GS Paper III — “Role of External State and Non-state Actors in creating challenges to Internal Security”

Reading the Syllabus Line Itself

Four load-bearing words — each generates its own question set:

Open answers with:

• Sub-conventional / “grey zone” warfare — coercion below the threshold of open war, engineered for plausible deniability.
• Pakistan’s doctrine of “bleeding India through a thousand cuts”; China’s “Three Warfares” (psychological, media, legal).
• Hybrid warfare (Frank Hoffman) — simultaneous use of conventional, irregular, terrorist and criminal means.
• K. Subrahmanyam’s framing of internal security as the “soft underbelly” of national power.

PYQ anchoring (direct hits on this line):

• 2021 (GS-III): Analyse the multidimensional challenges posed by external state and non-state actors to the internal security of India. Also discuss measures required to be taken to combat these threats. ← verbatim syllabus
• 2016: Misuse of internet and social media by non-state actors for subversive activities.
• 2019: Cross-border movement of insurgents across the India–Myanmar border.
• 2020: Complexity, causes, linkages and “obnoxious nexus” of terrorism.
• 2023: UAV/drone use by adversaries to ferry arms and narcotics.
• 2024: Role of central intelligence and investigative agencies in tackling internal security threats; “winning hearts and minds” in J&K.

Post-2025 anchor that will dominate Mains 2026: the Pahalgam attack (22 April 2025, 26 killed, TRF claim) and Operation Sindoor (7 May 2025) — the clearest available case of an external state–non-state hybrid attack and of India’s doctrinal response. Pair it with the declaration of India as effectively LWE-free on 31 March 2026, which lets you argue that the internal threat spectrum has shifted decisively toward externally-sponsored and cyber/cognitive threats.

1. What Is “Internal Security”? (Definitional & Conceptual Questions)

1.1 Definition

Internal security = the state’s capacity to maintain sovereignty, territorial integrity, constitutional order and public tranquillity within its borders, against threats that need not be military in character.

Distinguish it from:

• Law and order — routine crime, localised disturbance; State subject (State List Entries 1 & 2).
• External security — defence against foreign armed forces; Union subject (Union List Entry 1).
• Internal security straddles both — hence Union List Entries 2 (naval, military, air forces), 2A (deployment of Union armed forces in a State), 8 (CBI), 9 (preventive detention for reasons connected with defence/foreign affairs/security of India) and Concurrent List Entry 3 (preventive detention for security of a State/public order).

1.2 Constitutional Architecture

• Art. 355 — Union duty to protect States against external aggression and internal disturbance (invoked as justification for CAPF deployment; interpreted expansively in Sarbananda Sonowal v. UoI, 2005, which struck down the IMDT Act and read illegal migration into Assam as “external aggression”).
• Art. 352 — Emergency on grounds of war, external aggression or armed rebellion (44th Amendment replaced “internal disturbance”).
• Art. 356 — State emergency; Art. 21, 22 — procedural limits on preventive detention.
• Art. 246 + Seventh Schedule — the federal fault-line: policing is a State subject, but the threats are transnational. This tension explains why the NCTC (2012) was never operationalised.

1.3 The Seven Components (use this as a mind-map in intro/diagram)

1. Territorial — insurgency, secessionism, border infiltration (J&K, NE).
2. Ideological/political — LWE (declared effectively ended, 31 March 2026), religious extremism, separatism.
3. Social/communal — engineered polarisation, riots, targeted killings by religious identity (the Pahalgam modus operandi).
4. Economic — FICN, money laundering, hawala, narco-economy, smuggling, sabotage of critical economic infrastructure.
5. Cyber & critical infrastructure — power grids, banking, health, defence networks.
6. Cognitive/informational — disinformation, deepfakes, narrative warfare, radicalisation.
7. Demographic & border — illegal migration, refugee influx, altered border-district demography.

2. External State Actors

2.1 Definition & Instruments

A sovereign government using overt or covert instruments to degrade another state’s internal stability, calibrated below the threshold that would invite conventional retaliation.

Instrument set: proxy terrorism · training/arms/sanctuary to insurgents · counterfeit currency · narco-trafficking · cyber operations · information warfare · sponsorship of separatist diaspora · lawfare and diplomatic pressure · economic coercion and supply-chain leverage · demographic pressure.

