Technical Advisory Committee (TAC) Of SEBI To Address Cyber Security Issues As Well

Cyber security has become a priority issue for stakeholders’ around the world. Though governments are slow to adapt to cyber security requirements yet there is no escape from the necessity to have a robust and resilient cyber security infrastructure. India has been adopting technology driven project that have little cyber security support. For instance, cyber security for Digital India, e-governance, e-commerce, etc is still missing in India. Till now India is a sitting duck in cyberspace and civil liberties fields and it must be suitably prepared to deal with the cyber security challenges that would further increase in India in the near future.

There are many cyber law and cyber security obligations of Directors of Indian companies that are still not fulfilled by them. Indian government is also slow in enforcing these cyber law and cyber security obligations of Indian directors. The recent judgment of Supreme Court of India on Sections 66A, 69A and 79 of Information Technology Act, 2000 has further killed cyber law due diligence requirements in India to a great extent. This judgment must be reviewed by the Supreme Court to remove the unintended consequences of the same.

We at Centre of Excellence for Cyber Security Research and Development in India (CECSRDI) has suggested that Narendra Modi government must formulate the Cyber Security Policy of India 2015 as soon as possible. The Cyber Security Policy of India 2013 is suffering from many shortcomings that must be removed in the 2015 policy. India must also be cyber prepared to protect its cyberspace.

CECSRDI has also suggested that a dedicated cyber security law of India is need of the hour. The same must be a techno legal framework keeping in mind contemporary cyber security threats. Further cyber security disclosure norms in India must be formulated by Modi government. The cyber security awareness in India must be further improved with a special emphasis upon clearly specifying the cyber security obligations of directors of Indian companies.

The Cyber Security Trends of India 2015 by CECSRDI have outlined that state sponsored cyber attacks and an increased use of malware is on the cards. Cyber security of banks in India is need of the hour as cyber criminals have been targeting banking and financial institutions in India for long. Even the capital markets of India are vulnerable to sophisticated cyber attacks. The Securities and Exchange Board of India (SEBI) has been mandated to regulate the entire gamut of capital markets in India and it is required to ensure cyber security of capital markets as well.

Now it has been reported that SEBI has expanded the ambit of its Technical Advisory Committee (TAC) to include cyber security of the markets. CECSRDI welcomes this move of SEBI and is committed to help it in every possible manner to achieve this benign cyber security objective.

The five-member TAC formed in 2010 is headed by Ashok Jhunjhunwala, faculty-member, Indian Institute of Technology-Madras. The other members are H Krishnamurthy of the Indian Institute of Science (Bangalore), Abhay Karandikar of IIT-Bombay and Vibhakar Bhushan of Trignon Business Consulting and Synchosoft.com.

The TAC advises SEBI on various policy and internal technological safety issues. It also aids the regulator on framing appropriate policies arising out of technological advancements in areas such as wireless trading, co-location, algorithmic trading, smart order routing, Application Programming Interface (API). SEBI is particularly worried about the growing cyber crimes that have become complicated and stealth in nature. State sponsored attacks are also a caused of concern for various cyber security stakeholders. SEBI believes that Indian capital market needs a framework for future plan of action on securities market resilience.

This move of SEBI aims at securing the data, applications, database, operating systems and network layers of (FMIs) from various forms of cyber attacks such as Denial of Service (DoS) attacks, phishing, hacking, man-in-the-middle attack, sniffing, spoofing, key-logging and malware attacks. Critical infrastructure protection in India (PDF) is still struggling to deal with sophisticated cyber attacks and malware. In the past it was declared that NTRO would protect the critical ICT infrastructures of India. The National Critical Information Infrastructure Protection Centre (NCIPC) of India has also been established to protect Indian critical infrastructures. Nevertheless, cyber security of critical infrastructure of India is yet to be achieved.

CECSRDI hopes that Indian government and authorities like SEBI would help in securing Indian critical infrastructures like banks, capital markets, etc very soon. The starting point can be the cyber security policy of India 2015 as already suggested by CECSRDI.

Source: Global Techno Legal News And Views.

Indian Cyber Security Infrastructure Must Be Strengthened

India has launched technology driven and ambitious projects that rely heavily upon information and communication technology (ICT). In the past these projects were put under an umbrella known as national e-governance plan (NEGP). However, cyber security issues of e-governance in India were left ignored by Indian government. Now the NEGP has been renamed as Digital India and it is also plagued by inadequate cyber security. As a result, Digital India project is heading towards rough waters in India.

