#FactCheck - Deepfake Video Falsely Claims Indian Defence Secretary Admitted Pakistan ‘Jammed Indian Systems’

On 6 June 2025, the EU Council officially adopted the revised Cybersecurity Blueprint, marking a significant evolution from the 2017 guidance. This framework, formalised through Council Recommendation COM(2025) 66 final, responds to a transformed threat environment and reflects new legal milestones like the NIS2 Directive (Network and Information Security Directive) and the Cyber Solidarity Act.

From Fragmented Response to Cohesive Strategy

‍

Between 2017 and now, EU member states have built various systems to manage cyber incidents. Still, real-world events and exercises highlighted critical gaps - uncoordinated escalation procedures, inconsistent terminology, and siloed information flows. The updated Blueprint addresses these issues by focusing on a harmonised operational architecture for the EU. It defines a clear crisis lifecycle with five stages: Detection, Analysis, Escalation, Response, and Recovery. Each stage is supported by common communication protocols, decision-making processes, and defined roles. Consistency is key; standardised terminology along with a broad scope of application that eases cross-border collaboration and empowers coherent response efforts.

Legal Foundations: NIS2, ENISA & EU‑CyCLONe

‍

Several core pillars of EU cybersecurity directly underpin the Blueprint:

• ENISA – The European Union Agency for Cybersecurity continues to play a central role. It supports CSIRTs' Network operations, leads EU‑CyCLONe ( European cyber crisis liaison organisation network) coordination, conducts simulation exercises, and gives training on incident management
• NIS2 Directive, particularly Article 16, is a follow-up of NIS. NIS2 mandates operators of critical infrastructure and essential services to implement appropriate security measures and report incidents to the relevant authorities. Compared to NIS, NIS2 expands its EU-wide security requirements and scope of covered organisations and sectors to improve the security of supply chains, simplify reporting obligations, and enforce more stringent measures and sanctions throughout Europe. It also formally legitimises the EU‑CyCLONe network, which is the crisis liaison mechanism bridging technical teams from member states.

‍

These modern tools, integrated with legal backing, ensure the Blueprint isn’t just theoretical; it’s operationally enforceable.

‍

What’s Inside the Blueprint?

‍

The 2025 Blueprint enhances several critical areas:

‍

1. Clear Escalation Triggers - It spells out when a national cyber incident merits EU-level attention, especially those affecting critical infrastructure across borders. Civilian Military Exchange. The Blueprint encourages structured information sharing with defence institutions and NATO, recognising that cyber incidents often have geopolitical implications 
2. Recovery & Lessons Learned – A dedicated chapter ensures systematic post-incident reviews and shared learning among member states.

‍

Adaptive & Resilient by Design

‍

Rather than a static document, the Blueprint is engineered to evolve:

• Regular Exercises: Built into the framework are simulation drills that are known as Blueprint Operational Level Exercises—to test leadership response and cross-border coordination via EU‑CyCLONe
• Dynamic Reviews: The system promotes continuous iteration- this includes revising protocols, learning from real incidents, and refining role definitions.
  
  

This iterative, learning-oriented architecture aims to ensure the Blueprint remains robust amid rapidly evolving threats, including AI-boosted hacks and hybrid cyber campaigns.

Global Implications & Lessons for Others

‍

The EU’s Cybersecurity Blueprint sets a global benchmark in cyber resilience and crisis governance:

• Blueprint for Global Coordination: The EU’s method of defined crisis stages, empowered liaison bodies (like EU‑CyCLONe), and continuous exercise can inspire other regional blocs or national governments to build their own crisis mechanisms.
• Public–Private Synergy: The Blueprint’s insistence on cooperation between governments and private-sector operators of essential services (e.g., energy, telecom, health) provides a model for forging robust ecosystems.
• Learning & Sharing at Scale: Its requirement for post-crisis lessons and peer exchange can fuel a worldwide knowledge network, cultivating resilience across jurisdictions.

Conclusion

‍

The 2025 EU Cybersecurity Blueprint is more than an upgrade; it’s a strategic shift toward operational readiness, legal coherence, and collaborative resilience. Anchored in NIS2 and ENISA, and supported by EU‑CyCLONe, it replaces fragmented guidance with a well-defined, adaptive model. Its adoption signals a transformative moment in global cyber governance as for nations building crisis frameworks, the Blueprint offers a tested, comprehensive template: define clear stages, equip liaison networks, mandate drills, integrate lessons, and legislate coordination. In an era where cyber threats transcend borders, this proves to be an important development that can offer guidance and set a precedent.

