First Principles IASlearning from first principles

External state and non state actors

Syllabus
Role of external state and non-state actors in creating challenges to internal security
As of
October 2026
  • state actor
  • non state actor
  • proxy war
  • hybrid warfare
  • grey zone
  • deniability
  • sanctuary
  • two front challenge
  • state sponsored terrorism
  • front organisation
  • Financial Action Task Force
  • UNSC 1267 listing
  • Operation Sindoor
  • diaspora extremism

The first principle

A state that cannot win a war against a stronger rival, or does not want the cost of one, can still hurt that rival by working through others: armed groups, smugglers, hackers and propagandists who do the damage while the state denies any role. This is cheap for the sponsor and costly for the target, because the target must defend everywhere and can rarely prove who is behind an attack. India's internal security is shaped by this logic, so the task is to defend at home, prove the link abroad and make the sponsor pay a price it can feel.

The core

The actors

  • External state actors are foreign governments and their agencies, such as an army or an intelligence service, that act against India directly or through others. They bring what non state groups lack: sanctuary, training, money, diplomatic cover and sometimes advanced technology.
  • Non state actors are groups without the authority of a state: terrorist and insurgent groups, organised crime syndicates, hawala operators, drug cartels, hackers for hire and online radicalisers. Some act on their own; many are used, funded or shielded by a state.
  • The link between them is what makes the threat hard: a non state group gives the state deniability, and the state gives the group a safe base, which together let a weak actor strike a strong one for years.

The concepts

  • Proxy war is conflict carried on through a third party, so the sponsor's own forces stay out; Pakistan's support to militant groups in Jammu and Kashmir since 1989 is the clearest Indian case.
  • Hybrid warfare, a term popularised by the American analyst Frank Hoffman in 2007, is the use of regular forces, irregular fighters, terrorism, crime, cyber attacks and propaganda together, in the same space and time, to confuse and overload the defender.
  • Grey zone action stays below the threshold that would justify a war: slow encroachment on a disputed border, cyber intrusion or economic pressure, each step too small to answer with force.
  • The two front challenge is the planning problem of facing pressure from Pakistan and China at the same time, made sharper by the close ties between the two.
Two by two matrix of external threats: state and non state actors against violent and non violent means, with examplesWho acts, and by what meansViolentNon violentStatecross borderfiringarmed proxiesdrones witharmsborder clashescyber intrusiondisinformationfake currencyeconomiccoercionNon stateterror groupsinsurgents withcamps abroadarms smugglershawala networksdrug cartelsonlineradicalisershackers forhirekineticgrey zoneHybrid warfare combines all four boxes, so nosingle agency can answer it.
Figure: External threats sorted by who acts, a state or a non state actor, and by the means, violent or non violent; hybrid warfare draws on all four boxes.

Dimensions

  • Military and border. Infiltration across the Line of Control (LoC), drones that drop weapons and narcotics over Punjab and Jammu, and standoffs on the Line of Actual Control (LAC) with China, at Doklam in 2017 and in eastern Ladakh since 2020, keep large forces tied to the borders.
  • Financial. Hawala networks, fake Indian currency notes, drug money and foreign donations routed through fronts pay for violence, which is why the Financial Action Task Force (FATF) and the Foreign Contribution (Regulation) Act 2010, amended in 2020, are counter terror tools.
  • Cyber and information. State linked hacking groups probe power, health and government networks, and coordinated online campaigns spread disinformation and radical content, so cyberspace is now a border of its own; the cybersecurity and social media notes cover this.
  • Economic. Dependence on a hostile state for critical goods, apps or investment creates a lever, which is why India requires government approval for investment from countries that share a land border with it under Press Note 3 of 2020.
  • Diaspora and ideology. Small extremist groups abroad, such as those pressing for Khalistan, raise money and run propaganda from foreign soil, and global groups such as the Islamic State of Iraq and Syria (ISIS) and al Qaeda in the Indian Subcontinent, announced in 2014, try to recruit Indians online.
  • Diplomatic. A sponsor uses its friends to shield its proxies, as when China kept blocking the United Nations (UN) listing of Jaish-e-Mohammed (JeM) chief Masood Azhar until May 2019.
Table of India's neighbours, the main security channel through each, and India's responseNeighbours and the channels of threatPakistanThreat: proxy groups, infiltration, dronesover Punjab, fake currencyResponse: border grid, strikes on camps, FATFand UN pressureChinaThreat: pressure on the LAC, cyber intrusion,holds on UN listingsResponse: border roads and troops, app bans,investment screeningBangladeshThreat: past shelter to North East groups,smugglingResponse: cooperation since 2009, LandBoundary Agreement 2015MyanmarThreat: insurgent camps, drugs, refugee flowsResponse: joint action, border fence, tighterfree movementNepalThreat: open border misused by modules andfake currencyResponse: Sashastra Seema Bal, policecooperationhostile state threatnon state misuse
Figure: How each neighbour figures in India's internal security, either as a hostile state or as territory that non state groups misuse, and how India has responded.

