What are the legal challenges in securing legacy systems within critical infrastructure?

Introduction
Legacy systems—outdated hardware, software, or infrastructure that are still in use due to their critical functions—pose serious cybersecurity vulnerabilities. They are prevalent in sectors such as power generation, water treatment, defense, healthcare, and manufacturing. Many of these sectors form part of a nation’s Critical Information Infrastructure (CII). While these systems may be operationally stable, they often lack modern security features and compatibility with new security protocols, creating high-risk environments for cyberattacks. Legally, securing legacy systems within critical infrastructure brings unique challenges involving compliance, accountability, liability, and data protection.

This detailed explanation explores the legal difficulties in securing legacy systems, especially within the context of Indian law, international norms, and critical infrastructure management. It discusses regulatory gaps, compliance hurdles, procurement limitations, and enforcement challenges, supported by examples.

1. What Are Legacy Systems in Critical Infrastructure?
Legacy systems refer to older computer systems, software applications, operating systems, or network components that:

  • Are no longer supported by vendors or OEMs

  • Cannot be patched or updated

  • Are incompatible with modern cybersecurity tools

  • Are critical for ongoing operational functions

Examples include:

  • SCADA systems used in power plants that run on Windows XP

  • Outdated avionics in defense and transport systems

  • Unpatched medical equipment software in hospitals

  • Legacy routers and switches in telecom exchanges

Despite their vulnerabilities, replacing them can be costly, time-consuming, and operationally risky, which leads to legal and security complications.

2. Legal Obligation to Secure Critical Infrastructure in India
Under the Information Technology Act, 2000, specifically Section 70, systems designated as Critical Information Infrastructure must have adequate protection. The National Critical Information Infrastructure Protection Centre (NCIIPC) issues guidelines that CII operators must follow. Legally, entities managing legacy systems within CII are required to:

  • Identify vulnerabilities

  • Implement reasonable security safeguards

  • Report incidents promptly

  • Comply with NCIIPC advisories and CERT-In guidelines

Failure to comply can lead to penalties under the IT Act, Data Protection Laws, or sector-specific regulations (like RBI for banking, CEA for power, DoT for telecom).

3. Key Legal Challenges in Securing Legacy Systems

a. Lack of Statutory Clarity on Minimum Security Baselines for Legacy Systems
One of the biggest challenges is the absence of specific legal standards tailored to legacy technologies. While NCIIPC and CERT-In issue best practice documents, there is:

  • No legally binding minimum cybersecurity requirement for legacy systems

  • No clear exemptions or waivers for systems that physically cannot be upgraded

  • Ambiguity on who is responsible—the infrastructure owner or the equipment supplier—for ensuring cybersecurity in obsolete systems

Example: If a hospital uses a CT scan machine running on unsupported software, and a ransomware attack compromises patient data, it is unclear whether the manufacturer or the hospital bears legal responsibility.

b. Supply Chain and Procurement Law Limitations
Legacy systems often rely on obsolete components or foreign software with expired licenses. Under India’s Public Procurement Policy, updating or replacing such systems can face:

  • Long tendering cycles

  • Restrictions on procurement from foreign vendors

  • Absence of cybersecurity clauses in original contracts

This makes it legally difficult for organizations to comply with cybersecurity mandates, especially in time-sensitive upgrades.

c. Challenges in Applying Data Protection and Privacy Laws
The Digital Personal Data Protection Act, 2023 (DPDPA) requires entities handling personal data to implement reasonable security safeguards. However, legacy systems:

  • Often lack encryption, access controls, or data audit trails

  • Cannot integrate with modern consent management platforms

  • May store personal data insecurely due to design constraints

In a breach scenario, the data fiduciary (e.g., a hospital) may be held liable even if the breach was due to an unupgradable legacy system. This creates legal exposure without practical mitigation options.

d. Risk of Non-Compliance with CERT-In Guidelines
CERT-In’s April 2022 directive mandates organizations to:

  • Report cyber incidents within 6 hours

  • Enable logs and retain them for 180 days

  • Synchronize clocks with NTP servers

  • Share system configuration and vulnerability reports when requested

Legacy systems often cannot meet these technical prerequisites, leading to unintentional legal non-compliance, which may attract penalties or scrutiny.

e. Attribution and Incident Response Difficulties
Legacy systems are difficult to monitor using modern forensic tools. In case of an attack:

  • Attribution becomes hard

  • Evidence may not be admissible due to lack of audit trails

  • The incident response is delayed, increasing impact and legal liability

For law enforcement and regulators, this lack of traceability complicates investigation and prosecution.

