Wanted: A New Agency To Protect Core Digital Assets Critical To Security Of Nation

The weekend of 8-10 July 2017 was a little different from most other weekends. First, late on Friday night, the Airtel network in the National Capital Region (NCR) went down because of data corruption in one of its critical computers. Then, and the exact time is not known, someone hacked, or illegally accessed, the Jio customer database, retrieved confidential identity data about customers, including phone and Aadhaar numbers, and published the same on a public website. Finally, and again the exact time is not known, something unpleasant happened to the National Stock Exchange computers so that when the market opened on Monday morning, nobody could trade for almost the entire day.

It is possible that these three events were independent, random events but as Goldfinger says, in Ian Fleming’s eponymous novel, “Once is happenstance. Twice is coincidence. The third time it’s enemy action.” So let us not have any delusions about incompetence or equipment malfunction. This was a cyber attack.

Who could the enemy be?

Obviously, we do not know as yet, but consider three more facts. First, this was when India was in a tense stand-off in the Sikkim sector of the Indo-Tibetan border where the Indian army had a significant situational advantage. Second, China has publicly warned India that 2017 will not be the same as 1962. Finally, in 2014, five officers of the Chinese People’s Liberation Army Unit 61398, operating out of a 12-storey building on the outskirts of Shanghai, were indicted by a United States (US) federal grand jury “on charges of theft of confidential business information and intellectual property from US commercial firms and of planting malware on their computers”, leading to a tense stand-off between the US and China over state-backed cyber espionage.

While it is true that no bullets, shells or rockets have been fired across the Himalayan border, at least not till this article was written, could it be that something else is being fired?

Most of us civilians, living far away from the Line of Control (LoC) or international borders, have not seen guns being fired in anger, but thanks to television and social media coverage, we have a fair idea of what happens there. But what does a cyber attack look like?

Consider the two screenshots from two well-known cyber security companies that show cyber attacks in real-time.

This is only a small subset of actual cyber criminal activities that security companies can track and have chosen to make public – like an excerpt from the register of first information reports that is maintained in every police thana in India. As in real life, most crimes are neither recorded nor publicised unless they reach epidemic or pandemic proportions like the WannaCry virus that disabled thousands of computers by encrypting critical data.

Now that we know how pervasive and ubiquitous cyber attacks are, what should we be doing to counter them? Some of us use anti-virus and anti-malware software on our personal machines, and many technology-savvy companies use firewalls to protect their internal networks – that connect both users’ personal machines and company servers containing operational databases – from hostile external access. But is this adequate?

While technology exists to stop almost every kind of cyber attack, not all end users have the knowledge, the ability and, most importantly, the determination to use it effectively. Consider a small- or medium-sized company that uses a billing or financial accounting software. In the past, these would be on standalone machines and hence inherently safe because it was “air gapped” – or physically disconnected – from the big, bad external world. But with more and more bills, invoices and money receipts being exchanged over mail, this is no longer possible. So is the case with electronic filing of various tax returns and the goods and services tax (GST) in particular.

It is now impossible for any useful computer to be isolated from the internet and hence be safe from hostile attacks from anyone, anywhere in the world. Are the computers that form the backbone of our central and state governments safe? Unfortunately, the answer is no. So what if “non-state” hackers shut down the computers that control Powergrid Corporation’s electricity distribution network in India as was the case with the National Stock Exchange? The damage would be worse than a bomb exploding in Howrah station!

The challenge is less about ability and more about the attitude towards security. We know that our homes, offices and factories face threats from thieves and robbers, but do we all learn martial arts or purchase guns? No, we hire security guards or outsource the security to specialised security agencies who have the expertise to handle thugs and thieves. Can our software programmers and IT staff not protect our computer systems? In principle, they can, and in many companies they do keep hackers at bay, but most software programmers have expertise in a completely different area – meeting customer and business requirements in an efficient and economical manner. Security for them is more often than not an afterthought, not the core competence. On the other hand, the durwan at the gate cares two hoots about how and what is being produced in the factory, but only knows that neither should anything go out nor should anyone enter the premises without an approval from an authorised person. That security mindset is lacking in most of our IT installations.

Which is why we have the police in towns, the Central Industrial Security Force (CISF) in factories and airports, the Railway Protection Force at railway stations, the Border Security Force (BSF) and the Indo-Tibetan Border Police on the borders and, of course, the army as specialist agencies of the state whose only job is to ensure the security of our citizens, our factories, our infrastructure and, hence, of the country itself. Where is the equivalent agency that guards our cyber assets? Critical machines in the GST network, the bank ATM network, the telephone network, computers that control the generation and distribution of power, computers that store Aadhaar and voter information are at the moment being guarded, if at all, by people who know little about cyber security and certainly do not have the “police” mindset that anticipates crime and thwarts threats.

