyware use in India involves Pegasus, a sophisticated spyware developed by the Israeli NSO Group. Pegasus has come to be associated with widespread global allegations of misuse by the NSO Group’s customers. In India, reports have emerged from 2019 onward revealing that Pegasus was used to target individuals, including journalists, activists, opposition politicians, and even government officials.⁴¹

The Indian government has neither confirmed nor denied purchasing or using Pegasus,⁴² often citing national security concerns.⁴³ Again, mirroring similar situations elsewhere—such as in the European Union—the ambiguity and lack of transparency surrounding spyware allegations have led to widespread demands in India for accountability and independent investigation. The Supreme Court of India, in response, established a technical and an oversight committee in 2021 to investigate these allegations, reporting the following year that stronger safeguards were needed, but without publicly apportioning blame to the government—which had not cooperated with the inquiry.⁴⁴

In parallel, India’s national spyware industry has grown, driven by both government demand and global private sector opportunities. Indian companies are developing a range of surveillance and monitoring tools, catering to the needs of law enforcement agencies and private clients. Indian law enforcement and intelligence agencies also rely on domestically developed spyware for various purposes, including criminal investigation, counterterrorism, and maintaining public order. The cyber-related private sector in India also appears to have been used for digital intelligence against foreign targets.⁴⁵ For example, the DoNot Team (also known as APT-C-35) has been associated with targeting apparently aligned with Indian state interests.⁴⁶ The ecosystem of companies associated with such threat activity appears to have grown over the past twenty years; techniques and targeting have similarly evolved across this period.⁴⁷

India has participated in neither the U.S.-led effort nor the UK- and France-led effort to build agreement on how states should responsibly use and effectively regulate commercial spyware.⁴⁸ In theory, India’s nonparticipation might be explained by its traditional emphasis on strategic autonomy and its reluctance to embrace Western initiatives to which it has not contributed as an original, shaping partner.⁴⁹ But there is nothing to stop India from driving a parallel initiative—for example, one pursued under the more congenial auspices of a Global South forum such as India-Brazil-South Africa (IBSA).⁵⁰ Its failure to do so suggests that strategic autonomy and upholding India’s sovereign right to make decisions about when and how it uses spyware are significant priorities that shape India’s decision not to engage further on this issue.⁵¹ It should also be noted that, in this, India is not alone in international politics: a striking aspect of both the U.S.-led and UK- and France-led processes is that they have, thus far, attracted relatively small numbers of states. But so long as India remains outside of such initiatives, the country’s large commercial spyware industry is somewhat insulated against these efforts to constrain it.

National security, bureaucracy, and cyber statecraft

Cyber statecraft emerges from a political process, and its operational aspects are shaped by the state’s national security decisionmaking apparatus.⁵² The bureaucratic politics of national security in India inevitably involve multiple powerful ministries and agencies, each with a different stake in cyber statecraft. The Ministry of Defence (MOD), the Ministry of Home Affairs (MHA), the MEA, and the intelligence agencies are the main departments and institutional actors. The influence of these entities is shaped by their responsibility for specific aspects of national security. This is all coordinated under the authority of the prime minister, assisted by the national security adviser (NSA). The NSA is the prime minister’s principal adviser and leads on institutional coordination, strategic planning, and crisis management.⁵³ The NSA also plays a role in international security affairs.⁵⁴

The National Security Council (NSC), chaired by the prime minister, is the principal advisory body and has strategic oversight for cybersecurity policy. For cyber operations, including digital espionage, whether conducted by a part of the Indian state or (conceivably) by proxies at its behest, the NSC is the relevant top-level, formal decisionmaking apparatus.

Regarding cyber policy, different departments have different policy or operational equities, with the MOD holding the equities for cyber defense and the use of cyber capabilities to support the armed forces. The integration of capabilities within the armed forces is part of ongoing efforts to improve inter-service coordination and to streamline defense affairs.⁵⁵ In contrast, cyber-relevant aspects of domestic security and counter terrorism are within the purview of the MHA. Outside of the operational space, the MEA influences national security through diplomatic agreements and engagements that involve defense and security. Formally, however, the MEA is not part of the national security apparatus.⁵⁶ Similarly, while not directly involved in security operations, the Ministry of Finance allocates budgets for defense and internal security. The financial control it exercises over defense spending gives it indirect but substantial influence nonetheless.

Like many other states, India has developed the institutional, policy, and regulatory components of its cyber statecraft over the past twenty years. The early 2000s saw emergent cyber institutionalization, with the creation of a national computer emergency response team (CERT-In) and a national cyber intelligence agency (the National Technical Research Organisation) in 2004.⁵⁷ Legislative reform followed in 2008, focused on improving the lawful basis for cyber operations and ensuring the protection of critical infrastructure.⁵⁸ India’s first National Cyber Security Policy (NCSP) was formulated in 2013. This was the first dedicated policy document providing general measures protecting cyberspace from state and non-state threats and ensuring information infrastructure security.⁵⁹ The policy outlined strategic objectives, guiding principles, and specific actions to enhance India’s cybersecurity posture. The primary objectives of the NCSP were securing cyberspace by safeguarding critical information infrastructure, reducing the vulnerabilities of information and communications technology by implementing robust cybersecurity measures, promoting public-private partnerships and international cooperation, and spreading awareness about cybersecurity across all sectors of society.

The National Cyber Security Coordinator’s (NCSC) Office—part of the NSC Secretariat—emerged out of the 2013 reform and has the primary coordinating role for domestic cybersecurity. The NCSC leads the NSA in shaping domestic cybersecurity policies, mitigating current threats and preparing to address future cyber threats.⁶⁰ The NCSC is responsible for overseeing the National Cyber Coordination Centre (NCCC) and the National Critical Information Infrastructure Protection Centre (NCIIPC). The NCCC generates vital situational awareness and facilitates timely information-sharing to protect against cyber threats, while the NCIIPC focuses on safeguarding critical infrastructure from cyber attacks. Army Lieutenant General M.U. Nair, the current NCSC, has emphasized the importance of a collaborative approach to cybersecurity.⁶¹ The NCSC also plays a key role in advising and assisting the government on policy and strategic issues related to cybersecurity. This includes working closely with CERT-In, which issues alerts and advisories on cyber threats and coordinates the national response to cyber incidents.

