Indian Cyber Crime Coordination Centre (I4C)

Explanation

Statement 1 is correct: Under the IT Act, 2000, NCIIPC (established under Section 70A) is the nodal agency for protecting designated Critical Information Infrastructure, whereas CERT-In operates primarily through advisories, alerts, and incident coordination — these are complementary but distinct mandates. The characterisation of CERT-In's role as advisory/coordination and NCIIPC's as protective designation is accurate. Statement 2 is incorrect and reflects a common misconception. The IT Act, 2000 defines 'Critical Information Infrastructure' broadly as computer resources whose incapacitation or destruction would have a debilitating impact on national security, economy, public health, or safety. This definition is not restricted to 'information systems' in a narrow sense — it explicitly encompasses OT/ICS environments such as power grids, water systems, and industrial control systems when their compromise could have such debilitating effects. There is no categorical exclusion of physical-process control systems from CII designation. Statement 3 is correct: The French supermarket incident, and cybersecurity doctrine more broadly, identify the combination of unnecessary internet exposure and failure to apply security patches as the primary attack surface in OT/ICS environments. This vulnerability is conceptually identical for India's connected infrastructure — power networks, water treatment, cold-chain supply systems — all of which run OT systems that were historically air-gapped but are increasingly internet-connected.

Explanation

Statement 1 is correct. The Indian Cybercrime Coordination Centre (I4C) is indeed the Ministry of Home Affairs' nodal framework for cybercrime governance in India. It operates the National Cybercrime Reporting Portal (cybercrime.gov.in), which serves as the centralised platform for citizens to report cybercrimes including financial frauds. Statement 2 is incorrect and represents a common misconception that the 'digital arrest' scam exploits. There is no legal provision for a 'digital arrest' anywhere in Indian law — no statute, no procedural code, and no executive order confers on any law enforcement agency the power to arrest or detain a person through a video or phone call. The concept is entirely fabricated by fraudsters who impersonate CBI officers, Enforcement Directorate officials, or judges to coerce victims. Statement 3 is correct. Indian law does not authorise any police, investigative, or judicial authority to demand that a citizen transfer money in order to avoid arrest or prosecution. Any such demand is per se fraudulent, regardless of how official the caller appears. Candidates must distinguish between what I4C does operationally (coordination, reporting portal, data aggregation) and the non-existence of 'digital arrest' as a legal concept — a distinction that goes to the heart of public legal literacy around cybercrime governance.

Explanation

Statement 1 is correct: Both cybercrime.gov.in and the 1930 helpline are operated under I4C, which functions under the Ministry of Home Affairs. I4C was set up to provide a framework and ecosystem for law enforcement agencies to deal with cybercrime in a coordinated and comprehensive manner, and both the portal and the helpline are core components of this ecosystem. Statement 2 is correct: The 'golden hour' in cyber-fraud reporting is the critical period immediately after a fraud is committed — reporting during this window enables authorities and banks to trace and freeze fraudulently transferred funds before criminals can layer, withdraw, or move them further, making recovery significantly more likely. Statement 3 is incorrect on two grounds: I4C is not a statutory body created by the Information Technology Act, 2000; it is an administrative/executive body set up through a government decision (not through legislation). Moreover, its account-freeze directives operate through coordination with banks and law enforcement under existing legal powers (such as the CrPC and banking regulations), not as independently judicially enforceable orders issued by I4C itself. Conflating an executive coordination centre with a statutory body — and attributing self-executing judicial enforceability to its directives — is a common conceptual error.

Explanation

SIM boxes are hardware devices that route calls through multiple SIM cards to disguise the true geographic origin of a call, making overseas fraud calls appear as local Indian numbers — correctly matched. Deepfakes (AI-generated synthetic video/audio) are deployed by scammers during video calls to impersonate authority figures such as police or government officials, thereby deceiving victims into compliance — correctly matched. Mule account networks, however, are not used for intercepting or decrypting communications; they are bank accounts (opened using real people's credentials, often without their knowledge) that are used to rapidly move and layer illicitly obtained funds across multiple states and jurisdictions, obscuring the money trail. Intercepting communications is a function associated with different cyber-attack tools such as man-in-the-middle attacks or spyware — not mule accounts. Therefore, pair 3 is incorrectly matched.