'Aim is to dismantle entire cybercrime ecosystem, not just individual attackers’: Pronab Mohanty

The Karnataka State Police has rolled out several innovative measures and proposed a fusion of different technological innovations to tackle the rapidly evolving landscape of cybercrime. Pronab Mohanty, Director General of Police and head of the Cyber Command Centre (CCC) in Karnataka, speaks about enforcement, preparedness, and privacy concerns. 

Excerpts:

Do enforcement efforts against cybercrime need to be strengthened? Are the police stations overwhelmed by the surge in cases and shortage of technical personnel?

Karnataka police has long been regarded as a bellwether in technology-intensive enforcement. The state was among the first to adopt
a comprehensive Cyber Security Policy in 2023, followed by the establishment of an independent Cyber Command in 2025. 

However, Bengaluru’s position as India’s largest IT cluster has made it a prime target for cybercriminals and fraudsters. Cybercrime has risen sharply. In 2024 alone, over 22,000 cases were reported in Karnataka, of which nearly 17,000 were from Bengaluru. While Karnataka Police is cyber-savvy compared to many other states, the sudden spike in cases has stretched resources. Also, personnel trained in conventional policing now face a steep learning curve. Concurrent with the steep rise in cybercrime, there has also been a significant rise in attacks and threats to the state’s ICT infrastructure. Hence, the government has recently created the Cyber Command, which is uniquely structured to deal with these twin threats and tackle several related problems in a comprehensive manner. The visionary series of judgments of Justice Nagaprasanna last year has defined the way forward comprehensively.

Ransomware has evolved into multi-layered extortion, including data theft and tailored ransom demands. Are we technologically equipped to handle this?

Modern ransomware operations now employ multi-stage attack techniques that resemble advanced persistent threat (APT) operations. Victims face not only operational disruption but also the threat of public exposure of confidential data. Some groups have extended this approach, adding distributed denial-of-service (DDoS) attacks or targeting customers, partners, and stakeholders to apply additional pressure. The police have kept pace and achieved some success in disrupting such attacks. When an attack is reported, investigators work closely with the affected organisation to preserve evidence, secure logs, and capture volatile data such as
memory, running processes, and network connections. Following
initial triage, investigators conduct digital forensic analysis to
reconstruct the attack lifecycle.

Simultaneously, we also conduct financial investigations to track ransom payments, typically made in cryptocurrencies. Rather than focusing solely on individual attackers, law-enforcement agencies increasingly aim to dismantle the broader criminal ecosystem, including command-and-control servers, leak websites, malware-distribution networks, and hosting providers that support ransomware groups. These actions are typically carried out through multinational operations involving agencies such as the FBI, Europol, Interpol, and national cybercrime units, reflecting the transnational nature of ransomware activities.

Are you planning specialised training to create force multipliers within the police in the fight against cybercrime? 

The new Cyber Command has four sub-verticals, one of which is the training, outreach and capacity-building unit. This unit aims at including experts from academia, law schools, corporates, other agencies, and even NGOs and activists who will participate in the process of fighting cybercrime and advise on cybersecurity. Karnataka already has platforms such as the Technical Advisory Panel (TAP) and NGOs like the CySecK that support law enforcement. In fact, the state police already has an institution called the CCITR, which operates out of the CID premises and trains police personnel in advanced digital forensics regularly. The participation of experts from academia and the industry will offer a three-fold solution: firstly, it will expose the police staff to advanced practices in digital forensics and cybersecurity methods; secondly, the police department will avail itself of the services of these advanced practitioners for free; and thirdly, such a hub will allow interns and researchers to hone and upgrade their skills by solving real-world problems in real-time.

Could enhanced cyber security and surveillance measures compromise individual privacy? How do you balance the two?

It is inevitable that while exercising greater vigilance in the cyber domain using surveillance mechanisms, some individuals’ privacy may be impacted adversely. To achieve a stable trade-off between cybersecurity and privacy protection, police and investigative agencies have adopted a lawful, proportionate, and accountable surveillance framework. The first step that is taken is to ensure that all surveillance activities are conducted under clearly defined legal authority, with procedures specifying when and how personal data can be collected, processed, and retained. Surveillance is targeted rather than indiscriminate, focusing only on individuals or networks reasonably suspected of criminal activity. Second, strong oversight and accountability mechanisms are baked in. Third, police agencies have adopted Privacy-by-Design technological approaches. Fourth, educating citizens about cyber threats, encouraging voluntary reporting of cyber incidents, and promoting secure digital practices by the police have reduced the need for excessive surveillance while strengthening collective cybersecurity resilience.