Doctrine, Strategy and the Way Forward in Internal Security

This closing section does three things: it sets out what an internal security doctrine should contain and measures India against it; it examines the capability base — industrial and technological — on which any doctrine must rest; and it consolidates the reform agenda that has accumulated across the preceding sections into a single prioritised list.

Elements of an Internal Security Doctrine

A doctrine is not a plan and not a wish list. It states what the state is securing, against whom, by which instrument, and in what order of priority. The classical formulation for India identifies eight elements, and they remain the best organising frame available for a Mains answer.

Element	What the doctrine requires
1. Political	Establish the nature of the challenge before responding to it — secessionist, separatist, or regional. Analyse causative factors and determine whether the demands lie within the constitutional framework. The prescribed calibration: secessionist movements to be met firmly with stringent law; separatist elements kept at a distance; and regional aspirations and ethnic demands met with a reasonably softer and sympathetic approach. Misclassification at this stage guarantees the wrong response.
2. Socio‑economic	Where movements arise from genuine grievance — acute poverty, unemployment, displacement — the approach must differ from that used against ideological or externally sponsored violence. Equitable growth is the spirit of the Constitution; development must reach all sections without regional disparity.
3. Governance	Anti‑establishment elements exploit mismanagement, corruption in government schemes, poor implementation of law and the absence of state machinery in remote areas. Governance failure is not a background condition; it is the adversary’s principal recruiting instrument.
4. Police and security forces	Allegations of police atrocities and indifference aggravate internal security problems, and agitations are frequently directed at the forces themselves. Police must be sensitised and reformed to be seen as neutral, transparent and professional; central forces must understand local conditions and coordinate with the State police.
5. Centre–State coordination	Coordination failures run from intelligence to operations. An institutional framework is required to resolve them and ensure synergy at all levels.
6. Intelligence	Both defensive and offensive intelligence, to forewarn, neutralise impending threats and act proactively — with a standing institutional framework to compile, collate and act upon intelligence from multiple agencies.
7. Border management	Effective guarding of land borders against infiltration, illegal immigration, and smuggling of weapons and drugs, and coastal security with clearly defined roles for the Navy, the Coast Guard and the coastal police, working in harmony.
8. Cyber security	Cyberspace as the theatre of twenty‑first‑century conflict, requiring doctrine of its own rather than treatment as a technical annexe.

Measuring India against the frame

The most important development in this area occurred in February 2026, when the Ministry of Home Affairs published a National Counter‑Terrorism Policy and Strategy, designated “PRAHAAR”. It is the first publicly available national‑level strategy document in the internal security domain. Mapping its seven pillars against the eight classical elements is instructive, and is an argument worth studying:

Classical element	Covered by the 2026 strategy?	How
Intelligence	Yes — centrally	The strategy describes India’s approach as expressly “intelligence‑guided”, routed through the MAC and the Joint Task Force on Intelligence.
Border management	Yes	Threats identified on “all three fronts — water, land and air”, with border guarding forces and immigration authorities equipped accordingly.
Cyber security	Yes	Countering misuse of the internet for recruitment, propaganda and financing; encryption, dark web and crypto‑wallet anonymity named as threat vectors.
Police and security forces	Yes	Local police as first responder; NSG as nodal counter‑terror force; a stated move toward uniform anti‑terrorism structures across the States.
Centre–State coordination	Partly	“Aggregating internal capacities” through a whole‑of‑government approach, and MAC partnerships with State police — but no new institutional machinery.
Socio‑economic	Partly	“Attenuating the conditions enabling terrorism, including radicalisation” — poverty and unemployment addressed through existing schemes.
Governance	Weakly	Implicit in the attenuation pillar; not addressed as a distinct requirement.
Political	No	The strategy is confined to terrorism and does not address the classification question — secessionist, separatist or regional — that the political element requires.

