The Broken Foundation · Chapter Nine
India built UPI — a real-time payments system so good that the world's largest economies are copying it. India also leads the world in internet shutdowns, used Pegasus spyware against its own journalists, and spent over ₹1,000 crore on government IT through NIC to produce websites that crash on Budget Day. We are simultaneously the best and worst at this.
| Indicator | Figure | Source |
|---|---|---|
| UPI transactions 2023-24 | 100 billion+ | NPCI 2024 |
| Internet shutdowns in 2023 | 84 — world's highest | SFLC 2023 |
| NIC annual budget | ₹1,000 crore+ | CAG Report 7/2021 |
| Pegasus devices examined with evidence of infection | Several journalists, politicians, activists | SC Technical Committee 2022 |
| CoWIN data exposure | 100 million+ records | CERT-In 2023 |
India's Digital Personal Data Protection Act 2023 contains broad government exemptions for 'sovereignty and security' — without judicial oversight, defined scope, or time limits. Rights granted, then taken back. [PDPA 2023]
The Supreme Court ruled in Anuradha Bhasin (2020) that shutdowns must be proportionate and subject to judicial review. States continue to order shutdowns in direct defiance. Economic cost: $2.8 billion in 2023.
| Country | Key Innovation | Core Principle | Outcome |
|---|---|---|---|
| Estonia | X-Road decentralised + citizen audit trail | No central honeypot | Most cyber-secure government globally |
| EU AI Act | Risk-based regulation | Regulate harm, not technology | Clear limits without innovation barriers |
| EU DSA | Platform accountability | Platforms answer for structure | Accountability without censorship |
| Singapore | Voluntary AI framework + sandbox | Regulate outcomes, not processes | Global AI hub with governance clarity |
| Finland | Media literacy from age 7 | Build demand-side resilience | Most misinformation-resilient population |
01 · RTI Restored — Default Transparency
2019 amendment repealed. Information Commissioners given constitutional protection. Everything public unless specifically exempted. National security exemption narrowly defined.
02 · Surveillance Framework — Judicial Warrant
No interception without prior judicial approval. NATGRID under parliamentary oversight. Pegasus-type spyware banned for domestic use. Citizen notification if surveillance found unjustified.
03 · AI Regulation — Three-Tier Risk Framework