This article was downloaded by: [Colorado College]On: 11 November 2014, At: 18:55Publisher: RoutledgeInforma Ltd Registered in England and Wales Registered Number: 1072954 Registeredoffice: Mortimer House, 37-41 Mortimer Street, London W1T 3JH, UK

Strategic AnalysisPublication details, including instructions for authors andsubscription information:http://www.tandfonline.com/loi/rsan20

Indo–US Cooperation in CounteringCyber Terrorism: Challenges andLimitationsSwaran Singh & Jayanna KrupakarPublished online: 12 Sep 2014.

To cite this article: Swaran Singh & Jayanna Krupakar (2014) Indo–US Cooperation inCountering Cyber Terrorism: Challenges and Limitations, Strategic Analysis, 38:5, 703-716, DOI:10.1080/09700161.2014.941218

To link to this article: http://dx.doi.org/10.1080/09700161.2014.941218

PLEASE SCROLL DOWN FOR ARTICLE

Taylor & Francis makes every effort to ensure the accuracy of all the information (the“Content”) contained in the publications on our platform. However, Taylor & Francis,our agents, and our licensors make no representations or warranties whatsoever as tothe accuracy, completeness, or suitability for any purpose of the Content. Any opinionsand views expressed in this publication are the opinions and views of the authors,and are not the views of or endorsed by Taylor & Francis. The accuracy of the Contentshould not be relied upon and should be independently verified with primary sourcesof information. Taylor and Francis shall not be liable for any losses, actions, claims,proceedings, demands, costs, expenses, damages, and other liabilities whatsoever orhowsoever caused arising directly or indirectly in connection with, in relation to or arisingout of the use of the Content.

This article may be used for research, teaching, and private study purposes. Anysubstantial or systematic reproduction, redistribution, reselling, loan, sub-licensing,systematic supply, or distribution in any form to anyone is expressly forbidden. Terms &Conditions of access and use can be found at http://www.tandfonline.com/page/terms-and-conditions

Indo–US Cooperation in Countering Cyber Terrorism: Challenges andLimitations

Swaran Singh and Jayanna Krupakar

Abstract: The increasing dependence on Information and CommunicationTechnologies (ICTs) has unleashed a whole new genre of cyber terrorism. Cyberattacks on critical infrastructure, online hate propaganda and use of the internet forrecruiting, planning and effecting terrorist attacks have become new frontiers ofterrorism. The ubiquitous cyberspace has expanded terrorism structures and trans-formed their operations. Given their democratic traditions of privileging basic free-doms, such as individual privacy, and the unprecedented spread of the internet, Indiaand the US face a formidable challenge in confronting cyber terrorism. While bothcountries share a strong political affinity to cooperate and have set up institutionalmechanisms to secure cyberspace, divergences in their approaches and a lack of clarityand consensus on their immediate and long-term goals continue to be their funda-mental limitations. In spite of their strong commitment to work together, their diver-gent approaches to internet governance and episodes like the WikiLeaks and Snowdenaffairs have only re-enforced their continuing trust deficit.

Introduction

The post-Cold War world has witnessed a steep rise in the scourge of terrorism.The events of 9/11 were to make it the most formidable threat of the 21st century

and it has since evolved into several specialised genres, including cyber terrorism.Access to Information and Communication Technologies (ICTs) has been extremelyuseful for terrorists to organise violence through online training of terror modules andexecuting terror operations remotely through real-time communications. Seamlessinternet connectivity has not only expanded existing terrorism structures but triggerednew techniques of violence, such as hate propaganda, cyber vandalism and cyberattacks on critical infrastructure. With a high degree of dependence on ICTs, India andthe US are as vulnerable to cyber terrorism as they are to conventional terrorism. Theconvergence of borderless cyberspace and terrorism poses novel challenges to thestate authorities, including identifying the source of attack, jurisdictional problemsover prosecution and ensuring a balance between national security and individualfreedoms.

The early prototypes of cyber terrorism were witnessed in the 9/11 and Mumbai26/11 attacks. Both of these attacks clearly defied any possible advance thinking bytheir respective National Security Agencies (NSAs). But these unprecedented terroristattacks have since compelled both sides to reopen debates on their counterterrorism

Dr. Swaran Singh is Professor of Diplomacy and Disarmament at Jawaharlal Nehru University,New Delhi. Jayanna Krupakar is a Research Scholar in Diplomacy and Disarmament at the Schoolof International Studies, Jawaharlal Nehru University, New Delhi.

Strategic Analysis, 2014Vol. 38, No. 5, 703–716, http://dx.doi.org/10.1080/09700161.2014.941218

© 2014 Institute for Defence Studies and Analyses

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

thinking and to explore possibilities of cooperative strategies which have sincebecome the most essential imperative in securing cyberspace.1 In any case, post-1998 India had already been exploring possibilities for a reset in Indo–US ties when9/11 presented the strongest trigger for the US to engage with India. This rapproche-ment was further re-enforced by the 26/11 Mumbai attacks and the two countries havesince initiated cooperation in multiple sectors including countering cyber terrorism.

To begin with, both India and the US continue to face unending debates over thedefinition and causes of terrorism,2 the consequences of which remain far too glaringto be overlooked, though even here the US and India continue to differ on theirhierarchies of consequences. Also, whereas for the US the threat arises primarily fromChina as well as from non-state actors like al-Qaeda or private hacker groups, in thecase of India there is unmistakable evidence of state-sponsored terrorism throughagencies like Lashkar-e-Taiba and the Indian Mujahideen, stemming from across theborder.3 This has since pushed Indo–US initiatives in different directions even as theycontinue to rededicate themselves to tackling this menace together and explorepossibilities for collaborating in countering cyber terrorism.

The transformed nature of terrorism

To put cyber terrorism in perspective, it has to be located in the rapidly evolvingnature of terrorism, which has undergone a substantial transformation in the age of theinformation revolution and globalisation. What used to be localised conflicts operatedby small disgruntled groups have now assumed global proportions with transnationalterror networks spreading their tentacles to almost all parts of the world. Compared tobeing driven by radical political ideologies treating terror as their instrument, terror-ism has come to be an end in itself with political units working as its appendages tobest propagate their views, for example briefing the press after or prior to a majordestructive event.4 The number of active cadres has swollen, with active and sleepingcells making up their new organisation structure. These are increasingly accompaniedby large numbers of followers and sympathisers infiltrating the political, adminis-trative and security agencies of various states.

