In this blogpost, Konina Mandal, Student, School Of Law, KIIT University, Bhubaneshwar, writes about what is cyber warfare, how is it a new weapon, incidents around the world and the position in India.

INTRODUCTION

With the advent of sophisticated technology and greater knowledge of the intricacies of  cyber security, it is not very difficult to imagine situations  which were thought to exist only in science fiction movies. Situations, where  an enemy attacks a country’s computer system controlling  a major dam causing a flood; or where the enemy corrupts the computer program which controls the country’s fighter planes or drones, and consequently the system fails and starts attacking combatants and civilians indiscriminately, are slowly turning into reality in the form of cyber warfare.

When we speak of ‘war’, traditionally, it deals with the commitment of hostilities that involve arms and more precisely involves an attempt to physically wound or kill enemy combatants. Conforming to the layman’s understanding of war, cyber warfare is also a kind of contest of force and perhaps even of arms. However, such attacks are rarely public, and the point is not always to wound or kill enemy soldiers, but to destroy property.[1] The desired effects of cyber attacks are mostly indirect, which means what would normally be considered secondary effects are in fact of central importance.[2] So naturally, the destruction of property, produces  suffering among civilians and perhaps also combatants as foreseeable secondary effect.[3]Countries’ growing dependence on computer networks hence has increased their vulnerability to cyber warfare.

THE NOTION OF CYBER WARFARE : What is Cyber Warfare?

Cyber warfare has been defined by government security expert Richard A. Clarke, in his book Cyber War (May 2010), as “actions by a nation-state to penetrate another nation’s computers or networks for the purposes of causing damage or disruption.” The Economist describes cyber warfare as “the fifth domain of warfare[4],” or even more simply put it can be defined as warfare conducted in cyberspace through Computer Network Operations (CNO) as means and methods.[5] The term“cyber warfare” contains two elements: cyber or cyberspace and warfare. Cyberspace can be defined as “the global digital communication and information transfer infrastructure” [6] and “‘warfare’ is commonly understood as referring to the conduct of military hostilities in situations of armed conflict”[7] There are three main methods of cyber warfare: sabotage, electronic espionage (stealing information from computers via viruses) and attacks on electrical power grids. The third is perhaps most alarming. Cyberspace is not a physical place, unlike a real combat zone, but “it is a ‘virtual interactive experience’ accessible regardless of geographic location”[8]. Myriam Dunn Cavelty defines cyber warfare as “conducting and preparing military operations according to information  related principles. It features formal military forces pitted against each other, and aims at disrupting information and communications systems on which the adversaries rely in order to know themselves”[9]. Thus, cyber warfare is different from the kinetic attacks used in conventional warfare as it is conducted in a different way, even though the goals are the same[10].

CYBER WARFARE A NEW WEAPON: How and Why?

The reason why cyber warfare is becoming an important weapon is that the growing dependence of modern militaries “upon secure, timely flows of massive amounts of information” means that any “disruption would quickly have a crippling effect on the ability to fight”[11]. “Attacking a nation’s critical infrastructure allows a hostile state to erode the victim state’s internal operational viability” and consequently also the infrastructure that supports military actions[12]. Furthermore, cyber warfare primarily involves an attack on a computer system using another computer[13]. This means that cyber warriors often act remotely and launch the attack from within the territory of their own state, thereby reducing, or even eliminating, the likelihood of casualties to their own forces[14]. Moreover, cyber warfare may cause catastrophic effects:“Computer bugs bring down military e-mail systems; oil refineries and pipelines explode; air-traffic-control systems collapse; freight and metro trains derail; financial data are scrambled; the electrical grid goes down . . . orbiting satellites spin out of control. Society soon breaks down as food becomes scarce and money runs out”[15].

INCIDENTS OF CYBER WARFARE AROUND THE WORLD

Cyber warfare has been around as early as 1982. At the height of the cold war, in June 1982, an American early-warning satellite detected a large blast in Siberia.
Computer code stolen from a Canadian company by Soviet spies caused a Soviet gas pipeline to explode. The code had been modified by the CIA to include a logic bomb which changed the pump speeds to cause the explosion. This was one of the earliest cases of cyber war.

With the tap of a button and a few swift keystrokes, cyber warriors can cause grave damages.

In 1991, it was reported by air force that a computer virus named AF/91 was created and was installed on a printer chip and made its way to Iraq via Amman, Jordan. Its job was to make the Iraqi anti-aircraft guns malfunction.

The period between 1998-2000 witnessed the famous attack named ‘Moonlight Maze’. Moonlight Maze refers to an incident in which U.S. officials accidentally discovered a pattern of probing of computer systems at the Pentagon, NASA, Energy Department, private universities, and research labs that had begun in March 1998 and had been going on for nearly two years. Sources reported that the invaders were systematically marauding through tens of thousands of files — including maps of military installations, troop configurations and military hardware designs.

