Global Cyber Threats to Critical Infrastructure: Legal Ramifications and Incident Response in India

Introduction

A joint cybersecurity advisory issued by international security agencies—including the United States (CISA, FBI, NSA), the United Kingdom (NCSC), Canada, and Australia—recently sounded an urgent alarm regarding persistent, state-sponsored Iranian cyber campaigns targeting critical infrastructure. Over the course of a multi-year campaign, malicious actors have leveraged sophisticated brute-force tactics, credential harvesting, and known vulnerability exploits to compromise healthcare, transport, government, and utility systems.

While this advisory originated in the West, critical infrastructure sectors and enterprise supply chains across the globe face identical operational hazards. In India's financial capital and the surrounding Mumbai Metropolitan Region (MMR)—encompassing Mumbai, Thane, and Mira-Bhayandar—enterprises, port authorities, logistics corridors, and municipal utility providers cannot afford to treat these warnings as distant geopolitical issues.

This explainer outlines the technical nature of these cyber operations, the governing Indian legal framework under the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023, and practical remediation pathways for organizations operating in Maharashtra.

---

Anatomy of the Threat: How Critical Infrastructure Is Targeted

State-sponsored threat actors rarely rely purely on zero-day vulnerabilities. Instead, they weaponize operational fatigue, neglected configurations, and supply chain loopholes. The recent alerts document distinct tactics, techniques, and procedures (TTPs):

1. Credential Stuffing and Brute Force: Systematically attacking user accounts across cloud services (such as Microsoft 365 and Cisco Duo) using common passwords without multi-factor authentication (MFA).
2. Exploitation of Known Vulnerabilities: Infiltrating virtual private network (VPN) gateways, unpatched firewalls, and public-facing corporate servers.
3. Lateral Movement and Persistent Access: Once inside, threat actors harvest directory information, map internal networks, and establish backdoors inside Operational Technology (OT) and Supervisory Control and Data Acquisition (SCADA) systems.
4. Data Exfiltration and Ransom/Sabotage: Beyond intellectual property theft, adversaries position themselves to disrupt industrial operations, corrupt data integrity, or demand extortion payments.

For businesses across MMR—whether an industrial manufacturer in Thane, a fintech backend in BKC, or a maritime logistics intermediary along the coast—any compromise can trigger immediate operational suspension and acute legal exposure.

---

The Indian Legal Framework Governing Cyberattacks and Critical Infrastructure

Cyber intrusions targeting essential utilities, sensitive systems, and private corporate networks invoke multiple Indian statutes. Victims and infrastructure managers must navigate the intersection of cyber-specific regulations and reformed criminal codes.

1. The Information Technology Act, 2000 (IT Act)

• Section 43 & Section 66 (Hacking and System Damage): Penalizes unauthorized access, downloading or copying of data, disruption of computer networks, and introduction of malware. Section 66 prescribes imprisonment up to three years or fines up to ₹5 lakh, or both.
• Section 66F (Cyber Terrorism): Directly relevant to attacks on vital utilities. If an intrusion threatens the unity, integrity, or sovereignty of India, or strikes critical information infrastructure (CII) to cause public terror or severe damage, it constitutes cyber terrorism, punishable with imprisonment for life.
• Section 70 (Protected Systems): The Central or State Government may declare any computer system affecting national security, economy, or public health as a "Protected System." Unauthorized access to such systems carries rigorous imprisonment of up to ten years.

2. CERT-In Directions (April 2022)

Under Section 70B of the IT Act, the Indian Computer Emergency Response Team (CERT-In) issued binding directions requiring all service providers, intermediaries, data centres, corporate entities, and government organizations to report cybersecurity incidents within six (6) hours of noticing them. Types of incidents triggering mandatory reporting include:

• Targeted scanning/probing of critical networks.
• Compromise of critical systems or infrastructure.
• Unauthorized access to IT systems and databases.
• Attacks on operational technology and industrial control systems.

Failure to comply with CERT-In directions invites penal consequences under Section 70B(7) of the IT Act, which includes imprisonment for up to one year, a fine, or both.

3. The New Criminal Laws: BNS, BNSS, and BSA (2023)

With the replacement of the colonial Indian Penal Code, Code of Criminal Procedure, and Indian Evidence Act, cyber offences committed today are adjudicated under the new penal statutes:

• Bharatiya Nyaya Sanhita, 2023 (BNS):
  • Section 113 (Terrorist Act): Explicitly integrates attacks causing damage to critical infrastructure or information systems into the definition of a terrorist act, complementing Section 66F of the IT Act.
  • Section 308 (Extortion): Covers ransomware scenarios where attackers hold decryption keys or sensitive proprietary data hostage.
  • Section 324 (Mischief): Addresses intentional damage or destruction of electronic property.
• Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS): Establishes updated procedural mandates for lodging Zero FIRs, conducting search and seizure operations for digital hardware, and managing police custody in complex multi-jurisdictional investigations.
• Bharatiya Sakshya Adhiniyam, 2023 (BSA): Governs the legal admissibility of electronic evidence. Section 61 and Section 63 of the BSA require strict compliance when preserving system logs, server images, and forensic backups to ensure digital records remain admissible in trial courts.

