Sahyog: How India Built One of the World's Most Difficult Internet Governance Platforms

In the global debate on internet governance, most countries have struggled with the same impossible trilemma: how to act fast enough to stop real harm online, how to keep the process lawful and accountable, and how to get thousands of separate actors - police officers, ministries, and tech platforms - to actually cooperate.

With the Sahyog portal, India has quietly solved it.

Launched in October 2024 by the Ministry of Home Affairs and operated by the Indian Cyber Crime Coordination Centre (I4C), Sahyog is not just another government website.

It is a piece of critical criminal infrastructure disruption architecture - a centralized, secure, and auditable bridge between India's lawful authorities and the internet intermediaries that host India's digital life.

And its success is a case study in modern internet governance best practice.

1. The Problem No One Else Had Solved at Scale

Before Sahyog, the system was broken on both ends.

An investigating officer in a district cyber cell tracing a child sexual abuse material (CSAM) ring, a mule account network, or a phishing call centre impersonating Amazon, had to send separate emails to Meta, Google, Telegram, WhatsApp, Microsoft.

• Formats differed.
• No acknowledgement.
• No tracking.

A time-sensitive request for subscriber data of a missing 19-year-old, as the Delhi High Court noted in Shabana vs Govt. of NCT of Delhi (2024) where Sahyog was first disclosed, could get lost for weeks.

For intermediaries, it was chaos - thousands of notices in different formats, from unverified email IDs, with no way to confirm authority.

For citizens, it was delay in justice.

The global norm was either informal, opaque back-channel takedowns, or slow court-driven processes that don't match internet speed.

2. What Sahyog Actually Is: A Facilitation Mechanism, Not Censorship

As the Government has stated before the Delhi and Karnataka High Courts, Sahyog is defended not as a censorship tool, but as a facilitation mechanism.

It works on a simple, globally accepted legal principle: Safe Harbour is a privilege, not a right.

Under Section 79 of the IT Act, 2000, intermediaries are protected from liability for what users post.

Under Section 79(3)(b), that protection is conditional - if they receive "actual knowledge" from the government about unlawful content and fail to act expeditiously, they lose immunity.

Sahyog operationalizes this.

It provides:

• a) A Unified, Authenticated Channel: Only authorized agencies of the Centre, States and UTs, vetted by I4C, can log in. No more fake notices from spoofed emails.
• b) Standardization and Auditability: Every request has a standard format, a timestamp, a legal provision cited, and an audit trail. This is the opposite of opaque censorship - it is documented governance. Data presented to the Indian Express via RTI showed 130 notices in the first 5 months - a transparent, countable number, unlike informal takedown calls.
• c) Speed with Accountability: Intermediaries are notified through the dashboard and required to act within 36 hours as per IT Rules, 2021. This matches the velocity of viral crimes - non-consensual intimate imagery, deepfake scams, drug trade, terror recruitment - where every hour of delay means re-victimization, especially for women and children, as Justice M. Nagaprasanna noted while calling Sahyog an "instrument of public good" and "beacon of cooperation."

The result: 38 major intermediaries including Google, Microsoft, Amazon, Apple, Telegram have already integrated.

It is now the national backbone for cybercrime disruption.

3. Why This Is an Internet Governance Best Practice

For the world, Sahyog offers four lessons:

1. Sovereignty with Due Process: The Karnataka High Court in X Corp vs Union of India (2025) was clear: India cannot be treated as a "mere playground where information can be disseminated in defiance of statutes." Sahyog asserts that entering the Indian market is a privilege tied to responsibility, while still operating under a published law, unlike secretive blocking.
2. From Fragmentation to Federation: Instead of 28 states creating 28 portals, I4C built one interoperable platform for all. This is cooperative federalism applied to cyberspace - a model many federal democracies have failed to achieve.
3. Protecting the Most Vulnerable, Fast: International frameworks like the US TAKE IT DOWN Act, 2025 criminalize NCII and deepfakes and demand expeditious takedown. Sahyog brings India to parity, allowing a victim of intimate image abuse in Delhi to get relief in hours, not months of litigation.
4. Disrupting the Criminal Infrastructure: Sahyog is not just about speech. Its real use is criminal infrastructure disruption - taking down fake investment sites, offshore betting gateways, phishing domains, Google's Firebase C2 domains, Malicious Apps on Playstores, fake facebook & instagram advertisements that fuel India's Rs 10,000+ crore cyber fraud economy.

The Difficult Achievement

Building Sahyog was not easy.

It required aligning the IT Act, the 2021 and 2023 IT Rules amendments, authorization & appointment of nodal officers in each States & Ministries, I4C's cybercrime mandate, and getting competing tech giants to integrate with a single government system.

Few countries have managed this.

The EU's Digital Services Act still struggles with cross-border takedown coordination.

The US relies on a patchwork of private company policies.

India did it - a secure, centralized, auditable platform that protects safe harbour for compliant intermediaries, ensures accountability for non-compliant ones, and most importantly, safeguards citizens from real cyber harm.

Sahyog is not about more control of the internet.

It is about making the internet governable - lawfully, quickly, and at India-scale.