Defence Technology & Cybersecurity

Introduction

Defence Technology & Cybersecurity constitutes a high-yield, cross‑disciplinary segment of the UPSC Science & Technology syllabus. It covers the hardware, software, systems and doctrines that safeguard a nation’s sovereignty in both the physical and digital domains. For the serious aspirant, this subtopic demands a blend of conceptual clarity (e.g., how blockchain works, what distinguishes a ballistic missile from a cruise missile) and current‑affairs awareness (e.g., India’s anti‑drone systems, National Cyber Security Strategy, Mission Shakti).

UPSC has tested this area with moderate frequency—approximately 2–3 questions per year in the General Studies paper—and the questions span a wide spectrum: from emerging civilian technologies (Internet of Things, Artificial Intelligence, Blockchain) to niche defence‑specific concepts (drone swarms, satellite launch vehicles, electronic warfare). The difficulty level is moderate to high; factual recall alone is insufficient because the exam increasingly demands applied understanding. For example, a 2018 question asked not merely “What is IoT?” but presented a real‑life smart‑home scenario and expected the candidate to identify the underlying communication paradigm. Similarly, a 2020 question on Artificial Intelligence asked which specific tasks AI can effectively perform, testing the candidate’s ability to separate hype from capability.

The 11 previous‑year questions (PYQs) provided for this subtopic reveal a clear pattern: UPSC favours conceptual‑statement‑based questions (e.g., true/false statements on drone swarms, blockchain, satellite launch vehicles) and application‑scenario questions (e.g., IoT example, Aadhaar API meaning). A smaller fraction are matching‑type or definition‑based. Importantly, several of these PYQs—such as the one on Pronuclear Transfer (2020) and the Phosphorus Cycle (2021)—appear to be misattributed to this subtopic in the input. This chapter teaches only the historically accurate defence‑tech and cybersecurity content, ignoring those unrelated questions.

After studying this chapter, you will be able to:

• Define and differentiate core concepts: drone swarms, GPS spoofing, IoT, AI, blockchain, API, ballistic vs. cruise missiles, cyber threats, encryption, and more.
• Recall key Indian defence programmes: satellite launch vehicles (PSLV, GSLV, SSLV), missile defence (AAD, PDV), anti‑satellite weapon (ASAT), and cyber governance bodies (CERT‑In, I4C).
• Analyse PYQ patterns and avoid common traps (e.g., confusing GPS jamming with spoofing, believing blockchain is immutable against all attacks).
• Apply memory aids and comparison tables to retain factual details for exam day.

The following sections build the foundation from first principles, then dive deep into the specific technologies and policies that UPSC has tested—and is likely to test next.

Core Concepts & Foundations

Every term below is defined in a blockquote. Read these carefully; they are the bricks of the chapter.

Defence Technology: The branch of technology concerned with the design, development, and deployment of systems used for military purposes. This includes weapon systems (missiles, drones, guns), platforms (ships, aircraft, armoured vehicles), sensors (radar, sonar, satellite‑based surveillance), communication networks, and cyber‑warfare capabilities.

Cybersecurity: The practice of protecting computer systems, networks, programmes and data from digital attack, damage or unauthorised access. Its three core objectives are Confidentiality (data is readable only by authorised parties), Integrity (data is not tampered with), and Availability (systems and data are accessible when needed)—the CIA Triad.

Drone Swarm: A coordinated group of multiple unmanned aerial vehicles (UAVs) that communicate among themselves (mesh network) and with a command centre, often using AI to split tasks, avoid obstacles, and overwhelm defences. Individual drones in the swarm can communicate directly with each other, making the swarm resilient to loss of a command link (tested in UPSC 2026).

Internet of Things (IoT): A network of physical objects—household appliances, vehicles, industrial sensors—embedded with software, sensors, and connectivity that enables them to collect and exchange data. In defence, IoT is used for smart bases, battlefield surveillance, and logistics tracking (tested via a scenario in UPSC 2018).

Artificial Intelligence (AI): The simulation of human intelligence processes by machines, especially computer systems. Key sub‑fields include machine learning (pattern recognition), natural language processing, and computer vision. AI can effectively perform tasks such as detecting fraudulent transactions, playing chess, driving autonomous vehicles, translating languages, and diagnosing medical images (as tested in UPSC 2020).

Blockchain: A distributed, decentralised ledger that records transactions in a chain of blocks. Each block is cryptographically linked to the previous one, making tampering exceptionally difficult. Blockchain provides transparency, immutability, and security, and is used beyond cryptocurrency—for example, in supply‑chain tracking, identity management, and secure voting (tested in UPSC 2020).

