“Strategy consists of making the most of available means to achieve one’s goals. India’s goal is to transform India”

– Shiv Shankar Menon, Choices

India’s former National Security Advisor (NSA), Shiv Shankar Menon’s book “Choices: Inside the making of India’s Foreign policy” is a good read to understand the post-cold war decision making in Indian foreign policy. Mr. Menon describes the insider’s account of five crucial scenarios India has faced during his long career in government. The border peace and tranquility agreement with China, the negotiation of the nuclear agreement with the USA,  India’s response to the 26/11 Mumbai attacks by Pakistani terrorists, the final stages of Sri Lankan civil war and the evolution of India’s nuclear doctrine -‘No First Use policy’. In each case, Menon starts with the context, the choices that Delhi had to make and the lessons from these decisions. He also clearly explains the intricacies of getting things done within the political and institutional constraints that he faced which remind us about the need for reforms in India’s governance structures. Menon’s clear articulation of complex topics and command over the details makes each account a very exciting and informative read for anyone interested in India’s foreign policy.

He starts with the 1993 Border Peace and Tranquility Agreement with China – the first ever boundary related agreement between modern states of India and China in which he played a crucial role. He dwells deeper into the historical aspects of India-China ’border’, the 1962 war, Chinese strategy regarding India and Pakistan and its greater goal of becoming a preeminent global power, the intricate details of the negotiations and the calculations which went into the making of the agreement and finally the lessons learned from the agreement. Menon is of full praise to former Prime Minister P.V. Narasimha Rao for leading public opinion and building consensus while bringing along his political opponents for the fruition of the agreement.

The second chapter deals with the Civil Nuclear initiative between India and USA which was started by the first UPA government and which became the pillar of trust and cooperation between India and USA. He covers the entire negotiations which happened between India and USA as well as in international agencies like IAEA, Nuclear Suppliers Group as well as in the US Congress and Indian Parliament. He concludes the chapter by explaining what the civil nuclear initiative means for the larger geopolitics in the 21st century. In his own words the Indo-US nuclear agreement was always much more than a dollar and cents calculation or the import of reactors, or cheap renewable energy for India’s future. It was about much bigger things – like the strategic need to stand up together to balance the rise of China and chart a new century of cooperation between two countries whose strategic objectives converge almost on every aspect in Asia.

The third chapter deals with the question of why India didn’t use overt force against terrorist groups based in Pakistan after the 26/11 attacks in Mumbai in 2008. After dissecting the decision to not militarily respond to the 26/11 attack on Mumbai, Menon argues Prime Minister Manmohan Singh made the right decision not to respond.  But at the same time, he believes that future Indian governments will not be so restrained as the context and personalities heading the country has changed.

India’s involvement in the Sri Lankan civil war is one of its most traumatic overseas adventure till date. It led to thousands of Indian deaths including that of the former Prime Minister Rajiv Gandhi. Chapter four deals with India’s experience in Sri Lanka during the Sri Lankan civil war and how choices were made by New Delhi by giving the detailed overview of the different interests and strategic calculations which went into each decision.

Chapter five deals with India’s nuclear doctrine of ‘No First Use’ and he explains clearly why this is the best policy for India which allows India to focus on domestic transformation and economic growth without wasting time and effort on a nuclear arms race. But at the same time and gaining a strategic equivalence by indulging in deterrence strategy.

Menon concludes the book with a valuable reflection on India’s international destiny, its strategic culture and the kind of great power it might become. He offers insights into the emerging constraints on statecraft in this century and the need for strong institutional mechanism to solve issues in the foreign and security policymaking in the coming decades. Menon doesn’t answer directly to the question of whether India has a strategic culture but affirms that there is an Indian way of foreign policy which is “marked by a combination of boldness in conception and caution in implementation, by the dominant and determining role of the Prime Minister”. Menon warns Delhi against embracing ambitions of becoming a traditional great power and forgetting the priority of domestic transformation and reminds of Germany and Japan as examples of rising powers that prematurely thought that their time had come for global domination. Menon ends the book with the discussion on why India needs to be a great power and how it should be a ‘different power’ which uses its power first for domestic transformation of India itself.

Choices should be considered as one of the rare good books on the inside deliberations and thought processes which go into making the Indian security and foreign policy decisions. It is a must-read for anyone who would like to know how and why India has made certain ‘choices’ in its relations with the outside world and how it is trying to be a great power with a difference.

Author: Shivshankar Menon

Publisher :Penguin Random House India, 2016, pp 224

Price: Rs.599/-

Book Review by: Jerin Jose

(Jerin Jose is a Young India fellow, from the 2016-17 batch at Ashoka University.

He can be reached at jerinjose1906@gmail.com)

Rapid and unprecedented growth of Information and Communication Technologies (ICT) and media with its speedy and all-pervasive penetration has ushered in the digital age.  Not only has it brought the world together through globalisation, it has become the driver for economic growth. Technology and Information are the new normal of this digital transformation. This transition from an industrial to an information era has also ushered in a new security paradigm with new threats to both national and human security. With large scale automation, technology and connectivity, the developed nations are enjoying a much better quality of life. There exists a definite digital divide amongst the developed, developing and poor nations. This digital divide, coupled with the rising aspirations of the people accentuated by religious beliefs and cultural issues and technology denial have created serious security issues wherein new threats by way of cyber-crimes, cyber terrorism, cyber espionage and even cyber war have emerged making cyber security a strategic imperative at the national, regional and international levels.

Environmental Scan: India

While India has made considerable progress in the last decade or so towards the establishment of ICT infrastructure, enhancing the reach of the electronic media and extension of e-services in the finance, health and education sectors to ensure better governance, the development still remains differential. For example while India has the second largest number of Internet users in the world, it also has the second largest number of “Unconnected” population. The situation, however, is changing rapidly with the mobile telephone revolution which is under way and greater penetration of internet.

India’s drive towards digital economy coupled with national projects like Digital India, Smart Cities, National Broadband Network and so on are altering the digital landscape rapidly with direct impact on governance, transparency and accountability. While there is a definite requirement of greater penetration of ICT for development and better governance, this rapid change towards a digital environment has brought to fore the challenges of cyber security. A cyber insecure Digital India Initiative can turn from a strategic asset to an unaffordable liability and a direct threat to national security. India, needs safe navigation through cyberspace for its prosperity, national and human security. Hence, ensuring complete cyber security of our assets and National Information Infrastructure is both a national strategic imperative and an urgent national mission.

Threat Landscape

From leaking debit card details to influencing the US Presidential Election, cyber-attacks have become a significant part of our political and social discourse. Cyber threat exists 24/7 and manifests along the full spectrum starting from cybercrime to cyber espionage to cyber terrorism and cyber war.

Cyber crimes are a real threat today and are increasing very rapidly both in intensity and complexity with the spread of internet and smart phones. About eighty percent of cyber-attacks are related to cybercrimes. More importantly, cyber-crimes have changed the nature of conflict by blurring the line between state and non-state actors.

Cybercrimes are likely to increase exponentially with the fielding of virtual currency, Internet of Things, big data, cloud technology, drones, robotics, Blockchain and so on. Capabilities of hijacking a car, taking over the controls of an aircraft, cyber murder and remote injunction of viruses through drones and air crafts have already been demonstrated and in some cases, already inducted.

Dark net and Deep web are already being exploited for sale of vulnerabilities, weapons, recruitment of people in terrorist groups, drugs and so on.

Latest entrant to the long list of cyber-crimes is the installation of “Ransom Ware” to cripple a network or facility and demand ransom to restore the same. Recent ransomware attacks using Wanna Cry and Petya viruses have amply confirmed cyber as a “Weapon of Mass Disruption” with more than 300,000 computers affected across different sectors:  health, finance, transport, ports and so on in 150 countries! Another major cyber-attack on HBO is still awaiting resolution with hackers demanding 2.5 million in Bit Coins.

One of the biggest cyber-attack in 2016 was the hacking of Indian debit cards wherein as many as 32 lakh debit cards belonging to various Indian banks were compromised resulting in the loss of Rs. 1.3 crore in fraudulent transactions as per National Payments  Corporation of India (NPCI).

The Infamous hacker group “Legion Crew” made headlines in the sub-continent after hacking into the Twitter accounts and partial email dumps of prominent public figures such as politician Rahul Gandhi, businessman Vijay Mallya, and NDTV journalists Barkha Dutt and Ravish Kumar.

