An Indian Cyber Security Mechanism: Need of the Hour

Along with outer space, cyber space is slowly but surely emerging as a new frontier of the war. While in a space war, the adversary’s movement can be, to a large extent predicted, with a fairly good degree of certainty and counter measures deployed well in advance, in the cyber battlefield, the enemy not only remains invisible but also enjoys the advantage of deciding upon the timing and nature of the attack designed to inflict “maximum damage” on the adversary. Indeed, in a cyber war, stealth and anonymity stand out as the trump card of the enemy. A large section of strategic analysts continue to hold the view that the next world war could very begin and end in cyberspace without a single shot being fired. Indeed, by targeting public utilities, transport infrastructure, banking networks, nuclear installations and industrial units, paralysing the entire country in one quick sweep is by no means constitutes a challenging task. Even the mighty Pentagon has found it difficult to ward off cyber attacks.

The notorious Stuxnet worm, which in 2010 had temporarily paralysed an Iranian nuclear facility, has become a major weapon in the hands of cyber hackers bent upon putting out of commission a wide spectrum of systems and services including satellites parked in earth orbit. In fact, a couple of years back, there were reports to suggest that one of the satellites in India’s INSAT domestic spacecraft constellation being operated by the Indian Space Research Organisation(ISRO) was paralysed by Stuxnet. However, this was quickly discounted by ISRO which said that the problem faced by the satellite INSAT-4B had nothing to do with this notorious worm. About Stuxnet, Gulshan Rai, Director General of India’s Computer Emergency Response Team(CERT-In) has this to say, “Stuxnet, the first computer worm to impact critical infrastructure such as nuclear power plants, water treatment facilities and other factories reaffirms that cyber attacks have evolved into extremely sophisticated activities capable of compromising utilities, government and private infrastructure and corporate intellectual property.”

Described as a tactical cyber weapon, Stuxnet was originally developed in Israel. James Lewis of the Centre for Strategic and International Studies in Washington is of view that the cyber war is around the corner. “Cyber war is already here. We are in the same place as we are after the invention of the aeroplane. It was inevitable some one would work out how to use planes to drop bombs. Militaries will now have a cyber war capability in their arsenal.” Not surprisingly then sometime back, Keith Alexander, chief of US Cyber Command functioning under Pentagon had observed that it is only a matter of time before America is attacked by something like Stuxnet worm. Pointing out to the rapid evolution of cyber warfare strategies over the last three years, Alexander has favoured agreements similar to nuclear weapons treaties. But then a major problem is the ground reality that cyber spies have no physical boundaries to negotiate while giving a practical shape to their “evil designs”. Indeed, identifying who is behind the attack will be the tough nut to crack. For a treaty to be in force identities of those involved in the entire exercise of cyber attack need to be established without any ambiguity.

Against this backdrop, experts are worried that the invisible cyber war could ultimately prove to be far more damaging than a conventional war. There is a lurking fear that the gun totting terrorists will be replaced by cyber warriors who can easily be exploited by certain transnational criminal gangs and terror groups besides states wedded to radical ideologies to further their “deadly and dangerous objectives”. There is certainly no denying the fact that with cyber attack capabilities on its finger tips, a terrorist group could easily mount a devastating attack on a country like USA. Already there is a concern in USA that China and Russia are using cyber espionage to steal the US trade and technology secrets. Dave Clemente, an expert on conflict and technology at the Royal United Services Institute of London projects the view that the hype of cyber warfare is now fast becoming a reality. “The US and the UK are now putting large amounts of resources into cyber warfare, in particular, defence against it,” said Clemente. “What I think you can say about Stuxnet is that cyber war is now very real. This appears to be the first instance of a destructive use of a cyber war weapon,” noted Clemente.

Against this backdrop, there is little surprise that India has become a sitting duck for cyber attacks. As things stand now, India happens to be the eleventh most affected country by cyber hacking. According to Rear Admiral Rahul Sharawat, Director General of Weapons, Electronics and Systems Engineering establishment of the Indian Navy, India lost Rs.34, 110-crore as a result of cyber crimes and there were close to 30- million victims in 2010-11. India boasts of more than 110-million internet users, the third largest in the world after USA and China.

The very fact that over 15,000 Indian websites were hacked during 2011 has underscored the need for India to put in place a robust cyber security mechanism supported by a well meaning national cyber policy, a well trained human resources base and a network of advanced testing facilities. Of course, the Department of Information Technology is in the process of circulating computer security guidelines along with a draft of cyber security policy to all the ministries to give a final shape to a national cyber security bill. This policy framework focuses inter alia on hacking, website defacement, identify thefts, stealing and internet fraud. “An implementable cyber policy is still not in place and we are not sure of our readiness levels to face cyber crimes. Defacement is happening frequently and that too of government websites most notably of the CBI (Central Bureau of Investigation) website that was defaced and could not be corrected for a week,” says Pavan Duggal, a Supreme Court advocate. A study by the cyber security firm Symantec reveals that during 2010, online scams accounted for 20% in India against 11% globally while phishing accounted for 19% in India against 10% globally.

US intelligence agencies are of view that Russia and China are the two leading actors in the dangerous game of cyber espionage. “Chinese actors are the world’s most active and persistent perpetrators of economic espionage,” says a US Intelligence official. Not surprisingly then Chinese hands are suspected behind most of the high profile cyber hacking incidents reported in India. China based gangs of cyber thieves are known to have broken into the networks of not only of the United Nations (UN) and US defence companies but also the Indian government networks. According to a study by McAfee, even states can directly indulge in capacity building to destroy the adversary’s economic life in times of conflict like situation without actually going to the war. As such experts have been reiterating the view point that the time has come to treat cyber attack as military incursion. Since India and US are common victims of the cyber attacks launched by criminal gangs based in mainland China, it is but appropriate that both the countries come together under the umbrella of a joint cooperation agreement. Both the countries should stress on exploiting their software prowess to engineer effective defensive firewalls to defend themselves from any cyber attacks.