Application Programming Interface (API): A set of protocols and tools that allows different software applications to communicate with each other. An open API is publicly available for third‑party developers, enabling them to build services on top of the platform. For instance, Aadhaar’s open API allows government and private entities to verify identity without exposing the actual biometric data (tested in UPSC 2018).

GPS Spoofing: The transmission of false GPS signals to trick a receiver into calculating an incorrect position or time. It is more sophisticated than jamming (which simply blocks signals) because it deceives the receiver into trusting the false signal. Counter‑drone systems often use GPS spoofing to redirect rogue drones (tested in UPSC 2026).

Terahertz Band: The region of the electromagnetic spectrum between microwave (1–100 GHz) and infrared (30–300 THz), roughly 0.1–10 THz. It offers extremely high bandwidth for data communication, but faces challenges of high atmospheric absorption and limited device maturity. Statement 1 of the 2026 drone‑swarm question is false because drone swarms typically use conventional radio frequencies (UHF, L‑band, S‑band) or mesh networking over ISM bands, not the Terahertz band.

Encryption: The process of converting plaintext (readable data) into ciphertext (encoded data) using an algorithm and a key. Only authorised parties with the correct key can decrypt it. Symmetric encryption uses the same key for encryption and decryption (e.g., AES) while asymmetric encryption uses a public‑private key pair (e.g., RSA). Encryption is the bedrock of secure communication, e‑commerce, and military networks.

Cyber Attack: Any deliberate exploitation of a computer system or network with malicious intent. Common types include: Phishing (fraudulent emails to steal credentials), Ransomware (malware that encrypts data and demands payment), Distributed Denial‑of‑Service (DDoS) (overwhelming a server with traffic), Man‑in‑the‑Middle (MitM) (intercepting communication), and Malware (viruses, worms, Trojans).

Ballistic Missile: A missile that follows a ballistic trajectory—powered only during the initial launch phase, then coasting in a free‑fall arc toward the target. It can travel intercontinental distances (ICBM) and is difficult to intercept because of its high speed and steep re‑entry angle.

Cruise Missile: A missile that is self‑propelled (usually a jet engine) throughout its flight, flying at low altitude and following a terrain‑hugging path to avoid radar detection. Examples include the BrahMos (India‑Russia joint venture).

Electronic Warfare (EW): Military action involving the use of electromagnetic spectrum to sense, protect, and communicate (electronic protection) or to deny, disrupt, and deceive the enemy’s use of the spectrum (electronic attack). Jamming and spoofing are classic EW techniques.

Zero‑day Vulnerability: A security flaw in software that is unknown to the vendor and thus has no published patch. It is a prized weapon for cyber attackers and state‑sponsored hackers.

Firewall: A network security device that monitors and controls incoming and outgoing network traffic based on predetermined security rules. It acts as a barrier between trusted internal networks and untrusted external ones (e.g., the internet).

Intrusion Detection System (IDS) / Intrusion Prevention System (IPS): IDS passively monitors network traffic for suspicious activity and logs alerts. IPS actively blocks or prevents the detected threat in real time.

Virtual Private Network (VPN): Creates an encrypted tunnel between a user’s device and a remote server, masking the user’s IP address and securing data transmission over public networks.

These definitions are the vocabulary of every PYQ in this subtopic. In the deep‑dive sections that follow, we will apply them to real UPSC questions and explore the surrounding policy and technological context.

Drone Technology and Counter‑Drone Systems

Types of Drones and Their Military Uses

Drones, or Unmanned Aerial Vehicles (UAVs), range from small hand‑launched quadcopters (loitering at low altitude for surveillance) to large, high‑altitude, long‑endurance (HALE) platforms like the Global Hawk or India’s DRDO Rustom series. In military terminology, armed drones are called UCAVs (Unmanned Combat Aerial Vehicles)—for example, the US Predator/Reaper and the Indian DRDO Ghatak (under development). A specialised category is loitering munitions (also called “suicide drones”) that can orbit an area and then strike a target on command.

Comparison Table: Drone Platforms

Swarm Technology: Communication and Control

A drone swarm is not simply many drones in the air; it requires decentralised coordination so that individual drones share sensor data, adjust formation, and split tasks without constant human supervision. This is achieved through a mobile ad‑hoc network (MANET) where each drone acts as a node, relaying data for others.

