#FactCheck: 2020 Video of Bridge Collapse in Uttarakhand Falsely Shared as Recent Incident in Pithoragarh

CERT-In, India's national cybersecurity agency, operates under mounting pressure. Cyberattacks in the country have doubled from 1.4 million in FY2022 to 2.9 million in FY2026, even as the window between a vulnerability's discovery and its exploitation continues to narrow.  Rather than wait for access to the most advanced AI security tools, some of which face export restrictions, the agency has spent recent months building its own solution. 

CERT-In has developed a new sandbox platform built with open-source AI, designed to identify cybersecurity gaps in public-sector systems. The sandbox functions as an isolated testing environment, allowing teams to safely evaluate software and applications without exposing the broader system to risk.  Officials have framed this as a foundation rather than a substitute. MeitY Secretary S Krishnan described the platform as a step toward building a secure environment for eventual access to international AI models — suggesting the current approach is understood as an interim measure, not a permanent alternative to global tools. 

This effort sits within a broader policy push: encouraging domestic AI development and tightening oversight of AI use in finance and online content. Taken together, these moves suggest a deliberate strategy of capacity-building through incremental, self-reliant steps, rather than a story about capability gaps or resource shortfalls.

A Crisis Measured in Millions

It helps to look at why this matters so much right now. A joint study by the Data Security Council of India and BCG found that recorded cyberattacks in the country roughly doubled in four years, from about 1.4 million in FY22 to 2.9 million in FY26. What's more worrying is how little time defenders now have to react to the average time it takes attackers to exploit a newly found vulnerability dropped from 745 days in FY22 to just 44 days in FY26, largely because attackers are using AI themselves to scout targets and build exploits faster. Banking, financial services, healthcare, telecom and government portals bear the brunt of this, with ransomware-as-a-service groups and state-linked actors increasingly slipping in through vendor portals and supply-chain weak points. 

Turning Existing AI Into a Working Defence

CERT-In's Sandbox in Action

Instead of treating the lack of any one frontier model as a dealbreaker, CERT-In simply built its own closed trial platform  officials have taken to calling it a "war room"  where open-source and other AI models are set loose on software code to find vulnerabilities and shape secure workflows for India's top public sector companies, including in financial services. At a press conference, Meity secretary S. Krishnan pointed out that these substitute models already match roughly 60 to 70 per cent of the performance of the most advanced security-focused systems out there globally. That's a fairly substantial chunk of the capability, and it's coming from tools India can actually access today. The testing has stretched to core digital infrastructure like Aadhaar and government login systems, while some of the country's biggest tech firms are already using currently available AI models to patch widely used enterprise software, banking platforms included. The logic is simple enough: build the muscle now with whatever's on hand, so the enterprise environment is already in better shape by the time more capable tools eventually arrive. 

Investing in Sovereign Capability

Arguably the more important move here is a longer-term one , India's bet on building its own frontier-grade security AI. The Centre has reportedly asked domestic AI developers Sarvam AI and BharatGen to build advanced cybersecurity capabilities of their own, hosted on the government's isolated computer infrastructure and eventually put to work protecting critical infrastructure. There's no public timeline yet for when these indigenous models will be ready, but the intent behind the move isn't hard to read: cut India's reliance on any single foreign provider for defending the systems that underpin banking, identity and public administration, while keeping sensitive testing and deployment on Indian soil. Officials have also signalled a preference for on-premises deployment of high-capability AI tools where the stakes are highest, rather than leaning entirely on overseas cloud infrastructure. It's a choice that points toward building lasting, self-reliant capacity rather than making a one-off purchase. 

A Tightening Regulatory Net

RBI's Model Risk Guardrails

None of this is happening in a vacuum. On 24 June 2026, the Reserve Bank of India released draft guidance on model risk management that, for the first time, brings AI and machine learning systems used by banks, NBFCs and other regulated entities under a single, board-level governance framework. The draft asks institutions to keep a full inventory of every model they use, rank each one by risk, and build in human override and "kill-switch" mechanisms so a malfunctioning AI system can be shut down immediately. It also makes one thing very clear: banks can't shrug off accountability just because the technology came from a vendor. 