Evidently, Indian defence establishment has been one of the most conspicuous victims of the China based “cyber attacks”. Not long back, networks of Indian diplomatic missions around the world, many Indian companies, think tanks and media groups had felt the heat of the well planned and neatly executed cyber crimes originating from China. Whether these Chinese cyber spies enjoy the patronage of Beijing, no one is sure as yet. But given the sophistication of the attack, one could suspect the possibility of some sort of state support to these “cyber warriors”. As it is, the US State Government in June 2011 had stated that it had asked Beijing to investigate Google’s allegation of a major hacking attempt that the internet giant had said originated in China. But the standard response from China is that it is being unfairly accused by countries unhappy with its economic rise and that it has always been a victim of cyber attacks.

That Chia was behind the discrete stealing of information from the supposedly secure networks from across the world including India came into open after the release of a painstakingly researched and well documented study “Shadows in the Cloud”. This fact filled report was an outcome of the systematic research carried out by a team of experts from Information Warfare Monitor and the Shadow server Foundation. While Information Warfare Monitor is a joint enterprise of the Citizens Lab, Munk School of Global Affairs, University of Canada and SecDev Group, an operational consultancy group based in Ottawa, the Shadow server Foundation launched in 2004 is composed of volunteer security professionals with a keen and well informed interest in monitoring malware and malicious attacks on computer networks.

Significantly, the” Shadows in the Cloud “report had thoroughly exposed the devious doings and evil machinations of the China based hackers in siphoning off of classified documents from governments agencies and private organisations in more than one hundred countries not excluding the Tibetan Government in Exile presided over by His Holiness the Dalai Lama. In this instance, the Chinese hackers based in Hainan Island are known to have exploited a system called Ghostnet to steal the files from the information networks of the Tibetan Government in Exile.

Of late, there has been a mounting concern in India’s security set up and defence establishment over the cyber threat originating from China. As revealed in a report carried by the New York Times, “the intruders pilfered classified and restricted information from the highest levels of the Indian Defence Ministry”. The defence set ups targeted by the Chinese cyber criminals included National Security Council Secretariat, 21 Mountain Artillery Brigade based in North eastern region of the country and Air Force Station in New Delhi.

On another front, the information networks operated by the Indian military training schools were also attacked by China based hackers. It has now come to light that some of the that vital data base pilfered by the Chinese hackers included the secret assessment of the security situation in the north eastern region covering states such as Assam, Manipur, Nagaland and Tripura. In addition, a part of the classified data on the state of Maoist insurgency in various Indian states was also stolen by Chinese cyber spies. Not long back, the Indian Defence Ministry had stated that “of late extraordinary and unprecedented cyber crimes have taken place across the globe, exposing the gaping holes in cyber security systems. Although defence services at all levels have taken steps to counter cyber threat through the stringent implementation of cyber security policies, there is still a requirement to ensure that all the loopholes in this regard are suitably plugged”.

The moral of the story is that a well equipped and technically robust tri-service cyber command, to prepare India for a cyber war, should be put in place without any lose of time. Such a cyber command supported by a team of well trained and highly motivated cyber commandos will ensure the safety and integrity of all the defence information and communications networks. Before giving a practical shape to a full fledged cyber command, Indian defence ministry should study the architecture, function and objectives of cyber commands existing in other countries. Indian defence ministry should rope in academic and research institutions as well as scientific organisations and software and IT firms in the country to put in place a fool proof cyber security command to ensure the safety of networks being operated by all the three wings of the services.

Meanwhile, the Defence Research and Development Organisation (DRDO) has pointed out that algorithms are being worked out to ensure cyber security. Further, it has also stressed on the need to put in place trusted hardware and exclusive operating software for the Indian defence forces that will help them develop immunity to cyber intrusion.

According to V.K.Saraswat, the DRDO chief, if one has a dedicated communications system to operate a network centric architecture, one is safer than using internet for link up. “So we are building research areas on how to provide solutions to armed forces on cyber security , how to build a robust communications systems, how to build software that will not have any weakness, how to make servers, switches and routers that will have no parallel parts that can easily be targeted by outside agencies”.

It is an open secret that the terrorist groups that mounted attacks in various Indian locations over the last one decade invariably made use of cyber space to give a practical shape to their evil design. As such, the Indian cyber command should also develop expertise to intercept internet messages and radio communications linking up various terrorist groups across the world. As it is, detection of a threat or a potential threat plays a key role in ensuring cyber security in all its manifestations. For as of now, no formal rules of engagement in cyber warfare exist at both the international as well as multi lateral levels.

On a larger canvas, the need for a high powered national security mechanism supported by a firm legal framework has become critical to take care of cyber attacks aimed at the instruments of national development including banks and financial institutions, industrial enterprises, public utilities, transport network, space and nuclear facilities, research and development institutions and health care networks. For across the world, cyber spies are active in industrial espionage and collection of economic data as part of the move to paralyse the adversary by hitting where it hurts most. And India should take care of this aspect of cyber attack with utmost diligence and a high level of shrewdness. Otherwise, the country could easily end up as a “pathetic victim” of a cyber war launched by an invisible enemy.