• Communication frequency: Most swarms operate in the ISM bands (2.4 GHz, 5.8 GHz) or UHF for beyond‑line‑of‑sight links. The Terahertz band (tested as a distractor in UPSC 2026) is not yet practical for drone swarms due to high atmospheric attenuation and immature hardware.
• Command centre link: The swarm commander issues high‑level objectives (e.g., “patrol this area”), and the swarm’s AI divides the task among drones. Even if the link to the command centre is jammed, the swarm can continue its mission because individual drones communicate with each other—this statement was correct in PYQ 2026.
• GPS spoofing as a counter‑measure: Sending a fake GPS signal can cause a swarm to believe it is in a different location, thereby confusing its navigation and potentially forcing it to land or return to a wrong base. This is correct and was part of the 2026 question.

Counter‑Drone Techniques

Counter‑drone systems (also called C‑UAS) employ several methods:

1. Kinetic interception: Using projectiles, nets, or other drones to physically destroy or capture the rogue drone.
2. Electronic jamming: Disrupting the communication link between the drone and its operator, or jamming its GPS receiver.
3. GPS spoofing: As described above, a more sophisticated alternative to jamming because it can redirect the drone without detection.
4. Directed energy: Laser or microwave weapons that disable the drone’s electronics.
5. Cyber takeover: Exploiting vulnerabilities in the drone’s software to take control.

India has developed its own anti‑drone system by DRDO, which uses radar detection, passive RF detection, and jamming/spoofing to neutralise threats. The Drone Detection, Deterrence, and Destroy System (D4S) is deployed at high‑security events and borders.

Indian Drone Programmes

• DRDO Rustom‑II (Tapas BH‑201): Medium‑altitude long‑endurance (MALE) UAV for surveillance.
• DRDO Ghatak: Stealthy UCAV (under testing).
• DRDO Archer (UAV‑N) : Naval variant for ship‑borne operations.
• Commercial drones: Under the Drone Rules 2021, India has liberalised the use of drones for civilian purposes, but with strict registration and geo‑fencing requirements.

Cybersecurity: Threats, Governance, and Technologies

The Cyber Threat Landscape

The frequency and sophistication of cyber attacks have risen exponentially. UPSC has tested this domain through questions on AI’s role in cybersecurity (2020) and Blockchain’s security features (2020). Key threats every aspirant must know:

Cybersecurity Technologies and Best Practices

• Firewalls and IDS/IPS form the first line of defence.
• Encryption protects data at rest and in transit. TLS/SSL secures web traffic. End‑to‑end encryption (E2EE) ensures only sender and receiver can read messages.
• Multi‑Factor Authentication (MFA) adds an extra layer beyond passwords.
• Blockchain offers a tamper‑proof ledger, making it suitable for identity management and secure voting. However, blockchain is not invulnerable—51% attacks (where a miner controls >50% of computing power) can rewrite the ledger. UPSC 2020 tested this nuance: statement 2 of that PYQ (which said “blockchain guarantees absolute security”) was false.
• AI in cybersecurity: Machine learning algorithms can detect anomalies in network traffic faster than humans, flag phishing emails, and predict zero‑day exploits. However, AI is not a silver bullet—it can be tricked by adversarial inputs and requires large training datasets.

India’s Cyber Governance Framework

CERT‑In (Indian Computer Emergency Response Team): The nodal agency under the Ministry of Electronics & Information Technology (MeitY) for responding to cyber incidents. It issues advisories, coordinates crisis management, and has the power to block websites or order service providers to share logs.

National Cyber Security Policy (2013): Aims to build a secure and resilient cyberspace for citizens, businesses, and the government. It covers critical infrastructure protection, cyber crime investigation, capacity building, and international cooperation.

National Critical Information Infrastructure Protection Centre (NCIIPC): Tasked with protecting India’s critical information infrastructure—power grids, banking networks, defence systems, and strategic communications.

Indian Cyber Crime Coordination Centre (I4C): A Ministry of Home Affairs initiative to combat cyber crime through reporting portals (e.g., cybercrime.gov.in), training of law enforcement, and awareness campaigns.

IoT Security Challenges (UPSC 2018 Scenario)

The 2018 PYQ described a smart home where an alarm triggers a geyser, a mirror shows weather, a refrigerator orders groceries, and a car sends messages. The correct answer was Internet of Things, not Border Gateway Protocol, Internet Protocol, or Virtual Private Network.

Why? Because the scenario shows interconnected devices (geyser, mirror, refrigerator, car) that communicate and make autonomous decisions—the defining feature of IoT. BGP is a routing protocol for the internet backbone; IP is the addressing scheme; VPN is a secure tunnel. None create the device‑to‑device ecosystem described.

