"Accountability in cybersecurity requires transparency." Should CERT-In remain exempt from the RTI Act? Discuss.

Section 70B of the IT Act, 2000 makes CERT-In India's nodal cyber-incident response agency. In 2025 it handled over 29.4 lakh incidents [1]. In November 2023 it was placed in the RTI Act's Second Schedule, which takes it outside the Act's disclosure duties [2]. Some secrecy is justified, but a blanket exemption goes further than security needs.

Case for the exemption

• Operational security: Disclosing live investigations, unpatched vulnerabilities or response methods could help attackers.
• Institutional parity: The Second Schedule already covers security bodies such as the IB and NIA [2]. CERT-In's threat intelligence is similarly sensitive.
• Reporting confidence: Organisations report breaches more readily if their weaknesses will not become public.
• Built-in safeguard: Under the Section 24 proviso, information on corruption and human-rights violations must still be disclosed [3].

Case against the exemption

• Not an intelligence agency: CERT-In mainly coordinates and advises, and most of what it produces (advisories, vulnerability notes) is already public [1].
• No public learning: Without published post-mortems, citizens and Parliament cannot judge whether repeat breaches, often caused by basic lapses, are being fixed.
• Privacy stakes: Puttaswamy (2017) made privacy a fundamental right under Article 21. The DPDP Rules, 2025 require Data Fiduciaries to tell the Data Protection Board and affected persons about breaches [4]. Exempting the state's own nodal body while private firms must disclose is inconsistent.
• Redundancy: Section 8(1)(a) already lets any authority withhold information that threatens security or sovereignty [2]. A blanket exemption is not needed to protect that information.

Way forward

• Calibrated transparency: Remove CERT-In from the Second Schedule and rely on Section 8 exemptions decided case by case.
• Mandatory anonymised post-mortems and an annual report tabled in Parliament, scrutinised by the Standing Committee on IT.
• Coordination with the Data Protection Board so that breach disclosures are consistent across public and private entities [4].

Security and transparency can coexist. Sensitive operations can stay protected while CERT-In's performance is opened to scrutiny. Calibrated disclosure, through Section 8 safeguards, post-mortems and parliamentary oversight, would build public trust, prompt organisations to improve their cyber hygiene, and support the privacy guaranteed under Article 21.