Recruitment, training, command and control of terror modules now operate alongmodern organisational lines; financing of terror operations has become easier andquicker, thanks to swift interconnectivity in global financial transactions. Socialnetworks and mobile phone text messages provide them with worldwide access inreal time and this has since increased their nexus with other violence entrepreneurssuch as drug cartels, arms dealers and crime syndicates.5 The brazenness of terrorattacks has similarly grown in ferocity, with terrorists using advanced weaponry likeImprovised Explosive Devices (IEDs) to attack high-profile targets. The 9/11 episodewas a watershed that proved the obsolescence of the conventional wisdom ofterrorists wanting to kill the one being watched by thousands rather than kill thethousands.

Another notable feature of new terrorism is the enrolment of young technicalprofessionals, making terror attacks far too sophisticated to detect and neutralise intime. While conventional terrorism has shown few signs of abatement, such newcategories as cyber terrorism have improvised on the old actors and methods, multi-plying their destructive capabilities several times over. With ICTs becoming pervasivein our social and economic spheres, terrorists find it extremely effective to coercegovernments or generate mass terror simply by damaging computer networks.

704 Swaran Singh and Jayanna Krupakar

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

Hacking, defacing websites, hate propaganda, online financial theft, disrupting criticalinformation systems and other forms of illicit cyber activities are becoming increas-ingly frequent and intense, with India and the US topping the list of targets.6

Recent incidents such as the loss of contact of Inter-Continental Ballistic Missiles(ICBM) of the US Air Force (USAF)7 and the viral online hate messages that weredisrupting communal harmony in India’s Assam8 last year are suspected to be thehandiwork of cyber terrorists. It is in this context that this article seeks to examine theevolving contours of India–US cooperation in countering cyber terrorism. It does soby comparing their perspectives on cyber terrorism and the challenges faced by theirpolitical and juridical discourses. It then elaborates on the various means and mechan-isms organised by their joint initiatives, also considering their strengths and limita-tions. This article agrees with the Institute for Defence Studies and Analyses (IDSA)Task Force 2012 that India and the US must embark upon a twin-pronged strategy of(1) developing a strong deterrence force structure, both individually and jointly, thatincludes real-time preventive and punitive measures; and (2) steering multilateralcooperation to produce a legally binding international governance framework tokeep cyberspace open and secure.9 It contends, however, that despite showing astrong political affinity to cooperate, divergences in approaches, reluctance to accom-modate and be sensitive to each other’s concerns and more importantly a lack ofclarity and consensus on their immediate and long-term objectives will continue to beformidable challenges.

The cyber terrorism debate

Just like terrorism, cyber terrorism10 has no agreed definition and the discourse on itlacks clarity even in its scholarly conceptualisation. Especially in India, the bound-aries between the terms cyber crime, cyber espionage, cyber terrorism and cyber warare themselves somewhat sketchy, partly because of inadequate domestic legal frame-works governing the use of cyberspace and partially because of the lack of consensuson standards necessary to define these paradigms. Technically, similar computeralgorithms or software programming is used in all of these activities, making itdifficult to know their exact purposes a priori. Many states, therefore, simply mergeall illicit cyber activities into a single overarching notion of cyber security to avoiddilemmas over exact labelling and distinctions. States have also been falling betweentwo schools, either being too liberal or too harsh in dealing with violations of theirnewly envisioned cyber legislations. Despite cyberspace being intrinsically transna-tional, international legal norms have yet to be contemplated.

Within this milieu, the proponents of countering cyber terrorism in India and theUS insist on their distinctiveness, using criteria like the ‘nature of the act, actors’intent and affiliation, the threshold of damage caused’ and so on to warrant appro-priate policy measures.11 Cyber terrorism is a far more complex phenomenon than justthe misuse of cyberspace by terrorists. It is also clearly different from conventionalterrorism in that this new form of conflict is based on ‘networked organisationalstructures’ with many groups being ‘leaderless and supple to come together quickly inswarming attacks’ or someone simply operating alone.12 The potential of harminflicted by damaging critical infrastructure systems in banking, defence, healthcare,information or energy sectors, and thereby the quantum of fear engendered andspread, is much greater and more lasting than conventional physical terror attacks.Added to this, features like anonymity, remoteness of attack and the lower risks of

Strategic Analysis 705

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

mortality for cyber terrorists make cyber terrorism a very attractive tool for 21st-century terrorists.

On the other hand, critics who bemoan over-emphasising the uniqueness of cyberterrorism remain sceptical of this increasing securitisation of cyberspace; they cautionagainst exaggerating cyber terror, pointing out that not a single casualty has so farbeen reported from acts of cyber terrorism.13 They allude to panic reaction in severalsocieties leading to over-regimentation and denial of basic freedoms to citizens.14

They argue that vested psychological, political and economic forces have combined topromote the fear of cyber terrorism.15 Driven by Target Rating Points (TRPs), globalmedia often remains vulnerable to creating panic by turning an ordinary event like thebreach of a computer network into an extraordinary cyber terror attack when often itturns out to be nothing more than a nuisance.16 These dichotomous discourses andconceptual inconsistencies have not helped to clear the air of confusion over theheated issue of cyber terrorism, which continues to defy even the innovative attemptsin Indo–US cooperation.

What is cyber terrorism?

