GS Paper: Cyber Security

On April 28, Computer Emergency Response Team (CERT-In) passed a rule mandating VPN (virtual private network) providers to record and keep their customers’ logs for 180 days.

What is VPN?

• VPN describes the opportunity to establish a protected network connection when using public networks.
• It encrypts internet traffic and disguise a user’s online identity.
• This makes it more difficult for third parties to track your activities online and steal data.
• The encryption takes place in real time.

How does a VPN work?

• A VPN hides your IP address by letting the network redirect it through a specially configured remote server run by a VPN host.
• This means that if you surf online with a VPN, the VPN server becomes the source of your data.
• This means your Internet Service Provider (ISP) and other third parties cannot see which websites you visit or what data you send and receive online.
• A VPN works like a filter that turns all your data into “gibberish”. Even if someone were to get their hands on your data, it would be useless.

Why do people use VPN?

• Secure encryption: A VPN connection disguises your data traffic online and protects it from external access. Unencrypted data can be viewed by anyone who has network access and wants to see it. With a VPN, hackers and cyber criminals can’t decipher this data.
• Disguising whereabouts: VPN servers essentially act as your proxies on the internet. Because the demographic location data comes from a server in another country, your actual location cannot be determined.
• Data privacy is held: Most VPN services do not store logs of your activities. Some providers, on the other hand, record your behaviour, but do not pass this information on to third parties. This means that any potential record of your user behaviour remains permanently hidden.
• Access to regional content: Regional web content is not always accessible from everywhere. Services and websites often contain content that can only be accessed from certain parts of the world.
• Secure data transfer: If you work remotely, you may need to access important files on your company’s network. For security reasons, this kind of information requires a secure connection. To gain access to the network, a VPN connection is often required.

What does the new CERT-IN directive say?

• VPN providers will need to store validated customer names, their physical addresses, email ids, phone numbers, and the reason they are using the service, along with the dates they use it and their “ownership pattern”.
• In addition, Cert is also asking VPN providers to keep a record of the IP and email addresses that the customer uses to register the service, along with the timestamp of registration.
• Most importantly, however, VPN providers will have to store all IP addresses issued to a customer and a list of IP addresses that its customers generally use.

What does this mean for VPN providers?

• VPN services are in violation of Cert’s rules by simply operating in India.
• That said, it is worth noting that ‘no logs’ does not mean zero logs.
• VPN services still need to maintain some logs to run their service efficiently.

Does this mean VPNs will become useless?

• The Indian government has not banned VPNs yet, so they can still be used to access content that is blocked in an area, which is the most common usage of these services.
• However, journalists, activists, and others who use such services to hide their internet footprint will have to think twice about them.

Why such move?

• Crime control: For law enforcement agencies, a move like this will make it easier to track criminals who use VPNs to hide their internet footprint.
• Curbing dark-net activities: Users these days are shifting towards the dark and deep web, which are much tougher to police than VPN services.

Back2Basics: Indian Computer Emergency Response Team (CERT-IN)

• CERT-IN is an office within the Ministry of Electronics and Information Technology.
• It is the nodal agency to deal with cyber security threats like hacking and phishing. It strengthens the security-related defense of the Indian Internet domain.
• It was formed in 2004 by the Government of India under the Information Technology Act, 2000 Section (70B) under the Ministry of Communications and Information Technology.

UPSC 2023 countdown has begun! Get your personal guidance plan now! (Click here)

The Union Ministry of Electronics and IT (MeitY) has declared IT resources of ICICI Bank, HDFC Bank and UPI managing entity NPCI as ‘critical information infrastructure’.

Try this PYQ:

In India, the term “Public Key Infrastructure” is used in the context of

(a) Digital security infrastructure

(b) Food security infrastructure

(c) Health care and education infrastructure

(d) Telecommunication and transportation infrastructure

 

[wpdiscuz-feedback id=”2d4o8z90sm” question=”Please leave a feedback on this” opened=”1″]Post your answers here.[/wpdiscuz-feedback]

What is Critical Information Infrastructure (CIC)?

• The Information Technology Act, 2000 explicitly gives definition of CIC.
• It defines CIC as a computer resource, the incapacitation or destruction of which shall have debilitating impact on national security, economy, public health or safety.
• It basically aims to protect the digital assets.
• The government, under the Act, has the power to declare any data, database, IT network or communications infrastructure as CII.
• Any person who secures access or attempts to secure access to a protected system in violation of the law can be punished with a jail term of up to 10 years.

Why is CII classification and protection necessary?

• IT resources form the backbone of countless critical operations in a country’s infrastructure.
• Given their interconnectedness, disruptions can have a cascading effect across sectors.

What led to the classification of CICs?

