India Moves Ahead In The Direction Of Cyber Command For Armed Forces

In the present times of sophisticated cyber attacks, having a centralised cyber command for armed forces of India is a must requirement. This cyber command has been long due and announcement regarding its establishment have been made by Indian government from time to time. The latest announcement in this regard has been made by India government that a tri service cyber command for Armed Forces of India would be established very soon.

However, as has been rightly pointed out that without implementation everything is just a dream. On the implementation aspect, India is still grappling with the issues like cyber warfare, cyber espionage and cyber terrorism, etc. In these circumstances, a dedicated cyber warfare policy of India (PDF) must be formulated as soon as possible.

The Cyber Security Trends and Developments in India 2013 have shown many glaring cyber security problems (PDF) of India.  Establishment of offensive and defensive cyber security capabilities of India is one of the most prominent requirements of present times.

For too long cyber security issues have been dumped due to bureaucratic red tape. Now once again the bureaucratic process has been set in motion. For crucial issues like cyber security, the bureaucratic process and formalities should be kept at minimum.

Computer Systems Of DRDO And Security Officials Breached And Sensitive Files Leaked

Indian critical infrastructures and sensitive computer systems are regularly targeted by crackers. In many cases they are also successfully compromised and in many cases their compromise is also not known for a considerable period of time.

This has happened in the past and it would happen in the future as well. Although there is no absolute mechanism to ensure their security yet we must develop offensive and defensive cyber security capabilities of India.

There are many glaring cyber security problems of India that must be addressed on a priority basis. We must formulate the cyber security policy of India as soon as possible. Similarly, we must also ensure cyber security skills and capabilities development in India. In short, Indian cyber security problems, issues and challenges management must be properly appreciated and adequately taken care of.

In a recent media report, it has been alleged that a successful Chinese cracking attack has caused one of the biggest security breaches in India. The cyber security breach has compromised systems of hundreds of key DRDO and other security officials. The breach has also resulted in leakage of sensitive files related to the cabinet committee on security (CCS), the highest decision-making body for security issues of the government of India.

The leak was detected in the first week of March as officials from India’s technical intelligence wing, National Technical Research Organisation (NTRO), working with private Indian cyber security experts cracked open a file called “army cyber policy”. The file had been attached to hacked email accounts of senior DRDO officials that quickly spread through the system in a matter of seconds.

As Indian security experts began to track its origin they discovered, for the first time, that all the sensitive files stolen from the infected systems were being uploaded on a server in the Guangdong province of China.

On further and detailed probe of the breach, it was discovered that thousands of top secret CCS files, and other documents related to surface-to-air missile and radar programmes from DRDL, a DRDO laboratory based in Hyderabad, among many other establishments. Even the e-tickets of the scientists who had travelled to Delhi in the last week of February were found on the server.

The intelligence officials also discovered documents of deals struck between DRDO and Bharat Dynamics Ltd, a defence PSU which manufactures strategic missiles and components. Some other recovered files were related to price negotiations with MBDA, a French missile manufacturing company.

At Perry4Law and Perry4Law’s techno Legal Base (PTLB) we believe that this clearly is a cyber security lapse and cyber security due diligence failure on the part of organisations and computers involved. Let us hope that Indian government would learn lessons from this episode and plug in the loopholes existing in the security of these systems.

Source: CECSRDI.

Regulations And Guidelines For Effective Investigation Of Cyber Crimes In India

Cyber crimes are increasing at a rapid speed in India. However, cyber crimes investigation in India has still to be developed to tackle these cyber crimes effectively. As on date the cyber crime investigation capabilities of law enforcement agencies of India is still deficient and they need proper training in this regard.

The legal and judicial systems of India also need to adapt as per the contemporary information technology oriented society. However, a majority of cyber crimes in India are not reported at all. Even if some cyber crimes are reported, they are not properly investigated and very few such cyber crime cases reach to the court level.

In the absence of scientific evidence and knowledge and proper cyber crime investigation, there are very few cyber crimes convictions in India. In fact, the Supreme Court of India is hearing many Public Interest Litigations (PILs) in this regard.

In one such PIL the Supreme Court of India has issued notice to Centre to seek its views in this regard. The Supreme Court has sought response from the Centre on a PIL seeking its direction to the government to frame regulations and guidelines for effective investigation of cyber crimes in India.

The notice has been issued by a Three Judge Bench of Supreme Court headed by Chief Justice Altamas Kabir. The PIL alleges that the common people are being harassed by police due to lack of procedural safeguards in the prevalent system of cyber laws.