Cyber Espionage

Internet has become a very powerful source for intelligence collection in support of national, diplomatic, military, technology or economic objectives. It is estimated that more than 90 percent of “open source intelligence” is being obtained from the cyber world. It is economical and safe. Cyber espionage is also being used for technology theft and for launching probing missions on the critical infrastructure for possible exploitation later. The extent of threat can be gauged from the fact that Japan alone had 25.6 billion cyber-attacks in the year 2014 mostly for technology exfiltration. That is 900 cyber-attacks per second.  The fact that attack Vectors for cyber espionage and cyber war are the same makes cyber espionage a major threat in being. Recent alleged interference by Russia in the democratic elections in France and the USA add another dimension to the threat landscape and the cyber intelligence.

Cyber Terrorism:

Coincidence between the physical and virtual worlds, as demonstrated by the STUXNET attack on Iran’s nuclear facility at Natanz in 2010, has put complete information infrastructure at risk. Targeted attacks on a nation’s critical infrastructure like military installations, power plants, air traffic control, surface transport traffic control, telecommunication networks would be considered as part of cyber terrorism. These are low level, “short of war” attacks which would cripple part of a critical infrastructure or adversely affect the functioning of a business. These attacks are not large enough to warrant a military response but have the potential to inflict enough damage that numerous attacks over a long period of time could harm economy, complicating a policymaker’s calculus for determining an appropriate response.

Social Media

Social Media like Face Book, Twitter, and LinkedIn has emerged as powerful tool for perception management, social engineering, cyber-crimes and intelligence. It has also emerged as a major instrument of waging “Asymmetric Warfare” through exploitation of the aspirations of people, differential development, varying religious beliefs and cultural leanings.  These have also become attractive sources for recruitment and radicalisation by the terrorist organizations.

Nations across the world are putting legal frame work, infrastructure and human resource for monitoring this media to remain proactive. Major issue being privacy vs human/national security.

Cyber Warfare

It is universally acknowledged that the 21st century war will be highly “Cyber-centric” if not fully led by cyber theatre.  Glimpses of these have been given by the Russian assault on Estonia and Ukraine. While in Estonia, it was pure cyber intervention, in Ukraine, it was a combination of cyber and Kinetic attacks wherein the bits preceded the bullets. This operation is a land mark in Cyber Enabled Warfare. Nations across the world have pronounced their doctrines of cyber warfare, have raised organisations to conduct cyber warfare and are busy in the making and testing of cyber weapons. USA is reported to have used “logic bombs” in Afghanistan and Syria to effectively neutralise their communication networks.

The Indian Scene

India is very vulnerable to cyber interventions due to certain strategic deficiencies, inadequate appreciation of the threat and rather tardy and disjointed implementation of policies. India was one of the handful of nations to promulgate Information Technology Act in year 2000 as a legal policy document to deal with cyber interventions. The same was revised in 2008. Similarly, the National Policy on Electronics was issued in 2012 and the National Cyber Security Policy in 2013. Yet, till a few years ago, well co-ordinated and focused efforts towards cyber security were missing except for the establishment of Computer Emergency Response Team – India (CERT-IN) and similar organisations at the state level and the Indian Army.

India’s  cyber security chief Gulshan Rai told Parliament’s finance standing committee in July 2017, that cyber threats had evolved swiftly from viruses and “nuisance” attacks in the early 2000s to sophisticated malware and advanced denial of service, and could pose the risk of severely destructive attacks by 2020.

India will face increasingly sophisticated “destructive” cyber threats as compared to the “disruptive” attacks in the Indian cyberspace that are currently adding up to 200 million malware-related and 1,90,000 “unique” intrusions in any given week. The government — the Centre and states — is the main target of cyber-attacks, driven by motives ranging from theft, espionage and data extraction to counterfeiting. In 2015 and 2016, the government sector accounted for 27% and 29% of all cyber-attacks.

Other sectors high on the priority list of cyber criminals are banking, energy, telecom and defence, which along with the government, account for three-fourths of all cyber-attacks. The emergence of new services and apps, cloud and cognitive technologies, has made cyber security more challenging even as the value of data and its applications in commerce grows by the day, making cyber security a major task.

The incidence of e-transactions is rising with India logging in an estimated 2 billion such dealings a day as compared to around 54 billion worldwide, according to World Payments Report 2016.

Cyber-attacks use techniques and tools that help criminals evade detection with increasing refinement, and this has led the government to recognise cyber security as a “strategic domain” and devise strategies aimed at deepening cooperation at the international level. The PMO and the national security adviser are key elements overseeing a range of civilian and defence agencies with cyber security mandates.

Cyber Security Architecture

India is setting up its own ‘cyber security architecture’ that will comprise the National Cyber Coordination Centre (NCCC) for threat assessment and information sharing among stakeholders, the Cyber Operation Centre that will be jointly run by the NTRO and the armed forces for threat management and mitigation for identified critical sectors and defence, and the National Critical Information Infrastructure Protection Centre (NCIIPC) under the NTRO for providing cover to ‘critical information infrastructure’.

Concurrently, the government is also coming up with a legal framework to deal with cyber security; has launched a drive for creating greater awareness to this threat and is creating necessary human resource with requisite skills. Major cyber security projects under implementation are given in the succeeding paragraphs.

National Cyber Coordination Centre (NCCC)

NCCC is a critical component of India’s cyber security against hackers and espionage as well as track terrorist activity on line. A group of cyber security professionals and experts will look after the functioning of the Centre and track illegal and terror activities on line. It will run on similar lines as in the US, UK, France and Germany. Its mandate may also include cyber intelligence sharing.

Botnet Cleaning and Malware Analysis Centre

India has the largest number of Botnets in the world. To obviate and limit the threat due to botnets, the Government has recently set up a Botnet Cleaning and Malware Analysis Centre. The project is a part of Digital India programme and aims to create safe and secure cyberspace. It will automatically detect botnets that trigger various cybercrimes and suggest the device owner to remove them from their device with their help.

Central Monitoring System (CMS)

Central Monitoring System, the Union Government’s ambitious electronic intelligence monitoring system, is likely to start functioning fully by this year-end. According to the Ministry of Home Affairs officials, the hi-tech unit which will provide unhindered access to phone calls, text messages, and social media conversations to law enforcement agencies in real-time will have two units in the inaugural phase in Delhi and Bangalore.

National Critical Information Infrastructure Protection Centre (NCIIPC)

Article 70A (IT Act 2008) mandated the need for a special agency that would look at designated CIIs and evolve practices, policies and procedures to protect them from a cyber-attack. The National Critical Information Infrastructure Protection Centre (NCIIPC) was created and placed under the technical intelligence agency, the National Technical Research Organisation, to roll out counter-measures in cooperation with other security agencies and private corporate entities that man these critical sectors.

Protection of Power Sector

In December 2010, Ministry of Power had constituted CERTs (Computer Emergency Response Teams) for power sector i.e.; CERT-Thermal (nodal agency- National Thermal Power Corporation (NTPC)), CERT-Hydro (nodal agency- National Hydroelectric Power Corporation (NHPC)) and CERT-Transmission (nodal agency- Power Grid Corporation of India Limited (PGCIL)) to take necessary action to prevent cyber attacks in their domains. The State Power Utilities have also been advised to prepare their own sectorial Crisis Management Plan (CMP) and align themselves with the Nodal Agencies i.e. NTPC, NHPC & PGCIL and CERT – for the necessary actions.

Grid Security Expert System (GSES)

Grid Security Expert System (GSES) was developed by POWERGRID and it involves installation of knowledge based Supervisory Control and Data Acquisition (SCADA) system, numerical relays and Remote Terminal units up to 132 kV stations and the reliable Optical fibre Ground wire (OFGW) communication system. The objective of the GSES is implementation of the Automatic Defense mechanism to facilitate reliable and secure grid operation.

Crisis Management Plan

India has prepared a Crisis Management Plan (CMP) for countering cyber-attacks and cyber terrorism for preventing the large scale disruption in the functioning of critical information systems of Government, public and private sector resources and services. The Crisis Management Plan (CMP) for Countering Cyber Attacks and Cyber Terrorism outlines a framework for dealing with cyber related incidents for rapid identification, swift response and remedial actions to mitigate and recover from cyber related incidents impacting critical national processes.

 Network Traffic Analysis System (NeTRA)

A monitoring and electronic surveillance project being executed by the DRDO.It appears to be Indian government’s first attempt of mass surveillance rather than individual targets. It will scan the activities over the social networking websites like twitter and would scan the mails and chat transcript and even the voices in the internet traffic.