---

Mandatory Compliance for Businesses and Vendors in Maharashtra

Private entities that form part of the supply chain for critical infrastructure (such as software vendors, cloud service providers, third-party logistics firms, and back-office processors) bear serious legal responsibilities:

• Third-Party Risk Audits: Under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and emerging frameworks under the Digital Personal Data Protection Act, 2023 (DPDP Act), entities must ensure reasonable technical safeguards to protect systems.
• Contractual Safeguards: Commercial agreements must include clear data breach notification windows (aligning with the 6-hour CERT-In limit) and audit rights.
• Log Retention: CERT-In directions mandate that all entities maintain system logs within Indian jurisdiction for a rolling period of 180 days, ensuring verifiable trails for investigators.

---

Incident Response: How Victims in Mumbai, Thane, and Mira Road Must Report

When a cyber incident or infrastructure disruption occurs, swift, legally structured action is crucial. In Maharashtra, victims must pursue parallel technical and legal reporting tracks.

[Cyber Intrusion Detected]
           │
   ┌───────┴───────┐
   ▼               ▼
Technical       Statutory & Legal
Preservation    Filing
   │               │
   ├─ Isolate      ├─ Report to CERT-In (within 6 hours)
   ├─ Mirror Logs  ├─ Lodge at cybercrime.gov.in
   └─ BSA Sec 63   └─ Formal Complaint at MMR Cyber Cell
      Compliance      (BKC / Thane / MBVV)

1. Immediate Evidence Preservation

Before rebooting or reimaging compromised machines:

• Isolate the affected subnet or endpoints from the network.
• Create bit-stream forensic images of servers, routers, and firewalls.
• Secure authentication logs, active directory records, and timestamped firewall dumps in compliance with Section 63 of the Bharatiya Sakshya Adhiniyam, 2023.

2. Statutory Regulatory Filing

• Transmit an incident report to CERT-In (incident@cert-in.org.in or via their official portal) within six hours of identification.
• If public utilities, telecommunications, banking, or energy assets are compromised, notify the National Critical Information Infrastructure Protection Centre (NCIIPC).

3. Registering Criminal Complaints in the Mumbai Metropolitan Region

Victims should promptly register a formal complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) and escalate the matter to their territorial specialized Cyber Police Station:

• Mumbai Jurisdiction: Cyber Police Station, Bandra-Kurla Complex (BKC), or regional cyber cells (South, Central, Western, Eastern, and Northern suburbs).
• Thane Jurisdiction: Thane City Cyber Crime Police Station (located near Commissioner of Police Office, Thane West).
• Mira Road & Bhayandar Jurisdiction: Mira-Bhayandar Vasai-Virar (MBVV) Cyber Crime Police Station.

A written complaint detailing the timeline, impacted IP addresses, system logs, estimated damages, and applicable sections of the IT Act and BNS should be handed over to the investigating officer to convert the preliminary inquiry into a First Information Report (FIR).

---

Frequently Asked Questions (FAQs)

1. Is a private corporate entity considered "Critical Information Infrastructure" in India?

Private enterprises are not automatically classified as CII. However, under Section 70 of the IT Act, the Central or State Government can designate any private or public computer resource as a "Protected System" if its incapacitation would severely undermine national security, the economy, or public health. Additionally, private vendors directly integrated into designated CII networks bear statutory obligations.

2. Can an enterprise be penalized for failing to report a cyber intrusion?

Yes. Under the CERT-In Directions issued pursuant to Section 70B(7) of the IT Act, failure to report specified cybersecurity incidents within six hours can lead to regulatory penalties and criminal prosecution of key management personnel, resulting in fines or imprisonment of up to one year.

3. How do the new criminal laws (BNS and BSA) change cyber litigation?

The Bharatiya Nyaya Sanhita, 2023 (BNS) explicitly penalizes cyber-enabled terrorism (Section 113) and modern forms of extortion. The Bharatiya Sakshya Adhiniyam, 2023 (BSA) codifies electronic records as primary and secondary evidence under modernized criteria, making proper forensic handling from the first hour of an incident vital for court admissibility.

4. What should a company do if threat actors demand a ransom in MMR?

Paying a ransom is fraught with legal, financial, and sanctions risks, and does not guarantee data restoration. Organizations should preserve all communication logs, decline immediate payment, report the incident immediately to CERT-In and the local Cyber Police Station, and consult legal counsel to navigate extortion and regulatory reporting liabilities.

---

Protecting Your Organization

Navigating international cyber advisories requires bridging technical network defense with rigorous regulatory compliance. Whether your enterprise requires incident response representation, regulatory filings before CERT-In, or a comprehensive review of your third-party IT vendor contracts, proactive legal strategy mitigates substantial liability.

APS Law assists corporate entities, infrastructure vendors, and individuals across Mumbai, Thane, and Mira Road with cybersecurity compliance, data protection, and criminal cyber litigation. Contact APS Law today to schedule a confidential legal consultation.