Research Projects
We build in the open. Every project is aimed at protecting real people — citizens, businesses, NGOs and government — and strengthening India's collective digital resilience. All research is free and publicly available.
Active projects 10
Project Privacy Shield
Open research and tooling that helps citizens, journalists and activists reduce their digital footprint, evade surveillance capitalism and understand their rights under the DPDP Act.
- Threat-model templates for journalists, activists and everyday users.
- Browser-hardening guides and a self-audit toolkit, freely downloadable.
- Data-broker opt-out automation and metadata minimisation research.
- Legal-aid integration: mapping privacy violations to DPDP Act remedies.
Kardama Cipher — Secure Communications
A privacy-first encrypted communication platform with end-to-end encryption, forward secrecy and metadata-resistant design, built for at-risk organisations and sensitive government use.
- End-to-end encryption using the Signal Double Ratchet algorithm.
- Sealed-sender style metadata protection — even Kardama cannot read messages.
- Reproducible builds and periodic independent security audits.
- Available for Android, iOS and desktop; on-premise deployment option for government customers.
Kardama Shield — Mobile Security
An on-device security companion for Android that detects risky permissions, rogue Wi-Fi, known-malicious apps and stalkerware — entirely offline.
- Permission-risk scoring with least-privilege recommendations.
- Rogue Wi-Fi and evil-twin access point detection.
- Offline IOC matching against curated malware databases.
- Stalkerware detection module — aimed at protecting domestic abuse survivors.
Indian Threat Intelligence Commons
An open threat intelligence feed and analysis workflow curating indicators relevant to Indian enterprises, government portals and financial institutions — shared freely with the community.
- Curated IOC feeds with confidence scoring, updated hourly.
- Phishing-kit and banking-fraud campaign tracking targeting Indian victims.
- Free takedown-assistance playbooks and domain abuse reporting.
- STIX/TAXII compatible — integrates with enterprise SIEMs.
Critical Infrastructure Security
Research into the cyber resilience of India's power grid, water utilities, railway networks and financial market infrastructure — and policy recommendations for their protection.
- OT/SCADA security assessment methodology adapted for Indian operators.
- Vulnerability research with responsible disclosure to CERT-In.
- Published framework: "Securing India's Critical Infrastructure 2030".
- Collaboration with IITs and NIC on resilience testing frameworks.
Election Integrity & Cyber Security
Research into threats against democratic processes — disinformation campaigns, EVM security analysis, voter-data privacy and the cyber threat landscape around Indian elections.
- Disinformation and deepfake detection research for electoral contexts.
- Voter-data breach monitoring and responsible disclosure.
- Independent security research on digital voting infrastructure.
- Policy briefs delivered to Election Commission and Parliamentary committees.
AI & Deepfake Security Research
Research into adversarial attacks on AI systems, deepfake detection, AI-generated fraud and the security implications of large language models deployed in Indian enterprises.
- Deepfake detection models trained on Indian-context audio and video.
- Adversarial robustness testing for AI used in government and banking.
- LLM security assessment framework for enterprise deployments.
- Public awareness campaign: "Is That Real?" — deepfake literacy for citizens.
Financial Fraud & Cyber Crime Research
Research into the evolving landscape of UPI fraud, banking trojans, SIM-swap attacks and online financial crime targeting Indian consumers — with free victim-assistance resources.
- Real-time UPI fraud pattern analysis and alerting.
- Banking trojan tracking specifically targeting Indian payment apps.
- Free helpline integration: victim-support resources and police complaint templates.
- Quarterly reports shared with RBI, NPCI and state police cybercells.
Kardama Cyber Range
A hands-on HTB/OSCP-inspired lab environment where students practise offensive and defensive skills against realistic machines — India's first free non-profit cyber range.
- Progressive machines from beginner to expert difficulty.
- Guided walkthroughs unlocked after successful submission.
- Seasonal CTF tournaments with industry-recognised certificates.
- Special tracks for government and law enforcement trainees.
Cyber Law & Policy Research
Rigorous legal and policy research informing India's cyber legislation, international cyber norms participation and regulatory framework development.
- Analysis of proposed IT Act amendments and their security implications.
- India's participation in UN GGE and Open-Ended Working Group on cyber norms.
- DPDP Act implementation research and enterprise guidance.
- Model state-level cyber security policy framework.
Incubating 1
Software Supply Chain Security
Research into vulnerabilities in the open-source and commercial software supply chains that underpin Indian enterprises and government digital services.
- Dependency risk scoring for open-source libraries used in Indian GovTech.
- Typosquatting and malicious package detection for PyPI and npm.
- SBOM (Software Bill of Materials) tooling and policy advocacy.
- Coordinated disclosure programme for supply-chain findings.