Cyber security infrastructure in India is never given any siginificance. Even when some policy initiatives were undertaken by Indian government from time to time, they were more on the side of lip works and paper tiger only. For instance, the cyber security policy of India 2013 is just a facade to cover the inadequate cyber security of India.

An analysis of the cyber security policy of India would make it clear that it is useless and the cyber security policy of India 2015 must be urgently formulated by Indian government. The same must be accompanied by a Cyber Attack Crisis Management Plan of India that can address threats arising in Indian cybersapce. Cyber security should also be made part of national security policy of India.

At Perry4Law Organisation (P4LO) and Perry4Law's Techno Legal Base (PTLB), we firmly believe that a robust, strong and resilient cyber security infrastructure of India must be established as soon as possible. This cyber security infrastructure must be capable of thawarting the sophisticated malware and cyber attacks that have tremendously increased in the recent past. We also recommend that dedicated cyber security law of India must also be formulated that must put an obligation to inform about cyber security breaches upon individuals and organisations.

Recently the Prime Minister's Office (PMO) appointed Dr. Gulshan Rai as the first chief information security officer (CISO) of India. This is a positive development as Dr. Gulshan Rai is well capable to deal with cyber security related issues in India. We hope that he would also take care of cyber security of smart cities in India. Smart cities in India are presently facing many problems including the issues of civil liberties. Further, cyber security of smart grids of India must also be ensured to protect our power grids.

Another related problem is lack of cyber security in banking industry of India. This is the reason why the Reserve Bank of India (RBI) has decided to open an IT Subsidiary so that cyber security related issues of banks in india can be effectively managed by RBI.

P4LO recommend that cyber security infrastructure of India must be strengthen immediately. This is also relevant for the Digital India project that is facing many cyber security challenges. The sooner this is done the better it would be for Indian cyberspace.

Digital India Project Of India Lacks Cyber Security Infrastructure

In this article, Praveen Dalal, Managing Partner and CEO of Perry4Law Organisation (P4LO) and PTLB, is discussing shortcomings of Digital India project of Indian government. Digital India and cyber security issues in India have been ignored by Indian government so far and this article is addressing that aspect as well.

The success or failure of any project depends upon it due research and analysis. Without a proper homework and due diligence, a project may face many shortcomings, lacuna and limitations. One such project is known as Digital India. As on date, the Digital India project of India government is heading towards rough waters and problems. This is because Digital India project is suffering from many shortcomings and limitations that Indian government has failed to remove.

For instance, the cyber security infrastructure of India is not in a good shape. Take the example of smart grids cyber security in India. India is contemplating using of smart meters but the same has become a headache for the power companies. Even a Grid Security Expert System (GSES) of India was suggested by Indian government in the past but the same has not been implemented till now.

The Digital India Project of India Government is the classic example of use of Information and Communication Technology (ICT) for delivery of public services. Like any great project, Digital India is also suffering from some “Shortcomings”. The chief among them are lack of Cyber Security, ineffective Civil Liberties Protection, absence of Data Protection (PDF) and Privacy Protection, unregulated E-Surveillance in India, absence of Intelligence Agencies Reforms in India, etc.

Unfortunately, the initial objective of public delivery of services through use of ICT seems to be fading away day by day. Instead of public services the focus has now been shifted towards e-surveillance and data mining. To make this work, Indian Government has been using e-surveillance projects like Aadhaar, Central Monitoring System, Network and Traffic Analysis System (NETRA), National Intelligence Grid (NATGRID), National Cyber Coordination Centre (NCCC), etc. None of them is supported by any “Legal Framework” and “Parliamentary Oversight”.

In fact, Vodafone has confirmed that India has been using “Secret Wires” in the Telecom Infrastructure to indulge in e-surveillance. Indian Department of Telecommunications suppressed the whole incidence with a mere assurance of “Investigation” that never took place. As per my personal information, no “Public Report” was made available in this regard by Indian Government so far.