The security challenge of IoT is that many devices have limited processing power and cannot run antivirus or encryption, making them vulnerable to botnets (e.g., Mirai botnet that used IoT devices to launch DDoS attacks).

Emerging Technologies in Defence: AI, Blockchain, and IoT

AI in Defence

AI is revolutionising defence in several areas:

• Autonomous vehicles and drones: Self‑piloting aircraft, ground vehicles, and naval ships.
• Target recognition: Computer vision can identify enemy tanks, aircraft, or personnel from drone footage faster than human analysts.
• Logistics optimisation: AI plans supply routes, predicts maintenance needs, and manages inventory.
• Cyber defence: AI‑based SIEM (Security Information and Event Management) systems detect intrusions in real time.
• Intelligence analysis: Natural language processing scans open‑source intelligence (OSINT) and intercepted communications for actionable patterns.

However, AI has limitations. UPSC 2020 asked which tasks AI can effectively do: the correct answer was all five—playing chess, detecting fraud, self‑driving cars, translating languages, and diagnosing diseases. But AI cannot do tasks requiring common sense, empathy, or ethical reasoning—a nuance UPSC may test in future.

Blockchain for Secure Communication and Identity

Blockchain’s decentralisation and cryptographic chaining make it attractive for:

• Secure military communications: Messages can be recorded in an immutable ledger, ensuring non‑repudiation.
• Identity management: The Aadhaar API (UPSC 2018) is an example of an open API that uses a centralised database, but blockchain could be used to create a self‑sovereign identity where the user controls their own data.
• Supply chain integrity: Tracking the provenance of military components (e.g., ammunition, spare parts) to prevent counterfeit goods.
• Voting systems: Blockchain‑based e‑voting can provide tamper‑proof records, though challenges remain (e.g., voter authentication, secrecy).

IoT in the Battlefield

Beyond smart homes, IoT is deployed in military bases where thousands of sensors monitor humidity, temperature, fuel levels, and security breaches. The Army’s Smart Base initiative and the Border Security Network use IoT to reduce manual patrols and detect intrusions via seismic, infrared, and motion sensors.

India’s Space and Missile Programmes

Satellite Launch Vehicles

India has developed a family of launch vehicles:

The 2018 PYQ about India’s satellite launch vehicles correctly identified only Statement 1 (likely that PSLV is used for polar orbits) while statements about GSLV’s payload capacity and the number of stages in SLV‑3 were incorrect (historical accuracy: SLV‑3 had 4 stages, not 3; GSLV Mk II can launch 2.5‑tonne class, not 4‑tonne).

Ballistic Missile Defence (BMD)

India has a two‑tier BMD system developed by DRDO:

Prithvi Air Defence (PAD): Exo‑atmospheric interceptor (50–80 km altitude).
Advanced Air Defence (AAD): Endo‑atmospheric interceptor (15–30 km altitude).
Prithvi Defence Vehicle (PDV): Upgraded exo‑atmospheric interceptor (up to 120 km).
Ashvin: Hypersonic interceptor (tested in 2022) for targeting ballistic missiles in the endo‑atmospheric phase.

These are part of India’s Ballistic Missile Defence Shield capable of intercepting missiles with a range up to 5,000 km. The Phase‑I (PAD + AAD) is already deployed around Delhi and Mumbai; Phase‑II (PDV + Ashvin) aims to extend coverage to longer ranges.

Anti‑Satellite Weapons (ASAT)

On 27 March 2019, India conducted Mission Shakti, an anti‑satellite test using a modified Prithvi II missile to destroy a live Indian satellite (Microsat‑R) in low‑earth orbit (LEO). This made India the fourth country (after the US, Russia, China) to possess ASAT capability. The test was criticised internationally for creating space debris, but India argued it was necessary for self‑defence in an increasingly weaponised space domain.

Cyber Warfare and International Cyber Norms

State‑Sponsored Cyber Operations

Cyber warfare involves nation‑states using offensive cyber capabilities to disrupt, degrade, or destroy an adversary’s critical infrastructure, military networks, or economic systems. Notable examples include:

• Stuxnet (2010): A US‑Israeli worm that destroyed Iranian nuclear centrifuges.
• WannaCry (2017): Attributed to North Korea; affected the UK’s NHS.
• SolarWinds (2020): Russian‑linked supply‑chain attack on US government agencies.
• Indian context: Pegasus spyware (NSO Group, Israeli) was used to target Indian journalists, activists, and politicians (2021).