The PIL originated out of the allegations of Pune-based businessman Dilip Kumar Tulsidas Shah who claimed that he was harassed by the police in a cyber crime case in which he was not involved.

 The petitioner seeks the remedy of issuing a writ of Mandamus, order or direction to the Centre to frame an appropriate regulatory framework of rules, regulations and guidelines for effective investigation of cyber crimes, keeping in mind the fundamental rights of citizens.

The Petitioner also contends that there is a near total lack of procedural safeguards in the prevalent system of cyber crime investigation. Police harassment of citizens, whether out of intention or ignorance, is rampant, says the Petitioner.

The Bench after hearing his arguments issued notice and clubbed his plea along with other similar PIL pending before it.

At Perry4Law Organisation and Perry4Law’s Techno Legal Base (PTLB) we have been working in the direction of spreading public awareness regarding cyber law on the one hand and cyber crimes investigation on the other. PTLB is managing the exclusive techno legal Centre of Excellence for Cyber Crimes Investigation in India.

PTLB is also managing the exclusive techno legal Cyber and Hi-Tech Crimes Investigation and Training Centre (CHCIT) of India. A special emphasis upon preventing and punishing cyber crimes against women in India has been undertaken by PTLB. 

PTLB has also launched a techno legal initiative named Intelligence Agencies and Law Enforcement Technology in India. The aim of this initiative is to develop the techno legal capabilities of law enforcement and intelligence agencies of India.

Intelligence agencies and law enforcement agencies of India are actively looking towards adoption and use of information and communication technology (ICT) for their functioning.

Ambitious projects like Crime And Criminal Tracking Network and Systems (CCTNS) Project Of India, National Intelligence Grid (Natgrid) Project Of India, National Counter Terrorism Centre (NCTC) Of India, Central Monitoring System (CMS) Project of India, National Cyber Coordination Centre (NCCC) Of India, etc require techno legal expertise. Law enforcement agencies of India must be aware of both technical as well as legal requirements in order to derive maximum benefits out of these projects.

If either the Supreme Court or the Centre needs our assistance regarding formulating regulations and guidelines for effective investigation of cyber crimes in India, Perry4Law and PTLB would be glad to extend the same.

Source: CECSRDI.

Cyber Security Policy Of India Would Be Formulated

Cyber security in India has now become a policy issue where top governmental official have endorsed about its importance and adoption. In fact, Indian government would soon come up with the cyber security policy of India.

As on date we have no implementable national cyber security policy of India. Even research and development in the field of cyber security is missing in India. Perry4Law Organisation is managing the exclusive techno legal cyber security research and development centre of India (CSRDCI).

Further, Perry4Law Organisation is also managing the exclusive techno legal centre of excellence for cyber security research and development in India (CECSRDI).

Perry4Law Organisation and Perry4Law’s Techno Legal Base (PTLB) welcome the efforts of Indian government to streamline the cyber security of the nation. At the same time we wish to stress upon the importance of critical infrastructure protection in India. Similarly, critical ICT infrastructure protection policy of India is also required to be formulated.

Presently the Indian critical infrastructures are vulnerable to cyber attacks. There are many challenges and issues that remain unredressed till date in this regard. The glaring cyber security problems of India need urgent attention of Indian government and security agencies.

The offensive and defensive cyber security capabilities of India must also be ensured to tackle growing cases of cyber attacks, cyber warfare, cyber espionage and cyber terrorism.

For those interested in further research and discussions on these topics, they may register with the cyber security forum of India and other techno legal forums of India managed by Perry4Law Organisation. We would discuss cyber security policy related issues of India at these forums.

Source: CECSRDI.

Cyber Security Forums Of India And Techno Legal Forums In India

Perry4Law Organisation has been discussing Techno Legal and Cyber Security related aspects for long. Perry4Law Law Firm is the chief Legal Division of Perry4Law Organisation that has been providing Techno Legal Services in India and abroad.

Perry4Law Organisation is managing many Blogs and Websites that are providing General and Specialised Expertise to various stakeholders. For instance, Perry4Law Organisation’s Blog is covering the general discussions whereas the blog titled Centre of Excellence for Cyber Security Research and Development in India (CECSRDI) is covering domain specific Cyber Security related discussions.

Perry4Law Organisation is also managing many good Techno Legal Forums. Perry4Law Organisation’s Forum is the Parent Forum whereas domain specific Forums are also managed by Perry4Law Organisation. For instance, the Cyber Security Forum of Perry4Law Organisation is covering Techno Legal Aspects of cyber Security in India and abroad.

