Cyber Security Of Indian Satellites And Critical Infrastructure

We are living in a technology era where technology is both a friend and foe. It is up to us to work in this direction and ensure on which side technology should be. If technology is used for delivery of public services, we have the benefits of concepts like e-governance and e-commerce. On the other hand if the technology is used for causing wrong or harm to others we face concepts like cyber crimes, cyber attacks, cyber warfare and cyber terrorism.

Cyber warfare, in its basic form as well, is now a well accepted cyber threat. Cyber warfare against India is also well known and we must formulate a cyber warfare policy for India to counter such threats. Indian defense and security against cyber warfare needs to be upgraded and strengthened.

Similarly, terrorism and cyber terrorism are also posing big security problems for India. Indian counter terrorism capabilities are not sufficient and there is an urgent need to strengthen the same. Similarly, cyber espionage and cyber terrorism against India is also well known.

To start with we must have a robust and effective cyber security in India. We must also have an implementable cyber security policy of India. The cyber security policy must keep in mind both the preventive as well as offensive cyber attacks and cyber defense capabilities.

Critical infrastructure protection in India needs to be undertaken on a priority basis. We must have a critical infrastructure protection policy of India that must be strenuously followed by all governmental departments, organisations and even by private service providers.

For instance, supervisory control and data acquisition (SCADA) systems are a favourite target for cyber criminals and cyber terrorists. By targeting SCADA these cyber miscreants can damage the critical infrastructure of India. We must ensure sufficient cyber protection of SCADA systems in India in general and critical infrastructure in particular.

Malware like Stuxnet and Duqu have already shown how critical infrastructures and SCADA systems are vulnerable to cyber attacks. Indian critical infrastructures have also been targeted by these Malware. It is believed that Stuxnet was responsible for shutting down an Indian communication satellite. Similarly, these Malware have also been targeting Indian nuclear systems and facilities.

Even the government computers have been comprised successfully in India in the past. Recently Indian National Informatics Centre’s (NIC) server were compromised and used to attack computers of other nations. Even satellites of various nations have been compromised and taken control of by terrorists and enemy nations.

These developments are serious enough and they must be sufficient for Indian government to formulate an implementable cyberspace crisis management plan of India. Of course, national security policy of India, cyber security policy of India, critical infrastructure protection policy of India, cyber warfare policy of India, etc must be integral part of the same. The sooner these steps are taken the better it would be for the larger interest of India.

India's National Cyber Security Policy

Cyber security is an area that cannot be ignored by India. Cyber security in India has still not been paid enough attention. As a result important departments and computers of Indian governments are frequently breached and compromised.

India is poor at cyber security for numerous reasons. First and foremost being that cyber security policy of India is still missing. Till cyber security is considered at the policy level not much can be achieved.

However, politicians in India have no time for cyber security. Lack of political will towards a crucial topic like cyber security is evident when we have no national cyber security policy of India.

Indian national cyber security policy is also suffering on the count of legal enablement. Till now we have no legal enablement of ICT systems in India. We have no legal framework for cyber security in India. Even the cyber law of India is grossly deficient and is ineffective in tackling the growing cyber crimes and cyber attacks.

Naturally, the fronts like cyber warfare against India, cyber espionage against India, cyber terrorism against India, etc are still wide open for anybody and everybody to exploit.

Another factor that has resulted in poor cyber security in India is the growing incidences of industrial lobbying in India. Industrial lobbying is not allowing a strong cyber law and cyber security framework in India. Companies that may be required to follow stringent cyber law and cyber security practices are lobbying to make them redundant and powerless and Indian government is obliging the same.

India has waited for too long for an effective, robust and implementable cyber security policy. A national cyber security policy of India must be implemented as soon as possible for the larger interest of India and ignoring the same any further would only be counter productive.

White House Is Mulling Federal Cyber Security Law

United States (US) is a country that takes its cyber security very seriously. Recently US declared its international cyberspace strategy. US is also entering into bilateral cyber security agreements with various countries including India. Further, US is also advocating international cooperation for cyber security issues, though within the limits of existing international law framework and not through a dedicated international cyber security treaty.

Cyber attacks at the international level are getting worst and more sophisticated. Recently cyber attacks at Gmail, Citicorp, International Monetary Fund, etc have proved the point. Cyber security has become a necessity these days. Since cyber security is techno legal in nature, both laws and technology must be used to tackle cyber attacks.

