National Law, Global Interoperability: An Authorized-Intrusion Framework Starting with India

Cybercrime registered in India grew roughly sevenfold between 2016 and 2023. Reported cyber-financial fraud losses on the national reporting portal tripled in a single year, to about ₹22,846 crore in 2024. This paper asks whether the hacking of individuals, businesses and institutions can be stopped, or made as close to impossible as technology permits. It proposes that the governing objective should be an "identified-entry" society. In such a society every intrusive cyber operation must trace back to a legally identifiable authorization, while good-faith security research remains lawful. The study combines doctrinal analysis of Indian law, comparative analysis of ten jurisdictions and design-science reasoning. It maps current Indian law, institutions, weaknesses and reforms, and then specifies layered controls at the device, network, software, identity and financial layers. It drafts a model National Cybersecurity, Authorized Cyber Operations and Cybercrime Prevention Bill, 2026, with professional licensing tiers, a Cyber Authorization Certificate, a research safe harbour and accountable registration of dual-use tools. It then sets out a regulatory allocation of powers and an International Civilian Cyber Protection Convention. Stress-testing the proposed framework against constitutional, privacy, research, commercial and security interests shows that absolute unhackability is unattainable. The scope of proposed convention is global with interoperability across jurisdictions and implementation within the respective territories. Near-impossibility of anonymous intrusion, combined with reliable attribution, is achievable.

cybersecurity law; unauthorized access; India; CERT-In; secure by design; zero trust; attribution; vulnerability disclosure; cybercrime convention; licensing of security professionals

1. IANS, "CERT-In handled over 29.44 lakh cyber incidents in 2025," Morung Express, Jan. 2026. [Online]. Available: https://morungexpress.com/cert-in-handled-over-2944-lakh-cyber-incidents-in-2025-gains-global-recognition (accessed Oct. 2026). [Google Scholar] [Crossref]

2. Press Trust of India, "Cybercrime cases rise 31 pc in 2023: NCRB data," The Week, Sep. 2025. [Online]. Available: https://www.theweek.in/wire-updates/national/2025/09/30/del87-ncrb-cyber-crime.html (accessed Oct. 2026). [Google Scholar] [Crossref]

3. Drishti IAS, "NCRB's Crime in India 2024 report," Drishti IAS, May 2026. [Online]. Available: https://www.drishtiias.com/daily-updates/daily-news-analysis/ncrbs-crime-in-india-2024-report/print_manually (accessed Oct. 2026). [Google Scholar] [Crossref]

4. BOOM, "NCRB report notes sharp rise in cyber-crimes in India," BOOM Live, Oct. 2025. [Online]. Available: https://www.boomlive.in/news/ncrb-report-notes-sharp-rise-in-cyber-crimes-in-india-29662 (accessed Oct. 2026). [Google Scholar] [Crossref]

5. Government of India, "The Information Technology Act, 2000 (as amended)," India Code, 2000. [Online]. Available: https://www.indiacode.nic.in/handle/123456789/1999 (accessed Oct. 2026). [Google Scholar] [Crossref]

6. Factchecker, "Data dive: Cybercrime cases increase threefold in four years," FactChecker.in, 2022. [Online]. Available: https://www.factchecker.in/data-dive/data-dive-cybercrimes-case-increase-threefold-in-four-years-802620 (accessed Oct. 2026). [Google Scholar] [Crossref]

7. The News Minute, "India saw nearly 200% surge in cyber-attacks in 2020, Union govt tells Parliament," The News Minute, 2021. [Online]. Available: https://www.thenewsminute.com/article/india-saw-nearly-200-surge-cyber-attacks-2020-union-govt-tells-parliament-145912 (accessed Oct. 2026). [Google Scholar] [Crossref]

8. Ministry of Home Affairs, Govt. of India, "Lok Sabha unstarred question no. 432: Cybercrime and financial fraud," MHA, Dec. 2025. [Online]. Available: https://www.mha.gov.in/MHA1/Par2017/pdfs/par2025-pdfs/LS02122025/432.pdf (accessed Oct. 2026). [Google Scholar] [Crossref]

9. Free Press Journal, "Over 24 lakh cyber complaints, Rs 22,495 crore fraud reported in 2025," Free Press Journal, 2026. [Online]. Available: https://www.freepressjournal.in/amp/mumbai/over-24-lakh-cyber-complaints-22495-crore-fraud-reported-in-2025 (accessed Oct. 2026). [Google Scholar] [Crossref]