In a latest twist, the Indian Government clubbed its latest Project named Digital Locker with Aadhaar. Essentially it means that Digital Locker is a legal project based upon illegal technology named Aadhaar. I have serious doubts that Digital Locker would serve its or Digital India’s purpose in these circumstances. The matter does not end here. Indian Government has claimed before the Supreme Court that Aadhaar is not mandatory for availing public services. However, this stand of Indian Government is not correct as Aadhaar has already been made compulsory for many public services and many more are added on regular basis.

Surprisingly, Supreme Court has not invoked either the Contempt or the Perjury proceedings against Central Government and States for making false claims and giving incorrect statements. Is not it the duty of Supreme Court to protect the Fundamental and Human Rights of Indian Citizens and residents? It is difficult to believe that Supreme Court is not aware of the ground situation that is actually happening in India. How can the Supreme Court simply rely upon false and misleading statements and allow the Central Government and States to operate in a manner that is clearly prejudicial to the Constitutional Protections and Principles?

It would be really unfortunate if Digital India Project is made the biggest Panopticon of Human History and an endemic E-Surveillance Instrumentality for the Indian Government where every bit of “Digital Information” can be accessed and manipulated by Indian Government. If this is the intention of Indian Government then Digital India Project is heading for rough waters.

Source: ICTPS Blog.

Smart Grids Cyber Security In India

Cyber security is no more an ignored area for governments around the world. India has also recognised the significance of cyber security but its efforts in this direction are still scatterd, unstructured and inadequate. Perry4Law Organisation (P4LO) has been advocating for establishing a strong, robust and resilient cyber security infrastructure in India for almost a decade.

P4LO also believes that international legal issues of cyber security must be resolved on mutual cooperation basis among various countries. Countries may work in the direction of formulating international cyber law treaty and international cyber security treaty (PDF). Similarly, international legal issues of cyber security and conflict of laws in cyberspace must also be resolved by Indian government.

These days most of the public utilities are managed and coordinated by information and communication technology (ICT). In many cases, these utilities are managed through remote administration as well. This is also the stage and process that makes these utilities vulnerable to cyber attacks.

Keeping this fact in mind, critical infrastructure protection in India in general and cyber security of automated power grids of India in particular must be ensured with latest technology and international best practices.

Cyber security issues in India are emerging day by day. Similarly, the cyber security awareness in India is also increasing. However, cyber security capabilities of India are still not up to the mark. Cyber security skills developments in India are urgently required.

There would be many cyber security challenges for future smart grids of India. The evolution of SCADA system, deficiencies and shortcomings of existing power devices and vulnerabilities of software managing SCADA systems are areas of special concern for India.

These days power grids are centrally connected and integrated in nature from the stage of power generation to it transmission and distribution. A compromise of such power grids   can lead to power outages/blackout or even damage to power system devices and thereby huge loss to the utilities.

Further, renewable energy/distributed generation demands are the added feature of smart grid and due to networked control future power system will be much more vulnerable to cyber terrorism attacks, cyber warfare activities and cyber espionage attempts. Therefore, before switching to smart grids, India must consider cyber security challenges for them as well.

Perry4Law and Perry4Law Techno Legal Base (PTLB) are in the process of drafting of cyber security best practices for smart grids in India. We invite professional collaborations and cooperation in this regard from various smart grid stakeholders. If interested, kindly send your proposals while communicating with us so that we can consider collaborative aspects of such proposals.

Hacked USB Can Damage Computer’s Circuit And Crucial Components

USBs have been used for long to infect systems and to steal data. This is done by first infecting the concerned USB with a customised malware and then running the same on the target computer or system. Wherever physical access to the target system is not available, the USB can be simply left within the visibility and reach of the person managing such system. This social engineering tactics is very effective even today and in majority of cases the system administrator runs such infected USB upon his system.

Some users also allow autorun option for the media outputs including USBs. This is a serious cyber security risk as the malware would automatically start running and installing with such an option. By default autorun must be disabled by the users for security reasons.

For long, USBs have been used for corporate and cyber espionage. Now USB has also become a tool of cyber warfare as it can be customised to create damage rather than corrupting the system. A Russian hacker/researcher created a USB that can crash the victim system once the modified/hacked USB is plugged into it.

