The Great Snooping Game

Was it a Great Master coup by President Xi?
A few weeks ago, US President Barack Obama and President Xi Jinping of China decided to meet for a week-end at a luxurious desert estate known as Sunnylands in southern California.
The atmosphere of the first official encounter between the new Chinese President and his American counterpart was to be as ‘relaxed’ as possible: no stiff protocol, no long speeches, no ties, not even a formal agenda.
More than the North Korea or South and East China Seas dispute, Obama had in mind the Chinese hackers visiting the Pentagon’s and other US government Internet servers and taking away American military secrets. This was a major irritant for the United States and Obama was keen to corner Xi on the subject.
As he entered Sunnylands, Xi knew that the stakes were vastly different from the previous day.
Welcoming his counterpart, Obama reiterated the importance of the relationship which was “reflected with this somewhat unusual setting that we are hosting the President [Xi] in”. Obama spoke of sharing the “visions for our respective countries” and how a new model of cooperation between countries based on mutual interest and mutual respect could be forged (it sounds panchsheelian).
In his opening remarks Xi denied any wrong doing from China. But when he said that the cybersecurity issue needed to be resolved in a ‘pragmatic way’, as China was also a victim of cyber attacks; he was probably smiling to himself.
The Guardian had just reported that the US National Security Agency (NSA) had obtained direct access to the systems of Google, Facebook, Apple and other US internet giants. The British newspaper quoted from a top secret document demonstrating that the NSA had been using a previously undisclosed programme called PRISM, allowing US officials to collect personal information including search history, content of emails, file transfers and live chats.
Suddenly, it was the pot calling the kettle black.
The Guardian had verified the authenticity of a 41-slide top secret PowerPoint presentation, which was not to be shown to foreign allies.
According to the new revelations, PRISM is able to directly collect information from the servers of most major US service providers.
Earlier in the week, The Guardian had already leaked of a top-secret court order compelling telecoms provider Verizon to turn over the telephone records of millions of US customers.
The US companies’ denial is similar to Beijing rebuffing the fact that there are active hackers in China.
President Barack Obama had suddenly to staunchly defend his government’s surveillance over his countrymen's phone and internet activities. He called it a ‘modest encroachment on privacy’, necessary to defend the United States from outside attack. And he differentiated surveillance and espionage!
We shall never know if Xi told Obama: “please look in your backyard before pointing a finger at us”; but the fact remains that the Chinese President had won the battle. Obama could not lecture him anymore on the human rights and liberties, so dear to the American people.
Another serious question emerges from the revelations about PRISM: could the famous Chinese hackers be for something in the ‘timely’ disclosure?
Guess where Edward Snowden, already termed the ‘most consequential American whistleblower’ emerged day the after the Sunnylands Summit? In Hong Kong, the Special Administrative Region of China!
The 29-year-old working for a defence contractor under the CIA told The Guardian: “I have no intention of hiding who I am because I know I have done nothing wrong."
Strangely, he was staying at an unnamed ‘plush hotel’ in the former British colony. Why did he choose Hong Kong? Because the city has: “a spirit of commitment to free speech and the right of political dissent,” he said.
Could Hong Kong be a good place for Snowden to get ‘protection’ from Beijing if needed be? The future will tell us.
In the meantime, the United States will continue to snoop on the rest or the world (as well as on its own citizens), while the Middle Kingdom will maintain its surveillance of each of its nationals and peep into the US servers whenever required for its ‘defence’.
President Xi Jinping can be happy, Barack Obama repeated his favorite formula for foreign politics (in internal politics, Xi speaks of a ‘Chinese Dream’): a "new model for major country relationships"
Xi said that both sides need a new path, "different from the inevitable confrontation and conflict between major powers in the past”.
Well, where is India in this scheme?
Did Dr. Manmohan Singh take up the issue of cybersecurity when Premier Li Keqiang visited Delhi? Will the ‘honest’ Defence Minister broach the topic during his forthcoming trip to Beijing?
Of course, not! China is a friend and a strategic partner; Beijing may bother us in Ladakh, but it would never do this in the cyberspace!
In any case, the National Technical Research Organisation (NTRO) is watching! Unfortunately, there is another side to it, the Indian agencies are also watching Indian citizens.
The International NGO Human Rights Watch said that the new Central Monitoring System (CMS) recently introduced by Delhi ‘was chilling, given its reckless and irresponsible use of the sedition and Internet laws” in India.
It seems that the system has the capacity to provide government agencies like the National Investigation Agency or the IB, centralised access to the country’s telecom network and monitor phone calls, text messages, and Internet messages bypassing service providers.
Earlier, when my website site was hacked, I could without hesitation point a finger at the Dark Visitors from China, now I will have a choice on who to blame.
India, however, remains far behind the US and China in the Great Snooping Game and as far as external threats are concerned, India needs to work harder, much harder.

China disarming India without fighting

My article China disarming India without fighting
appeared in NitiCentral.com.

More than 2,000 years back, Sun Tzu, the author of the Art of War wrote, “For to win one hundred victories in one hundred battles is not the acme of skill; to subdue the enemy without fighting is the acme of skill.”
If I was a Chinese general and keen to defeat India without combating, do you know what I would do?
I would provide ‘proofs’ that foreign arms dealers have corrupted some Indian officials or politicians by paying hefty ‘commissions’. I would repeat this for each and every armament deal.
The result would be terrific. The Indian Ministry of Defence would immediately cancel all the deals, no more arms for the three Indian services! It would be rather easy to realise. One just has to ‘inform’ the Indian Government that something has gone wrong in the procurement process, and ‘someone’ has taken money.
So easy to do and easy to believe! The reverse would be unbelievable.
A few days ago, a US company, Mandiant, identified the People’s Liberation Army’s Shanghai-based unit 61398 as the organisation behind most computer attacks against the United States. Through Unit 61398, I would leak some ‘details’ about the bribes to the MoD or better, to a gullible ‘breaking news’ channel.
Mandiant’s detailed 60-page study tracked individuals of a sophisticated hacking group, known in the United States as ‘Comment Crew’. The report said, “The activity we have directly observed likely represents only a small fraction of the cyber espionage that APT1 has conducted.” APT1 stands for ‘Advanced Persistent Threat’, the most dominant being termed APT1.
The report continues, “We have analysed the group’s intrusions against nearly 150 victims over seven years. We uncovered (in Shanghai) a substantial amount of APT1’s attack infrastructure, command and control, and modus operandi (tools, tactics, and procedures) Our research found that People’s Liberation Army (PLA’s) Unit 61398 is similar to APT1 in its mission, capabilities, and resources.”
Further, it was discovered that PLA Unit 61398 is located exactly in the place from which APT1 activity originates.
As a Chinese general, I would have the perfect tool to win the war. Let us take an example, the latest scam or Choppergate.
In 2010, the Government signed a Rs 4,000 crore contract for procurement of 12 AW101 helicopters from the Anglo-Italian firm AgustaWestland for the use of Indian VVIPs. Three of the 12 helicopters ordered have already been delivered (and an advance of 40 per cent has been paid).
Citing an ‘integrity clause’, Defence Minister AK Antony immediately announced that the contract will be cancelled and a show-cause notice was sent to the company to this effect.
Defence expert, Ajai Shukla commented in Business Standard, “Defence Minister AK Antony’s ‘strong action’ against Italian defence giant Finmeccanica, and its Anglo-Italian helicopter subsidiary, AgustaWestland, is aimed at making him sound like a man of steel.”
Now, Antony has no proof of any offence as yet, as the Italian prosecutors in Milan have refused to share incriminating documents with India. This is logical as the trial has not yet started, but it does not matter as, in India, loud voices have started asking for a ban. One commentator even suggested cancelling the deal for 126 Rafales because the fighter planes of Dassault Aviation were armed with missiles manufactured by the European company MBDA, of which Finmeccanica is a minority shareholder.
The rule, say the babus, is when a defence firm, Indian or foreign, comes under a corruption cloud, not only are all its contracts, present and the future, cancelled, but the entire group of companies are blacklisted and they can’t work in India for a minimum of 10 years.
According to this thinking, Dassault would be banned because Rafale may use weapons made by MBDA; the French firm being owned by BAE (37.5 per cent) and EADS (37.5 per cent). The Rafale’s rival Eurofighter would also be banned as Finmeccanica is part of the Eurofighter GMBH consortium, etc, etc, etc.
At the end, I, the Chinese general will effortlessly win the war, because India will not get a single piece of armament required for its defence and this, for the next one or two decades. I would merely have to leak some credible information into a few Indian computers.
Some will say, “It is a good thing; we shall now indigenise the defence production.” Faster said than done, the Tejas Light Combat Aircraft has been on the HAL drawing table for the past decades. Air Chief NAK Browne recently declared, “By my estimate the Initial Operational Clearance should be by the end of 2013 and the Final Operational Clearance (FOC) should take another year-and-half more.” Ditto for many DRDO projects.
So, as a Chinese general, I would used Unit 61398 or any other ‘research labs’ to pass on to South Block the information that there is something ‘fishy’ in each and every armament deal and the trick will be done.
The next day, the MoD will ‘cancel’ the deal using the ‘termination clause’.
I would subdue my enemy without a fight! That’s skill! India’s tragedy is that it prefers to punish the bribe-givers and leave free the bribe-takers and then ban the former in order to look honest. Unless the rotten apples are booked, the Chinese generals will keep laughing.
Separate issue: I am wondering what the Ministry of Defence is doing against Unit 61398 or its sister/brother concerns? Whether one likes it or not, cyberwar will be tomorrow’s war; the Chinese are far in advance on us in this field.