India has a bad cyber law, missing cyber security and cyber warfare policy and absent cyber security laws. US on the other hand has good cyber laws and is now planning to have a federal cyber security law. The focus seems to be on developing both offensive and defensive cyber warfare capabilities. The department of homeland security may be entrusted with the job to secure US cyberspace.

In the Indian context, expecting cyber security law before a decade would be pre mature and over optimism. India must first make its cyber law potent and strong by repealing the existing one. But given the preference of e-surveillance over cyber security capabilities in India, the information technology act, 2000 may continue on the statute book despite it being a bad law having unconstitutional provisions.

Cyber security is an international concept and so must be the regulations governing the same. We need international harmonisation because a national approach in this regard would not be sufficed.

Legal Enablement Of ICT Systems In India

Information and communication technology (ICT) is both a boon and bane. It is a boon as it facilitates e-governance, e-commerce and e-delivery of public services. It is a bane as it has a darker side as well. ICT is very frequently used for committing various cyber contraventions and cyber crimes.

This is the reason why we must have a strong and stringent legal framework to regulate ICT dealings. Legal enablement of ICT systems ensures formulation of legal framework for various cyberspace dealings.

Legal enablement covers areas like cyber law, cyber security, cyber forensics, critical ICT infrastructure protection, anti cyber warfare steps, anti cyber espionage steps, anti cyber terrorism steps, etc.

Legal enablement also includes policy issues like cyber law policy, cyber security policy, cyber forensics policy, etc. At the same time legal enablement also ensures a legal framework for all these components. A cyber crisis management plan is also an essential part of the legal enablement initiative of any nation.

In the national context we have no legal enablement of ICT systems in India. We have information technology act 2000 as the cyber law of India that is trying to give some legitimacy to cyberspace dealings in India. However, in the desire to get everything at a single place, the cyber law of India has failed to achieve even a single aspect of legal enablement.

There is no deterrent for cyber criminals in India as almost all the cyber crimes are bailable. Mandatory e-governance services in India are missing and the cyber law of India has imposed a blanket ban upon asking such services by Indiana citizens. The e-commerce environment of India is also not safe and sound. Lack of cyber security and encryption usage makes e-commerce of India highly vulnerable to cyber attacks.

India must repeal the cyber law of India and come up with separate laws on these aspects of legal enablement. As far as cyber security law and cyber forensics law are concerned, India has none.

It would be safe to presume that we have no legal enablement of ICT systems in India. India is not a part of international cyber law treaty and there is also no international cyber security treaty in existence. Thus, India is lax regarding legal frameworks, policy issues and cyber security requirements and the same need to be changed as soon as possible for the larger interest of India.

Cyberspace Crisis Management Plan Of India

Crisis Management is an important aspect of planning and management of any project or eventuality. If we have a proper Crisis Management Plan, losses of lives and property is minimised to a great extent. We have Crisis Management Plans in India against floods, earthquakes and other natural calamities. However, are we prepared for Cyber Crises in Indian Cyberspace?

India has formulated a Crisis Management Plan for its Cyberspace. However, like other Policies and Strategies in India, it has not been implemented in true letter and spirit. Even the basic level Cyber Security Preparedness in India is not up to the mark.

There are many aspects of a Cyber Crisis Management Plan. For instance, Cyber Security, Cyber Law, Cyber Forensics, Anti Cyber Terrorism Plans, Anti Cyber Espionage Plans, Anti Cyber Warfare Plans, Human Rights Protection in Cyberspace, Critical ICT Infrastructure Protection, etc are some of the “Components” of a Cyber Crisis Management Plan.

Theoretically, India has a Cyber Law in the form of Information Technology Act 2000 (IT Act 2000), Cyber Security in the form of Government Guidelines, Cyber Forensics Practices in Governmental Laboratories alone and so on.

However, practically we have no Cyber Crimes Laws in India as the Cyber Law of India has made almost all the Cyber Crimes “Bailable”. We may have a Cyber Law but India has no Cyber Crimes Law. So Legal Framework for preventing Cyber Crimes is “practically missing” in India.

As far as Cyber Security is concerned, we have no Cyber Security Laws in India and no Cyber Security Policy in India. The Governmental Guidelines are meant for Government Departments alone and even these Government Departments do not follow the same. Government Websites are the most frequently defaced websites in India. Similarly, Government Computers are the “most successfully breached” Computers in India. Computers of Defense Forces, Prime Minister’s Office (PMO), Ministry of External Affairs (MEA), Ministry of Home affairs, etc have been successfully breached without even notice by these Ministries/Offices.

