Subject: Internal Security

The Ministry of Home Affairs has recommended a ban on 54 Chinese mobile applications that pose a threat to the country’s security.

Legal basis of app ban

• The ban has been enforced under Section 69A of the Information Technology Act, 2000.
• This act empowers to issue directions for blocking for public access of any information through any computer resource.
• This is done in the interest of –
  1. sovereignty and integrity of India
  2. defense of India, security of the State
  3. friendly relations with foreign states
  4. public order (or)
  5. for preventing incitement to the commission of any cognizable offense relating to above

Why MHA has put such a ban?

• Most of these apps were operating as clones or shadow apps of the apps that had earlier been banned by the government.
• There was stealing and secretly transmitting users’ data in an unauthorized manner to servers that have locations outside India.
• These apps largely impact the psychosocial abilities of the users.
• The immediate decision has been taken in a specific strategic and national security

Implications of the ban

• India’s offensive: The move comes as an exercise of coercive diplomacy with China amid the heated exchange of words during the diplomatic boycott on the winter Olympics.
• Hurting china’s ambitions: The ban may affect one of China’s most ambitious goals, namely to become the digital superpower of the 21st century.
• Data nationalization: The ban is also based on the recognition that data streams and digital technology are a new currency of global power.

Issues with the ban

• Not only China: Data privacy and data security concerns are not limited only to Chinese apps.
• Harm already caused: The apps that were banned were very popular in India and the move to block them comes after these apps had already amassed hundreds of millions of users in India.
• Further dependency on China: The ban on Chinese mobile apps is a relatively soft target, as India remains reliant on Chinese products in several critical and strategically sensitive sectors.

Way Forward

• There is a strong case to revise the key legislations and sync them to change the digital environment.
• Data privacy and security remain to be major challenges emanating from the ongoing digital revolution.
• Thus, a data protection law is long overdue.
• India must speed up indigenization, research, and development, and frame up a regulatory architecture to claim data sovereignty.

UPSC 2022 countdown has begun! Get your personal guidance plan now! (Click here)

Context

Cyber-attacks may be a relatively new phenomenon, but in a short timeframe have come to be assessed as dangerous as terrorism.

A cyber attack is a type of attack that targets computer systems, infrastructures, networks, or personal computer devices using various methods at hand. India is ranked 10th (among 194 countries) in the Global Cybersecurity Index (GCI) 2020 ahead of China and
Pakistan.

The increasing threat of cyber attacks

• Stuxnet Worm in 2010: Resulted in large-scale damage to Iran’s centrifuge capabilities.
• Natanz nuclear facility (Iran) in 2021: Targeted the industrial control systems and destroyed the power supply to centrifuges used to create enriched uranium
• Chinese cyberattack on the power system in Mumbai brought the entire city to a halt.
• Ransomware as a Service (RaaS) — a business model for ransomware developers — is no mere idle threat.
• Advanced Persistent Threats (APT) attacks are set to increase, with criminal networks working overtime and the Dark web allowing criminals to access even sensitive corporate networks.

Tools of Cyberattacks

• Malware: Malicious software to disrupt computers. It can include Viruses, Spyware, Trojans, etc.
• Phishing: It is the method of trying to gather personal information using deceptive e-mails and websites.
• Denial of Service attacks: A Denial-of-Service (DoS) attack is an attack meant to shut down a machine or network, making it inaccessible to its intended users.
• Hacktivism:  Misusing a computer system or network for a socially or politically motivated reason. For example, hacktivists can block access to Government’s website, deface the government’s website or unblock the sites which have been blocked by the Government.
• Social Engineering: Entice users to provide confidential information. For example, these days u must have come across some of the fake Facebook accounts which are opened in the name of your close friends. First, the cyber attackers send you the friend request in the name of your close friend. Once u accept it, they will ask to request you to transfer some money.