Grid and Greed

As mentioned in this article from the National Geographic Correspondent on Water issues, India "suffers from inertia on one hand and from destructive greed on the other. It doesn’t suffer from a shortage of dams"
But there are other related issues which complicate the situation.
Of course, great is the temptation to built new dams, under the pretext to 'produce more', in reality to mint more money like in the Arunachal Pradesh case.
An article in Nature China warns us: "Climate change: Melting ice before your eyes".
Glaciologist Tandong Yao at the Chinese Academy of Sciences in Beijing and his colleagues say: "Glaciers in the Himalayas have shrunk over the past 30 years", adding: 

The Tibetan Plateau holds one of the largest numbers of glaciers in the world. These glaciers are at the headwaters of many prominent Asian rivers and play important roles in local ecosystems. Recently, however, controversy has raged as to whether glaciers in the Tibetan Plateau are experiencing shrinkage due to global climate change.

Tandong Yao studied differences in status of 7,090 glaciers between the 1970s and 2000s using topographic maps, satellite images and on-site observations. They found that the Himalayas (excluding the Karakorum) experienced the most intensive shrinkage, and that the extent of shrinkage decreases from the Himalayas to the continental interior. 
Interestingly they warned: "if glacier shrinkage continues in the Himalayas, downstream regions could experience unsustainable alterations to water supplies and growing incidences of geohazards."
Even more worrying is the desertification of the Tibetan plateau.
According to Xinhua, as a result of global warming the Qinghai-Tibet Railway is being threatened by desertification on the Qinghai-Tibet Plateau .

Photo: Nature China

Wang Jinchang, a senior engineer with the Qinghai-Tibet Railway Company told the Chinese news agency that about 443 kilometers of the 1,956-km railway are in areas affected by desertification, including 103 km that lie in seriously desertified areas.
Wang affirmed that the threat of soil erosion has grown very fast in recent years, mostly near rivers and wetlands from Golmud and Lhasa, and the amount of affected rail tracks almost doubled from 2003 to 2009.
Another expert in soil erosion control, An Fengjie, from China's State Forestry Administrations stated that the plateau region suffered from desertification long before the railway was built: "The railway did not cause the problem, but it gives us an opportunity to witness the severity and scale of soil erosion on the Qinghai-Tibet Plateau." 
The Chinese will not admit that the railway line made the situation worse. It appears that sands buried rail racks and disrupted train services over 1,362 times from 1984 to 2002 on the Xining-Golmud section of the railway.
Xinhua says that one of the most prevalent theories blames global warming for the ecological deterioration in the plateau region.
According to Sun Zhizhong, from the Chinese Academy of Sciences, the temperatures on the Qinghai-Tibet plateau rose over two degrees Celsius on average over the past three years, leaving large chunks of frozen earth to defrost.
One of the consequences is that the Kokonor (or Qinghai Lake), China's largest saltwater lake keeps expanding.
For a long time, this phenomenon remained unexplained.
Xinhua reported yesterday: "The surface area of China's largest inland saltwater lake has been expanding for eight years, according to the latest remote sensing survey."
Zhou Bingrong, deputy chief of the provincial institute of meteorological sciences found out that:

The Qinghai Lake in northwest China's Qinghai province measured 4,354.28 square km, according to satellite data collected on July 19 and published on Sunday, s. The figure was 14.58 square km larger than the same time last year, and the largest in 12 years.

Zhou's institute has been carrying out dynamic surveillance of the lake's surface area since 2001, when the lake was shrinking due to climate change and human activity. 
Zhou takes the credit for the increase of the lake: "We have noticed an apparent increase of water since 2005, thanks to more rainfall and sustained environmental protection efforts," but the increase in the waters filling up the lake is more likely to be due to climate change and melting of permafrost".
The Qinghai Lake had been shrinking since the 1950s, but now is increasing.

India is bound to have new black-outs, if new measures as the ones suggested by Himanshu Thakkar in the article below are not urgently taken.
But is there the will to bring out meaningful changes.
The problem is that these measures may not fill the politicians pockets, while building new dams will do. 
It may be difficult for the grid to prevail over the greed.
There is another angle to the blackout: computer hackers.
In August 2003, a blackout occurred in North America, leaving 50 million people in the dark for four days.
Bloomberg wrote: "[it] provides a glimpse of the havoc a cyber attack could inflict on the nation’s power grid." 
Adding: "Internet-based terrorists would be capable of causing blackouts “on the order of nine to 18 months” by disabling critical systems such as transformers, said Joe Weiss, managing director of Applied Control Solutions LLC, a Cupertino, California-based security consulting company."
Apparently the 2003 event was triggered when a power line touched tree branches in Ohio; it ultimately caused losses of as much as $10 billion, according to a study by the U.S. and Canadian governments.
According to Bloomberg that: "Energy companies including utilities would have to increase their investment in computer security more than seven-fold to reach an ideal level of protection."
A Bloomberg survey of network managers at 21 energy companies found that companies spend an average of $45.8 million a year on computer security and are able to prevent 69 percent of known cyber strikes against their systems.
It is quite ominous!
Though in the case of India, external hackers are not required. Undisciplined Electricity Boards will continue to do the job.


India’s Massive Blackout, and the Environmental Danger to Come
Dan Morrison
National Geographic News Correspondent in Water Currents 
July 31, 2012
An estimated 600 million Indians – more people than live in western Europe — were without electricity today, victims of a massive blackout that darkened most of the northern and eastern portions of the country.
The Great Indian Outage, stretching from New Delhi to Kolkata, comes just a day after 300 million people in northern India lost power for much of Monday.
It is a disaster that’s caused untold damage to India’s economy, its prestige, and its well-being – think of the millions of patients in hospitals, the commuters stuck on trains, and farmers in need of irrigation. Hundreds of miners in the states of West Bengal and Jharkand were trapped underground by the blackout. Some 300 trains were reportedly stalled across the country.
There’s more damage to come, I fear: Forces that have been bridling against environmental regulations and science-based activism will use the Great Outage as a cudgel to demolish future restraints on dam construction, coal mining, and other projects.
India’s humiliating power failure is sure to birth a slogan as reductive and wrong as America’s own “Drill Baby Drill.”
The irony is that this outage was likely caused in part by mismanagement at the Bhakra series of hydroelectric dams in Punjab and Himachal Pradesh states in northern India, according to Himanshu Thakkar of the South Asia Network on Dams, Rivers and People.
“Had these dams been operated more rationally, keeping in mind the emerging realities and forecasts, the situation in Northwest India would have been different,” Thakkar told me. “Higher [water] levels in these dams would have meant more power generation for each unit of water release and at the same time more water for agriculture, thus less water [for irrigation] pumped from aquifers, and thus less demand of power.”
Earlier this month, Thakkar’s organization published a short paper criticizing dam administrators for allowing water levels to become alarmingly low.
Thakkar says the answer to India’s current power crisis isn’t more hydroelectric dams, as most currently existing dams aren’t built or operated for maximum efficiency. Instead, power can be saved by harvesting rainwater.
“Since most of our water is coming from groundwater, we need to store the rainfall in aquifers that are fast depleting,” he says. “This would have multiple spin-off benefits.” With healthier aquifers, farmers wouldn’t have to run electric-powered pumps as much to adequately irrigate their crops – a major drag on the power grid.
“More dams won’t help achieve that,” Thakkar says, adding that farmers should shift to less water-intensive crops. “It is amazing that, among all the crops, [acreage devoted to] sugarcane has gone up in this drought year!”
At the Center for Science and the Environment, Chandra Bushan provides some of the hard numbers behind today’s blackout, as well as a simple cause: Indian states are taking more power from the grid than they are supposed to, even as the power system lacks the flexibility to meet seasonal spikes in demand.
In this case, a weak and tardy annual monsoon has millions of households and businesses running their air conditioners for longer than they would under normal conditions. This from the CSE:
Electricity generation for the month of June illustrates this problem:
In June 2012, India produced 8 per cent more electricity than in June 2011.
The generation from thermal power plants was 11.4 per cent higher than in June 2011. Coal-based power plants generated 16.7 per cent more electricity.
However, with low monsoon, the generation of electricity from hydropower plants reduced by 6 per cent compared to June 2011. In fact, hydropower plants produced 19 per cent lesser electricity in April-June, 2012 than the corresponding months in 2011. As hydro plants are also peak load plants, this reduction seems to have affected the peak power generation in the country significantly.
None of this logic – nor the many recent plans and ideas for improving the management and efficiency of India’s power grid – will make a difference to the contractors and bureaucrats in the “Build Baby Build” crowd that has much to gain from poorly-planned dam construction.
The debate over dams has become so silly that earlier this month a minister from the government of Uttarakhand state went on a one-day hunger strike to support more construction on the Himalayan tributaries of the Ganges River. Mantri Prasad Naithani’s constituency is in the region of Tehri Gahrwal, which was submerged a decade ago by the giant Tehri dam. Residents of the doomed town of Tehri were relocated to a “model town” higher up the valley to make room for the $1 billion, 1,000 megawatt hydroelectric dam’s reservoir.
When I visited New Tehri last year, power outages were commonplace.
But it’s brute force, not the rhetorical kind, that truly keeps this movement alive.
On June 22, the Indian environmentalist Bharat Jhunjhunwala was attacked in his home in Uttarakhand state by a gang of 40 thugs purportedly working for a contracting company. At the time of the attack, Jhunjhunwala, 62, had been hosting G.D. Agrawal, an eminent scientist turned swami who is also known as Gyan Swarup Anand. Agrawal was in the region to protest the coming submergence of the Dhari Devi Temple on the Alaknanda river by a hydroelectric project.
In full view of local police and journalists, the crowd kicked in Jhunjhunwalla’s door and blackened his face with ink. He and his wife were forced to flee the area.
“They threatened him that they will burn him alive in the house if he did not stop opposing the dams within two days,” according to an account by Jhunjhunwala’s family.
India’s power grid suffers from inertia on one hand and from destructive greed on the other. It doesn’t suffer from a shortage of dams.