The researcher, nicknamed Dark Purple, hacked a standard USB stick, and installed an inverting DC-DC converter and some capacitors bought from a Chinese website. When the USB is plugged in, it charges the capacitors to -110V before shutting down. Next, a transistor discharges the stored electricity through the USB port’s data pins. This continues until the capacitors are down to -7V, at which point the DC-DC converter is switched back on, and begins to charge the capacitor back for the next cycle.

The basic idea of the USB drive is quite simple. When we connect it up to the USB port, an inverting DC/DC converter runs and charges capacitors to -110V. When the voltage is reached, the DC/DC is switched off. At the same time, the filed transistor opens. It is used to apply the -110V to signal lines of the USB interface. When the voltage on capacitors increases to -7V, the transistor closes and the DC/DC starts. The loop runs till everything possible is broken down.

USB ports are typically well protected from electrical attacks, but the inverting DC-DC converter gets around these defenses – and eventually overloads them to damage the PC’s sensitive inner electronics. Clearly cyber security and the defence against cyber warfare have to be moved to the next level as present day’s safeguards are not enough to ward off these customised and stealth cyber attacks.

Source: Global Techno Legal News And Views.

Grid Security Expert System (GSES) Of India Proposed To Ensure Cyber Security Of Power Grids

Present days critical infrastructures are connected to information and communication technology (ICT) for portability, convenience and remote control purposes. Although this process brings many advantages yet this usage of ICT for critical infrastructures also exposes them for potential cyber attacks.

According to the Cyber Security Trends of India 2015 by Perry4Law Organisation (P4LO), Critical Infrastructure Protection in India (PDF) would be required in the year 2015 as India has launched projects like Digital India and Internet of Things (IoT) (PDF). Indian Government needs to work hard in this regard as cyber security challenges in India are very daunting in nature.

The cyber security challenges before the Narendra Modi government are more demanding than its predecessor government due to heavy reliance upon ICT and technology. However, India is not yet prepared to deal with the same. We at Centre of Excellence for Cyber Security Research and Development in India (CECSRDI) believe that Modi government must urgently formulate the Cyber Security Policy of India 2015 as the previous policy is just a paper work with no actual benefits.

Now here lies the real problem. Formulation of a techno legal framework and robust cyber security policy of India 2015 require tremendous techno legal acumen. Further, the actual implementation of the proposed 2015 policy would be even more difficult. This may be the reason that Modi government is shy in bringing any change in the otherwise outdated and redundant 2013 cyber security policy of India. Nevertheless, a call has to be made in this regard and immediate action is need of the hour.

It is not the case the Modi government has not taken pro cyber security initiatives in India. Firstly, Modi government has appointed Dr. Gulshan Rai as the first chief information security officer (CISO) of India. Secondly, Narendra Modi has suggested to Nasscom that a task force be set up to solve the growing cyber security menace in India. According to Nasscom the taskforce would be constituted within a period of one month. Now it has been reported that the Grid Security Expert System (GSES) of India has been proposed to be developed by Powergrid.

GSES would involve installation of knowledge based Supervisory Control and Data Acquisition (SCADA) system, numerical relays and Remote Terminal units upto 132 kV stations and the reliable Optical fibre Ground wire (OPGW) communication system at an estimated cost of around Rupees 1200 crores. The objective of the GSES is implementation of the Automatic Defense mechanism to facilitate reliable and secure grid operation.

CECSRDI welcomes this move of Indian government. We have been advocating that a robust cyber crisis management plan of India is need of the hour. A crisis management plan for preventing cyber attacks on the power utilities in India has also been suggested by CECSRDI. We have also suggested that crisis management plan of India for cyber attacks and cyber terrorism is required. Power grids cyber security in India and its challenges are not much known as on date but awareness about the same is fast increasing. The present decision of Indian government to establish GSES is an example of the same.

It has also been stated that the Computer Emergency Response Team-India (CERT-IN), Department of Information Technology, Ministry of Communication and Information Technology, Government of India has prepared a Crisis Management Plan (CMP) for countering cyber attacks and cyber terrorism. The CMP intends to prevent large scale disruption in the functioning of critical information systems of Government, public and private sector resources and services. A framework has also been outlined for dealing with cyber related incidents for rapid identification, swift response and remedial actions to mitigate and recover from cyber related incidents impacting critical national processes.