Notwithstanding this polarised debate, the US has developed some technical standardsto define cyber terrorism.17 These come mainly from US academics highlighting therole of the US private sector, which has pioneered many cutting-edge technologiesrelated to cyberspace. The most widely quoted definition is the one provided byDorothy Denning, a professor of computer science, in a testimony before the USHouse Armed Forces Committee:

Cyber terrorism is the convergence of cyberspace and terrorism. It refers to unlawful attacksor threats of attacks against computers, networks and the information stored therein whendone to intimidate or coerce a government or its people in furtherance of political or socialobjectives. Further, to qualify as cyber terrorism, an attack should result in violence againstpersons or property, or at least cause enough harm to generate fear. Attacks that lead to deathor bodily injury, explosions, or severe economic loss would be examples. Serious attacksagainst critical infrastructures could be acts of cyber terrorism, depending on their impact.Attacks that disrupt nonessential services or that are mainly a costly nuisance would not.18

This definition appears to have influenced the US government’s thinking on cyberterrorism, as is witnessed in its various policy documents on cyber security. In the2003 National Strategy to Secure Cyberspace, cyberspace is defined as ‘… composedof hundreds of thousands of interconnected computers, servers, routers, switches, andfibre optic cables that allow our critical infrastructures to work’.19 Cyber terrorism isthus implied as attacks launched against cyberspace to coerce government or intimi-date its people, resulting in violence. Accordingly, the US has since moved far fromtreating cyber crimes as part of normal fraud and intrusions and evolved it as a distinctpart of their national security network. From being just an idea in 2006, US CyberCommand (USCYBERCOM) became operational from October 2010, comprising theJoint Task Force (TF) for Global Network Operations and the Joint FunctionalComponent Command for Network Warfare (JFCC-NW) coordinating with severalother US agencies in the intelligence and defence sectors.20

The number of Indian internet users doubled to exceed 100 million between 2005and 2010, and is expected to exceed 160 million by 2015. But the Government ofIndia’s definition of cyber terrorism remains somewhat vague and wide-ranging.

706 Swaran Singh and Jayanna Krupakar

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

India’s approach to cyber terrorism started with its Information Technology Act(2000), emphasising ‘unauthorised access’ to restricted information. The amendmentbill of 2006 then added e-governance, e-commerce, e-transactions and protection ofpersonal data. An amendment in 2008 provided a lengthy definition with key termslike ‘attacks on computers and computer networks’, ‘critical information infrastruc-ture’, ‘death or physical destruction’ and so on.21 Article 69 of the IT Act (2011) hassince authorised the state to ‘direct any agency of the appropriate government tointercept, monitor or decrypt or cause to be intercepted or monitored or decrypted anyinformation transmitted, received or stored through any computer resource’.22

Compared to the US, the Indian government appears less effective yet harsher. Inthe context of rapidly evolving ICTs and the versatile nature of their use, both theIndian and US approaches have serious shortcomings. First, cyber terrorism mayhappen not just by attacking communication networks but also by using them forswift, real-time coordination to mount conventional terror attacks. This was clearly thecase with the Mumbai 26/11 attacks, where reconnaissance and communication fromacross the border were supporting actual operations. Second, terrorists also usecyberspace for campaigning purposes, scouting for potential recruits and trainingthem, an aspect that remains uncovered by our existing definitions.23 Third, thepredominant focus on computers and the internet ignores other digital platform suchas social media, smartphone applications and so on, through which viral hate propa-ganda can be rapidly spread and may instigate communal riots.24 As a priority,therefore, India and the US need to evolve a shared political understanding oncyber terrorism, encompassing all possible variants through which it manifests.

Political thrust to counterterrorism cooperation

In spite of their differences, a strong political thrust exists between India and the USfor bilateral cooperation on countering terrorism in general and on countering cyberterrorism in particular.25 This is categorically expressed at all summit-level talks andis acknowledged by the political leaderships of both countries irrespective of partyaffiliations (see Table 1). Two broad reasons can be given for this sustained commit-ment. First, the overall political climate governing the relationship between the twohas transformed phenomenally in the post-Cold War era. India’s dynamic economicperformance, a rapidly modernising military with successful nuclearisation, a prag-matic foreign policy and the changed geostrategic calculus of the US have been thekey drivers to bring the erstwhile estranged democracies together to forge a strategicpartnership.26

Second, the raging terrorism threat and the utility of seeking collaborative mea-sures in confronting it have been recognised by both sides. Even prior to 9/11, the twogovernments had established a Joint Working Group (JWG) on counterterrorism inJanuary 2000.27 Starting from ‘intelligence sharing, information exchange and train-ing of personnel’, India and the US have intensified cooperation on counterterrorismunder the rubric of strategic partnership since 2004–2005.28 The evolving deep inter-linkages between the services sectors of the two economies have been another reasonfor the governments to cooperate on securing cyberspace.

Recent estimates suggest the loss of around $400 billion a year for the US andaround $4 billion for India due to illicit cyber activities.29 India is reported to have beensubjected to the highest number of Distributed Denial of Services (DDoS) attacks andthe fact that out of 13 internet root servers are located in the US makes it imperative for

Strategic Analysis 707

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

Indian strategists to seek cooperation with relevant US authorities. Likewise, alarmingthreats from Chinese-sponsored cyber attacks have also encouraged the US authoritiesto adopt a strategy of ‘deterrence by denial’ by building worldwide capability to protectits interests in cyberspace.30 At a Congressional hearing in 2013, the Asian region wasdubbed ‘the cyber security battleground’ beset by ‘aggressive state and non-stateactors’, and a strong pitch for US–India partnerships in this regard was made.31

However, the translation of this political thrust into productive outcomes has beensomewhat suboptimal, even problematic.

Institutionalisation of Indo–US cooperation

The first stint of Indo–US cooperation on countering cyber terrorism began with theestablishment of the India–US Cyber Security Forum Initiative (CSFI) on July 19,

Table 1. Timeline of Indo–US cooperation.

Year Key Events

2000 India and the US establish a JWG on counterterrorism, the first of its kind.2001–2002 Indo–US Cyber Security Forum Initiative (CSFI) is established; five ministerial-level

JWGs are set up to exchange expertise and recommend joint actions.2003 US government releases The National Strategy to Secure Cyberspace, a strategic

document to combat all illicit cyber activities, including cyber terrorism. TitanRain, a cyber espionage programme, steals sensitive files from Pentagon, allegedlyby Chinese hacker groups.

2004 Indian CERT-In is established along the model of US-CERT as a nodal body tooversee cyber security in India.

2005 Manmohan–Bush Joint Statement declares Indian and US intent to initiate StrategicPartnership. National Skills Registry is set up; the Indo–US Mutual LegalAssistance Treaty comes into effect.

