Sources at NTRO, a relatively new highly specialised intelligence gathering agency concerned with satellite, terrestrial and internet monitoring as well as cyber warfare, have pegged the number of computers to have been hit in these attacks at 450.

Initial investigations revealed that 30 computers, including eight from the PMO, were compromised. This also involved two persons not on the regular posted strength of the PMO, prompting intelligence agencies to believe that the cyber attacks were backed by a high level of human intelligence, providing the whereabouts of key individuals and their portfolios and e-mail addresses. Others who came under attack from cyber space included chairman of the Joint Intelligence Committee, chief of the Naval Staff, deputy chief of Naval Staff, PM’s special envoy, the three military intelligence services and establishments of the BSF and CRPF in Jammu and Kashmir.

Monitoring the flow of information from these computers led to the identity of other computers that were compromised. Experts feel that the number could be more if the net was cast wider.

NTRO claims that the e-mail IPs of a couple of top mediapersons were also the target of these attacks. A MS-Word file titled National Security Document, containing a complex spyware was sent to the targeted addresses, which resulted in the computers being compromised once the document was downloaded. Earlier a malicious PDF file was also circulated. An e-mail address with a.nic.in suffix, said to be a dormant address hacked by the attackers, was reportedly used to send the mails.

Sources said that cyber experts at NTRO used “reverse hacking” methodology to trace the origins of the servers used in the malicious attacks. It is strongly believed that the servers were traced to mainland China, the exact physical location could not be established due to the complex nature of the attacks. “Our technical corroborations and results from other similar investigations reveal that the command and control architecture of these attacks have a Chinese signature,” a source claimed.

Under its Informationalisation Doctrine, China lays a huge emphasis on cyber war and it has a well set-up infrastructure for the same. Chinese believe cyber war to be the first element of surprise in a conventional war, to be used to cripple enemy civilian and military networks before going in for a physical offensive.

Some time ago NTRO had formed a rapid reaction team to deal with such exigencies and sources claim that their reaction time to the attacks was about an hour-and-a-half. NTRO is also known to have developed an offensive cyber warfare capability designed to penetrate computer networks and remote servers.

NEW DELHI – The world now accepts that protecting our atmosphere, hydrosphere, lithosphere, and biosphere – the “global commons” – is the responsibility of all countries. The same norm must apply to cyberspace, which is critical to our everyday life, economic well-being, and security.

At a time when cyber attacks are increasing worldwide, US Secretary of State Hillary Clinton was right to declare that an attack on one nation’s computer networks “can be an attack on all.” Indeed, the attacks are a reminder that, as a new part of the global commons, cyberspace already has come under threat.

Cyberspace must be treated, along with outer space, international waters, and international airspace, as property held in common for the good of all. And, like ocean piracy and airplane hijacking, cyber-crime cannot be allowed to go unpunished if we are to safeguard our common assets and collective interests.

Naming China among a handful of countries that have stepped up Internet censorship, Clinton warned that “a new information curtain is descending across much of the world.” Her statement, with its allusion to the Cold War-era Iron Curtain, amounted to an implicit admission that the central assumption guiding US policy on China since the 1990′s – that assisting China’s economic rise would usher in greater political openness there – has gone awry.

The strategy of using market forces and the Internet to open up a closed political system simply is not working. Indeed, the more economic power China has accumulated, the more adept it has become in extending censorship to cyberspace.

If anything, China has proven that a country can blend control, coercion, and patronage to stymie the Internet’s politically liberalizing elements. Through discreet but tough controls, Beijing pursues a policy of wai song, nei jin – relaxed on the outside, vigilant internally.
Google is now crying foul over ” a highly sophisticated and targeted attack on our corporate infrastructure originating from China.” But, despite its corporate motto – “Don’t be evil” – Google itself was instrumental in aiding online censorship in China, having custom-built a search engine that purges all references and Web sites that the Chinese government considers inappropriate. Now Google itself has become a victim of China’s growing cyber prowess, in the same way that appeasement of Hitler boomeranged onto France and Britain.

China deploys tens of thousands of ” cyber police” to block Web sites, patrol cyber-cafes, monitor the use of cellular telephones, and track down Internet activists. But the threat to the new global commons comes not from what China does domestically. Rather, it comes from the way in which the know-how that China has gained in fashioning domestic cyber oversight is proving invaluable to it in its efforts to engage in cyber intrusion across its frontiers.

Canadian researchers have discovered a vast Chinese surveillance system called “GhostNet,” which can compromise computers in organizations abroad through booby-trapped e-mail messages that automatically scan and transfer documents to a digital storage facility in China. This is what happened when computers of the Tibetan government-in-exile in Dharamsala, India, were attacked last year.