In December 2010, Ministry of Power had constituted CERTs (Computer Emergency Response Teams) for power sector. At CECSRDI we welcome establishment of these dedicated CERTs as they can manage cyber security issues in a better manner. For instance, CERT-Thermal (nodal agency- National Thermal Power Corporation (NTPC)), CERT-Hydro (nodal agency- National Hydroelectric Power Corporation (NHPC)) and CERT-Transmission (nodal agency- Power Grid Corporation of India Limited (PGCIL) can take necessary action to prevent cyber attacks in their domains. The State Power Utilities have also been advised to prepare their own sectorial Crisis Management Plan (CMP) and align themselves with the Nodal Agencies i.e. NTPC, NHPC & PGCIL and CERT-In for the necessary actions.

Cyber security of automated power grids of India is need of the hour. It is only after a massive power blackout in 2012 that Indian government has woken up to the dangers of cyber attacks against Indian power sector. Based on the recommendations of the Enquiry Committee, constituted by Ministry of Power to enquire into the causes of the grid collapse of 2012, several measures like third party protection audit, review of Unscheduled Interchange mechanism, review of Central Electricity Authority transmission planning criterion, tightening of frequency band, coordinated planning of outages, development of islanding schemes, proper maintenance of under frequency relays etc. have been taken by the Government to prevent grid failures. We welcome these pro active efforts on the part of Indian government.

However, it would be really interesting to observe what actual steps would be taken by Modi government to strengthen Indian cyber security. Till now Modi government has not come out with even a single cyber security related policy decision or initiative. These policy decisions and projects, with their own merits and demerits, are the legacy of Congress government. What Modi government would do in this regard is yet to be seen. We wish all the best to Modi government in the field of cyber security and other related projects.

Source: Global Techno Legal News And Views.

PMO Appoints Dr. Gulshan Rai As The First Chief Information Security Officer (CISO) Of India

India has been pushing for delivery of public services through e-governance for long. However, India failed to consider the cyber security aspects of e-governance and this is a dangerous situation. When everything is connected to the Internet or cyberspace, the risks of cyber attacks are very real and significant. Now India has once again adopted an ambitious technology driven project named Digital India.

Even Digital India has been heading towards rough waters due to lack of clear policies and implementation plan. Besides civil liberties protection in cyberspace, Indian Government must also keep in mind the cyber security aspects of Digital India project. As on date India is a sitting duck in cyberspace and civil liberties protection fields.

The Centre of Excellence for Cyber Security Research and Development in India (CECSRDI) has provided the cyber security trends and developments in India in 2013 (PDF), 2014 and 2015. These trends have proved that India has failed on the front of developing offensive and defensive cyber security capabilities. At CECSRDI we believe that cyber security challenges in India would increase many folds in the near future and India must be prepared to deal with the same effectively and efficiently.

The cyber security challenges before the Narendra Modi Government are both complicated and voluminous in nature. Unlike other readymade and almost completed projects and schemes that the Congress Government has left for the BJP Government, the cyber security related issues were not properly dealt with by the Congress Government. Even the National Cyber Security Policy of India 2013, as formulated by Congress Government, is grossly defective and useless. BJP Government has the challenge of managing the cyber security related issues on its own and from the very beginning.

In a significant move, the Prime Minister’s Office (PMO) has appointed Gulshan Rai as the first Chief Information Security Officer (CISO) of India. We at Perry4Law Organisation (P4LO) and CECSRDI welcome this pro active move of PMO and Indian Government. This would go a long way in ensuring critical infrastructure protection in India (PDF). We also strongly recommend that a revised Cyber Security Policy of India 2015 must be drafted by Modi Government that must address cyber security issues in a more comprehensive and holistic manner.

This CISO position would operate directly under the PMO and this is a good move. We believe that issues of cyber security and national security must be managed at the highest levels and nothing is better than the present PMO. Gulshan Rai has been heading the computer emergency response team (CERT-IN) at the department of electronics and information technology (DeitY) and he has done a wonderful job at CERT-IN. Appointing him as the CISO is a good move of Modi Government as he is already well aware of the cyber threats landscape in India. He would now take charge as special secretary for cyber security.

Rai has been working since 1998 in the area of evolving legal framework to address issues arising out of cyberspace. He is also expected to head the national cyber coordination centre (NCCC) that the Government is also setting up with a budget of Rs 1,000 crore. Since Rai’s expertise and services would be required as a CISO, DeitY has already posted a vacancy for the post of director general for CERT-IN.