The above efforts are aligned towards developing a cyber defence capability. There is no information in the open domain regarding development of cyber offensive capabilities and their integration. Cyber space is essentially “Offence Dominant” by its very character and cyber power includes both defensive and offensive capabilities backed by appropriate organisation, technology, skilled human resource and a well-developed defence electronic manufacturing and components base.

Imperatives

India needs national scale effort supported by political will, adequate funding, contemporary technology and skilled people to realize necessary cyber security capability. These imperatives would require synergy amongst various ministries and agencies through appropriate policy framework and organisation and must be executed concurrently. Some of the essential imperatives are given in the succeeding paragraphs.

Establish National Cyber Security Commission (NCSC) – a fully empowered body with its own department, on the lines of Space Commission and Atomic Energy Commission. The country needs to build thought leadership and weave together India’s potential in cyber security under one organisation. NCSC will have the onerous tasks of creating synergy amongst various stake holders through an enabling policy framework; developing technology, manpower, industry clusters, education standards and certification, intelligence and counter intelligence mechanisms, cyber forensics, security standards, and policy research. It will also coordinate with all ministries for National Critical Information Infrastructure (NCII) in their areas.  It will play a catalytic role for the requirements of military in cyber warfare.

The National Cyber Security Policy 2013 needs to be revisited urgently in the light of rapid pace of technology development and very dynamic threat scenario. This policy should be translated to a time bound action plan in consonance with the national cyber security doctrine and specify clearly the responsibility for its execution and accountability. The policy, action plan, organisation and assured budgetary support must be discussed and approved by the Parliament.

Develop Cyber War Capability: India urgently needs to develop policies and capabilities in this ‘Fifth’ domain of war.  These cannot wait and must be taken up on top most priority in a “Mission Mode” by the Services. The situation and threats to India are unique and hence there is the necessity of developing an indigenous solution in consonance with the doctrine to include organisation, technology, skill sets, training infrastructure and R&D. Immediate raising of an Indian Cyber Command is a national strategic imperative.

Energise “Make in India” Programme

India announced her National Electronic Policy (NEP) in 2012 with a view to establish an Electronic System Design and Manufacturing (ESDM) eco system and manufacture of semi-conductors in the country. Unfortunately, the scheme did not take off inspite of the fact that it offered attractive financial and taxation terms. This scheme has now been given a push under the “Make in India” programme. Absence of electronic manufacturing base and indigenous semi-conductor manufacturing capability in the country are strategic deficiencies. These are absolutely essential and fundamental pre-requisites for cyber security and need immediate attention at the highest level.

Cyber Policy Research Centre: There is no think tank that is studying policies and documents being produced by groupings of governments, industry, civil society, academia, interested organisations and international policy making organisations. Thousands of pages are being churned out, which require deeper understanding through analysis and discussions to decide on what is in India’s interest. We are unable to address policy as well as operational issues due to the lack of focused studies. Numerous NGOs created at the behest of foreign governments, are obfuscating policy discussions to derail national positions. Also as technology evolves, a large amount of cyber security research and policies require timely revision.

Cyber Threat Intelligence Centre: India needs to have cyber analysis centers which collects attack data on various infrastructures, financial systems, web sites and services; correlate “big data” generated from government with financial and commercial data to create patterns and suggest anomalies, for advance preventive actions.

Cyber Workforce development: There is an urgent requirement to have a national plan to develop cyber security workforce and an associated cadre. NCSP 2013 has set up a target of five lakhs skilled cyber resource in the non-formal sector for cyber security and also to exploit the business opportunity of providing services to global customers by 2018. India also must lay emphasis on developing “Science of Cyber Security”.

R&D for product development: India needs focused R&D in the development of safe products; discovery and analysis of vulnerabilities, fixing attribution and design of cyber weapons. Manufacturing and export of cyber security products presents a very attractive opportunity for India.

Security Standards and Frameworks, Audit: India needs to develop and promulgate the cyber security standards and frameworks for development, and audit processes for assurance of protection of our NCII. Enabling Policy measures are required to encourage establishment of testing labs for managing ICT Supply Chain Risks.

Cyber-crime investigations: There is an urgent need for development and continual upgradation of cyber forensics capabilities and investigating skills with our law enforcement agencies (LEAs), to handle cyber-crimes in the ever expanding proliferation of devices, platforms, big data, Internet of Things, mobility and social media.

Assurance Framework, Test & Certifica-tion: There is an immediate requirement of setting up a national cyber test facility providing for network emulation, monitoring and audit, vulnerability analysis, simulated attacks, graduated response, performance analysis and security assurance modeling.

Build Thought Leadership, Executive/ Political Sponsors: Build cyber security savvy leadership, subject matter experts, solution architects and system engineers so as to address the inadequate comprehension of lack of cyber security capability and its bearing on national security including the military dimension.

Leveraging Diaspora: Indian diaspora is at the fore front of building security technologies, platforms and solutions across world class institutions and industry in USA and Europe. They can be the biggest catalyst in building cyber security capability. Proactive and aggressive steps should be taken to leverage the diaspora.

Outreach Programme to Attract Industry. Government needs to make it attractive for the private sector to invest in capability building through innovative mechanisms, such as funding development of new technologies, committing to buy from partner companies etc. Both the Government and the Industry must recognize multi-billion opportunity in cyber security related products and services and cash on this through a focused and proactive approach as was done for IT.

Establish Cyber Policy Research Centre: A Think-tank funded by the government/Industry, for studying all facets of cyberspace and making policy recommendations to the government.

In this digitally connected world, development of full spectrum cyber security along with an electronic industrial base, skilled human resource, enabling policy and legal frameworks, assured financial support, R&D and so on,  in consonance with the national security and cyber doctrines, is a national imperative. The digital world of today demands “Technical Sovereignty” and complete protection of data to ensure national and human security. India must ensure these for continued development and securing her rightful place in the comity of nations.

(Lieutenant General Davinder Kumar is a former Signal Officer-in-Chief, Indian Army and former CEO & MD of Tata Advanced Systems.)

(This article is carried in the print edition of September-October 2017 issue of India Foundation Journal.)

With Independence Day seeing a flurry of articles on India’s progress over the years, now is as good a time as any to see how India has fared in the cyber domain. On the face of it, it would seem that India is no better or worse off than other countries. It has not faced any debilitating cyber attacks despite having adversarial relations with countries that have advanced cyber capabilities. Experts ascribe this to the fact that friend and foe alike are content to sit on the networks and harvest the data for information. However, successive stories of leakage of data are sufficient to indicate there are any number of vulnerabilities in networks, systems and software that can be exploited by adversaries. The increasing reported instances of cybercrime only serves to bear this out. On the policy front, while there has been considerable progress in fashioning proactive policies in a number of areas central to cyber security from safeguarding critical information infrastructure to fostering start-ups, the moot questions are whether a) these policies are sufficient and b) whether they are being effectively implemented. There are other areas where policies are urgently needed but are developing at a snail’s pace such as in encryption, even as new technological developments such as blockchain technologies are in urgent need of policy direction to enable a healthy environment for their development. With the increasing militarisation of cyberspace, there is also a need for understanding the role of the military and the intelligence agencies in cyberspace, and developing doctrines as well as concretising operational issues such as chains of command, etc.  While India has taken a more pro-active interest in the international debates on cyber security, and is actively participating in international fora, its position on many issues is yet to be clearly delineated. The deeply interlinked nature of activities in cyberspace means that all these policy issues and areas are deeply interlinked which creates enormous challenges for policy makers.

India had a head start in the cyber-domain, being one of the first countries to have an Information Technology Act, and to set up Computer Emergency Response Team (CERT).  The potential for Information and Communications Technologies to drive growth and development was seen as early as the 1970s when the National Informatics Centre (NIC) was setup to provide information technology solutions to the government. The 1980s saw increased utilisation of communications technologies through the establishment of country-wide networks, among these, the National Informatics Centre Network (NICNET), a nationwide VSAT network for public sector organisations, which also connected the central government with the state governments and district administrations, and the Education and Research Network (ERNET), which served the academic and research communities. Internet service for the public was made available from August 14, 1995. Today, India has not only the second largest user base worldwide with over 462 million users, but also has the fastest growth with an increase of 108 million over the previous year. This was largely due to the drop in data tariffs by over 75% over the previous year.