About state-sponsored attackers

I must say that it is quite unpleasant when you open your GMail box in the morning (or in the evening) to get this banner: "Warning: We believe state-sponsored attackers may be attempting to compromise your account or computer".
Once you have found what it is about, you are even more frustrated because you can't do anything about it, except 'strengthen' the security of your account.
But even then, the banner continues to appear. 
Does the 'state-sponsored' agency continues to pip into your emails (and computer)?
Google won't tell you.
And why in India?  
On the subject of 'state-sponsored' actors on June 4, 2012, Republican Senator John McCain testified in front of the Committee on Armed Services of the United State Senate. He said:

I believe that cyber warfare will be the key battlefield of the 21st century, and I am concerned about our ability to fight and win in this new domain. I authored a provision in the bill that requires the commander of U.S. Cyber Command to provide a strategy for the development and deployment of offensive cyber capabilities. I am very concerned that our strategy is too reliant on defensive measures in cyber space, and believe we need to develop the capability to go on the offense as well.
This provision to craft a comprehensive strategy should spur U.S. Cyber Command to develop this offensive capability effectively and at a reasonable cost to the taxpayer.

The question remains why should individual being 'warned' if they don't have the possibility to do anything about it. It is just bad publicity for Google.

Google to Warn Users About Possible 'State-Sponsored' Attacks
Chloe Albanesius
PCMag.com
June 5, 2012
Google has been rather warning-happy lately; from alerts about malware to blocked websites in China. Today, however, the search giant expanded those efforts with security warnings about state-sponsored attacks.
Google said the warnings will appear for a "subset" of users who Google believes "may be the target of state-sponsored attacks." When activated, a pink bar will appear atop various Google services (see below) with a warning that reads: "We believe state-sponsored attackers may be attempting to compromise your account of computer. Protect yourself now." The "protect yourself" text will link to a page with steps you can take to guard against unwanted intrusions.
That includes creating strong passwords, enabling Google's two-step verification, and updating your browser, OS, plugins, and document editors, Eric Grosse, vice president of security engineering at Google, wrote in a blog post.
Grosse warned users about phishing attacks that spoof Google services; be sure that the URL reads "https://accounts.google.com/" before entering your Google password.
"If you see this warning it does not necessarily mean that your account has been hijacked," Grosse said. Nor does it mean that Google's own system has been compromised.
"It just means that we believe you may be a target, of phishing or malware for example, and that you should take immediate steps to secure your account," he said.
How does Google detect these possible attacks? "We can't go into the details without giving away information that would be helpful to these bad actors, but our detailed analysis—as well as victim reports—strongly suggest the involvement of states or groups that are state-sponsored," Grosse wrote.
The news comes several days after Google announced plans to display warnings to Search users in mainland China when their query was likely to result in an error beyond the search giant's control.
Google has had a rather tumultuous relationship with Chinese officials in recent years. In January 2010, Google said there were attempts to hack into the Gmail accounts of Chinese human rights activists. At the time, Google pledged to no longer censor search results in China, even if that meant pulling out of the country entirely, and re-routed all Google.cn traffic to the uncensored Google.com.hk. Unsurprisingly, a Chinese minister warned of "consequences" if Google continued redirecting its results. Finally, the two parties settled on a hybrid solution.
Last month, Google also pledged to warn users whose computers or home routers appear to be infected with the DNSChanger malware. Google first started adding malware warnings to search results last summer after it noticed some unusual activity on its network while conducting routine data center maintenance. Google said last month that that effort resulted in warnings for 1 million of its users.

Fighting it out in cyberspace

This article has been published in The Pioneer (yesterday's edition).

In today’s cyber age, missiles, bombs and guns will become increasingly irrelevant as nations hack into each other’s computer servers to rob data.

Sometimes one can see a smile appearing behind the most serious issues. The ease with which hackers can intrude into the privacy of your e-mail accounts or hack your personal computers is one of these serious issues which make individuals and Governments extremely uncomfortable. But not always. At times, it can also bring a smile, as it happened recently when MI6, Britain’s external spy agency, and the Government Communications Headquart-ers managed to penetrate one of Al Qaeda’s websites whose objective was to recruit ‘lone wolf’ agents.
According to a report in The Daily Telegraph, “When Al Qaeda followers tried to download the 67-page colour magazine, instead of instructions about how to ‘Make a bomb in the kitchen of your mom’ by ‘The AQ Chef’ they were greeted with … cupcake recipes.” The British intelligence hackers had removed the original page containing instructions for making a lethal pipe bomb using sugar, match heads and a miniature light bulb attached to a timer and substituted it with a recipe for making cupcakes.
In April 2010, an incident which lasted 18 minutes sent shivers through the Pentagon and the White House. A report of the US-China Economic and Security Review Commission later admitted that the Internet traffic of the US Administration and military was briefly redirected through servers in China. The 18-minute hijack affected about 15 per cent of the world’s online traffic, particularly that of Nasa, the US Senate, the military and the office of the Secretary of Defence.
More recently, Google has again accused China of stealing personal passwords and breaking into sensitive e-mail boxes. The spokesperson for Google said, “We recently uncovered a campaign to collect user passwords, likely through phishing. This campaign, which appears to originate from Jinan, China, affected what seem to be the personal Gmail accounts of hundreds of users including, among others, senior US Government officials, Chinese political activists, officials in several Asian countries (predominantly South Korea), military personnel and journalists.” This was a pointed accusation, as an important signals’ intelligence unit of the PLA is located in Jinan.
Google’s accusation was immediately denied by the Chinese Government. The China Daily spoke of a ‘political farce’: “Google is playing its old tricks at a time when the US Government and the public are making a great whoop on the issue of the Internet. One is led to believe that Google has attempted to play a role in a political farce… Therefore, if Google has really suffered from ‘Chinese hackers’ attacks, it could resort to the judicial cooperation mechanism between China and the US to find solutions.”
A week earlier, the American defence contractor Lockheed Martin admitted that it had also been hacked, though “it managed to stop the ‘tenacious’ attack before any critical data was stolen”. Knowing that Lockheed Martin deals with US defence hardware and software, this news would not have left the Obama Administration indifferent.
What American analysts fear the most is an ‘electronic Pearl Harbour’. The US’s apprehensions are underscored by what Mr James Miller, the Principal Deputy Undersecretary of Defence for Policy, has had to say on this issue: “Over the past decade, we have seen the frequency and sophistication of intrusions into our networks increased. Our networks are scanned thousands of times an hour."
On May 25, China Review News, a publication in Chinese language, reported that the Ministry of National Defence spokesman, Senior Colonel Geng Yansheng, had acknowledged the existence of a professional cyberwarfare unit at Guangzhou Military Region (known as the ‘Online Blue Army’). Col Geng admitted: “China’s network protection is comparatively weak. Enhancing IT capacity and strengthening network security protection are important components of military training for an Army.” He refused to answer whether the objective of the ‘Online Blue Army’ was to attack other countries.
While the Chinese Foreign Ministry has dismissed Google’s allegations, two PLA Senior Colonels, Ye Zheng and Zhao Baoxian, have written an essay for China Youth Daily, arguing that Beijing needs cyberwarfare skills: “Just as nuclear warfare was the strategic war of the industrial era, cyberwarfare has become the strategic war of the information era, and this has become a form of battle that is massively destructive and concerns the life and death of nations.” The PLA is said to have already conducted simulated cyberbattles between a ‘Blue Army’ fighting a ‘Red Team’ using virus and mass spam attacks.
The future is rather depressing. According to The Wall Street Journal the Pentagon is ready to respond to computer sabotage with military force. “The Pentagon has concluded that computer sabotage coming from another country can constitute an act of war, a finding that for the first time opens the door for the US to respond using traditional military force,” the daily said recently. But it is not an easy proposition to decide at what point computer hacking can be construed as an act of war. Apparently the Pentagon has defined some criteria, but are they reliable?
Another issue is how to be sure of the origin of the attack. Further, will missiles solve hacking problems or will they just be a deterrent? Look at the situation in Libya: Despite thousands of missiles being launched, three months into the conflict Colonel Muammar Gaddafi is still going strong. There is clearly no ready-made solutions to cyberwar.
But there is another side to the issue. Kaspersky Security Lab Service recently published a fascinating interview on China’s cybersecurity and the fact that China is itself extremely vulnerable to cyber attacks. A friend commented, “I’m not surprised that China is vulnerable. This is yet another example of why security is asymmetric in nature. It calls for great effort to plug all the holes (defensive action) as opposed to the effort required to find one hole (offensive action).” In the cyberworld, offence is the best defence. This is ‘active defence’.
China’s hackers will probably continue to attack targets abroad. However, the fact remains that China’s servers are possibly not so secure. If Beijing refuses to cooperate, it could also face serious problems with protecting official data.
A Worldwide Cybersecurity Summit was recently held in London with Ministers from the UK, the US, China, India and France gathering to discuss how to combat the threat of cyber-terrorism. Different opinions were shared. France, for example, believes that if nations are able to work together and set up international security standards, national laws are enough to fight this scourge.
For India the situation is different: It sees cyberspace as a borderless world; therefore, a global legal regime is needed to deal with issue. As Mr Kapil Sibal, Minister in charge of IT and communications, says, “The nature of cyberspace is that it is borderless and anonymous and it is not subject to Government territories that have laws,” adding, “There is a fundamental contradiction between Government regulation and the nature of cyberspace.”

