2. AASHVAST, a Firmware Analysis and Validation Suite, developed by QuickPay Pvt Ltd for the Directorate General of Electronics and Mechanical Engineering (DG EME), is designed to do more than just physically inspect drones.
3. It also examines the software that operates these unmanned aerial vehicles (UAVs) – to identify and eliminate firmware-level vulnerabilities.
4. The Army has published a Request for Proposal in April this year to procure customised licensed software for validation of firmware and embedded systems for electronic components, including UAV components.
What is firmware?
5. Firmware is a specialized type of software permanently or semi-permanently embedded into a hardware device to provide low-level control and basic operational instructions.
6. Firmware vulnerabilities can be introduced during the manufacturing stage of a component or an upgrade process. For instance, unused codes could be introduced, hidden commands could be invoked at a certain location – thereby preventing the drone from performing its task.
Differences between Hardware, Firmware and Software (Infographic generated by AI).
Why are AASHVAST labs significant?
7. While the lab will initially test all drones, sources said that CCTV cameras procured by the Army in future will also eventually be inspected by it for Chinese proprietary protocols or equivalent, which could be potentially embedded in these.
8. The idea behind establishing these labs, a first of its kind, was to neutralise the common threats of enemy interference in Indian drones, preventing them from performing their designated tasks in a contested area, according to Rajib Roy, Director of QuickPay Pvt Ltd.
9. So far, drones procured by the Indian Army did not have firmware-level vulnerabilities checked. The suite will close this critical gap.
10. There are approximately 14 types of vulnerabilities that the labs can detect. These include geospatial vulnerabilities, such as a malfunction that occurs when flying over a certain location, or issues that prevent a drone from reaching its preset destination.
11. Other vulnerabilities involve unused and hidden codes that could cause a drone to terminate before reaching its target. Additionally, there are time and location bugs that may cause a drone to operate normally except at specific times or locations.
12. The use of Chinese components in military drones has been a cause of concern for India, especially since many of these drones are used in operations along the eastern borders.
13. Considering significant national security risks and possible data vulnerabilities, India has previously prohibited domestic military drone manufacturers from using parts made in China.
14. In 2025, the Army Design Bureau submitted a detailed framework to the Ministry of Defence aimed at eliminating Chinese-origin components from UAVs.
15. People involved with the project said that AASHVAST labs will also examine drones for Chinese and/or other foreign-origin active components, as well as hidden passwords, embedded keys, remote access tools and location-based security controls.
16. “This will help prevent situations where active components sourced from China are misrepresented as ‘made in India’ or another country, based solely on the invoice indicating their point of purchase,” a person involved with setting up the lab said.
17. On August 14, the Indian Army’s Additional Directorate General of Public Information had posted on X: “Equipped with advanced capabilities AASHVAST will enable evaluation of critical defence platforms thereby increasing cyber resilience. Aligned with the national vision of #AtmanirbharBharat, the facility will strengthen operational readiness as well as promote growth of the domestic defence ecosystem.”
BEYOND THE NUGGET: India’s cyber threat landscape and key cybersecurity institutions:
1. Cyber intelligence firm CloudSEK’s 2024 report placed India as the second-most cyber-attacked nation after the US. Its Global Threat Landscape Report 2025 placed India sixth.
2. According to the India Cyber Threat Report 2025, jointly published by the Data Security Council of India (DSCI) and Seqrite, India recorded over 369.01 million malware detections across 8.44 million endpoints in 2024—an average of 702 potential security threats every minute.
3. The 2020 Mumbai power grid attack, allegedly linked to Chinese hackers, illustrated how critical infrastructure vulnerabilities could be exploited during military tensions.
4. During Operation Sindoor, Pakistan-backed threat actors such as APT36 targeted India’s critical sectors, including the Ministry of Defence, Army, Navy and DRDO, and for the first time, Bharat Operating System Solutions (BOSS) Linux.
5. They also disrupted government IT infrastructure such as the National Informatics Centre and targeted state-level educational and government portals — exposing the vulnerability of India’s critical infrastructure to coordinated offensive cyber operations.
6. In the past two decades, India has developed a panoply of cyber institutions to protect its cyber space.
7. The establishment of the office of the National Cyber Security Coordinator (NCSC) which advises the Prime Minister’s Office (PMO) and National Security Advisor (NSA) marked the recognition of cyber resilience as a key strategic priority.
8. India’s Computer Emergency Response Team (CERT-IN), set up legislatively through Section 70B of the Information Technology Act, detects and responds to cyber incidents, furthers capacity and awareness, and proactively issues cybersecurity advisories and guidelines.
9. Other key cyber institutions include the National Critical Information Infrastructure Protection Centre (NCIIPC), the Defence Cyber Agency (DyCA) drawing from the three branches of the armed forces and the MHA’s Indian Cyber Crime Coordination Centre (I4C) that deals with domestic cyber crime issues.
Post Read Questions
(1) The terms ‘WannaCry, Petya and Eternal Blue’ sometimes mentioned in the news recently are related to (UPSC CSE, 2018)
(a) Exoplanets
(b) Cryptocurrency
(c) Cyber attacks
(d) Mini satellites
(2) In India, the term “Public Key Infrastructure” is used in the context of? (UPSC CSE , 2020)
(a) Digital security infrastructure
(b) Food security infrastructure
(c) Health care and education infrastructure
(d) Telecommunication and transportation infrastructur
(3) Keeping in view of India’s internal security, analyse the impact of cross-border cyber-attacks. Also, discuss defensive measures against these sophisticated attacks. (UPSC CSE GS-III/2021)
Answer key: 1. (c) 2. (a)
(Sources: New Army labs to weed out Chinese parts and hidden bugs in drones, India’s cyber doctrine has an ambitious vision, but there are implementation challenges, India is one of the most cyber-attacked nations. Here’s how AI adds another layer to the threat)
🚨Click Here to read the UPSC Essentials magazine for September 2026. Share your views and suggestions in the comment box or at raveena.baneta@indianexpress.com🚨
Subscribe to our UPSC newsletter. Stay updated with the latest UPSC articles by joining our Telegram channel – Indian Express UPSC Hub, and follow us on Instagram and X
Indian Army will deploy six AASHVAST labs nationwide for mandatory drone and CCTV cybersecurity screening to counter operational vulnerabilities. (Representational Image generated with AI) 
Differences between Hardware, Firmware and Software (Infographic generated by AI).
Share