2006 3rd Plenary of IUSCSF recommends setting up of India Anti-Bot Alliance (ABA)and Information Sharing and Analysis Centre (ISAC); however, India-US CyberSecurity Forum (IUSCSF) itself is suspended later due to alleged US poaching ofIndian personnel and leaking of sensitive Indian information.

2008 Series of terrorist attacks in India (Ahmedabad, Jaipur etc.) point to increasing misuseof cyberspace. Following 26/11 attacks, IT Act 2000 is amended with emphasis oncyber security paradigm; cyber terrorism gets mentioned in the act.

2009 Manmohan–Obama Joint Statement reiterates Indo–US commitment to counterterrorism in all its manifestations.

2010 India-US Strategic Dialogue commences; a Memorandum of Understanding onCounter Terrorism Cooperation Initiative (CCI) is signed. Indian computernetworks are hacked and disrupted in the midst of Commonwealth Gamespreparations. WikiLeaks release about US spying networks causes jitters withindiplomatic circles.

2011 India and US conclude Cyber Security Agreement, emphasise technologicalcollaboration, real-time intelligence sharing and supply chain management.

2012 CERT-In participates in an international cyber war simulation exercise hosted by theUS.

2013 Online viral hate propaganda creates civil disturbances in India; authorities deploreUS’s stingy attitude towards information sharing. Snowden’s revelations aboutUS’s intrusive snooping programme, including bugging Indian embassies, causesfurther furore. Important Indian networks like Defence Research and DevelopmentOrganisation (DRDO) and Central Bureau of Investigation (CBI) are breached,allegedly by a nondescript Pakistani Cyber Army (PCA).

708 Swaran Singh and Jayanna Krupakar

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

2001, shortly before the 9/11 strikes. Comprising both government agencies and theprivate sector, the CSFI focused on cooperation in the areas of ‘cyber security andrelated research, cyber forensics and law enforcement’.32 More specifically, ‘nationalsecurity issues arising from critical network information systems involved in out-sourced business processing, [and] knowledge management software development’were sought to be addressed through inter-governmental cooperation between Indiaand the US.33 Higher officials from the US Department of State (DOS) and theNational Security Council Secretariat (NSCS) of India presided over the forumwhile five ministerial-level JWGs were set up to exchange expertise in their respectivedomains and make recommendations for policy initiatives.34 The JWGs were directedto ‘exchange expertise in organisational, technical and procedural aspects of cybersecurity’.35

From the very beginning, these arrangements were tilted in favour of serving USinterests. While for India the primary objective was capacity building and Researchand Development (RnD), given the US’s technological superiority the US sought toco-opt India to build its first line of defence against cyber attacks targeting UScompanies.36 Given their divergent objectives, the forum did not achieve substantiveoutcomes. More specifically, the lukewarm US response was largely because issueslike defence and high-technology transfers required a relationship of ‘strategicpartnership’, which was still to be firmed up. Nevertheless, two notable outcomeson ‘soft issues’ like software development and capacity building resulted in the settingup of the Indian Computer Emergency Response Team (CERT-In)37 and the NationalSkills Registry (NSR)38 in 2005. However, two other suggested pilot projects—theIndia Information Sharing and Analysis Centre (IISA)39 and the India Anti-Bot Alliance(IABA)40—met with varying degrees of success.41

The India–US CSFI has remained defunct since 2006 due to a controversy thaterupted over alleged poaching of Indian personnel and leaking of sensitive informa-tion to US intelligence agencies.42 The setback did not reverse the cooperativeenthusiasm, thanks to the high tide in Indo–US relations that were witnessingnegotiations on the nuclear deal and the setting up of a strategic partnership. Bothgovernments continued to express their commitment to strengthen bilateral coopera-tion in a systematic, integrated and soundly institutional way. For four years, theforum managed to generate certain chemistry and had positive spin-offs as it helpedIndia to build its capacity in internet traffic analysis, detection of malicious software,cyber forensics and so on, which are incorporated in the CERT-In modules. Since itsestablishment, the CERT-In has greatly expanded its domain of activities and hasconsolidated its strengths in various cyber terrorism-related aspects.43 For the US, itgenerated an increased information security consciousness in Indian IT companies(many of them work for the US), which was some consolation, although it did notsuffice to sustain US indulgence with New Delhi.

The second stint of Indo–US cooperation began with the conclusion of the India–US Counter Terrorism Cooperation Agreement in 2010. Before that, the 2010Strategic Dialogue had already outlined their aim to ‘strengthen security cooperationthrough … sharing of advanced technologies’, an indication of the US becomingliberal in transferring the sensitive cyber technologies that India expects.44 Theagreement incorporated wider areas such as liaison and training between specialistcounterterrorism units, investigative assistance, terrorist financing and other suchissues. The two countries also signed the India–US Cyber Security Agreement in2011 to rejuvenate their cyber security dialogue, which has stalled since 2006. The

Strategic Analysis 709

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

basic format of the dialogue was kept unchanged, with regular ministerial-level talks,forming JWGs to deliberate on agreed issues and to recommend policy actions. Whatis distinguishable now is the urge from both sides to produce effective outcomes inthe spirit of strategic partnership.

While the July 2013 Indo–US Strategic Dialogue meeting had underlined the needfor ‘stronger partnership’ through various existing mechanisms, the December 2013meeting of the Indo–US Homeland Security Dialogue saw their top-level policedeliberating on tackling cyber crimes beyond computers to mobile hand-held devicessuch as smartphones and tablets. Compared to their existing mechanisms, like theMutual Legal Assistance Treaty (MLAT) and sending Letters Rogatory (LR) that take15–80 days to get log details, their proposed Indo-American Alert, InternationalWatch and Warn Network (IWWN) will allow real-time participation of Indian andAmerican law enforcement agencies to disseminate cyber crime information andmanage responses.45

Even their existing mechanisms and forums that deal with issues of counteringcyber terrorism have also gradually expanded their scope to include all cyber securityissues that affect their national, international and economic security. Cooperation onbest practices, sharing and operational assistance between CERT-In and US-CERT hasalso been assured.46 This new spirit promises to result in some kind of joint deterrencemechanism for real-time coordination in countering cyber terrorism. At the same time,the JWG on Strategic Policy Dialogue has continued to explore issues of ‘norms ofresponsible state behaviour in cyberspace, internet governance’ for evolving rules ofglobal governance. This is no doubt indicative of some harmonisation of viewsbetween Indian and US agencies.