We wish all the best to Indian Government and Dr. Gulshan Rai for this challenging job.

Source: Global Techno Legal News And Views.

RBI To Establish An IT Subsidiary For Managing Banking Related Cyber Security Issues In India

Reserve Bank of India (RBI) has been taking many pro active steps to strengthen cyber security for banking sector of India. Despite its best intentions, cyber security in banks is still a distant dream. Banks in India are too slow to adopt and use cyber security mechanisms for banking related business.

Whether it is phishing or social engineering, bank customers are continuously loosing money to cyber fraudsters. There is an urgent need on the part of Indian Government and RBI to spread information and awareness about cyber law and cyber security among various stakeholders.

India is treading on the digital highway and very soon most of the public services would be delivered through use of information and communication technologies (ICT). This is clear from the enthusiastic implementation of Digital India project that needs some fine tuning to get the best results. Nevertheless there is no escape from the reality that Digital India would be the face of Indian economy and culture very soon.

With this increased and omnipresent digital culture, cyber crimes and cyber security breaches would be the norm in future. This is the reason why the Delhi Police has decided to launch a mobile application that would help in filing of online FIR for economic frauds and cyber crimes. Now the RBI has also showed its commitment to fight against cyber crimes and financial frauds by declaring that an information technology driven subsidiary would be established by it to deal with cyber nuisances. This IT subsidiary of RBI would also deal with cyber security and related issues with a special focus upon banking related technology issues. The IT subsidiary of RBI would also evaluate the technical capabilities of banks that is almost missing as on date.

We at Perry4Law Organisation (P4LO) welcome this move of RBI and extend our full techno legal support and expertise in this regard. As per the cyber security trends of India 2015 by P4LO cyber security related issues must be taken care of by various stakeholders including banks in India. Although RBI has announced many effective cyber security related initiatives for banks in India yet cyber security for banks in India is still not in good shape. Some of the initiatives already undertaken by RBI in this direction include formulation and implementation of Internet banking guidelines, formation of a RBI Working Group on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds, RBI Recommendation on Information Security and its implementation in India, etc.

RBI has also prescribed establishment of Steering Committees on Information Security by Banks in India and appointment of Chief Information Officers (CIOs) for all banks in India.  However, banks in India have failed to comply with the directions of RBI so far. As on date there is neither a legal framework nor any compulsion to ensure cyber security of banks in India. This gives little incentive to the banks to ensure cyber security of online banking system of India. On top of it, banks in India are not following cyber security due diligence and cyber law due diligence (PDF) despite RBI’s directions.

If we take the example of western countries, sophisticated malware are targeting banks of these countries. These countries are heavily relying upon ICT for their functioning and this makes them vulnerable to cyber crimes and cyber attacks. India has not faced this heat so far because till now India did not adopt technology to that extent. However, after the adoption of Digital India, cyber security and cyber crimes investigation would become major issues for not only the law enforcement agencies but also banks of India. RBI seems to be aware of this reality and has taken a good step by deciding to establish an IT subsidiary that would take care of all these issues. However, we at P4LO believe that this IT subsidiary of RBI should not be a mere paper tiger but must actually work towards establishing a robust and resilient cyber security environment for banks of India.

Sophisticated botnet and malware like Dump Memory Grabber has been targeting Indian banks and POS Terminals. Similarly, the Gameover Zeus or GOZ botnet is also capable of stealing sensitive banking and financial information and details. Recently, the US Justice Department even charged a Russian national for creation of Gameover Zeus (GOZ) Botnet.

In these circumstances we must consider the proposal of India to adopt and use mobile banking, Internet banking and other online banking and financial transactions methods. So far India and RBI has not considered the issues of mobile banking cyber security, internet banking cyber security, legal aspects of Internet banking, cyber security of e-governance services, etc. In these circumstances, Indian online banking transactions are vulnerable to cyber attacks.

The cyber security for banking and financial sectors of India must be ensured as soon as possible. Online payment market of India and e-commerce and online business legal compliances have further increased the requirements of banking cyber security in India. Similarly, cyber due diligence for Paypal and online payment transferors of India must also be ensured by these stakeholders. These are some of the suggestions that P4LO has shared with Indian Government and RBI through this platform. More detailed suggestions would also be shared by P4LO at appropriate stage and platform.

