Protecting critical information infrastructure: IT Act Sections 70, 70A and 70B
Why in news: Hackers altered refrigeration controls at hundreds of French supermarkets, spoiling food and causing fires, Al Jazeera reported on 13 October 2026.
Critical information infrastructure, under the Information Technology Act, 2000, is a computer resource whose loss would cripple national security, among other things. Section 70 lets governments notify such systems as protected; NCIIPC guards them and CERT-In responds to incidents. A cyberattack on refrigeration controls at hundreds of French supermarkets was reported on 13 October 2026.
Syllabus: Prelims · Current Affairs & IR; GS2 · Statutory & Regulatory Bodies; GS3 · IT, Space, Biotech & IPR
Why this matters for UPSC
GS3 covers the basics of cyber security and threats to critical infrastructure. Prelims can ask which section of the IT Act creates NCIIPC or CERT-In and who must report incidents; Mains, how to secure operational technology.
In short
Critical information infrastructure (CII) is a computer resource whose disabling would debilitate national security, among other things; the Information Technology Act, 2000 guards it through protected systems, NCIIPC and CERT-In.
India's CII law has a guardian and a responder; it must now reach the ageing, internet-facing controllers that run food, medicine and transport.
Why it matters
A hospital's vaccine fridge, a metro's signals and a city's water treatment plant increasingly run on controllers that can be reached over the internet. If an attacker changes a temperature setting or a valve, the harm is physical: spoiled medicines, stalled trains, unsafe water. A clear law decides who must guard such systems and who must be told when something goes wrong, so that a breach at one site can be flagged to every other site using the same equipment before it is hit too. The larger issue is that India is wiring up its essential services faster than old devices and outside maintenance links are being secured.
Prelims pointers
- Section 70(3), IT Act: securing or attempting access to a protected system without authorisation is punishable with up to ten years' imprisonment and fine.
- NCIIPC: designated national nodal agency by Gazette notification in January 2014; it follows up compliance with the Protected Systems Rules, 2018 notified by MeitY.
- CERT-In: in operation since 2004; appointed under Section 70B(1) by notification of 27 October 2009; its functions are listed in Section 70B(4).
- Section 70B(7): ignoring CERT-In's call for information or direction risks up to a year's jail, fine up to Rs 1 crore (raised from Rs 1 lakh in 2023), or both.
- 2022 Directions cover service providers, intermediaries, data centres, body corporate and Government organisations; individual citizens are not covered.
- VPN, cloud and VPS providers must keep validated subscriber records for five years; virtual asset providers keep KYC and transaction records for five years.
- National Cyber Coordination Centre: run by CERT-In to scan Indian cyberspace; Cyber Swachhta Kendra: CERT-In's botnet cleaning and malware analysis centre.
- Indian Cyber Crime Coordination Centre (I4C) was set up by the Ministry of Home Affairs; the National Cyber Security Coordinator sits in the NSCS.
Practise a UPSC-style question
With reference to Section 70 of the Information Technology Act, 2000, consider the following statements:
1. CERT-In declares a computer resource to be a protected system by notification in the Official Gazette.
2. Securing or attempting to secure unauthorised access to a protected system is punishable with imprisonment of up to ten years.
Which of the statements given above is/are correct?
- (a) 1 only
- (b) 2 only
- (c) Both 1 and 2
- (d) Neither 1 nor 2
Show the answer
Answer: (b) 2 only
Answer: (b) 2 only. The power to declare a protected system lies with the appropriate Government, not CERT-In.
Statement 1: incorrect. Section 70(1) gives the appropriate Government the power to notify a protected system in the Official Gazette; CERT-In is the incident-response agency under Section 70B.
Statement 2: correct. Section 70(3) punishes unauthorised access, or an attempt at it, with imprisonment of up to ten years and a fine.
Eliminate: statement 2 is the surer: the ten-year penalty is the Act's own figure. Out: (a), (d).
Eliminate: statement 1 credits CERT-In with a government power. Out: (c).
Trap: Swapped attribution. A real power of Section 70 is pinned on CERT-In, the best-known cyber agency, instead of the appropriate Government.
Remember: Government declares protected systems (Section 70); NCIIPC protects (70A); CERT-In responds (70B).
More Explainers
- State Legislative Councils: Articles 168-172 and the graduates' and teachers' seats Polity
- Whales and dolphins in Indian waters: legal protection, IUCN status and strandings Environment
- The Aligarh Movement, AMU and the Article 30 minority test Polity
- Environmental clearance by States: SEIAA, SEAC and the EIA Notification, 2006 Environment
- Software vulnerabilities: CVE, CVSS, coordinated disclosure and CERT-In's role Sci-Tech
- Drug trafficking law in India: NDPS Act, PIT-NDPS, NCB and NCORD National
- Choosing the UN Secretary-General: Article 97, UNSC veto and straw polls World & IR
- UN Convention against Torture, and why India has not ratified it Polity
- NavIC: why India's navigation constellation cannot give a standalone position Sci-Tech
- International Energy Agency: membership, 90-day oil stocks and India's status World & IR
- PM Surya Ghar: Muft Bijli Yojana and the rooftop solar subsidy Economy
- HFSS foods: FSSAI's draft limits and front-of-pack warning labels National