CERT-In and the Cyber Crime Coordination Centre (I4C) are important entities in the country’s domestic cybersecurity landscape, each playing distinct yet complementary roles. CERT-In, established in 2004, operates under the Ministry of Electronics and Information Technology (MeitY). It is the national nodal agency for responding to cybersecurity incidents. The I4C was launched in 2018 and operates under the MHA. It is designed to combat cyber crime in a comprehensive and coordinated manner.

Specific responsibilities for wider cyber-related policy and operations are managed by a variety of different institutions. Government agencies such as MeitY and the National Technical Research Organisation (NTRO) play key roles in implementing cybersecurity measures. Additionally, the government has launched initiatives such as the Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre) to combat cyber threats at the national level.⁶²

MeitY is primarily responsible for promoting the country’s digital ecosystem, which includes ensuring cybersecurity. MeitY oversees several key areas, such as the development and enforcement of cyber-related legislation, advancing research and development in cybersecurity, and enhancing the digital infrastructure to safeguard against cyber threats​.⁶³ One of MeitY’s prominent initiatives is the National Cyber Security Policy. But MeitY also administers important projects and frameworks such as CERT-In, which is responsible for responding to cybersecurity incidents and providing early warnings on potential threats. The ministry is the primary beneficiary of the recent doubling of India’s cybersecurity budget, highlighting its importance in the national apparatus.⁶⁴  

These domestic, cybersecurity-focused national efforts are separate from India’s military cyber, strategic cyber, and cyber diplomacy activities. India’s military cyber operations are pursued operationally within the Defence Cyber Agency (DCYA)—a relatively new, tri-service entity, created in 2018, that focuses specifically on cyber defense and cyber operations as these apply to the armed forces’ capabilities, platforms, networks, and systems. The DCYA is complemented by a civilian cyber capability provided by the NTRO, which is part of the Prime Minister’s Office. The DCYA therefore contributes to India’s cyber deterrence and enables it to use cyber capabilities as a tool of statecraft, actively pursuing national strategic objectives. It was estimated in 2018 to comprise 1000 personnel—but with no further detail about the different roles and skill levels within this complement.⁶⁵

Strategic cyber operations—including espionage, disruptive and destructive operations, and online information operations—are the purview of two agencies under the direction of the prime minister: the NTRO and the external intelligence agency, Research and Analysis Wing. These are, understandably, the least publicly visible aspects of India’s cyber statecraft. Strategic cyber operations are similarly obscured in all states, although there are some interesting exercises in strategic communication about the use of cyber operations to further national strategic objectives, such as the 2023 Responsible Cyber Power in Practice publication by the UK’s National Cyber Force.⁶⁶ It is an open question whether, at an appropriate point of maturity in offensive cyber capability development and employment, India might find it strategically useful (for signaling purposes, to reduce the risk of misperception) to make a similar departure from its traditional secrecy about operational matters.

Given the somewhat busy inter-institutional context outlined above, in which several agencies and departments retain operational equities, India’s MEA must coordinate between the institutions to shape the objectives that India’s diplomats bring to international forums of debate about cyber norms. Like in other states, while diplomats pursue India’s cyber diplomacy objectives, they do not own the operational equities that are at stake in the establishing of national red lines.⁶⁷ It is clear from public statements over the past decade by a range of India’s senior diplomats and securocrats that a plurality of views exists within the Modi government over the desirability of multilateral negotiations that might bring more binding constraints on states’ freedom of action in cyberspace.⁶⁸ In the absence of clear public doctrine regarding Indian cyber operations, it is an interpretive challenge to understand how India’s cyber diplomacy relates to the more operational aspects of India’s cyber statecraft.

India’s Cyber Threats 

Over the past twenty years, and particularly over the past decade, India has undergone a rapid digital transformation—driving South Asia to become one of the world’s fastest growing regions for internet connectivity.⁶⁹ In 2015, India already had 120 million users of the internet, making it the world’s third-largest user base, but with considerable room to grow considering its population.⁷⁰ By 2023, internet penetration had reached over 50 percent of the country’s 1.4 billion population.⁷¹ Digital technologies are being adopted across sectors and in both urban and rural areas, transforming the sale and consumption of goods and services and reducing the developmentally damaging digital divide.

In the past decade, the digital economy has contributed significantly to growth in India. In 2015, it was estimated that the internet contributed 1.6 percent of India’s GDP. As of 2025, the Indian IT industry alone employs 5.4 million people, estimated to contribute 10 percent of its GDP, and more than half of its services exports.⁷² Technology is also at the heart of flagship government initiatives designed to widen access to public and essential services. Aadhar, the digital biometric identity system, is providing Indians with a ubiquitous digital identity and access to government services, while the Unified Payments Interface is democratizing cashless transactions. Both systems have high levels of adoption, but they represent attractive targets for attackers as critical digital infrastructures.⁷³

Digital connectivity and innovation are important factors in the Modi government’s economic strategy. But, as the United States itself has found, the more digitized a country becomes, the more targets it presents for cyber criminals and malevolent state actors to exploit.⁷⁴ One recent estimate places India’s private sector as the second-most cyber-attacked in the Asia-Pacific region, with over 3000 such attacks per week, behind only Taiwan.⁷⁵ As in many other countries, during the coronavirus pandemic, cyber attacks targeting individuals, businesses, and government agencies increased substantially. This trend was particularly evident in India, highlighting its systemic cyber vulnerabilities.⁷⁶ Despite considerable administrative reforms over the last decade, India remains a prime target for cyber attacks, with ransomware payments estimated at $1.54 billion over ten months in 2023.⁷⁷ Again, it is important to distinguish the global picture—in which international efforts to counter ransomware crime are yet to have a significant discernible impact on the incidence of this crime—and the specifically Indian context, in which government and other stakeholders use the levers available to them to mitigate existing threats and build resilience.

The following section focuses on four main cyber threats facing India: state-sponsored attacks, espionage operations, cyber crime, and information operations from state and non-state actors.