Cyber attack: an act of war?

The Wall Street Journal reports: "Pentagon Sets Stage for U.S. to Respond to Computer Sabotage With Military Force".
It is not an easy proposal to decide when computer sabotage is serious enough to constitute an act of war. Apparently the Pentagon has now defined some criteria which will be partially released next month.
Still, how to be sure of the origin of the attack? 
What should be the degree of retaliation, even if the notion of 'equivalence' is introduced.
It is true that most of the attacks have been coming from China or appear to be coming from China, does it mean that the US is ready to go to war with China if, for example its power grid is attacked?
Last month, I posted an article on the weakness of the Chinese cyber defense system. Instead of going to war, the Pentagon should launch a massive cyber attack on China which could be a deterrent against future hacking.
Missiles can not solve any problems. Just look at the situation in Libya, after 3 months of bombarding, Gaddafi is going strong. 
If the State Council's servers were down, the Chinese leadership would perhaps start thinking of the consequences of their actions.  

Cyber Combat: Act of War
Pentagon Sets Stage for U.S. to Respond to Computer Sabotage With Military Force
By SIOBHAN GORMAN And JULIAN E. BARNES
WASHINGTON
Wall Street Journal
The Pentagon has concluded that computer sabotage coming from another country can constitute an act of war, a finding that for the first time opens the door for the U.S. to respond using traditional military force.
The Pentagon's first formal cyber strategy, unclassified portions of which are expected to become public next month, represents an early attempt to grapple with a changing world in which a hacker could pose as significant a threat to U.S. nuclear reactors, subways or pipelines as a hostile country's military.
In part, the Pentagon intends its plan as a warning to potential adversaries of the consequences of attacking the U.S. in this way. "If you shut down our power grid, maybe we will put a missile down one of your smokestacks," said a military official.
Recent attacks on the Pentagon's own systems—as well as the sabotaging of Iran's nuclear program via the Stuxnet computer worm—have given new urgency to U.S. efforts to develop a more formalized approach to cyber attacks. A key moment occurred in 2008, when at least one U.S. military computer system was penetrated. This weekend Lockheed Martin, a major military contractor, acknowledged that it had been the victim of an infiltration, while playing down its impact.
The report will also spark a debate over a range of sensitive issues the Pentagon left unaddressed, including whether the U.S. can ever be certain about an attack's origin, and how to define when computer sabotage is serious enough to constitute an act of war. These questions have already been a topic of dispute within the military.
One idea gaining momentum at the Pentagon is the notion of "equivalence." If a cyber attack produces the death, damage, destruction or high-level disruption that a traditional military attack would cause, then it would be a candidate for a "use of force" consideration, which could merit retaliation.

The War on Cyber Attacks
Attacks of varying severity have rattled nations in recent years.
The Pentagon's document runs about 30 pages in its classified version and 12 pages in the unclassified one. It concludes that the Laws of Armed Conflict—derived from various treaties and customs that, over the years, have come to guide the conduct of war and proportionality of response—apply in cyberspace as in traditional warfare, according to three defense officials who have read the document. The document goes on to describe the Defense Department's dependence on information technology and why it must forge partnerships with other nations and private industry to protect infrastructure.
The strategy will also state the importance of synchronizing U.S. cyber-war doctrine with that of its allies, and will set out principles for new security policies. The North Atlantic Treaty Organization took an initial step last year when it decided that, in the event of a cyber attack on an ally, it would convene a group to "consult together" on the attacks, but they wouldn't be required to help each other respond. The group hasn't yet met to confer on a cyber incident.
Pentagon officials believe the most-sophisticated computer attacks require the resources of a government. For instance, the weapons used in a major technological assault, such as taking down a power grid, would likely have been developed with state support, Pentagon officials say.
The move to formalize the Pentagon's thinking was borne of the military's realization the U.S. has been slow to build up defenses against these kinds of attacks, even as civilian and military infrastructure has grown more dependent on the Internet. The military established a new command last year, headed by the director of the National Security Agency, to consolidate military network security and attack efforts.
The Pentagon itself was rattled by the 2008 attack, a breach significant enough that the Chairman of the Joint Chiefs briefed then-President George W. Bush. At the time, Pentagon officials said they believed the attack originated in Russia, although didn't say whether they believed the attacks were connected to the government. Russia has denied involvement.
The Rules of Armed Conflict that guide traditional wars are derived from a series of international treaties, such as the Geneva Conventions, as well as practices that the U.S. and other nations consider customary international law. But cyber warfare isn't covered by existing treaties. So military officials say they want to seek a consensus among allies about how to proceed.
"Act of war" is a political phrase, not a legal term, said Charles Dunlap, a retired Air Force Major General and professor at Duke University law school. Gen. Dunlap argues cyber attacks that have a violent effect are the legal equivalent of armed attacks, or what the military calls a "use of force."
"A cyber attack is governed by basically the same rules as any other kind of attack if the effects of it are essentially the same," Gen. Dunlap said Monday. The U.S. would need to show that the cyber weapon used had an effect that was the equivalent of a conventional attack.
James Lewis, a computer-security specialist at the Center for Strategic and International Studies who has advised the Obama administration, said Pentagon officials are currently figuring out what kind of cyber attack would constitute a use of force. Many military planners believe the trigger for retaliation should be the amount of damage—actual or attempted—caused by the attack.
For instance, if computer sabotage shut down as much commerce as would a naval blockade, it could be considered an act of war that justifies retaliation, Mr. Lewis said. Gauges would include "death, damage, destruction or a high level of disruption" he said.
Culpability, military planners argue in internal Pentagon debates, depends on the degree to which the attack, or the weapons themselves, can be linked to a foreign government. That's a tricky prospect at the best of times.
The brief 2008 war between Russia and Georgia included a cyber attack that disrupted the websites of Georgian government agencies and financial institutions. The damage wasn't permanent but did disrupt communication early in the war.
A subsequent NATO study said it was too hard to apply the laws of armed conflict to that cyber attack because both the perpetrator and impact were unclear. At the time, Georgia blamed its neighbor, Russia, which denied any involvement.
Much also remains unknown about one of the best-known cyber weapons, the Stuxnet computer virus that sabotaged some of Iran's nuclear centrifuges. While some experts suspect it was an Israeli attack, because of coding characteristics, possibly with American assistance, that hasn't been proven. Iran was the location of only 60% of the infections, according to a study by the computer security firm Symantec. Other locations included Indonesia, India, Pakistan and the U.S.
Officials from Israel and the U.S. have declined to comment on the allegations.
Defense officials refuse to discuss potential cyber adversaries, although military and intelligence officials say they have identified previous attacks originating in Russia and China. A 2009 government-sponsored report from the U.S.-China Economic and Security Review Commission said that China's People's Liberation Army has its own computer warriors, the equivalent of the American National Security Agency.
That's why military planners believe the best way to deter major attacks is to hold countries that build cyber weapons responsible for their use. A parallel, outside experts say, is the George W. Bush administration's policy of holding foreign governments accountable for harboring terrorist organizations, a policy that led to the U.S. military campaign to oust the Taliban from power in Afghanistan.

