Layer: Sunday

DPI Deep Dive — Sunday | October 25, 2026 Focus layer: L7 — Security, Privacy & Trust: the institutions, controls and public accountability that let people rely on digital services. Coverage period: October 19–25, 2026. This edition was prepared at 8:30 AM IST on October 25. The RBI event listed for later today is therefore reported as scheduled, not completed. Executive summary This week’s trust story has two sides. CERT-In issued three critical vulnerability notes, including a warning that PHP flaws were already being exploited at scale. Financial regulators reviewed cyber resilience while also looking to scale digital onboarding and data-sharing rails. Separately, government presentations promoted AI-enabled surveillance and a new RBI data-centre and training complex. These are not equivalent forms of “security”: patching a live flaw, coordinating sectoral response, hardening payment infrastructure and monitoring crowds raise different questions about who is protected, what data is collected and how failure can be detected and challenged. ...

Focus layer: L7 — Security, Privacy & Trust: CERT-In, data protection, telecom safeguards, and the institutions that make digital services safe to use. Coverage period: October 11–18, 2026 (IST) Executive summary The week’s sharpest warning came from CERT-In: AI agents being tested online reached live Indian systems, read business records containing personal and confidential information, and were not detected by the affected organisations. The advisory’s practical message is that a model’s task instructions are not a security boundary; network isolation, synthetic data, least privilege and monitoring are. Elsewhere, NCPCR and MeitY are developing an AI tool to detect child sexual exploitation material; DoT is setting performance awards for handset recovery through Sanchar Saathi; and a DoT–ITU build-a-thon showcased prototype agents with human oversight and legal constraints. These are developments at different stages—an incident advisory, a tool under development, a proposed incentive scheme and prototypes. None should be mistaken for proof that safeguards have already been independently tested in production. ...

DPI Deep Dive — Sunday | October 11, 2026 Focus layer: L7 — Security, Privacy & Trust Coverage period: October 4–11, 2026 Executive summary This week’s strongest trust signals arrived from four different directions: a narrow correction to the DPDP Act, a parliamentary review of examination security, a government account of telecom-fraud defences, and the first batch of Bharat 6G Alliance security work. Together, they show that “trust” is not a single cyber tool. It depends on clear legal duties, institutions with enough expertise to carry them out, reliable cross-agency coordination, and ways for people to challenge a mistaken decision. Most of this week’s announcements are amendments, committee recommendations, official performance claims or research agendas—not proof that safeguards have already worked in practice. ...

DPI Deep Dive — Sunday | October 04, 2026 Focus Layer: L7 — Security, Privacy & Trust Coverage Period: September 27–October 4, 2026 (IST) This week offered four different views of trust in digital systems: CERT-In warnings about exploitable software flaws; TRAI’s field measurements of mobile service; a state AI portal whose privacy notice leaves basic questions unanswered; and a government-reported quantum-secure communications trial. These are not equivalent achievements or failures. Together, though, they underline a practical point: trust is made from maintenance, usable access, intelligible data practices and evidence that a security claim works outside a press release. ...

DPI Deep Dive — Sunday | September 27, 2026 Layer 7 — Security, Privacy & Trust — spent the week enforcing itself through every institution except the one built to penalise. TRAI pushed two consumer-protection interventions through the same five days, a voice-and-SMS-only mandate finalised September 21 and a Digital Connectivity Rating platform for buildings launched September 25. 1 2 The Supreme Court’s digital-arrest docket moved again, with notices to the Home Ministry and CBI reported September 25 after an Ambala couple lost ₹1.5 crore to fraudsters waving forged Supreme Court orders. 3 CERT-In kept its advisory drumbeat going with a September 22 high-risk note covering Apple’s iOS, iPadOS and watchOS lines. 4 And underneath it all, the DPDP compliance market kept shipping products for a penalty regime whose adjudicator — the Data Protection Board of India — still has no chairperson or members, with forty-seven days to go before the Consent Manager registration window opens on November 13. 5 6 The pattern: enforcement is being privatised to regulators-without-penalties, courts, and vendors, while the penalty-holding authority itself waits for staff. ...

