#FactCheck - Edited Video of ‘India-India’ Chants at Republican National Convention

Introduction

The Ministry of Electronics and Information Technology (MeitY) recently issued the “Email Policy of Government of India, 2024.” It is an updated email policy for central government employees, requiring the exclusive use of official government emails managed by the National Informatics Centre (NIC) for public duties. The policy replaces 2015 guidelines and prohibits government employees, contractors, and consultants from using their official email addresses on social media or other websites unless authorised for official functions. The policy aims to reinforce cybersecurity measures and protocols, maintain secure communications, and ensure compliance across departments. It is not legally binding, but its gazette notification ensures compliance and maintains cyber resilience in communications. The updated policy is also aligned with the newly enacted Digital Personal Data Protection Act, 2023.

Brief Highlights of Email Policy of Government of India, 2024

• The Email Policy of the Government of India, 2024 is divided into three parts namely, Part I: Introduction, Part II: Terms of Use, Part III: Functions, duties and Responsibilities, and with an annexe attached to it defining the meaning of certain organisation types in relation to this policy.
• The policy direct to not use NICeMail address for registering on any social media or other websites or mobile applications, save for the performance of official duties or with due authorisation from the authority competent.
• Under this new policy, “core use organisations” (central government departments and other government-controlled entities that do not provide goods or services on commercial terms) and its users shall use only NICeMail for official purposes. 

• However, where the Core Use Organisation has an office or establishment outside India, to ensure availability of local communication channels under exigent circumstances may use alternative email services hosted outside India with all due approval.
• Core Use Organisations, including those dealing with national security, have their own independent email servers and can continue operating their independent email servers provided the servers are hosted in India. They should also consider migrating their email services to NICeMail Services for security and uniform policy enforcement.
• The policy also requires departments that currently use @gov.in or @nic.in to instead migrate to @departmentname.gov.in mail domains so that information sanctity and integrity can be maintained when officials are transferred from one department/ministry to another, and so that the ministry/department doesn’t lose access to the official communication. For this, the department or ministry in question must register the domain name with NIC. For instance, MeitY has registered the mail domain @meity.gov.in. The policy gives government departments six months time period complete this migration.
• The policy also makes distinction between (1) Organisation-linked email addresses and (2) Service-linked email addresses. The policy in respect of “organisation-linked email addresses” is laid down in paragraphs 5.3.2(a) and 5.4 to 5.6.3. And the policy in respect of “service-linked email addresses” is laid down in paragraphs 5.3.2(b) and 5.7 to 5.7.2 under the official document of said policy. 

• Further, the new policy includes specific directives on separating the email addresses of regular government employees from those of contractors or consultants to improve operational clarity.

CyberPeace Policy Outlook 

The revised Email Policy of the Government of India reflects the government’s proactive response to countering the evolving cybersecurity challenges and aims to maintain cyber resilience across the government department’s email communications. The policy represents a significant step towards securing inter government and intra-government communications. We as a cybersecurity expert organisation emphasise the importance of protecting sensitive data against cyber threats, particularly in a world increasingly targeted by sophisticated phishing and malware attacks, and we advocate for safe and secure online communication and information exchange. Email communications hold sensitive information and therefore require robust policies and mechanisms in place to safeguard the communications and ensure that sensitive data is shielded through regulated and secure email usage with technical capabilities for safe use. The proactive step taken by MeitY is commendable and aligned with securing governmental communication channels.

References:

1. https://www.meity.gov.in/writereaddata/files/Email-policy-30-10-2024.pdf-(Official document for Email Policy of Government of India, 2024.
2. https://www.hindustantimes.com/india-news/dont-use-govt-email-ids-for-social-media-central-govt-policy-for-employees-101730312997936.html#:~:text=Government%20employees%20must%20not%20use,email%20policy%20issued%20on%20Wednesday
3. https://bwpeople.in/article/new-email-policy-issued-for-central-govt-employees-to-strengthen-cybersecurity-measures-537805
4. https://www.thehindu.com/news/national/centre-notifies-email-policy-for-ministries-central-departments/article68815537.ece

‍

Introduction

‍

We inhabit an era where digital connectivity, while empowering, has also unleashed a relentless tide of cyber vulnerabilities, where personal privacy is constantly threatened, and crimes like sextortion are the perfect example of the sinister side of our hyperconnected world. Social media platforms, instant messaging apps, and digital content-sharing tools have all grown rapidly, changing how people communicate with one another and making it harder to distinguish between the private and public domains. The rise of sophisticated cybercrimes that use the very tools meant to connect us is the price paid for this unparalleled convenience. Sextortion, a portmanteau of “sex’ and “extortion”, stands out among them as a particularly pernicious kind of internet exploitation. Under the threat of disclosing their private information, photos, or videos, people are forced to engage in sexual behaviours or provide intimate content. Sextortion’s psychological component is what makes it particularly harmful, it feeds on social stigma, shame, and fear, which discourage victims from reporting the crime and feed the cycle of victimisation and silence. This cybercrime targets vulnerable people from all socioeconomic backgrounds and is not limited by age, gender, or location. 

