Indian Defence Review

The capability of India’s matchless troops in on-the-ground, blood-and-guts fighting is legendary. But if operational logistics is compromised in advance by a hostile military, wars may be lost even before engaging in battles and such battles as engaged in, will prove costly in terms of soldiers’ lives lost due to inadequate generalship. Ineffective military cyber security is a military shortcoming and reduces the deterrence capability of India’s military. Is there a disconnect stemming from ignorance or hubris at the top military echelons regarding cyber vulnerability and its effect on military capability? Historically, the failure of military strategy notwithstanding, the boldness and raw guts of junior leaders have won battles. But this cannot work in cyber warfare. Offensive cyber capability has to be built up along with reliable and effective cyber security as a national strategic imperative.

National defence is central to protecting the territorial and political sovereignty of our republic. This defence is primarily provided by the military (Army, Navy and Air Force), with its soldier-and-weapon capability. In present time, military operations and logistics use command, control and weapons systems which are enabled by information technology and military teaching is about Command, Control, Communications, Computers, Intelligence, Surveillance and Reconnaissance (C4ISR) with cyber warfare as a distinct branch.

The effectiveness of military operations is finally based on the backup that the nation provides with its infrastructural, economic and political resources. Boots-on-the-ground in real-time combat situations cannot succeed without cyber-dependent operations and logistics. Thus there is a need for both offensive and defensive cyber capability and this is intimately linked with the cyber capability of the nation.

The larger picture requires that data systems which include the bits and bytes which every civil and military computer stores, uses and processes, the enabling software, the basic hardware and the human resources which are the final users, are secure against loss, corruption, theft and infiltration. Thus, there are real threats to national security from loss, leakage or corruption of data whether due to ignorance, inadvertence or cyber attack. This calls for policy and coordination at the highest level, namely, the National Security Council (NSC).

Security of data at government or military levels is not unlike the privacy of personal data at the level of the individual. When the government stores and handles personal data of millions of its citizens in a national database, a cyber attack on such a database is an attack on national sovereignty.

Threats to Inter-connected Databases

In an age of exploding data, information and knowledge, both human and machine, cyber security is as much a necessity for personal privacy as it is for internal and external national security or for day-to-day economic activities and operation of social and economic infrastructure systems. Cyber security also constitutes the defensive part of modern warfare which is intimately connected with the blood-and-guts, on-the-ground military operations. Thus, the threats to privacy and to national security from loss, leakage or corruption of data whether due to ignorance, inadvertence or cyber attack, need to be understood clearly.

Vulnerability to cyber attack is a function of the inter-connectedness of personal and institutional computer systems and the integrity and quality of cyber defences at every level. Data has no geographical or political borders. The border for data is essentially the physical border formed by the physical infrastructure of installed hardware and the electronic boundary of the IT system or database within which the system manager has control.

Cyber attack has come into public space precisely because of increasing inter-connectedness between systems or autonomous data silos, as internet users proliferate at the staggering rate of eight new internet users every second. This is even while there are allegedly 250,000 new computer viruses being created every day, which have the potential to infect private and institutional systems from around 300,000 infected websites, which can and do change every day. That gives an idea of the threat lurking behind every single keystroke of every computer which is connected to the internet.

Cyber Criminals

Cyber criminals are not only professional in their capabilities, but are well organised and even advertise their profession. There are ads for hacking services, which can be purchased by a business person to knock out business competitors by obtaining information or disabling systems for a critical period or effectively making the system inoperable by deliberately overloading it with inputs – called DDOS, standing for Deliberate Denial of Services. DDOS can cost the purchaser of the hacking service $5 to $100 per hour or more depending upon the built-in security of the system, the risk of discovery and the benefit that the customer would get out of the DDOS to his business rival.

While hacking into a system to extract (copy), corrupt or delete data, is fraught with the risk of being traced, arranging DDOS is perhaps relatively safer. Alternatively, the hacker can be employed to infect a target system with malware. Such advertised services are themselves difficult to trace to a physical address, since the operators are skilled geeks who could be a next door neighbour or living on another continent.