WHAT THE PUBLISHED STRATEGY ADDS — AND WHAT IS STILL MISSING Three elements appear in the 2026 strategy that the classical eight‑element doctrine did not contain, and their inclusion is a genuine advance: Human rights and rule‑of‑law based processes as an express pillar of counter‑terrorism, rather than as a constraint upon it. Aligning and shaping international efforts — treaties, mutual legal assistance, extradition and UN designation as instruments of counter‑terrorism. Recovery and resilience through a whole‑of‑society approach — reconstruction, psychological support, community reintegration after an attack. This is the element most consistently absent from Indian security thinking and its appearance is significant. What neither document supplies, and what a National Security Strategy would: Prioritisation. No ranking of threats against one another. If everything is a security concern and resources are finite, some sequencing rule is required, and none exists. Resource allocation. No assignment of budget or capability to stated objectives, so the strategy cannot be used to arbitrate between competing claims. Cross‑domain coverage. A counter‑terrorism strategy addresses one threat category. It does not speak to insurgency, communal violence, organised crime, or grey‑zone competition. Measurable objectives and review. No stated benchmarks, no review cycle, no mechanism by which failure would become visible. The formulation to write: India has moved from having no published security doctrine at all to having a domain‑specific one. The gap has narrowed and has not closed — and the remaining gap is political rather than intellectual, because the substantive content, as the mapping above shows, has been available for decades.

Indigenisation and the Security‑Industrial Base

Why this belongs in an internal security paper. Import dependence is itself a strategic vulnerability. A supplier can withhold spares at the moment of crisis, decline resupply for political reasons, embed vulnerabilities at the component level, or simply be inaccessible when a conflict closes shipping lanes. Capability that cannot be sustained domestically is capability held on somebody else’s terms.

The instruments

• Defence Acquisition Procedure (DAP), 2020 — the procurement framework, with preference structures favouring domestic manufacture.
• Positive Indigenisation Lists, from 2020 — items barred from import after specified dates, creating an assured domestic market.
• Innovations for Defence Excellence (iDEX) — engagement of startups and MSMEs, with an outlay of ₹498.78 crore for 2021–22 to 2025–26, and the ADITI scheme (Acing Development of Innovative Technologies with iDEX) at ₹750 crore for 2023–24 to 2025–26. By March 2026, iDEX had engaged 676 startups, MSMEs and innovators and signed 551 design and development contracts.
• Defence Industrial Corridors in Uttar Pradesh and Tamil Nadu.
• The SRIJAN portal for indigenisation of imported items, and Atmanirbhar Bharat in defence as the overarching frame.

The record

Indicator	Baseline	Position in FY 2025–26
Indigenous defence production	₹46,429 crore (2014–15); ₹84,643 crore (2020–21)	₹1.78 lakh crore — a rise of about 15.6 per cent over the previous year’s ₹1,54,071 crore, and about 110 per cent since 2020–21.
Defence exports	₹686 crore (2013–14)	₹38,424 crore — an all‑time high, with exports to over 80 countries.
Composition of production	—	Defence PSUs and other public undertakings about 76 per cent; private sector about 24 per cent.

ASSESS IT HONESTLY — BOTH HALVES The achievement is real. Production has multiplied several times over in a decade and the export trajectory in particular represents a genuine structural change: a country that imported almost everything now supplies defence equipment to more than eighty others. Anyone who dismisses this is not being critical but merely contrarian. Three qualifications belong in a balanced answer: The ecosystem remains PSU‑dominated. A private sector share of about 24 per cent means the competitive dynamics that drive innovation elsewhere are still largely absent. Indigenisation by value is not indigenisation by criticality. A platform may be assembled in India and counted wholly as domestic production while its engines, sensors, semiconductors and advanced materials are imported. The dependency that matters in a crisis is dependency on the critical subsystem, not on the airframe. This is the single most important qualification to make. The internal security forces have benefited least. CAPF procurement is repeatedly identified as suffering from bottlenecks in the procurement process, and State police modernisation procurement is weaker still. The indigenisation success story is a defence story; it has not yet reached the forces that actually conduct internal security operations.

Emerging Domains

(a) Counter‑Unmanned Aerial Systems

The threat profile. Commercially available drones have collapsed the capability gap between a state and a small hostile network. The identified uses are: cross‑border smuggling of narcotics, arms and counterfeit currency, particularly on the India–Pakistan frontier; targeted attacks on critical infrastructure and public gatherings; espionage and reconnaissance over sensitive installations; disruption of civil aviation near airports; and psychological effect on civilians and security personnel in conflict zones. The published counter‑terrorism strategy of 2026 names the misuse of drones and robotics for lethal purposes as a continuing area of concern, and notes that handlers across the border frequently use drones to facilitate terror‑related activity in Punjab and Jammu and Kashmir.