As far as other components of Cyber Crisis Management Plan of India are concerned, even they do not exist in India. We have no Cyber Forensics Laws in India, no Cyber Terrorism Policy in India, no Cyber Warfare Policy in India, no Critical ICT Infrastructure Protection Policy in India and no Human Rights Protection in Cyberspace in India.

In fact, Projects like Aadhar, NATGRID, CCTNS, Central Monitoring System (CMS) of India, etc are openly violating the Human Rights of Indians. These Projects are operating without any Legal Framework, Parliamentary Oversight and Judicial Scrutiny.

Even the basic Privacy Rights in India are missing. It is only now the Law Ministry of India has proposed the Right to Privacy Bill 2011 of India. Further, Data Protection Law in India is urgently required. We also need a Data Security Policy of India so that sensitive information and data of projects like Aadhar, NATGRID, CMS, etc is not “misused” once it falls in the wrong hands.

India cannot have a robust and effective Cyber Crisis Management Plan till it considers these aspects and actually starts working in the direction of achieving these components.

Cyber Security Laws In India

The debate between self regulatory environment and a regulatory environment has always been a part of technology related laws. Some believe that issues like cyber law, cyber security, cyber forensics, etc must be regulated by the government whereas others believe that they should be left to individuals and organisations as self regulatory mechanisms.

In this present fragile and dangerous cyberspace it would not be advisable to leave everything upon self regulation mechanism. Issues like cyber law, cyber security, cyber forensics, etc deserve to be regulated at national and international level.

We have no legal framework or laws for cyber security in India. Of course, a few provisions have been incorporated in this regard in the information technology act, 2000 of India that is the sole cyber law of India. However, we need express and dedicated cyber security legislation in India as soon as possible.

Even the cyber law of India needs to be upgraded and strengthened. We need stringent provisions against cyber criminals and not the soft provisions that are presently incorporated in the Indian cyber law. By making the offences and cyber crimes “bailable” India has made its cyberspace a “free zone” and “safe heaven” for cyber criminals and cyber offenders.

It seems the problems of Indian cyber security are multi facet in nature. We do not have sufficient laws, we lack proper strategies and policies, and we do not care much about cyber security.

To start with we must formulate a pro active cyber security policy of India. Then we must proceed towards strengthening our existing cyber law and enacting an effective cyber security law of India. The sooner we consider these issues the better it would be for the cyber security of India.

Australia Plans Cyber Defence Strategy To Combat Hacking

Cyber Security Strategy is one of the most important Strategies of any Nation. This Strategy should not be mere words but an “Implementable Mechanism” that can ensure Robust Cyber Security. This Mechanism must also be supported by a Stringent and Strong Legal Framework in this regard.

In the Indian context, we have a poor Cyber Security in India. We have no implementable Cyber Security Strategy in India. We are still following “Achievements on Paper Theory” in India. We have no Cyber Warfare Policy in India and even Critical ICT Infrastructure Protection Policy of India is missing. Even the Cyber Law of India deserves to be repealed. These Policies do exist in “Form but not in Substance”. Hence for all practical purposes we can consider them as non existent.

Further, there is also no International Cyber Security Treaty as well. In fact, Developing Countries like US are against such International Treaty. This makes International Cooperation and Harmonisation next to impossible. The only viable option that remains is strengthening National Cyber Security and National Cyber Laws and Australia is doing exactly the same.

Australia will develop a Cyber Defence Strategy to combat Cracking and Cyber Espionage. Australian Government declared this after responding to what it sees as an increased threat after recent cyber attacks on global companies and government officials.

For instance, the news of attempt to steal the password of hundreds of Google email account holders, including those of senior U.S. government officials, Chinese activists and journalists is out. Google believes that Chinese hackers are behind this attempt once again. US is assessing whether security had been compromised by this attack.

Australia's Parliament came under cyber attack in February, with the computers of at least 10 federal ministers including Prime Minister Julia Gillard and Defence Minister Stephen Smith, targeted and confidential emails possibly accessed. Similarly, the European Parliament's computer networks were also breached by a cyber attack.

Critical ICT Infrastructure Protection Policy Of India

Critical ICT Infrastructure Protection in India is in news thanks to the India US Homeland Security Dialogue. India has to go a long way before it can effectively protect its Critical ICT Infrastructures from Cyber Attacks. India is also all alone in its initiatives irrespective of Bilateral Agreements as there is no “International Norms” in this regard.