The year 2003 saw the rise of the ‘Titan Rain’, where hackers gained access to many U.S. computer networks, including those at Lockheed Martin, Sandia National Laboratories, Redstone Arsenal, and NASA. These attacks were labelled as Chinese in origin, although their precise nature (i.e., state-sponsored espionage, corporate espionage, or random hacker attacks) and their real identities (i.e., masked by proxy, zombie computer, spyware/virus infected) still remain unknown.

 In 2006, Israel alleged that cyber-warfare was part of the war against Hezbollah, where several countries in the Middle East used Russian hackers and scientists to operate on their behalf to attack the Israel Defense Force, (IDF).

The year 2007 turned out to be very eventful with respect to cyber warfare. 3 serious cases of cyber warfare were observed. First, McAfee, Inc. alleged that China was actively very involved in “cyberwar” and accused it of carrying cyber-attacks in India, Germany and the United States, second, Estonia came under cyber attack in the wake of the relocation of the Bronze Soldier of Tallinn. Estonian authorities, including Estonian Foreign Minister Urmas Paet accused the Kremlin of direct involvement in the cyber attacks and third, United States government suffered an “an espionage Pearl Harbor” in which an “unknown foreign power…broke into all of the high tech agencies, all of the military agencies, and downloaded terabytes of information.

Cyber warfare requires considerable effort and organization, which even very developed nations are willing to put in order to extract crucial information from other countries.  A cyber spy network, dubbed GhostNet, using servers mainly based in China had tapped into classified documents from government and private organizations in 103 countries, including the computers of Tibetan exiles in 2008. However, China has denied such a claim. Again, Operation Aurora, a cyber attack which began in mid-2009 and continued through December 2009, was first publicly disclosed by Google on January 12, 2010, and was believed to be originated from China. The attack was  aimed at dozens of other organizations, of which Adobe Systems, Juniper Networks and Rackspace have publicly confirmed that they were targeted.

Most recently in the year 2010, Iran was attacked by the Stuxnet worm, thought to specifically target its Natanz nuclear enrichment facility. The worm is said to be the most advanced piece of malware ever discovered and significantly increases the profile of cyber warfare.

These incidents clearly point towards the gravity of how cyber warfare has become a major threat to every country in the world.

CYBER WARFARE IN INDIA

India is a large country with countries like China and Pakistan bordering it. In today’s technologically advanced era a mere look at the size of armed forces and military equipment is not enough. Cyber war deterrence is also something that we should start thinking about. It is only recently that the new Indian Government also recognized the importance of cyber security and The Department of Information Technology has in response created the Indian Computer Emergency Response Team (CERT-In) in 2004 to thwart cyber attacks in India. In 2004 itself there were 23 reported cyber security breaches and by 2011 had risen to an alarming 13,301. Hence, in 2011, the government even created a new subdivision, the National Critical Information Infrastructure Protection Centre (NCIIPC) to thwart attacks against energy, transport, banking, telecom, defence, space and other sensitive areas.[16]

A high-profile cyber attack on 12 July 2012 breached the email accounts of about 12,000 people, including those of officials from the Ministry of External Affairs, Ministry of Home Affairs, Defence Research and Development Organisation (DRDO), and the Indo-Tibetan Border Police (ITBP)[17] As a response to this the Indian government did come up with a  government-private sector plan being overseen by former  National Security Advisor (NSA) Shivshankar Menon in October 2012, whose aim was to beef up India’s cyber security capabilities in the light of a group of experts findings that India faces a 470,000 shortfall of such experts despite the country’s reputation of being an IT and software powerhouse.[18] In February 2013, Information Technology Secretary J. Satyanarayana stated that the NCIIPC was finalizing policies related to national cyber security that would focus on domestic security solutions, reducing exposure through foreign technology. Other steps include the isolation of various security agencies to ensure that a synchronised attack could not succeed on all fronts and the planned appointment of a National Cyber Security Coordinator.[19]Even today, as gunfire continues to be traded across the India-Pakistan border, violating the ceasefire between the neighbours, a full-blown hacking and defacement war seems to have also simultaneously erupted in cyber space. A the battle on the cyber space too is very much on Pakistan’s agenda.
Pakistan like China is known to wage cyber wars with India. The Pakistan cyber army, in particular, has been very active on the internet and has spared no opportunity to hack into Indian websites only to cause an embarrassment. As per the latest alert, Pakistan has directed its cyber army to declare an internet war on India. Intelligence Bureau officials say that Pakistan will use all tactics to declare a non-conventional war on India.[20] Like this India is always under threat from neighbouring and other nations too.
The Defence Ministry should hence consider the creation of a Joint Command for Cyber Warfare and create warriors trained only on this. . It has become extremely crucial that we understand the gravity of these cyber wars and be aware of all the areas of vulnerability that exist in our system. Cybersecurity initiatives and projects in India are negligible in numbers. Even if some projects have been proposed, they have remained on papers only. Projects like National Cyber Coordination Centre (NCCC) of India, National Critical Information Infrastructure Protection Centre (NCIPC) of India, has, etc. failed to materialise so far. The National Cyber Security Policy of India 2013 also failed to take off and even if it is implemented it is weak on numerous aspects like privacy violation in general and civil liberties infringement in particular. It would not be wrong to say that India is a sitting duck in cyberspace and civil liberties protection regime.[21]  Cyber security needs urgent attention of Indian government. In a positive development, the National Cyber Coordination Centre (NCCC) of India may finally see the light of the day and may become functional very soon. The NCCC would help India is fighting against national and international cyber threats. Very soon it would be clear how far the BJP government would go to protect Indian cyberspace.[22] We need to create both defensive and offensive capabilities to be prepared for such attacks. Like China, India also needs to build indigenous capability in key technologies in computers using our own operating systems and networking equipment for our networks to become secure. This effort also requires support from corporate’s as we move ahead to privatized infrastructure like railways, power, etc.