From commercial to national security

Other than setting up cyber security structures and evolving common understandingon cyber terrorism, India and the US have also sought to blend their normativeunderstanding on this subject. To begin with, crimes in cyberspace were conceivedonly in the limited domain of commercial losses and profits, restricted to commercialspying and hacking. It is only gradually that their canvas has expanded to understandcyber terrorism as a major threat to national security. Cherian Samuel argues that theinitial Indian approach towards cyber security was to secure the economic interests ofthe IT companies. The 2008 Mumbai attacks were a major eye-opener for the Indianestablishment about the alarming capabilities of terrorists to misuse cyberspace. AsUS Commander George Lynn observed, ‘all the 26/11 mission planning was done viaGoogle Earth … The terrorists used cellular phone networks as command and controland social media to track and thwart the efforts of Indian commandos’.47

Since then, several terror attacks on Indian cities have used cyber technologiessuch as the Voice-over-Internet protocol (VoIP) for coordination, e-mails sent to mediaorganisations claiming responsibility for the attacks, circulation of hate videos, mal-icious anti-Indian propaganda and so on. The government, as a result, has madedecisive changes in its approach from largely commerce-centric cyber security plan-ning to a national security perspective.48 India amended the IT Act of 2000 in 2006,2008 and 2011 to incorporate new crimes like cyber terrorism and to provide forstringent punishment. It has set up coordinating authorities like sectoral CERTs tograpple with cyber security incidents in various government and economic sectors, aswell as strengthening the cyber police forces. The government has instituted a slew of

710 Swaran Singh and Jayanna Krupakar

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

measures, including enacting a National Cyber Security Policy (NCSP) in 2013 underwhich detailed jurisdictional authorities are established, like the National CriticalInformation Infrastructure Protection Centre (NCIIPC) and the National CyberCoordination Centre. Frontier areas like cryptology and cyber forensics have beengiven a boost for RnD.49

Many analysts, due to the gravity of threats in cyber terrorism thinking, havetermed preceding examples of the Indo–US Cooperation inadequate while welcomingthe positive changes made in India’s cyber terrorism thinking. India has only 556cyber security experts and the infrastructure that government controls was termed as‘grossly inadequate’ in a note prepared by the NSCS.50 Cyber security falls under thejurisdiction of the Ministry of Information Technology (MoIT) whose main purpose istechnology promotion, not security. Consistent demands have been made to shift thecyber security domain to the Ministry of Home Affairs (MHA).51 There has also beenthe problem of coordination between India’s provinces (under whom the police forceswork) and the Union government, and the proposal for a National Counter TerrorismCentre (NCTC), based on the US model, remains stagnant.52

The US, on the other side, has achieved better results in crafting a detailed nationalsecurity perspective on cyberspace since 2003. But it has also encountered seriouscoordination problems with state administrations and private sector players whooperate nearly 85 per cent of the US’s critical cyberspace infrastructure. However,relentless cyber threats, including attacks on US economic sectors, a trend of rapidcyber espionage and cyber intrusions into sensitive military domains (allegedlycarried out by Chinese-sponsored hackers and other non-state cyber terror groups)have convinced the US federal administration of the value of collaborative strategies.After successful negotiations with multiple stakeholders, a Comprehensive NationalCybersecurity Initiative (CNCI) was launched in 200853 which outlines a detailedframework for intergovernmental coordination and public–private partnerships. TheUS also has plans to integrate the civilian and military dimensions of cyberspace andin 2010 the USCYBERCOM was established, with cyberspace being declared thefifth domain of warfare.

Political and technical challenges

Countering cyber terrorism first requires a broader understanding as well as aninternational and dynamic approach to blend together the technical and politicaldimensions. On the technical side, the thrust areas of Indo–US cooperation includeinformation exchange, intelligence sharing, capacity building, technological colla-boration, counter cyber terrorism exercises and real-time coordination and responsemechanisms. Each side has identified certain priority sectors likely to be most affectedby cyber terrorism and to require joint prevention strategies. These sectors are: (1)government web infrastructure; (2) critical information infrastructure; (3) globalSupply Chain Management (SCM) of hardware/software products; and (4) generalpublic users of cyberspace.

The US government has already put in place robust federal coordinating institu-tions for cyber incident response and sophisticated programmes like EINSTEIN andCyber Storm III for early detection and prevention of cyber terrorism. EINSTEIN is acyber intrusion detection system that is deployed in all government web infrastruc-tures, with premeditated programming to trace potential malicious activity and disruptit at its origin. Cyber Storm III is a scenario-based cyber security drill conducted

Strategic Analysis 711

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

frequently since 2010 where large-scale attacks are carried out on critical informationsystems to assess the strength of cyber defence mechanisms.54 India’s ambitiousdigital connectivity programme, including the National e-Governance Plan (NeGP),could benefit hugely by learning from US experience. In June 2012, the US invitedIndia to participate in an international cyber war game.55 Joint exercises like these aremutual win-wins in building capacities, but both countries need to address theirbureaucratic red-tapism and agency-to-agency contact and coordination.

The US views South Asia as its ‘strategic backwater’, an epicentre of terrorismand a region filled with aggressive cyber state and non-state actors and this makes USagencies, according to India’s National Security Advisor (NSA) Shiv Shankar Menon,‘extremely stingy’ in intelligence sharing.56 The US security agencies’ low interest insharing advanced technologies can be overcome by engaging deeply with its politicalestablishment. While India expects no big wholesale transfer of technologies, modeststeps like academic collaboration, in-situ learning and experimentation can suffi-ciently help in building mutual expertise.57 Collaboration on advanced countercyber terrorism strategies and technologies needs a big push from both governments.Moreover, given that present-day technologies have a short shelf life, they must keeptheir progression way ahead of cyber terrorists. Cryptology, stealth electronic surveil-lance, nanorobotics and artificial intelligence are some of the frontier areas that needto be considered for collaboration.