State-sponsored attacks and espionage

State-affiliated cyber threats are most notable in the form of espionage and infrastructure-targeting. Adversarial nations, particularly China and Pakistan, have been alleged to be implicated (sometimes jointly) in numerous cyber incidents aimed at undermining India’s strategic and economic interests.⁷⁸ Conversely, cyber espionage threat actors involved in targeting China have been alleged to have an India nexus.⁷⁹

Chinese (reportedly state-affiliated) groups have been linked to cyber espionage campaigns targeting sensitive sectors such as defense, telecommunications, and government networks. The i-Soon leaks early in 2024 and the insight they provided into China’s hacking industry highlighted this potential link.⁸⁰ These espionage campaigns have targeted government, the military, and the private sector in India.

In addition to cyber espionage, India has also been the target of cyber attacks against critical infrastructures such as power plants. Some of these incidents are believed to originate in China.⁸¹ In October 2020, against a backdrop of bilateral tensions between China and India over a disputed border, the city of Mumbai experienced a significant power outage. Subsequent reporting suggested that the outage was due to a suspected cyber attack.⁸² The incident disrupted daily life and raised concerns about the vulnerability of critical infrastructure to cyber threats. According to a report by Recorded Future, malware connected with the threat actor known as RedEcho—an actor believed to be associated with the Chinese state—had been present on India’s electricity network at the time of the outage.⁸³ The group’s activities included deploying malware in systems belonging to Indian power generation and transmission organizations. The report was, however, unable to examine the claim that the Mumbai outage was directly attributable to a cyber attack.⁸⁴ And a subsequent Indian government inquiry called into doubt the cyber attack scenario, suggesting that equipment failure was the cause.⁸⁵

Whatever the ultimate provenance of the Mumbai outage, the wider malware campaign against Indian infrastructure highlights the strategic context in which cyber operations target India’s critical infrastructure. India is obviously not the only state in which Chinese threat activity on infrastructure is suspected. There are several factors that shape a state’s response to being the victim of a cyber operation.⁸⁶ The United States government, for example, has formally attributed both digital espionage and infrastructure pre-positioning operations to Chinese threat actors, such as Flax Typhoon, Salt Typhoon, and Volt Typhoon.⁸⁷ Three notable differences in the India-China case are that: (1) there is suspicion that a disruptive cyber operation has actually been conducted against infrastructure targets, rather than a pre-positioning phase; (2) the cyber interactions between India and China take place in the context of a bilateral relationship that includes a disputed border; and relatedly, (3) the Indian government has been much more circumspect than the U.S. government in its public handling of these issues.

One pertinent observation is that, given the claims and counter-claims made by India and China about one another as cyber threats, it might well be difficult for these two countries—either bilaterally or collaboratively within a grouping such as BRICS—to develop shared proposals to advance the global agenda of cyber diplomacy. They might find common cause on a range of less controversial issues in the bilateral relationship, such as the importance of sovereignty and the role of states in internet governance, or exhortative rather than prohibitive global cyber norms. Unless the recent rapprochement between Modi and Chinese President Xi Jinping fundamentally transforms the bilateral relationship, there is much that divides India and China despite their cooperation on certain issues. Cyberspace appears to be a domain in which these complexities and tensions are given heightened operational expression. A bilateral cyber risk-reduction dialogue might at some point be desirable to both sides, but, somewhat akin to the agreement in 2015 between Xi and then U.S. president Barack Obama, the outcomes of such an agreement would be contested and fragile, and the momentum to negotiate it would likely only arise when both sides perceived it as advantageous.⁸⁸

Cyber crime

Cyber crime by nonstate actors is another rapidly growing concern for India, with attacks becoming more frequent and sophisticated. Sometimes these criminals are based within India itself,⁸⁹ but there is also considerable foreign-origin cyber crime targeting India, particularly regarding ransomware crimes.⁹⁰ None of this is surprising: as the world’s fifth largest economy, with a thriving digital sector, it should be expected that India would experience the global trend of rising cyber crime. And as the global effort to counter ransomware cyber crime has demonstrated, no single state has the power to solve this problem, and it is proving difficult for existing multi-state and multi-stakeholder efforts to counter.

According to the Oxford Cybercrime Index, which ranks countries most affected by cyber crime, India ranks tenth, below the UK and Brazil, but above Iran and Belarus.⁹¹ According to India’s National Cybersecurity Coordinator, Lieutenant General M.U. Nair, ransomware payments doubled between 2022 and 2023, and India experiences nearly double the global average of cyber incidents.⁹² Cyber criminals target individuals, businesses, and government entities. Cyber crime includes ransomware, data breaches, and fraud. Ransomware has affected numerous Indian businesses, causing operational disruptions and financial losses. Similarly, data breaches targeting financial institutions and e-commerce platforms have compromised the personal and financial information of millions of Indians. This vector has recently expanded to targeting election systems and databases.⁹³

In August 2018, Cosmos Bank, one of India’s oldest cooperative banks, suffered a massive breach by cyber criminals, resulting in a loss of approximately $13.5 million (94 crore rupees). Cyber criminals infiltrated the bank’s systems and manipulated the ATM switch server, enabling them to authorize fraudulent transactions across twenty-eight countries. The attackers withdrew cash from ATMs and conducted unauthorized SWIFT transactions, exploiting vulnerabilities in the bank’s network security. This crime was attributed to North Korean threat actor the Lazarus Group.⁹⁴ The same year, another major data breach was reported involving India’s Aadhaar system, managed by the Unique Identification Authority of India (UIDAI). Investigations revealed that unauthorized access to Aadhaar data was being sold on the black market.⁹⁵ For as little as 500 rupees (approximately $7), individuals could obtain access to the personal information of over a billion Indian citizens, including biometric data. This breach raised significant concerns about data privacy and the security of the Aadhaar system.⁹⁶ In March 2021, digital wallet and payment service provider MobiKwik faced allegations of a massive data breach affecting 3.5 million users. Hackers reportedly accessed and posted sensitive user data, including names, email addresses, phone numbers, and payment information, on the dark web.⁹⁷ The breach exposed vulnerabilities in MobiKwik’s security infrastructure and highlighted the growing threat of cyber crime targeting financial technology companies in India.

It is notable that while the state-sponsored threats facing India in cyberspace mirror its principal non-cyber threats (for example, from China and Pakistan), when it comes to cyber crime, India faces similar attacks to those on many other states. For example, despite India’s strategic ties to Russia, Russian ransomware criminals have victimized Indian targets as readily as targets in states with worse bilateral relations.⁹⁸ The issue is not that the Russian state is directing cyber criminals to victimize India. It is that the Russian state is either unable or unwilling to dissuade them from doing so. There is, however, as yet no evidence that this situation is adversely affecting that wider bilateral relationship.