Successive governments have been proactive in using information and communication technologies (ICT) to improve governance and accelerate development. The present government has taken these efforts to a new level by making internet connectivity and digitalisation the cornerstone of many of its activities. Just one of these campaigns, the Digital India Campaign has a number of ambitious goals, from creating broadband highways, improving delivery of government services, and reducing electronics imports. Others like Start-up India endeavour to have digital products created in India rather than just consuming those created elsewhere. The Aadhaar unique identification card initiative, with over a billion numbers generated, functions on a digital backbone, with the biometric data stored in a central database.

The vast expansion in all things digital has increased the attack surface for adversaries. Recent attacks around the world on critical infrastructure ranging from electricity grids to financial institutions to even nuclear plants make the various doomsday scenarios of Cyber Armageddon, quite plausible. Response and remediation to these attacks show that governments, largely have a limited role in emergency response to such attacks, other than monitoring and providing advisories through the relevant organisations. Their role is more towards pre-empting attacks, through, on the one hand, enacting policies to reduce the risks and locate vulnerabilities, as well as formulating broader policies that enhance  security but are also flexible enough to allow for openness, innovation and privacy. These policies need to be addressed across many domains, from law enforcement, to commerce, to data security, as well as India’s approach to global internet governance policy.

How has India fared so far? In terms of creating legal and administrative frameworks, this has been an on-going process for over two decades though implementing them has proved to be the more difficult part. Though many of them are deeply interlinked and should by rights be carefully sequenced, these frameworks have often been developed piecemeal and in isolation, and have taken an inordinately long time to implement in a domain where policymaking cannot keep pace with technology even in the most advanced countries. To give a few examples, a privacy law and a data protection law are essential to safeguard the individual at a time when companies are mining data streams of individuals for a variety of purposes and even selling them to third parties. In terms of implementation, the most glaring example is that of the Cyber Appellate Tribunal the apex body to try cases of cyber fraud which has been without a Chairperson since 2011 and has nearly all the cases from 2010 in pending status. Cases of cybercrime have gone up exponentially even as the rate of conviction remain abysmally low. Companies and individuals are easily susceptible to cybercrime because of low cyber literacy, lack of awareness especially about cyber hygiene and best practices.

Policy makers, whether in the Ministry of Home Affairs (looking at cybercrime), the Ministry of Electronics and Information Technology (looking at issues of cyber security) or at nodal agencies are hamstrung by a number of seemingly immutable factors, ranging from the fact that much of the software and hardware is of foreign origin, and much of the data resides on foreign servers. This is getting further exacerbated with increasing digitalisation as companies in just about every sector, critical or otherwise, are entering into collaboration with application service providers without undertaking due diligence, in a rush to provide apps and services to customers. The security ramifications of the headlong rush to digitalisation are yet to be fully comprehended. The fact that much of the infrastructure rests in the privates sector also hamstrings the government’s room for manoeuvre in terms of fashioning and implementing policies to secure the digital environment. As a case in point, in just one sector, telecom, the National Telecom Policy of 2012 had set a target for domestic telecom equipment to meet Indian telecom sector demands to the extent of 60-80 per cent by 2020 after it was noted that over 60% of the equipment was being sourced from China. That laudable goal notwithstanding, the fact is that even today, the vast majority of telecom equipment, amounting to Rs. 70,000 crores annually, continues to be imported from China.

The sheer size of the population, the federal setup, legacy issues, the multiplicity of agencies concerned with cyber security, lack of experienced and expert manpower in not just core areas of cyber security, but also in law enforcement and the judiciary, are all factors that will see the cyberspace environment become progressively worse before it gets better. The security aspects of new technologies and concepts from cloud computing to the internet of things and driverless cars to crypto-currencies, to name just a few, will provide more regulatory and policy headaches for  policymakers in the coming days.

The external environment has also turned darker in recent times, as countries turn to militarisation following the failure of collaborative efforts to evolve norms to secure cyberspace.  Norms development has been an on-going process for well over a decade in the United Nations and other fora, and  for a time, looked to be making some progress, particularly in the  Group of Governmental experts process instituted by the First Committee of the United General Assembly  tasked with promoting Peace and Disarmament. The very success of the process seems to have led to its own un-doing as different groups of countries tried to secure their interests by putting forward untenable proposals. While the United States and its allies were supportive of the process initially, the bias towards multi-lateralism is probably one reason why there was no attempt made at arriving at a consensus report leading to a collapse of the process in 2017.

India has participated in many of the norm-making mechanisms related to cyber-security though it has tended to take nuanced positions based on its interests. The preference has hitherto been for multilateral fora since India faces the same problems other developing countries face at multi-stakeholder fora; that of limited participation due to limited funding for other stakeholder, disinterest on the part of stakeholders in the private sector, as well as limited domain expertise and exposure. Efforts are being made to enhance participation in multi-stakeholder fora, be it in internet governance or cyber security. Having said that, the multilateral/multi-stakeholder debate has taken on the shape of a proxy battle on ideological lines. As security considerations come to the fore, even liberal Western countries are imposing stringent regulations and laws without consulting other stakeholders.

In fact, India’s vision of a fair and equitable multi-stakeholder mechanism could be said to blur the distinction between multi-lateralism and multistakeholderism, viewing this as a false dichotomy. In his message to ICANN53 where India formally signed up to the multi-stakeholder process, the Minister of Communications mooted a ‘multi-layered’ system of multilateral and multi-stakeholder institutions working on a common platform that will support equity, innovation, collaboration and inclusion. India has begun to more actively participate in organizations such as the Internet Corporation for Assigned Names and Numbers (ICANN), the de facto global internet governing body, and is also holding the next iteration of the Global Conference on Cyberspace under the aegis of the London Process, a state-sponsored summit originally initiated to propagate the values and ideals of a global and open cyberspace. On the whole though, as consensus on the basic tenets of securing cyberspace and the means of doing so continues to evade the global community, the various seminars, conferences and commissions risk being relegated to being nothing more than talking shops.

On the bilateral front, India has signed MoUs on enhancing cyber security co-operation with a number of countries. There has also been a deepening of dialogues with a few countries such as Israel, the United States and Russia with substantive proposals on exchange of information, expertise and co-operation in research and development. Co-operation with the United States is the most crucial but also the most problematic. On the law enforcement side, there are multiple hindrances when it comes to co-operation ranging from lack of familiarity with US procedures and laws, and using out-dated mechanisms such as mutual legal assistance treaties (MLATS) and Letters Rogatory  to obtain information and evidence for judicial cases that  take an inordinate amount of time and effort to process. On the intelligence side, historically, effective two-way co-operation has been less than optimal since the agencies in the US intelligence constellation tend to provide information on a need-to-know basis. The cyber intelligence agencies have gone a step further and have been found actively hacking into the networks of friends and foes alike.

The militarisation of cyberspace continues apace as countries set up cyber commands, and gather up cyber ammunition in the form of exploits, vulnerabilities and malware. The United States has, in recent days, elevated the status of its Cyber Command to that of a Combatant Command. Though this is largely an administrative decision to separate it from the National Security Agency (NSA), it further accentuates the emerging arms race in cyberspace.  India’s approach has been exceptional and sober, with the government taking a graduated response, first undertaking to set up a Cyber Defence Agency which would presumably upgraded to a Cyber Command. While this is a measured and restrained approach, scaling up should be a continuous process with set timelines, fixed structures and budgets. While the services are currently struggling jointness in the Armed Forces, jointness in cyber security should go beyond the Armed Forces and merge civilian capabilities as well. While on the one hand, the Armed forces bring in the expertise, operational capability and a clear mandate to defend the nation from any external threat and also house technical expertise, the private sector also has much to contribute in terms of domain knowledge, technical and financial resources. A cyber strategy would be effective only if it succeeds in synchronising the capacities, infrastructure and expertise spread throughout the government, the armed forces and the private sector.