Finally, an elaborate public awareness programme alerting cyber users to thedangers of cyber terrorism and equipping them with adequate security measures cango a long way in building societies resilient to the menace of cyber terrorism.Cyberspace has multiple stakeholders—individuals, social groups, industrial organi-sations, government agencies, etc. A collective psychological movement to defeatcyber terrorists is essential as terrorism is as much a social problem as a political one.The US has already integrated a Stop.Think.Connect awareness campaign in itsoverall national cyber security strategy.58 It is imperative for India too to embarkupon such an initiative to arrest the trend of panic-creating cyber incidents that disruptsocial harmony and economic progress.

WikiLeaks and the Snowden affair

Recent controversies over WikiLeaks and Edward Snowden’s revelation of theNSA’s intrusive snooping programmes over US domestic citizens as well as foreigngovernments and peoples have received universal condemnation and contempt.59 TheWikileaks episode and NSA’s PRISM programme have especially undermined thecooperative spirit of US allies and friends.60 Bugs were planted in the IndianEmbassies that leaked sensitive information.61 In response, the Indian governmenthas been considering starting its own snooping programmes. Indeed, the IndianCentral Monitoring System (CMS), authorised under the IT Act 2008, is oftencriticised for evading the debate on Indian citizens’ right to privacy.62

Following the US, many countries, including India, are planning to establish aCyber Command to confront this fifth domain of warfare. But this paranoia may alsounleash a cyber arms race, which is bound to give much fodder to cyber terrorists justas the conventional arms race gave to conventional terrorists. The anonymous natureof cyberspace makes it extremely difficult for security agencies to patrol. But just aspolicing the neighbourhood streets does not mean sneaking into every household,India and the US must work together to devise intelligent mechanisms to solve the

712 Swaran Singh and Jayanna Krupakar

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

challenges of cyberspace terrorism without undermining basic needs for individualprivacy.

India and the US face three formidable political challenges in their endeavour tosecure cyberspace against terrorist threats. The first challenge is to maintain thebalance between privacy and security. As responsible democracies with accountablesystems of rule of law, the two governments cannot violate the basic freedoms of theircitizens in their zeal to enforce absolute security. Their second challenge lies inaddressing the growing inter-state espionage and a nascent cyber arms race that isthreatening to expose the vulnerable side of the architecture of cyberspace security.The third challenge lies in constructing an international regime to govern the ‘lawlessand anarchic’ cyberspace. India and the US presently differ over who should control,own and operate the internet, with the US insisting on private sector-led controlmechanisms and India arguing to bring the internet under the aegis of the UN.Being world leaders in ICTs and sharing similar political value systems, India andthe US have to reconcile these divergent positions that underwrite their specificinitiatives as well as their larger cooperation in countering cyber terrorism.

Conclusion

There is no doubt that Indo–US cooperation on countering cyber terrorism showsincreasing signs of dynamism and expansion, yet it remains to be seen how thistrajectory progresses towards maturity and mutual trust as the two countries confronteven more complex challenges in the future. To their credit, the two have continued toengage and have evolved some broad understanding, moving from their initial view ofprotecting cyberspace for limited commercial interests to seeing it as integral to theirlarger national and international security discourses. The last decade has seen bothcountries sharing a strong political thrust to cooperate in countering terrorism but thishas not been fully institutionalised, partly because of persistent distrust and bureau-cratic red-tapism that stems in some part from the deep-rooted differences in theirunderstanding and approaches to cyber terrorism.

While the focus of US strategies remains cyber aggression from China, India’sprimary concern is confronting cyber terrorism from Pakistan and Pakistani-sponsorednon-state actors.63 Substantial work remains to be done even on the basic issues ofintelligence sharing and capacity building. Recent controversies like the US cybersnooping and divergent positions over internet governance point to the formidablelimitations and challenges for Indo–US cooperation in countering cyber terrorism.Mutual respect, sensitivity to each other’s concerns and accommodation of eachother’s policy positions remain prerequisites for effective Indo–US cooperation andto bring in it the necessary dynamism to take their cooperation to those requiredadvanced and higher levels. This, by any means, seems a tall order.

Notes1. An urge to seek comprehensive cooperation in countering terrorism in all its manifesta-

tions has been regularly expressed at the summit-level talks between India and the UnitedStates. See ‘Joint Statement on PM’s Summit Meeting with President Barack Obama inWashington DC’, at http://pib.nic.in/newsite/erelease.aspx?relid=99734 (Accessed July 30,2014).

2. There are several definitions of terrorism, but the commonly accepted one sees it as organisedviolence against innocent citizens or non-combatants in order to coerce a government or its

Strategic Analysis 713

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

people. See Bruce Hoffman, ‘Defining Terrorism’, in Russell Howard and Reid Sawyer (eds.),Terrorism and Counterterrorism: Understanding the New Security Environment, McGraw-Hill, Guildford, 2002, pp. 3–23.

3. Concerns about cross-border terrorism have been frequently expressed at the highest politicallevel in India. See ‘PM’s Statement in the Lok Sabha on the Debate on the PM’s Recent Visitto Abroad’, at https://www.indianembassy.org/archives_details.php?nid=1152 (Accessed July30, 2014).

4. For instance, an Indian Mujahideen terror outfit sent e-mails to various media organisationsafter or before the terror attacks in Mumbai (2011), Pune (2010), Delhi (2008), etc. See B.Raman, ‘More on the Indian Mujahideen’, Outlook, September 12, 2011, at http://www.outlookindia.com/article.aspx?278279 (Accessed October 27, 2013).

5. Johan Bergenas and Esha Mufti, ‘Crime-Terror Nexus Requires Integrated Approaches’, WorldPolitics Review, February 25, 2013, at http://www.worldpoliticsreview.com/articles/12740/crime-terror-nexus-requires-integrated-security-approaches (Accessed October 27, 2013).