• In 2007, a wave of denial-of-service attacks, allegedly from Russian IP addresses, hit major Estonian banks, government bodies – ministries and parliament, and media outlets.
• It was cyber aggression of the kind that the world had not seen before.
• The attacks played havoc in one of the most networked countries in the world for almost three weeks.

Recent incidents of CIC incapacitation

• In October, 2020 as India battled the pandemic, the electric grid supply to Mumbai suddenly stopped.
• It hit the mega city’s hospitals, trains and businesses.
• Later, a study by a US firm claimed that this power outage could have been a cyber-attack, allegedly from a China-linked group.
• The government, however, was quick to deny any cyber-attack in Mumbai. But prospects cannot be denied.
• The incident underlined the possibility of hostile state and non-state actors probing internet-dependent critical systems in other countries, and the necessity to fortify such assets.

How are CIIs protected in India?

• Created in January 2014, the National Critical Information Infrastructure Protection Centre (NCIIPC) is the nodal agency.
• It takes all measures to protect the nation’s critical information infrastructure.
• It is mandated to guard CIIs from “unauthorized access, modification, use, disclosure, disruption, incapacitation or distraction”.
• NCIIPC monitors and forecasts national-level threats to CII for policy guidance, expertise sharing and situational awareness for early warning or alerts.

UPSC 2023 countdown has begun! Get your personal guidance plan now! (Click here)

Context

After 100 days of Ukraine crisis, Russia is yet to achieve what can be termed as a decisive victory in any sector of the current conflict.

Reasons for the lacklustre performance of Russia

• Several reasons have been adduced by experts in the West for the lacklustre performance of the Russian army.
• Lack of motivation: There is a lack of motivation and the poor morale of the Russian forces sent to Ukraine.
• Outdated weaponry: Russian weaponry being outdated and ineffective to fight an informationalised war under modern conditions.
• Leadership issue: Russian commanders have also proved inept in devising plans and taking appropriate decisions in battlefield conditions against a determined enemy.

Important role of cyber warfare

• Given that cyber is often touted as the Fifth Dimension of warfare, it may be worthwhile to examine whether this indeed is the first major conflict in which ‘cyber’ is playing a crucial role, allowing a weaker nation with cyber capabilities to use it to its advantage.
• A former Chief of the National Security Agency of the U.S., in his memoirs had said that although cyberspace is a man-made domain, it had become critical to military operations on land, sea, air and in space.
• A former U.S. Secretary of Defence a few years ago,, even talked of a possible ‘cyber Pearl Harbour to paralyze nations and create a profound sense of vulnerability’.
• The Russian military oligarchy is indeed among the world leaders in digital disruption and cyber-methodology.
• One could have reasonably presumed that even before the conflict commenced, Russia would have swamped Ukraine with an avalanche of digital attacks.
• Ukraine, for its part, has its own digital army, including a corps of digital weapons.

Limits of cyber warfare

• There are several publicised instances earlier, of alleged Russian operatives waging a cyberwar against Ukraine.
• Both sides now possess and use malware such as data-wipers which have proved highly effective.
• On the day the Russian invasion of Ukraine began, Russian cyber units are believed to have successfully deployed destructive malware against several Ukrainian military targets.
•  A series of distributed denial-of-service (DDoS) attacks against Ukrainian banking and defence websites occurred simultaneously.
• As far as the conduct of the war is concerned, the string of small-scale cyberattacks cannot be said to have had any material impact on the conduct or outcome of the conflict.
• Hence, the cardinal question is why given that Ukraine has put up such a heroic defence — and to a considerable extent stalled the Russian offensive — Russia has not embarked on a massive all-out cyber-offensive.
• If that be the case, then much of the speculation that cyberattacks in the event of a war provide a perpetrator the capability to enact another ‘Pearl Harbour’ seems highly unrealistic.

Conclusion

It is very likely, and possibly a fact, that there are major difficulties in planning and executing massive cyberattacks on a short timeline to ensure higher efficacy of kinetic attacks.

UPSC 2023 countdown has begun! Get your personal guidance plan now! (Click here)

The Supreme Court has said its technical committee had so far received and tested 29 mobile devices suspected to be infected by Pegasus malware.

Why in news?

• It was alleged that the government used the Israel-based spyware to snoop on journalists, parliamentarians, prominent citizens and even court staff.

What is Pegasus?

• Pegasus is a spyware developed by NSO Group, an Israeli surveillance firm that helps spies hack into phones.
• In 2019, when WhatsApp sued the firm in a U.S. court, the matter came to light.
• In July 2021, Amnesty International, along with 13 media outlets across the globe released a report on how the spyware was used to snoop hundreds of individuals, including Indians.
• While the NSO claims its spyware is sold only to governments, none of the nations have come forward to accept the claims.