4. Legal Liability and Accountability Issues

a. Multi-Party Responsibility Confusion
Critical infrastructure may be managed by public-private partnerships, with ownership, operations, and IT support divided among multiple stakeholders. In a breach involving legacy systems, legal liability becomes diffused and disputed.

Questions that arise include:

  • Is the OEM responsible for not providing updates?

  • Is the operator liable for using unsupported systems?

  • Should the government have mandated decommissioning?

b. Civil and Criminal Liability Risks
Under the IT Act, unauthorized access or data breach due to poor security can invite:

  • Civil liability for damages to affected users

  • Criminal penalties if negligence amounts to breach of public safety

  • Possible action under Section 66, 66F (Cyberterrorism), or 70 (unauthorized access to protected systems)

For instance, a power grid outage caused by a malware exploiting an old Windows vulnerability could result in both regulatory sanctions and lawsuits.

5. Sector-Specific Legal Challenges in India

a. Power Sector (CEA Guidelines)
The Central Electricity Authority (CEA) has introduced cybersecurity regulations for thermal, nuclear, and hydro plants. But many legacy grid systems:

  • Are incompatible with SIEM or SOC integration

  • Cannot be hardened without significant downtime

While legal guidelines exist, no enforcement mechanism ensures phased upgrades for such legacy setups.

b. Banking Sector (RBI Circulars)
RBI mandates cybersecurity audits, third-party risk assessments, and data protection in banks. However, core banking systems developed in the early 2000s often:

  • Cannot implement two-factor authentication

  • Lack real-time monitoring compatibility

In such cases, banks struggle to meet RBI’s compliance checklist, exposing them to fines or reputational harm.

c. Health Sector (NDHM & DPDPA)
Under the National Digital Health Mission, hospitals are expected to comply with DPDPA’s data protection mandates. But older EHR (Electronic Health Record) systems:

  • May not support encryption

  • May not log access events

  • Could be vulnerable to SQL injection or buffer overflow attacks

This makes healthcare institutions legally vulnerable to penalties and lawsuits in the event of breaches.

6. Global Legal Landscape and Challenges

a. GDPR and Legacy Systems
Under the General Data Protection Regulation (GDPR) in the EU, data controllers must ensure “data protection by design and by default.” Using legacy systems without adequate security controls can be considered non-compliance, even if the systems are technically irreplaceable.

b. US NIST and FISMA Requirements
In the United States, the Federal Information Security Modernization Act (FISMA) and NIST guidelines mandate continuous monitoring. Legacy systems in federal infrastructure must be isolated, monitored, or decommissioned—failure to do so invites legal scrutiny.

7. Strategies to Overcome Legal Challenges

a. Legal Frameworks for Gradual Transition
India could consider introducing legal mechanisms such as:

  • “Safe harbor clauses” for legacy systems with compensatory controls

  • Time-bound upgrade mandates with phased compliance targets

  • Sector-specific legal exemptions accompanied by detailed risk disclosures

b. Mandated Vulnerability Disclosure Programs
Legal frameworks can be amended to require vendors of legacy systems to disclose known vulnerabilities, even if end-of-life support has ended.

c. Integration of Cyber Insurance Laws
Allowing entities managing legacy systems to buy cyber liability insurance could legally mitigate their financial risks from breaches.

d. Enabling Legal Sandbox Testing
The government can create regulatory sandboxes where legacy systems are tested under simulated cyberattacks to determine compliance gaps and legal exposure.

Conclusion
Securing legacy systems within critical infrastructure is not merely a technical challenge but a profound legal one. Outdated technologies often run mission-critical operations but fall short of meeting modern cybersecurity laws. Legal frameworks—such as India’s IT Act, sectoral regulations, and the DPDPA—impose obligations that legacy systems may be structurally unable to meet. This creates a compliance paradox, where entities must choose between operational continuity and legal compliance. To address this, a balanced legal approach is essential—one that incentivizes modernization while allowing for temporary legal accommodations with appropriate safeguards. Only then can critical infrastructure become both operationally stable and legally secure in the digital age.

Priya Mehta

Posts