Internet and Cyber Security for UPSC: Web 3.0, SaaS, Ransomware, PKI, Blockchain, NFTs, DPDP Act and Sanchar Saathi

How UPSC Tests Internet and Cyber Security

🎯 Exam priority: Tier-1. Internet and digital technology questions are 17 of 104 in ten years, shared with AI (next article), and ask what a term means and what it can do. UPSC asked: Project Loon (2016); Aadhaar's open APIs, the aims of Digital India and WannaCry (2018); the Atal Innovation Mission and digital signatures (2019); blockchain and Public Key Infrastructure (2020); open-source digital platforms, Web 3.0, Software as a Service and NFTs (2022); the metaverse (2024); and blockchain features (2026, provisional key). Mains asked about cyber threats and security frameworks almost every year (2016 to 2022), the Srikrishna Committee on data protection (2018), CyberDome (2019) and the Digital Personal Data Protection Act, 2023 (2024).

Three boxes: how the digital stack is built (web, cloud, platforms), how it is secured (malware, cryptography, law) and how it is being misused or policed (frauds, the telecom response).

The Digital Stack: Web 3.0, SaaS, Open Platforms and the Metaverse

The digital stack

Malware, PKI, Blockchain, NFTs and Data Protection

Security, cryptography and trust technologies

• Malware: ransomware locks files for payment, as in WannaCry and Petya, which used the EternalBlue exploit (2018 PYQ: all are related to cyber attacks); a virus spreads by attaching to files; phishing tricks users into giving credentials; a DDoS attack floods a server with requests.

• Public Key Infrastructure (PKI) is the system of keys, certificates and certifying authorities behind encryption and digital signatures, so it belongs to digital security infrastructure (2020 PYQ). A digital signature signs an electronic document and shows the content has not been altered; a digital certificate, issued by a certifying authority, proves the identity of the holder (2019 PYQ).

• Blockchain is a ledger copied across many computers; it is public and cannot be altered easily, no single user controls it and applications can be built on it without permission. It holds data other than cryptocurrency (2020 PYQ). Records can be shared with stakeholders without risk of alteration, and the whole database is stored on many computers (2026 provisional key). A consortium blockchain is run by a group of organisations.

• NFTs are unique cryptographic tokens on a blockchain that can represent digital or physical assets; because each is unique, they are not exchangeable at equivalence as a medium of commercial transactions the way currency is (2022 PYQ).

• Law and institutions: the Information Technology Act, 2000; CERT-In, the national agency for responding to cyber incidents; and the National Critical Information Infrastructure Protection Centre for critical sectors.

• Data protection: the Digital Personal Data Protection Act, 2023 sets rules on consent, purpose and security for processing personal data and creates a Data Protection Board; the DPDP Rules, 2025 were notified in mid-November 2025 and phase in over about 12 to 18 months, with penalties of up to ₹250 crore for failing to keep reasonable security safeguards (secondary sources).

The 2025 Telecom-Security Toolkit and How UPSC Could Ask Next

The 2025 telecom-security toolkit (PIB)

• Sanchar Saathi (portal launched in 2023; mobile app launched on 17 January 2025 in Hindi, English and 21 regional languages) lets citizens report fraud calls, block lost handsets and see the mobile connections in their name. Its Central Equipment Identity Register (CEIR) has traced 26.35 lakh lost or stolen handsets, returned 7.3 lakh to owners and blocked 6.21 lakh fraud-linked IMEIs.

• The Financial Fraud Risk Indicator (FRI), introduced in May 2025, classifies mobile numbers by their risk of use in fraud; the RBI has asked banks to integrate it, and alerts were generated for more than 70 lakh fraudulent transactions, preventing losses of about ₹450 crore.

• The Digital Intelligence Platform (launched 2024) lets agencies share information on misuse of telecom resources, and crowd-sourced Chakshu reports led to the blocking of over 309 international carriers sending spoofed calls.

• Device Setu (the Indian Counterfeited Device Restriction system) lets manufacturers and importers register and generate IMEI certificates free of charge.

• The Telecommunications (Telecom Cyber Security) Rules, 2024, made under the Telecommunications Act, 2023 and amended in 2025, require operators to audit security and report incidents and prohibit tampering with IMEIs. Incoming calls from international numbers are now displayed as 'International Call'.

How UPSC Could Ask This Next

• Definitions: web generations, cloud models, DPI, PKI, hash, zero-day, honeypot.

• Cyber incidents: named malware or attacks and what category they belong to.

• Law: IT Act, DPDP Act 2023 and Rules 2025, Telecommunications Act 2023.

• Programmes: Sanchar Saathi, FRI, I4C, CERT-In, Digital India.

Further Reading

• NCERT Biology (Class 12) and Geography textbooks, the India State of Forest Report, the MoEFCC Annual Report, the Economic Survey and the official lists cited in this note — the primary sources behind every figure above.

Test Yourself: Practice Questions and PYQs

Twelve practice questions on digital platforms, cyber security, blockchain and telecom-fraud tools, followed by the real UPSC Prelims questions and exact Mains questions.