India’s national security adviser recently complained that his office was targeted yet again by hackers. “People seem to be fairly sure it was the Chinese,” he said. Officials in Germany, Britain, and the US have acknowledged that hackers believed to be from China also have broken into their government and military networks.

The state-sponsored transnational cyber threat is at two levels. The first is national, with the hackers largely interested in two objectives. One is to steal secrets and gain an asymmetrical advantage over another country. Cyber intrusion in peacetime allows the prowler to read the content and understand the relative importance of different computer networks so that it knows what to disable in a conflict situation. The other objective is commercial: to pilfer intellectual property.

The second level of cyber threat is against chosen individuals. The most common type of intrusion is an attempt to hack into e-mail accounts. The targets also can face Trojan-horse attacks by e-mail intended to breach their computers and allow the infiltrators to corrupt or transfer files remotely.

To be sure, if a cyber attack is camouflaged, it is not easy to identify the country from which it originated. Through the use of so-called “false-flag espionage” and other methods, attacks can be routed through the computers of a third country. Just as some Chinese pharmaceutical firms exported to Africa spurious medicines with “Made in India” labels – a fact admitted by the Chinese government – some Chinese hackers are known to have routed their cyber intrusion through computers in Russia, Iran, Cuba, and other countries.

But, like their comrades in the pharmaceutical industry, such hackers tend to leave telltale signs. Then there are many cases in which the attacks have originated directly from China.
It seems unlikely that these hackers, especially those engaged in cyber espionage, pilferage, and intimidation, are private individuals with no links to the Chinese government. It is more likely that they are tied to the People’s Liberation Army. In war, this irregular contingent of hackers would become the vanguard behind which the PLA takes on the enemy. Systematic cyber attacks constitute a new frontier of asymmetrical warfare at a time when the world already confronts other unconventional threats, including transnational terrorism.

With national security and prosperity now dependent on the safekeeping of cyberspace, cybercrime must be effectively countered as an international priority. If not, cyberspace will become the new global-commons battlefield.

Brahma Chellaney, a former member of India’s National Security Council, is Professor of Strategic Studies at the Center for Policy Research in New Delhi.

Copyright: Project Syndicate, 2010.
www.project-syndicate.org

For a podcast of this commentary in English, please use this link: http://media.blubrry.com/ps/media.libsyn.com/media/ps/chellaney6.mp3

The mission of Cyber Command is to protect the U.S. military’s networks and to be ready to launch offensive cyber attacks on a potential enemy. Those offensive cyber attacks have the potential to reach out from cyberspace into the physical dimension, causing giant electrical generators to shred themselves, trains to derail, high-tension power-transmission lines to burn, gas pipelines to explode, aircraft to crash, weapons to malfunction, funds to disappear and enemy units to walk into ambushes. Welcome to warfare in the twenty-first century.

We have become accustomed to the pilots of Predator and Reaper drones driving a few miles to their homes in Virginia and dinner with their kids after having “flown” aircraft all day on the other side of the globe, firing deadly Hellfire missiles into houses of terrorists in Pakistan. That looks like war as PlayStation: death by joystick, no risk of being shot down, no chance of capture. Now, with cyber war, we have another means of launching attacks on the other side of the world, this time with only a keyboard. In Vietnam and Iraq, U.S. pilots were shot down while attempting to bomb enemy air-defense missiles. Now, a cyber warrior might simply shut off an air-defense network or cause missiles to explode on their launch rails, not by using a laser-guided missile, but by activating a logic bomb. Cyber war could well mean fewer casualties, less physical destruction. Surely then, it is a good idea.

PERHAPS NOT. Much like sixty years ago when we first began to deal with strategic nuclear weapons, we have neither outlined a clear strategy nor had an open debate about how best to deal with this new capability and this new threat. As former–Secretary of Defense Robert McNamara discovered, without a real strategy for the use of strategic nuclear weapons, we risked annihilation of both ourselves and our enemies. The Strategic Air Command (SAC) had a simple plan: the United States would perceive when the Soviet Union was getting ready to attack us and then SAC would go first, launching all of its weapons against all of its possible targets in the Soviet Union, China and the Warsaw Pact nations of Eastern Europe. Horrified by that idea, McNamara commissioned work that developed a strategy of deterrence, including withholding attacks on cities, controlling escalation, minimizing crisis instability and initiating nuclear-arms control. Much of the development of that strategy was done in public, in speeches by then-President John F. Kennedy and McNamara, and in books by academics such as Herman Kahn, founder of the Hudson Institute, and MIT professor William Kaufmann. This is exactly the kind of discussion we need to have today. For it is not an overstatement to say that the body of work on atomic strategy initiated in the Kennedy administration probably prevented a nuclear war in which hundreds of millions may have died.

