Context & Strategic Need
India's digital society is expanding rapidly—with over 24.5 billion monthly UPI transactions, 1.31 billion telecom subscribers, and 1.45 billion enrolled Aadhaars. But as the digital footprint grows, so does the harm. Between 2021 and 2025, financial-fraud complaints grew from 2.63 lakh to 24.03 lakh (≈9× growth), while reported losses increased from ₹551 crore to ₹22,495 crore (≈41× growth).
“We keep adding portals, databases, units, and platforms. But cybercrime keeps moving across them.” A single cyber-fraud incident crosses multiple banks, telecom providers, platforms, and police jurisdictions. Criminals operate as organized networks—reusing identities, mule accounts, devices, and infrastructure across cases. Meanwhile, our institutional response remains divided across separate portals, sequential workflows, and institutional boundaries. The mismatch is the problem.
The Proposed Solution: The DPI Approach
India has solved large coordination problems through common infrastructure—Aadhaar created a trusted identity foundation without replacing institutions; UPI provided common payment rails without replacing banks; Account Aggregator enabled consent-based data sharing without centralizing data. NCTI applies this same approach to cybercrime:
- Don't replace what exists. Make it work together: NCTI is a federated Digital Public Infrastructure connecting existing institutions—police, commercial banks, telecom operators, digital platforms, and the judiciary—through common protocols, trusted information exchange, automation, and shared intelligence.
- What NCTI is not: NCTI is not another reporting portal or agency, not a command and control centre, not a replacement for I4C or state police systems, and not a central repository of all cybercrime data. It is a common digital fabric to coordinate actions and move evidence through standardized pathways.
- Trust, privacy, and institutional control by design: Purpose-bound information exchange, controlled role-based access, auditable traceability, and statutory compliance with the DPDP Act 2023—ensuring every institution retains its legal mandate and independent authority.
Results & Performance Framework
Standardized monitoring indicators comparing current operational baseline metrics against project performance targets under the multilateral Digital Public Infrastructure framework:
| Key Performance Indicator | Operational Baseline (FY 2025) [DEFICIT] | Project Target (Phase III) [PROTOCOL] | Data Source |
|---|---|---|---|
| Lien Placement Latency Elapsed time between validated 1930 incident signal and provisional multi-bank debit freeze. | 24 – 72 Hours | < 90 Seconds | Core Banking Switch Telemetry |
| Multi-Hop Interception Depth Automated containment capacity along consecutive beneficiary mule accounts. | 1 Hop (Manual) | Up to 5 Hops (Automated) | NCTI Protocol Bus |
| Citizen PII Centralization Exposure Volume of personal financial ledgers or KYC records stored in a central government repository. | High (Central Portals) | Zero (Decentralized DEPA) | Statutory Compliance Logs |
| Annual Citizen Restitution Rate Percentage of stolen digital financial assets preserved within the banking perimeter. | < 12% Recovered | > 65% Preserved | NCRP / RBI Financial Reports |
Project Operational Components
The technical implementation is divided into four modular components adhering to GovStack and Open DPI specifications:
Common Wire Protocols & Data Contracts
Machine-to-machine schemas (JSON-LD) for reporting incidents, tagging compromised accounts, and transmitting forensic artifacts across participating commercial banks, telecom operators, and state police cyber command units.
Cryptographically Verifiable Threat Signals
A decentralized public-key infrastructure for non-repudiable threat indicators. Participating financial institutions can verify and execute containment actions instantaneously on signals issued by peer nodes without manual human verification.
Automated Provisional Lien Workflows
Direct integration with core banking systems allowing sub-minute automated debit freezes on identified mule accounts for a time-bound window of 72 hours pending formal police or judicial confirmation.
Federated Cyber Memory & Privacy Safeguards
Cross-institutional graph analysis of fraud syndicates without centralizing raw citizen bank statements or personal PII, fully adhering to statutory requirements under the DPDP Act 2023.
System Architecture Schematic
Multi-tier operational topology spanning Ecosystem Enablers, Infrastructure Rails, Specialized Intelligence Units, and Operational Consumers. Hover or click any block on the schematic to inspect its technical role and statutory safeguards:
Data Empowerment and Protection Architecture enforcing purpose limitation, time-bound consent, and DPDP Act compliance across all inter-agency queries. Click or hover any block on the schematic above to inspect its operational role.
