Prashant Mali
Cyber warfare involves an attempted or actual cyber attack, but for some in the media it means defacing some websites of important organisations. This is not really the case. In fact, I would term such hackers as ‘novice hackers’ in some corner of the world, looking to earn some brownie points amongst their non-hacker peers by fear mongering. Cyber warfare is something quite different. As a researcher, I would argue that cyber warfare involves actions by a state or non-state actor to attack and attempt to damage another nation’s computers or information networks through, for example, computer viruses, denial-of-service attacks, physical attacks and sabotage.
However, the main concern of cyber warfare is through attacking the physical backbone of the Internet — submarine cables. About 97 per cent of all international data is carried out on such cables, according to the Asia-Pacific Economic Cooperation forum. Often, academicians and strategists fail to acknowledge that cutting or sabotaging a Fibre Optic submerged cable carrying Internet traffic, with the intent to disrupt traffic and cause losses, is an action of cyber warfare, where neither a DDoS (Distributed Denial of Service) attack nor a Zero Day vulnerability is exploited, but sabotagers get successful in bringing in an Internet blackout in a region or state.
Such a situation needs to be considered very carefully during war time. In the event our neighbours declare a war, it would make strategic sense for them to disrupt our internet cables to get that psychological edge in the war, as it would create mass chaos to our internet-addicted citizens and our internet dependent or enabled businesses today. Already, other countries are preparing themselves for such an eventuality. The UK and the US military intelligence officials have repeatedly warned that relatively little is being done to guard the safety of cables, and the Russian navy continually conducts activities near them. One of the Russian ships, Yantar, owned and operated by Russia’s Directorate of Deep Sea Research, is evoking fear and concerns in the minds of countries.
The attack on submarine cables would be difficult to manage as satellites could not possibly fill their shoes. The Internet would, of course, route around breaks, but Internet routing cannot create additional capacity where none exists. A signal relayed by a geostationary satellite must travel about 72,000 km up to the satellite and back to earth, so there is a noticeable time delay. Between the US and Japan an IP-package sent via satellite has an average delay of 650 msec, whereas the delay on a fibre submarine cable is just 120 msec. Even differences on this level impose a noticeable decrease in quality that would be visible for normal internet users browsing the web. For other businesses, it could mean chaos. Just imagine doing stock trading on satellite-based Internet.
It isn’t just the latest Russian incident. For years, countries have worried that a hostile foreign power or cyber terrorist might sabotage undersea cables. In 2013, three divers were arrested in Egypt attempting to cut submarine web cables. An entire country — Mauritania — was taken offline for two straight days due to an undersea internet cable cut. The 17,000-kilometre-long African Coast to Europe (ACE) submarine cable was severed on March 30, cutting off web access partially or totally to the residents of Sierra Leone and Mauritania. In eastern Libya, the landing station for the Silphium submarine cable was blown up in 2013. Yemen has seen numerous acts of sabotage in recent years while Colombia suffered a major telecom sabotage incident back in January. In other cases, Bangladesh, Kenya and Nigeria have also had their own incidents of telecom sabotage. One of the estimated 428 undersea cables worldwide is damaged every couple of days. Though so far, nearly all the faults are not intentional.
Cyber warfare between nations carries potentially devastating consequences. At a time when more than 95 per cent of everything that moves on the global Internet passes through just 200 undersea fibre-optic cables, countries such as the US, Russia, China and Iran are focusing on these deep-sea information pipes as rich sources of intelligence, as well as targets in war. The weapons earmarked for the struggle include submarines, underwater drones, robots, specialised ships and divers. This new battlefield is also a gray legal zone: The current Law of the Sea conventions covers some aspects of undersea cables, but not hostile acts.
In India, the Defence Cyber Agency (DCA), a precursor of a cyber command for cyber warfare, should have both offensive and defensive capacity. The DCA or Cyber command should be given responsibility to protect all submarine cable landing stations. This will make them a military target and justify the ‘use of force’ that constitutes an internationally wrongful act, entailing the international responsibility of the State, and also allowing the victim state to take counter-measures against the perpetrator. A defence organisation would also be able to act faster than a civil body in restoration of services as it is often less burdened with protocols and bureaucratic red tape.
India needs robust physical protection on submarine cables landing stations. We need India-based DNS name resolution where the websites of banks and e-governance websites of ‘Digital India’ keep running inspite of total Internet blackout. Then, BharatNET (Bharat Broadband Network Limited) or ‘InNET’ should be kept ready whenever ‘Internet’ fails. RBI, too, needs to work on its Banking Network, which would run and serve customers even if the mighty Internet fails. Digital India also should invest in undersea sensors for cables and in creation of backup or ‘dark cables’ that would not be publicly identified. For this, India can identify Cable Protection Zones, where ships cannot fish or anchor, and can only sail through under supervision by the Coast Guard. It’s time to act now.
The author is an eminent international cyber lawyer with research interests in cyber warfare. Views are personal.
No comments:
Post a Comment