Cyber biosecurity hybrid threat governance

Introduction

Cyber biosecurity hybrid threat governance refers to the legal, institutional and regulatory framework established to prevent, identify and manage threats arising from the combination of cyberattacks, biological technologies and malicious interference with biotechnology systems. The increasing digitalisation of biotechnology, healthcare, genetic research and biological manufacturing has created new security challenges for governments, research institutions and private organisations.

Modern biotechnology increasingly depends on interconnected digital systems, including genomic databases, laboratory information management systems, automated research equipment, artificial intelligence platforms and biological manufacturing infrastructure. These systems may become targets of cyberattacks that disrupt research, compromise sensitive genetic information or interfere with essential healthcare and biological production activities.

Hybrid threats combine technological, biological, informational and sometimes geopolitical methods to create complex security risks. Cyber biosecurity governance therefore requires coordination between cybersecurity authorities, public health institutions, biotechnology regulators, law enforcement agencies and international organisations.

Meaning and scope of cyber biosecurity hybrid threats

Cyber biosecurity hybrid threats involve the use of digital technologies to compromise biological research, healthcare infrastructure or biotechnology-related information systems.

Such threats may include:

Unauthorised access to genomic databases and sensitive biological information.

Cyberattacks targeting biotechnology research institutions.

Manipulation or theft of digital laboratory records.

Disruption of pharmaceutical and vaccine manufacturing systems.

Ransomware attacks affecting hospitals and diagnostic laboratories.

Misuse of artificial intelligence systems in biological research.

Disinformation campaigns concerning biological emergencies.

Cyber interference with agricultural and public health monitoring systems.

These threats may affect national security, public health, research integrity, economic stability and public confidence in biotechnology.

Legal and regulatory framework in India

1. Information technology act, 2000

The Information Technology Act, 2000, provides India's principal legislative framework for addressing cyber offences and electronic information security.

Section 43 addresses unauthorised access, damage and other specified activities involving computer systems.

Section 66 establishes criminal liability for certain acts covered by Section 43 when committed dishonestly or fraudulently.

Section 70 provides for the declaration of protected systems where unauthorised access may threaten national security or other protected interests.

Section 70A provides for the designation of the National Critical Information Infrastructure Protection Centre (NCIIPC), which protects critical information infrastructure.

Section 70B establishes the Indian Computer Emergency Response Team (CERT-In), responsible for coordinating cybersecurity incident responses.

These provisions are particularly relevant to biotechnology laboratories, hospitals, pharmaceutical companies and biological research databases.

2. Digital personal data protection act, 2023

The Digital Personal Data Protection Act, 2023, establishes a framework for processing digital personal data in India.

Genomic information and certain medical records may constitute personal data when they relate to identifiable individuals.

Organisations processing such information must comply with applicable data protection obligations, including requirements concerning lawful processing and security safeguards.

Cyber biosecurity governance must therefore address both the protection of biological research infrastructure and the privacy of individuals whose genetic and medical information is processed.

3. Environment protection act, 1986

The Environment (Protection) Act, 1986, provides the legislative foundation for regulating environmental risks associated with biotechnology.

The 1989 Rules concerning hazardous microorganisms and genetically engineered organisms or cells establish regulatory controls over specified biotechnology activities.

Cybersecurity becomes relevant where digital interference could affect regulated biotechnology operations, safety monitoring or compliance records.

4. Disaster management act, 2005

The Disaster Management Act, 2005, establishes India's institutional framework for disaster prevention, preparedness and response.

Biological emergencies may require coordination between public health authorities, disaster management institutions and cybersecurity agencies.

Cyber biosecurity governance should therefore integrate digital incident response with biological emergency preparedness.

Institutional framework for hybrid threat governance

Effective governance requires coordination among different institutions.

1. Indian Computer Emergency Response Team (CERT-In)

CERT-In coordinates responses to cybersecurity incidents and issues cybersecurity directions and advisories. Its role is important when cyber incidents affect biotechnology laboratories, hospitals and pharmaceutical infrastructure.

2. National Critical Information Infrastructure Protection Centre (NCIIPC)

NCIIPC is responsible for protecting designated critical information infrastructure. Healthcare and other essential systems may require protection against digital threats that could disrupt important public services.

3. Department of Biotechnology (DBT)

DBT supports biotechnology research, development and policy coordination. Its responsibilities are relevant to establishing appropriate security practices for biotechnology research institutions.

4. Indian Council of Medical Research (ICMR)

ICMR contributes to biomedical research governance and research ethics. Its institutional role is important in protecting research integrity and sensitive health information.

5. National Disaster Management Authority (NDMA)

NDMA provides national-level disaster management guidance. Its coordination responsibilities are relevant when cyber incidents contribute to wider biological or public health emergencies.

International legal and regulatory framework

1. Biological weapons convention, 1972

The Biological Weapons Convention (BWC) prohibits the development, production, acquisition and stockpiling of biological and toxin weapons.

It establishes an international prohibition against biological weapons and requires participating states to take appropriate national implementation measures.

