Cyber Warfare: Challenges and Options for India’s Defence

“India absorbs and outlasts its conquerors Indian's say. But...I wonder whether intellectually for a thousand years, India had not always retreated before the conquerors and whether in its periods of apparent revival, India had not only been making itself archaic again, intellectually smaller, always vulnerable"

In centuries gone by, tiger ruled the jungle; today it is the "mouse", which wears the crown and canons the cyberspace. Mao's dictum, "Power flows from the barrel of the gun," is en passé; instead power pours from the clicks of the mouse in bits and bytes; later when optical and quantum computing augur presence, it will be in "photons" and "qubits" respectively; or still later, in "cogs" of, yet to philosophically expound, cognitive computing.

The cyber canvas is wide, the pieces galore, and the moves astoundingly complex and varied, wreaking checks, striving for checkmate. The most significant paradigm shift that has occurred is the transition of ICT from a support function to the core of military affairs and control of economy and critical national endeavours. Likewise, the pertinent example in warfare is from force multiplier, to weapon of mass disruption, leading to widespread and split-second destruction of opponent's sinews of power.

There are cyber attacks "ahoy", the variety of weaponry overshoots count and the styles rupture limits of propriety and ethics ad nauseam. Affordable and Mobile Technology with high speeds facilitated these attacks due to its easy access to the people across the world see figures 1.1 and 1.2 respectively.

They target national governments, militaries, critical infrastructures, economies and social edifice by disrupting or destroying networks, software, hardware, mobiles, user interfaces and even "wetware". The latest in the series are operations Shady RAT, Nitro and Red October, authentically or allegedly, originated from the Chinese soil, and "game-changing" malware of the kind; Ransomware, Stuxnet, Duqu, and Flame-widely believed to be state-sponsored with conjectures, real or make-believe-pointing to Israel and the U.S.

These are supplemented by CHAMP that targets enemy electronic systems with NNEMP; HERF gun, e-bombs. photonic weapon systems, EMR Weapons like DRDO’s ‘Kali’, Laser weapons, inter alia Energy Beam Weapons and revitalised DEW of last century's covert research.

In the above context, on 16 April 2010, while addressing the senior officers of the Defence Services and the Ministry of Defence, the then Defence Minister A. K. Antony called upon the top brass of the Armed Forces to coordinate closely with various national cyber agencies and prepare action plan to counter cyber attacks and cyber terrorism. He repeated this counsel in diverse forums, the latest being the 14th Asian Conference on "Non Traditional Security Threats – Today and Tomorrow" held on 13-15 March 2012 under the aegis of the Institute for Defence Studies and Analyses, His apprehensions about the prevailing cyber insecurity are timely and decidedly sought-after.

He opines, "Cyber security is a critical area of concern. With digitisation of the world and various services, the world is becoming increasingly dependent on Internet and information technology. However, security of networks has become a serious concern, as enormous, vital and critical data passes through every day. Any breach of cyber networks can cause untold damage to the security of any society and country. Nations must take serious and prompt note and cooperate with each other to strengthen seamless cyber security" .

It is not that Defence Services were oblivious of the importance of cyber combat, but their involvement had not been to the liking of "agencies" for fear of take over. Further, geeks and lays alike, harbour widespread impression that cyber infractions are more in the nature of fraud, seeding malware, spoofing, spamming and phishing, all in the domain of law and order.

These oddities, coupled with the indifference of the erstwhile establishment, have kept the Defence Services comatose, still worse, out for the count. Nonetheless, each Service, on its own initiative, has set up a modicum of cyber soirée just to keep abreast of what is happening in the world. Splintered, cut-priced and self-initiated as the effort is, it can hardly match non-state actors from abroad and home-grown terrorists within, let alone our avowed and aggressive adversaries and their proxies in the garb of insiders.

Time has come to shed corporate-tainted cost-benefit platitudes and take cyber war seriously in the light of prevailing chary and challenging milieu, which call for armed-forces-specific synchrony of defensive and offensive capability development in the cyber arena.

IDSA released a Task Force Report titled, India's cyber Security Challenges , in 2012, which is stimulating and timely, but somewhat aggregative reconciling of diverse viewpoints of stakeholders. It astutely portrays "Regional Security Scenario 2020", stressing on challenges of asymmetry, anonymity, non-attributable proclivity and deniability as the characteristics of cyber warfare, but discreetly defers specifics of attacks hitherto targeted on India, their perpetrators, the cyber weapons used, or in the offing. Yet in "Back to the Future 1997 to 2012" and "Events of 30 June 2020" the report wisely postures and purveys the "said unsaid," the "known unknown" to make the point.

There has been an exponential growth of computing. Not a day passes when technology does not throw up surprises, or ICANN proposes new measures for governance of Internet. In 2011, the successful trials of new Internet Protocol "IPV6" and new "Domain Names Suffixes" are the cases of instance, both, for elation and apprehension.