10. Inc42, "Digital arrest scams: cases and losses, 2022-2025," Inc42, 2025. [Online]. Available: https://inc42.com/?p=504907 (accessed Oct. 2026). [Google Scholar] [Crossref]

11. BusinessWorld, "Ransomware attack hits payment systems of nearly 300 Indian banks," BusinessWorld, Jul. 2024. [Online]. Available: https://businessworld.in/article/ransomware-attack-hits-payment-systems-of-nearly-300-indian-banks-527929 (accessed Oct. 2026). [Google Scholar] [Crossref]

12. IBM, "India records highest average cost of a data breach," IBM India Newsroom, Aug. 2025. [Online]. Available: https://in.newsroom.ibm.com/2025-08-07-India-Records-Highest-Average-Cost-of-a-Data-Breach-IBM (accessed Oct. 2026). [Google Scholar] [Crossref]

13. Federal Bureau of Investigation, "Internet Crime Report 2020," IC3, 2021. [Online]. Available: https://ic3.gov/AnnualReport/Reports/2020_IC3Report.pdf (accessed Oct. 2026). [Google Scholar] [Crossref]

14. Federal Bureau of Investigation, "Internet Crime Report 2024," IC3, 2025. [Online]. Available: https://ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf (accessed Oct. 2026). [Google Scholar] [Crossref]

15. National CIO Review, "FBI cybercrime report reveals $20.8 billion lost in 2025," National CIO Review, 2026. [Online]. Available: https://nationalcioreview.com/articles-insights/extra-bytes/fbi-cybercrime-report-reveals-20-8-billion-lost-in-2025/ (accessed Oct. 2026). [Google Scholar] [Crossref]

16. Office for National Statistics, "Crime in England and Wales: year ending March 2026," ONS, 2026. [Online]. Available: https://www.ons.gov.uk/peoplepopulationandcommunity/crimeandjustice/bulletins/crimeinenglandandwales/yearendingmarch2026 (accessed Oct. 2026). [Google Scholar] [Crossref]

17. Singapore Police Force, "Scams and cybercrime fell by almost a quarter in 2025," Police Life, Feb. 2026. [Online]. Available: https://www.police.gov.sg/Media-Hub/Police-Life/2026/02/Scams-and-Cybercrime-Fell-by-Almost-a-Quarter-in-2025 (accessed Oct. 2026). [Google Scholar] [Crossref]

18. Verizon, "2025 Data Breach Investigations Report: executive summary," Verizon, 2025. [Online]. Available: https://www.verizongov.com/resources/reports/2025-dbir-executive-summary.pdf (accessed Oct. 2026). [Google Scholar] [Crossref]

19. CERT-In, "Directions under sub-section (6) of section 70B of the IT Act, 2000," MeitY, Apr. 2022. [Online]. Available: https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf (accessed Oct. 2026). [Google Scholar] [Crossref]

20. Government of India, "The Bharatiya Nyaya Sanhita, 2023," India Code, 2023. [Online]. Available: https://www.indiacode.nic.in/handle/123456789/20062 (accessed Oct. 2026). [Google Scholar] [Crossref]

21. Government of India, "The Bharatiya Sakshya Adhiniyam, 2023," India Code, 2023. [Online]. Available: https://www.indiacode.nic.in/handle/123456789/20063 (accessed Oct. 2026). [Google Scholar] [Crossref]

22. LiveLaw, "Supreme Court rejects challenge to S.63(4) BSA mandating hash value disclosure for electronic evidence," LiveLaw, May 2026. [Online]. Available: https://www.livelaw.in/amp/top-stories/supreme-court-rejects-challenge-to-s634-bsa-mandating-hash-value-disclosure-for-electronic-evidence-535950 (accessed Oct. 2026). [Google Scholar] [Crossref]

23. Mondaq, "MeitY notifies DPDP Rules: enforcement timelines and formation of the Board," Mondaq, Nov. 2025. [Online]. Available: https://webiis10.mondaq.com/india/privacy-protection/1715184/meity-notifies-dpdp-rules-enforcement-timelines-and-formation-of-the-board (accessed Oct. 2026). [Google Scholar] [Crossref]

24. MediaNama, "DoT issues SIM binding directions to WhatsApp, Telegram and other apps," MediaNama, Nov. 2025. [Online]. Available: https://www.medianama.com/2025/11/223-dot-sim-binding-directions-to-whatsapp-and-telegram/ (accessed Oct. 2026). [Google Scholar] [Crossref]