‍

For India, the EU Cybersecurity Blueprint offers a valuable reference point as we strengthen our own frameworks through initiatives like the DPDP Act, the upcoming Digital India Act and CERT-In’s evolving mandates. It reinforces the importance of coordinated response systems, cross-sector drills, and legal clarity. As cyber threats grow more complex, such global models can complement our national efforts and enhance regional cooperation.

‍

References

• https://industrialcyber.co/expert/the-eus-cybersecurity-blueprint-and-the-future-of-cyber-crisis-management/
• https://www.consilium.europa.eu/en/press/press-releases/2025/06/06/eu-adopts-blueprint-to-better-manage-european-cyber-crises-and-incidents/ 
• https://www.enisa.europa.eu/topics/eu-incident-response-and-cyber-crisis-management 
• https://www.enisa.europa.eu/news/new-cyber-blueprint-to-scale-up-the-eu-cybersecurity-crisis-management 
• https://www.isc2.org/Insights/2025/01/EU-Cyber-Solidarity-Act 
• https://www.enisa.europa.eu/topics/eu-incident-response-and-cyber-crisis-management/eu-cyclone 
• https://nis2directive.eu/what-is-nis2/ 

‍

Introduction

Over the past few months, cybercriminals have upped the ante with highly complex methods targeting innocent users. One such scam is a new one that exploits WhatsApp users in India and globally. A seemingly harmless picture message is the entry point to stealing money and data. Downloading seemingly harmless images via WhatsApp can unknowingly install malware on your smartphone. This malicious software can compromise your banking applications, steal passwords, and expose your personal identity. With such malware-laced instant messages now making headlines, it is advised for netizens to exercise extreme caution while handling media received on messaging platforms.

How Does the WhatsApp Photo Scam Work?

Cybercriminals began embedding malicious code in images being shared on WhatsApp. Here is how the attack typically works:

1.  The user receives a WhatsApp message from an unknown number with an image.
2. The image may appear harmless—a greeting, meme, or holiday card—but it's packed with hidden malware.
3. When the user taps to download the image, the malware gets installed on the phone in silent mode.
4. Once installed, the malware is able to capture keystrokes, read messages, swipe banking applications, swipe credentials, and even hijack device functionality.
5. Allegedly, in its advanced versions, it can exploit two-factor authentication (2FA) and make unauthorised transactions.

Who Is Being Targeted?

This scam targets both Android and iPhone users, with a focus on vulnerable groups like senior citizens, busy workers during peak seasons, and members of WhatsApp groups flooded with forwarded messages. Experts warn that a single careless click is enough to compromise an entire device.

What Can the Malware Do?

Upon installation, the malware grants hackers a terrifying level of access:

• Track user activity via keylogging or screen capture.
• Pilfer banking credentials and initiate fund transfers automatically.
• Obtain SMS or app-based 2FA codes, evading security layers.
• Clone identity information, such as Aadhaar details, digital wallets, and email access.
• Control device operations, including the camera and microphone.

This level of intrusion can result in not just financial loss but long-term digital impersonation or blackmail.

Safety Measures for WhatsApp Users

1. Never Download Media from Suspicious Numbers

Do not download any files or pictures, even if the content appears to be familiar, unless you have faith in the source. Spread this advice among family members, particularly the older generation.

2. Turn off Auto-Download in WhatsApp Settings

Navigate to Settings > Storage and Data > Media Auto-Download. Switch off auto-download for mobile data, Wi-Fi, and roaming.

3. Install and Update Mobile Security Apps

Ensure your phone is equipped with a good antivirus or mobile security app that is updated from time to time.

4. Block and Report Potential Scammers

WhatsApp offers the ability to block and report senders in a straightforward manner. This ensures that it notifies the platform and others as well.

5. Educate Your Community

Share your knowledge on cyber hygiene with family, friends, and colleagues. Many people fall victim simply because they aren't aware of the risks, staying informed and spreading the word can make a big difference.