Chinese Cyber Weakness

The Kaspersky Security Lab Service has just published a fascinating interview about China's cyber security. 
A friend commented: "I'm not surprised that China is vulnerable, this is yet another example of why security is asymmetric in nature. It several orders of magnitude of effort to plug *all* the holes (defense effort) as opposed to the effort required to find *one* hole (attack effort).
So this 'new' finding that might 'surprise US policymakers and Pentagon officials' is rather odd, I don't think it would surprise anyone in the security community assuming the broadest possible definition of security community."
In the previous Chinese White Paper on Defense, the concept of Revolution in Military Affairs (RMA) comes up again and again, so is the idea of ‘active defensive’. 
Practically it means a military strategy in which China does not initiate wars, but engages in war to defend its national sovereignty and territorial integrity: “Strategically, it adheres to the principle of featuring defensive operations, self-defense and striking and getting the better of the enemy only after the enemy has started an attack,” says the WP which also introduces the notion of ‘RMA with Chinese characteristics’.
The WP gives the history of the concept: “Entering the 1990s, the PLA began to vigorously promote RMA with Chinese characteristics. It established the military strategic guideline of active defense for the new era, based on winning local wars in conditions of modern technology, particularly high technology. It began to adopt a strategy of strengthening the military by means of science and technology, and a three-step development strategy in modernizing national defense and the armed forces, and promoted the coordinated development of national defense and economy.”
This gives us an idea of the general direction in which the PLA wants to go in the years to come, but nothing very specific is mentioned.
In the cyber world, the best defense is attack, this is 'active defense'.
The Chinese hackers will probably continue to attack target abroad, however it remains that the Chinese servers are unsecured. 
Beijing will have to tackle this issue in the years to come, if it does not want to face serious drawbacks. 

Glass Dragon: China's Cyber Offense Obscures Woeful Defense
April 27, 2011
Paul Roberts
The official line in Washington D.C. is that there's a new Cold War brewing, with an ascendant China in the place of the old Soviet Union, and cyberspace as the new theater of war. But work done by an independent security researcher suggests that the Chinese government is woefully unprepared to fend off cyber attacks on its own infrastructure.
For the last 18 months, Dillon Beresford, a security researcher with testing firm NSS Labs and divorced father of one, has spent up to seven hours a day of his spare time crawling the networks of China's state and provincial governments, as well as stealthier networks belonging to the PLA and the country's top universities. Armed with free tools like Metasploit and Netcat, as well as Google Translate, he's pulled back the curtains on the state of cyber security in China. What he's discovered may come as a surprise to many U.S. policymakers and Pentagon officials.
Contrary to the image of China as a nearly invincible cyber powerhouse, Beresford says in an interview with Threatpost Editor Paul Roberts, that the fast-growing nation suffers from woeful cyber security practices at home that leave, literally, thousands of networks and databases vulnerable to even trivial, remote attacks. Beresford, who publicized holes in domestic Chinese SCADA systems in September, 2010, said the country's aggressive cyber offense abroad, he said, is in stark contrast to an almost total lack of basic cyber defense at home that has left both classified and unclassified government networks vulnerable to attack and compromise. That should give the Chinese government pause as it ponders the consequences of a global campaign of cyber espionage, and create an opportunity for the U.S. and China to de-escalate what he sees as a growing cyber arms race. Beresford has publicized holes in recent weeks highlighting insecure mail servers and databases he has uncovered. He spoke to Roberts on April 26th, 2011.

Threatpost: Why China? What got you looking at the vulnerability of China's networks?
Dillon Beresford: The best answer to that question is 'curiosity.' I was reading a lot about cyber war  and the capabilities of PRC and PLA. I was hearing a lot about the vulnerability of U.S. critical infrastructure, so I got interested in China and wanted to find out about its infrastructure - map out the flashpoints.

Threatpost: You suggest that China's single party system is actually to blame for some of the poor security practices you discovered. Can you explain?

Dillon Beresford: One of the things I thought about with my research is the issue of transparency. This is an issue in China and, I would guess, other authoritarian regimes. A lot of what is running in China is developed in-house by Chinese firms.  They're not using Western products or open source platforms, because they don't trust them or they're worried that someone might put a back door into them. The down side is that they don't benefit from the whole community of people who are crawling over those platforms and patching bugs and looking for holes.
In China, you see that not a lot of government and private sites are interconnected, as they are in the U.S. That kind of interdependence allows there to be lots of eyes looking at the same network and make it more likely that mistakes will get discovered and reported. But, in China, the government runs everything and there's no clear policy for cyber security.
In Chinese culture, also, its hard to publicly come out and admit mistakes - a fear that people will lose faith in their abilities. So, for example, a journalist who is writing on this got an email from an official in the Office of Foreign Affairs who was worried about losing his job.

Threatpost: It's interesting, because the picture you paint is so different from the one that's presented in the media.
Dillon Beresford: Yes. The media hype in the U.S. is all about cyberwar  and how the Chinese are kicking our ass. I wanted to know how vulnerable are the Chinese, and what I found is that they are just as vulnerable as the U.s. if not more-so. In large part, I think its because of this lack of transparency and openness. I'm hoping that, as a result of my work, they might realize this and maybe tone down their aggressiveness towards U.S. After all, we have the best people and it won't be long before other researchers will do as I have.

Threatpost: Why haven't other security researchers looked at this before you?

Dillon Beresford: I think the language barrier has discouraged people, but with Google's translation tools, that really isn't an issue any more.

Threatpost: How have you managed to navigate these networks and sites?

Dillon Beresford: Rosetta Stone. I've been studying Chinese for a year now, so its getting easier. And I work with people from China, which helps. 

Threatpost: How do you choose your targets?

Dillon Beresford: Its really not hard. In fact, the amount of data I have found that is not intended for public consumption is amazing. I stopped after three terabytes. These systems are not maintained  and are all vulnerable to attacks. HTTP is just one attack vector, but there are many others. For example: there was an LDAP server that was accessible from the Internet and it running a vulnerable version of PHP and, in addition, everything on the server was running as root. I find that a lot - its a bit of laziness by system administrators that makes their job easier. I was able to compromise the the server and then simply enumerate the directory and find other file servers and systems on the network that weren't connected to the Internet. Another example is China's National University of Defense Technology. They had a bunch of Web servers that weren't using SSL or HTTPS, so everyone was logging in using plain HTTP. All you needed to do was compromise one box and you could sniff all the user names and passwords in clear text.

Threatpost: What kinds of vulnerabilities are you finding commonly?

Dillon Beresford: As I mentioned to you before, vulnerable VxWorks installations are very common. I see a lot of Huawei integrated access devices in the private sector there as well, and they all run VxWorks. When Cisco went to vxworks so did Huawei, and they're just out there listening and waiting for a connection, and they haven't been patched or they've got weak passwords that you can brute force. You can just fire up Metasploit and find the vulnerable vxworks installations.  Once you have one vulnerable system, say a switch or router, its very easy to pivot from that to other devices.
I've found lots of appliances - routers, firewalls, IPS. A lot of them have back doors left by the developers. If I find it, I can generally exploit it and get into it. A lot of these devices have Web interfaces that have remote command execution vulnerabilities that allow you to use a function call, say, to log into the device without authenticating. If you have NetCat, you can just fire it up and connect directly to the box. And these publicly exploitable devices are so important, because they're potentially connected to other parts of the network that are even more vulnerable, because it was assumed that they're not public. So, if you find a Web server that's connected to a private LAN (local area network) and the Internet, you can compromise it, then reach out and compromise ever other box on that network.

Threatpost: You've found lots of evidence of weak authentication and passwords, as well?

