India to set up special agency to battle cyber terrorists

Today, the Internet provides nearly universal interconnectivity of computer networks. It has the capacity to carry data across the countries, continents and oceans of the world. The Internet has expanded rapidly at a global scale and has been the most powerful technological revolution known in the history of mankind. In December 2017, there were 4,050 million users of Internet, which is about 51.8% of the world population. There has also been a phenomenal growth in military reliance on computer systems. This has introduced a “fifth” domain in which wars may be fought, besides the conventional domains of land, sea, air and space. 

Given the increasing reliance on information systems in general and access to the Internet in particular, critical military and civil infrastructure is growing more and more vulnerable to cyber attacks. In India, there were more than 27,000 cyber security risk incidents within the first half of 2017. 

Cyber attacks are actions taken through the use of computer networks to disrupt, deny, degrade or destroy information resident in computers and computer networks, or the computers and the networks themselves. Terrorist groups, whether state-sponsored or independent, domestic or international, as well as organized crime syndicates and individuals, are equipped with cyber technologies with which they can launch cyber attacks. During the Cold War, the Central Intelligence Agency (CIA) allegedly gained unauthorised access to a Soviet computer to install a malicious code, called a logic bomb, which the CIA subsequently used to destroy a Soviet natural gas pipeline. Cyber attacks and cyber warfare undoubtedly present new and difficult legal problems. 

The most important source of the body of law, i.e., jus ad bellum, which governs the “use of force” by States in their international relations, is the UN Charter. Article 2(4) of the Charter provides that all Members shall refrain in their international relations from the threat or use of force against the territorial integrity or political independence of any state, or in any other manner inconsistent with the purposes of the United Nations. 

The “use of force” constitutes an internationally wrongful act entailing the international responsibility of the State, and also allows the victim State to take counter-measures against the perpetrator. The Charter allows for two exceptions to this prohibition; the right to self-defence in case of an armed attack as well as the use of force authorized by the UN Security Council. A state-sponsored cyber operation would qualify as a use of force against another State and may also trigger an international armed conflict.  A cyber operation amounting to an armed attack would permit the attacked state to exercise its inherent right to self-defence. However, a cyber operation that merely causes inconvenience or irritation would not qualify as use of force.

A State that is the target of a cyber operation may exercise its inherent right of self-defence. It would be immaterial whether the cyber attack is against a military target or critical civilian objects. Any system related to a State’s economic prosperity, public safety and national defence would constitute a critical infrastructure. The action of a State in self-defence against a cyber attack must meet the requirements of necessity, proportionality and immediacy. A State could also resort to anticipatory self-defence against an imminent attack through conventional means.

The 2013 Tallinn Manual on the International Law Applicable to Cyber Warfare has been prepared by experts working with the Cooperative Cyber Defence Center of Excellence (CCDCOE), an institute based in Tallinn, Estonia.

The Manual is particularly concerned with jus in bello (the law of war) and jus ad bellum (the set of rules to be consulted before engaging in war) and does not deal with cyber crime in general or cyber terrorism. The Manual containing 95 rules is intended as a reference for legal advisers for government agencies. The Manual has been criticised for being an exercise of academic debate, restating what has been the practice, but failing to address the central issues raised by the emerging technical landscape. 

Governments as well as industries have established both formal and informal mechanisms for countering rapidly increasing cyber threats and operations. More than 100 militaries in the world have dedicated cyber-attackers and defenders and have built some kind of cyber military unit. These include the establishment of the US Cyber Command, China’s People’s Liberation Army General Staff Department’s 3rd Department, Iranian Sun-Army and Cyber Army, Israel’s Unit 8,200, and the Russian Federal Security Service’s 16th Directorate. In India, the government is planning to create a new tri-service agency—the Defence Cyber Agency (DSA)— for cyber warfare. The DSA will have both offensive and defensive capacity and is seen as a precursor of a cyber command for the armed forces. 

It is nearly impossible to limit or ban cyber weapons. The 2017 Joint Doctrine of the Indian Armed Forces states that the current fifth generation of war has laid foundation for the cyber warfare. India must develop a cyber warfare doctrine (CWD) to regulate the use of cyber weapons in future war. The CWD should be based on our current legal doctrine and precedents. 

The author is a retired Wing Commander. Views expressed are personal