Smart Cities Cyber Security In India

Cyber security in an interconnected world is a difficult task to manage. This is more so when the enemy is almost invisible and anonymous. Perry4Law Organisation (P4LO) has been working in the direction of cyber security research, education and training in India and world wide. P4LO has already covered many techno legal issues of cyber security that can affect Indian cyberspace.

It has been a considerable time since India has been using e-governance for various public services. However, cyber security of e-governance services in India is still missing to a large extent. This is equally true regarding critical infrastructures that require resilient and robust cyber security.

For instance, India is planning to build smart cities. There is no doubt that India must have made suitable policies and strategies regarding the proposed smart cities. However, till now the Indian Government has not made public a smart city policy that meets the cyber security and civil liberties requirements.

India is embracing the concept of Digital India and electronic delivery of services to its citizens. This is a noble intention but its actual implementation requires strong and effective techno legal framework. Digital India and initiatives based upon it cannot be successful till the foundation of Digital India itself is strong, legal and flexible. Unfortunately, Digital India project is not only suffering from many shortcomings but it is also heading towards rough waters.

Digital India is also closely related to the Internet of Things (IoT) concept. India has issued the Draft Policy on Internet of Things (IoT) (PDF) and a Revised Draft Policy on Internet of Things (IoT) (PDF). The IoT Policy of India is yet to be finalised and implemented after analysing and incorporating the public suggestions and inputs.

Smart Cities is another promising project of Indian Government to make urban cities technology oriented. While this is a fancy idea yet its implementation is not free from challenges. For instance, India has been using e-governance for delivery of public services for long. However, cyber security of e-governance services in India is still not upto the mark. This would make the proposed Smart Cities also vulnerable to sophisticated cyber attacks and cyber crimes. So before establishing Smart cities in India, Indian Government must take care of various techno legal challenges that are still not managed by India.

There are many cyber security challenges before the Narendra Modi Government that have to be addressed on a priority basis. A quick analysis of the National Cyber Security Policy of India 2013 reveals that it is suffering from many shortcomings. There are no Cyber Security Disclosure Norms in India that may require individuals and companies to share details of cyber attacks and cyber breaches. There is also an urgent need to formulate the Cyber Security Policy of India 2015 as the Cyber Security Trends are very alarming in India. Even there is no implementable Telecom Security Policy of India as on date and telecom related issues are getting complex day by day.

However, Indian Government and other stakeholders have also initiated many good projects to facilitate public delivery of services through e-governance and use of information and communication technologies (ICT). For instance, an E-Police Station in Delhi has been established that would register online FIR for motor vehicle theft cases of Delhi. The Reserve Bank of India (RBI) has also decided to set up an IT Subsidiary to deal with technology related banking issues. The Technical Advisory Committee (TAC) of SEBI would address cyber security issues as well. The Grid Security Expert System (GSES) of India has also been proposed by Indian Government. Indian Government has also banned private e-mail services for official communications in Government Departments. Indian Government would also launch Internet Safety Campaign very soon to spread awareness about cyber security among various stakeholders. However, the best effort of Indian Government via-a-vis cyber security is the appointment of Dr. Gulshan Rai as the first Chief Information Security Officer (CISO) of India by the Prime Minister Office (PMO) of India. This would definitely strengthen the cyber security infrastructure of India.

Another area of concern regarding Smart Cities would be protection of Civil Liberties in Cyberspace where India is lagging far behind than its International and Constitutional Obligations. Recently the Supreme Court of India has asked for a clarification from the Central Government regarding Privacy Invasive Software and Mobile Applications. India has no dedicated Privacy and Data Protection (PDF) laws. Privacy protection in the information era has to be ensured by Narendra Modi Government for the success of Smart Cities in India. Privacy Right is a Human Rights and not a Government Charity that must be protected by the Narendra Modi Government. Narendra Modi Government has made Digital India the “Biggest Panopticon of Human History” by clubbing it with Illegal and Unconstitutional Aadhaar Project. The Indian Government is making the Aadhaar Compulsory even if the Supreme Court has clearly declared on multiple occasions that Aadhaar cannot be made mandatory. Even the Indian Parliament and Judiciary are indifferent and submissive to these Illegalities of Digital India and Aadhaar Projects.