6. Patience Wheatcroft, ‘Cyber Terrorism is Now Seen as Real Threat’, The Wall Street Journal,June 30, 2010, at http://online.wsj.com/news/articles/SB10001424052748704103904575336703726142746 (Accessed March 14, 2014); and ‘India, US, UN Targets of Biggest EverCyber Attacks: Report’, The Hindu, August 3, 2011, at http://www.thehindu.com/news/international/india-us-un-targets-of-biggest-ever-cyber-attack-report/article2319500.ece (AccessedSeptember 17, 2013).

7. ‘International Cooperation Key to Counter Cyber Threat’, Ria Novosti, March 23, 2013, at http://indrus.in/world/2013/03/22/international_cooperation_key_to_counter_cyber_threat_23151.html(Accessed September 11, 2013).

8. Silviu Petre, ‘Cyberwarfare as a Factor in Nation-Building and Un-building: The Case of theAssam Riots’, Romanian Review of Eurasian Studies, 9(1/2), 2013, p. 32.

9. India’s Cyber Security Challenges, IDSATask Force Report, Institute for Defence Studies andAnalyses, New Delhi, 2012.

10. The term ‘cyber terrorism’ was first coined by Barry Collin in the 1980s, a period when theinternet project was becoming increasingly noticeable and virus attacks like Brain andMichelangelo were receiving wide media attention. See Barry Collin, ‘The Future of CyberTerrorism’, Crime and Justice International, 13(2), March 1997, at http://www.cjimagazine.com/archives/cji4c18.html?id=415 (Accessed July 30, 2014).

11. Clay Wilson, ‘Cyber Threats to Critical Information Infrastructure’, in T.M. Chen et al. (eds.),Cyberterrorism: Understanding, Assessment and Response, Springer, New York, 2014, p. 123.

12. John Arquilla and David Ronfeld, Networks and Netwars: The Future of Terror, Crime andMilitancy, Rand Corporation, Santa Monica, CA, 2001.

13. Peter Singer, ‘The Cyber Terror Bogeyman’, Armed Forces Journal, November 2012, at http://www.brookings.edu/research/articles/2012/11/cyber-terror-singer (Accessed August 12, 2013).

14. Stephen Cohen, Folk Devils and Moral Panics, Routledge, Abingdon, 2002.15. Gabriel Weimann, ‘Cyberterrorism: How Real is the Threat?’, Special Report, United States

Institute of Peace, May 13, 2004, at http://www.usip.org/publications/cyberterrorism-how-real-the-threat (Accessed October 7, 2013).

16. Y. Jewkes, Media & Crime, Sage Publications Ltd, London, 2004.17. Cyber terrorism on computer networks can be carried out through multiple platforms like the

usual virus or worm attacks, Trojan horses and other such malware. The more devastatingforms are Distributed Denial of Services (DDoS) and botnet attacks. DDoS is an extremelylarge and continuous website-access service-seeking attack launched from different hosts ofcomputers targeting a particular server which ultimately breaks down due to the enormity ofrequests received to address. The 2007 Estonia attacks were based on DDoS. Botnet refers totasks that can invade computers and undertake malicious activities remotely on behalf ofhackers. Cyber attack through corrupted hardware is also possible through logic bombs. For aglossary of these terms, see US-CERT, ‘Explore Terms: A Glossary of Common CybersecurityTerminology’, available at http://niccs.us-cert.gov/glossary#letter_d.

18. Dorothy Denning, ‘Cyberterrorism’, Testimony before the Special Oversight Panel ofTerrorism, Committee on Armed Services, US House of Representatives, May 23, 2000, athttp://www.stealth-iss.com/documents/pdf/CYBERTERRORISM.pdf (Accessed July 30,2014).

714 Swaran Singh and Jayanna Krupakar

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

19. The National Strategy to Secure Cyberspace, The White House, Washington DC, February2003, p. vii, at https://www.us-cert.gov/sites/default/files/publications/cyberspace_strategy.pdf(Accessed July 30, 2014).

20. For a detailed and tabulated comparison of Indian and US legal provisions, see RaghuSantanam, M. Sethumadhavan and Mohit Virendra (eds.), Cyber Security, Cyber Crime andCyber Forensics: Applications and Perspectives, Information Science Reference, New York,2011, pp. 41–44.

21. Department of Electronics & Information Technology (DeitY), ‘Information Technology(Amendment) Act 2008ʹ, at http://deity.gov.in/sites/upload_files/dit/files/downloads/itact2000/it_amendment_act2008.pdf (Accessed 14 March 2014).

22. Ibid.23. Many terrorist organisations operate their own websites, directly or through masking other

websites. For a discussion on terrorist use of the internet, see Council on Foreign Relations,‘Terrorists and Internet’, at http://www.cfr.org/terrorism-and-technology/terrorists-internet/p10005 (Accessed July 30, 2014).

24. National Security Advisor Shiv Shankar Menon reportedly pointed to the deliberate misuse ofsocial media to create panic and drive out north-easterners from south India in 2013. See ‘US,UK “Stingy” in Sharing Sensitive Data with India: Shiv Shankar Menon, NSA’, The EconomicTimes, July 19, 2013, p. 1.

25. The White House, US–India Joint Statement, September 27, 2013, at http://www.whitehouse.gov/the-press-office/2013/09/27/us-india-joint-statement (Accessed July 30, 2014).

26. Raja Mohan, Crossing the Rubicon: The Shaping of India’s New Foreign Policy, PenguinViking, New Delhi, 2003.

27. Ministry of External Affairs, India–US Relations, at http://www.mea.gov.in/Portal/ForeignRelation/India-U.S._Relations.pdf (Accessed November 2, 2013).

28. Shanthie Mariet D’Souza, ‘Indo‑US Counterterrorism Cooperation: Rhetoric versusSubstance’, Strategic Analysis, 32(6), 2008, pp. 1067–1084.

29. ‘Cyber Criminals Cost India USD 4 Billion in 2013: Symantec’, The Economic Times, October22, 2013, at http://articles.economictimes.indiatimes.com/2013-10-22/news/43288507_1_cyber-crime-ritesh-chopra-ransomware (Accessed November 11, 2013).

30. Siobhan Gorman, ‘US Report to Warn on Cyberattack Threat from China’, The Wall StreetJournal, March 8, 2012, at http://online.wsj.com/news/articles/SB10001424052970203961204577267923890777392 (Accessed September 13, 2013).