Along with the Cyber Security Forum, there are numerous other techno Legal Forums that are providing Domain Specific and Highly Expertise based discussions. These are:

(1) Cyber Security Forum Of Perry4Law Organisation

(2) Cyber Law Of India And International Cyber Law

(3) Cyber Security News And Views

(4) Techno Legal Think Tank of India

(5) Techno Legal Centre Of Excellence For Cyber Forensics In India (TLCECFI)

(6) National Cyber Security Database of India (NCSDI)

(7) Intelligence Agencies And Law Enforcement Technology In India

(8) Cyber Security Research Centre Of India (CSRCI)

(9) International Critical ICT Infrastructure Protection In India

(10) National Critical ICT Infrastructure Protection In India

(11) International Cyber Law Treaty And Cooperation

(12) International Cyber Security Treaty And Cooperation

(13) International Legal Aspects Of Cyber Security 
 
(14) National Legal Aspects Of Cyber Security In India

(15) Cyber Crimes Investigation In India

We would keep on updating on this topic from time to time. Further, we would also add more Forums and Sub Forums as well.

Perry4Law Organisation is also managing many Discussion Groups. These include:

(1)  Cyber Law Revisited

(2) Cyber Security Research Centre Of India (CSRCI)

(3) Intelligence Agencies And Law Enforcement Technology In India

(4) National Cyber Security Database of India (NCSDI)

(5) Techno Legal Centre Of Excellence For Cyber Forensics In India (TLCECFI)

(6) Techno Legal Think Tank of India

(7) Websites, Blogs And News Censorship By Google And India

Perry4Law Organisation hopes that these Forums and Discussion Groups would prove useful to all concerned.

Source: Perry4Law Organisation’s Blog.

Mobile Service Providers Of India Shall Use Indian Made SIM Cards

Cyber security issues in India are increasingly becoming part of Indian policy decisions. The cyber security policy of India is also witnessing this change. One significant shift in this regard can be found in the way India has been planning to use various hardware and software.

India has been pushing use of indigenously made hardware and software. Further, India has also declared its intention to make cyber security awareness brochures in India mandatory for hardware sale. It is clear that India is becoming serious about its national security and cyber security.

There is no second opinion that mobile banking cyber security in India and mobile cyber security in India are absolutely required. Similarly, the decision of Indian government to ban import of mobiles or cell phones in India with fake IMEI numbers is also justified.

We have no dedicated cell phone laws in India or mobile phone laws in India though they are very much required. However, some solace can be found in the form of governmental directions given from time to time.

Taking another step in ensuring mobile cyber security in India, the Indian government has now shown its concern that SIM cards, used by more than 900 million mobile users in the country, can be a major threat to national security as these might have been produced with malicious embedded software.

To ensure security, the Department of Telecommunications (DoT) has recommended that mobile service providers should manufacture the SIM cards in India with indigenously designed chips incorporating specific laid down standards. The DoT has also recommended that the clause should also be included in the proposed Cyber Security Policy.

The DoT has also proposed imposition of tax on imports of SIM cards till complete indigenous production is ensured. However, mobile companies will have to seek security clearances for such procurements.

Mobile Banking Cyber Security Is Required In India

Mobile banking in India is moving towards an acceptance level. However, till now very few people and institutions are comfortable in using mobile banking in India. Mobile banking in India is still not popular according to RBI. There are certain shortcomings of mobile banking in India that are still left unaddressed.

For instance, mobile governance in India is still not well established. M-governance in India is essential before mobile banking can be successfully implemented in India. We have no regulatory framework for m-governance in India. Even the proposed electronic delivery of services bill 2011 of India has failed to provide a mandatory legal framework for electronic delivery of services in India, including for mobile banking. In short, India is still not ready for m-governance and cloud computing especially in the absence of dedicated e-commerce laws in India.

Mobile banking in India is risky due to absence of mobile cyber security in India. Further, online banking system of India is not secure. In the absence of adequate cyber security safeguards, e-banking in India is not safe. The cyber security trends in India 2011 have also proved that Internet banking cyber security in India is in poor shape and it needs to be strengthened. Even data security, privacy and cyber security in Indian banking industry is not satisfactory.

Online banking risks in India are increasing and this is also shaking the confidence of customers in the same. Even RBI has acknowledged risks of e-banking in India. ATM frauds in India are increasing. In fact, Reserve Bank of India (RBI) has recently released the report of its working group on securing card present transaction that covers ATM security and credit card security issues as well. Internet banking risks in India cannot be effectively tackled till we have dedicated Internet banking laws in India.