Terrorist propaganda

Another category of non-state threats facing India in cyberspace is terrorism. Organizations such as the Islamic State (IS) and al-Qaeda have used online platforms both for recruitment, indoctrination, and spreading propaganda in India. In 2014, al-Qaeda announced in a widely shared online video the formation of its Indian subcontinent branch, al-Qaeda in the Indian Subcontinent. The video called for attacks against Indian targets and aimed to incite violence among Indian Muslims.⁹⁹ Such propaganda efforts are part of broader strategies of radicalization and regional destabilization. In 2014, the arrest of Mehdi Masroor Biswas, an Indian engineer from Bangalore who ran a prominent pro-IS Twitter account, highlighted the group’s digital reach in India. Biswas’s account, which had tens of thousands of followers, was used to glorify IS activities and attract new recruits.¹⁰⁰

Hacktivism

Hacktivist groups such as Anonymous India have conducted cyber protests and data leaks to promote a variety of campaigns. These activities, while often nonviolent, can cause significant reputational damage and some operational disruption. For example, hacktivists have defaced Indian government websites and released sensitive information to facilitate protests against government policies. Most prominently, Anonymous India launched a series of cyber attacks in 2012 dubbed “Operation India” in protest against the Indian government’s stance on internet censorship and corruption. The group targeted several government websites, including the websites of the Indian National Congress party, the Bharatiya Janata Party, and the Supreme Court of India.¹⁰¹ These attacks involved defacing websites and leaking sensitive data to draw public attention to issues of transparency and freedom of speech.

More recently, Indonesian hacktivist groups have hacked and defaced Indian government websites in response to the Indian position in the conflict between Israel and Hamas.¹⁰² This hacktivism aims to amplify dissent and to disrupt governmental operations as a form of digital protest. None of this implies that India is uniquely a victim of hacktivism. The Canadian government’s Center for Cyber Security, for example, recently stated that, during the on-going bilateral dispute between Canada and India, a “pro-Indian hacktivist group” had claimed responsibility for disrupting and defacing websites, including that of the Canadian Armed Forces.¹⁰³

India’s ongoing digital transformation, marked by increasingly widespread internet penetration and digital technology adoption across various sectors, has made the country an increasingly attractive target in cyberspace. The threat landscape encompasses both state and non-state actors. India is not unique in this respect, given the recent global rise in cyber threats. Nonetheless, as an increasingly large and increasingly digitized economy, India is a bigger target than many. The next section explores how Indian policy and strategy is used to counter these cyber threats.

Cybersecurity Strategy

The past decade has been a period of intensifying effort by states to develop effective, well-coordinated cybersecurity strategies. This effort includes improvements in domestic governmental cybersecurity apparatus and legislation, as well as improving relationships between government and domestic stakeholders, and between the state and its international partners. As outlined above, India’s experience over the past twenty years mirrors these wider global trends.

Most recently, in April 2023, CERT-In published a series of new directives for reporting cybersecurity incidents, which was followed later that year by the publication of a National Cyber Security Reference Framework (NCRF).¹⁰⁴ The NCRF was produced by the NCIIPC and funded by the NSC. It superseded the NCSP from 2013, providing a structured framework for identifying the cybersecurity responsibilities of different institutions and stakeholders. The NCRF focuses particularly on seven sectors of critical infrastructure—banking and financial services, energy, government enterprises, healthcare, strategic enterprises, telecommunications, and transportation—that have seen the sharpest rise in cybersecurity threats. The NCRF improves guidance on governance, management, and the architecture of both information technology and operational technology systems.¹⁰⁵

Like other countries over the last decade, India has recognized that the pace and intensity of cyber threats requires a revised national response at the strategic level. The NCRF’s focus on areas of critical infrastructure highlights the priority of threats to infrastructure from cyber criminals and hostile state actors. While the publication of a new framework a decade after the NCSP is a slow response, the more important question is how effectively the government will coordinate national cybersecurity policy implementation and operations in practice. The NCRF is still comparatively new, but the government will need to monitor feedback and continuously review its effectiveness in countering cyber threats.

Cyber Capabilities

India is not regarded as a global top-tier cyber power.¹⁰⁶ It has even been described as a “muddling cyber-power.”¹⁰⁷ But assessment of India’s cyber power is made difficult by the lack of open-source information about its capabilities and operations, or of publicly available cyber doctrine explaining the principles behind their use.¹⁰⁸ Nonetheless, it is clear that cyber threat actors engaged in intelligence collection, and assessed as having a possible Indian connection—without any evidence of a governmental affiliation—have become more numerous, more capable, and more diverse in their targeting over the past decade.¹⁰⁹ There is very little public visibility regarding India’s capabilities in cyberspace—but absence of evidence is not necessarily evidence of absence.

Recognizing the importance of cyber resilience and defense, India has focused on developing cyber capabilities for intelligence collection, defensive, and offensive operations. The NCCC, established in 2015, aims to streamline cyber-related intelligence collection.¹¹⁰ Resource constraints and skills shortages reportedly undermine its effectiveness—a globally ubiquitous theme for governmental cybersecurity. India’s cybersecurity workforce requirement is estimated to be around 1.5 million professionals by 2025. Its cyber workforce gap—currently estimated at 30 percent —is expected to widen even further as demand grows faster than the available supply.¹¹¹

From a military perspective, the Indian Armed Forces have invested in both defensive and offensive cyber capabilities; their capacity is likely equal or superior to that of Pakistan, but inferior to that of China.¹¹² This is partly due to the lack of institutional prioritization of emerging technologies for military purposes.¹¹³ India’s offensive cyber capabilities are developing, and the MOD has recently operationalized its command cyber operations and support wings.¹¹⁴ Yet they are characterized by regional focus and notable limitations.¹¹⁵ In the past, India’s offensive cyber operations have reportedly primarily targeted Pakistan.¹¹⁶ While firm evidence is elusive, it seems plausible to speculate that, over the past five years, India’s offensive cyber program has been affected by the same shift in strategic thinking that has influenced non-cyber activities in India’s statecraft: affording a higher priority to development and employment of capabilities to address China.