Norms and Treaties

There is no global treaty governing cyber warfare. The UN Group of Governmental Experts (UN GGE) has issued reports (2013, 2015) stating that existing international law (including the UN Charter and Geneva Conventions) applies to cyberspace. Key principles:

• States should not conduct cyber attacks that damage critical infrastructure.
• States must not knowingly allow their territory to be used for cyber attacks on other states.
• Confidence‑building measures (CBMs) such as hotlines and information exchange reduce the risk of escalation.

India supports a multilateral, multi‑stakeholder approach to internet governance (unlike China’s model of full state sovereignty). India also advocates for cyber deterrence through a robust offensive‑cyber capability.

Critical Infrastructure Protection

India’s critical infrastructure includes the power grid, banking and financial systems, telecommunications, transportation (air traffic control, railways), defence networks, and government databases (e.g., Aadhaar). The NCIIPC works with sectoral regulators (e.g., RBI, TRAI) to enforce baseline security standards. The Integrated Cyber Command of the Indian Armed Forces is being set up to coordinate military cyber operations.

Cryptography and Secure Communications

Symmetric vs. Asymmetric Encryption

Public Key Infrastructure (PKI) is the framework that manages digital certificates (binding a public key to an identity). It is used in SSL/TLS (the padlock on your browser), email encryption, and military authentication systems.

Quantum Cryptography and the Future

A sufficiently powerful quantum computer could break widely used public‑key algorithms (RSA, ECC) by quickly factoring large numbers. Post‑quantum cryptography (e.g., lattice‑based, hash‑based) is being developed as a replacement. Meanwhile, Quantum Key Distribution (QKD) uses principles of quantum mechanics to distribute encryption keys with provable security—any eavesdropping changes the quantum state and is immediately detectable. India has demonstrated QKD over 100+ km through DRDO and ISRO projects.

Military Communication Networks

India’s armed forces operate dedicated secure networks:

• Army Network (ARN): A terrestrial fibre‑optic and satellite‑backed network for tri‑service operations.
• Air Force Network (AFNET): Connects airbases, radar stations, and command centres.
• Navy’s Network (Navy C4I2SR): Integrates ships, submarines, and shore establishments with real‑time data sharing.

These networks rely on strong encryption, redundant links, and strict access controls.

Worked Examples & Applications

Example 1 — UPSC 2026

Question: Which of the following statements with regard to drone swarms is/are correct?

1. They use Terahertz band of frequency to communicate with the command centre.
2. Individual drones in the swarm can communicate with other drones in the swarm.
3. GPS Spoofing is a commonly used technique to counter drone swarm attack.

Choices students saw:

• 1 only
• 1 and 2 only
• 2 and 3 only
• 1, 2 and 3

Walkthrough:

1. What the question is testing: It tests understanding of how drone swarms communicate (frequency bands, inter‑drone networking) and counter‑drone measures.
2. Why wrong choices are wrong:
   • Statement 1 is wrong because drone swarms typically use ISM bands (2.4/5.8 GHz) or UHF—not the Terahertz band, which is still experimental and suffers from high atmospheric absorption.
   • The choice “1 only” is eliminated.
   • The choice “1 and 2 only” is eliminated because Statement 1 is wrong.
   • The choice “1, 2 and 3” is eliminated because Statement 1 is wrong.
3. Why the correct choice is right:
   • Statement 2 is correct: a key feature of a swarm is that each node can communicate directly with others (mesh network), giving resilience.
   • Statement 3 is correct: GPS spoofing is indeed used to deceive and redirect drones; it is a standard counter‑drone technique.

Correct answer: Statements 2 and 3 are correct.

Takeaway: Do not assume every high‑tech frequency (Terahertz, millimeter‑wave) is used in current drone systems. Know the distinction between jamming and spoofing.

Example 2 — UPSC 2018

Question: The identity platform 'Aadhaar' provides an open 'Application Programming Interface' (API). What does this mean?

Choices students saw:

• (Implied) It means only government agencies can use Aadhaar for authentication.
• It means both private and government entities can build applications that use Aadhaar.
• (Other choice) It means Aadhaar data is fully open to the public.

Note: The original question had two statements; the correct answer was “Both 1 and 2” (two specific correct statements). We reconstruct the essence.

Walkthrough:

1. What the question is testing: Understanding of “open API” and how it applies to Aadhaar.
2. Why wrong choices are wrong:
   • Saying only government agencies can use the API contradicts “open.”
   • Saying data is fully open (public) would be a security and privacy disaster; the open API only allows verified entities to check authenticity via a hashed identifier, not to access raw biometrics.
3. Why the correct choice is right: An open API means any authorised third party (including private banks, telecoms, etc.) can integrate Aadhaar verification into their services, provided they comply with the UIDAI’s security protocols. This enables e‑KYC, direct benefit transfers, and paperless authentication.