Although an integrated banking law of India has been proposed yet it may take some years before it is actually enacted. In an interesting development, the RBI removed limits from mobile banking transactions limits in India. This is good for the development of mobile banking in India but is bad for the interests of mobile banking customers who have almost no safeguards against cyber crimes and technology assisted financial frauds happening in the mobile banking field.

The cyber law in India has prescribed cyber law due diligence for various stakeholders. Cyber due diligence for banks in India is just a part of the same. Cyber due diligence for Indian companies including banks operating in India is very stringent. However, Indian banks are not following the guidelines of RBI prescribing mandatory cyber security requirements for banks of India. Further, banks are also liable

Even on the policy front, mobile banking has received a bad response form Indian government. For instance, absence of effective encryption laws in India and non use of robust encryption in India has made the mobile security very weak in India. Instead of making the encryption requirements redundant and weak, India must concentrate upon further strengthening the same for better and secure mobile communications. Governments of most developed countries allow the usage of strong encryption standards ranging from 128 bits to 256 bits or more to ensure the security of sensitive information exchanged via Internet and other networks. However, India is still clinging to 40 bits encryption standards for the simple reason that intelligence and security agencies of India are not capable enough to break strong encryptions.

A weak mobile banking infrastructure would also affect other projects and schemes as well. For instance, recently the Securities and Exchange Board of India (SEBI) has declared about its intentions to introduce electronic initial public offer (E-IPO) in India. This is a good step but E-IPO cannot succeed in the absence of strong mobile banking and Internet banking infrastructure. Online payments mechanisms in India must also be suitable strengthened to make such proposals workable.

India must give these considerations some serious thoughts if it wishes to encash the benefits of technology. Otherwise, concepts like Internet banking and mobile banking are more nuisance than luxury in India.

Source: ICTPS Blog.

Mobile Cyber Security In India Is Needed

Mobile phones have become ubiquitous these days. They are used for multiple purposes ranging from personal use to mobile banking. Cyber criminals have also realised the importance of mobile phones for committing cyber crimes and financial frauds. This is also the reason why malware writers are also writing mobile phone specific malware to steal confidential and sensitive information.

Mobile cyber security in India has become a cause of concern these days. Mobile phones are now proposed to be used for mobile banking and mobile governance in India. Naturally, we must ensure robust mobile cyber security in India. An electronic authentication policy of India can help in more active and secure mobile usages in India. Mobile governance and e-authentication in India are also closely related and with the proposed electronic delivery of services in India this is also a must have requirement.

For the time being we have no implementable electronic delivery of services policy of India though it may be in pipeline. Indian government is working in the direction of ensuring electronic delivery of services in India. In fact a legal framework titled electronic delivery of services bill 2011 (EDS Bill 2011) has also been proposed by Indian government.

Once the EDS Bill 2011 becomes an applicable law, governments across the India would provide electronic services through various modes, including mobile phones. This requires putting a robust and reliable mobile security infrastructure in India.

However, using of mobile phones for commercial and personal transactions in India is also risky. For instance, the mobile banking in India is risky as the present banking and other technology related legal frameworks are not conducive for mobile banking in India. Similarly, we do not have a well developed e-governance infrastructure in India. As a result India is still not ready for m-governance.

We at Perry4Law and Perry4Law Techno Legal Base (PTLB) believe that the biggest hurdles before the mobile related uses in India pertain to use of weak encryption standards and non use of mobile cyber security mechanisms in India. Absence of encryption laws in India has further made the mobile security very weak in India.

The ever evolving mobile malware are further increasing the woes of mobile users’ world wide. Recently 50 applications within Google’s official Android Market were found to be contaminated with DroidDream malware. The malware stole sensitive information like phone’s International Mobile Equipment Identity (IMEI) Number and the SIM card’s International Mobile Subscriber Identity (IMSI) number. It then sent it to a command-and-control server. Similarly, other spyware and bugs are also infecting mobile phones worldwide.

It is high time for India to seriously work upon mobile cyber security aspects as soon as possible. The policy decisions in this regard must be taken urgently and must be implemented as soon as possible.

Source: ICTPS Blog.

Mobile Cyber Security In India

Mobile phone has become an important aspect of our daily lives. We use mobile phone for multi purposes including mobile banking and mobile governance. With the use of third generation spectrum, even better, speedier and more productive use of mobile phones is now possible.

