Public-private partnerships in strategic infrastructure projects raise unique governance and accountability challenges. Discuss.

Q. Public-private partnerships in strategic infrastructure projects raise unique governance and accountability challenges. Discuss. (15 marks, 250-350 words)

Public-private partnerships (PPPs) mobilise private capital and specialised expertise for infrastructure the state cannot deliver alone at pace. But where the asset is strategic — nuclear, defence, power — a PPP diffuses operational control without diffusing national risk, making governance and accountability uniquely fraught.

Why PPPs remain indispensable in strategic sectors - The Kelkar Committee (2015) held that PPPs must be judged by citizen service delivery, not merely fiscal relief, and recommended a national PPP policy to sustain them [1]. - Power, energy and "Strategic & Public Enterprises" are formally recognised as critical sectors under the Section 70A/NCIIPC framework — the state retains ultimate responsibility even where a private partner executes [3].

Governance challenges - Risk mis-allocation: Kelkar flagged that risks are often loaded on the party least able to manage them; concession contracts are drafted around financial and construction risk, rarely around security risk [1]. - Extended attack surface: the 2026 Kudankulam Units 3–4 data leak originated not in NPCIL's systems but in a contractor's third-party data centre — a fourth-party vulnerability outside the operator's direct control [4]. - Capacity asymmetry: public agencies must negotiate and monitor technically complex contracts with thinner in-house expertise than the private partner commands. - Containment by isolation, not by design: NPCIL confirmed only conventional Balance of Plant data was exposed, with no nuclear safety or security systems affected [4] — segregation limited damage, but vendor governance did not prevent it.

Accountability challenges - Diffused liability across operator, contractor and data host leaves no single answerable owner. - Disclosure lag: weeks separated detection from public knowledge, against CERT-In's six-hour mandatory incident-reporting direction (2022) binding on body corporates and data centres [2]. - Oversight thinning: private partners are not exposed to the same parliamentary and audit scrutiny that a public sector operator routinely faces.

A PPP in a strategic sector is not a transfer of responsibility but a widening of its perimeter. Security-audited model contracts under a national PPP policy [1], CII certification extended to every vendor tier [3], and contractually enforced breach reporting can align private incentives with public safety. Partnership must extend the state's capacity — never dilute its accountability.

(~330 words)

Sources: 1. Report of the Committee on Revisiting & Revitalising the PPP Model of Infrastructure Development (Kelkar Committee, 2015), PIB — service-delivery focus, risk allocation, national PPP policy recommendation 2. CERT-In Directions under Section 70B(6), IT Act 2000 (28 April 2022) — mandatory six-hour cyber incident reporting for body corporates and data centres 3. National Critical Information Infrastructure Protection Centre (NCIIPC), Section 70A, IT Act 2000 — critical sectors including power/energy and strategic & public enterprises 4. NPCIL Press Release on Kudankulam Units 3 & 4 Balance of Plant data (15 July 2026) — breach at contractor's third-party host; only conventional BoP data affected, nuclear safety systems secure