New threat

New Delhi, July 4: India has woken up to the possibility of its power installations coming under attack from evil Internet hackers.

On Friday, the Prime Minister’s Office convened a meeting that dwelt on online attackers seriously crippling new plants and distribution networks being set up by private operators.

Chaired by the principal secretary to the Prime Minister, the meeting decided to set up an inter-ministry task force headed by Sam Pitroda to draw up a plan to secure power grids and installations.

Newer facilities are more vulnerable as they are very reliant on computer management systems that could fall prey to an embedded malware (malicious software).

“A malware intentionally introduced into the IT backbone, which supports or controls a power plant, or a cyber attack on its distribution network could cause large swathes of the country to black out at a crucial juncture. It could even destroy infrastructure,” power ministry officials said.

They said the real fear was over the private players “who have largely been buying from vendors who are not necessarily amongst the most reliable from the security point of view”. Security agencies had realised in April the vulnerability of the country’s infrastructure — such as telecom — to Internet attacks and had been trying to plug the potential gaps.

Recently, S. Gopalakrishnan, CEO and managing director of Infosys, asked the country to “remain vigilant” against possible cyber attacks.

“India faced a severe threat in April from the hackers. It is believed that the Chinese were behind it but the reason is still unknown. India has to face threats like this in a huge manner,” he said, adding that the country needed to work on its security levels in collaboration with IT leaders.

A note prepared by the power ministry points to the sourcing of equipment from little-known vendors who can build in “backdoors”.

Backdoors are embedded malware, which enables a remote controller to take over the control of the system.

Analysts stress on the need to audit systems by a trusted third-party validator. “We can’t tell power plants to buy from one country and not from the other. It’s better to let power firms buy through tenders but to get these systems validated,” officials said. The validation process is supposed to check for and sanitise hidden threats.

At the same time, officials recommend long-term measures such as the certification of equipment on a regular basis.