We sit at a similar historical moment. War fighting is forever changed. Though it will never produce the kind of death toll of nuclear weapons, we can see echoes of these same risks and challenges in today’s newest cyber-war battlefield. We’ve developed a plethora of gee-whiz technological capabilities in the past few years, but cyber war is a wholly new form of combat, the implications of which we do not yet fully understand. Its inherent nature rewards countries that act swiftly and encourages escalation.

AS IN the 1960s, the speed of war is rapidly accelerating. Then, long-range missiles could launch from the prairie of Wyoming and hit Moscow in only thirty-five minutes. Strikes in cyber war move at a rate approaching the speed of light. And this speed favors a strategy of preemption, which means the chances that people can become trigger-happy are high. This, in turn, makes cyber war all the more likely. If a cyber-war commander does not attack quickly, his network may be destroyed first. If a commander does not preempt an enemy, he may find that the target nation has suddenly raised new defenses or even disconnected from the worldwide Internet. There seems to be a premium in cyber war to making the first move.

And much as in the nuclear era, there is a real risk of escalation with cyber war. Nuclear war was generally believed to be something that might quickly grow out of conventional combat, perhaps initiated with tanks firing at each other in a divided Berlin. The speed of new technologies created enormous risks for crisis instability and miscalculation. Today, the risks of miscalculation are even higher, enhancing the chances that what begins as a battle of computer programs ends in a shooting war. Cyber war, with its low risks to the cyber warriors, may be seen by a decision maker as a way of sending a signal, making a point without actually shooting. An attacker would likely think of a cyber offensive that knocked out an electric-power grid and even destroyed some of the grid’s key components (keeping the system down for weeks), as a somewhat antiseptic move; a way to keep tensions as low as possible. But for the millions of people thrown into the dark and perhaps the cold, unable to get food, without access to cash and dealing with social disorder, it would be in many ways the same as if bombs had been dropped on their cities. Thus, the nation attacked might well respond with “kinetic activity.”

Responding, however, assumes that you know who attacked you. And, one of the major differences between cyber war and conventional war—one that makes the battlefield more perilous—is what cyber warriors call “the attribution problem.” Put more simply, it is a matter of whodunit. In cyberspace, attackers can hide their identity, cover their tracks. Worse, they may be able to mislead, placing blame on others by spoofing the source.

In 2007, the Russian government denied that it had engaged in primitive cyber war against Estonia that took out such things as the financial-services sector, and in 2009 claimed it was not responsible for largely identical activity against Georgia; though Russia did concede that some of its citizens, outraged over the conflict in Abkhazia, might have launched the denial-of-service attacks.

In July of this year, cyber attacks were launched against commercial and government websites in the United States and South Korea. The targets included the White House and Washington Post homepages. South Korean intelligence officials blamed the North. The attacks, however, seemed to originate inside South Korea.

For years, masses of data have been stolen from sensitive U.S. government and defense-contractor computers in attacks that investigators have code-named “Moonlight Maze” and “Titan Rain.” Which nation—or nonstate actor—has repeatedly performed the brazen cyber espionage has never been clearly established. What is clear is that cyber warfare poses new risks that we have yet to fully grasp.

THE UNITED States thinks that its cyber warriors are the best at offense, with the capability of shutting down enemy air defenses, electric-power grids, rail systems and telephony. The United States has probably already penetrated many such networks and laced them with trap doors (ways to get back in easily) and logic bombs (software that would wipe out everything on a network).

Such offensive prowess does nothing to defend our own networks from similar attacks, however, and the current U.S. defense systems protect only parts of the federal government, and not civilian or private-sector infrastructure. No nation is as dependent on cyber systems and networks for the operation of its infrastructure, economy and military as the United States. Yet, few national governments have less control over what goes on in its cyberspace than Washington. And these major lapses in our defense present a threat we ignore at extremely high cost.

The possibility of an electric-power grid being hit by a cyber attack is less far-fetched than one might think. A CIA official has admitted that at least one blackout outside the United States was already caused by a cyber attack. An Energy Department laboratory determined that a cyber attack from the Internet could weave its way into the digital control system of a generator and cause the device to self-destruct. Officials have privately confirmed media accounts that logic bombs have already been placed in America’s power-grid control systems, presumably by foreign cyber warriors.

And this problem goes deeper still. The “critical infrastructure” of the transportation, finance, energy and communications sectors are owned and operated by nongovernmental entities, corporations that have proven highly resistant to regulation. The Federal Energy Regulatory Commission (FERC) issued new cybersecurity guidelines to U.S. power companies in January 2008, requiring greater separation of the operations systems from the public Internet. But it took two years for these rules to go into effect (they start in January 2010), and many critics do not believe that the FERC has the ability to audit compliance. The leaders of those corporations, when asked about cybersecurity, almost uniformly believe that they should fund as much corporate cybersecurity as is necessary to maintain profitability and no more. They will defend themselves against cyber crime. Defending them against a cyber war, they all concur, is the job of the government.