Reportedly, malware sales and distribution to potential and in-practice cyber criminals, is a thriving business. For example, a package named Black Hole Exploit Pack complete with full technical support and documentation enables a newcomer to set up his own malicious hacking server. Further, computer systems can be invaded by planting or embedding hardware at some stage of the manufacturing process or inserting malware during system installation. This provides a so-called ‘backdoor’ to the system, unknown to the user, permitting individual criminals, corporate competitors, intelligence outfits or deep state actors unauthorised, and often undetected, entry to the system for their respective nefarious purposes.

Software firewalls can prevent unauthorised entry into systems, but it must be understood that an engineer working in even a reputed firewall vendor company could have illicit and secret association with a hacking facility at the individual level. Even otherwise, hacking is a part-time or full-time occupation which is open to the very young, even as young as eight years of age. Some hackers do it for kicks – supposedly harmless – or to deliberately harm some particular person or organisation, while others do it for making money.

All it requires for hacking a system is some self-acquired skill on computers (not very difficult for today’s youngsters born to the keyboard), motivation to hack (monetary incentives or personal satisfaction aims) and time (part-time after school or work is adequate) to succeed. The world over, cyber experts admit that a system is safe only until it is hacked and the truth of this admission is that very high security systems such as NASA, CIA and FBI have been hacked or have had malware injected into them.

Hard Truth

Thus, a cyber attack can be on an individual computer, a system, a network or a server. But the threat is not only through the internet. There are many software devices and tools for physically gaining access to a system or database. Most cyber criminals skilfully cover their tracks to escape detection and arrest. It helps them that most cyber security laws are national in scope whereas the internet is not limited to national political or geographical boundaries, being borderless and international. Furthermore, countries do not agree with each other on cyber security and privacy.

Backdoors and Built-in Threats

The IT infrastructure, meaning critical high-end hardware and software (‘equipment’, hereinafter), in most, perhaps all, central and state government ministries, departments and organisations is purchased from international vendors. These vendors are not the Original Equipment Manufacturers (OEMs), since OEMs have limited global marketing capability. The purchaser enters into a contract with the vendor who procures the infrastructure from the OEM and installs it. In most cases, the vendor is also contracted for life-cycle technical support since the design and details of the equipment are protected by the OEM under IPR.

Further, the OEM, operating under an export control regime, insists on the purchaser providing end-use certification. The nexus between the IT OEMs and the intelligence community needs no highlighting. It is this nexus which permits the OEM to secretly embed targeted hardware and/or software in the equipment, including detecting and suiting the geographical location of the end-user.

Regarding the life-cycle technical support of the equipment, the vendor is often contracted for online support. This means that the purchaser actually hands over the entire live system to the vendor’s systems engineer who may be physically located anywhere in the world for updation, upgradation and rectifications. At this stage, one or more of the following could happen:

•  If a backdoor was not installed at time of supply and installation, this can be done,

•  If a backdoor was installed at time of supply and installation, data can be downloaded,

•  A new or updated backdoor can be installed.

Online technical support by the vendor may be preferred because it is cheaper than having a vendor’s engineer visit the site, and also because security clearances for physical visits could be problematic especially in high-security installations.

Click to buy: Jan-Mar 2018 (Vol 33.1)

The point here is that critical IT hardware and software infrastructure is purchased from the international market, for end-use in defence, home, finance and banking operations, energy including oil, education, health, social welfare, electric power, nuclear power, railway operations, air traffic control, rail and air passenger reservations, public or private sector industry including UIDAI’s Central ID Repository (CIDR).

Thus vulnerability to cyber attack is substantial when every single item of critical hardware and software is purchased from international vendors especially those who also provide technical support as part of the contract.