MeitY's Deepfake and Synthetic-Content Rules

Around the same time, the Ministry of Electronics and Information Technology notified amendments to the IT Rules that formally define "synthetically generated information," require deepfakes and AI-altered media to carry clear, persistent labels and embedded provenance metadata, and cut the takedown window for unlawful synthetic content down to just three hours. Taken together, the RBI and MeitY rules form the regulatory backbone that CERT-In's technical sandbox is meant to plug into giving India a more coordinated response to both the defensive and the deceptive sides of AI.

One Chain of Command

Officials have gone out of their way to stress that all these moving parts aren't creating confusion in India's cybersecurity reporting structure. CERT-In director general Sanjay Bahl has said the National Security Council Secretariat remains the overarching body, with CERT-In as the top cyber reporting and investigations organisation across sectors, and that sectoral regulators like the RBI and SEBI still report into this one structure rather than running their own parallel systems.

Conclusion

Look at CERT-In's sandbox, the push for sovereign AI, and the tightening regulatory net together, and a clearer picture forms. This isn't really a story about a piece of technology India doesn't have. It's a story about capability being built, deliberately and in the open. The country is using the AI tools available right now to close real security gaps, backing homegrown alternatives for the long haul, and pairing both with governance rules that keep banks, platforms and public infrastructure honest. If there's a lesson in all this, it's that real resilience against a fast-moving cyberthreat landscape rarely arrives all at once. It gets built the way most lasting capability does  piece by piece, mostly at home, without waiting for any single outside breakthrough to show up first.

References

1. https://inc42.com/buzz/centre-asks-sarvam-ai-bharatgen-to-develop-mythos-like-cyber-ai-models/
2. https://inc42.com/buzz/centre-asks-sarvam-ai-bharatgen-to-develop-mythos-like-cyber-ai-models/
3. https://www.newkerala.com/news/a/govt-prioritises-access-anthropics-mythos-ai-model-strengthen-475.htm
4. https://blog.qualys.com/product-tech/2026/06/24/cert-in-ai-vulnerability-blueprint-machine-speed-risk-operations
5. https://www.business-standard.com/technology/tech-news/mythos-threat-govt-tech-firms-test-their-softwares-for-vulnerabilities-126052700386_1.html
6. https://inc42.com/buzz/centre-asks-sarvam-ai-bharatgen-to-develop-mythos-like-cyber-ai-models/
7. https://www.finextra.com/blogposting/32142/rbis-model-risk-management-guidance-2026--summary
8.  https://www.medianama.com/2026/06/223-rbi-ai-guidelines-2026-banks-kill-switch/
9. https://www.freshfields.com/en/our-thinking/blogs/technology-quotient/india-targets-deepfakes-and-ai-generated-content-key-changes-under-meitys-2026-102mjwn

‍

Introduction

Military equipment used by elite special forces is supposed to be the most tightly secured hardware a country owns, the last place anyone would expect a hidden flaw in its parts supply chain to slip through undetected. Yet that is precisely where one surfaced this August, when The Telegraph, revealed that cameras fitted to the Royal Navy's K3 Scout surveillance drones, equipment used by Britain's Royal Marines and closely associated with the Special Boat Service, the United Kingdom's elite maritime special forces unit, had been secretly transmitting signals to an internet address inside China. The United Kingdom's Ministry of Defence stripped the affected cameras of all internet connectivity the moment the transmissions were discovered, and has spent the days since insisting no sensitive data actually left the country. That distinction, between what was taken and what was exposed, is where this incident becomes genuinely worth examining.

What was actually found, and what was not

The K3 Scout is an 8.4 metre uncrewed surface vessel built by Kraken Technology Group, a British defence manufacturer based in Fareham, Hampshire, capable of reaching 55 knots and remaining at sea for up to 30 days. The Royal Navy purchased roughly 20 of these vessels under Project Beehive, a £12 million programme designed to fold autonomous systems into frontline maritime operations quickly, and the Royal Marines' Coastal Forces Squadron and 47 Commando have operated the fleet since March 2026.

A routine cyber vulnerability assessment, not an external tip off or an adversarial intrusion, is what caught the problem. Investigators found the electro-optical and infrared cameras mounted on the vessels sending what the industry calls heartbeat communications, routine signals a connected device sends simply to confirm it is powered on and functioning, to an IP address located in China. Kraken did not manufacture the cameras in house; the company sourced them from a third party supplier that had reportedly given assurances about their security, assurances the heartbeat traffic now calls directly into question.