2.2 Country Case-Files

PAKISTAN — the archetype of state-sponsored proxy war

• Institutional: ISI’s “S-Directorate”; use of LeT, JeM, HM, TRF as deniable proxies; Deep-state doctrine of strategic depth.
• Landmark cases: IC-814 hijack (Dec 1999, Kathmandu→Kandahar, release of Masood Azhar → founding of JeM); Parliament attack (13 Dec 2001) → Operation Parakram; 26/11 Mumbai (2008) — sea route via trawler Kuber, LeT control room in Karachi, David Coleman Headley’s reconnaissance establishing the ISI link, Kasab’s capture giving legal proof; Pathankot (Jan 2016); Uri (Sept 2016) → surgical strikes; Pulwama (Feb 2019) — VBIED, JeM, local recruit Adil Ahmad Dar → Balakot air strike; Pahalgam (22 April 2025) → Operation Sindoor, nine terror sites in Pakistan and PoJK struck on 7 May 2025, including Markaz Subhan Allah (Bahawalpur, JeM) and Muridke (LeT).
• Non-kinetic: high-quality FICN routed via Nepal, Bangladesh, Thailand and Gulf; drone-borne arms and heroin drops in Punjab and Jammu (BSF recoveries rising steeply year on year); first drone attack on an Indian defence installation — Jammu Air Force Station, 27 June 2021; cross-border tunnels in Samba/Kathua; revival of Khalistan through Sikhs for Justice (banned 2019) “Referendum 2020” and BKI/KTF modules.
• Lawfare: internationalising Kashmir at UNGA/OIC/UNHRC; blocking UNSC 1267 designations (Masood Azhar listed only in May 2019 after China’s technical hold lapsed).

CHINA — indirect, patient, multi-domain

• Sponsorship of NE insurgency: historic training/arms to Naga, Mizo and Meitei groups; ULFA-I’s Paresh Baruah long reported operating from the Yunnan–Myanmar frontier; arms pipelines through the Yunnan–Kachin corridor to PLA (Manipur), UNLF, NSCN(K); the Kanglatongbi/Churachandpur ambush (Nov 2021) killing an Assam Rifles commanding officer and his family illustrates the lethality of these externally-armed outfits.
• Cyber: RedEcho/ShadowPad intrusions into Indian power-sector load-despatch centres (reported around the Mumbai grid failure, Oct 2020); repeated probing of health, telecom and transport networks; Zhenhua Data mass open-source profiling of Indian elites.
• Cognitive & economic: “Three Warfares”; predatory Chinese loan apps driving extortion and suicides (ED/MHA crackdowns, 2021–23); dependence on Chinese APIs and telecom equipment → National Security Directive on Telecommunication Sector (2021) and the “trusted source” regime; strategic encirclement (Gwadar, Hambantota, Kyaukphyu) reducing India’s room to police its own periphery.
• Territorial-psychological: Doklam (2017), Galwan (2020), border villages — these produce internal effects via information operations and by pinning down forces.

MYANMAR — the sanctuary problem (state weakness, not state hostility)

• Post-February 2021 coup, collapse of central control in Sagaing/Chin created safe havens for ULFA-I, NSCN(K), PLA-Manipur, Kuki militants.
• Spillover of the Chin/Kuki-Zo refugee influx into Mizoram and Manipur is a documented aggravator of the Manipur ethnic violence from May 2023; also the conduit for the Golden Triangle methamphetamine and heroin flow.
• India’s response: scrapping of the Free Movement Regime (Feb 2024) and sanctioned fencing of the ~1,643 km border; earlier Operation Sunrise (2019) coordinated with the Tatmadaw.

BANGLADESH — from sanctuary to partner, and renewed uncertainty

• Pre-2009: safe haven for ULFA (Arabinda Rajkhowa handed over in 2009), HuJI-B; Operation Golden Bird (1995) targeted the arms corridor.
• 2009–2024: model of cooperation — Land Boundary Agreement (2015), coordinated border management, handover of insurgents.
• Post-August 2024 political transition: renewed concern over ABT/JMB networks, minority security, and the vulnerability of the Siliguri “Chicken’s Neck” corridor.

