Like China, India needs to encourage 'hacker clubs' in view of the challenges of virtual terrorism, says Lieutenant General Prakash Katoch (retd).
The use of the Internet has been a boon to crime syndicates, radicals and terrorists. Al Qaeda used it for the 9/11 attacks on the United States through coded messages for recruitment, planning, funding and execution.
Today, the Islamic State and other terrorist organisations have been using cyberspace similarly. Cyber crime has gone up exponentially. Frost & Sullivan Global Cyber Security Market Assessment, 2014 says cyber crime has a global cost greater than that of trafficking in marijuana, heroin and cocaine with an estimated one cyber crime victim in every three Internet users. Cyber warfare and cyber crime are a growing threat, now more than ever.
The consumer shift towards the interconnectivity of personal computers, tablets and mobile phones is creating new opportunities for criminals to access critical personal data, in addition to increasing number of devices connected to the Internet.
In their assessment, the global cyber security market is expected to grow at a compound annual growth rate of 11.8 per cent from $71 billion in 2013 to $155 billion in 2020. Critical national assets, organisational and physical structures and facilities too require enormous effort and expenditure.
Last year, the discovery of the IS twitter account operator 'Mehdi' alias 'Shami Witness' from Bengaluru jolted India. He was recruiting volunteers for IS for the past several years, abetted IS in its agenda to wage war against Asiatic powers and had posted the video of US aid worker Peter Kassig's beheading several times on his account.
Twitter India, when questioned, said it would not comment on individual accounts, for privacy and security reasons and only review reported accounts against their rules, which prohibit direct, specific threats of violence against others.
Post the Mehdi episode, a former National Security Advisor went on record to say that some 100 Indians were engaged in Mehdi type of activities on the Internet. Other social media too is being used for such purposes. Possibly the false news of rapes and photographs posted on social media during 2013 of homes attacked and burnt that forced the exodus of North-East youth working in Bengaluru and Delhi was the handiwork of radicals.
Similarly, the Whatsapp message purportedly sent by a young officer after the terrorist attack on an army camp in Uri during 2014 too could have been by radicals aimed at creating dissension in the army's rank and file.
The National Investigative Agency had reported earlier that Indian Mujahideen cadres have been using proxy servers and complex code to chat: Setting up e-mail accounts that disappear if they not accessed in 24 hours, proxy servers to camouflage geographical location, encrypted files and complicated code language; use of US-based Yahoo Inc, Paltalk Inc, Sophidea Inc and Hurricane Electric, plus providers in Nepal, Canada and Ireland; IP address of Nimbuzz chat traced to the Pakistan Telecom Company Ltd and others traced to France, Germany, The Netherlands, Nepal and India.
Additionally, (Indian Mujahideen terrorist) Riaz Bhatkal and his close aides are known to run a hi-tech command centre in Karachi to communicate with terror cells in India and Nepal, and possibly even the Maldives, Sri Lanka and Bangladesh.
In 2012, the Al Qaeda 'electronic jihad' against the US through a video message, calling for cyber attacks against US government networks and critical infrastructure including the electric grid.
US intelligence officials assessed Al Qaeda could even 'purchase' such capabilities to do so from expert criminal hackers; engineering devastating attacks on the electric grid, water delivery systems and financial networks.
This led to calls for new legislation to protect critical networks necessary to protect national and economic security, urging the US Senate to act on the bipartisan Cyber Security Act that requires minimum security performance requirements for key critical infrastructure cyber networks.
We have the IT Act that has been amended many times and the announcement of various task forces on cyber security have been made from time to time. Some progress has also been made in terms of public-private partnership.
In September 2013, Ellyne Phneah, in an article titled 'India government reportedly monitors Web activities, without ISP knowledge,' wrote that India had deployed 'Lawful Intercept and Monitoring' systems to track the Internet activities of citizens, separate from similar systems used by telcos in the government's Central Monitoring System project.
The article said that Lawful Intercept and Monitoring systems had been deployed by India's Centre for Development of Telematics to monitor internet traffic, e-mails, Web browsing, Skype and other Internet activities by Indian citizens and that the systems are fully owned and operated by the Indian government, unlike similar systems deployed by local Internet Service Providers which have to comply with the Indian Telegraph Act and Rule 419(A) of the country's IT rules.
The Lawful Intercept and Monitoring systems were said to have been installed between the edge router and core network, and had 100 percent indiscriminate access to the online activity of the country's 160 million users, also having an 'always live' link so it can be operated without legal oversight of ISP knowledge.
However, Indian media reports of June 2013 stated that the government was appointing a coordinator to preside over the new inter-agency structure for cyber security and that this body would rope in the ISPs.
This new architecture, cleared by the Cabinet Committee on Security in June 2013, envisaged an interconnected set of organisations in key departments like the National Technical Research Organisation, defence and home ministeries, while CERT would remain the umbrella body to oversee cyber protection.
A key aspect of the architecture is that the government will work with ISPs to oversee the metadata of Indian users but not 'mine' the data.
Post the growing threat of ISIS, a non-governmental initiative termed Counter Extremism Project was recently launched in the US, ostensibly with Israeli assistance to confront the growing threat from 'extremist ideology.'
CEP seeks to refute social media messaging, compile the world's biggest database of extremist networks. This is in sharp departure from the erstwhile US policy where the Global War on Terrorism was launched against primarily Al Qaeda and later the Taliban.
The CEP would augment the United States's National Security Agency already heavily committed albeit the latter faced heavy criticism in recent times for snooping globally under the 'Prism' programme.
Participation of the private sector is also essential because of the magnitude of the issues involved. CEP has been launched as a private sector organisation that describes itself non-partisan in its efforts to combat extremism.
Its goals include compilation of the world's most exhaustive database on extremist groups and their networks, and places unmasking the funding sources for ISIS high on its list of immediate priorities.
Though the CEP is a non-governmental organisation, it plans to work with governments including US government and will exploit the Internet to mobilise social media to counter extremist ideology by exposing the threat of extremists and mounting a global counter narrative.
It would also be prudent for India to take a few leads from China on the aspect of cyber security. A top level Chinese IT company like Tencent (qq.com) established only in 1998 has been listed number 4 of 100 top Internet companies by Forbes magazine. It offers equivalents of Skype, Facebook, Twitter, Amazon, Microchat, Wizard, Google, Gaming etc and claims improvement over Twitter.
Its V-chat (equivalent of Whatsapp) being used in 200 countries. It earns 50 percent of money through its gaming applications. The point to note is that such indigenous systems make it much easier for China to monitor Web activity.
China has implemented IPv6 Internet protocol which is not only more secure but also makes it easier to hide certain information through encryption that is not possible under the current IPv4 used in India. China is producing its own hardware and software.
China's ministry of public security supports information security research; certification of commercial sector products for use in government systems; control of commercial information security companies, and funding of academic grants for research for subjects of interest to MPS.
Finally, China's IW militias reportedly employ over 60,000 hackers. India needs to encourage and integrate similar 'hacker clubs' in view of the enormity of challenges of virtual terrorism.
Total security against cyber attacks is a misnomer but we can mitigate such threats to a large extent by establishing a robust mechanism to govern the use of IT in the country, a centralised structure for proactive defence of information assets, effective cyber forensic analysis and regulatory risk evaluation enabled through legislation and across the board cyber-security awareness and training, all of which cannot be ignored in the interests of national security.
Lieutenant General (retd) Prakash Katoch is a veteran of the Indian Army's Special Forces.