Every source, including the UK Ministry of Defence itself, confirms the cameras were sending signals to an IP address in China. What remains unconfirmed is which company actually manufactured the compromised camera components. Neither The Telegraph nor the Ministry of Defence has publicly named the specific camera manufacturer, and an unverified social media claim allegedly identifying a Canadian supplier has since been disputed by that company, with no confirmation from official sources tying it to the incident as of now.

Crucially, the UK Ministry of Defence has been consistent on one point across every statement it has issued: its investigation found no evidence that classified information, government systems, or mission critical data were accessed, compromised, or transmitted outside the country. That is a meaningful distinction, and one worth taking at face value rather than dismissing as reflexive reassurance, since heartbeat signals by design carry connectivity status rather than payload content. But security researchers who reviewed the case have been equally consistent in noting that even metadata this thin has value to a watching adversary. Knowing when and where a piece of specialised military hardware is powered on and actively connected can itself function as a targeting signal, revealing patterns of deployment, operational tempo, and geographic presence without a single classified file ever leaving the device.

Why this particular fleet matters

The timing sharpens the concern considerably. A defence source cited in reporting on the story indicated the K3 Scout fleet was being considered as part of a future British contribution to securing freedom of navigation in the Strait of Hormuz, where the United Kingdom has already deployed a warship amid discussions of a multinational security mission. Equipment destined for a contested, strategically sensitive waterway having any unexplained data path back to a systemic rival's territory is not a detail that stays confined to a procurement footnote. The vessels were also tested during a NATO exercise in the Baltic Sea in 2025, meaning any compromised telemetry pattern could theoretically have been observed by the very alliance partners Britain was demonstrating the technology to.

The deeper issue is structural rather than incidental. Modern military hardware, however elite the unit operating it, is rarely built end to end by a single trusted manufacturer. Cameras, sensors, chipsets, and firmware routinely pass through several tiers of suppliers before reaching a finished platform, and each tier is a potential point where the chain of custody and verification can quietly break down. Kraken's own assurances about its camera supplier illustrate exactly how that failure propagates: a manufacturer can act in good faith, rely on a vendor's word, and still end up fielding compromised hardware, because the vulnerability was never introduced at the assembly stage but several layers upstream, in components whose ultimate origin was never fully audited.

CyberPeace View | A wider principle worth naming

There is a broader ethical and legal frame worth applying here, one that extends beyond ordinary cybersecurity practice into the territory international humanitarian law occupies. The core distinction that law draws, between combatants and protected persons, between military objectives and civilian life, depends fundamentally on operators having accurate, uncompromised situational awareness. A surveillance platform is not merely a piece of hardware; it is the sensory apparatus through which decisions with real consequences for human life get made in contested environments. If the integrity of that apparatus cannot be guaranteed, the reliability of everything built on top of it, target verification, proportionality assessments, distinction between combatant and civilian, is quietly weakened at its foundation. This is not a claim that the K3 Scout breach itself caused harm; the Ministry of Defence's own findings suggest it did not. It is a reminder that supply chain integrity in military sensing equipment is not simply a procurement or cybersecurity concern sitting apart from the laws of armed conflict. It sits underneath them, because a compromised sensor is, in a very real sense, a compromised judgment further down the chain.

Where India fits into this story

India has been grappling with functionally the same problem for years, and its response offers a useful point of comparison. Reporting dating back to 2023 revealed that Indian defence officials had quietly barred domestic drone manufacturers from using components sourced from countries sharing a land border with India, an unmistakable, if unstated, reference to China, citing exactly the kind of vulnerability now playing out in Britain's fleet, compromised communication functions, cameras, and operating software capable of leaking intelligence. That policy has hardened considerably since. Earlier this year, the Ministry of Defence in New Delhi finalised a stringent framework requiring that drones procured from domestic manufacturers contain no Chinese origin components or electronics at all, and at least one major drone order was placed on hold after allegations surfaced that the supplier had used Chinese parts despite those restrictions.

The commercial consequence of that caution has been real and acknowledged openly by industry figures; sourcing components outside China raises costs, given that up to 70 percent of the global drone supply chain has historically run through Chinese manufacturing. But India appears to have concluded, well ahead of this particular British incident becoming public, that the cost of auditing and diversifying a supply chain is lower than the cost of fielding compromised sensing equipment inside sensitive military operations. Indian firms have responded by building propulsion, avionics, and camera systems in house specifically to close this gap, treating component provenance as a first order design question rather than an afterthought bolted on after a breach forces the issue. Seen from that vantage point, the K3 Scout episode reads less like a uniquely British failure and more like a case study in a risk India's own defence establishment had already priced in.

