Unless India improves its cyber defence capabilities, the country’s critical national infrastructure — oil pipelines, steel plants and nuclear reactors — will be vulnerable to the kind of attack that damaged the Iranian nuclear programme
In today’s world, when most computers are linked to the World Wide Web, the threats posed by cyber adversaries including hostile nations, hackers, and cyber mercenaries to national security are enormous. A related challenge is to protect the critical national infrastructure — stock market brokerage platforms, steel plants, air traffic signal management, oil pipelines, nuclear reactors, power plants, civil telecommunication networks — all of which now rely on computer networks for operational reasons.
On July 30, 2012, the northern, eastern and north-eastern parts of the country witnessed a blackout caused by a tripping of the regional electricity grids. It was the world’s largest blackout, with half of India’s population left without electricity, which resulted in losses of approximately $100 million. It took three days for the power supply to be fully restored and for life to returnto normal.
If this had been an attack by cyber hackers from Pakistan or China, which brought down India’s public and private infrastructure systems, the damage would have been deep and devastating for India’s economy — and regional geopolitics.
Thankfully, the committee set up by the Union Ministry of Power to examine the July 2012 grid collapse ruled out any possibility of cyber sabotage. However, it noted that cyber attacks on the power grid will have far-reaching and detrimental effects on the country’s energy sector, national security, and economy. Indeed, the spectre of cyber attack extends to other critical infrastructure sectors too, spanning the private and public sectors. The pipeline networks of GAIl and ONGC, the dams of the Narmada Water Authority, the steel plants of the Steel Authority of India limited and Tata Steel, are all susceptible to cyber attack. Their vulnerability is primarily located in the weakness of the Supervisory Control and Data Acquisition system, which is used to manage the operations of all these facilities.
The Scada systems are computer-based industrial control systems. They monitor and control industrial and infrastructure processes, including power transmission, civil defence, communications, and air-conditioning and space systems. They manage operations at facilities that are functional 24x7; any disruption can impact human life, the economy, and national security. A majority of the Scada systems used in India were installed 20 to 30 years ago, in the pre-internet era. Now known as ‘legacy systems’, these older systems were stand-alones, unconnected to remote users. They were not built to deal with today’s network-based threats or cyber attacks. According to industry insiders, not only the ‘legacy systems’, but also the Scada systems in a networked environment, are vulnerable to cyber attacks. This is because devices running Scada systems have limited computational power to implement security protocols.
The devastation that cyber attacks on Scada systems can inflict is illustrated by the 2010 Stuxnet virus attack. The virus was allegedly designed by the US and Israel to target the Iranian nuclear programme, which runs on the Scada system.
Stuxnet is a minor manifestation of the damage that cyber attacks can have on Scada systems. Confidential data from India’s Computer Emergency Response Team reveals that hundreds of attacks on the Scada systems of India occur annually. So far, these attacks have been small, but anecdotal evidence suggests that their scale and frequency is increasing over the years.
Considering the criticality of this threat to India’s economy and cyber security, efforts to counter the threat are tiny. The Government and private companies are equally to blame for this lapse. The Government does have a National Cyber Security Policy, which aims to strengthen regulatory, legal, and monitoring mechanisms for cyber security. But it makes no mention of plugging Scada vulnerabilities or of developing a dedicated critical infrastructure protection policy.
The Government has also formulated a crisis management plan. But the effectiveness of its implementation has been questioned after the Stuxnet attack. What does exist and works operationally is the National Critical Information Infrastructure Protection Centre. Set up to secure critical infrastructure, the centre was established under the umbrella of the National Technical Research Organisation. The NTRO is a technical intelligence agency about which little is publicly known — except that it is part of India’s intelligence network. This makes it virtually invisible to the public, which undermines its effectiveness.
The Government’s ambiguity is coupled with a reluctance among private businesses to disclose the vulnerability of their Scada systems. Given this mutual distrust and vulnerability of both public and private players, the solution will involve jointly addressing the problem in the form of a public-private-partnership. This must be taken forward by creating a regulatory framework; identifying the most vulnerable infrastructure facilities in the public and private sectors; establishing a platform for real-time information-sharing on emerging cyber threats; coordinating with the Centre for Development of Advanced Computing which works on Scada security; and formulating security standards for Scada systems in all sectors.
At a time when India’s regional environment is hostile and the country is subject to increasing cyber attacks, it is important to promote such PPPs. Without such measures, the next Stuxnet attack could be the one which cripples our businesses and critical national infrastructure for longer than we can imagine.