NEPAL — the open-border vulnerability

• 1950 Treaty of Peace and Friendship (Arts. 6–7) creates a virtually unpoliced border used for FICN transit, ISI’s “Kathmandu module”, and fugitive movement — Yasin Bhatkal (IM) was arrested at Raxaul in 2013; IC-814 originated at Kathmandu.

OTHERS

• Sri Lanka: LTTE’s Tamil Nadu linkages and the assassination of Rajiv Gandhi (1991) — the classic case of an external NSA reshaping Indian domestic politics and law (POTA/TADA debates).
• Afghanistan: post-2021 Taliban takeover → arms leakage and ISKP’s propaganda reach into South Asia.
• Safe-harbour states for radical preachers and Khalistani/secessionist networks (Canada, UK, US, Turkey, Malaysia) — a diplomatic-legal rather than kinetic challenge.

3. External Non-State Actors:

Present this as a six-fold typology (examiners reward classification):

(i) Transnational terrorist organisations LeT, JeM, HM and the shell-front The Resistance Front (TRF, proscribed under UAPA in Jan 2023) created to give Kashmir violence an “indigenous” face; AQIS (announced by al-Zawahiri, 2014); ISIS/ISKP with its India-facing magazines (Voice of Hind, Sawt al-Hind); Indian Mujahideen as the hybrid indigenous-external node.

(ii) Organised crime syndicates — the crime–terror nexus D-Company — the 1993 Bombay serial blasts remain the definitive Indian case of a criminal syndicate executing a state-backed terror strike; Dawood Ibrahim designated by the US (2003) and listed under UNSC 1267. Extend to narco-cartels: the Golden Crescent (Afghan heroin via Iran) and Golden Triangle (Myanmar meth) — evidenced by the Mundra Port seizure of ~3,000 kg of heroin (Sept 2021) and repeated multi-tonne maritime interdictions off Kerala and the Andamans by the NCB–Navy–Coast Guard.

(iii) Diaspora and secessionist networks SFJ’s “Referendum 2020”, Babbar Khalsa International, Khalistan Tiger Force — funding, propaganda and the attacks on Indian missions in London and San Francisco (March 2023); also LTTE-remnant and NE insurgent fundraising abroad.

(iv) Radical ideological and front organisations PFI (banned Sept 2022 after NIA/ED “Operation Octopus”, with allegations of Gulf-routed funding**)**; Hizb-ut-Tahrir (banned 2024); the Al-Hind module (Bengaluru, 2020); the “Kerala 21” who travelled to ISKP-held Nangarhar (2016).

(v) Cyber and information actors Pakistan-aligned APTs (Transparent Tribe/APT36) targeting defence personnel through spear-phishing and honey-traps; ransomware syndicates behind the AIIMS Delhi outage (Nov 2022) and Oil India attack (2022); the Kudankulam Nuclear Power Plant malware intrusion (Sept 2019) — the best example of a state-sponsored non-state hacking group hitting critical infrastructure; hacktivist swarms and coordinated inauthentic behaviour during Article 370 abrogation, the farm protests and Operation Sindoor.

(vi) “Grey” actors — corporates, platforms, foreign-funded entities Social media platforms as unwitting vectors (the Bengaluru riots, Aug 2020; the 2012 NE exodus from Bengaluru triggered by doctored images circulated from abroad); spyware vendors; foreign-funded NGOs — the FCRA debate (IB’s 2014 report on Kudankulam agitation funding; the 2021 “toolkit” case and its Poetic Justice Foundation link). Balance requirement: note that the FCRA 2020 amendment and mass registration cancellations have drawn credible criticism for shrinking legitimate civil-society space — a nuanced answer flags securitisation risk.

4. The Mechanism: Ten Vectors Through Which Challenges Are Created

This is the analytical core of the syllabus line. Each vector = one paragraph, one case study.

Two cross-cutting concepts worth naming explicitly:

• “Hybrid militancy” in J&K — the local recruit who retains his civilian identity between operations, making external sponsorship harder to prove and infiltration statistics misleading.
• The “obnoxious nexus” (UPSC’s own 2020 phrasing) — terrorism + organised crime + narcotics + counterfeiting + corruption, each financing the next.

