Cyber Moral: The Ceremony
A story from the Cyber Moral series, on the gap between what we preach and what we practise. The department, the people and the portal are fictional. The October 2026 incidents are real.
The certificate on the wall
The security audit certificate hung in a gold frame outside the Joint Director's cabin. It said the citizen services portal was "safe for hosting," and it carried three signatures and a hologram.
Arjun walked past it every morning. He was twenty-six, eight months into his first government posting, and the only person on the floor who still read CERT-In advisories for fun.
The department was proud of that frame. It appeared in every presentation, every review meeting, every reply to an RTI query about data safety. Nobody had opened the server it described in two years.
How the portal was bought
The portal had been built three years earlier, under a tender with a forty-page security annexure. It asked for OWASP compliance, encryption at rest, quarterly patching and a named security officer. On paper, it was excellent.
In practice, the tender was decided before it opened. A consultant visited the right offices, and four companies bid. Three of them had quoted high on purpose. The fourth won at the lowest price, which the rules call L1, and nobody asked how anyone could deliver forty pages of security at that price.
The answer was simple: they couldn't, and they didn't plan to. The annual maintenance contract covered "uptime," not upgrades. The named security officer had left the vendor within a year. Quarterly patching became a line in a quarterly report.
Arjun once asked his boss, Deshpande sir, why the server still ran a PHP version from 2019. Deshpande sir pointed at the frame. "It is audited," he said, and the conversation was over.
The night of 20 October
On 20 October 2026, details of a critical PHP flaw leaked online, two days before the planned fix. It was later tracked as CVE-2026-109618 and nicknamed PHP2Shell. It had sat in PHP's core since 2012, and it let anyone on the internet run code on a server with a single crafted request.
Arjun read the news at 11 p.m. on his phone. By midnight, he was reading something stranger. Finnish government sites, the French government website, the Dutch national cyber security centre and the Port of Rotterdam had all taken themselves offline as a precaution.
He sat up in bed. These were governments with far bigger budgets and far better engineers. And they had chosen to go dark rather than gamble.
He messaged Deshpande sir: Sir, critical PHP flaw, our portal is exposed, request permission to take it offline till patch.
The reply came at 7:40 a.m. Portal cannot go down. Minister's review on Friday. Ask vendor.
The vendor's support line said patching was "outside AMC scope" and would need a fresh work order. A fresh work order needed a file. A file needed three signatures. The frame outside the cabin had three signatures too.
The other ceremony
That same week, Arjun read about a different kind of failure, one with no tender and no middleman in it.
In April 2025, eMudhra, an Indian certifying authority, had held a key-generation ceremony for eight intermediate certificate authorities. A key ceremony is security's most solemn ritual: a hardware security module, witnesses, scripts, logs, signatures. It exists to prove that the most important secrets were made properly.
A scripting error in that ceremony produced private keys just one byte long. One of them was reportedly the number four. Every step was performed, every box was ticked, and nobody checked what came out. An independent researcher found it on 17 October 2026, about eighteen months later.
To be fair to eMudhra, it said its infrastructure was not compromised and those intermediates had issued no end-entity certificates. CERT-In said its Indian digital-signature and eSign services were unaffected. The company called it a process lapse, revoked the certificates, and later withdrew from the global SSL/TLS certificate business.
Arjun noticed what the two stories shared. One was born of corruption, the other of an honest mistake. But in both, the ceremony had been mistaken for the thing itself.
Friday
The minister's review went well. The portal was up, the dashboard was green, and the frame appeared on slide four.
The following Tuesday, a citizen called the helpline. Her application status page was showing someone else's name, someone else's Aadhaar-masked number, and a strange line of text at the bottom of the page.
Nobody ever learned exactly when the server was entered. The logs had been rotated to save disk space, another cost cut nobody remembered approving. The vendor said the breach was "due to a zero-day beyond contractual scope." The department said the system was "duly audited." Both statements were true.
Arjun wrote the incident report. In the section titled Root cause, he typed a long technical paragraph, deleted it, and wrote one line instead: We patched the paperwork and not the server.
Deshpande sir asked him to rephrase it. He did. But he kept a copy.
The moral
A ceremony is not a control, and a certificate is not security.
We preach security through documents: annexures, audit reports, policies, framed certificates. We practise it, or fail to, in small unglamorous moments. Who is allowed to take a site offline at midnight? Who is paid to patch? Who checks the key after the ceremony ends?
The PHP bug was not India's fault; it hit Paris and Helsinki too. The difference was what happened next. Some governments could switch off a website in hours because someone had the authority and the incentive to do it. Our fictional department could not, because every incentive pointed the other way.
A few practices that close the gap:
- Buy maintenance, not just a build. Put patching inside the contract, with a deadline in days after a critical advisory, and pay for it.
- Stop rewarding the lowest bid alone. Score vendors on security capability, and disqualify bids priced below what the security annexure costs to deliver.
- Give someone the kill switch. Name, in writing, the person who can take a system offline during a critical vulnerability, without a file.
- Verify outputs, not just steps. Check what the process produced: the actual version on the server, the actual key length, the actual logs.
- Keep the logs. Retention is cheaper than an investigation you cannot finish.
The next time someone points to a frame on the wall, ask a simpler question: when was the server last touched?
Member discussion