Threats created by Pegasus

• What makes Pegasus really dangerous is that it spares no aspect of a person’s identity.
• It makes older techniques of spying seem relatively harmless.
• It can intercept every call and SMS, read every email and monitor each messaging app.
• Pegasus can also control the phone’s camera and microphone and has access to the device’s location data.
• The app advertises that it can carry out “file retrieval”, which means it could access any document that a target might have stored on their phone.

Dysfunctions created

• Privacy breach: The very existence of a surveillance system, whether under a provision of law or without it, impacts the right to privacy under Article 21 and the exercise of free speech under Article 19.
• Curbing Dissent: It reflects a disturbing trend with regard to the use of hacking software against dissidents and adversaries. In 2019 also, Pegasus software was used to hack into HR & Dalit activists.
• Individual safety: In the absence of privacy, the safety of journalists, especially those whose work criticizes the government, and the personal safety of their sources is jeopardised.
• Self-Censorship: Consistent fear over espionage may grapple individuals. This may impact their ability to express, receive and discuss such ideas.
• State-sponsored mass surveillance: The spyware coupled with AI can manipulate digital content in users’ smartphones. This in turn can polarize their opinion by the distant controllers.
• National security: The potential misuse or proliferation has the same, if not more, ramifications as advanced nuclear technology falling into the wrong hands.

Snooping in India:  A Legality check

For Pegasus-like spyware to be used lawfully, the government would have to invoke both the IT Act and the Telegraph Act. Communication surveillance in India takes place primarily under two laws:

1. Telegraph Act, 1885: It deals with interception of calls.
2. Information Technology Act, 2000: It was enacted to deal with surveillance of all electronic communication, following the Supreme Court’s intervention in 1996.

Cyber security safeguards in India

• National Cyber Security Policy: The policy was developed in 2013 to build secure and resilient cyberspace for India’s citizens and businesses.
• Indian Computer Emergency Response Team (CERT-In): The CERT-In is responsible for incident responses including analysis, forecasts, and alerts on cybersecurity issues and breaches.
• Indian Cyber Crime Coordination Centre (I4C): The Central Government has rolled out a scheme for the establishment of the I4C to handle issues related to cybercrime in the country in a comprehensive and coordinated manner.
• Budapest Convention: There also exists Budapest Convention on Cybercrime. However, India is not a signatory to this convention.

Issues over government involvement

• It is worth asking why the government would need to hack phones and install spyware when existing laws already offer impunity for surveillance.
• In the absence of parliamentary or judicial oversight, electronic surveillance gives the executive the power to influence both the subject of surveillance and all classes of individuals, resulting in a chilling effect on free speech.

Way forward

• The security of a device becomes one of the fundamental bedrock of maintaining user trust as society becomes more and more digitized.
• Constituting an independent high-level inquiry with credible members and experts that can restore confidence and conduct its proceedings transparently.
• The need for judicial oversight over surveillance systems in general, and judicial investigation into the Pegasus hacking, in particular, is very essential.

Conclusion

• We must recognize that national security starts with securing the smartphones of every single Indian by embracing technologies such as encryption rather than deploying spyware.
• This is a core part of our fundamental right to privacy.
• This intrusion by spyware is not merely an infringement of the rights of the citizens of the country but also a worrying development for India’s national security apparatus.

UPSC 2023 countdown has begun! Get your personal guidance plan now! (Click here)

World military spending continued to grow in 2021, reaching a record $2.1 trillion despite the economic fallout of the pandemic, according to new data on global military spending published by the Stockholm International Peace Research Institute (SIPRI).

Top defence spenders in 2021

• The five largest spenders in 2021 were the U.S., China, India, the U.K. and Russia, together accounting for 62% of expenditure.
• The U.S. and China alone accounted for 52%.

India’s defence expenditure

• India’s military spending of $76.6 billion ranked third highest in the world.
• This was up by 0.9% from 2020 and by 33% from 2012.
• Amid ongoing tensions and border disputes with China and Pakistan that occasionally spill over into armed clashes, India has prioritised the modernisation of its armed forces and self-reliance in arms production, the report said.

What about Russia and Ukraine?

• Russia increased its military expenditure by 2.9% in 2021, to $65.9 billion, at a time when it was building up its forces along the Ukrainian border.
• On Ukraine, the report remarked that as it had strengthened its defences against Russia, its military spending “has risen by 72% since the annexation of Crimea in 2014”.
• Spending fell in 2021, to $5.9 billion, but still accounted for 3.2% of the country’s GDP.

Also read-

[Sansad TV] Perspective: Self-Reliance in Defence

UPSC 2023 countdown has begun! Get your personal guidance plan now! (Click here)