How India must secure its electronic hardware

Solutions to the threat of compromised supply chains must balance strategic nous with economic efficiency.

As tensions between India and Pakistan flare again along the physical borders, it is important to focus on an insidious vulnerability in the cyber domain. The electronic hardware that powers everything from missile defence systems to power grids could be compromised, in addition to border skirmishes. This silent threat vector – manipulated supply chains for critical electronic components – represents the modern battlefield where wars might be won or lost before the first conventional shot is fired.

Recent research from the Takshashila Institution, which the author co-wrote, confronts this reality head-on, proposing a governance framework that India desperately needs. Consider what happened just last month: during heightened border tensions, several key government networks experienced unexplained outages. While conventional cyber attacks exist, there is always the possibility of compromised hardware components, embedded months or years earlier in critical systems.

It is time to move away from the current one-size-fits-all approach to hardware security towards a sophisticated analysis framework that considers the unique vulnerabilities of different sectors and use cases. Not all hardware requires the same level of scrutiny – a router in a public library doesn’t demand the same security protocols as one in a nuclear facility. There is a need for a nuanced approach that takes into account concerns of economic efficiency while also hardening truly critical infrastructure.

The way forward is in establishing a unified governance mechanism under a proposed National Cyber Command. This isn’t just another bureaucratic layer. It’s an essential centre that can coordinate and take action across traditional ministerial boundaries. The current approach is very fragmented. Various departments maintain separate security protocols which can create exactly the gaps that adversaries can exploit.

The paper proposes moving towards data-driven decision-making. The proposed Supply Chain Technical Office (SCTO) under the National Cyber Security Coordinator (NCSC) would transform hardware security from subjective assessments into quantifiable risk calculations. The SCTO would provide the technical expertise needed to translate policy into practical security protocols. It would come up with a cost-benefit analysis for various threat scenarios for different products, use cases, and sectors.

The framework suggested by the report evaluates four critical factors: the implementation costs of any policy intervention, the harm prevention value derived from that action, the strategic importance of the particular sector or scenario, and – crucially – the criticality of the sector combined with the vulnerability of the product. By examining these factors together rather than in isolation, the framework creates a strategic coefficient that should be used to normalise the severity of any policy action for the specific context. This isn’t academic theory – it’s the practical approach needed when deciding which of thousands of electronic components demand rigorous security protocols and which can follow standard market practices.

Tailored regulation

Economic realities make total supply chain control impossible. The need of the hour is a methodology to identify where India must invest in rigorous security. The report proposes a four-tiered approach – ranging from minimal restrictions to comprehensive blacklisting – that creates the flexibility needed in a complex threat landscape. Based on the severity score that emerges from the framework, the paper recommends four distinct approaches tailored to different risk levels.

For low-risk scenarios, a “No Restrictions” approach allows standard market protocols without additional regulatory overhead. Medium-risk situations call for “Voluntary Certification” strategies with standardised security assessments and incentives rather than strict mandates. As risks increase, a more strict “Trust but Verify” protocol is needed which will implement comprehensive pre-emptive checks and whitelisting of pre-verified technologies. For scenarios of extreme vulnerability, a “Restrictive Response” can employ comprehensive blacklisting and technological blockades where national security considerations override market dynamics.

Will implementing such a system slow innovation and increase costs? Security always involves trade-offs. However, the analytical framework specifically accounts for these costs, weighing them against potential harm and strategic importance. This isn’t security at all costs; it’s security precisely where it matters most.

Think about what’s at stake: a compromised component in air defence radar systems could blind India to incoming threats. Manipulated hardware in the telecommunications backbone could silently exfiltrate state secrets for years without detection. The electrical grid that powers cities could be shut down remotely during moments of geopolitical crisis. The ability to compromise hardware supply chains represents, perhaps, the most strategically valuable capability, offering persistent access that traditional cyber-attacks cannot match.

What makes this particularly challenging is India’s limited domestic electronics manufacturing capacity. Despite a slew of ‘Make in India’ initiatives, India remains heavily dependent on imported components that pass through complex global supply chains. Each link in these chains could become a potential point of compromise, whether from state actors or sophisticated criminal organisations. It’s very important, therefore, to put some serious thought into how critical electronic hardware supply chains can be protected, while also accounting for the implementation costs and taking into account various complexities involved in supply chains.

The alternative – continuing the current fragmented, ad hoc approach to hardware security – leaves the digital doors to the most critical systems potentially unlocked. In an era where regional adversaries increasingly seek asymmetric advantages, this is a vulnerability India simply cannot afford.

(The writer is a research analyst at the Takshashila Institution)