Consequences of Cyberattacks

• Impact on data: Confidentiality, Integrity and Availability of information.
• Impact on Critical Information Infrastructure: Presently, most of the sectors are critically dependent on the use of ICT to carry on their operations. These sectors are Banking and Finance, Power systems, Transport sector, Telecommunication, etc. Cyber attacks on these critical information infrastructures can bring the entire country to a grinding halt. For example, the recent Chinese cyber attack on the power system in Mumbai brought the entire city to a halt.
• Creates Distrust: A cyber-attack on a specific component exposes vulnerabilities in the entire system which may negatively impact relations with allies and adversaries and questions our nuclear reliability.
• Financial loss: Estimates of the cost to the world in 2021 from cyberattacks are still being computed, but if the cost of cybercrimes in 2020 (believed to be more than $1 trillion) is any guide, it is likely to range between $3trillion-$4 trillion.
• Threat to National Security and peace and stability in a country.

Steps taken by India to improve Cyber Security

• Section 66F of ITA: Specific provision dealing with the issue of cyber terrorism that covers denial of access, unauthorized access, introduction of computer contaminant leading to harm to persons, property, critical infrastructure, disruption of supplies, ‘sensitive data’ thefts. Provides for punishment which may extend to life imprisonment.
• National Cyber Security Policy 2013: Policy document drafted by the Department of Electronics and Information Technology. Established National Critical Information Infrastructure Protection Centre (NCIIPC) to improve the protection and resilience of the country’s critical infrastructure information; Create a workforce of 5 lakh professionals skilled in cybersecurity in the next 5 years.
• National Critical Information Infrastructure Protection Centre (NCIIPC): It has been setup to enhance the protection and resilience of Nation’s Critical information infrastructure. It functions under the National Technical Research Organization (NTRO).
• CERT-IN: Organization under the Ministry of Electronics and Information Technology with an objective of securing Indian cyberspace. The purpose of CERT-In is to respond to computer security incidents, report on vulnerabilities, and promote effective IT security practices throughout the country. According to the provisions of the Information Technology Amendment Act 2008, CERT-In is responsible for overseeing the administration of the Act.
• Cyber Surakshit Bharat Initiative: It was launched in 2018 with an aim to spread awareness about cybercrime and build capacity for safety measures for Chief Information Security Officers (CISOs) and frontline IT staff across all government departments.
• Cyber Crisis Management Plan (CCMP): It aims at countering cyber threats and cyber-terrorism.
• National Cyber Coordination Centre (NCCC): It seeks to generate necessary situational awareness of existing and potential cyber security threats and enable timely information sharing for proactive, preventive and protective actions by individual entities.
• National Cyber Security Coordinator (NCSC) under National Security Council Secretariat (NSCS) coordinates with different agencies at the national level for cyber security matters.
• Cyber Swachhta Kendra: This platform was introduced for internet users to clean their computers and devices by wiping out viruses and malware.
• Information Security Education and Awareness Project (ISEA): Training of personnel to raise awareness and to provide research, education, and training in the field of Information Security.

Challenges

• Structural:
  a)Absence of any geographical constraints.
  b)Lack of uniformity in devices used for internet access.
• Administrative:
  a) Lack of national-level architecture for cybersecurity
  b) Security audit does not occur periodically, nor does it adhere to the international standards.
  c) The appointment of the National Cyber Security Coordinator in 2014 has not been supplemented by creating liaison officers in states.
• Procedural
  a) Lack of awareness in local police of various provisions of IT Act, 2000, and also of IPSC related to cybercrime.
  b) Lack of data protection regime.
• Human Resource Related
  a) Inadequate awareness among people about the security of devices and online transactions.

Way forward

• International Convention: Presently, Budapest Convention is the first international treaty that promotes greater cooperation between countries in fighting cybercrimes. India should accede to Budapest Convention at the earliest. It would reduce India’s capacity to combat cybercrimes at a global level.
• PPP Framework for Cyber Security: Presently, most of the cyber security operations are carried out by the Government agencies such as CERT-In. Given the fast-changing nature and intensity of cyber threats, there is a need to leverage private sector expertise in combating cyber crimes through the PPP framework.
• Capacity building and skill development- Recently, according to a report published by NASSCOM, India needs around 10 lakh, cyber security experts. However, presently there are only around 64,000 professionals. One of the main reasons for the lower number of cyber security professionals is due to lack of an adequate number of specialized courses in cyber security, poor training Infrastructure, lack of availability of trainers, etc. Hence, accordingly, the Government has to recognize the lacunae and increase the number of Skilled professionals.
• Promoting Startups in the field of Cybersecurity.
• Investment in R&D to improve Cyber Security- Big data, AI
• Learning from best practices such as the Tallinn manual of the US.