Cyber biosecurity governance supports the objectives of the Convention by strengthening the protection of biological research institutions and preventing malicious interference with biotechnology systems.

2. Convention on cybercrime, 2001

The Budapest Convention on Cybercrime provides an international framework for cooperation against computer-related offences.

It addresses illegal access, illegal interception, data interference, system interference and other cyber offences.

Its relevance to cyber biosecurity lies in international cooperation concerning attacks on digital biological research infrastructure.

India is not a party to the Budapest Convention, although its provisions remain influential in international discussions on cybercrime legislation.

3. International health regulations, 2005

The International Health Regulations (IHR), adopted by the World Health Organization, establish obligations relating to the detection, assessment, notification and response to public health events.

Cyber biosecurity governance complements these obligations by addressing digital threats that may affect disease surveillance, laboratory reporting and public health information systems.

4. United Nations security council resolution 1540 (2004)

UN Security Council Resolution 1540 requires states to adopt measures preventing non-state actors from acquiring or using nuclear, chemical and biological weapons and their means of delivery.

It reinforces the importance of national legal controls, institutional safeguards and international cooperation against the proliferation of dangerous technologies.

Important case laws

1. Shreya Singhal v. Union of India (2015)

The Supreme Court of India examined the constitutionality of Section 66A of the Information Technology Act, 2000.

The Court declared Section 66A unconstitutional because its provisions violated the freedom of speech and expression guaranteed under Article 19(1)(a) of the Constitution.

Relevance: Cyber biosecurity policies must respect constitutional freedoms while addressing digital threats. Governments cannot rely on vague or excessively broad restrictions when regulating online information concerning biological research or public health.

2. Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)

The Supreme Court recognised privacy as a fundamental right under Article 21 and other constitutional freedoms.

The judgment established important principles concerning informational privacy, personal autonomy and protection against unjustified state interference.

Relevance: Genomic databases, clinical research records and biological information systems may contain highly sensitive personal information. Cyber biosecurity governance must protect such information through appropriate security safeguards and lawful data processing.

3. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court examined the admissibility of electronic records under Section 65B of the Indian Evidence Act, 1872.

The Court clarified the requirements for establishing the admissibility of electronic evidence.

Relevance: Cyber biosecurity investigations may involve electronic laboratory records, system logs, research databases and digital communications. Reliable preservation and authentication of electronic evidence are essential for investigating cyber incidents and establishing legal responsibility.

4. State of Tamil Nadu v. Suhas Katti (2004)

This case involved online harassment and was among the early Indian cybercrime prosecutions resulting in conviction under the Information Technology Act, 2000.

The matter demonstrated the application of existing criminal law to offences committed through digital communication systems.

Relevance: Although unrelated directly to biotechnology, the case illustrates the importance of applying cybercrime legislation to harmful digital activities. Similar investigative and evidentiary principles are relevant when cyber incidents target biological research institutions.

Major governance challenges

Cyber biosecurity hybrid threats create several regulatory and institutional challenges:

1. Fragmented regulation: Cybersecurity, biotechnology, public health and environmental laws operate through different institutions.

2. Cross-border cyberattacks: Digital attacks may originate outside the country, creating difficulties in investigation and international cooperation.

3. Sensitive biological information: Genomic and medical databases require strong privacy and security protections.

4. Research infrastructure vulnerabilities: Universities, laboratories and biotechnology companies may have different cybersecurity capabilities.

5. Artificial intelligence risks: AI-based research systems introduce additional questions concerning data integrity, accountability and responsible access.

6. Attribution difficulties: Identifying the individuals or organisations responsible for sophisticated cyber incidents can be legally and technically challenging.

7. Institutional coordination: Effective responses require cooperation between cybersecurity agencies, biotechnology regulators, healthcare institutions and law enforcement authorities.

Governance and preventive measures

A comprehensive cyber biosecurity governance framework should incorporate the following measures:

Establish cybersecurity standards for biotechnology and biomedical research institutions.

Introduce regular security audits and risk assessments.

Protect genomic and medical databases through appropriate access controls.

Develop coordinated incident-reporting mechanisms.

Establish institutional cybersecurity training programmes.

Strengthen cooperation between CERT-In, NCIIPC, DBT and public health authorities.

Develop emergency response plans for cyber incidents affecting essential biological infrastructure.

Promote international cooperation concerning cybercrime and biological security.

Establish clear accountability for organisations responsible for protecting sensitive biological information.

Conclusion

Cyber biosecurity hybrid threat governance is an emerging area of legal and institutional regulation that combines cybersecurity, biotechnology, public health and national security. In India, the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023, the Environment (Protection) Act, 1986, and the Disaster Management Act, 2005, provide important elements of the existing regulatory framework. International instruments such as the Biological Weapons Convention, International Health Regulations and UN Security Council Resolution 1540 further strengthen the governance framework. Judicial decisions concerning privacy, electronic evidence and constitutional freedoms provide essential legal principles for managing these threats. A coordinated governance system involving cybersecurity agencies, biotechnology regulators, healthcare institutions and international organisations is necessary to protect biological research infrastructure, sensitive information and public health while ensuring responsible scientific innovation.