The Smart Cities project of Indian Government has both negative and positive aspects. It is for the Narendra Modi Government to remove the negative aspects and stress more upon the positive and development aspects. I hope and wish that this would be the approach of Narendra Modi Government regarding Smart Cities in India.

New Cyber Espionage Malware Named Uroburos/Snake Detected By Cyber Security Researchers

The traditional Cold War Era may be over but the Technology Assisted Cold War is still in vogue. Developed Nations have been making and using Sophisticated Malware that is well beyond traditional and modern Cyber Security Mechanisms. Even well trained Cyber Security Professionals cannot detect them till these Malware have already achieved their Surveillance and Espionage tasks.

For instance, Malware like Stuxnet, Duqu and Flame have simply proved this point. They kept on creating havoc for many years in an undetectable and covert manner. They were detected only recently and since then their variants have been making rounds in the Cyberspace.

These Malware are not the tasks of a group or company but expert malware makers that are supported by Developed Nations. The United States has been accused of making these Malware in the past and it is also believed that U.S. is the biggest buyer of Malware in the World. U.S. has also been accused of using a combination of Radio Waves and Malware to spy upon other Countries. It is well known that Global Cyber Espionage Networks are being actively and covertly used to Spy on other Nations. This is evident from the fact that the Command and Control Servers of Malware FinFisher were also found in 36 Countries, including India.

Countries across the World have started to strengthen their Cyber Security Capabilities. While protecting their own Cyberspace domain, various Countries must understand that Cyber Security is an International Issue (PDF) and not a National one. Therefore, an International Cyber Security Treaty is Required (PDF). In the absence of international harmonisation in this crucial field, countries would keep on attacking one another in the Cyberspace.

In the latest news in this regard, G Data Security experts have analysed (PDF) a very complex and sophisticated piece of malware, designed to steal confidential data. G Data refers to it as Uroburos, in correspondence with a string found in the malware’s code and following an ancient symbol depicting a serpent or dragon eating its own tail.

According to G Data Uroburos is a rootkit, composed of two files, a driver and an encrypted virtual file system. The rootkit is able to take control of an infected machine, execute arbitrary commands and hide system activities. It can steal information (most notably: files) and it is also able to capture network traffic. Its modular structure allows extending it with new features easily, which makes it not only highly sophisticated but also highly flexible and dangerous. Uroburos’ driver part is extremely complex and is designed to be very discrete and very difficult to identify.

BAE systems have labelled it as “Snake” (PDF) and it has identified two distinct variants, both highly flexible but with two different techniques for establishing and maintaining a presence on the target system. In general, its operation relies on kernel mode drivers, making it a rootkit. It is designed to covertly install a backdoor on a compromised system, hide the presence of its components, provide a communication mechanism with its command and control (C&C) servers, and enables an effective data exfiltration mechanism. At the same time, Snake exposed a flexibility to conduct its operations by engaging these noticeably different architectures.

According to media reports, ‘Uroburos’ has been stalking its victims since as far back as 2005 and large enterprises and governments need to pay urgent attention to the threat it. It now transpires that Snake has been slithering silently around networks in the U.S. and its NATO allies and former Soviet states for almost a decade, stealing data, getting ever more complex and modular and remaining almost invisible.

Culling data from malware research sites (i.e. those to which suspected malware samples are submitted for inspection), it has been spotted 32 times in the Ukraine since 2010, 11 times in Lithuania, 4 times in the UK, and a handful of times altogether from the US, Belgium, Georgia, Romania, Hungary and Italy.

These are very small numbers but cyber security firm(s) believes that on past experience they are highly indicative. While they represent a tiny fraction of the number of infections that will have occurred in these countries and beyond, they can be used to reliably infer that Snake has been aimed at Western and Western-aligned countries pretty much exclusively. While none have specifically named Russia as the originator for this malware yet some have put the country under suspicion.

Hints of the malware’s provenance have surfaced from time to time. In 2008, the U.S. Department of Defense (DoD) reported that something called, Agent.btz had attacked its systems, an incident later attributed on more than one occasion to the Russian state without further elaboration. Beyond that the evidence is circumstantial and it is very difficult to attribute Cyber Criminality with great certainty.

Source: International Legal Issues Of Cyber Security.