The fact that the country has not yet been subject to a cyber attack of a magnitude that would impact on the life of the citizens, or cause the economy to crash  should not give rise to complacency and the feeling that “all is well” as far as the country’s cyber security is concerned. Attacks in the recent past have taken place through known vulnerabilities, as in the case of the Wannacry ransomware attack, as well as through unknown vectors. While some progress has been made in setting in place structures to improve the country’s cyber security posture such as appointing a National Cyber Security Co-ordinator, setting up a National Cyber Co-ordination Centre, creating sectoral CERTs, activating the National Cyber Infrastructure Protection Centre, augmenting the expertise of the judiciary and of law enforcement, providing funding for R&D, more remains to be done. At the operational level, the most pressing issues are providing existing agencies with more teeth to enforce regulatory requirements, whether it be in reporting cyber attacks or sharing information. The capacities and capabilities of these agencies should be augmented to the required level. This also holds true for law enforcement and forensic agencies as well. At the policy making level, the time has probably come to have cyber security elevated as a specific Ministerial level responsibility to send the message down the line of its importance. This is not to suggest that a separate Ministry with attendant bureaucracy be set up but that the subject itself should be elevated to the apex level. Ultimately, the conversation that needs to take place is that between strategic experts, domain experts and policy makers to pinpoint the specific areas of weakness and how they can be plugged, the strategic calculations behind attacks, the policy actions that need to be taken to secure the country’s cyberspace, and that dialogue is, as yet, not happening to a sufficient degree.

(Cherian Samuel is Research Fellow in the Strategic Technologies Centre at the Institute for Defence Studies and Analyses (IDSA). Views expressed are personal.)

(This article is carried in the print edition of September-October 2017 issue of India Foundation Journal.)

Former chairman of the Unique Identification Authority of India (UIDAI) and architect
of the Aadhaar initiative Nandan Nilekani recently made the case for a “data inversion” policy, requiring businesses operating in India to return the data they collect to the user.1 Over several iterations of this proposal, Mr. Nilekani has argued data of Indians is at the risk of being “colonised” by big technology corporations, and data inversion can “empower” the user.2 A strong data protection framework, he suggests, would give users the right to “pull out” their data anytime. “They can choose what they want to be part of, and what they don’t.”3

Nilekani’s comments are significant because they come in the backdrop of efforts by him and other technology evangelists — both from government and the private sector — to make India a “data-rich” economy. At the launch of Reliance Industries Ltd’s digital offering ‘Jio’ early this year, its chairman Mukesh Ambani declared “data is the new oil”4, with immense potential to “bring benefit to the people”. In the same vein, Information Technology minister Ravi Shankar Prasad characterised data-driven, “digital” governance as “honest” and “transparent”.5In a country whose digital economy has been largely serviced by American and Chinese companies, the desire among policymakers and home-grown businesses to retain agency over the data produced by consumers is acute.

Nilekani’s data inversion proposal is not an altogether radical concept. As the former Infosys CEO has himself acknowledged, there is comparable legislation in the United States.6 The Dodd-Frank Wall Street Reform and Consumer Protection Act, for instance, requires financial and banking institutions to maintain data about lending practices to small businesses.7 This information has to be made available to “any member of the public” upon requests made according to statutorily prescribed procedure. The provision, which has met with controversy,8 is aimed at ensuring “fair lending” practices through closer scrutiny of potentially discriminatory terms of financing for small businesses. But it also provides fintech startups precisely the data that they need to build digital platforms that cater to local needs.

But were such a proposal to be implemented in India, would it really “empower” the user?

At the heart of the ‘data inversion’ proposal lies the expectation that users — made owners of their data — will subsequently hand it over to Indian start-ups. Indian companies today have neither the giant data sets nor the analytics capabilities needed to create technology-driven platforms in the same manner as an UBER or AirBnB, but the ready availability of user data may level the playing field. The “data inversion” proposal is driven by the same motivations as the Swadeshi movement of the early 20th century, which sought to revive the textiles industry in Bengal and other parts of India that had suffered on account of Britain’s surging exports to its biggest colony and market. Then, cotton mills in Manchester and Lancashire had taken advantage of rising market demand in India, supplying products that were acknowledged to be imitations of Indian methods of dyeing and printing.9Unlike textiles however, data is a “non-rivalrous” resource. A swadeshi data movement would not involve any boycott of foreign digital services: to the contrary, companies based outside India too will benefit from gaining access to a larger pool of user data in the country.

Key to harvesting such data would be the ready availability of Application Programming Interfaces (APIs) upon which Indian companies can build their digital platforms. The current suite of APIs developed by the iSpirt foundation — collectively called India Stack — already hosts several tools that developers can integrate into their platforms. For instance, state and central government departments as well as major Indian businesses have already absorbed the “Aadhaar eKYC” API to digitally verify their consumers without seeking physical copies of identification documents. The eKYC API allows a business to build a software platform that taps into the Aadhaar database (with the user’s consent) to extract authentic details about her date of birth, address of residence etc, in the process removing the need to reinvent the wheel and spend lakhs of rupees in building a customer database. Similarly, the Unified Payments Interface – another API developed by the volunteer-driven iSpirit — allows businesses to create digital markers beyond just banking address to effect instantaneous transfers of money. These markers may be Aadhaar numbers, specially created UPI addresses, or just phone numbers. That platforms developed in Silicon Valley, like WhatsApp and Uber, have begun to integrate UPI-driven payments in their products is an indications that APIs developed in India can offer competitive tools for global markets.10

If India Stack currently hosts “first-generation” APIs that run on the back of large, government databases like Aadhaar, its progression into a more diverse set of tools for businesses and public agencies will be driven by developers’ access to richer data sets. The Aadhaar platform provides barebones information for personal identification, and it would neither be prudent — on account of security reasons — nor desirable to link it to other sensitive, tertiary information about a citizen such as her health records. The Indian government is the custodian of vast troves of data about its population, but until such time there is a cohesive effort to digitise this data and protect it with appropriate safeguards, software developers will have to rely on information provided by users on their existing apps. If the user were to be the “owner” of data provided to large technology companies based abroad, it is likely she will provide it to Indian app developers that can provide targeted, locally relevant services (weather patterns, mandi rates for perishable goods, public transportation timings etc). In some cases, the user may be legally required to provide this information in return for governance benefits.

This process of transmission of data — either de novo information or data that has been “returned” by other platforms — from the user to Indian digital platforms arguably marks the genesis of a swadeshi data movement. In some respects, this process has already begun with the widespread adoption of Aadhaar-enabled platforms, which allow the user to authenticate her private transactions through data shared with the government.

The availability of data for Indian companies to innovate for local needs is of course a positive development, but in the absence of a clear data protection regime, the jury is still out on the role of the citizen in this movement. In other words: what determines the success of a home-grown data movement? Is it driven by the technological innovations and bottom-lines of Indian businesses? Is another key metric the ability of governments in India to provide digital governance services at affordable cost to citizens? Or is it also the ability of Indian users to retain agency over their data, and determine precisely what can be shared with companies and government agencies?

The Supreme Court of India in its landmark ruling on the ‘right to privacy’ in August 2017 directly addressed the question of the user’s agency over her data. The verdict — which affirmed the existence of a fundamental right to privacy — acknowledged that the “state may have justifiable reasons for the storage and collection of data” but also held that Indian data laws should protect the “autonomy” of the individual or the user.11 The Court cited with approval the “privacy principles” outlined by the 2012 report submitted to the Planning Commission by a Group of Experts led by Justice A.P. Shah. These principles underline statutory limitations on data collection and access by state and non-state actors to users’ data, as well as the importance of consent in collecting and sharing data with third parties. Some of these principles have already been absorbed, albeit in a rudimentary form, in the data protection guidelines crafted under the Information Technology Act, 2008.

But for a swadeshi movement to make India a data-rich economy to succeed, the user should be more than just the passive recipient of e-governance services or innovative digital platforms. The Indian user should play a crucial and autonomous role in determining the kind of data that is shared with the government and the private sector. Often, individuals – especially first generation internet users – agree to share their data with apps and services without understanding or being informed about the exact purposes to which such data may be deployed. The Supreme Court’s recent judgement has rightly acknowledged the “centrality” of user consent, but the Indian government should go beyond consent- or permissions-based approaches in its national data protection framework. Faced with better awareness of the nature and functions of digital platforms they interact with, Indian users can make informed choices about the data they share. This in turn would spur the creation of digital products and services that address a consumer-driven demand or need. It would avoid the problem of all-pervasive collection of data, which often results in unchecked or illegal surveillance, cyber security vulnerabilities and data leakages.