Dillon Beresford: Yes. I'd estimate that 40% of logins are user name and either all numerical or all lowercase passwords. There are no hash or space characters. They're not complex and there are weak access controls - controls that aren't properly implemented, or there's no password requirement or two factor authentication, which is becoming increasingly common in the West. You don't see any of that in China.

Threatpost: As you talk to officials in China, what sense do you get about the reasons for the widespread problems with insecure IT infrastructure?

Dillon Beresford: I think China is growing very fast and there aren't enough people to maintain the infrastructure. They have more networks and government sites than their own government can even maintain. They don't have the manpower or even the knowledge to maintain them. And, in many ways, China is still playing catch up with the US. They're an aggressor in cyberspace, but their own networks are very weak and poorly designed. I'm not saying that to shed a negative light on China, but there's so much out there that they just can't maintain it all. Beyond that, there's a lack of trust in Western products - even open source products. A fear that people will put back doors in them, which really misunderstands what open source is about, which is: if we have a lot of eyes looking at the code, people will spot problems and fix them.

Threatpost: Have there been any "whoa!" moments where you've come across a hole or exposed data that really surprises you?

Dillon Beresford: That moment was probably the National Institute of Defense Technologies. I mean, when you think about it, they have supercomputers there that they use for cryptography. What's funny is that, if you look, you can't find a Web site for the Ministry of State Security or the Ministry of Cryptography, but most of the projects that the government allocates money for those agencies goes to universities. Its the students who create spy tools, so if you want to find the classified information, you just have to go to the University networks and get it.
Its the same with the People's Liberation Army. Their networks are hidden all throughout China and they're hard to find. But if you can find a vulnerable file server, you can pivot and proxy into a network that may be their equivalent of SIPRNet (the United States' classified information network). Students can make VPN connections into PLA networks. I've seen the client. You have students and cadets who attend university then, when they graduate, go to work for the PLA. In the meantime there's a lot of traffic going between the PLA and the universities.

Threatpost: What do you want to accomplish with this research?

Dillon Beresford: I've been transparent about this research and reported everything to China CERT. I want to create awareness of the problem and raise the bar. I'd like there to be open communications between the U.S. and China. We have to sit down at the same table. If other researchers like myself publish vulnerabilities maybe china will think twice about attacking U.S. companies and acknowledge that they have problems and weaknesses as well.

The Hackers Hacked

45% of Chinese netizens encountered virus in 2010. It is a lot! Chinese 'experts' probably practice the Art of Hacking on their own countrymen.
For Beijing, how to control 450 millions of netizens is today the main problem for the regime, Great Firewall or not.  
The new  White Paper on National Defence states that the goals and tasks of China's national defense are (amongst others)
— Safeguarding national sovereignty, security and interests of national development. China's national defense is tasked to guard against and resist aggression, defend the security of China's lands, inland waters, territorial waters and airspace, safeguard its maritime rights and interests, and maintain its security interests in space, electromagnetic space and cyber space. 
It is, of course, also tasked "to oppose and contain the separatist forces for 'Taiwan independence', crack down on separatist forces for 'East Turkistan independence' and 'Tibet independence', and defend national sovereignty and territorial integrity."
But more importantly:
— Maintaining social harmony and stability. ...Taking the maintenance of overall social stability as a critical task, the armed forces resolutely subdue all subversive and sabotage activities by hostile forces, as well as violent and terrorist activities. The Chinese armed forces carry on the glorious tradition of supporting the government and cherishing the people, strictly abide by state policies, laws and regulations and consolidate the unity between the military and the government and between the military and the people".
It is not an easy task to control 450 millions netizens to 'maintain social harmony and stability".


45.8% of Internet Users in China Encountered Virus or Trojan Malware Attacks in 2010    
China News Service
March 29, 2011
According to the China Internet Network Information Center (CNNIC), in 2010, 45.8% of Chinese Internet users encountered virus or Trojan malware attacks and 21.8% experienced account or password theft. CNNIC also noticed that, by the end of 2010, the number of Internet users in China had reached 457 million, an increase of 73.3 million over 2009.
http://www.chinanews.com/it/2011/03-29/2938890.shtm

Eighteen Long Minutes in China

What about India? We will probably never know, but if they can do it to the Pentagon, the same e-pirates can certainly do it to South Block or the Army Headquarters. 
And 18 minutes is a long, long time.
This is the new form of warfare and the Middle Kingdom is far in advance on its opponents at this game.
To read the US Report, click here.
The Chinese answer is posted on The Global Times.


US Government and Military Websites Redirected to Chinese Servers

ABC News

By JASON RYAN

WASHINGTON, 

Nov. 17, 2010

April Incident Lasted Only 18 Minutes but Could Have Security Impact
U.S. government and military Internet traffic was briefly redirected through computer servers in China earlier this year, according to a report that is to be released by the U.S.-China Economic and Security Review Commission on Wednesday.
The report says telecommunications companies in China disrupted the Internet for only about 18 minutes -- but they were a big 18 minutes. They "hijacked" about 15 percent of the world's online traffic, affecting NASA, the U.S. Senate, the four branches of the military and the office of the Secretary of Defense.
A draft copy of the report, obtained by ABC News, said, "For about 18 minutes on April 8, 2010, China Telecom advertised erroneous network traffic routes that instructed U.S. and other foreign Internet traffic to travel through Chinese servers."
While the Internet "hijacking" incident was initially reported on in April, it had not been previously disclosed that the U.S. government was affected by the incident. "This incident affected traffic to and from U.S. government (''.gov'') and military (''.mil'') sites, including those for the Senate, the army, the navy, the marine corps, the air force, the office of secretary of Defense, the National Aeronautics and Space Administration, the Department of Commerce, the National Oceanic and Atmospheric Administration, and many others. Certain commercial websites were also affected, such as those for Dell, Yahoo!, Microsoft, and IBM."

Indian Cyber Army

In March, I had suggested to present the Award for the Most Misleading Statement of the Year to Sachin Pilot, the young Minister of State for Communication and Information Technology for telling the press: "There have been attempts to hack into the government computer network, but till date there has been no loss of vital information. Yes, there have been attempts but I can categorically say that not one attempt has been successful. ...The government's computer network system, maintained by the National Informatics Centre, is highly efficient".
It is good that the Government acknowledges now that there is a problem and has decided to use the skills of thousands young Indian IT professionals. It sends a strong message to China and Pakistan that India will not lay down, if attacked.
 
India readies cyber army to spy on hostile nations
Times of India
Harsimran Singh & Joji Thomas Philip,
Aug 5, 2010
NEW DELHI: Borrowing a page from China’s art of cyber war, the government is giving shape to an IT infrastructure setup manned by a small army ofIndia's top 10 BPOs software professionals to spy on the classified data of hostile nations by hacking into their computer systems.
IT workers and ethical hackers who sign up for the ambitious project will be protected by law, says the proposal being discussed by senior government administrators. The expertise of these professionals will be used to go on the offensive or preempt strikes by breaching the security walls of enemy systems.
The strategy of taking the fight to hackers was drafted at a high-level security meet on July 29 chaired by National Security Advisor Shiv Shankar Menon. The meeting was attended by the director of Intelligence Bureau as well as senior officials of the telecom department, IT ministry and security agencies, documents seen by ET show. Departments whose officials were present at the meeting did not respond to ET emails.
The government is worried about spying and sabotage from neighbouring countries, particularly China and Pakistan, after a spate of assaults on its computer systems in recent times. The Citizen Lab at the University of Toronto said in April that a clique of hackers based in China had conducted extensive spying operations in India, pilfering confidential documents from the defence ministry.
Though Beijing strongly denied any role in the attacks, the investigation pointed to the Chinese government’s tacit approval of the spying operations. The technical reconnaissance bureau of the People’s Liberation Army that is responsible for signals intelligence collection is headquartered in Chengdu, where the hackers had set up base.
According to the government proposal, the National Technical Research Organisation (NTRO) along with Defence Intelligence Agency (DIA) will be responsible for creating cyber-offensive capabilities. NTRO is a key government agency that gathers technical intelligence while DIA is tasked with collating inputs from the Navy, Army and Air Force.
The NTRO will also suggest measures to ensure legal protection to recruits, a move that is expected to coax software professionals into joining the government group because under the Indian IT Act, hacking is punishable with imprisonment up to three years, or carries a fine up to `2 lakh, or both.
"Even if the offense is done on a computer on foreign soil, it is punishable under Indian laws," says cyber lawyer Pavan Duggal, adding that the IT Act will have to be changed for "patriotic stealth operations".
Mr Duggal welcomed the efforts to establish a hacker group, pointing to the explosive growth in assaults on Indian systems recently. Last year, 600 computers belonging to the external affairs ministry were hacked, allegedly by Chinese groups. The hackers also managed to steal crucial documents from the computers of the defence establishment then.
Vikas Desai, lead technical lead of network security firm RSA, said the government’s efforts can be classified as ethical hacking. "Many countries and organisations in the world already have this kind of infrastructure," he said.
In sheer numbers at least, recruitment may not be a problem. The country is due to produce nearly 5.71 lakh technical graduates and postgraduatesIndia's top 10 BPOs in 2010, says IT lobby group Nasscom. There is also a teeming workforce in India thanks to large anti-virus and software companies such as McAfee, Microsoft, Intel establishing R&D labs here.
The government is not taking chances, however. The NSA’s National Security Council Secretariat has directed the HRD and IT ministries to introduce cyber security in the curriculum of IITs and education institutes.
The government also plans to amplify efforts to strengthen its cyber armour. A National Testing Centre to check all types of hardware and software being sourced by departments for spyware will be established to prevent India’s computers from coming under attack.
The NSA has also asked the Defence Research & Development Organisation (DRDO) and DIA to magnify efforts against electromagnetic-pulse bombs that can interrupt wireless signals inside the country. It has also directed the DIA to harden its Transient ElectroMagnetic Pulse Emanations Standards, known as TEMPEST in military parlance. Hardening TEMPEST to a geek means lowering the chances of interception of data transferred by defence agencies on the internet.
To enable this, the government wants to involve engineers and scientists from the IITs and Indian Institutes of Science to develop highly-encrypted algorithms, in large numbers. The high-level meeting notes that government’s cyber efforts are stumped by its ability to produce no more than 3-4 such algorithms in a year.