5. Theatre-Wise Mapping (for region-specific questions)

• Jammu & Kashmir: Pakistan/ISI + LeT-JeM-TRF. Post-Article 370 (Aug 2019) shift to hybrid militants, targeted minority killings, and a re-opened Jammu-region front (Rajouri–Poonch ambushes, 2023–24) using foreign-trained cadres. Counter: Operation All Out, security-grid saturation, NIA cases on the terror-funding ecosystem, and demonstrable normalisation markers (record tourist inflow before Pahalgam, the 2024 Assembly elections).
• Punjab: Khalistani diaspora funding + Pakistan’s drone-and-drugs pipeline; radicalisation of youth through gangster-terrorist tie-ups (the “gangster–Khalistani nexus” in NIA charge-sheets).
• North-East: Myanmar’s sanctuary + China’s arms supply; but a genuine success story — Bodo Accord (2020), Bru-Reang (2020), Karbi Anglong (2021), ULFA (pro-talks) Accord (Dec 2023), and phased AFSPA withdrawal. Manipur (2023 onwards) is the counter-example showing how ethnic conflict + porous border + narcotics can reverse gains.
• LWE/Red Corridor: primarily indigenous, but historically supplied through arms-smuggling networks. Declared effectively over on 31 March 2026 — affected districts down from 126 (2014) to nil, incidents from 1,936 (2010) to 234 (2025). Use SAMADHAN (2017) and the “Legacy/Thrust districts” concept to argue that consolidation, not victory, is the current task.
• Coastal & maritime: post-26/11 architecture — Sagar Prahari Bal, coastal police stations, IMAC/NC3I Gurugram, Information Fusion Centre–IOR; drugs and arms interdiction as the current threat.
• Hinterland & cyber: sleeper modules, radicalisation, financial crime — the least geographically bounded and fastest-growing theatre.

6. India’s Counter-Mechanisms (Six Layers)

6.1 Legal

• UAPA 1967 — 2019 amendment permits designation of individuals as terrorists (Masood Azhar, Hafiz Saeed, Zaki-ur-Rehman Lakhvi, Dawood Ibrahim) and NIA property attachment.
• NIA Act 2008 — 2019 amendment gives extraterritorial jurisdiction and adds cyber-terrorism and human trafficking.
• PMLA 2002, FEMA, Black Money Act 2015, Fugitive Economic Offenders Act 2018, NDPS Act 1985.
• FCRA 2010/2020 — foreign-funding regulation.
• IT Act s. 69A, IT Rules 2021, Telecommunications Act 2023, DPDP Act 2023.
• AFSPA 1958 — and its contested legitimacy after the Oting incident (Nagaland, Dec 2021).
• New criminal codes (in force 1 July 2024): BNS s. 113 codifies “terrorist act” in the general penal law for the first time; s. 152 replaces sedition with “acts endangering sovereignty, unity and integrity of India”. Highly examinable — and legitimately contested on vagueness grounds.

6.2 Institutional

• NSA / NSCS / Strategic Policy Group / NSAB; CCS.
• Intelligence & coordination: IB, R&AW, DIA, NTRO, Multi-Agency Centre (post-Kargil), NATGRID (operational since 2022), NIA, ED, DRI, FIU-IND.
• Cyber: NCIIPC (critical infrastructure), CERT-In, I4C and the citizen financial cyber-fraud reporting system, Defence Cyber Agency (2019), Cyber Swachhta Kendra.
• Forces: CAPFs (BSF, ITBP, SSB, Assam Rifles, CRPF/CoBRA, NSG), Coast Guard, state police and specialised units (Greyhounds, DRG, Bastar Fighters).
• The gap: NCTC remains unimplemented owing to federal objections — the single best example of the Seventh Schedule constraining counter-terror capacity.

6.3 Border Management

CIBMS and smart-fencing pilots (Dhubri) · anti-tunnel and anti-drone (DRDO D-4) systems · Vibrant Villages Programme (2023) on the northern border · Border Area Development Programme · scrapping of the Free Movement Regime and fencing of the India–Myanmar border · Madhav Godbole Task Force / Kargil Review Committee lineage of “one border, one force”.

6.4 Financial & Regulatory

Demonetisation and new security features against FICN · FATF-aligned amendments to PMLA · India’s strong showing in the FATF Mutual Evaluation (2024), placed in the regular follow-up category · No Money for Terror Conference, New Delhi (Nov 2022) · India-chaired UNSC Counter-Terrorism Committee special meeting, Mumbai/Delhi (Oct 2022) and the Delhi Declaration on the misuse of new and emerging technologies.