Advisories and Response

The Indian Cybercrime Coordination Centre (I4C) and other state cyber cells have released several alerts on increasing fraud via messaging platforms. Law enforcement agencies are appealing to the public not only to be vigilant but also to report any incident at once through the National Cybercrime Reporting Portal (cybercrime.gov.in).

Conclusion

The WhatsApp photo scam is a stark reminder that not all dangers come with a warning. A picture can now be a Trojan horse, propagating silently from device to device and draining personal money. Do not engage with unwanted media, refresh and update your privacy and security settings. Cyber criminals survive on neglect and ignorance, but through digital hygiene and vigilance, we can fight against these types of emerging threats.

References

• https://www.opswat.com/blog/how-emerging-image-based-malware-attacks-threaten-enterprise-defenses
• https://www.indiatvnews.com/technology/news/whatsapp-photo-scam-alert-downloading-random-images-could-cost-you-big-2025-05-06-988855
• https://www.hindustantimes.com/india-news/what-is-the-whatsapp-image-scam-and-how-can-you-stay-safe-from-it-101744353412848.html
• https://faq.whatsapp.com/898107234497196/?helpref=uf_share
• https://www.welivesecurity.com/en/malware/malware-hiding-in-pictures-more-likely-than-you-think/
• https://faq.whatsapp.com/573786218075805
• https://www.reversinglabs.com/blog/malware-in-images

‍

A word rooted in medical terminology keeps getting mistaken for a word rooted in technology, and that confusion is not just semantic. On 6 August 2026, it sat at the heart of a case where police in Uttar Pradesh reportedly treated the absence of WhatsApp chats, call recordings, and social media material as grounds to disbelieve a sexual assault complaint altogether, before the Allahabad High Court intervened. For an organisation working at the intersection of digital literacy and public safety, this case is less a story about a legal term and more a case study in how assumptions about digital evidence, when left unchecked, can become a barrier to justice rather than a tool for it. "Digital" here refers to a finger, not a device, and the gap between what police expected and what the law actually required is exactly where this case becomes instructive. Digital rape has nothing to do with the internet. Digit simply means finger, and the word describes non-consensual penetration by a finger, thumb, toe, or similar body part or object. That basic clarification matters because the same investigating officers who were expected to know the law also appear to have leaned on a mistaken evidentiary standard, one where a complaint without a digital trail was treated as a complaint without merit. The judgment that followed says as much about how the criminal justice system treats sexual assault complaints, and how it treats digital evidence, as it does about legal terminology.

The case, in brief

The matter is Arpit Gupta v. State of U.P. and 2 others, 2026 LiveLaw (AB) 571, neutral citation 2026:AHC:168404-DB, decided by a Division Bench of Justice Chandra Dhari Singh and Justice Tarun Saxena. Arpit Gupta, the owner of a Noida based real estate firm, Parit Associates (OPC) Private Limited, approached the High Court under Article 226 of the Constitution seeking to quash an FIR registered against him at Wave City police station, Ghaziabad, alleging rape, sexual harassment, and criminal intimidation. The complainant, a former employee of Gupta's company, alleged sustained workplace sexual harassment culminating in an act legally categorised as digital penetration, along with subsequent threats and intimidation. She resigned in April 2026. What followed procedurally is where the case becomes significant: Gupta filed a separate extortion complaint against her, she was arrested and later released on bail, and only after that sequence did she attempt to formally report the sexual assault, a report the police initially declined to register.

What followed complicates the picture considerably, and is central to why the case reached the High Court at all. On 14 April 2026, Gupta filed his own FIR against the complainant alleging extortion, claiming she had demanded 10 crore rupees from him. She was arrested in connection with that case and secured bail on 21 May 2026.  After her release, she attempted to register her own complaint of sexual assault, but police at Wave City station declined to register an FIR. A written complaint dated 7 July 2026 addressed directly to the Commissioner of Police, Ghaziabad, also produced no result. The police investigating officer's report, dated 16 July 2026, went further still, terming her allegations false and characterising the sexual assault complaint as a retaliatory counter-blast to Gupta's extortion case, citing in particular the absence of supporting electronic material such as WhatsApp chats, call recordings, or social media evidence. Only after she approached a Magistrate under Section 173(4) of the Bharatiya Nagarik Suraksha Sanhita, 2023, did the FIR finally get registered, by Magisterial order dated 20 July 2026.

