Evaluate the adequacy of India's legal and institutional framework (IT Act, CERT-In, DPDP Act 2023) in responding to large-scale software vulnerabilities.

On October 21, the PHP team disclosed two flaws. They could let attackers take over web servers remotely, with no password needed, on sites ranging from small shops to large firms [1]. Events like this test India's framework. It responds well to incidents and makes firms liable for weak security, but it does little to make firms fix known flaws quickly.

Strengths

• Statutory nodal agency: CERT-In draws its power from Section 70B, IT Act 2000. Its 2022 Directions require incidents to be reported within 6 hours, and failure to comply can lead to penal action under Section 70B(7) [3].
• Operational scale: In 2025, CERT-In handled over 29.44 lakh incidents. It also issued 1,530 alerts, 390 vulnerability notes and 65 advisories [2].
• Liability deterrent: Section 8(5) of the DPDP Act, 2023 requires Data Fiduciaries to maintain reasonable security safeguards [4]. Failure can attract penalties of up to ₹250 crore [5]. An owner who ignored a public patch would struggle to claim "reasonable" care.

Gaps

• Reactive design: The core mandate is reporting after an incident [3]. It does not penalise slow patching of a flaw that is already public, and that is when attackers strike.
• Alert overload: Hundreds of technical notes [2] suit corporate security teams. They do not suit a small shop on shared hosting, where the host, not the owner, controls the PHP version [1].
• MSME capacity: Even the 2022 Directions needed extended deadlines for MSMEs [3]. Small firms lack staff to check for breaches that happened before they patched [1].
• Shared-code risk: Public portals depend on widely reused open-source components. India has little institutional support for keeping these components secure.

Way forward

• Make hosting providers accountable for patching shared servers. One upgrade protects thousands of sites.
• CERT-In should send plain-language "what to do" notes through MSME bodies, alongside its technical notes.
• Government departments should keep a mandatory list of their software and servers and meet time-bound patching norms.

Overall, India has a capable responder in CERT-In and a strong deterrent in the DPDP Act's penalties. However, the framework mostly acts after harm has occurred. It needs to move from reporting incidents to fixing vulnerabilities within set deadlines, built on secure-by-design norms. That would make it adequate and protect the privacy and trust that Digital India depends on.