Sub-Critical Equipment

Cyber vulnerability is not only from critical hardware; sub-critical hardware is also vulnerable when purchased from international vendors. Sub-critical hardware is essential for operation of IT systems and routers are one such item used for communication, data handling and transfer. Routers are sub-critical hardware which route data within and between IT systems. Routers are much like postmen who collect snail-mail from post boxes and post offices and deliver it to the addressee, hopefully without reading the communications or extracting anything from the mail. However, for digital data security, data is coded and voice communication is scrambled. The software for some routers is regularly updated by security patches and this, as in critical equipment, is a source of substantial cyber threat.

Open Market Purchase

IT equipment purchased from the open market overcomes the disadvantage of revealing the end-use and prevents the installation of targeted backdoors. Cyber threat is minimised, but not eliminated because, for example, a motherboard or a hard disk or the microprocessor could have secretly embedded devices which can be activated remotely. Notwithstanding, this is a ‘safer’ route. However, this route of open market purchase calls for increased levels of hands-on IT competence for system design, integration and implementation. Such talent is not difficult to find in our country, but sadly this is not encouraged because of reliance on foreign vendors who exercise influence at the highest levels of state and central governments.

Security Evaluation

Criteria for IT-product security evaluation is done under a framework of evaluation assurance levels from 1 to 7. EALs 1 to 4 are relatively easily dealt with, but levels 5 to 7 involve checks ranging from investigation into the source of the hardware and software, to the checks for embedded hardware and/or software, to silicon-chip-level testing to check whether the device performs only the task for which it is purchased and none other. As EALs increase, the level of expertise, infrastructure required and time-and-cost required for conducting evaluation grow exponentially. These need to be assessed according to the assessed risk of cyber attacks, the extent of non-acceptable consequences, and the capability and time-frame for restoration after attack. Infrastructure planning and provision should be done accordingly.

Effects of Cyber Attack on National Databases

Cyber attack by a foreign power or a criminal group on a national database by one of the means mentioned above can be disguised to appear as internal system failure. Simultaneous attack on multiple databases can bring the economy to a grinding halt. The ability to enter multiple data silos or systems almost simultaneously is provided by an ‘entry-point’ which is common to them.

Such an entry-point could be through a database which provides a digital entity that is linked to multiple databases. Several experts consider UIDAI’s Aadhaar number, which is linked to multiple databases, as providing a hacker with entry into multiple databases. That is, if CIDR is hacked, it can be a clandestine route for entry into linked databases. In fact, UIDAI naively created and implemented the CIDR by contract with an international vendor which had intimate links with the intelligence community of the vendor’s country. Hence, the danger of backdoors having already been installed cannot be ruled out. It is a moot point whether Aadhaar is UIDAI’s self-goal by unwittingly planting a cyber-crime bomb, notwithstanding their unconvincing protestations. A law to protect data would not hinder a determined aggressor from hacking into the CIDR. It would appear that cyber security with national security consequences was apparently not a priority with the architects of UIDAI’s Aadhaar and hence justification for alleging naivety.

In international politics, a cyber attack is an act of war, justifying reactive military response. However, when a cyber attack disables multiple databases which affect military logistics and operations, it can restrict or limit the scale or speed of military response.

Capability for Cyber Security

As mentioned earlier, India has virtually zero production of critical hardware and software even in core sectors such as defence, home, finance, energy (especially oil) and transportation, all of which impinge immediately and directly on the daily economic life of individuals and the state. Total dependence on international vendors for critical IT hardware and software is the bitter truth. The attitude of successive governments to this truth has been denial, finger-pointing or targeting whistleblowers by trolling or legal action – Tribune journalist Rachna Khaira being the most recent instance or ‘shooting’ the messenger or adopting an ostrich-head-in-sand policy. It is not surprising that the problem has not gone away. Rather, the risk has increased from military, political and economic perspectives.