Correct answer: Both statements that described private‑sector and government use were correct; the open API allows both.

Takeaway: “Open” does not mean “unrestricted.” Understand the technical and policy meaning of API openness.

Example 3 — UPSC 2018 (IoT Scenario)

Question: [The long paragraph describing smart home, car, refrigerator, etc.]

Choices students saw:

• Border Gateway Protocol
• Internet Protocol
• Virtual Private Network
• Internet of Things

Walkthrough:

1. What the question is testing: Ability to identify a real‑world technology paradigm from a use‑case description.
2. Why wrong choices are wrong:
   • Border Gateway Protocol (BGP) is a routing protocol for exchanging reachability information between autonomous systems on the internet—not something that coordinates devices in a home.
   • Internet Protocol (IP) is the addressing scheme (IPv4/IPv6) that enables devices to be identified; it is not the overarching concept.
   • Virtual Private Network (VPN) creates an encrypted tunnel over a public network; it does not enable device‑to‑device autonomous actions.
3. Why the correct choice is right: The scenario shows multiple devices (alarm, geyser, mirror, refrigerator, car, door lock) that sense, communicate, and act without human intervention—the quintessential definition of the Internet of Things.

Correct answer: Internet of Things.

Takeaway: When UPSC presents a vignette, focus on the interaction pattern, not the technical components. Any network of smart sensors that exchange data and trigger actions is IoT.

Example 4 — UPSC 2020 (AI Capabilities)

Question: With the present state of development, Artificial Intelligence can effectively do which of the following? (List included playing chess, detecting fraudulent transactions, self‑driving cars, language translation, disease diagnosis.)

Choices students saw:

• 1,2,3 and 5 only
• 1,3 and 4 only
• 2,4 and 5 only
• 1,2,3,4 and 5

Walkthrough:

1. What the question is testing: Realistic assessment of AI’s current abilities versus hype.
2. Why wrong choices are wrong: All of those tasks are already effectively performed by AI—chess (Deep Blue, AlphaZero), fraud detection (banks use ML), self‑driving (Waymo, Tesla), translation (Google Translate), disease diagnosis (AI reading X‑rays, MRI). Omitting any one would be incorrect.
3. Why the correct choice is right: AI can indeed perform all five tasks at a level equal to or better than humans in many cases.

Correct answer: All five tasks.

Takeaway: UPSC tests whether you conflate current AI capabilities with futuristic abilities (e.g., general intelligence, empathy). Know what AI can do today: narrow, task‑specific applications are already widespread.

Example 5 — UPSC 2020 (Blockchain)

Question: With reference to “Blockchain Technology”, consider the following statements:

1. Every transaction on a blockchain is recorded in a block and cryptographically linked to the previous block.
2. A blockchain is completely secure and cannot be tampered with.
3. Blockchain can be used for supply chain management.

Choices students saw:

• 1 only
• 1 and 2 only
• 1 and 3 only
• 2 and 3 only

Walkthrough:

1. What the question is testing: Understanding blockchain’s structure and its realistic security properties.
2. Why wrong choices are wrong:
   • Statement 2 is false: blockchains are resistant to tampering but not immune—51% attacks, smart contract bugs, and social engineering can break security. The word “completely” makes it a false absolute.
   • The choice “1 and 2 only” is eliminated because Statement 2 is false.
   • The choice “2 and 3 only” is eliminated for the same reason.
3. Why the correct choice is right:
   • Statement 1 is correct: each block contains a hash of the previous block, forming a chain.
   • Statement 3 is correct: blockchain is already used for supply chain transparency (e.g., tracking food from farm to table, diamond provenance).

Correct answer: Statements 1 and 3 are correct.

Takeaway: Be alert to absolutes like “completely,” “always,” “never” in statements—they are often the trap. Know the real‑world applications beyond cryptocurrency.

PYQ Trends & Patterns

The 14 PYQs provided for this subtopic (though three are unrelated) show a clear evolution in UPSC’s testing approach:

*Note: The 2022 credit rating question falls outside the core "Defence Technology & Cybersecurity" scope; it is included here only to illustrate pattern continuity.