‍

The Economy of Shame: Sextortion as a Cybercrime Industry

‍

A news report from June 03, 2025, reveals a sextortion racket busted in Delhi, where a money trail of over Rs. 5 crore was identified by different teams of the Crime branch. From synthetic financial identities to sextortion and other cyber frauds, a recipe for a sophisticated cybercrime chain was found. To believe this is an aberration is to overlook the reality that it is symptomatic of a much wider and largely uncharted criminal framework. According to the FBI’s 2024 IC3 report, “extortion (including sextortion)” has skyrocketed to 86,415 complaints with losses of $143 million reported in the United States (US) alone. This indicates that coercive image-based threats are no longer an isolated cybercrime but an everyday occurrence. Sextortion is no longer an isolated cybercrime; it has metamorphosed into a systematic, industrialised criminal enterprise. Another news report dated 19th July, 2025, where Delhi Police has detained four people suspected of participating in a sextortion scheme that targeted a resident of the Bhagwanpur Khera neighbourhood of Shahdara. The suspected people were allegedly arrested on a complaint wherein the victim was manipulated and fell prey to a dating site. 

The threat is amplified by the usage of deepfake technology, which allows offenders to create obscene content that looks believable. The approach, which relies on the stigma attached to sexual imagery in conservative societies like India, is that victims frequently give in to requests out of fear of damaging their reputations. The combination of cybercrime and cutting-edge technology highlights the lopsided power that criminals possess, leaving victims defenceless and law enforcement unable to keep up. 

‍

Legal Remedies and the Evolving Battle Against Sextortion

‍

Given the complexity of these crimes, India has recognised sextortion and similar cyber-enabled financial crimes under a number of legal frameworks. A change to recognising cyber-enabled sexual exploitation as an organised criminal business is shown by the introduction of specific provisions like Section 111 in the Bhartiya Nyaya Sanhita (BNS), 2023, which classifies organised cybercrimes including extortion and frauds which fall under its expansive interpretation, as a serious offence. Similarly, Section 318 (2) criminalises cheating with a maximum sentence of three years in prison or a fine, whereas Section 336 (2) makes digital forgery a crime with a maximum sentence with a maximum sentence of two years in prison or a fine. In addition to these regulations, cheating by personation through computer resources is punishable by the Information Technology Act, 2000, specifically Section 66D, which carries a maximum sentence of three years in prison and a maximum fine of Rs. 1 lakh. Due to issues with attribution, cross-border jurisdiction, and the discreet nature of digital evidence, enforcement is still inconsistent even with current statutory restrictions. 

The government and its agencies recognise that laws achieve real impact only when backed by awareness initiatives and accessible, localised mechanisms for redressal. Several Indian states and the Department of Telecommunications launched numerous campaigns to educate the public about and safeguard their mobile communication assets against identity theft, financial fraud, and cyberscams. Initiatives like Cyber Saathi Initiative and Cyber Dost by MHA, with the goal of improving forensic and victim reporting skills.

‍

Conclusion

‍

At CyberPeace, we understand that the best defence against online abuse is prevention. Our goal is to provide people with the information and resources to identify, avoid and report sextortion attempts like CyberPeace Helpline and organise awareness campaigns on safe digital habits. In order to remain updated with the constantly looming danger, our research and policy advocacy also focus on developing more robust legal and technological safeguards. 

To every reader: think before you share, secure your accounts, and never let shame silence you. If you or someone you know becomes a victim, report it immediately, help is available, and justice is possible. Together we can reclaim the internet as a space of trust, not terror. 

‍

References 

‍

• https://www.hindustantimes.com/india-news/delhi-police-busts-sextortion-cyberfraud-rackets-6-held-101748959601825.html 
• https://timesofindia.indiatimes.com/city/delhi/delhi-police-arrests-four-for-sextortion-and-blackmail-in-shahdara/articleshow/122767656.cms ‍
• https://cdn.ncw.gov.in/wp-content/uploads/2025/05/CyberSaheli.pdf

Executive Summary:

This report deals with a recent cyberthreat that took the form of a fake message carrying a title of India Post which is one of the country’s top postal services. The scam alerts recipients to the failure of a delivery due to incomplete address information and requests that they click on a link (http://iydc[.]in/u/5c0c5939f) to confirm their address. Privacy of the victims is compromised as they are led through a deceitful process, thereby putting their data at risk and compromising their security. It is highly recommended that users exercise caution and should not click on suspicious hyperlinks or messages.