India’s response has developed along three tracks:

Track	Content
Detection and neutralisation	The DRDO D4 system — Drone Detection, Deterrence and Destruction — capable of detecting, jamming and destroying drones within a radius of about 4 km. Very Short Range Air Defence (VSHORAD) systems, including indigenous shoulder‑fired interceptors, with SAMAR‑1, Igla‑S and SPYDER among the systems in service.
Regulation	The National Counter Rogue Drone Guidelines (2019) and the National Counter Rogue Drone Technology Policy, providing a framework for detection, identification and neutralisation of unauthorised drones; the Drone Rules, 2021, with airspace maps; and registration of drones with Unique Identification Numbers.
Supply‑chain security	The Framework for Testing Security Vulnerabilities in Drones — the significant recent development, examined below.

THE DRONE SECURITY FRAMEWORK — SUPPLY CHAIN AS A SECURITY PROBLEM The Ministry of Defence framework mandates twenty tests before a drone enters service, covering both hardware‑level validation — integrated circuit testing, tamper resistance, secure boot verification, printed circuit board testing and micro‑controller testing — and software vulnerability and penetration testing, including software update tests, cryptographic key and certificate tests, operating system testing, trusted execution environment protection, data‑in‑transit security and anti‑rollback tests. It identifies eight critical components: the electronic speed controller, the flight controller, the flight control firmware, the transmission and reception unit, the inertial navigation system and GPS, the sensors unit, the ground data terminal, and the ground control station software. And it identifies the avenues of compromise: interception of the link between drone and ground control station; GPS jamming and spoofing; control hijacking through firmware vulnerabilities or a compromised link; data exfiltration or manipulation during surveillance; exploitation of data pathways created by internet‑connected devices; and malicious capability introduced through firmware updates. Testing is to be conducted by NABL‑accredited or internationally recognised laboratories within India, and the framework insists on “secure by design” — security built in at the design and manufacturing stage rather than added afterwards. Why this matters far beyond drones. The concern here is not only that an adversary may fly a drone at you — it is that the drone you bought may already be compromised at the component level. That is a supply‑chain security problem, and it is the clearest illustration in this chapter of why indigenisation is a security question and not merely an economic one. The same logic applies to telecommunications equipment, surveillance systems, networked infrastructure and police communications. Treating procured equipment as trustworthy because it was procured is the assumption this framework abandons — and it should be abandoned everywhere, not only for drones.

(b) Quantum technology and national security

The threat is present, not future. Quantum computers can in principle break the public‑key encryption on which secure communication currently rests — RSA and Elliptic Curve Cryptography. The operational danger is therefore not the arrival of a working quantum computer at some future date, but the practice known as “Harvest Now, Decrypt Later” (HNDL): adversaries are hoarding encrypted Indian data today, to decrypt when their quantum capability matures. Data intercepted now is compromised later. Most answers treat quantum as a prospective concern; stating the HNDL point correctly places it in the present tense.

The opportunity is correspondingly large:

• Quantum Key Distribution (QKD) — theoretically unbreakable key sharing in which any interception is instantly detectable, securing strategic command links.
• Quantum sensing and metrology — ultra‑precise detection and navigation, enabling positioning, navigation and timing independent of GPS in jammed electronic warfare environments, and counter‑stealth detection of submarines and aircraft through gravimetry and magnetometry without emitting trackable radar.
• Quantum computing — battlefield simulation, real‑time processing of surveillance data, logistics and deployment optimisation, and multi‑domain intelligence fusion that compresses the decision cycle.
• Cryptanalysis — the capacity to break an adversary’s encryption.

India’s quantum programme

Initiative	Content
National Quantum Mission (NQM)	Approved on 19 April 2023 with an outlay of ₹6,003.65 crore for 2023–24 to 2030–31, to seed and scale research, development and an industrial ecosystem in quantum technology, working through thematic hubs.
QuEST programme (2018)	Earlier support for quantum laboratories and foundational research.
Military Quantum Mission (MQM) Policy Framework	Released by the Chief of Defence Staff on 22 January 2026 — a comprehensive, time‑bound roadmap for integrating quantum technologies into the armed forces, built on four pillars: Quantum Communication, Quantum Computing, Quantum Sensing and Metrology, and Quantum Materials and Devices.
Institutional and industrial base	IISc Bangalore (quantum algorithms and error correction); IIT Madras (CQuICC) (quantum communication and computing); C‑DOT indigenous QKD solutions; private firms including QNu Labs; and ISRO’s QKD tests (2021).