Whereas the aforesaid IDSA report purveys "top-down" approach, this exposition highlights a "bottom-up" analytical viewpoint. In this context, we need to also deliberate on raising cyber units down the chain, training warriors and conducting exercises in delivering multifarious weapon-loads from fighting platforms, both, real and virtual, manned and unmanned. It would be prudent to take cue from what others are up to, lest we are left out from the futuristic cybernetic, psychotronic, scalar, or DEW club or for that matter the Internet governance - as is the pertinent example of isolation from the Nuclear Club.

India's cyber security and warfare policy paradigms are dated, clichéd and unimaginative with glaring exceptions, that too, the modicum is restrained and confined to the coffers of top echelons of hierarchy. If cyber intrusion, techno-spying, netspionage, infrastructure-sabotage and electromagnetic attack are recognised as warfare, then "offensive action", is of vital essence to any strategic or tactical plan. Combat, be it real or virtual, is a lawful concern of man-in-uniform and, that too, "exclusive" and "elitist" in design and rationale.

The dictum Secure or Perish given as a title to an earlier published work based on the project "Emerging Global and National Infrastructure and their Security Implications: an Analysis" assigned by the USI of India under DRDO, Dr. Kothari Fellowship in 1998, begs a switch to Pre-erupt or Repent, more consistent with the emerging risks and challenges; albeit the hitherto prevailing penchant to "secure" continues to bear reckonable, if not, imperative virtues.

The first word, pre-empt, underplays widespread proclivity to post attack "patches" and after-thought "parries"; instead, laying significant emphasis on preventative intelligence and constant 24/7 surveillance. Further, it does not, per se, exclude knock-out "punches". The second word, repent, emphasises inevitable regrets for not taking timely action, including retribution or threat thereof. Further, unlike the dicta and doctrine of "Cold Start" or "Two Front War", the action plan cannot and must not be country specific, as cyberspace defies boundaries; besides, the abominable acts hide inimical source, initiated as they maybe, by a fair-weather friend or time-tested foe,

It is widely known, though not acknowledged, that many amongst the decision-makers would not have heard of the MVTW, botnets, zombies, logic bombs, trap doors, EMR, EMP, and scalar weapons, or of ostentatious strategy and multiplicity of devices in the form of ingress, anonymity, autonomy, self-replication and intelligent traits of the malware.

PLA of China and Pakistan Army through ISI control hackers, crackers and Whackerz ; whereas we in India keep our armed forces, scholars and scientists cut-off from sharing intelligence and surveillance, let alone be privy to assessment on simmering threats and unambiguous doctrine with a view to training for offensive options.

This research work is not a primer either for so-called ethical-hacking or for counter-hacking. However, its rationale and thrust would be lost if malware technologies, both, currently ground-breaking and futuristically insightful, are not deliberated and their impact on policy dynamics ignored. Cyber warfare mandates creation of dedicated training establishments and deployment of units of cyber warriors in the learning and practice of its art.

Unlike kinetic warfare the involvement of these units is not confined to active hostilities only, but also during peacetime; not only within the geographical boundaries of a state, but also in outer-space, water-space and airspace friendly, hostile or neutral or commons beyond. Cyber warriors are disciplined in art and scientific academics of ICT, electromagnetic propagation, next generation networks, software programming, cognitive radio, and exploiting the intricacies of computer networks, robotics, cryptography and a host of other legacy and emerging skills and know-how of attacks.

The focus of this research is, both, on conceptual and practical aspects of technological parlance and cyber idiom, such as bandwidth, packet-switched networks, grid topologies, malware almanac, system analysis and database management vis., archiving and mining; besides commonplace tactical terms, associated and prefixed by `cyber', such as reconnaissance, surveillance, convergence, situational awareness, and asymmetric doctrine.

The findings and recommendations herein are designed to illuminate risks and challenges, project futuristic techno-coups; be cautious of war-defined outlook abroad, foster real-world deliberations; and stimulate appropriate policy solutions to the challenges identified zero-day ones somehow and somewhat predicted.

This work evokes a basic orientation to India-centric policy dynamics of cyber security and warfare. It addresses several fundamental perspectives, vis.:

• It emphasises the core idea that cyberspace is a virtual, versatile and dynamic domain or medium with its own rules, whereas warfare rigorously follows set principles. The synthesis of the two terms, cyber and warfare, produces a unique paradigm lucid, powerful and resilient decidedly, ever explorative.
• It draws from the scientific interpretation that cyberspace has separate layers (physical, syntactic, and semantic) the conquest of each of which has vastly different meaning.
• It endorses the oft-enunciated beliefs of cyberspace being an indivisible "Global. Commons” and that it will not replace geographical space and will not abolish state sovereignty. But diffusion of power in cyberspace will co-occur with geographical space and greatly obscure what it implies to exercise of power along each of these domains.
• It takes an overview of the vulnerabilities, the past incidents and anti technologies like viruses, worms and Trojan horses, that plague us; follows it by the tactics of swarming, zapping, war driving, blue-jacking, counter-sniffing, identity sheltering and deep packet inspecting; and then appraises variants and methodologies of cyber attacks - distributed, reflected, unified, massed and blended.
• It underscores susceptibility of our infrastructures to terrorist and enemy attacks particularly those, which are SCADAICS endowed. These are systems that are cybernetic or computer controlled.
• It lends industries, businesses, infrastructure managers and security forces a spotlight that they are an integral and vital part of national security. It is incumbent that they learn how to effectively engage cyber threats, and that too in concert with each other.
• It underscores need for establishing inter-service structures that train and conduct cyber exercises identifying current and future threats, expected from state and non-state entities with a view to engaging in war and peace.
• It seeks to create an elite army of futuristic techno-geeks that innovate and propagate software-defined and intelligence-endowed cyber gadgetry; a bevy of black-box inspectors that predict, trace, track and "black-hole" even the "zero-day malware"; and a motivated, well-versed in cyber tradecraft, somewhat low-key, yet crisis-hardened cyber warrior-commune that serves the country in becoming a responsive and deterrent cyber power of reckoning and merit.
• It urges that cyber warfare is, first and foremost, a "warfare", both, by appellation and implication; therefore, a primary and serious concern of the armed forces. We, in our deliberations, should eschew: firstly, the differentiation between civil and military on jurisdiction . Instead there is a need for a policy, which is articulate, unhindered and unambiguous, and that "empowers combatant commanders to execute full spectrum of cyber endeavour" before, during and after combat operations.
• It suggests protective offense is the best form of defence; patting a cue from the US Armed Forces seeking right to retaliate. The preventive attribute may well be non lethal e.g., radio frequency jamming, HERF strike or NNEMP attack.
• It cautions that the aforesaid does not mean defence has to be ignored. Cyber attacks are facilitated not by use of force but by the manipulation and exploitation of the enemy's defencelessness. High time we paid attention to our expertise: scientists, academia and information warriors - particularly the last one - suggestive of strategic and hi-tech options to neutralise attempts at espionage, sabotage, subversion and physical destruction of communication and information infrastructures.
• It investigates acupuncture points of e-ecosystem and their impact on intelligence gathering, strategy, technological research and development, organisation structures, command and control and futuristic force multiplicative thrusts with a view to evolving a vigorous and authentic plan of action.
• In concluding remarks, it leaves a sobering, yet pertinent, thought that although we are highly worried, time is against us and it would be to our peril if we ignore the above-said realities. Let us pay heed to Sun Tzu, who forewarned that- "The value of time, of being a little ahead of your opponent, often provides greater advantage than superior numbers or greater resources”.

“It always seems impossible, until it’s done”.

- Nelson Mandela

Broad philosophy, on which this thesis anchors, is that cyber warfare is fallout of cyber power, a subset of information or what Chinese term as informationisation warfare and of intimate kinship to "Network Centric", "Sub Rosa", "No contact", "Unrestricted", "Electromagnetic Spectrum", "mimetic" "scalar", "Cognitive", "psychological", and "Psychotronic" Warfare; besides many, indeed many, emerging variants, cross breeds, and hybrids of the so-called irregular, or non-traditional warfare.

The technology of virtual battle arena has turned up bit-by-bit and critically, but the consequences, thereof, have surfaced at an enormous and revolutionary scale and, that too, imperceptibly.

The security and warfare paradigms, though unique, are transiting ad nauseam - technologically complex in conduct, and demanding nano-second responses. Therefore, the policy perspective and action plan must follow the maxim, "Prevent or Repent". This calls for an understanding of world-wide overt and covert initiatives, and at home, synchrony of security, proactive defensive and preventive offensive strategies. A comprehensive, joint and Ludo-centric "policy initiative", is the need of the hour.

It would embrace all the stakeholders in its fold, identifying threats, vulnerabilities and challenges, exploring schema and stratagems and positioning structures to overcome them, Obviously, some aspects, which are in the domain of the armed forces, research and development establishments, and intelligence agencies would be classified.

The way we conduct our conflicts is a reflection of our society. This is not a unique observation. In their book War and Antiwar, Heidi and Alvin Toffler observed that the way warfare is conducted is a reflection of the period in history. They divided human history and their corresponding conflicts into three waves, namely Agrarian, Industrial and Information age. Today, we are in an information age.

In this age the increasing flow of information, rapid flow of data, the evolution of global economy, creation of internet, ever increasing dependence on information network in day to day business have definitely made things convenient, fast, encompassing, inclusive and reaching to everyone but at the same time increased vulnerabilities have also been created in cyberspace. These vulnerabilities have given possibilities of offence and defence in the cyberspace giving rise of a new warfare namely Cyber Warfare.

India being an emerging economy and poised to be one of the Global powers, definitely has to have serious concern to ensure that her cyberspace, her information infrastructure, network, portals of several institutions, department and transactions on nets or internet remain safe and adequately protected from the offensive tools of perpetrators of cyber crime/war. It is equally important to know and practice offensive tools in use or likely to be developed and used by perpetrators to keep defence, safeguards up to date and seek information dominance.