India’s cyber doctrine is excellent, but one word change would make it even stronger
India’s Joint Doctrine for Cyberspace Operations is a landmark achievement. It’s clear, ambitious, and rooted in digital reality. The central message is powerful: India must control its own cyber infrastructure to be truly independent. This level of strategic thinking puts India ahead of most nations. Many countries still treat cyber issues as just another IT problem. India understands something deeper: cyber is a full domain of national power.
However, this strategic clarity encounters an unexpected obstacle within the doctrine itself. While the document correctly advocates for indigenous control and strategic autonomy, it simultaneously characterises cyberspace as a domain of “shared sovereignty.” This terminology, though perhaps intended to acknowledge cyberspace’s interconnected nature, creates a conceptual tension that undermines the doctrine’s own strategic logic. A more accurate characterisation would recognise cyberspace as “contested sovereignty.”
This isn’t just wordplay. It matters for India’s future.
What the Doctrine Gets Right
The doctrine’s focus on Atmanirbharta (self-reliance) is brilliant. Instead of quick fixes or foreign solutions, it insists on something harder but smarter: India must build its own cyber foundations.
This means:
- Indian operating systems
- Indian-made hardware and chips
- Indian-controlled digital infrastructure
The logic is simple: whoever controls the infrastructure controls the game.
The doctrine also shows mature strategic thinking in four key ways:
- It treats cyber as real power. Not just a technical support function, but a domain where nations win or lose.
- It connects capability to independence. You can’t buy cyber security, you have to build it yourself over time.
- It thinks comprehensively. This isn’t just about military cyber operations. It’s about economic security, social stability, and good governance.
- It invests in people. The best technology means nothing without the human talent to create and operate it.
These insights make this one of the world’s most sophisticated cyber strategy documents.
The Language Problem
So what does “sovereignty” mean in cyber terms? It’s straightforward:
- Control over critical digital systems
- Authority over data flowing through your territory
- Power to set cyber rules within your borders
- Ability to defend against digital attacks
When the doctrine calls this “shared sovereignty,” it inadvertently suggests that cyberspace operates as a cooperative domain governed by mutual agreement and shared norms. The evidence suggests otherwise. Cyberspace functions as an arena of continuous competition where state and non-state actors pursue strategic advantage through technological capability, information control, and infrastructure dominance.
Why This Matters
Using “shared sovereignty” language creates three real problems:
- International pressure. When India takes strong cyber actions, like requiring data to stay in India or blocking malicious websites, critics can point to India’s own doctrine. They’ll say: “But you called it shared sovereignty. Why are you acting unilaterally?”
- Domestic skepticism. If cyber sovereignty is “shared,” why should India spend billions building its own capabilities? Why not just rely on international cooperation and foreign technology?
- Operational confusion. Military and civilian cyber operators need clear authority to act decisively. “Shared sovereignty” makes everyone wonder: do we have the authority to do what’s necessary?
These problems are completely avoidable.
How Cyber Really Works
The operational reality of cyberspace demonstrates consistent patterns of competitive behavior rather than cooperative governance:
China has constructed comprehensive digital sovereignty infrastructure, from the Great Firewall to indigenous semiconductor programs, treating cyberspace as contested terrain requiring systematic national control.
The United States maintains rhetorical commitment to international cyber norms while consistently prioritising technological and operational superiority through programs that ensure American dominance in critical cyber domains.
Russia conducts persistent information operations and cyber campaigns that explicitly reject any notion of shared governance in favour of strategic advantage.
India itself has already begun implementing policies that reflect this competitive reality. The country’s data localisation requirements, CERT-In’s recent cybersecurity mandates for VPN providers and cloud services, and restrictions on Chinese technology applications all demonstrate an understanding that cyberspace requires assertive sovereign action rather than cooperative governance. India’s strategic approach already recognises cyberspace as contested territory. The doctrinal language simply needs to acknowledge what policy implementation already demonstrates.
The Simple Fix
Instead of “shared sovereignty,” the doctrine should say: “Cyberspace is where sovereignty is constantly contested and must be actively defended through indigenous capabilities.”
This small change would:
- Match words to reality about how cyber competition actually works
- Give clear guidance to those implementing the strategy
- Protect India’s flexibility in international negotiations
- Justify investments in domestic cyber capabilities
The Bottom Line
India’s cyber doctrine is already excellent. It understands the challenge, sets the right priorities, and charts a smart course forward. One word change would make it perfect. It would align the document’s language with its wisdom, ensuring that terminology serves rather than limits India’s strategic goals. In cyber, as everywhere else, clarity of purpose determines success. India deserves a doctrine that speaks as clearly as it thinks. The foundation is strong. The architecture is sound. Only one finishing touch remains.
Sovereignty is never shared, one either has it or doesn’t.