Practice Questions

Q1. Project Loon, sometimes seen in the news, was related to

• (a) waste management

• (b) water conservation

• (c) solar power production

• (d) wireless internet delivery by high-altitude balloons

Q2. Which of the following are built on open-source digital platforms?
1. CoWIN
2. DigiLocker
3. DIKSHA
4. Aarogya Setu

• (a) 1, 2, 3 and 4

• (b) 2, 3 and 4 only

• (c) 1 and 4 only

• (d) 1 and 2 only

Q3. WannaCry and Petya are examples of

• (a) firewall software

• (b) spyware only

• (c) cryptocurrencies

• (d) ransomware

Q4. A digital signature

• (a) is a certificate issued to prove the identity of a person

• (b) is a password stored on a server

• (c) is a photograph of a handwritten signature

• (d) signs an electronic document and ensures its content is unchanged

Q5. In India, the term Public Key Infrastructure is used in the context of

• (a) digital security infrastructure

• (b) health care

• (c) transportation

• (d) food security

Q6. Consider the following statements about blockchain:
1. It is a public ledger that everyone can inspect but which no single user controls.
2. All the data in it is about cryptocurrency only.
3. Applications depending on its basic features can be developed without anybody's permission.
Which of the statements given above is/are correct?

• (a) 1 and 2 only

• (b) 1, 2 and 3

• (c) 1 and 3 only

• (d) 2 only

Q7. A Non-Fungible Token (NFT) is

• (a) a currency exchangeable one-for-one

• (b) a type of government bond

• (c) a bank deposit

• (d) a unique cryptographic token on a blockchain

Q8. 'An interoperable network of 3D virtual worlds that can be accessed simultaneously by millions of users who can exert property rights over virtual items' is best called

• (a) the metaverse

• (b) a virtual matrix

• (c) big data analytics

• (d) cryptography

Q9. The Atal Innovation Mission is set up under

• (a) Department of Science and Technology

• (b) Ministry of Skill Development

• (c) NITI Aayog

• (d) Ministry of Labour

Q10. The Financial Fraud Risk Indicator (FRI), introduced in 2025,

• (a) categorises mobile numbers by their risk of being used in financial fraud

• (b) is a credit score for citizens

• (c) blocks all foreign calls

• (d) regulates cryptocurrency exchanges

Q11. The Sanchar Saathi portal helps citizens to

• (a) block lost or stolen handsets and report fraud calls

• (b) file income tax returns

• (c) register vehicles

• (d) book railway tickets

Q12. The Digital Personal Data Protection Rules, 2025 were notified in

• (a) March 2026

• (b) January 2023

• (c) August 2023

• (d) mid-November 2025

UPSC Previous Year Questions (PYQs)

Real UPSC Prelims questions, checked against the official paper and answer key.

Q1. (2016) 'Project Loon', sometimes seen in the news, is related to

• (a) waste management technology

• (b) water conservation technology

• (c) solar power production technology

• (d) wireless communication technology

Q2. (2018) The identity platform 'Aadhaar' provides open “Application Programming Interfaces (APIs)”. What does it imply?
1. It can be integrated into any electronic device.
2. Online authentication using iris is possible.
Which of the statements given above is/are correct?

• (a) 1 only

• (b) 2 only

• (c) Both 1 and 2

• (d) Neither 1 nor 2

Q3. (2018) Which of the following is/are the aim/aims of the “Digital India” Plan of the Government of India?
1. Formation of India's own Internet companies like China did.
2. Establish a policy framework to encourage overseas multinational corporations that collect Big Data to build their large data centers within our national geographical boundaries.
3. Connect many of our villages to the Internet and bring Wi-Fi to many of our schools, public places and major tourist centers.
Select the correct answer using the code given below:

• (a) 1, 2 and 3

• (b) 2 and 3 only

• (c) 1 and 2 only

• (d) 3 only

Q4. (2018) The terms 'WannaCry, Petya and EternalBlue' sometimes mentioned in the news recently are related to

• (a) Cyber attacks

• (b) Exoplanets

• (c) Cryptocurrency

• (d) Mini satellites

Q5. (2019) Atal Innovation Mission is set up under the

• (a) NITI Aayog

• (b) Ministry of Labour and Employment

• (c) Department of Science and Technology

• (d) Ministry of Skill Development and Entrepreneurship

Q6. (2019) Consider the following statements: A digital signature is 1. an electronic record that identifies the certifying authority issuing it 2. used to serve as a proof of identity of an individual to access information or serve on Internet 3. an electronic method of signing an electronic document and ensuring that the original content is unchanged Which of the statements given above is/are correct?

• (a) 3 only

• (b) 1, 2 and 3

• (c) 1 only

• (d) 2 and 3 only

Q7. (2020) With reference to “Blockchain Technology” consider the following statements:
1. It is public ledger that everyone we Inspect, but which no single user controls
2. The structure and design of blockchain is such that all the data in it is about crypto currency only.
3. Applications that depend on basic features of blockchain can be developed without anybody's permission.
Which of the statements given above is/are correct?