25. Vision IAS, "DoT walks back Sanchar Saathi pre-installation directive following uproar," Vision IAS (summarising The Hindu), Dec. 2025. [Online]. Available: https://visionias.in/current-affairs/upsc-daily-news-summary/article/2025-12-04/the-hindu/security/dot-walks-back-sanchar-saathi-pre-installation-directive-following-uproar (accessed Oct. 2026). [Google Scholar] [Crossref]

26. PRS Legislative Research, "Report summary: Cyber Crime - Ramifications, Protection and Prevention (254th Report)," PRS, Aug. 2025. [Online]. Available: https://prsindia.org/policy/report-summaries/cyber-crime-ramifications-protection-and-prevention (accessed Oct. 2026). [Google Scholar] [Crossref]

27. Chambers and Partners, "Cybersecurity 2026: India - trends and developments," Chambers Practice Guides, 2026. [Online]. Available: https://practiceguides.chambers.com/practice-guides/cybersecurity-2026/india/trends-and-developments (accessed Oct. 2026). [Google Scholar] [Crossref]

28. Council of Europe, "The Budapest Convention (ETS No. 185) and its Protocols," Council of Europe, 2001. [Online]. Available: https://www.coe.int/en/web/cybercrime/the-budapest-convention (accessed Oct. 2026). [Google Scholar] [Crossref]

29. Manorama Yearbook, "India signs UN Convention against Cybercrime," Manorama Yearbook, Sep. 2026. [Online]. Available: https://www.manoramayearbook.in/current-affairs/india/2026/09/28/india-signs-un-convention-against-cybercrime.html (accessed Oct. 2026). [Google Scholar] [Crossref]

30. Government of the Netherlands, "United Nations Convention against Cybercrime: treaty details," Netherlands Treaty Database, 2026. [Online]. Available: https://treatydatabase.overheid.nl/en/Treaty/Details/013891_p (accessed Oct. 2026). [Google Scholar] [Crossref]

31. Legal Information Institute, "18 U.S. Code s. 1030: Fraud and related activity in connection with computers," Cornell Law School, n.d. [Online]. Available: https://www.law.cornell.edu/uscode/text/18/1030 (accessed Oct. 2026). [Google Scholar] [Crossref]

32. U.S. Department of Justice, "Department of Justice announces new policy for charging cases under the Computer Fraud and Abuse Act," DOJ, May 2022. [Online]. Available: https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act (accessed Oct. 2026). [Google Scholar] [Crossref]

33. European Parliament and Council, "Directive 2013/40/EU on attacks against information systems," EUR-Lex, 2013. [Online]. Available: https://eur-lex.europa.eu/eli/dir/2013/40/oj (accessed Oct. 2026). [Google Scholar] [Crossref]

34. European Parliament and Council, "Regulation (EU) 2024/2847 (Cyber Resilience Act)," EUR-Lex, 2024. [Online]. Available: https://eur-lex.europa.eu/eli/reg/2024/2847/oj (accessed Oct. 2026). [Google Scholar] [Crossref]

35. European Parliament and Council, "Directive (EU) 2022/2555 (NIS2)," EUR-Lex, 2022. [Online]. Available: https://eur-lex.europa.eu/eli/dir/2022/2555/oj (accessed Oct. 2026). [Google Scholar] [Crossref]

36. Federal Ministry of Justice (Germany), "Strafgesetzbuch s. 202c," gesetze-im-internet.de, n.d. [Online]. Available: https://www.gesetze-im-internet.de/stgb/__202c.html (accessed Oct. 2026). [Google Scholar] [Crossref]

37. UK Parliament, "Computer Misuse Act 1990," legislation.gov.uk, 1990. [Online]. Available: https://www.legislation.gov.uk/ukpga/1990/18/contents (accessed Oct. 2026). [Google Scholar] [Crossref]

38. The Record, "UK moves to shield security researchers in cybercrime reforms," Recorded Future News, May 2026. [Online]. Available: https://therecord.media/uk-moves-to-shield-security-researchers-cybercrime (accessed Oct. 2026). [Google Scholar] [Crossref]

39. UK Parliament, "Product Security and Telecommunications Infrastructure Act 2022," legislation.gov.uk, 2022. [Online]. Available: https://www.legislation.gov.uk/ukpga/2022/46/contents (accessed Oct. 2026). [Google Scholar] [Crossref]

40. National Cyber Security Centre, "NCSC Annual Review 2025: Active Cyber Defence," NCSC, 2025. [Online]. Available: https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-02-resilience-at-scale/active-cyber-defence (accessed Oct. 2026). [Google Scholar] [Crossref]