Huawei part of Chinese spy network says R&AW

Soon after I had published a post on Huawei, the Chinese Telecom equipment company, I  came across this article in the Economic Times giving the reasons behind the banning of Huawei in India.


Huawei part of Chinese spy network, says R&AW
7 May 2010,
Bharti Jain,
Economic Times Bureau
NEW DELHI: Chinese telecom major Huawei may aggressively deny any link to the China’s People’s Liberation Army, but independent assessments of Indian intelligence agencies so far clearly point out that PLA remains a customer of the company and has become more involved with it.
The security concerns of Indian intelligence agencies about Huawei’s close connection with the Chinese security establishment are shared by the US administration and had led the latter to cancel Huawei’s 2008 bid to pick up stake in 3Com.
Even British intelligence agencies have warned that the Chinese could cripple IT-dependent telecom infrastructure and critical services like water, power and food supplies by embedding malware in equipment installed by firms such as Huawei and ZTE.
According to security assessments of Huawei Technologies put together by R&AW, the Chinese firm not only shares ties with the Chinese security establishment but is also suspected to be a part of its intelligence set-up. Not only was it founded by retired PLA officer Ren Zhengfei, a former director of the Information Engineering Academy of the PLA’s general staff department, in 1988, but one of the members on the company’s board was an officer of the PRC ministry of state security.
Huawei, intelligence inputs collected over a period of time point out, is responsible for sweeping and debugging all Chinese embassies and their expertise extends to bugging of the target telecommunication and computer systems. This explains Huawei’s involvement in projects for military purposes in Iraq during the Saddam Hussein regime and also in telecom projects in Afghanistan during the Taliban rule.
Given the adverse reports of Huawei’s alleged role in bugging systems for the benefit of the Chinese security establishment, the communication ministry has warned BSNL to test all equipment supplied by the Chinese firm for “trapdoors, black box, malwares” and check if it is susceptible to remote hacking before it can be allow to be operational.
Though BSNL was allowed to award telecom network contract to Huawei, it was to restrict the orders to southern states as they do not share borders with sensitive countries such as China, Pakistan, Bangladesh and Myanmar. The communications ministry also warned that networks provided by Huawei could go live only after all requisite audits were completed.
Security concerns over Huawei links with PLA are not restricted to Indian agencies alone. The Chinese telecom major’s proposal to purchase stake in 3Com, the US firm manufacturing internet router and networking equipment, was shot down after the US administration questioned the deal’s security implications. A reluctance of approval followed and the lucrative $2.2-billion deal — wherein Huawei had invited Boston-based private equity firm Bain Capital to jointly acquire 3Com — was cancelled in February 2008. The fact that 3Com makes anti-hacking computer software for the military and that Huawei has ties with PLA raised an alarm with the US authorities, leading them to disallow the deal.
According to R&AW reports, the US administration was concerned that Huawei would be able to alter the electronic equipment and computer software sold to the military in a way that would make these less effective in real-time operations.
Adverse security assessments of Huawei have also led British security agencies to warn of China’s attempts to hit telecom infrastructure as well as water, power and food supplies through equipment installed by Huawei through covert modifications to compromise systems in ways that are difficult to detect and could later be disrupted or disabled.

China's Cyber activities

If there was an Award for the Most Misleading Statement of the Year, Sachin Pilot, the young Minister of State for Communication and Information Technology would certainly be the Laureate.
He said in an interview: "There have been attempts to hack into the government computer network, but till date there has been no loss of vital information.
'Yes, there have been attempts but I can categorically say that not one attempt has been successful,' the minister said. 'The government's computer network system, maintained by the National Informatics Centre, is highly efficient,' Pilot told IANS in an interview." 
Read my interview with Shishir Nagaraja, you will understand.

Cyberwar declared as China hunts for the West’s intelligence secrets
The Times
March 8, 2010
It is estimated that in the past year the number of attacks on US government agencies rose to 1.6 billion per month. Systems in the EU are even more vulnerable
Michael Evans, Giles Whittell
Urgent warnings have been circulated throughout Nato and the European Union for secret intelligence material to be protected from a recent surge in cyberwar attacks originating in China.
The attacks have also hit government and military institutions in the United States, where analysts said that the West had no effective response and that EU systems were especially vulnerable because most cyber security efforts were left to member states.
Nato diplomatic sources told The Times: “Everyone has been made aware that the Chinese have become very active with cyber-attacks and we’re now getting regular warnings from the office for internal security.” The sources said that the number of attacks had increased significantly over the past 12 months, with China among the most active players.
In the US, an official report released on Friday said the number of attacks on Congress and other government agencies had risen exponentially in the past year to an estimated 1.6 billion every month.
The Chinese cyber-penetration of key offices in both Nato and the EU has led to restrictions in the normal flow of intelligence because there are concerns that secret intelligence reports might be vulnerable.
Sources at the Office for Cyber Security at the Cabinet Office in London, set up last year, said there were two forms of attack: those focusing on disrupting computer systems and others involving “fishing trips” for sensitive information. A special team has been set up at GCHQ, the government communications headquarters in Gloucestershire, to counter the growing cyber-threat affecting intelligence material. The team becomes operational this month.
British and American cyber defences are among the most sophisticated in the world, but “the EU is less competent”, James Lewis, of the Centre for Strategic and International Studies, said. “The porousness of the European institutions makes them a good target for penetration. They are of interest to the Chinese on issues from arms sales and nuclear non-proliferation to Tibet and energy.”
The lack of routine intelligencesharing between the US and the EU also contributes to the vulnerability of European systems, another analyst said. “Because of Britain’s intelligence-sharing relationship with America our systems have to be up to their standards in a way that some of the European systems don’t,” he explained.
Jonathan Evans, Director-General of MI5, warned in 2007 that several states were actively involved in large-scale cyber-attacks. Although he did not specify which states were involved, security officials have indicated that China now poses the gravest threat. Beijing has denied making such attacks.
Robert Mueller, FBI Director, has warned that, in addition to the danger of foreign states making cyber-attacks, al-Qaeda could in the future pose a similar threat. In a speech to a security conference last week, Mr Mueller said terrorist groups had used the internet to recruit members and to plan attacks, but added: “Terrorists have \ shown a clear interest in pursuing hacking skills and they will either train their own recruits or hire outsiders with an eye towards combining physical attacks with cyber-attacks.”
He said that a cyber-attack could have the same impact as a “well-placed bomb”. Mr Mueller also accused “nation-state hackers” of seeking out US technology, intelligence, intellectual property and even military weapons and strategies.To help to fight the growing threat, the Office of Cyber Security, set up last year as part of the Government’s national security strategy, liaises with America’s so-called cyber czar, Howard Schmidt, who was appointed by President Obama to protect sensitive government computers.
British officials said that everyone in sensitive jobs had been warned to be especially cautious about disseminating intelligence and other classified information. Whether British intelligence is involved in retaliatory attacks is never confirmed. However, officials said that there was a significant difference between being part of an information war and indulging in aggressive attacks to disrupt another country’s computer systems.
Dr Lewis said that neither the US nor any of its Western allies had formed an effective response to the Chinese threat, which has its origins in a massive boost to Chinese technology ordered by Deng Xiaoping, the late Chinese leader, in 1986. The West’s own cyber offensives have so far been directed largely at terrorists rather than nation states, giving China virtually free rein to penetrate Western systems with its own world-class hackers and increasingly popular Chinese-made components. “You almost have to admire them,” Dr Lewis said. “They have been very consistent in their goals.”