India has the wider foundational infrastructure needed for offensive cyber strategies, including a robust information technology sector, intelligence, surveillance, and reconnaissance capabilities, and relevant institutions like the DCYA. As mentioned above, the DCYA, established in 2018, is designed to conduct offensive and defensive cyber operations, functioning similarly to a cyber command structure. In addition to the DCYA, the civilian NTRO also retains a cyber operations mission (in addition to its digital espionage mission), but there is little public clarity about how effectively the two complement each other—or whether deconfliction is even necessary.¹¹⁷ There is little public information about the NTRO, the budget and operations of which are classified, although recent reporting suggests the intra-government view is that the agency requires reinvigoration under new leadership.¹¹⁸ Similarly, public information suggests that the DCYA is an inchoate agency, whose development is proceeding more slowly and with fewer resources than the armed forces had desired.¹¹⁹ In both cases, information is scarce, but the tentative conclusion regarding India’s national cyber operations institutions is that they are not yet where India needs them to be.

Despite ongoing investment in capability development, India’s offensive cyber efforts could be undermined by the absence of a comprehensive and cohesive cyber strategy, as well as by the resource constraints reportedly noted above.¹²⁰ These gaps could inhibit the full operationalization and strategic use of offensive cyber capabilities. Without a unified strategy, resource allocation and capability integration will remain inconsistent, limiting the overall effectiveness of India’s cyber operations​.¹²¹ But without insight into the inter-institutional status quo, it is difficult to appraise the current state of offensive cyber maturity and coordination. Perhaps the most obvious question from the outside is where India’s government prioritizes investment in military cyber (both cyber defense and cyber operations in support of the armed forces) in comparison to investment in cyber capabilities to deter, or if necessary respond to, hostile actors’ disruptive or destructive operations against India’s critical infrastructure. This debate is wholly opaque to outsiders, but it is likely that the bilateral tensions with China after 2020 have intensified efforts to improve the maturity and strategic utility of the latter capabilities.

Beyond low-level degradation and website defacement activity—often associated with moments of tension—between India and Pakistan, there have also been reports of similarly low-level activity against Canadian government targets in 2023, during a period of bilateral tension with India (see below).¹²² This activity was reportedly claimed by a hacker group known as the Indian Cyber Force.¹²³ This group is reportedly reactive, for example conducting similar low-level disruptive attacks in subsequent months against Qatari and Hamas-related websites.¹²⁴ While the activities of this group appear to be aligned with a certain conception of India’s interests, it is not publicly known whether or to what extent this group is associated with Indian governmental or political actors.

There is significant ambiguity about India’s cyber doctrine.¹²⁵ This ranges from questions about potential use of proxies to specific questions about how the DCYA and NTRO might operate. Whether this ambiguity is a bug (a simple absence of clear doctrine) or a feature (a deliberate effort to increase uncertainty) is less apparent. Of course, there could be elements of both. Notwithstanding, India’s growing cyber capabilities are supported by a dynamic private sector and foundational cyber institutions. It would be prudent for India to continue to improve its cyber capabilities—the public statements of senior Indian officials (see below) suggest they recognize this and that political will perseveres, despite a few dissonant notes about the institutions responsible for cyber operations.

For India to benefit fully from its cyber capabilities as tools of national statecraft, the government will need strategic patience and an integrated, whole-of-nation approach to cyber statecraft.¹²⁶ It will also need to be clear about the effects it wants to achieve and how these serve specific national objectives.¹²⁷ The DCYA must, for example, coherently prioritize between different objectives, integrate cyber effects in support of each service in the armed forces, and (if it conducts cyber operations below the threshold of armed conflict) deconflict clearly with NTRO and the Research and Analysis Wing (India’s external intelligence service).

India’s Cyber Strategy and Foreign Policy

Modi’s Foreign Policy Agenda

To understand how cyber policies and equities contribute to India’s national strategy, it is important to situate cyber-related issues within the context of Indian foreign policy, particularly as it has been pursued under Modi since 2014. India’s approach to cyber diplomacy, like India’s other foreign policy, is influenced by a combination of historical legacies, regional dynamics, and evolving debates about global governance. It is important to understand how India’s cyber diplomacy is situated in this context, rather than seeing Indian cyber diplomacy through a distorting prism of standing between two camps of like-minded states and authoritarian states.

Whilst significant executive power has always been vested in the prime minister and his office, Modi has reportedly centralized foreign policy decisionmaking to a considerable extent, driving key initiatives and setting the strategic direction.¹²⁸ Under Modi, the Prime Minister’s Office has become the pivotal player in foreign policy, overseeing critical decisions and ensuring alignment with the broader political agenda.¹²⁹

The MEA also remains a crucial actor in formulating and implementing foreign policy. It provides expert advice, conducts diplomatic negotiations, and manages India’s international relations on a day-to-day basis. On the other hand, the Indian defense establishment, including the MOD, the armed forces, and the intelligence agencies, significantly influences the more securitized aspects of foreign policy. The long-serving National Security Adviser Ajit Doval plays a key role in coordinating between different branches of the government and directly advising Modi.¹³⁰ From the perspective of cyber statecraft, it is clear that securocrats are likely to have most influence in calibrating the development of India’s tacit doctrine and decisions about the employment of capabilities. This establishes the context and boundaries within which India’s diplomatic positions can be crafted regarding the agreement of norms of responsible state behavior in cyberspace.