• (a) 1 and 2 only

• (b) 1 only

• (c) 2 only

• (d) 1 and 3 only

Q8. (2020) In India, the term “Public Key Infrastructure” is used in the context of

• (a) Telecommunication and transportation infrastructure

• (b) Food security infrastructure

• (c) Health care and education infrastructure

• (d) Digital security infrastructure

Q9. (2022) Consider the following:
1. Aarogya Setu
2. CoWIN
3. DigiLocker
4. DIKSHA
Which of the above are built on top of open-source digital platforms?

• (a) 1, 2, 3 and 4

• (b) 1 and 2 only

• (c) 1, 3 and 4 only

• (d) 2, 3 and 4 only

Q10. (2022) With reference to Web 3.0, consider the following statements:
1. Web 3.0 technology enables people to control their own data.
2. In the Web 3.0 world, there can be blockchain based social networks.
3. Web 3.0 is operated by users collectively rather than a corporation.
Which of the statements given above are correct?

• (a) 2 and 3 only

• (b) 1, 2 and 3

• (c) 1 and 2 only

• (d) 1 and 3 only

Q11. (2022) With reference to “Software as a Service (SaaS)”, consider the following statements:
1. SaaS buyers can customise the user interface and can change data fields.
2. SaaS users can access their data through their mobile devices.
3. Outlook, Hotmail and Yahoo! Mail are forms of SaaS.
Which of the statements given above are correct ?

• (a) 1 and 3 only

• (b) 1 and 2 only

• (c) 2 and 3 only

• (d) 1, 2 and 3

Q12. (2022) With reference to Non-Fungible Tokens (NFTs), consider the following statements:
1. They enable the digital representation of physical assets.
2. They are unique cryptographic tokens that exist on a blockchain.
3. They can be traded or exchanged at equivalency and therefore can be used as a medium of commercial transactions.
Which of the statements given above are correct?

• (a) 1 and 2 only

• (b) 1, 2 and 3

• (c) 1 and 3 only

• (d) 2 and 3 only

Q13. (2024) Which one of the following words/phrases is most appropriately used to denote “an interoperable network of 3D virtual worlds that can be accessed simultaneously by millions of users, who can exert property rights over virtual items”?

• (a) Cryptography

• (b) Big data analytics

• (c) Virtual matrix

• (d) Metaverse

Q14. (2026, provisional key) Which of the following statements regarding the features of blockchain technology are correct?
1. Records stored in the database may be made visible to relevant stakeholders without risk of alteration.
2. Copies of the entire database are stored on multiple computers on a network, syncing within seconds.
3. Consortium blockchain is a blend of public and private blockchains allowing selective data access.
4. Mathematical algorithms make it impossible to change or delete any data once recorded and accepted.
Select the answer using the code given below :

• (a) 1 and 3

• (b) 1 and 4 only

• (c) 2 and 4 only

• (d) 1, 2 and 4

Mains Practice Questions

Use these to frame full-length answers. You don't have to answer one exactly — they show the angles UPSC tests, so let them guide which points you cover.

• Discuss the potential threats of cyber attack and the security framework to prevent it.

• What are the different elements of cyber security? Examine the extent to which India has developed a comprehensive National Cyber Security Strategy.

• Describe the context and salient features of the Digital Personal Data Protection Act, 2023.

• What is the CyberDome Project? Explain how it can be useful in controlling internet crimes in India.

• Use of the internet and social media by non-state actors for subversive activities is a major security concern. How have these been misused and what guidelines would curb the threat?

UPSC Mains — Previous Years’ Questions on this topic (last 10 years)

These are the actual GS Mains questions UPSC has asked on this theme — real proof of how, and when, it is tested. Try to write a full answer to each.

• 2024 (GS-III): Describe the context and salient features of the Digital Personal Data Protection Act, 2023.

• 2024 (GS-III): What is the technology being employed for electronic toll collection on highways? What are its advantages and limitations? What are the proposed changes that will make this process seamless? Would this transition carry any potential hazards?

• 2022 (GS-III): What are the different elements of cyber security ? Keeping in view the challenges in cyber security, examine the extent to which India has successfully developed a comprehensive National Cyber Security Strategy.

• 2021 (GS-III): Keeping in view India's internal security, analyse the impact of cross-border cyber attacks. Also discuss defensive measures against these sophisticated attacks.

• 2020 (GS-III): Discuss different types of cyber crimes and measures required to be taken to fight the menace.

• 2019 (GS-III): What is CyberDome Project? Explain how it can be useful in controlling internet crimes in India.

• 2018 (GS-III): Data security has assumed significant importance in the digitized world due to rising cyber crimes. The Justice B. N. Srikrishna Committee Report addresses issues related to data security. What, in your view, are the strengths and weaknesses of the Report relating to protection of personal data in cyber space?

• 2017 (GS-III): Discuss the potential threats of Cyber attack and the security framework to prevent it.

• 2016 (GS-III): Use of Internet and social media by non-state actors for subversive activities is a major security concern. How have these been misused in the recent past? Suggest effective guidelines to curb the above threat.