Conclusion

Failure to build resilience — at both the ‘technical and human level — will mean that the cycle of cyber attacks and the distrust they give rise to will continue to threaten the foundations of a democratic society. Preventing erosion of trust is critical in this day and age.

UPSC 2022 countdown has begun! Get your personal guidance plan now! (Click here)

A New York Times report has claimed that the Indian government had bought the Pegasus Spyware in 2017.

What is Pegasus?

• Pegasus is a spyware developed by NSO Group, an Israeli surveillance firm that helps spies hack into phones.
• In 2019, when WhatsApp sued the firm in a U.S. court, the matter came to light.
• In July 2021, Amnesty International, along with 13 media outlets across the globe released a report on how the spyware was used to snoop hundreds of individuals, including Indians.
• While the NSO claims its spyware is sold only to governments, none of the nations have come forward to accept the claims.

Why is Pegasus so lethal?

• What makes Pegasus really dangerous is that it spares no aspect of a person’s identity.
• It makes older techniques of spying seem relatively harmless.
• It can intercept every call and SMS, read every email and monitor each messaging app.
• Pegasus can also control the phone’s camera and microphone and has access to the device’s location data.
• The app advertises that it can carry out “file retrieval”, which means it could access any document that a target might have stored on their phone.

Dysfunctions created by Pegasus

• Privacy breach: The very existence of a surveillance system, whether under a provision of law or without it, impacts the right to privacy under Article 21 and the exercise of free speech under Article 19.
• Curbing Dissent: It reflects a disturbing trend with regard to the use of hacking software against dissidents and adversaries. In 2019 also, Pegasus software was used to hack into HR & Dalit activists.
• Individual safety: In the absence of privacy, the safety of journalists, especially those whose work criticizes the government, and the personal safety of their sources is jeopardised.
• Self-Censorship: Consistent fear over espionage may grapple individuals. This may impact their ability to express, receive and discuss such ideas.
• State-sponsored mass surveillance: The spyware coupled with AI can manipulate digital content in users’ smartphones. This in turn can polarize their opinion by the distant controllers.
• National security: The potential misuse or proliferation has the same, if not more, ramifications as advanced nuclear technology falling into the wrong hands.

Snooping in India:  A Legality check

For Pegasus-like spyware to be used lawfully, the government would have to invoke both the IT Act and the Telegraph Act. Communication surveillance in India takes place primarily under two laws:

1. Telegraph Act, 1885: It deals with interception of calls.
2. Information Technology Act, 2000: It was enacted to deal with surveillance of all electronic communication, following the Supreme Court’s intervention in 1996.

Cyber security safeguards in India

• National Cyber Security Policy: The policy was developed in 2013 to build secure and resilient cyberspace for India’s citizens and businesses.
• Indian Computer Emergency Response Team (CERT-In): The CERT-In is responsible for incident responses including analysis, forecasts, and alerts on cybersecurity issues and breaches.
• Indian Cyber Crime Coordination Centre (I4C): The Central Government has rolled out a scheme for the establishment of the I4C to handle issues related to cybercrime in the country in a comprehensive and coordinated manner.
• Budapest Convention: There also exists Budapest Convention on Cybercrime. However, India is not a signatory to this convention.

Issues over government involvement

• It is worth asking why the government would need to hack phones and install spyware when existing laws already offer impunity for surveillance.
• In the absence of parliamentary or judicial oversight, electronic surveillance gives the executive the power to influence both the subject of surveillance and all classes of individuals, resulting in a chilling effect on free speech.

Way forward

• The security of a device becomes one of the fundamental bedrock of maintaining user trust as society becomes more and more digitized.
• Constituting an independent high-level inquiry with credible members and experts that can restore confidence and conduct its proceedings transparently.
• The need for judicial oversight over surveillance systems in general, and judicial investigation into the Pegasus hacking, in particular, is very essential.

Conclusion

• We must recognize that national security starts with securing the smartphones of every single Indian by embracing technologies such as encryption rather than deploying spyware.
• This is a core part of our fundamental right to privacy.
• This intrusion by spyware is not merely an infringement of the rights of the citizens of the country but also a worrying development for India’s national security apparatus.

UPSC 2022 countdown has begun! Get your personal guidance plan now! (Click here)