The time has now come for India to recognize this need and address any vulnerability that exists in the system. In the increasingly digital world that we are moving towards, we need to prepare ourselves to defend any web wars that come our way

CONCLUSION

Cyber violence has increasingly become a very threatening aspect of our lives as evidenced by the incidents stated above. We have become afraid of acts of cyber violence only because we have made them acts in the real world.  It was not that long ago that a connected computer could only touch other connected computers.  Now we have a different situation. By putting real world controls on Internet-accessible systems, we have made these acts real and dangerous.  Prioritizing security over convenience is probably the most important act of prevention. The problem is that the humans in the system will take a risk for convenience and not fully understand the potential outcomes.  If we limit the possible outcomes of cyber violence than the economics of the situation will keep us fairly safe.

[1] Michael Newton, Larry May, Proportionality in International Law, (Oxford University Press: Oxford, 2014), p. 265.

[2] Michael N. Schmitt, “Wired Warfare: Computer Network Attack and Jus in Bello”,InternationalReview of the Red Cross, Vol. 84 No. 846, (2002), pp.365, 367.

[3] Ibid

[4] “Cyberwar: war in the fifth domain”, The Economist, 1 (July 2010),, available at: http://www.economist.com/sites/default/files/images/images-magazine/2010/27/fb/201027fbd001.jpg.

[5] Center for Strategic and International Studies, Cybersecurity and Cyberwarfare,Preliminary Assessment of National Doctrine and Organization, UNIDIR Resources Paper, 2011, available at: http://www.unidir.org/files/publications/pdfs/cybersecurity-and-cyberwarfare-preliminary-assessment-of-national-doctrineand-organization-380.pdf. Last accessed on 23/12/2015

[6] Paul Cornish, David Livingstone, Dave Clemente and Claire Yorke, “A Chatham House Report on Cyber Warfare”, (November 2010). Available at www.chathamhouse.org.uk.Last accessed on 25 November 2014.

[7] Supra Note 5

[8]Susan W. Brenner, “Civilians in Cyberwarfare: Conscripts”, Vanderbilt Journal of Transnational Law, Vol. 43, Issue 4,( 2010), pp. 1011-1076.

[9]Myriam Dunn Cavelty, “Cyberwar”, in The Ashgate Research Companion to Modern Warfare, George Kassimeris& John Buckley (eds.), (2010), p. 123.

[10]Susan W. Brenner (n. 14)pp. 1011-1076.

[11]John Arquilla, “The Computer Mouse that Roared: Cyberwar in the Twenty-First Century”, Brown Journal of World Affairs, Vol. XVIII, Issue 1,(2011), p. 28.

[12]A.J. Schaap, “Cyberwarfare Operations: Development and the Use Under International Law”, Air Force Law Review, Vol. 64, (2009) ,p.121.

[13]Timothy Shimeall, Phil Williams and Casey Dunlevy, “Countering cyber war”, NATO Review,Vol. 49 – No. 4, (2001), pp.16-17.

[14]Susan W. Brenner, Cyber Threats: The Emerging Fault Lines of the Nation-State (Oxford University Press:New York, 2009); See also Susan W. Brenner (n. 14) pp. 1011-1076.

[15]“Cyberwar: war in the fifth domain”,(n 6)

[16] Manu Kaushik and Pierre Mario Fitter, ‘Beware of the Bugs'( BusinessToday.in, 17 February 2013) http://www.businesstoday.in/magazine/features/india-cyber-security-at-risk/story/191786.html accessed on 29 December 2015

[17] ibid.

[18] Indrani Bagchi & Vishwa Mohan,”5 lakh cyber warriors to bolster India’s e-defence “  The Times of India (India, 16 October 2012)

[19] Manu Kaushik and Pierre Mario Fitter, ‘Beware of the Bugs'( BusinessToday.in, 17 February 2013) http://www.businesstoday.in/magazine/features/india-cyber-security-at-risk/story/191786.html accessed on 29 December 2015

[20] Vicky Nanjappa, ‘Pakistan wants to launch cyber war on India'(Oneindia,  10 August 2015)
http://www.oneindia.com/india/pakistan-wants-to-launch-cyber-war-on-india-1831947.html
accessed on 1 January 2015.

[21] Ram K Kaushik,’ Cyber Security Needs Urgent Attention Of Indian Government‘ (Cyber security in India,14 September  2014) http://cybersecurityforindia.blogspot.in/ accessed on 1 January 2015.

[22] ibid.