Further, absence of Cyber Security in India and Cyber Security Policy and Strategy of India has further complicated the matter. Naturally Indian Cyberspace is Vulnerable to Cyber Attacks, Cyber Terrorism, Cyber Warfare and Cyber Espionage. Absence of Cyber Warfare Policy of India has further complicated this situation.

The least Indian Government can do in this regard is to formulate a Critical ICT Infrastructure Protection Policy for India. These days a majority of crucial functions of Private Companies and Government are essentially connected with the Computers and Computers Systems. If these Computers or Computer Systems are compromised, much damage can be done to the Country where such breach has occurred.

At Perry4Law and Perry4Law Techno Legal Base (PTLB) we are working in the direction of formulating a world class Critical ICT Infrastructure protection Policy of India. We are analysing the “International Best Practices” in this regard so that a “Composite Policy” can be formulated in this regard.

We have also opened a Techno Legal Cyber Security Research and Training Centre (CSRTCI) that is analysing Techno Legal aspects of Cyber Law, Cyber Security, Cyber Forensics, Cyber Warfare, Cyber Espionage, Critical ICT Infrastructure Protection (CIIP), etc.

Perry4Law and PTLB can enter into a Public Private Partnership (PPP) Agreements with National and International Organisations like United Nations (UN), North Atlantic Treaty Organisation (NATO), Indian Government, Foreign Governments, etc on a mutually beneficial basis.

We are also working in the direction of “Harmonisation” of International Standards and Norms in the field of Cyber Law, Cyber Crimes, Cyber Security, etc. Interested Individuals or Organisations may Contact Us in this regard.

Now it is for the Indian Government to take the call and start working upon crucial Policies issues pertaining to Cyber Crimes, Cyber Security and Critical ICT Infrastructure Protection.

Cyber Security In India

Cyber security in India is not upto the mark and is an ignored world. Further, India has no cyber security policy and strategy that can be implemented under any legal framework. Merely mentioning that India has formulated a cyber security strategy or policy is not enough till it has a force of law.

One area that India has not touched at all pertains to enactment of cyber security laws. Till now we have no cyber security laws in India. Of course, one or two vague provisions have been incorporated in the information technology act, 2000 (IT Act 2000) of India that happens to be the sole cyber law of India.

Even the cyber law of India is weak and ineffective in tackling the fast growing cyber crimes in India. Many of the provisions contained in the IT Act 2000 have crossed the limits of constitutionality. This has made a dominant part of Indian cyber law unconstitutional. In fact, so bad is the position that a need to repeal the cyber law of India has been felt these days.

So we have neither a policy/strategy for cyber security nor legal framework for its implementation. All we have are uncodified and non implementable words that have no significance and legal value.

India has faced many cyber attacks in the past. Many of them were not detected for a very long period of time. Indian websites are regularly defaced by cyber miscreants. Cases of cyber espionage are rampant in India. Sensitive and strategic defence forces and ministries computer systems are frequently breached and sensitive data is occasionally stolen.

Perry4Law and Perry4Law Techno Legal Base (PTLB) firmly believe that it is high time for India to formulate effective cyber security policies/strategies and cyber security laws in India. Further the cyber law of India must also be repealed and a strong and robust law must be enacted that is also constitutionally and legally sound.

Cyber Security Policy And Strategy Of India

Cyber security of India is an aspect that deserves attention at the national level. It must be reflected in the national policies and strategies of India. For the time being we have no enforceable national cyber security policy of India or national cyber security strategy of India.

This is a serious lacuna that is not conducive for the national security of India in general and cyber security of India in particular. We have no cyber security laws in India and even our cyber law is not strong enough. On the contrary the cyber law of India is encouraging growth of cyber crimes in India by making almost all the cyber crimes bailable.

By making the offences and cyber crimes “bailable” India has made its cyberspace a “free zone” and “safe heaven” for cyber criminals and cyber offenders. It seems the problems of Indian cyber security are multi facet in nature. We do not have sufficient laws, we lack proper strategies and policies, and we do not care much about cyber security.

India has been a victim of cyber espionage on many occasions where crackers operating in foreign jurisdictions regularly attack Indian computers and have successfully taken out sensitive information. International community is stressing upon enhancement of their cyber security capabilities unlike India.

It is high time for India to consider cyber security seriously. Cyber security is not a one day process that can be implemented all of a sudden. It requires years of planning and continued efforts to have a robust cyber security. The sooner it is adopted by India the better it would be for the national interest of India.