In practice

Cases and their lessons

  • Kandahar hijack, 1999. Indian Airlines flight IC-814 was hijacked to Kandahar in December 1999, and India released Masood Azhar to free the passengers; he founded JeM in 2000. The lesson was that a concession to hijackers can seed a new and deadlier group.
  • Mumbai, 2008. The attackers were trained in Pakistan and guided by handlers by phone during the attack, which showed a state's territory and agencies behind a non state strike. India built a case through dossiers, courts and diplomacy, and international pressure on terror financing later kept Pakistan on the FATF grey list from June 2018 to October 2022.
  • Myanmar, 2015. After insurgents killed 18 soldiers in an ambush in Chandel, Manipur, in June 2015, the Army struck their camps across the border, showing that sanctuary in a neighbour's territory need not be safe.
  • Galwan, 2020. Twenty Indian soldiers were killed in a clash with Chinese troops in the Galwan valley on 15 June 2020. India answered with troops and roads on the LAC, a ban on 59 Chinese apps under Section 69A of the Information Technology Act in June 2020, and screening of Chinese investment.
  • Pahalgam and Operation Sindoor, 2025. After the Pahalgam attack of 22 April 2025, which The Resistance Front (TRF), a front of Lashkar-e-Taiba (LeT), first claimed and later disowned, India held the Indus Waters Treaty in abeyance and launched Operation Sindoor on the night of 6 and 7 May 2025 against nine terrorist sites in Pakistan and Pakistan occupied Jammu and Kashmir (PoJK). Firing stopped on 10 May 2025, and the Prime Minister declared that India would make no distinction between terrorists and their sponsors and would not accept nuclear blackmail. The United States designated TRF a Foreign Terrorist Organisation in July 2025.

The legal and institutional toolkit

  • Bans and designations. Under the Unlawful Activities (Prevention) Act 1967 (UAPA), groups are listed in the First Schedule and, since 2019, individuals in the Fourth; Masood Azhar, Hafiz Saeed, Zaki-ur-Rehman Lakhvi and Dawood Ibrahim were the first individuals designated, in September 2019. Sikhs for Justice was banned in 2019 and the Popular Front of India in September 2022.
  • Border and money. The border guarding forces, the National Investigation Agency (NIA), the Enforcement Directorate and the financial intelligence unit work on the routes by which men, arms and money cross; the border management and terror financing notes cover them.
  • Diplomacy. India presses for listings at the UN Security Council's 1267 committee, for FATF scrutiny of sponsors and for the Comprehensive Convention on International Terrorism, and it shares intelligence through joint working groups with partners.
Flowchart of a proxy war chain from a sponsor state to an attack, with deniability rising at each layerThe proxy chainSponsor statesets the aim, gives sanctuaryIntelligence handlerstraining, money, weapons, targetsBanned group behind a front nameclaims under a new nameLocal recruits and helpersguides, shelter, informationAttackon forces, civilians or symbolsdeniability growsThe arrow on the right: each layer puts moredistance, and more deniability, between thesponsor and the attack.
Figure: The layers between a sponsor state and an attack; each layer adds distance and deniability, which is why proving the link is the hardest part of the response.

Issues and way forward

  • Attribution. A sponsor hides behind front names, cut outs and encrypted links, so India needs strong technical and human intelligence and evidence that stands up in courts and before partners abroad.
  • Escalation. A military answer to a proxy attack risks a wider conflict between nuclear armed neighbours, so each response has to be measured, aimed at terrorist infrastructure and backed by clear communication, as India stressed in 2016, 2019 and 2025.
  • Grey zone pressure. Slow moves on the LAC, cyber probing and economic levers are too small for a military answer, so building border roads, protecting critical networks and cutting dependence on hostile supply chains are the answers.
  • Shields at the UN. Technical holds by a permanent member can block listings for years, so India works through partners, the FATF and bilateral sanctions as well.
  • The home front. External actors exploit local grievance, unemployment and division, so good governance, quick justice and social cohesion deny them recruits, which no border fence can do.
Timeline of India's responses to major cross border attacks from 2008 to 2025, each raising the cost for the sponsorRaising the cost for the sponsor2008Mumbai attacksdossiers, diplomacy and UN listings2016Uri attacksurgical strikes on launch pads across theLoC2019Pulwama attackair strike on a JeM camp at Balakot inPakistan2025Pahalgam attackIndus Waters Treaty in abeyance; OperationSindoor on nine sitesThe bar grows with the response: from diplomacy,to strikes across the LoC, to strikes deep insidePakistan.
Figure: India's responses to four major cross border attacks from 2008 to 2025, each raising the cost for the sponsor.

Common confusions

  • Proxy war and hybrid war. A proxy war is fought through a third party, while hybrid war mixes many tools, of which proxies are only one.
  • State sponsored terrorism and state terrorism. The first is a state backing non state terrorists against another country, while the second is a state using terror against its own people.
  • Grey zone and hybrid war. Grey zone action deliberately stays below the threshold of war, while hybrid war can include open fighting alongside other tools.
  • Non state actor and illegal actor. A non state actor is simply one without state authority, which includes legal bodies such as firms and charities; it becomes a security threat when it uses or funds violence or crime.

For the exam

  • Keyword bank: state actor, non state actor, proxy war, hybrid warfare, grey zone, deniability, sanctuary, two front challenge, front organisation, state sponsored terrorism, FATF grey list, UNSC 1267 listing, UAPA designation, diaspora extremism, Operation Sindoor.
  • Previous year questions: Practise the previous year questions on this topic →
  • Use in an answer:
    • Introduction with data: Pakistan stayed on the FATF grey list from June 2018 to October 2022 for failing to curb terror financing, a sign that the world now treats sponsorship of non state groups as a state's own responsibility.
    • Introduction with a source: In his address of 12 May 2025 after Operation Sindoor, the Prime Minister said India would make no distinction between terrorists and the governments that sponsor them.
    • Conclusion: External actors succeed where they find local grievance and weak institutions, so India's best defence pairs firm borders and a credible response with good governance at home.
    • Conclusion: Against hybrid threats no single agency is enough, and India needs intelligence, diplomacy, finance, cyber defence and the armed forces to act as one system.