How Chinese hacked Google, and why India should worry

My interview with Shishir Nagaraja of Illinois University on the Google episode, the Chinese hackers in the Dalai Lama's server and other hot cybertopics is posted as a beautiful slideshow on Rediff.com.
Click here and enjoy.

Cyberwar and the ‘destruction of rules’

My article on Cyberwar and the 'destruction of rules' is posted on Sify.com. Click here to read.

Unrestricted Warfare: the next war will be cyber

A 14-page ‘restricted’ report prepared by the British intelligence agency MI5’s Centre for the Protection of National Infrastructure has recently come to light. The report describes how China has attacked UK defence, energy, communications and manufacturing companies in a concerted hacking crusade. It also details how undercover intelligence officers from the People’s Liberation Army (PLA) and the Ministry of Public Security approached UK businessmen at trade fairs and exhibitions, offering them ‘lavish hospitality and presenting nice ‘gifts’. Unfortunately for the recipients of the famed Chinese hospitality, the gifted cameras and memory sticks, tokens of Chinese friendship contained electronic Trojan bugs which could enable hackers to remotely access business men’s computers. According to the MI5 report, the Chinese government “represents one of the most significant espionage threats to the UK”.
China was also accused of ‘bugging and burgling’ UK business executives and setting up ‘honeytraps to later blackmail them'.
One thought that techniques like the one used against John Profumo, a British Defence Minister during the Cold War had been relegated to the dustbin of history and just good for third rate Hollywood script, but the MI5 report says that “Chinese intelligence services have also been known to exploit vulnerabilities such as sexual relationships and illegal activities to pressurize individuals to co-operate with them.”
Today more widespread than these ‘honeytraps’ are the cyber attacks by Chinese hackers. The public became aware of this new type of warfare after Google announced that it would reconsider working in China: the US search engine giant had been the victim of wild attacks originating from China. The attacks involved did not only Google, but more than 30 companies whose servers were intruded by hackers; this included several human rights groups and some prominent Chinese dissidents. What provoked Google to react in such a sudden manner was the high sophistication of the attack. The attackers seemed to have employed some techniques never seen before.
Ron Deibert and Rafal Rohozinski who worked on Tracking Ghostnet (a 10-month assessment of alleged Chinese cyberspying of diplomatic missions, ministries of foreign affairs, and international organizations) explained in the Christian Science Monitor: “As principal investigators in the Information Warfare Monitor, a project formed in 2002 to investigate and analyze the exercise of power in cyberspace, we have seen many of these types of attacks first hand in our research, and have followed closely those examined by other researchers.”
They believe that the Google attacks were unusual not only in ‘scope or sophistication’, but also ‘in terms of the high-profile nature of the victims’. According to these cyber watchers, “targeted cyber attacks such as these will grow in frequency as cyberspace becomes more heavily contested. …solutions won’t be easy". This is the general opinion amongst experts.
They cite for example criminal organizations “thriving in the hidden ecosystems of cyberspace, profiting from cyberattacks, cybercrime, and cyberfraud”.

What about India? 
Before leaving for his new assignment in West Bengal, former National Security Advisor M.K. Narayanan declared that China had ‘unleashed cyber aggression against India’. In an interview, Narayanan admitted that Chinese hackers had tried to penetrate the PMO. The former NSA said that his office and other government departments were targeted on December 15 (the same day as Google and other US companies). The attack came through e-mail attachments containing a ‘Trojan’ virus which usually allows the hacker to penetrate the server and help himself to sensitive files. Officials had to be asked not to log into the server until the threat could be eliminated. Narayanan told the journalist: “This was not the first instance of an attempt to hack into our computers.” He disclosed that Chinese hackers were suspected to be behind the attack: “People seem to be fairly sure it was the Chinese. It is difficult to find the exact source but this is the main suspicion. It seems well founded.”
Hardly a month later, The Tribune reported that “computer networks at sensitive establishments have experienced a second wave of cyber attacks from foreign-based hackers. Sources in the intelligence reveal that fresh attacks began on January 28 and about 25 computers were targeted.” The attacked computers belonged to the National Security Council (NSC) Secretariat and the National Security Advisory Board (NSAB). The source of information was an official at the National Technical Research Organisation (NTRO) which is supposed to deal with cyber attacks.
According to the same source, even the Cabinet Secretary has been a victim: “Initial investigations revealed that 30 computers, including eight from the PMO, were compromised. This also involved two persons not on the regular posted strength of the PMO, prompting intelligence agencies to believe that the cyber attacks were backed by a high level of human intelligence, providing the whereabouts of key individuals and their portfolios and e-mail addresses. Others who came under attack from cyber space included the chairman of the Joint Intelligence Committee, chief of the Naval Staff, deputy chief of Naval Staff, PM’s special envoy, the three military intelligence services and establishments of the BSF and CRPF in Jammu and Kashmir.”
Again the Chinese ‘signature’ was suspected. The NTRO has apparently formed a rapid reaction team to deal with such attacks. They claim that their reaction time is about an hour-and-a-half. Experts consulted, however, dismiss this as pure wishful thinking, as attacks are now very sophisticated and not easy to notice.
But let us go back some years. In February 1999, the PLA Literature and Arts Publishing House in Beijing released a fascinating book written by Qiao Liang and Wang Xiangsui, two Senior Colonels of the People’s Liberation Army. The title of the book was Unrestricted Warfare.
The two Chinese officers prophesized the ‘destruction of rules’ in future warfare. They wrote: “The direct result of the destruction of rules is that the domains delineated by visible or invisible boundaries which are acknowledged by the international community lose effectiveness. This is because all principals without national power who employ non-military warfare actions to declare war against the international community all use means that go beyond nations, regions and measures.”
Interestingly they gave some examples: “Whether it is the intrusions of hackers, a major explosion at the World Trade Center, or a bombing attack by bin Laden, all of these greatly exceed the frequency bandwidths understood by the American military, …they [the US] have never taken into consideration and have even refused to consider means that are contrary to tradition and to select measures of operation other than military means.”
One of the reasons behind this thinking has been the arm-dealers lobby striving to sell military ‘hardware’.
But the Art of War is changing fast, very fast.
As the Defexpo India 2010 is opening at the Delhi Pragati Maidan, many believe that the exhibitors are only ‘Showcasing Land and Naval Systems’ of yesterday. The War of Tomorrow is being prepared behind some computer monitors in Sichuan or Hainan.
In an eye-opening article Cyber Warriors published in The Atlantic, James Fallows wrote that it was “rare to hear U.S. military or diplomatic officials talk about war with China as a plausible threat” in the conventional sense of the term. Fallows says: “Yes, circumstances could change, and someday there could be a consensus to ‘take on the U.S.’ But the more you hear about the details, the harder it is to worry seriously about that now.” However, it is different with a cyber war: “After conducting this round of interviews, I now lose sleep over something I’d generally ignored: the possibility of a ‘cyberwar’ that could involve attacks from China — but, alarmingly, could also be launched by any number of other states and organizations.”
The recent shutting down of the Black Hawk Safety Net, the largest hacker training center in Hubei Province is only an eye-wash, smaller centers working in close collaboration with the People's Liberation Army will remain opened and hacking will continue as before.
A few months ago, in a report prepared for the US China Economic and Security Review Commission, Northrop Grumman presented a list of electronic intrusions and disruptions originating from China since 1999. The conclusion was that in most cases it was difficult to say whether the activity was amateur or government-planned, but: “The depth of resources necessary to sustain the scope of computer network exploitation targeting the US and many countries around the world coupled with the extremely focused targeting of defense engineering data, US military operational information, and China-related policy information is beyond the capabilities or profile of virtually all organized cybercriminal enterprises and is difficult at best without some type of state-sponsorship.”
The Chinese State is clearly identified in these attacks.
Another conclusion of the Report is: “The breadth of targets and range of potential ‘customers’ of this data suggests the existence of a collection management infrastructure or other oversight to effectively control the range of activities underway, sometimes nearly simultaneously.”
It will probably take 10 years for the NTRO to prepare such a report and 10 more to make it public. Here, as in infrastructure development, India is far, far behind China. While it will take several more years to complete a deal for 126 Multi Role Combat Aircrafts (for some 11 billion dollars), for a much smaller budget, the Chinese will have found ways to neutralize the electronics of these planes.
But there is worse. In a forthcoming novel, Directive 51, John Barne envisages the collapse of the world ‘financial life’ (most of our ‘assets’ being kept inside some banks’ computer systems), the halt of most manufacturing systems, the evaporation of the technical knowledge and legions of other consequences. Frightening!
Let us hope that the Indian Government will wake up to the threat and NRTO will truly be able to respond in one hour.