How India laid out a digital line of control for its adversary
The digital countermeasures also included blocking approximately 8,000 social media accounts, 90% of which were Pakistan-based
New Delhi : Shortly after Indian jets fired cruise missiles at terror targets deep inside Pakistan to launch Operation Sindoor on May 7, officials in Delhi mobilised for a parallel battle in the digital realm. Government cyber teams tripled in size overnight to counter what became an unprecedented flood of disinformation—including sophisticated deepfakes— while simultaneously coordinating cybersecurity for critical infrastructure, particularly within the financial sector.
For the first time, senior officials have revealed to HT the full digital dimension of the four-day conflict, which the government now classifies as India’s first experience with “war in the age of social media.” The measures included a flurry of near-immediate takedown orders against narrative falsely claiming Indian military casualties, and defensive protocols that included the extraordinary step of temporarily taking offline at least two small financial institutions deemed vulnerable to cyberattacks.
“We were prepared because we saw a similar online campaign during the G20,” said a senior security official with direct knowledge of the operations, speaking on condition of anonymity. “Since that time, we had about 15-20 team members in the IT ministry who work at countering this. We had to scale that up three times to effectively work during Operation Sindoor.”
The official said the G20 experience demonstrated the severity of the threats – the summit’s official website was hit by a distributed denial of service (DDoS) attack that included 1.6 million hits per minute, a blast of data meant to take it offline.
Then, similar attacks followed in 2024 during the consecration of the Ram Temple and the Kumbh Mela. “It’s not that they target religious events. It’s more like various parties and non-state actors are either looking to get engagement or they use these moments to practice their operations,’’ one of the officials said.
The digital countermeasures also included blocking approximately 8,000 social media accounts, 90% of which were Pakistan-based, according to the officials. This effort drew controversy when X (formerly Twitter) posted that it disagreed with many of the takedown requests, including those targeting news organisations and journalists.
The official cited above also confirmed that the government had reached out to X after their global affairs handle posted about the Indian request. “We asked why was it necessary for the post to be made in the first place,” this person said.
“The media handles were blocked temporarily for sharing problematic content,” the official added.
The official added that the government invoked section 69 A of the Information Technology Act which empowers it to issue blocking orders in the “interest of sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign States or public order or for preventing incitement to the commission of any cognisable offence relating to above.”
“We took the view that anything that compromises national security or morale should be taken down.”
What surprised officials was the absence of anticipated ransomware attacks.
“We were expecting heightened ransomware activity, but that did not materialise,” the official said, suggesting that adversaries had prioritised disinformation over systems disruption.
