Cybercrime does not respect jurisdictional boundaries, yet policing is a State subject. Critically analyse the challenges this poses for India's cyber-security governance.

Cybercrime is inherently trans-jurisdictional — an offender in one State, a victim in another, servers abroad — yet "Police" and "Public Order" fall under the State List (Entries 1 & 2, Seventh Schedule). This structural mismatch is the central fault-line in India's cyber-security governance.

Challenges from the federal mismatch

• Jurisdictional gridlock: FIRs stall over which State has territorial competence; investigation crosses boundaries but police powers do not.
• Uneven capacity: cyber-forensic labs, trained personnel and dedicated cyber cells vary sharply across States, creating enforcement "weak links".
• Coordination deficit: no single State can trace fraud spanning telecom, banking and platforms hosted elsewhere.
• Attribution and evidence: volatile digital evidence and cross-border data demand uniform standards States alone cannot enforce.

Central coordination as the mitigating response

• The Indian Cyber Crime Coordination Centre (I4C) under MHA runs the National Cybercrime Reporting Portal and 1930 helpline, routing complaints to the correct State police — a functional bridge over the federal gap [1].
• DoT's Digital Intelligence Platform (DIP) enables telecom–bank–regulator data-sharing, and ASTR disconnected over 88 lakh fraudulent connections; Chakshu-based analysis led to 50.90 lakh more (as on 15.7.2026) [2][3].

These show the Union supplying coordination while States retain policing — but persistent capacity gaps and legal ambiguity limit reach.

India's answer lies not in centralising policing but in deepening cooperative federalism: shared forensic infrastructure, capacity-building grants, and a common procedural protocol — securing citizens without disturbing the constitutional division of powers.