When Modi entered office in 2014, commentary speculated that his foreign policy would be steeped in nationalism but also reflect pragmatic prioritization of relationships—including with China—that would promote India’s economic growth.¹³¹ Furthermore, alongside its deprecation of the Nehruvian concept of nonalignment, Modi’s administration has made much of the importance to India of pursuing a diplomacy of “multi-alignment.¹³² A key element of this approach—mindful of the threat posed by China—has been maintaining India’s relationships with both the United States and Russia. This has become an even more delicate balancing act since Russia’s full-scale invasion of Ukraine in 2022, which left it more reliant on China. Some commentators concerned that India can no longer rely on Russia vis-à-vis the China threat.¹³³ Others doubt whether Western states should pursue close relations with India, given Modi’s domestic policies and his willingness to maintain such close ties to Russia.¹³⁴

Modi’s foreign policy has emphasized the principle of strategic autonomy, echoing a wider priority of his governing agenda: the need for atmanirbhar bharat (self-reliance).¹³⁵ An important motivation for the cultivation of strategic autonomy is the perceived need to decouple from China and “derisk” that bilateral relationship. While India would prefer to regard China simply as a major trade partner, the recent turn in China’s foreign policy—and specifically the issue of border tensions—has forced Modi to adopt a different approach, particularly from his second term (starting in 2019) onward.¹³⁶ Tensions with China, given China’s rising military power and India’s relational weakness, have worried both India’s political elite and its population as a whole.¹³⁷ One consequence of this perception shift—which is likely to endure despite the apparent diplomatic progress made in late October 2024 in reducing risk and building confidence over the bilateral border issue¹³⁸—is that India is increasingly careful to separate economic and security-related issues in the bilateral relationship. This is a step that will be familiar to readers in North America and Europe.¹³⁹

Lacking the military power to rely solely on itself to balance China, India has needed to pursue a range of closer ties to the United States and other states interested in balancing against China.¹⁴⁰ This can be seen most clearly in the rejuvenated Quad partnership. Over the past three years, the Quad has been developing an initiative to improve the cybersecurity of critical infrastructure, supply chains, and the software development process; to facilitate coordination and knowledge-sharing between the Quad’s members; and to enhance cybersecurity across the Indo-Pacific region.¹⁴¹

Beyond China, the Modi administration has pursued regional cooperation as the cornerstone of its foreign policy. The South Asian “neighborhood” is, understandably, India’s first priority.¹⁴² Precisely because of its relative size in the region, India’s diplomacy toward its neighbors needs to reassure and at times placate them—what one scholar has referred to as managing the effects of “small neighbor syndrome”¹⁴³—and there are limits to what India can achieve.¹⁴⁴ The Modi government has pursued this priority through initiatives such as the “Act East” policy since 2014, with a focus on Pakistan and Bangladesh.¹⁴⁵ The extent to which India’s immediate region demands executive bandwidth fluctuates over time; the recent political crisis in Bangladesh, for example, necessitated more urgent prioritization.¹⁴⁶

Modi’s geopolitical ambitions for India certainly extend beyond its immediate neighborhood, toward a more influential global role. India also engages in multilateral forums such as the BRICS and the G20. BRICS is important as a platform for signaling and for enabling India to amplify the voice of the Global South in international debates. BRICS has, however, achieved relatively modest outcomes in policy terms as yet, primarily in efforts to diversify international financial arrangements and institutions.¹⁴⁷

For all Modi’s ambition, it is clear that there are limits to what India can achieve globally. Karthik Nachiappan, for example, suggests that India should be seen more as a “premature power” than a “rising power,” reflecting the sharp constraints on wider diplomatic action implicit in India’s immediate need to pursue economic growth and secure its periphery.¹⁴⁸ This sense of limits—and indeed of relational weakness—is also discernible in relations with China, where, although India has sought to foster balancing partnerships with other states, “New Delhi’s relative weakness compels it to avoid provoking Beijing.”¹⁴⁹ How India juggles the extent and intensity of these balancing commitments alongside direct management of its bilateral relationship with China will shape its wider statecraft, in which cyber diplomacy and cyber operations both play a part.¹⁵⁰

One issue that has appeared to complicate India’s closer partnerships with Western states is the ongoing controversy over alleged Indian involvement in extraterritorial killings. Under Modi, there has reportedly been an increase in external operations against individuals and groups deemed to be a threat to India’s national security.¹⁵¹ In 2024, for example, India’s defense minister appeared to confirm the existence of a targeted killing policy against individuals based in Pakistan and associated with Islamist movements.¹⁵²

Canadian Prime Minister Justin Trudeau publicly raised serious allegations in 2023 of India’s involvement in the assassination in Canada of a Sikh separatist, Canadian national Hardeep Singh Nijjar.¹⁵³ Since then, Canadian authorities have charged three Indian nationals.¹⁵⁴ Whilst the Indian government denied involvement, the incident has certainly had deleterious consequences for the bilateral relationship, with India expelling forty-one Canadian diplomats and suspending the processing of visas in response to these accusations.¹⁵⁵ There have also been (see above) reported Indian hacktivist disruptions of Canadian government websites following these statements.

This issue has also strained India’s relations with the United States.¹⁵⁶ Last year, American prosecutors charged an Indian national suspected of planning another assassination, this time in the United States. The indictment revealed the existence of a large-scale assassination plot targeting numerous Khalistani activists across the United States and Canada.¹⁵⁷ This has already had specific repercussions for Indo-U.S. security relations, with the U.S. Congress delaying an arms sale.¹⁵⁸ The bigger issue is the possibility that this episode will ultimately undermine the trust and slow the momentum behind India’s closer ties with the United States and other states keen to balance against China. External Affairs Minister S. Jaishankar’s books, published over the last decade, articulate a vision of foreign policy that combines both an active pursuit of multiple vectors of diplomacy with a focus on developing and, where necessary, using hard power to pursue India’s goals.¹⁵⁹ Perhaps the most plausible interpretation of the targeted killing issue—notwithstanding the Indian government’s denial—would be that, if such a policy exists, it reflects an exploratory dimension of India’s statecraft, willing to calibrate and re-calibrate actions according to their impact. A number of recent articles by Western commentators have explored a similar theme, namely how to manage a relationship with India that is premised on an alignment of interests that are shared only up to a point.¹⁶⁰

For Jaishankar, India’s contemporary foreign policy embraces the imperative of “engaging in multiple directions and constantly balancing competitive relationships.”¹⁶¹ The priority of maintaining a “multipolar Asia” and balancing against security risks from China explains India’s continued pragmatic relationship with Russia, despite the dismay of India’s Western partners.¹⁶² Whether or not Russia ultimately proves itself an unreliable partner for India vis-à-vis China, this should not be the focus of Western diplomacy with India. Instead, Western diplomats should focus on building from the starting point of initiatives such as those pursued under the umbrella of the Quad. The agenda should be one of pragmatic, incremental, and mutually beneficial projects that are unencumbered by high-flown rhetoric about alliances and shared values.¹⁶³ Jaishankar applies this approach to foreign policy generally and to engaging India as part of global cyber diplomacy specifically. 

