Cyber Security Doctrine | 09 Mar 2021

Presently, all across the world, the changes in military doctrines favoring the need to raise cyber commands reflect a shift in strategies, which include building deterrence in cyberspace. Moreover, the area of influence of cybersecurity extends far beyond military domains to cover all aspects of a nation’s governance, economy, and welfare.

India ranks 3^rd in terms of the highest number of internet users in the world after the USA and China, but still, India’s cybersecurity architecture is in a nascent approach.

This can be reflected by a report published in the New York Times that highlighted the possibility that the power outage in Mumbai, 2020, could have been the result of an attack by a Chinese state-sponsored group.

Therefore, given the criticality of cyberspace in the military, governance, and economic domain there is a need for a comprehensive cybersecurity doctrine in India.

Challenges in India's Cyber Security Architecture

• False Flag Attacks: The documents released by WikiLeaks show that groups such as the Central Intelligence Agency’s UMBRAGE project have advanced capabilities of misdirecting attribution to another nation-state (“false flag attacks”) by leaving behind false “fingerprints” for investigators to find.
  • This makes it difficult for India to launch a counterattack.
• Problems With ‘All of Government Approach’: While seeking to create an ‘all of government’ approach to countering and mitigating cybersecurity threats at the national level, has also resulted in concerns around effective coordination, overlapping responsibilities, and lack of clear institutional boundaries and accountability.
• Capability Asymmetry: India lacks indigenization in hardware as well as software cybersecurity tools. This makes India’s cyberspace vulnerable to cyberattacks motivated by state and non-state actors.
  • India doesn’t have an ‘active cyber defense’ like the EU's General Data Protection Regulation (GDPR) or the US’ Clarifying Lawful Overseas Use of Data (CLOUD) Act.
• Absence of a Credible Cyber Deterrence Strategy: Further, the absence of a credible cyber deterrence strategy means that states and non-state actors alike remain incentivized to undertake low-scale cyber operations for a variety of purposes — espionage, cybercrime, and even the disruption of critical information infrastructure.

Way Forward

National Cyber Security Policy 2013 clarified that India needs a National Cyber Security Strategy, but is yet to be released. Therefore, given the criticality of cyberspace, the new strategy should include:

• Doctrine on Cyber Conflicts: There is a need to clearly articulate a doctrine that holistically captures its approach to cyber conflict, either for conducting offensive cyber operations or the extent and scope of countermeasures against cyber attacks.
• Setting a Global Benchmark: India should see the National Cyber Security Strategy as a key opportunity to articulate how international law applies to cyberspace.
  • This could also mould the global governance debate to further India’s strategic interests and capabilities.
• Multi-Stakeholder Approach: To better detect and counter threats from both state actors and their proxies as well as online criminals, improved coordination is needed between the government and the private sector, as well as within the government itself — and at the national and State levels.
• Specifying Redlines: National Cyber Security Strategy should include positioning on not just non-binding norms but also legal obligations on ‘red lines’ with respect to cyberspace-targets, such as health-care systems, electricity grids, water supply, and financial systems.
• Promoting Indigenisation: There is a need to create opportunities for developing software to safeguard cybersecurity and digital communications.
  • The Government of India may consider including cybersecurity architecture in its Make In India program.
  • Also, there is a need to create suitable hardware on a unique Indian pattern that can serve localized needs.

Conclusion

A clear public posture on cyber defense and warfare boosts citizen confidence, helps build trust among allies, and clearly signals intent to potential adversaries, thus enabling a more stable and secure cyber ecosystem.

This editorial is based on “Misplaced concern: On Supreme Court and OTT regulation” published in The Hindu on March 08^th, 2020. Now watch this on our Youtube channel.