Implementation Schedule & Timeline
A disciplined progression through the multilateral project lifecycle from empirical field research to federated sandbox validation:
| Phase / ID | Workstream & Operational Deliverable | 25 H1 | 25 H2 | 26 H1 | 26 H2 | 27 H1 | Status |
|---|---|---|---|---|---|---|---|
| Phase I WS-1.0 |
Empirical Field Study & Problem Diagnostic 12 state police HQs, bank fraud desks, telecom registries; quantified ₹22,495 Cr leakage. | Completed | |||||
| Phase II-A WS-2.1 |
Open Wire Protocols & JSON-LD Data Contracts Standardized incident schemas, PKI non-repudiable threat signals, and API specifications. | Active | |||||
| Phase II-B WS-2.2 |
Statutory DPDP & Constitutional Safeguards DEPA privacy architecture, 72-hr provisional lien sunset rules (BNSS Sec 107), List II compliance. | Active | |||||
| Phase III WS-3.0 |
Multi-Institution Sandbox & Containment Benchmark Connecting 5 commercial banks, state police cyber units & TSPs to benchmark <90s freeze latency. | Projected |
Statutory Governance & Constitutional Safeguards
NCTI is built to operate within the existing Indian constitutional framework and statutory data protection laws, avoiding jurisdictional friction:
DPDP Act 2023 & DEPA Framework
Enforces purpose limitation, zero-knowledge verification, and time-bound auditable consent tokens. Raw citizen bank balances, KYC records, or telecom location telemetry are never pooled into a central repository.
State Police Sovereignty (List II)
Preserves exclusive state police command under Entry 1 & 2, List II (State List), Seventh Schedule of the Indian Constitution. NCTI acts as an interoperability telephone exchange, not a centralized police command.
BNSS 2023 Sec 107 & IT Act Sec 69B
Provisional debit freezes are time-bound to 72 hours, expiring automatically unless confirmed by a judicial magistrate or authorized Superintendent of Police under relevant statutory provisions.
Consortium Partners & Leadership
Led by sovereign research institutes and open public goods foundations working alongside commercial banks and law enforcement:
Centre for Digital Public Goods (CDPG)
Based at IIM Bangalore, CDPG leads empirical cybercrime research, institutional governance design, and public policy formulation for India's digital commons.
iSPIRT Cyber DPI Working Group
Volunteers and systems architects drafting open wire protocols, interoperable JSON-LD schemas, and sandbox integration specifications following India Stack principles.
Working Group Leadership
Curated and coordinated by Keshav Bhardwaj in collaboration with faculty, cybersecurity researchers, commercial banking fraud heads, and state police cyber cells.
Official Document Repository
Primary source documents, technical briefings, and working presentation slide decks released by the consortium:
| Document Title & Description | Format & File Size | Publication Date | Access |
|---|---|---|---|
| NCTI Blueprint Presentation Official 16-slide briefing deck covering digital growth, network mismatch, federated DPI doctrine, 3-tier architecture, and institutional safeguards. | Presentation Deck PDF (641 KB) · ODP (217 KB) | October 2026 | |
| NCTI Project Specification & Implementation Blueprint Complete 24-month operational specification containing Problem Statement, Needs Assessment, SMART Objectives, Activities, Workplan, MEL Framework, and Itemized Budget. | Technical & Policy Blueprint Markdown (.md) · 480+ lines | October 2026 | Read Doc |
| Interactive Visual Investigation An 18-scene cinematic journey dissecting the anatomy of a cyber-fraud incident, institutional bottlenecks, and the complete protocol solution. | Interactive Web Application Self-paced scrollytelling | Live Application | Launch |
Collaborate & Connect
National Cyber Trust Infrastructure (NCTI) is an open, collaborative initiative anchored at the Center for Digital Public Goods (CDPG), Indian Institute of Management Bangalore. Working group engagement connects commercial banks and fintechs on automated mule account lien rails, state police cyber cells on standardized digital evidence handshakes, telecom operators and digital platforms on real-time risk signaling, and academic researchers on open DPI wire specifications and statutory DPDP compliance.