41. Global Compliance News (Baker McKenzie), "Singapore: licensing requirements for cybersecurity service providers come into effect," Global Compliance News, Apr. 2022. [Online]. Available: https://www.globalcompliancenews.com/2022/04/30/singapore-licensing-requirements-for-cybersecurity-service-providers-come-into-effect-18042022/ (accessed Oct. 2026). [Google Scholar] [Crossref]

42. Monetary Authority of Singapore, "MAS and IMDA announce implementation of Shared Responsibility Framework from 16 December 2024," MAS, 2024. [Online]. Available: https://www.mas.gov.sg/news/media-releases/2024/mas-and-imda-announce-implementation-of-shared-responsibility-framework-from-16-december-2024 (accessed Oct. 2026). [Google Scholar] [Crossref]

43. Baker McKenzie, "Japan's Active Cyber Defence Law," Baker McKenzie Tokyo, 2025. [Online]. Available: https://www.bakermckenzie.co.jp/en/newsletter/12091 (accessed Oct. 2026). [Google Scholar] [Crossref]

44. Department of Home Affairs (Australia), "Cyber Security Act 2024," Home Affairs, 2024. [Online]. Available: https://www.homeaffairs.gov.au/about-us/our-portfolios/cyber-security/cyber-security-act (accessed Oct. 2026). [Google Scholar] [Crossref]

45. NIST, "SP 800-207: Zero Trust Architecture," National Institute of Standards and Technology, 2020. [Online]. Available: https://csrc.nist.gov/pubs/sp/800/207/final (accessed Oct. 2026). [Google Scholar] [Crossref]

46. NIST, "SP 800-193: Platform Firmware Resiliency Guidelines," National Institute of Standards and Technology, 2018. [Online]. Available: https://csrc.nist.gov/pubs/sp/800/193/final (accessed Oct. 2026). [Google Scholar] [Crossref]

47. ETSI, "EN 303 645 V2.1.1: Cyber Security for Consumer Internet of Things: Baseline Requirements," ETSI, 2020. [Online]. Available: https://www.etsi.org/deliver/etsi_en/303600_303699/303645/02.01.01_60/en_303645v020101p.pdf (accessed Oct. 2026). [Google Scholar] [Crossref]

48. CyberSigma, "TEC MTCTE and ITSAR: an overview," CyberSigma Consulting, n.d. [Online]. Available: https://cybersigmacs.com/knowledge-center/tec-mtcte/ (accessed Oct. 2026). [Google Scholar] [Crossref]

49. The Chromium Projects, "Memory safety," Chromium, n.d. [Online]. Available: https://www.chromium.org/Home/chromium-security/memory-safety/ (accessed Oct. 2026). [Google Scholar] [Crossref]

50. J. Vander Stoep, "Rust in Android: move fast and fix things," Google, Nov. 2025. [Online]. Available: https://blog.google/security/rust-in-android-move-fast-fix-things/ (accessed Oct. 2026). [Google Scholar] [Crossref]

51. Press Information Bureau, Govt. of India, "Sanchar Saathi and telecom anti-fraud measures," PIB, Jul. 2025. [Online]. Available: https://www.pib.gov.in/PressReleseDetailm.aspx?PRID=2149729&reg=48&lang=2 (accessed Oct. 2026). [Google Scholar] [Crossref]

52. Upstox, "Govt's fraud risk tool prevents suspected cyber fraud transactions worth over Rs 5,000 crore," Upstox News, Aug. 2026. [Online]. Available: https://upstox.com/news/business-news/latest-updates/govt-s-fraud-risk-tool-prevents-suspected-cyber-fraud-transactions-worth-over-5-000-crore/article-200002/ (accessed Oct. 2026). [Google Scholar] [Crossref]

53. APNIC, "India's Internet ecosystem in 2026: growth, resilience and the road ahead," APNIC Blog, Aug. 2026. [Online]. Available: https://blog.apnic.net/2026/08/17/indias-internet-ecosystem-in-2026-growth-resilience-and-the-road-ahead/ (accessed Oct. 2026). [Google Scholar] [Crossref]

54. AZB & Partners, "CERT-In's technical guidelines on SBOM, QBOM and CBOM, AIBOM and HBOM," AZB & Partners, Jul. 2025. [Online]. Available: https://www.azbpartners.com/bank/cert-ins-technical-guidelines-on-sbom-qbom-and-cbom-aibom-and-hbom/ (accessed Oct. 2026). [Google Scholar] [Crossref]

55. Microsoft Threat Intelligence, "Social engineering attacks lure Indian users to install Android banking trojans," Microsoft Security Blog, Nov. 2023. [Online]. Available: https://www.microsoft.com/en-us/security/blog/2023/11/20/social-engineering-attacks-lure-indian-users-to-install-android-banking-trojans/ (accessed Oct. 2026). [Google Scholar] [Crossref]