The obstacles are candidly acknowledged in Indian policy documents: technological immaturity and high error rates in the present generation of devices; infrastructure cost, requiring ultra‑low‑temperature laboratories and advanced fabrication; an acute talent shortage in quantum physics, algorithms and cryptography; evolving international standardisation for post‑quantum cryptography; hardware dependency on foreign original equipment manufacturers for superconducting circuits and ultra‑stable lasers; civil–military silos between defence research laboratories and agile civilian deep‑tech startups; a lack of dedicated military quantum testbeds; and the challenge of tri‑service interoperability in quantum protocols — which is itself a prerequisite for integrated theatre commands.

The priority action is unambiguous: an immediate, risk‑prioritised migration to Post‑Quantum Cryptography (PQC) with cryptographic agility built in. Because of HNDL, every month of delay adds permanently to the volume of Indian data that will eventually be readable by an adversary. This is the rare security recommendation where the cost of inaction is not merely a future risk but an accumulating present loss.

(c) Artificial intelligence and the ETAI framework

Applications in defence and security span supporting functions — intelligence gathering and analysis, surveillance and reconnaissance, navigation assistance, and enhancement of command and control systems — and offensive functions, including target selection and engagement and the coordination of drone swarms.

In cyber defence, AI supports threat detection and prediction and the countering of malware and ransomware. Indian examples include the Army’s Project Seeker and BEL’s ANANT tool.

The threats are the mirror image. Non‑state actors can exploit AI tools for attacks and propaganda. Social engineering at scale — manipulation of social media algorithms to radicalise individuals or spread disinformation — connects directly to the information‑domain contest and to online radicalisation. AI‑generated malware presents a novel cyber threat. And there is no binding international treaty governing the military use of AI.

The ethical and operational risks deserve precise statement, because they are examinable: automation bias — mistaking civilians for combatants through over‑reliance on machine judgment; proportionality difficulties in assessing likely civilian harm; unpredictability of autonomous systems under complex conditions; and objectification of targets, in which AI‑mediated engagement dehumanises the act of warfare and raises tolerance for collateral damage.

THE ETAI FRAMEWORK — GET THE FIVE PRINCIPLES RIGHT The Evaluating Trustworthy Artificial Intelligence (ETAI) Framework and Guidelines for the Armed Forces was launched on 17 October 2024 by the Chief of Defence Staff together with the Secretary, Department of Defence R&D and Chairman, DRDO. It provides a risk‑based evaluation methodology for integrating AI into sensitive defence applications, and seeks to build trust in AI systems by setting clear and enforceable standards. Its five principles are: Reliability and Robustness Safety and Security Transparency Fairness Privacy Note the significance of the last two. A military AI framework that names fairness and privacy among its five governing principles is making a claim that goes well beyond operational effectiveness — it accepts that a system may be technically capable and still not fit for deployment. That is the same proposition established at the outset of this chapter: security and rights are conditions of each other, not competing claims. The framework is worth citing for that reason as much as for its content.

(d) Space

Space is now a security domain because satellites underpin communications, navigation, surveillance and precise positioning, navigation and timing — and because they are, as targets, comparatively easy to reach.

THE DISTINCTION TO STATE PRECISELY Militarisation is the use of space assets — satellites for communication, imagery, navigation and early warning — to support ground, air or naval operations, without placing weapons in space. Weaponisation is the deployment of weapons in space itself, making outer space an active battleground. Militarisation of space proceeded rapidly throughout the Cold War while weaponisation was avoided. It does not follow that weaponisation will continue to be avoided in an era of asymmetric competition — and satellites remain highly vulnerable to weapons designed to kill on impact.

India’s space security efforts: the Defence Space Agency (2018) to coordinate military space operations; Mission Shakti (March 2019), the anti‑satellite missile test that made India the fourth country capable of destroying a satellite in low Earth orbit, after the United States, Russia and China; IndSpaceEx (2019), India’s first space warfare exercise, simulating threats and testing response; and sustained development of dual‑use technologies with both civilian and defence application.