31. ‘Congressional Committee Calls for Strong India–US Ties on Cyber Security’, The Hindu,July 30, 2013, p. 1.

32. Press Information Bureau, India–US Cyber Security Forum—Fact Sheet, March 2, 2006, athttp://pib.nic.in/newsite/erelease.aspx?relid=16132 (Accessed September 23, 2013).

33. US Department of State, US–India Cyber Security Forum: Enhanced Cooperation toSafeguard Shared Information Infrastructures, March 3, 2006, at http://2001-2009.state.gov/p/sca/rls/fs/2006/62530.htm (Accessed September 23, 2013).

34. These five groups included: (1) Legal Cooperation and Law Enforcement (co-chaired by theUS Department of Justice and the Indian Ministry of Home Affairs); (2) Research andDevelopment (co-chaired by the Department of State and the Indian Ministry of Defence);(3) Critical Information Infrastructure, Watch and Warning and Emergency Response (co-chaired by the US Department of Homeland Security and the Indian Department ofInformation Technology); (4) Defence Cooperation (co-chaired by the US Department ofDefense and the Indian Ministry of Defence); (5) Standards and Software Assurance (co-chaired by the Department of Commerce and the Indian Department of InformationalTechnology), ibid.

35. A full analysis of what the JWGs achieved is impeded by the lack of primary information fromgovernment sources. Webpage links to the Indo‑US Cyber Security Forum are non-existent,nor are their minutes and activities, if recorded, open to public access.

36. Cherian Samuel, ‘Prospects for India–US Cyber Security Cooperation’, Strategic Analysis,35(5), 2011, pp. 770–780.

37. CERT-In, modelled on the US Computer Emergency Readiness Team (US-CERT), is the apexnodal agency to coordinate all aspects of operational cyber security issues, such as respondingto cyber incidents, developing best security practices and so on. See https://cert-in.org.in.

Strategic Analysis 715

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14

38. The NSR maintains a systematic registry of all personnel working in the IT industry onbiometric identification for valid authentication. This is to detect and prevent potential trouble-makers from disrupting software or hardware machinery at various levels in the electronicsand software industry. See https://nationalskillsregistry.com/nsr-context.htm.

39. IISA is a proposed centre for information sharing among software industrial organisations andtheir end users over the trends of malicious activities in cyberspace. The website of the IISA isalso defunct.

40. IABA, which aimed to remove botnets that hack industrial systems, was a non-starter as theforum itself became defunct in 2006. However, efforts to build such a system, modelled on USinitiatives, continued with Tata Communications acquiring capability over time. See CherianSamuel, no. 35.

41. Cherian Samuel, no. 35.42. Ibid.43. IDSA Task Force Report, no. 9.44. US Department of State, Security Partnership for the 21st Century, July 19, 2011, at http://

www.state.gov/r/pa/prs/ps/2011/07/168744.htm (Accessed October 3, 2013).45. Namrata Biji Ahuja, ‘Cyber Crimes: US, India to Cooperate’, The Asian Age (New Delhi),

December 3, 2013.46. US Department of State, US–India Joint Fact Sheet: International Security, June 24, 2013, at

http://www.state.gov/r/pa/prs/ps/2013/06/211020.htm (Accessed October 3, 2013).47. ‘Cyber Space Played Key Role in 26/11 Mumbai Attack: US Commander’, The Economic

Times, May 16, 2012, at http://articles.economictimes.indiatimes.com/2012-05-16/news/31726926_1_mumbai-attack-cyber-space-google-earth (Accessed July 30, 2014).

48. Cherian Samuel, no. 35.49. Ministry of Communication and Information Technology, National Cyber Security Policy, July

2, 2013, at http://deity.gov.in/sites/upload_files/dit/files/National%20Cyber%20Security%20Policy%20%281%29.pdf (Accessed July 30, 2014).

50. ‘An IT Superpower, India Has Just 556 Cyber Security Experts’, The Hindu, June 19, 2013,p. 1.

51. IDSA Task Force Report, no. 9.52. ‘No NCTC Till All States are on Board: Home Minister’, The Indian Express, July 11, 2013,

at http://archive.indianexpress.com/news/no-nctc-till-all-states-are-on-board-home-minister/1140404/ (Accessed July 30, 2014).

53. Department of Homeland Security (DHS), Preventing and Defending against Cyber Attacks,October 2011, at http://www.dhs.gov/xlibrary/assets/preventing-and-defending-against-cyber-attacks-october-2011.pdf (Accessed July 30, 2014).

54. Ibid.55. Franz-Stefan Gady, ‘US–India Cyber Diplomacy: A Waiting Game’, The National Interest,

October 24, 2013, at http://nationalinterest.org/commentary/us-india-cyber-diplomacy-waiting-game-7662 (Accessed July 30, 2014).

56. ‘US, UK “Stingy” in Sharing Sensitive Data’, no. 23.57. Cherian Samuel, no. 35.58. DHS, no. 52.59. ‘Ex-Worker at CIA Says He Leaked Data on Surveillance’, The New York Times, June 9, 2013,

at http://www.nytimes.com/2013/06/10/us/former-cia-worker-says-he-leaked-surveillance-data.html?_r=0 (Accessed July 30, 2014).

60. Kamlesh Bajaj, ‘Through the Prism Revelation’, The Indian Express, June 17, 2013, at http://archive.indianexpress.com/news/through-the-prism-revelation/1129877/ (Accessed July 30,2014).

61. ‘NSA Planted Bugs at Indian Missions in D.C., U.N.’, The Hindu, September 25, 2013, p. 1.62. ‘Govt. Violates Privacy Safeguards to Secretly Monitor Internet Traffic’, The Hindu,

September 9, 2013, p. 1.63. ‘Congressional Committee Calls for Strong India-US Ties on Cyber Security’, The Hindu, July

30, 2013, p. 1.

716 Swaran Singh and Jayanna Krupakar

Dow

nloa

ded

by [

Col

orad

o C

olle

ge]

at 1

8:55

11

Nov

embe

r 20

14