CERT-IN, the Indian Computer Emergency Response Team, under the Ministry of Electronics and Information Technology, is merely a technical body, not a security agency, whose responsibility is limited to collecting and disseminating information on threats and offering advice to anyone who chooses to listen. They do have the mandate to intervene during or, as is usually the case, after an attack but do not have the executive or operational responsibility to actually prevent attacks, as is the case of the CISF or the BSF. The so-called “cyber cells” of the metropolitan police are hardly any better – all that they can do is track down mischief-makers who put up politically inconvenient Facebook posts.

Going forward, what we need is to separate the operational roles from security roles. Just as the security of an industrial plant is not the responsibility of the production manager, but instead is handled by a separate security department, so should be the case of security for our government installations. Those who operate IT systems should not have the additional responsibility of ensuring their security. This is not because local IT staff may not be competent enough, but because we need a consistent and comprehensive security stance at all possible threat points. It is not enough for some installations to be secure. Since all systems are interconnected, a breach anywhere is a threat everywhere, and that is why we need consistent security everywhere. Hence, the cyber security team should not be a part of the local IT management but should be part of a central organisation, the Central Cyber Defence Authority, CCDA – analogous to CISF or BSF – reporting directly to the security establishment in the Home Ministry.

In fact, CCDA should be an organisation on par with any other central security agency like CISF, CRPF, BSF, ITBP and, like them, should be headed by a person from a police or crime prevention background with a rank equivalent to that of the head of existing central forces. While CCDA should be responsible for government and public assets, private companies, unless they create their own separate cyber security organisations, could outsource their cyber-security requirements to professional security companies, for whom this will be an additional line of business above and beyond their normal fire and crime prevention services.

But while our security establishments, the army, police, CISF, CRPF, etc, may have the mindset and the security stance to anticipate criminal behaviour and prevent crime, they would not have the technical skills to prevent or fight cyber crime. Cyber security is not part of the curriculum either at the Indian Military Academy or the National Police Academy, and it is unlikely that it will ever be so. Even if some basic training is imparted, it will never have the technical depth required to defeat the sophisticated hacker. However, the Manhattan Project, to build the atom bomb, was run by the US Army Corps of Engineers under General Leslie Groves, but he had the best nuclear scientists like Robert Oppenheimer and Nobel laureates like Richard Feynman working for him. So should be the case of the CCDA – led by people from a police background, with an aptitude in computers and an interest in cyber security, but staffed with people who have the deep technical knowledge, recruited laterally, or on lien, from the IT industry.

Just as the CISF reports to the Home Ministry but is deployed in airports that report to the Aviation Ministry, the CCDA should report to the Home Ministry but should be deployed across all computer installations in all government departments, power generation and distribution companies and other critical utilities like roads, railways, telecom and ATMs. In these deployments, CCDA should be the executive body, not be an advisory one, and should have both the responsibility and the authority to ensure security.

For example, it should be CCDA technicians who have passwords for the firewall servers – that protect government computers on, for example, the GST network or the power transmission network – and should be responsible for configuring the security settings on the same. This will be analogous to the CISF being the custodian of the door keys, frisking passengers and operating the X-ray scanners at the airport.

In fact, CCDA, like the army, should also acquire offensive, or “strike”, capabilities in addition to its professed defensive, or “holding”, capabilities. Building offensive capabilities is a good way to test its own defences, and offence is often the best form of defence.

Unlike other central forces, CCDA need not physically relocate its expert staff to distant locations even when it is deployed to protect dispersed digital assets. Just as the attacker can attack from anywhere in the world, so too can the defender protect from one or two central locations because all activity – both offensive and defensive – can and will be carried out over the same networks.

The HBO television network was recently hacked by people who demanded a multi-million dollar ransom in untraceable bitcoins to refrain from leaking episodes of the billion-dollar Game of Thrones series. What would happen if someone were to hold the Government of India to ransom with a similar hack? Just as we need to have the BSF jawan with his INSAS rifle at the LoC or the CISF jawan with his X-ray scanner at airports, we also need the CCDA jawan – or in this case, the CCDA technician – with his “hardened” firewall to stand guard on the digital assets that are connected to the web.

The arrival of nuclear technology in the battlefield led India to set up the Nuclear Command Authority. With the emergence of Digital India, we need the CCDA to protect the core digital assets that are critical to the safety and security of the country.