The international framework and its gap

Instrument	Content
Committee on the Peaceful Uses of Outer Space (1959)	Promotes peaceful exploration and use of outer space.
Outer Space Treaty (1967)	Bans the placement of nuclear weapons and other weapons of mass destruction in orbit, on celestial bodies or in outer space.
Rescue Agreement (1968)	Governs the rescue of astronauts and the return of space objects.
Space Liability Convention (1972)	Imposes liability for damage caused by space objects.
Registration Convention (1975)	Requires States to register space objects with the United Nations.
Moon Agreement (1979)	Prohibits military activity on the Moon.

The gap is the point. The treaty regime prohibits weapons of mass destruction in space and says almost nothing about conventional space weapons. This is precisely the objection Russia advanced in vetoing a United Nations Security Council draft resolution reaffirming Outer Space Treaty commitments — that it addressed only weapons of mass destruction and ignored other weapons being developed for space. Whatever one makes of the motive, the legal lacuna it identifies is real.

The consequent challenges: an emerging arms race, with major powers establishing dedicated military space commands and thereby signalling space as a combat domain; and space debris, since conflict in orbit would generate debris fields threatening the long‑term usability of space for everyone, including the victor. The way forward lies in negotiating a legally binding treaty covering all weapon types in space, building Space Situational Awareness (SSA) capability to track debris and rogue satellites, and supporting the Prevention of an Arms Race in Outer Space (PAROS) initiative with enforceable consequences for violation.

A Consolidated Institutional Reform Agenda

The reform proposals dispersed across this chapter are gathered here in one place. They are grouped by type, because the type determines the difficulty — and recognising that is itself an analytical point.

A. Strategy and doctrine

• Publish a National Security Strategy, periodically reviewed and laid before Parliament, stating the hierarchy of threats and assigning instruments and resources to each — building on the precedent set by the counter‑terrorism strategy of February 2026.
• Develop a grey‑zone response doctrine — a stated framework for sustained sub‑threshold coercion, so that cumulative losses are not absorbed simply because no single act crosses the threshold for response.
• Institutionalise periodic published threat review on a fixed cycle, to break the pattern of building institutions after events rather than in anticipation of them.

B. Constitutional and legal

• Enact the localised emergency recommended by the Punchhi Commission — a time‑bound, area‑specific instrument permitting Union intervention in a district without dismissing an elected State government — to fill the gap between inaction and Article 356.
• Codify the deployment convention — State consent, its exceptions, maximum duration of unconsented deployment and post‑facto consent — so the boundary is a legal rule rather than a political quarrel.
• Bring the Forty‑fourth Amendment’s Article 22 provisions into force, reducing the pre‑Advisory Board detention period from three months to two — a safeguard enacted by Parliament and withheld by executive inaction for over four decades.
• Restore sunset and review to the special provisions of the UAPA, so exceptional powers must periodically justify their continuation.
• Codify the K. A. Najeeb principle and impose enforceable outer time limits for the completion of trial in special‑law cases.
• Publish binding criteria governing registration under Section 113 BNS rather than the UAPA, so the choice is reviewable rather than discretionary.
• Define or authoritatively read down the elastic terms in Section 152 BNS — “subversive activities”, “feelings of separatist activities”.

C. Accountability

• Enact a statutory charter for the IB, R&AW and NTRO, with defined mandate, authorisation procedure for interception and surveillance, retention limits and audit — the minimum required to satisfy the legality limb of the Puttaswamy test.
• Establish parliamentary oversight through a security‑cleared standing committee meeting in camera, with an independent tribunal competent to hear complaints, order destruction of unlawfully obtained material and award compensation.
• Enact a dedicated CBI statute under Union List Entry 8, replacing the Delhi Special Police Establishment Act, 1946, and prescribing by law the terms of operation in a State.
• Replace the AFSPA Section 6 sanction requirement with a time‑bound, reasoned and judicially reviewable decision.
• Amend Section 19 of the Protection of Human Rights Act to permit the NHRC to investigate the CAPFs directly.
• Give NATGRID a statutory basis with permitted purposes, retention limits, audit and independent oversight.

D. Institutions

• Revisit institutional fusion. A redesigned counter‑terrorism centre — constituted with State representation, placed outside the Intelligence Bureau, and given a statutory charter with parliamentary oversight — would meet the objections that defeated the NCTC while supplying the operational integration hybrid threats require.
• Create a standing Union–State internal security forum meeting to a fixed calendar with published agendas, since no such body currently exists.
• Close the intelligence–evidence gap through statutory procedures for the protected handling of sensitive material in terrorism trials.