Lessons from the breach

A few conclusions follow fairly directly from how this incident unfolded. First, routine cyber vulnerability assessments work, and this case is arguably an argument for doing more of them, more often, rather than a sign that current practice failed; the breach was caught internally, before any confirmed operational harm occurred. Second, a manufacturer's own assurances about a component supplier are not a substitute for independent verification, since Kraken's good faith reliance on its camera vendor's word is precisely where this vulnerability slipped through. Third, and most durably, defence procurement increasingly needs to treat component provenance as inseparable from operational security, not as a compliance checkbox to be satisfied once at contract signing. India's multi-year pivot toward auditing and localising sensitive component supply chains, imperfect and costly as it has been, points toward the direction other defence establishments will likely be pushed in as more incidents like this one surface. The K3 Scout breach did not, on the evidence available, compromise a single mission. What it compromised was the assumption that hardware assurances alone are sufficient, and that assumption was never going to survive close scrutiny forever.

References

1. LBC, "Spy cameras on Navy drones used by UK's elite special forces sending signals to China as security fears grow." https://www.lbc.co.uk/article/royal-navy-spy-drones-sending-signals-to-china-5Hjdfpm_2/
2. Defence Blog, "Royal Navy naval drone cameras secretly sent data to China." https://defence-blog.com/royal-navy-naval-drone-cameras-secretly-sent-data-to-china/
3. The National Interest, "The Royal Navy's Spy Drones May Have Been Spying for China, Too." https://nationalinterest.org/blog/buzz/royal-navys-spy-drones-may-have-been-spying-for-china-too-sa-081026
4. Kyiv Post, "UK Navy Drone Camera Components Were Secretly Communicating With China." https://www.kyivpost.com/post/82061
5. The Defense News, "UK's Royal Navy K3 Scout Drone Cameras Found Sending Data to an IP Address in China." https://www.thedefensenews.com/UKs-Royal-Navy-K3-Scout-Drone-Cameras-Found-Sending-Data-to-an-IP-Address-in-China/
6. The Jerusalem Post, "UK drones sent data to China, raising US, European fears on Chinese components." https://www.jpost.com/international/article-905191
7. Firstpost, "UK military drones fitted with Chinese cameras found sending data to Beijing: Report." https://www.firstpost.com/world/uk-military-drones-fitted-with-chinese-cameras-found-sending-data-to-beijing-report-14037075.html
8. Firstpost, "UK deploys warship to West Asia amid plans for multinational Hormuz security mission." https://www.firstpost.com/world/uk-deploys-warship-to-west-asia-amid-plans-for-multinational-hormuz-security-mission-ws-e-14009471.html
9. Reuters via Inquirer.net, "India bars makers of military drones from using Chinese parts." https://newsinfo.inquirer.net/1813810/india-bars-makers-of-military-drones-from-using-chinese-parts
10. The Print, "Amid concerns about use of Chinese parts in drones, Army general urges industry to be transparent." https://theprint.in/defence/amid-concerns-about-use-of-chinese-parts-in-drones-army-general-urges-industry-to-be-transparent/2305866/
11. idrw.org, "India Unveils Drone Security Framework to Eliminate Chinese Components and Strengthen UAV Cyber Defences." https://idrw.org/india-unveils-drone-security-framework-to-eliminate-chinese-components-and-strengthen-uav-cyber-defences/
12. The Week, "The hidden weakness in India's military drones: Zen Technologies says it has fixed the Chinese problem." https://www.theweek.in/news/defence/2026/07/09/the-hidden-weakness-in-indias-military-drones-zen-technologies-says-it-has-fixed-the-chinese-problem.html

‍

Introduction

The integration of Artificial Intelligence into our daily workflows has compelled global policymakers to develop legislative frameworks to govern its impact efficiently. The question that we arrive at here is: While AI is undoubtedly transforming global economies, who governs the transformation? The EU AI Act was the first of its kind legislation to govern Artificial Intelligence, making the EU a pioneer in the emerging technology regulation space. This blog analyses the EU's Draft AI Rules and Code of Practice, exploring their implications for ethics, innovation, and governance.