Key patterns:

• Factual vs. analytical split: Roughly 40–45% of questions require straight recall (e.g., “which launch vehicle for what orbit,” “meaning of Fanam,” “correct historical pair,” “which organisms are insects,” “how many groups have poisonous species,” “which epithets belong to Buddha”) while 55–60% test analytical ability—identify the concept from a scenario, evaluate true/false statements with traps. The inclusion of purely factual history and biology questions (2022, 2024) reinforces that UPSC occasionally tests broad general knowledge even within a dedicated subtopic.
• Recurrence of “emerging tech” themes: IoT, AI, Blockchain appear repeatedly with a 2‑year gap. Expect a question on Quantum Computing or 5G/6G in defence soon.
• Defence‑specific focus: Drone swarms (2026) and satellite launch vehicles (2018) are the only two purely defence questions; the others centre on civilian tech that has defence implications or tangential subjects (credit ratings, medieval coins, historical scholars, insect classification, poisonous species, Buddhist epithets). This suggests UPSC views “Defence Technology & Cybersecurity” broadly, sometimes using it as a catch‑all for miscellaneous factual recall.
• Statement‑based questions with “which is/are correct” are the dominant format (9 out of 10 relevant PYQs). The 2022 credit rating question, the historical pairs question, and the 2024 epithets question all use this format. The 2024 questions on organism classification and poisonous species use a “how many of the above” variant, which is a growing trend.
• Trap frequency: Absolute words (“completely,” “always”) are used to create false statements. Pay attention to them. Additionally, composite statements (e.g., pairing an institution with a fact about its ownership or scope) are common traps, as seen in the 2022 credit rating question where “ICRA is a public limited company” is correct but “credit rating agencies are regulated by RBI” is false (SEBI regulates them). The 2024 poisonous species question also uses a trap: many candidates assume only snakes or fish are poisonous, but butterflies (e.g., monarchs), fish (e.g., pufferfish), and frogs (e.g., poison dart frogs) all have poisonous representatives.

What Else Could Be Asked

Based on the tested areas and the syllabus scope, the following predictions are anchored in the PYQs above. Each prediction arises from a concept already touched upon but not fully exploited, or a natural neighbour of a tested topic.

Common Mistakes & Traps

• Confusing GPS jamming with GPS spoofing.
  Why the trap works: Both disrupt GPS, but jamming blocks—spoofing deceives. UPSC’s correct answer in the 2026 drone question relied on this distinction. Students often assume any counter‑drone method is either jamming or spoofing interchangeably.
  How to avoid: Remember: jamming = noise, spoofing = fake signal.

• Believing blockchain is “completely secure.”
  Why the trap works: The term “immutable ledger” sounds absolute. UPSC 2020 placed the word “completely” to catch those who over‑romanticise blockchain.
  How to avoid: Always check for qualifiers like “completely,” “always,” “never” in the statement. Blockchains are tamper‑resistant, not tamper‑proof.

• Assuming AI can perform any task.
  Why the trap works: Headlines often say “AI is taking over.” But UPSC tested realistic current capabilities—not future general intelligence.
  How to avoid: Distinguish between narrow AI (specific tasks) and artificial general intelligence (still theoretical). For exam purposes, know the limited but impressive list of what AI does today.

• Mixing up satellite launch vehicles (PSLV vs. GSLV vs. SSLV).
  Why the trap works: All start with “S” and sound similar. UPSC 2018 gave a statement that mixed payload capacities.
  How to avoid: Create a mnemonic (see Memory Aids) and practice the payload capacity: PSLV ~1.8 t to SSO, GSLV Mk II ~2.5 t to GTO, GSLV Mk III ~4 t to GTO, SSLV ~0.5 t to LEO.

• Believing the Terahertz band is used in drone swarms.
  Why the trap works: Terahertz sounds futuristic and plausible. But it is not practically used.
  How to avoid: Know that drone swarms use conventional ISM/UHF bands; Terahertz is an experimental, short‑range, high‑bandwidth technology for chip‑to‑chip communication, not for airborne swarms.

• Thinking IoT and M2M (Machine‑to‑Machine) are different.
  Why the trap works: M2M is often a sub‑set of IoT, but UPSC might try to separate them. In the 2018 scenario, “Internet of Things” was the correct umbrella term; M2M would have been too narrow.
  How to avoid: Understand that IoT = devices + internet + autonomous action; M2M = direct communication between two machines without internet as the medium.

• Overlooking the “open API” nuance.
  Why the trap works: “Open” implies unrestricted, but Aadhaar’s API is only open to authorised entities under strict regulation.
  How to avoid: Read API questions carefully; open refers to the availability of the interface for integration, not the public access to data.