Focussing on data protection at database levels is inadequate since data is simply digital alpha-numeric strings divorced from real-time situations and real-life people. Privacy, cyber security and national security, which are at the core of individual sovereignty and national sovereignty, need to be covered both by actionable policy and law. A degree of assurance for cyber security can only be had by using national human and material resources drawn from India’s public and private sectors. This is obviously a process which will take years, and planning for this can only be effective after the risks and consequences of cyber attack are accepted and realistically assessed at state and centre government levels and policy and law on data and cyber security are formulated. All this needs to be with policy and time-bound action plans cleared at the level of the National Security Council.

National Security

The government’s e-governance initiatives will inevitably shift every aspect of national functioning into the cyber domain. As it gains momentum, the concomitant risk will be its increased vulnerability as a cyber target. Since cyber security compromised in one sector gives an aggressor access to associated sectors that use linked data, cyber security cannot be effective unless it encompasses the entire linked databases of knowledge-information-data across administrative and procedural demarcations. Only holistically architectured security can reduce vulnerability to cyber attack, limit or contain damage to databases and speed up recovery in case of a successful attack.

A national database such as the UIDAI’s Aadhaar CIDR was created without laws to safeguard it or the data that it contains. Even after a law was passed in 2016, reports of leaked data are eliciting defensive responses from UIDAI, indicating the governments’ casual approach to cyber security. A law to protect data can fix responsibility for invasion of databases and prescribe legal action. It would be ineffective when the attacker is outside India’s political boundaries and cannot take cognisance of the larger aspect of cyber security at the national level. That would call for holistic policy at the National Security Council (NSC) level, with action plans for time-bound, phase-wise implementation.

An effective cyber strike on the day-to-day governance of a nation could be catastrophic, impinging on national security and also compromising national sovereignty. Being in a state of denial with respect to cyber security, as in the UIDAI’s case, will only take our country closer to the edge of a precipice beyond the point of no return. We need to think beyond feel-good, band-aid solutions like formulating a law on data protection. Political-diplomatic-trade tie-ups with countries which promise assistance in security may further compromise security, since the critical IT hardware and software which we use are all imported and we may even facilitate the foreign intelligence agency’s access. Surely, the NSC has its task cut out.

Military Cyber Security

The critical IT hardware and software used by the military for its operations and logistics is no different from that used by the rest of India’s official machinery and is similarly at risk of penetration. Imported weapons systems subject to end-use certification include the concomitant risk of pre-installed backdoors and/or malware capable of remote activation. Until the NSC works out policy and phased action plans for indigenous production of reliable IT equipment, the military will continue to be dependent on foreign sources for its critical IT hardware and software and its operations and logistics will remain open to interference from countries which have well-defined strategies and superior cyber warfare capability.

Military vulnerability will obviously be more vis-a-vis a country which supplies critical hardware and software. There is all the more reason to carry out EALs to the highest level for equipment acquired from such a country, for there is no such thing as a ‘safe’ supplier in the cloak-and-dagger world of cyber warfare. The present status of India’s military logistical inadequacy would be well known to hostile as well as ‘friendly’ foreign militaries through conventional intelligence sources as well as through cyber backdoors, as part of their cyber warfare preparedness. In the IT-centric warfare of tomorrow and in the absence of plans regarding overcoming the military’s cyber dependence on imported critical cyber equipment, what is India’s real-time military capability, notwithstanding statements that we can fight on two-and-a-half fronts?

Click to buy: Jan-Mar 2018 (Vol 33.1)

The capability of India’s matchless troops in on-the-ground, blood-and-guts fighting is legendary. But if operational logistics is compromised in advance by a hostile military, wars may be lost even before engaging in battles, and such battles as engaged in, will prove costly in terms of soldiers’ lives lost due to inadequate generalship. Ineffective military cyber security is a military shortcoming and reduces the deterrence capability of India’s military. Is there a disconnect stemming from ignorance or hubris at the top military echelons regarding cyber vulnerability and its effect on military capability? Historically, the failure of military strategy notwithstanding, the boldness and raw guts of junior leaders have won battles. But this cannot work in cyber warfare. Offensive cyber capability has to be built up along with reliable and effective cyber security as a national strategic imperative.