False Claim:

The fraudsters send an SMS stating the status of delivery of an India Mail package which could not be delivered due to incomplete address information. They provide a deadline of 12 hours for recipients to confirm their address by clicking on the given link (http://iydc[.]in/u/5c0c5939f). This misleading message seeks to fool people into disclosing personal information or compromising the security of their device. 

‍

‍

The Deceptive Journey:

• First Contact: The SMS is sent and is claimed to be from India Post, informs users that due to incomplete address information the package could not be delivered.

• Recipients are then expected to take action by clicking on the given link (http://iydc[.]in/u/5c0c5939f) to update the address. The message creates a panic within the recipient as they have only 12 hours to confirm their address on the suspicious link.

• Click the Link: Inquiring or worried recipients click on the link.

• User Data: When the link is clicked, it is suspected to  launch possible remote scripts in the background and collect personal information from users.

• Device Compromise: Occasionally, the website might also try to infect the device with malware or take advantage of security flaws.

The Analysis:

• Phishing Technique: The scam allures its victims with a phishing technique and poses itself as the India Post Team, telling the recipients to click on a suspicious link to confirm the address as the delivery package can’t be delivered due to incomplete address. 
• Fake Website Creation: Victims are redirected to a fraudulent website when they click on the link (http://iydc[.]in/u/5c0c5939f) to update their address.
• Background Scripts: Scripts performing malicious operations such as stealing the visitor information, distributing viruses are suspected to be running in the background. This script can make use of any vulnerability in the device/browser of the user to extract more info or harm the system security.
• Risk of Data Theft: This type of fraud has the potential to steal the data involved because it lures the victims into giving their personal details by creating fake urgency. The threat actors  can use it for various illegal purposes such as financial fraud, identity theft and other criminal purposes in future.
• Domain Analysis: The iydc.in domain was registered on the 5th of April, 2024, just a short time ago. Most of the fraud domains that are put up quickly and utilized in criminal activities are usually registered in a short time.
• Registrar: GoDaddy.com, LLC, a reputable registrar, through which  the domain is registered. 
• DNS: Chase.ns.cloudflare.com and delilah.ns.cloudflare.com are the name servers used by Cloudflare to manage domain name resolution. 
• Registrant: Apart from the fact that it is in Thailand, not much is known about the registrant probably because of using the privacy reduction plugins. 

• Domain Name: iydc.in
• Registry Domain ID: DB3669B210FB24236BF5CF33E4FEA57E9-IN
• Registrar URL: www.godaddy.com
• Registrar: GoDaddy.com, LLC
• Registrar IANA ID: 146
• Updated Date: 2024-04-10T02:37:06Z
• Creation Date: 2024-04-05T02:37:05Z (Registered in very recent time)
• Registry Expiry Date: 2025-04-05T02:37:05Z
• Registrant State/Province: errww
• Registrant Country: TH (Thailand)
• Name Server: delilah.ns.cloudflare.com
• Name Server: chase.ns.cloudflare.com

Note: Cybercriminals used Cloudflare technology to mask the actual IP address of the fraudulent website.

CyberPeace Advisory:

• Do not open the messages received from social platforms in which you think that such messages are suspicious or unsolicited. In the beginning, your own discretion can become your best weapon.
• Falling prey to such scams could compromise your entire system, potentially granting unauthorized access to your microphone, camera, text messages, contacts, pictures, videos, banking applications, and more. Keep your cyber world safe against any attacks.
• Never reveal sensitive data such as your login credentials and banking details to entities where you haven't validated as reliable ones.
• Before sharing any content or clicking on links within messages, always verify the legitimacy of the source. Protect not only yourself but also those in your digital circle.
• Verify the authenticity of alluring offers before taking any action.
  

Conclusion:

The India Post delivery scam is an example of fraudulent activity that uses the name of trusted postal services to trick people. The campaign is initiated by using deceptive texts and fake websites that will trick the recipients into giving out their personal information which can later be used for identity theft, financial losses or device security compromise. Technical analysis shows the sophisticated tactics used by fraudsters through various techniques such as phishing, data harvesting scripts and the creation of fraudulent domains with less registration history etc.  While encountering such messages, it's important to verify their authenticity from official sources and take proactive measures to protect both your personal information and devices from cyber threats. People can reduce the risk of falling for online scams by staying informed and following cybersecurity best practices.

‍