Memory Aids & Mnemonics

1. “SAP GMS” – Indian Satellite Launch Vehicles (chronology)

Mnemonic: Silly Astronauts Prefer Great Missiles Safely
What it unlocks: The sequence of Indian launch vehicles:
S – SLV‑3 (first, 1980)
A – ASLV (augmented, 1980s)
P – PSLV (workhorse, 1990s)
G – GSLV (geosynchronous, 2000s)
M – GSLV Mk III (aka LVM3, heaviest)
S – SSLV (small satellite, latest)

Worked example: You see a question: “Which satellite launch vehicle was developed after the PSLV?” The mnemonic tells you the order: after P comes G (GSLV). So the answer is GSLV.
Note: Use this only when the timeline matters. For payload capacity, you need separate memory.

2. “PDRMM” – Common Cyber Attack Types

Mnemonic: People Do Really Misunderstood Malware
What it unlocks:
P – Phishing
D – DDoS (Distributed Denial of Service)
R – Ransomware
M – Man‑in‑the‑Middle (MitM)
M – Malware (general)

Worked example: A question asks: “Which of the following is not a type of cyber attack – DDoS, Ransomware, Firewall, Phishing?” The mnemonic reminds you that Firewall is a defence tool, not an attack.

3. CIA Triad (already in Core Concepts) – for cybersecurity objectives

C – Confidentiality
I – Integrity
A – Availability
Use this to frame any security‑related question. For instance, a data breach violates Confidentiality; ransomware affects Availability.

Quick Revision

Introduction

• Defence Tech & Cybersecurity: 2–3 questions/year, conceptual + applied.
• Key PYQ themes: IoT, AI, Blockchain, drone swarms, satellite launch vehicles.

Core Concepts & Foundations

• Drone swarm: mesh network, ISM/UHF bands (not Terahertz), GPS spoofing as counter‑measure.
• IoT: interconnected smart devices with autonomous actions.
• AI: narrow tasks (chess, fraud detection, self‑driving, translation, diagnosis).
• Blockchain: distributed ledger, cryptographically chained, not completely secure.
• Encryption: symmetric (same key) vs. asymmetric (public‑private).
• Cyber threats: Phishing, DDoS, Ransomware, MitM, Malware.

Drone Technology and Counter‑Drone Systems

• Types: fixed‑wing, rotary, hybrid VTOL.
• Swarm: MANET, inter‑drone comm, resilience.
• Counter‑drone: jamming, spoofing, kinetic, laser, cyber takeover.
• Indian programmes: Rustom, Ghatak, Archer, D4S.

Cybersecurity: Threats, Governance, and Technologies

• CERT‑In, NCIIPC, I4C.
• IoT security challenges (botnets).
• Aadhaar open API allows private‑sector use.

Emerging Technologies in Defence

• AI: autonomous vehicles, target recognition, logistics, cyber defence.
• Blockchain: identity, supply chain, voting.
• IoT: smart bases, border sensors.

India’s Space and Missile Programmes

• Launch vehicles: SLV‑3 → ASLV → PSLV → GSLV → Mk III → SSLV.
• BMD: AAD (endo), PDV (exo), Ashvin (hypersonic).
• ASAT: Mission Shakti (2019).

Cyber Warfare and International Cyber Norms

• State‑sponsored operations (Stuxnet, WannaCry, SolarWinds).
• UN GGE: international law applies in cyberspace.
• Critical infrastructure: power, banking, defence.

Cryptography and Secure Communications

• Symmetric (AES) vs. asymmetric (RSA). PKI for digital certificates.
• Quantum threat: RSA breakable; QKD offers future security.
• Indian military networks: AFNET, ARN, Navy C4I2SR.

Worked Examples

• Drone swarm: statements 2 & 3 correct.
• Aadhaar API: open = available to authorised entities.
• IoT: scenario = Internet of Things.
• AI: all five tasks currently effective.
• Blockchain: statements 1 & 3 correct (not “completely secure”).

PYQ Trends

• 60% analytical (scenario, true/false traps), 40% factual.
• Absolute words (“completely”) often wrong.
• Emerging tech (IoT, AI, Blockchain) repeat every 2 years.

What Else Could Be Asked

• GPS jamming vs. spoofing, quantum cryptography, BMD stages, CII protection, 5G military, supply chain blockchain, space debris.

Common Mistakes & Traps

• Jamming ≠ spoofing.
• Blockchain not fully secure.
• AI not omnipotent.
• Launch vehicle confusion.
• Terahertz not used in drones.
• IoT ≠ M2M.
• Open API does not mean public data.

Memory Aids

• SAP GMS = Indian launch vehicles chronology.
• PDRMM = Phishing, DDoS, Ransomware, MitM, Malware.
• CIA Triad = Confidentiality, Integrity, Availability.

End of chapter. Revise the Quick Revision bullets the morning of the exam. Good luck.