Indian Cyber Diplomacy

Cyber diplomacy plays a growing role in India’s foreign policy agenda.¹⁶⁴ For example, the MEA created a dedicated Cyber Diplomacy Division (CDD) in 2017, the year it hosted the Global Conference on Cyberspace, to complement the existing division of Disarmament and International Security Affairs. CDD covers both bilateral cyber dialogues and multilateral cyber negotiations, including the UN cyber norms process, internet governance, and international negotiations about data protection.¹⁶⁵ This was an unsurprising development, given the increasing importance of cyberspace in national security, economic development, and international relations. India’s cyber diplomacy is characterized by a mix of confidence- and capacity-building measures, diplomatic engagement, and efforts to shape global cyber governance norms. Its highest cyber priorities are consistent with Jaishankar’s philosophy that there is a general need for states to pursue a “securitizing of the routine” to guard against foreign subversion and threats to critical infrastructure.¹⁶⁶

There is some disagreement in scholarly and policy-focused literature about how best to interpret India’s record in cyber diplomacy. Some scholars emphasize that India has been actively engaged for two decades in United Nations processes from the Group of Governmental Experts (GGE) onward and has a track record of explicit support for multilateral processes shaping norms of responsible state behavior in cyberspace.¹⁶⁷ They cite, for example, India’s successful advocacy of the Open-ended Working Group (OEWG) as a more globally representative forum for cyber norms discussion than the GGE.¹⁶⁸ Yet other scholars have been underwhelmed by India’s substantive achievements in cyber diplomacy.¹⁶⁹ Moreover, some are skeptical of how carefully coordinated India’s diplomatic positions have been, both within government and between governmental and other stakeholders. They argue, quite plausibly and reasonably, that India most keenly engages only on those issues it prioritizes as strategically important.¹⁷⁰

In a 2016 speech, India’s then deputy national security adviser Arvind Gupta clarified India’s globally mainstream view that “there is now a growing recognition that international law, particularly the UN charter, applies as much as to cyberspace as to other domains.” He further observed, somewhat elusively, that debate was “inconclusive” on whether “intervention through cyber means in other countries’ networks…is justified or not.”¹⁷¹ Gupta commented in that speech that there might be a say-do gap between what states claim while participating in cyber norms diplomacy and their actual conduct in cyber operations: “It is quite possible that states may be clandestinely developing arsenal of tools of cyber-attack even as they discuss the need for accepted norms in cyberspace.”¹⁷² This comment perhaps indicates one source of India’s reluctance to become more proactive in the cyber norms debate. Through the lens of Jaishankar’s pragmatism, it is possible to speculate about the nuanced relationship between diplomacy and action in India’s cyber statecraft.

Notwithstanding the more operational aspects of India’s cyber statecraft,¹⁷³ India advocates for a rules-based international order in cyberspace, emphasizing principles such as the peaceful use of cyberspace, respect for sovereignty, and non-interference in the internal affairs of states.¹⁷⁴ India’s cyber diplomacy appears therefore to be situated in the mainstream of global efforts to promote responsible state behavior and prevent the militarization of cyberspace. One former senior Indian diplomat, Ambassador Asoke Mukerji, who played a significant part in coordinating India’s cyber diplomacy dialogues, has even advocated for a more binding international cyber agreement.¹⁷⁵ This opinion is an outlier: it is more common for India’s cyber-diplomatic positions to reflect specific national interests. For example, India has emphasized the importance of trusted supply chains in cyber diplomacy forums, indicating the high national security priority of this issue in light of bilateral tensions with China.¹⁷⁶ Similarly, in its cyber-related activities under the auspices of the Quad, India is pursuing enhancements of its domestic cyber security capacity and not engaging with other Quad members on more controversial issues of potential diplomatic disagreement.

Arindrajit Basu has argued that there is relatively little disagreement between domestic stakeholders about India’s role in global cyber diplomacy. He suggests that the reason for this is that none of these stakeholders have been able to precisely articulate a clear view about what India actually wants to get out of the global process, apart from instrumental improvements in its domestic cybersecurity capacity and resilience.¹⁷⁷ Basu’s argument reflects wider recognition that public debate about cybersecurity should be broader and deeper than it presently is.¹⁷⁸ The result in India, argues Basu, is somewhat “passive” stakeholder engagement in India’s cyber diplomacy, complemented by a governmental position that neither opposes nor proactively embraces the multistakeholder nature of cyber diplomacy.¹⁷⁹ Official Indian cyber delegations, for example, rarely include a multistakeholder component. India does, however, conduct ad hoc stakeholder engagement and supports a variety of conferences, including hosting the fifth Global Conference on Cyberspace in 2017.¹⁸⁰

In the absence of a prominent contribution from civil society stakeholders, Indian cyber diplomacy is shaped principally by national interest and the institutional capacity.¹⁸¹ Scholars have highlighted prominent themes in India’s cyber diplomacy statements in multilateral forums, including concern for sovereignty, autonomy, multilateralism, capacity-building, cyber terrorism, and supply-chain security.¹⁸² These situate India somewhere between the liberal and sovereigntist camps in global cyber diplomacy and some observers wonder how long India will be able to modulate its position between these two camps.

India’s cyber diplomacy, therefore, exhibits the same flexibility and pragmatism as its wider foreign policy, supporting, in turn, the GGE, the OEWG, and the ad hoc committee to negotiate a global cyber crime treaty.¹⁸³ This tension should be familiar from the survey of India’s wider foreign policy dilemmas regarding China and Russia. But there is a further, cyber-specific question that bears on the coherence of India’s cyber statecraft: how to resolve any implicit tension between India’s choices about cyber diplomacy and its priorities regarding cyber operations.

India actively participates in a wide variety of international forums and initiatives aimed at shaping global cyber governance norms. This includes engagement via organizations like the United Nations and the International Telecommunication Union, and partnerships such as the Shanghai Cooperation Organisation (SCO) and BRICS. However, bilateral tensions between India and other member states (China in BRICS, and both China and Pakistan in the SCO) render these organizations implausible as vehicles for substantive cybersecurity cooperation.