56. Google, "Launching enhanced fraud protection pilot in India," Google India Blog, Oct. 2024. [Online]. Available: https://blog.google/intl/en-in/products/launching-enhanced-fraud-protection-pilot-in-india/ (accessed Oct. 2026). [Google Scholar] [Crossref]

57. Android Developers, "Android developer verification: building a safer ecosystem together," Android Developers Blog, 2026. [Online]. Available: https://developer.android.com/blog/posts/android-developer-verification-building-a-safer-ecosystem-together (accessed Oct. 2026). [Google Scholar] [Crossref]

58. K. Thomas and A. Moscicki, "New research: How effective is basic account hygiene at preventing hijacking," Google Security Blog, May 2019. [Online]. Available: https://security.googleblog.com/2019/05/new-research-how-effective.html (accessed Oct. 2026). [Google Scholar] [Crossref]

59. KPMG India, "RBI (Authentication Mechanisms for Digital Payment Transactions) Directions, 2025," KPMG, Dec. 2025. [Online]. Available: https://kpmg.com/in/en/insights/2025/12/reserve-bank-of-india-rbi-authentication-mechanisms-for-digital-payment-transactions-directions-2025.html (accessed Oct. 2026). [Google Scholar] [Crossref]

60. Press Information Bureau, Govt. of India, "RBI measures on unauthorised transactions and MuleHunter.AI," PIB, Mar. 2026. [Online]. Available: https://www.pib.gov.in/PressReleasePage.aspx?PRID=2244478&reg=3&lang=2 (accessed Oct. 2026). [Google Scholar] [Crossref]

61. Supreme Court of India, "Shreya Singhal v. Union of India, (2015) 5 SCC 1," Indian Kanoon, 2015. [Online]. Available: https://indiankanoon.org/doc/110813550/ (accessed Oct. 2026). [Google Scholar] [Crossref]

62. Khaitan & Co, "New rules for lawful interception of telecommunications," Khaitan & Co, 2024. [Online]. Available: https://www.khaitanco.com/thought-leadership/New-Rules-for-Lawful-Interception-of-Telecommunications (accessed Oct. 2026). [Google Scholar] [Crossref]

63. UK Foreign, Commonwealth & Development Office, "The Pall Mall Process Code of Practice for States," GOV.UK, Apr. 2025. [Online]. Available: https://www.gov.uk/government/publications/the-pall-mall-process-code-of-practice-for-states (accessed Oct. 2026). [Google Scholar] [Crossref]

64. Supreme Court of India, "K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1," Indian Kanoon, 2017. [Online]. Available: https://indiankanoon.org/doc/91938676/ (accessed Oct. 2026). [Google Scholar] [Crossref]

65. Supreme Court of India, "Anuradha Bhasin v. Union of India, (2020) 3 SCC 637," Indian Kanoon, 2020. [Online]. Available: https://indiankanoon.org/doc/82461587/ (accessed Oct. 2026). [Google Scholar] [Crossref]

66. SFLC.in, "Mandatory SIM binding: how it affects messaging app users," SFLC.in, 2025. [Online]. Available: https://sflc.in/mandatory-sim-binding-how-it-affects-messaging-app-users/ (accessed Oct. 2026). [Google Scholar] [Crossref]

67. TechCrunch, "India delays strict new VPN rules by 3 months," TechCrunch, Jun. 2022. [Online]. Available: https://techcrunch.com/2022/06/27/india-delays-strict-new-vpn-rules-by-3-months (accessed Oct. 2026). [Google Scholar] [Crossref]

68. Bratby Law, "APP fraud reimbursement: the PSR's evaluation," Bratby Law, Jul. 2026. [Online]. Available: https://bratby.law/app-fraud-reimbursement-evaluation/ (accessed Oct. 2026). [Google Scholar] [Crossref]

69. H. G. Rice, "Classes of recursively enumerable sets and their decision problems," Trans. Amer. Math. Soc., vol. 74, no. 2, pp. 358-366, 1953. [Online]. Available: https://www.ams.org/journals/tran/1953-074-02/S0002-9947-1953-0053041-6/ (accessed Oct. 2026). [Google Scholar] [Crossref]

70. seL4 Foundation, "seL4 frequently asked questions," seL4 Docs, n.d. [Online]. Available: https://docs.sel4.systems/projects/sel4/frequently-asked-questions.html (accessed Oct. 2026). [Google Scholar] [Crossref]