E. Forces and police

• Make the Prakash Singh directives enforceable — tie central modernisation funding to verified compliance, publish an annual independent audit, and give Police Establishment Board decisions binding force.
• Separate investigation from law and order by creating a distinct investigative cadre with its own recruitment, training and accountability.
• Fix recruitment machinery rather than sanction more posts, since sanctioned strength has risen far faster than filled strength for over a decade.
• Invest in the constabulary — training, regulated duty hours, housing, and a genuine promotion ladder for the 86 per cent of the force that constitutes the public’s entire experience of policing.
• Cap the diversion of border guarding forces to internal security duty, with parliamentary reporting of deployment away from primary mandate.
• Implement the 2025 OGAS judgment through cadre review, defined promotion channels and progressive reduction of deputation at senior levels.
• Treat retention as the primary CAPF personnel problem — guaranteed leave cycles, predictable tenures, family accommodation and embedded mental health support.
• Settle the Assam Rifles dual‑control question with a transition plan for pay, pension and career progression.
• Build forensic capacity to match the BNSS obligation, failing which mandatory forensic examination will generate delay rather than evidence.
• Set an exit path from armed forces internal deployment tied to measurable State police capacity benchmarks.

F. Capability and technology

• Rebalance capability toward the growth theatres — cyber, financial and analytic capacity — which cannot be met by raising more armed battalions.
• Mandate immediate migration to Post‑Quantum Cryptography, force‑wide and government‑wide, to limit the accumulating exposure created by Harvest Now, Decrypt Later.
• Extend the “secure by design” and supply‑chain testing approach from drones to telecommunications, surveillance systems, networked infrastructure and police communications.
• Pursue indigenisation by criticality, not only by value — engines, sensors, semiconductors and advanced materials rather than assembly share — and extend the indigenisation effort to CAPF and State police procurement, which it has largely bypassed.

G. Society

• Institutionalise the human security lens so that development, entitlement and rights delivery in conflict‑affected areas are planned as security instruments, not as unrelated welfare.
• Address the information domain through verification capacity, platform accountability and public digital literacy, rather than content prohibition alone.
• Treat internal cohesion as a component of national power, making social harmony a measurable strategic objective.
• Rebuild police–public trust as intelligence infrastructure, on the understanding that ground‑level collection depends on a citizen’s willingness to speak to a constable.

THE PATTERN IN THE AGENDA — AND THE REASON IT MATTERS Sort these proposals by difficulty rather than by subject, and a pattern emerges that explains the whole chapter. Where reform has been technical, India has delivered. CCTNS connected every police station in the country. NATGRID became operational after a decade of effort. The counter‑terrorism strategy was published. Defence production multiplied several times over. Theatre command blueprints were drafted. Quantum and AI frameworks were issued. None of this was easy, and all of it was done. Where reform requires the political executive to surrender discretion, almost nothing has moved. Fixed tenure for police officers. A statutory charter for the intelligence agencies. Parliamentary oversight. A dedicated CBI statute. The localised emergency. Sunset clauses on the UAPA. A commencement notification for an Article 22 amendment passed in 1978. These cost no money and require no technology. They have not been done because each one removes a lever of control. That is the single most important conclusion available from this chapter, and it belongs in the closing paragraph of almost any Mains answer on internal security architecture: India’s security deficit is not primarily a deficit of capability, resources or expertise. It is a deficit of institutional self‑restraint.

FINAL TAKEAWAY India’s internal security architecture is, on the evidence of the past decade, operationally effective and institutionally unfinished. It has ended a six‑decade insurgency, driven violence in every territorial theatre to historic lows, networked every police station in the country, and published its first security strategy. It has also left its most powerful agencies outside the law that would define them, its most contested statute without a sunset, its constitutional emergency toolkit without a middle setting, its police unreformed since 1861, and its central forces losing trained personnel faster than it can recruit them. The through‑line is consistent and it is the thing to say last: where the required reform was technical, India built it. Where the required reform meant the executive giving up discretion — over transfers, over intelligence, over the duration of emergency powers, over who reviews whom — it did not. A security architecture is not measured only by what it can do to a threat. It is measured by what it permits to be done to a citizen, and by who is empowered to ask whether that was justified. On the first India has succeeded; on the second, the work has not begun.