However, of all the benefits of use of mobile, we cannot ignore the risks associated with it. For instance, the mobile banking in India is risky as the present banking and other technology related legal frameworks are not conducive for mobile banking in India.

Similarly, we do not have a well developed e-governance infrastructure in India. Naturally, India is still not ready for m-governance. India does not have any infrastructure, legal framework, policies and strategies and most importantly expertise to implement these ambitious projects.

The biggest hurdles before the mobile related uses in India pertain to use of weak encryption standards and non use of mobile cyber security mechanisms in India, informs Praveen Dalal, managing partner of New Delhi based law firm Perry4Law. Absence of encryption laws in India has further made the mobile security very weak in India, says Dalal.

Mobile viruses and worms are further increasing the woes of mobile users’ world wide, claims Dalal. Recently 50 applications within Google’s official Android Market were found to be contaminated with DroidDream malware. The malware stole sensitive information like phone’s International Mobile Equipment Identity (IMEI) Number and the SIM card’s International Mobile Subscriber Identity (IMSI) number. It then sent it to a command-and-control server, informs Dalal. Similarly, other spyware and bugs are also infecting mobile phones worldwide

Instead of making the encryption requirements redundant and weak, India must concentrate upon further strengthening the same for better and secure mobile communications. Governments of most developed countries allow the usage of strong encryption standards ranging from 128 bits to 256 bits or more to ensure the security of sensitive information exchanged via Internet and other networks. However, India is still clinging to 40 bits encryption standards for the simple reason that intelligence and security agencies of India are not capable enough to break strong encryptions.

In fact, threats have been issued by Indian government to services providers providing encrypted mobile, e-mail and VOIP services. Gmail and Skype have been asked to provide the encryption keys to Indian government and its security agencies. However, neither Google nor Skype have admitted of receiving any such communication. India is also indirectly pressurising Blackberry to help India in its e-surveillance activities. These actions of Indian government would only make mobile security weaker.

Indian population is still not interested in mobile cyber security and if the default encryption protection is also taken away, mobile usage in India is definitely going to be suffered from malware attacks and cyber attacks. India must urgently concentrate upon mobile security so that these infected mobile cannot be used by criminals.

Source: Cjnews India.

Cyber Security Policy Of India

Cyber Security is an issue that tries to protect and preserve the Information Technology Infrastructure (ITI) of a Nation. Since Cyberspace is boundary less it is possible to attack the ITI of any Nation from any place.

We are still dealing with the Cyber Security issues in India. Although India has formulated the Cyber Security Strategy but it is more on the side of prescribed guidelines alone. The practical and actual implementation of the same is still missing.

Policies and Strategies issues are best implemented practically and effectively if they are made part of the National Policies. Till now we have not formulated a National Cyber Security Policy of India that is implantable at National level.

The Cyber Security Policy of India must cover areas like Cyber Laws, Cyber Crimes, Transnational Technological Crimes, Cyber Attacks, Cyber Warfare, Cyber Terrorism, Cyber Espionage, Human Rights Protection in Cyberspace, Critical Infrastructure Protection Plan, Critical ICT Infrastructure Protection, Crisis Management Plan, etc.

Till now there is no National Cyber Security Policy of India that covers these issues and is implementing the same. Our websites are frequently defaced, strategic computers are often compromised, sensitive defence documents are occasionally stolen and cyber espionage against India is frequently committed.

I also understand that it is not possible to have an absolute Cyber Security. The notion of having an absolute Cyber Security is a “Myth” as we cannot ensure absolute Cyber security anywhere. There are exploits and vulnerabilities, both hardware and software based, that cannot be anticipated and tackled in advance. In fact, “Zero Days Exploits” are the most difficult one to anticipate and handle. In these types of exploits all Cyber Security Measures proves ineffective and futile.

Further, human beings are usually the weakest link in the Cyber Security infrastructure and Social Engineering is the easiest way to break into a Computer System. Besides being easy, Social Engineering can be incredibly cheap. Social Engineering is the hardest form of attack to defend against because an individual or organisation cannot protect itself with hardware or software alone.

Both Government Departments and Private Companies must have good employee’s awareness activities and information dealing policies in place and the employees must strictly follow these policies. The employees must be willing to ask relevant questions while dealing with a request to provide sensitive information.

Indian Government must also focus upon Techno Legal Cyber Security Skill Development for its employees and departments. Suitable Techno Legal Cyber Security Courses must be made available to Government departments and employees. All these issues must be made part of the Cyber Security Policy of India that should be formulated and implemented as soon as possible.

Source: ICTPS Blog.