Unfortunately, the government has no cyber-defense strategy. While the cyber warriors of Fort Meade may take comfort in America’s reputation as having the most potent arsenal of cyber weapons, they may be members of the national cyber-war team with the lowest overall capability. Indeed, America’s ability to defend its vital systems from cyber attack ranks among the world’s worst. Some countries, like China, have implemented plans allowing them to shut the limited number of portals that connect their cyberspace to the outside world. Other nations, like North Korea, have such limited cyberspace and cyber dependence that there is almost nothing to defend. America’s connectivity to the rest of the world is unlimited and controlled by no plan or agency. If, as a result of a cyber-war attack, our power grids failed, trains stopped and the financial sector froze, the government’s response today would make former–FEMA Director Michael Brown’s performance after Katrina truly look like one “hell of a job.”

While we do have Cyber Command, it has a defensive mission largely limited to protecting the Defense Department. Cyber Command says someone else needs to defend civilian entities, specifically, the Department of Homeland Security (DHS). Unfortunately, DHS has neither a plan nor the capability to defend private-sector infrastructure from a cyber attack. Thus, electric power, gas pipelines, rail and air transport, banking, food-distribution networks and other key systems are defenseless against nation-state cyber attacks.

This asymmetry, in which we are developing offensive capability but doing little to prevent a devastating cyber attack, began in the Bush administration. In the last year of his eight-year presidency, George W. Bush signed a national-security decision called PDD-54. That directive, still classified, ordered steps be taken to improve the security of the Department of Defense and other federal-government computer networks. Critics say it did almost nothing to address the weaknesses of the national infrastructure. President Obama launched a sixty-day review of cyber policy in March, but it resulted in no new major initiatives. He did announce the creation of a cybersecurity position within the staff of the National Security Council (NSC). But it has yet to be filled permanently. The new staffer will report not only to bosses in the NSC staff, but also to Director of the National Economic Council Lawrence Summers—who has vehemently criticized government cybersecurity efforts in the past as imposing costly burdens on U.S. companies, whose leaders supposedly know best what level and type of cybersecurity they need.

When pressed about America’s lack of cyber defenses, several officials privately suggested that there was no nation today that would want to hurt us like that. If that philosophy were applied more broadly to the defense budget, the nation could save hundreds of billions annually—and be left entirely defenseless.

THE FACT that legislators and policy makers do not understand the strategy issues surrounding cyber war may stem from the lack of public discussion, absence of academic contribution, minimal media coverage and insistence on unnecessary government secrecy. A multidepartment effort this year to develop a cyber-war-deterrence strategy produced a paper that is still labeled “secret.” The last time someone thought a secret could deter an opponent was when 1960s movie character Dr. Strangelove yelled at the Soviet ambassador that a deterrent weapon only works “if you tell us you have it.” America was not sufficiently deterred in that movie scenario (an air-force general launched an attack which resulted in escalation into global destruction).

In the absence of a public cyber-war strategy, we do not know today whether an air-force general could launch an effective cyber war. We have not had the basic discussion of whether the United States is better-off with the advent of cyber-war capabilities, or whether it is we who will be deterred in the future by the threat of cyber attack on our vulnerable infrastructure.

Although President Obama may not yet know it, his freedom to maneuver in the world is likely already restricted by those vulnerabilities. Perhaps in a crisis, someone will tell him. Or maybe he will learn it by looking out the window at a darkened city after he has ordered a bombing raid on Iran, or sent a carrier battle group to protect Taiwan, or done something to irritate the Dear Leader of Pyongyang.

Maybe then he will ask policy questions such as: How does deterrence work in cyber war when our capabilities are secret and our weapons undemonstrated? Should we, because of our own vulnerabilities to cyber attack, initiate cyber-arms-limitation talks, instead of our current policy of opposing them? Can arms control work in cyberspace when verification is so difficult? Strategic defense was not possible in nuclear strategy, despite Ronald Reagan’s best efforts, but does that also apply to cyber war? Can public discussion, international norms and established lines of communication result in some sort of risk-reduction process to address the issues of crisis instability that seem to be inherent in cyber war? Are the generals and admirals at Cyber Command more thoughtful than SAC’s leaders were at the advent of the era of strategic nuclear war? We would like to think so, but in the absence of public-policy development, the American people cannot know the answer to that or to the many other questions that the possibility of cyber war raises. It is time for that public discussion.

Richard Clarke was special adviser to the president for cybersecurity in the George W. Bush administration. He is now chairman of Good Harbor Consulting. His book Cyber War, coauthored with Robert Knake, will be published by HarperCollins in the spring.