The autonomy of the Indian user in digital spaces should be protected by the state through a legal framework that addresses three distinct relationships: user-government, user-private sector, and government-private sector. Of these three interactions, Indian law — through policies such as The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011 — currently accounts for the collection of data by mobile applications and services, but does so in very broad terms that essentially allow companies to gather and share information they determine to be relevant to their products’ functionalities.12 The user’s consent, in such a scenario, is made perfunctory. A growing, global body of research suggests that the permissions-based model of data sharing with digital applications does little to illuminate users’ understanding of privacy and indeed, the nature of the apps themselves.13

Regulators in other jurisdictions have challenged the concept of “binary, one-time” consent given that “unprecedented amounts of personal information are collected by, and shared among, a myriad of often invisible players who use it for a host of purposes, both existing and not yet conceived of.”14 The risk of users not sharing relevant information is also real, as research suggests many will simply reject requests to access data if they are unaware of the context in which personal information is share with an app.15 The user-private sector engagement in India must take into account the unique requirements of the online population and address how the user can retain agency over the sharing and collection of her data based on the context.

Meanwhile, the relationship between the Indian government and the digital citizen is mediated by statutes like the UIDAI Act which place limits on the sharing of sensitive and biometric information. Nevertheless, this legal framework does not account for the linking of Aadhaar information to tertiary public and private databases that may be vulnerable to leaks or cyber attacks. There are also few statutory mechanisms that ensure the state’s accountability on policies around Aadhaar linkages with other government welfare programs.

Finally, there are no regulatory mechanisms currently in place to evaluate data sharing between public agencies and businesses across digital platforms. The UIDAI Act admittedly includes penal provisions for the misuse of biometric information by the private sector, but as businesses tap into public databases to provide digital platforms that deal with healthcare, transportation and education, the automated sharing of such information must be carefully scrutinised for corporate misuse. Calls for an “open data” policy in India are not new, but they must be calibrated to ensure that the user is not marginalised in choices around collection and sharing of personal information.

A national data movement — one that encourages the free flow of information across public and private platforms, thereby providing opportunities for both to create innovative digital products — can only be sustained with the user at its centre. The user must not only be made aware of the information collected from devices and platforms, but also the implications of such data sharing for her privacy. A swadeshi movement must distinguish itself from the deterministic ethos of Silicon Valley, which seeks to design and impose technologies on communities for the ostensible purpose of solving their social and economic malaises. India’s data revolution must instead be driven by contextual, local language platforms that respect both the needs and rights of the user.

 

Reference

1  Nandan Nilekani, “Why India needs to be a data democracy”, July 27, 2017, Livemint, http://www.livemint.com/Opinion/gm1MNTytiT3zRqxt1dXbhK/Why-India-needs-to-be-a-data-democracy.html

2  “Need law where data collected is shared back with users: Nilekani”, The Hindu Business Line, July 22, 2017, http://www.thehindubusinessline.com/info-tech/need-law-where-data-collected-is-shared-back-with-users-nilekani/article9784813.ece

3  Supra n.1

4  “Mukesh Ambani says data is new oil for fourth industrial revolution”, The Economic Times, February 15, 2017 economictimes.indiatimes.com/articleshow/57173843.cms

5 “Digital India Summit 2017: ‘Data is the new oil’; data important for new policy formulation, says Ravi Shankar Prasad”, Financial Express, March 23, 2017 http://www.financialexpress.com/industry/digital-india-summit-2017-data-is-the-new-oil-data-important-for-new-policy-formulation-says-ravi-shankar-prasad/599220/

6  “Who Owns Personal Data: Technology and Policy Frameworks”, Aug 17, 2017, https://www.youtube.com/watch?v=mwC1kjaWV6g&feature=youtu.be&utm_content=buffer1798b&utm_medium=social&utm_source= twitter.com&utm_campaign=buffer

7  Section 1071, “Small Business Data Collection”,The Dodd–Frank Wall Street Reform and Consumer Protection Act (Pub.L. 111–203, H.R. 4173) http://www.dodd-frank-act.us/Dodd_Frank_Act_Text_Section_1071.html

8  “The CFPB Wants Data On Small Business Loans. Bankers Are Outraged”, Forbes, May 29, 2017, https://www.forbes.com/sites/robbmandelbaum/2017/05/29/the-cfpb-wants-data-on-small-business-loans-bankers-are-outraged/2

9  Prasannan Parthasarathi, “The European Response to Indian Cottons” http://www.lse.ac.uk/economicHistory/Research/GEHN/GEHNPDF/PUNEParthasarathi.pdf

10 Arun Mohan Sukumar, “WhatsApp’s Integration of UPI-Based Payments Has Strategic Consequences for India’s Digital Economy”, August 9, 2017, The Wire, https://thewire.in/165881/whatsapp-upi-bhim-digital-economy/

11 Justice K.S. Puttaswamy (Retd.) &And v. Union of India & Ors., Writ Petition (Civil) No. 494 of 2012, para.181

12 Rule 3, The Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011http://www.wipo.int/edocs/lexdocs/laws/en/in/in098en.pdf

13 Max Van Kleek, Ilaria Liccardi, Reuben Binns, Jun Zhao, Daniel J. Weitzner and Nigel Shadbolt,

    “Better the Devil You Know: Exposing the Data Sharing Practices of Smartphone Apps”, http://people.csail.mit.edu/ilaria/papers/CHI2017.pdf

14 Office of the Privacy Commissioner of Canada , “Consent and privacy: A discussion paper exploring potential enhancements to consent under the Personal Information Protection and Electronic Documents Act”, May 2016, https://www.priv.gc.ca/media/1806/consent_201605_e.pdf

15Primal Wijesekera, Arjun Baokar, Ashkan Hosseini, Serge Egelman, David Wagner, and Konstantin Beznosov, “Android Permissions Remystified: A Field Study on Contextual Integrity”, September 2015, https://www.ftc.gov/system/files/documents/public_comments/2015/09/00013-97595.pdf

(Arun Mohan Sukumar is Head, ORF Cyber Security and Internet Governance Initiative.)

(This article is carried in the print edition of September-October 2017 issue of India Foundation Journal.)

When the first building blocks of cyber space1 emerged in the 1960s, the concept of effective international cooperation for cybers ecurity was not a priority. Today, an ever-expanding information-based global cyber domain, dominated by wireless and fixed broadband, smartphones, the mobile Internet, cloud computing, open data, big data and social media, and linked infrastructures for transmission of information and the creation of a digital economy, is characterized by its trans-national or international character. It is generally accepted that this domain is multi-stakeholder in nature, and that information and communication technologies (ICTs) play a key role in the transformation of cyber space.

The four broadly accepted stakeholders in global cyber space are governments, businesses, academia and civil society. In terms of approaches to cyber security, the emergence of a digital society, both nationally and globally, which is dependent on the security of cyber space for myriad aspects of human endeavor, has significantly broadened the focus of governments. Businesses, licensed to operate in cyber space by the governments of their jurisdiction, have reflected this evolution, taking the lead in providing the necessary technologies and innovations to implement cyber security policies. Academia, which often partners businesses in innovating and applying new cyber technologies, has always played a vital role in spreading greater awareness of cyber issues, including vulnerabilities impacting on the security of cyber space. Civil society has contributed vigorously to upholding fundamental human rights in cyber space, while attempting to cope with cyber vulnerabilities which have a direct impact on the sanctity of human lives regardless of national boundaries.

It has become apparent to all stakeholders that the increasing speed and expansion of cyber space also contain inbuilt weaknesses which can be exploited to jeopardize the security of cyber space, including its use for meeting the aspirations of humanity for a prosperous future, driven by easily accessible ICTs. This has pushed the issue of cyber security to the forefront, and highlighted the need to ensure effective international cooperation on cyber issues, through coherence and cooperation among cyber space stakeholders.

Background

The United Nations General Assembly (UNGA) had first discussed scientific and technological developments in ICTs in the context of international security in 1998. It adopted a resolution that year sponsored by Russia following this discussion, which emphasized that such developments could have both civilian and military applications, and that “progress in science and technology for civilian applications needed to be maintained and encouraged”.2 Subsequently, in December 2002, a UNGA resolution called for the creation of a “global culture of cyber security”, highlighting 9 elements which could contribute to this objective. These elements included awareness, responsibility, response, ethics, democracy, risk assessment, security design and implementation, security management and reassessment.3

The initiative of the UNGA was dovetailed subsequently into the launch of global discussions on the “world information society” by the United Nations, resulting in multilaterally agreed outcomes from the United Nations’ World Summit on the Information Society (or WSIS) at Geneva (2002) and Tunis (2005), referred to commonly as the “Tunis Agenda”.4 The need for the Tunis Agenda to keep up with momentous changes in cyber space between 2005 to 2015 was underscored by the UNGA in its High Level Review of the Tunis Agenda in December 2015.5  The Review acknowledged the role of multi-stakeholders in cyber space, and called upon them to proactively accelerate the use of ICTs as a “means of implementation” for the global sustainable development framework. This framework had been unanimously adopted by world leaders at the UN Summit held three months earlier, in September 2015, as Agenda 2030, with its core 17 Sustainable Development Goals (SDGs).6

International discussions on cyber issues among all stakeholders recognize the concept that “a chain is as strong as its weakest link”. Whether these issues relate to cyber security, or cyber-crime, or providing equitable access to cyber space, or bridging the “digital divide” between and within countries, it is acknowledged that progress (or failure) to secure any one area of cyber space will impact on the entire cyber domain.