6.5 Operational & Doctrinal

Surgical strikes (2016) → Balakot (2019) → Operation Sindoor (2025): a visible shift from strategic restraint to punitive, calibrated deterrence, now articulated as a “new normal” in which a terror attack invites a direct state-level response and instruments such as the Indus Waters Treaty are placed in abeyance. Complement with SAMADHAN (LWE), Operation All Out (J&K), Operation Sadbhavana (civic action), and surrender-and-rehabilitation policies.

6.6 Diplomatic & International

UNSC 1267 designations · ~48 extradition treaties and MLATs · Interpol notices · SCO-RATS, BIMSTEC Convention on Combating Terrorism, Quad counter-terrorism working group · sustained pressure on Pakistan through FATF grey-listing (2018–2022) · bilateral intelligence-sharing agreements.

7. Critical Evaluation (the “value-addition” paragraph)

Structural gaps:

• No published National Security Strategy; the National Cyber Security Strategy has remained pending despite the 2013 policy being outdated.
• Intelligence–action gap: Pulwama and Pahalgam both raised questions of last-mile actionable intelligence rather than collection.
• Police reform stalled — Prakash Singh v. UoI (2006) directives largely unimplemented; police–population ratio well below the UN-indicated norm; chronic CAPF vacancies and deployment fatigue.
• Federal friction — NCTC’s fate; States’ objections to the NIA (Amendment) Act.
• Rights costs — very low conviction rates under UAPA relative to arrests; prolonged pre-trial detention; AFSPA and the accountability deficit. A balanced answer cites the Supreme Court’s caution in Arup Bhuyan and the Justice Verma/Jeevan Reddy Committee (2005) recommendation to repeal AFSPA.
• Technology deficit — anti-drone coverage is patchy; forensic and cyber-workforce capacity lags threat growth; critical-infrastructure OT security remains weak.

Reform agenda (conclusion material): Whole-of-government “grey zone” doctrine · operationalise a federal counter-terror node with State buy-in · publish a National Security Strategy and Cyber Security Strategy · scale indigenous counter-UAS and AI-based border surveillance · institutionalise counter-radicalisation and de-radicalisation (Maharashtra ATS and Kerala models) · deepen development-security integration (Aspirational Districts, PESA, Vibrant Villages) · strengthen international legal cooperation and push the Comprehensive Convention on International Terrorism (CCIT), proposed by India in 1996 and still stalled over the definition of terrorism.

8. Probable Question Bank

Conceptual/definitional (10 marks)

1. Distinguish between external state and external non-state actors with reference to India’s internal security. (150 words)
2. What do you understand by “grey zone warfare”? Illustrate with examples from India’s neighbourhood.
3. Examine the crime–terror nexus as a threat to India’s internal security.

Analytical (15 marks) 4. “The distinction between external and internal security has collapsed in the age of hybrid warfare.” Critically examine with reference to India. 5. External non-state actors today pose a greater challenge to India’s internal security than external state actors. Do you agree? 6. Discuss how narcotics trafficking has emerged as a force-multiplier for externally-sponsored terrorism in India’s border States. 7. Evaluate the shift in India’s counter-terrorism doctrine from strategic restraint to punitive deterrence, using recent operations. 8. “Technology has democratised the capacity of non-state actors to inflict strategic harm.” Examine with reference to drones and cyber operations. 9. Assess the adequacy of India’s institutional architecture for countering externally-sponsored threats. Why has the NCTC remained a non-starter? 10. Foreign funding regulation must balance national security with the space for civil society. Critically evaluate the FCRA regime. 11. Examine the implications of political instability in Myanmar and Bangladesh for India’s north-eastern security. 12. Has India’s declaration of freedom from Left Wing Extremism (March 2026) changed the composition of its internal security threat spectrum? Analyse.

9. Ready Reckoner — Facts, Dates, Figures

Usable one-liners for openings and conclusions

• “The battlefield of the twenty-first century runs through the citizen’s mind and the citizen’s mobile phone.”
• Kautilya’s Arthashastra on the enemy who works through the kantaka (thorn) within — internal subversion as an instrument of statecraft.
• India’s own formulation at the UNSC: terrorism financed and hosted abroad but detonated at home is a shared, not a bilateral, problem.