Background: The Need for AI Regulation

AI adoption has been happening at a rapid pace and is projected to contribute  $15.7 trillion to the global economy by 2030. The AI market size is expected to grow by at least 120% year-over-year. Both of these statistics have been stated in arguments citing concrete examples of AI risks (e.g., bias in recruitment tools, misinformation spread through deepfakes). Unlike the U.S., which relies on sector-specific regulations, the EU proposes a unified framework to address AI's challenges comprehensively, especially with the vacuum that exists in the governance of emerging technologies such as AI. It should be noted that the GDPR or the General Data Protection Regulation has been a success with its global influence on data privacy laws and has started a domino effect for the creation of privacy regulations all over the world. This precedent emphasises the EU's proactive approach towards regulations which are population-centric. 

Overview of the Draft EU AI Rules

This Draft General Purpose AI Code of Practice details the AI rules for the AI Act rules and the providers of general-purpose AI models with systemic risks. The European AI Office facilitated the drawing up of the code, and was chaired by independent experts and involved nearly 1000 stakeholders and EU member state representatives and observers both European and international observers.

14th November 2024 marks the publishing of the first draft of the EU’s General-Purpose AI Code of Practice, established by the EU AI Act. As per Article 56 of the EU AI Act, the code outlines the rules that operationalise the requirements, set out for General-Purpose AI (GPAI) model under Article 53 and GPAI models with systemic risks under Article 55. The AI Act is legislation that finds its base in product safety and relies on setting harmonised standards in order to support compliance. These harmonised standards are essentially sets of operational rules that have been established by the European Standardisation bodies, such as the European Committee for Standardisation (CEN), the European Committee for Electrotechnical Standardisation (CENELEC) and the European Telecommunications Standards Institute. Industry experts, civil society and trade unions are translating the requirements set out by the EU sectoral legislation into the specific mandates set by the European Commission. The AI Act obligates the developers, deployers and users of AI on mandates for transparency, risk management and compliance mechanisms 

The Code of Practice for General Purpose AI

The most popular applications of GPAI include ChatGPT and other foundational models such as CoPilot from Microsoft, BERT  from Google, Llama from Meta AI and many others and they are under constant development and upgradation.  The 36-pages long draft Code of Practice for General Purpose AI is meant to serve as a roadmap for tech companies to comply with the AI Act and avoid paying penalties. It focuses on transparency, copyright compliance, risk assessment, and technical/governance risk mitigation as the core areas for the companies that are developing GPAIs. It also lays down guidelines that look to enable greater transparency on what goes into developing GPAIs. 

The Draft Code's provisions for risk assessment focus on preventing cyber attacks, large-scale discrimination, nuclear and misinformation risks, and the risk of the models acting autonomously without oversight. 

Policy Implications

The EU’s Draft AI Rules and Code of Practice represent a bold step in shaping the governance of general-purpose AI, positioning the EU as a global pioneer in responsible AI regulation. By prioritising harmonised standards, ethical safeguards, and risk mitigation, these rules aim to ensure AI benefits society while addressing its inherent risks. While the code is a welcome step, the compliance burdens on MSMEs and startups could hinder innovation, whereas, the voluntary nature of the Code raises concerns about accountability. Additionally, harmonising these ambitious standards with varying global frameworks, especially in regions like the U.S. and India, presents a significant challenge to achieving a cohesive global approach.

Conclusion

The EU’s initiative to regulate general-purpose AI aligns with its legacy of proactive governance, setting the stage for a transformative approach to balancing innovation with ethical accountability. However, challenges remain. Striking the right balance is crucial to avoid stifling innovation while ensuring robust enforcement and inclusivity for smaller players. Global collaboration is the next frontier. As the EU leads, the world must respond by building bridges between regional regulations and fostering a unified vision for AI governance. This demands active stakeholder engagement, adaptive frameworks, and a shared commitment to addressing emerging challenges in AI. The EU’s Draft AI Rules are not just about regulation, they are about leading a global conversation. 

References

• https://indianexpress.com/article/technology/artificial-intelligence/new-eu-ai-code-of-practice-draft-rules-9671152/ 
• https://digital-strategy.ec.europa.eu/en/policies/ai-code-practice 
• https://www.csis.org/analysis/eu-code-practice-general-purpose-ai-key-takeaways-first-draft#:~:text=Drafting%20of%20the%20Code%20of%20Practice%20is%20taking%20place%20under,the%20drafting%20of%20the%20code. 
• https://copyrightblog.kluweriplaw.com/2024/12/16/first-draft-of-the-general-purpose-ai-code-of-practice-has-been-released/