The legal terminology: what "digital rape" actually means under BNS

Section 63 of the Bharatiya Nyaya Sanhita, 2023, which replaced Section 375 of the erstwhile Indian Penal Code, defines rape. Clause (b) of Section 63 extends that definition to cover non-penile penetrative acts, specifically insertion, to any extent, of any object or body part other than the penis into specified parts of a woman's body, done without her consent or against her will, subject to the circumstances of absent consent set out in the section. Digital penetration, meaning penetration by finger or thumb, falls squarely within this clause. There is no standalone offence in the BNS titled "digital rape"; the term is a widely used medico-legal shorthand, not a separate statutory category, and the offence itself is prosecuted and punished as rape under Section 64 BNS, which prescribes the punishment provisions. In this particular case, the FIR reportedly also invoked Sections 74, 75(2), and 76 BNS, provisions dealing with assault or use of criminal force with intent to outrage modesty, sexual harassment by a person in a position of authority, and related offences, alongside Section 351(3) BNS concerning criminal intimidation.

CyberPeace View

This is where the case circles back to the concern raised at the outset. The most instructive part of this judgment for the wider public may not be the definition of digital rape at all, but the police's original insistence on WhatsApp chats and call recordings before treating the complaint as credible. That reflex, a growing habit of associating the credibility of any complaint with the existence of a corresponding digital trail, reflects a wider and increasingly common misunderstanding about how evidence actually works in criminal law. Not every offence leaves an electronic footprint, and sexual assault, by its nature, frequently occurs without any accompanying digital record at all. Treating the absence of a chat log or a recording as evidence of falsehood inverts the legal presumption entirely, and risks turning digital literacy gaps within law enforcement into a structural barrier for genuine complainants who have no messages to produce because none were ever exchanged. As India's criminal justice system increasingly interacts with digital evidence, this case is a useful reminder that digital forensics should supplement an investigation, never gatekeep its starting point.

There is a genuinely technology rooted counterpart to this terminology confusion worth flagging, and it sits at the opposite end of the spectrum from where this case began. While "digital rape" has nothing to do with computers, "virtual rape" very much does, and it is an emerging harm India's legal framework is still catching up to. In January 2024, British police opened what was reported as the first investigation of its kind after a minor's avatar was allegedly gang assaulted by other avatars on Meta's metaverse platform, and similar incidents, avatars groped or sexually harassed within minutes of entering platforms like Horizon Worlds, have been documented repeatedly since, including a widely reported case involving psychotherapist Nina Jane Patel as far back as 2021. These incidents involve no physical contact whatsoever, yet researchers and legal scholars studying virtual reality note that immersive VR environments are specifically engineered to create a sense of embodiment, where the brain processes an avatar's violation as something closer to a real bodily experience than a typical online interaction, producing genuine trauma responses in victims. India's legal position here remains only partially settled. The POCSO Act's coverage of non-contact sexual abuse of minors likely extends to avatar based assaults on children, but adult victims of virtual sexual violence in India currently have no clearly dedicated statutory provision, leaving prosecutors to stretch existing harassment and outraging modesty provisions, originally drafted for a physical world, onto a form of harm the legislature has not yet explicitly addressed. As metaverse and VR platforms grow their user base in India, that gap is one worth closing before, rather than after, a case forces the question, much as this one forced the question of how police ought to treat digital evidence.

Conclusion

Two lessons run through this judgment. First, that the law's protection of bodily autonomy extends well beyond narrow, traditional definitions of penetration, a principle Section 63(b) BNS makes explicit. Second, that a complainant reporting a cognizable offence cannot be made to investigate her own case before the police will even open a file. FIR registration is not conviction, and conviction requires investigation, evidence, and trial to follow. What this case asks of the system is simpler than any of that: register the complaint, then do the work of finding out what happened.

References

1. https://www.barandbench.com/news/digital-rape-allahabad-hc-orders-inquiry-against-senior-ghaziabad-police-officers-for-not-filing-fir
2. https://www.livelaw.in/high-court/allahabad-high-court/allahabad-hc-police-cant-refuse-fir-sexual-complaint-non-production-evidence-545374

‍