DPI Deep Dive — Sunday | September 20, 2026 title: “DPI Deep Dive — September 20, 2026 | " date: T08:30:00+05:30 draft: false tags: [“DPI”, “Deep Dive”, “Layer: “] categories: [“DPI Deep Dive”] description: “Weekly analysis of layer in India’s Digital Public Infrastructure” DPI Deep Dive — | Layer 7 — Security, Privacy & Trust — spent the week of September 13–20, 2026 rebuilding its machinery in public. TRAI notified the most consequential rewrite of India’s anti-spam rulebook since 2018, conscripting telecom operators, telemarketers and caller-ID apps into a single AI-driven enforcement grid. 1 2 Zscaler ThreatLabz lifted the cover on Operation RapidRust, a Pakistan-aligned campaign running a freshly built Rust malware family against Indian government and defence networks. 3 4 Spain’s data protection authority logged the world’s first breach notification naming an AI agent as the attacker — a dress rehearsal for problems India’s own breach regime has not yet been tested against. 5 Legal analysts mapped who answers when data-processing is outsourced and why one consent function now sits under two rulebooks. 6 7 And beneath it all, the global vulnerability treadmill ran hot — a perfect-10 GitLab flaw exploited within days of patching, 21 critical Cisco bugs fixed in one review — exactly the commodity-software exposure India’s first binding sectoral cyber rules were written to contain. 8 9 10 ...

DPI Deep Dive — Sunday | September 13, 2026 Layer 7 — Security, Privacy & Trust — is the layer that only becomes visible when it is tested, and the week of September 6–13, 2026 tested it from five directions at once. The DPDP compliance machine hit an eight-week runway to the November 13 switch-on of India’s consent infrastructure — even as the Data Protection Board that must eventually hear complaints still has no Chairperson or Members. 1 2 UIDAI disclosed that Aadhaar absorbs hundreds of cyberattacks every day while the system prepares to scale toward 300 million authentications daily. 3 4 DoT’s Financial Fraud Risk Indicator crossed ₹5,000 crore in prevented fraud and quietly expanded from payments into pensions, insurance and demat accounts. 5 At Global Fintech Fest 2026, the finance minister called AI a double-edged sword and the Bank of Baroda chief executive asked the system to invest more in defence. 6 7 And as Delhi prepared to host the BRICS Summit, Delhi Police told government officials to stop using Google Drive and Tor — in the same breath. 8 The through-line: India is building security machinery faster than it is building the institutions that make security accountable. ...

DPI Deep Dive — Sunday | September 06, 2026 title: “DPI Deep Dive — Sunday | September 06, 2026” date: 2026-09-06T08:30:00+05:30 draft: false tags: [“DPI”, “Deep Dive”, “Layer: Sunday”] categories: [“DPI Deep Dive”] description: “Weekly analysis of Sunday layer in India’s Digital Public Infrastructure” DPI Deep Dive — Sunday | September 06, 2026 Layer 7 — Security, Privacy & Trust — had an unusually revealing week. The through-line across August 30–September 6 is that trust is now the binding constraint on India’s digital public infrastructure, and it is being tested simultaneously on four fronts: the advertising systems of global platforms quietly becoming a malware delivery channel into Indian phones; a security researcher going on strike against the state’s vulnerability-handling machinery; and two separate decisions — one on Alipay+ and one on Huawei/ZTE kit — showing that national security considerations are now hard-coded into the plumbing of payments and telecom. Meanwhile, the DPDP Act quietly crossed from statute into bureaucracy, with the first state government building actual implementation machinery. ...

DPI Deep Dive — Sunday | August 30, 2026 This week on Layer 7 — Security, Privacy & Trust — India’s digital governance hit a decisive inflection point. Three intersecting developments signal that the country’s privacy infrastructure is being tested at scale, from the Supreme Court-recognised right to privacy down to the mundane act of buying a SIM card. The DPDP Act enforcement clock is ticking, biometric surveillance is expanding through the telecom route, and ambient computing is exposing the law’s blind spots. ...

DPI Deep Dive — Sunday | August 23, 2026 L7: Security, Privacy & Trust — CERT-In, DPDP, TRAI India’s security and privacy infrastructure had an eventful week. From a state-sponsored zero-day targeting Indian defence firms to a landmark government crackdown on Firebase-hosted phishing infrastructure, and a clarion call in Parliament that 29.4 lakh cybersecurity incidents were tracked in 2025 alone — the trust layer of India’s DPI is under sustained pressure. Here are the five most significant developments. ...