Role of governments

Against this backdrop, the role of governments in creating an effective framework for international cooperation on cyber security is critical, as public policy is the prerogative of governments. Apart from their sovereign functions in negotiating and adopting an international legal architecture to facilitate various aspects of such cooperation, governments are themselves also increasingly the largest stakeholders of cyber space in terms of the implementation of their security and development policies.

Governments adopted a resolution in the UNGA in December 2003 on “developments in the field of information and telecommunications in the context of international security”. They upheld the need for the free flow of information while looking at concepts aimed at strengthening cyber security. The resolution asked the UN Secretary General to seek the assistance of a Group of Governmental Experts (GGE), appointed on the “basis of equitable geographical distribution and with the help of Member States in a position to render such assistance”, to report on the way forward to the UNGA.7 From 2005 onwards the UNGA stipulated only the geographical representation criteria for the UN Secretary General to follow while appointing experts to the GGE.8

This approach determined the way the GGE has functioned in two significant ways. First, in the absence of any multilateral roster of “experts” provided by member states, the UN Secretary General has selected countries, and not individual experts, to compose the GGE. The selected countries have been free to designate their experts for the discussions of the group. While some governments have opted for continuity in selecting their experts while participating in the different editions of the GGE, others have opted for rotating their nominees, which has prevented the GGE from adopting a collegial approach to its work. Secondly, discussions in the GGE have been skewed towards a narrow perspective on international cooperation on cyber security, based on the mandate of the First Committee of the UNGA, which is to look at “disarmament, global challenges and threats to peace that affect the international community …and challenges to the international security regime”.9 In the process, the initial emphasis of the UNGA in December 199810 to give primacy to civilian, rather than military, applications of ICTs has dropped by the wayside.

What has been the outcome of the work of the GGE so far on establishing effective international cooperation on cyber security? GGEs have normally worked for a two-year period. There have been five editions of the GGE constituted by the UN Secretary General so far between 2004-2017, with selected participating member states fluctuating from 15 in its first three editions to 20 for the fourth GGE and 25 for the fifth GGE. India has participated in the first three and the fifth GGEs.11The UN Secretary General has consistently nominated the five permanent members of the UN Security Council (China, France, Russia, the United Kingdom and the United States) to all editions of the GGE, implicitly linking its work to the dynamics of these five countries in the Security Council.

The first GGE could not agree on an agreed report in 2005, due to three areas of divergence. First, there was divergence on the impact of ICTs on national security and military affairs. Second, there were divergences on whether the proposed international framework for cyber security should focus only on the content, or only on the infra-structure, of ICTs. (Significantly, this divergence between content and infrastructure also led to the deadlock in updating the regulations of the specialized UN agency responsible for tele-communications, the International Tele-communications Union (ITU), at its Conference held in Dubai in 2012).12 A third area of divergence was on the issue of technology transfer to developing countries. These divergences led the UNGA to ask the UN Secretary General to constitute another GGE in 2009.

The second GGE, constituted in 2009, issued a consensus report in 2010. It recommended dialogue among member states to reduce the risk and protect critical national and international cyber infrastructure; confidence building and risk-reduction measures, including the use of ICTs during conflict; capacity building; and elaboration of common terms and definitions in cyber security.

The third GGE in June 2013 agreed with the proposition that international law, and especially the UN Charter, applied to cyber space, while confirming that state sovereignty applied in cyber space. It underlined that cyber security should be in consonance with respect for human rights and fundamental freedoms. It called on member states to respect their obligations not to allow proxies or non-state actors to use their jurisdictions for violating cyber security.

The fourth GGE in 2015 recommended some norms to secure cyber space. These included the recommendation that  “States cooperate to prevent harmful ICT practices and should not knowingly allow their territory to be used for internationally wrongful acts using ICT.” It emphasized that “States should guarantee full respect for human rights, including privacy and freedom of expression. A State should not conduct or knowingly support ICT activity that intentionally damages or otherwise impairs the use and operation of critical infrastructure. States should also take appropriate measures to protect their critical infrastructure from ICT threats. States should not harm the information systems of the authorized emergency response teams of another State or use those teams to engage in malicious international activity. States should encourage the responsible reporting of ICT vulnerabilities and take reasonable steps to ensure the integrity of the supply chain and prevent the proliferation of malicious ICT tools, techniques or harmful hidden functions.”13

Further progress was halted when the fifth GGE process reached a deadlock at its final meeting in June 2017.  This was due to divergences on how international law would apply to the use of ICTs by states. In a public statement, the United States affirmed that “the framework of international law provides States with binding standards of behavior that can help reduce the risk of conflict by creating stable expectations of how States may and may not respond to cyber incidents they face”, a view which was not agreed to by some other members of the GGE.14

Role of Businesses

While the GGE has articulated behavioral norms based on international law for international cooperation on cyber security, some trans-national businesses headquartered in the United States have taken initiatives to foster international cooperation based on the technology that drives cyber space. In February 2017, Microsoft advocated a “Digital Geneva Convention”, that is meant to “commit governments to protecting civilians from nation-state attacks in times of peace” with the active assistance of technology companies.15 Facebook, Microsoft, YouTube and Twitter joined hands in June 2017 to launch a Global Internet Forum to Counter Terrorism.16

Earlier, in June 2016, Microsoft had proposed a roadmap for developing offensive norms, defensive norms and industry norms. It pointed to the difficulty in attributing and countering threats to cyber-security because of “global connectivity, anonymity, and lack of traceability”. Microsoft suggested that governments should adopt the model of public-private partnership in developing cyber security norms, as had been done in the case of the Financial Action Task Force (FATF), where consultation with the private sector helped effective implementation of financial norms, as well as a platform for private sector priorities to be addressed by governments.17

International cooperation on cyber security has also been pursued by businesses which maintain the global cyber infrastructure. Currently, 13 “root servers”, administered by 12 entities, control the functioning of global cyber space.18 In this context, norms developed through platforms such as the Internet Corporation for Assigned Names and Numbers (or ICANN), have become relevant. The main functions of the ICANN are to allocate domain names, numbering resources, and decisions on internet protocol parameters. Each of these functions has a significant ground-level impact on international cooperation on cyber security. A similar ongoing role is being played by the professionals who create cyber space, represented by the Internet Engineering Task Force (IETF)19.

Role of Academia

Academia’s contribution to establishing an international framework of cooperation on cyber security has a long history. Its focus on people as well as technology enables academia to address one of the major challenges of cyber security, which is the human factor. Generating awareness is perhaps the most significant contribution that academia can make to effective international cooperation on cyber security, by preventing the exploitation of vulnerabilities in cyber space. The constant flow of graduates from academia into both governments and businesses represents a continuous upgradation to the international community’s efforts to tackle issues of cyber security.

Academia has often taken the lead to make significant conceptual contributions to evolving an international framework of cooperation on cyber security. For example, almost a decade ago, a white paper prepared for the White House by Pradeep Khosla, the founding director of Carnegie Mellon’s CyLab, advocated that a more relevant approach to cyber security policy would be to look at a “data-centric” rather than a “device-centric” approach.20

Apart from generating greater awareness of the vulnerabilities of cyber space, and looking at the issue of cyber security from a multidisciplinary perspective, academia also plays a hands-on role in ground-level international cyber security cooperation. This is well illustrated by two universities in the United States (University of Southern California and University of Maryland) who manage two of the 13 root servers of the internet. A focused participation in the global discussion on the need for international cooperation on cyber security is the hallmark of academic think-tanks across the world, though many of them are funded by sources looking at cyber security issues from a military perspective.

Role of Civil Society

Civil society is perhaps the most vocal stakeholder of cyber space, using cyber tools such as social media to advocate its views. Ensuring the upholding of fundamental human rights online has been recognized as one of the core advocacies of civil society as governments work to establish a framework for effective international cooperation on cyber security. These rights include, inter alia, freedom of expression, privacy, and human dignity.