The U.S.-India cybersecurity partnership is one of the deepest and most enduring collaborations India has in the cyber domain. Initiated nearly twenty years ago, this partnership formally began with the establishment of the U.S.-India Cyber Security Forum, which was first convened in 2002.¹⁸⁴ There is now a long-established track record of collaboration between the two governments, but also more widely through academia, the private sector, and joint research and development initiatives in science and technology, including cybersecurity.¹⁸⁵

Bilateral cyber cooperation between India and the United States is now complemented by the wider initiatives emerging under the auspices of the Quad.¹⁸⁶ Cybersecurity has emerged as a significant pillar of activity for the Quad both because it is a shared national security priority amongst Quad member states and because it is amenable to a wide range of relatively soft coordination, capacity-building, and educational initiatives.¹⁸⁷ These initiatives are desirable in themselves—building cybersecurity and resilience—but are also helpful in providing opportunities to elaborate and intensify the Quad as a strategic tool. However, the progress being made on cybersecurity issues within the Quad should not raise hope of a convergence between India and like-minded states on other issues where they are not obviously aligned with India’s national interest, such as commercial spyware.

India’s cyber diplomacy thus provokes a surprisingly wide range of different views, from plaudits for its active engagement and broadening of global representation in cyber diplomacy to criticism of its past administrative disorganization and “largely non-committal” relationship with the norms of cyber diplomacy.¹⁸⁸ One reason for this seeming inconsistency is probably the fact that cyber diplomacy is but one tool of a wider cyber statecraft. It is genuinely difficult to appraise the effectiveness of any single tool when the contours of the full agenda are (potentially by design) somewhat blurry. As Basu and Nachiappan have argued, it would be entirely in keeping with the Modi administration’s wider preference toward diplomatic flexibility for India’s cyber diplomacy to leave itself plenty of room to maneuver.¹⁸⁹ It is also consistent with Jaishankar’s analysis of contemporary international relations, namely that norms are being eroded and states are responding by developing a wide array of capabilities and demonstrating an appetite to use them assertively to pursue national strategic objectives.¹⁹⁰

Conclusion

India’s cyber statecraft is a set of tools to facilitate India’s wider national strategy and foreign policy agenda. Its different elements reflect Modi’s prioritization of national security and commitment to India’s strategic autonomy, including in diplomatic debates about re-balancing global governance. As cyberspace continues to evolve as a domain of international competition and cooperation, India’s approach to cyber diplomacy under Modi will likely remain pragmatic. It will adapt to emerging challenges and opportunities, and will continue to prioritize the safeguarding of India’s sovereign freedom of action.

Western cyber engagement that goes with, rather than against, the grain of this orientation is likely to be the most effective. Overtures from the United States and other like-minded states that focus on contributing to India’s security and developmental priorities will be more constructively received by Modi than those that focus on those areas of India’s domestic cyber policies—such as surveillance and spyware legislation—that touch on more sensitive issues of sovereignty and autonomy. But the United States and like-minded countries have a range of options, levers, and forums at their disposal to pursue influence on those areas where it is likely to be most effective.

There is some debate about precisely how to interpret India’s embrace of the global cyber normative process and what the future might bring for India’s cyber statecraft. It is particularly difficult, for example, to assess the existence or extent of the say-do gap between India’s normative statements and its discreet development and employment of cyber capabilities. Reportedly Indian threat actors appear to be more focused on espionage than pre-positioning for offensive cyber operations. But this apparent prioritization of espionage begs the question of how to interpret the available evidence, both in terms of its accuracy and completeness in conveying present reality (is our visibility consequentially limited?¹⁹¹), and in its reliability as a predictor of future developments in India’s cyber doctrine—that is, as India becomes more operationally potent, might its government be tempted to assert itself more in cyberspace?

Notwithstanding India’s security competition with Pakistan, it is the bilateral relationship with China which will be the most significant outside factor in shaping India’s wider cyber statecraft. Tensions with China reduce the extent to which India perceives BRICS and the SCO as forums for cybersecurity cooperation. This makes less difference in the field of norms and capacity-building, but even here cooperation will be carefully bounded to reduce risk.

Given the strength of its digital economy and innovation, and its potential for further growth in connectivity, digital inclusion, and workforce development, India has considerable latent cyber power. There are, however, significant obstacles to converting latent into actual power—and indeed in orchestrating its effective use. Future developments should focus principally on investment in and improved coordination of domestic cybersecurity, resilience, and cyber defense.¹⁹² 

India’s next steps in cyber strategy are also likely to include continued pursuit of offensive capabilities and an appetite to use (and signal the potential use of) these capabilities more assertively against India’s adversaries. This would need to be handled carefully, learning lessons from elsewhere about how to calibrate such operations and achieve effects in and through cyberspace. These are difficult, sensitive discussions for India’s strategic partners to cultivate with its relevant national security institutions. Such efforts could usefully be complemented by sponsoring Track II dialogues on these issues, thus improving the nuance of think tank and other deliberations about the operational aspects of India’s cyber statecraft.

Most importantly, India needs to clarify what effects it means to generate through the use of cyber capabilities and what contribution it intends to make to wider statecraft, and work backward from there to address outstanding issues of resources, organization, and execution. India would then benefit, in due course, from pursuing more transparency about its cyber doctrine, not least as a confidence-building measure to reduce the risk of misunderstanding and to improve regional cyber stability. There are interesting lessons to learn here from observing such efforts elsewhere, such as those of the UK’s National Cyber Force. Despite alternative views of what could be achieved by more coherent or assiduous cyber norms diplomacy,¹⁹³ it will be India’s success in developing the other aspects of its cyber statecraft that will shape the requirements of its cyber diplomacy, as will the reciprocal efforts of its adversaries across all elements of statecraft.

Acknowledgments 

The authors would like to thank the Defence Science and Technology Laboratory (Dstl) for funding this research through the Engineering and Physical Sciences Research Council (EPSRC) as part of the project on Cyber Statecraft in an Era of Systemic Competition. We are also very grateful to the Carnegie Endowment’s Technology and International Affairs Program, including the editorial team and very helpful reviewers. The paper does not, however, reflect the views of the Dstl, the EPSRC, the Carnegie Endowment for International Peace, or King’s College London. The authors benefited greatly from a range of conversations with other researchers and experts, including in a December 2024 roundtable discussion at King’s College London. All errors and omissions are, however, the sole responsibility of the authors.