The Way Ahead

As this brief review outlines, the current multilateral effort to create an international framework for effective international cooperation on cyber security through the GGE of the UNGA has probably reached its limit. Countries which are active in cyber space have initiated steps to position their views on issues like cyber norms and application of international law in a confrontationist, rather than cooperative, mode. Without a cooperative approach among governments at the multilateral level, the initiatives taken by businesses, academia and civil society to augment an appropriate international framework are greatly diminished.

While bilateral and regional frameworks have been welcomed by the multilateral process under the United Nations, including during the Review of the Tunis Agenda in December 2015, the impact of these frameworks would be limited to participating countries. For effective global cyber security cooperation, the core focus must remain on a universally applicable framework, which has its focus on the weakest link in the global cyber chain.

How can this happen? The time has come for the UNGA to adopt a resolution to launch broad-based multilateral negotiations, with inputs from the major stakeholders, on international cooperation on cyber security. These negotiations should be launched by the UNGA as part of its review of the implementation of Agenda 2030.

The UNGA has acquired relevant experience for such multi-stakeholder negotiations, which have been led by governments, during the past few years, when global issues such as sustainable development and the evolution of a world information society were placed on the UNGA’s agenda, and successful outcomes reached.

In any such future negotiations, some potential areas of divergence could arise. One issue would be who would decide on the question of attribution for attacks on cyber security, given the skepticism among a majority of UN member states for such issues to be referred to the UN Security Council as currently structured, where necessary structural reforms, including on decision-making, have been resisted by some of its permanent members. Another potential area of divergence would be in adopting a common template to counter perceived cyber security vulnerabilities in industrialized and developing countries, and where national capacities to respond to threats require technology transfers and financial flows. Divergent economic interests of major multinational ICT businesses and new emerging ICT businesses will inevitably be reflected in these negotiations when counter-measures are conceptualized. Negotiators will have to identify provisions drawn from applicable international law, including the UN Charter, the WTO’s corpus of international trade law and international humanitarian law.

However, potential divergences cannot detract from the urgent need to secure global cyber space, through an internationally agreed framework on effective cooperation on cyber security. As the UNGA has pointed out repeatedly, the impact of effective international cooperation on cyber security is not only restricted to international peace and security, but also to development. In this context, there is need to broaden the negotiating mandate for an international framework to include the “development dimension” of cyber security, drawing upon the specific provisions contained in Agenda 2030 and the Tunis Agenda.

In any such international negotiation, the role of India in focusing on the “development dimension” of international cyber security cooperation will be crucial. The scale of India’s national programmes which apply ICT for development is unique, symbolized by the nine pillars of Digital India with its Aadhar database, provide a ground-level drawing board for conceptualizing and testing cyber security concepts, as well as the effectiveness of international cooperation in securing developmental programmes.21 A special focus would need to be provided by India during these negotiations on the impact on designated critical national infrastructure sectors.22 India’s advocacy of using a “development” perspective in the process to create a supportive international framework for cooperation in cyber security will be relevant for a large number of other developing countries, who are prioritizing the use of ICTs to meet their sustainable development goals under Agenda 2030.

The objective should be the creation of a framework on cyber security which will serve the global cyber domain in the same manner that the United Nations Convention on the Law of the Seas (UNCLOS), which was negotiated between 1973 and 1982, serves the global maritime domain.

References

1  Internet Society, “Brief History of the Internet”. Available at

   http://www.internetsociety.org/internet/what-internet/history-internet/brief-history-internet

2  United Nations General Assembly Resolution A/RES/53/70 dated 4 December 1998. Available at

   https://documents-dds-ny.un.org/doc/UNDOC/GEN/N99/760/03/PDF/N9976003.pdf?OpenElement

3  United Nations General Assembly Resolution A/RES/57/239 dated 20 December 2002. Available at

   http://www.un.org/en/ga/search/view_doc.asp?symbol=A/RES/57/239

4 “Tunis Agenda for the Information Society”. Available at

   http://www.itu.int/net/wsis/docs2/tunis/off/6rev1.html

5  United Nations, “Outcome Document of the high-level meeting of the General Assembly on the overall review of the implementation of the outcomes of the World Summit on the Information Society”, UNGA Resolution A/RES/70/125 dated 1 February 2016. Available at

   http://www.un.org/en/ga/search/view_doc.asp?symbol=A/RES/70/125

6  United Nations, “Transforming our world: the 2030 Agenda for Sustainable Development”. Available at

   https://sustainabledevelopment.un.org/post2015/transformingourworld

7  United Nations General Assembly Resolution A/RES/58/32 of 8 December 2003. Available at

   http://www.un.org/en/ga/search/view_doc.asp?symbol=A/RES/58/32

8   United Nations General Assembly Resolution A/RES/60/45 dated 8 December 2005. Available at http://www.un.org/en/ga/search/view_doc.asp?symbol=A/RES/60/45

9   United Nations. “Disarmament and International Security: First Committee”. Available at http://www.un.org/en/ga/first/

10                    See footnote 3 above.

11 For a summary record of the work done by the four GGEs, the United Nations Office of Disarmament Affairs Fact Sheet, available at https://unoda-web.s3-accelerate.amazonaws.com/wp-content/uploads/2015/07/Information-Security-Fact-Sheet-July2015.pdf is useful. India was omitted by the UN Secretary General for the Fourth GGE due to alleged pressures from other countries to apply the criteria for rotational representation. From the Asia-Pacific region, China, Japan, Malaysia and Pakistan were chosen by the UN Secretary General. India was re-nominated to the Fifth GGE by the Secretary General in 2016.

12                    For an outsider’s account of this deadlock, see “What really happened in Dubai”, Internet Governance Project, Georgia Tech. Available at

   http://www.internetgovernance.org/2012/12/13/what-really-happened-in-dubai/

13                    United Nations. Report of the GGE to the UN Secretary General No. A/70/174 dated 22 July 2015. Available at https://documents-dds-ny.un.org/doc/UNDOC/GEN/N15/228/35/PDF/N1522835.pdf?OpenElement

14                    United States Department of State.“Explanation of Position at the Conclusion of the 2016-2017 UN Group of Governmental Experts (GGE) on Developments in the Field of Information and Telecommunications in the Context of International Security “. Available at https://www.state.gov/s/cyberissues/releasesandremarks/272175.htm

15                    “The need for a Digital Geneva Convention”, Microsoft. Available at

   https://blogs.microsoft.com/on-the-issues/2017/02/14/need-digital-geneva-convention/

16                    Global Internet Forum to Counter Terrorism. Available at

   https://blog.twitter.com/official/en_us/topics/company/2017/Global-Internet-Forum-to-Counter-Terrorism.html

17“From Articulation to Implementation: Enabling progress on cyber-security norms”, Microsoft. Available at

   https://mscorpmedia.azureedge.net/mscorpmedia/2016/06/Microsoft-Cyber security-Norms_vFinal.pdf

18             A map of the 13 global root servers is available at http://www.root-servers.org

   For technical details on root servers and related issues, see “What are Root Name Servers”, Netnod, Sweden. Available at https://www.netnod.se/i-root/what-are-root-name-servers

19             See “About the IETF”. Available at https://www.ietf.org/about/

20 EDUCAUSE Review.Academia’s role in security cyberspace, Jared Cohon, 2009. Available at

   https://er.educause.edu/articles/2009/9/academias-role-in-securing-cyberspace

21             The breadth and depth of India’s cyber profile was presented during the Review of the Tunis Agenda by the UNGA in December 2015. It is available at

   http://workspace.unpan.org/sites/Internet/Documents/UNPAN95026.pdf

22             For a discussion on the issues involved in protecting India’s Critical National Infrastructure, see “Protection of Critical Information Infrastructure: an Indian Perspective” by Col. R.K. Sharma, The Digital Policy Portal, Observer Research Foundation. Available at

http://www.digitalpolicy.org/protection-of-critical-information-infrastructure-an-indian-perspective/

(Asoke Kumar Mukerji is a former diplomat. He was India’s Permanent Representative to the United Nations in New York from 2013-2015. He supervised India’s participation in United Nations Review of the Tunis Agenda in 2015. He has led Government of India’s multi-agency delegations for International Cooperation on Cyber Issues with the United States, Russian Federation, United Kingdom, and Japan during 2011-2013.)

(This article is carried in the print edition of September-October 2017 issue of India Foundation Journal.)