August is a time for celebration in India and Pakistan. There is a patriotic fervour in the air and it spills over into cyberspace; this is also the time some over-enthusiastic hackers indulge in jingoism.
On August 14, Pakistan's Independence Day, hacker group Lulzsec India defaced 30 websites of different departments of the Government of Pakistan, including the ministry of defence, ministry of information technology and ministry of railways. The defaced homepages bore the message: Hacked by LulzSec India. "Happy Independence Day - 15th August. Lulzsec India celebrating 70th Independence Day. Security Kissed By ROOT DESTROY3R (a mechanical engineer)"
Screenshots of the defaced websites were posted on social media and widely circulated in India. The sites remained dysfunctional for several days.
On August 15, Independence Day in India, in a retaliatory strike, hacker group Pakistan Haxor Crew (PHC) hacked the site of Allahabad University and posted anti-India messages as well as a clip of a burning tricolour. They put up a message in Hindi that said 'Kashmir would become like Pakistan'. The hackers also posted a photograph of slain Kashmiri miltant leader Burhan Wani with the message: I am Wani, I am Pakistani.
The same group had earlier claimed responsibility for hacking websites of many other educational institutions such as the Indian Institute of Technology-Delhi (IIT-Delhi), IIT-Varanasi, Aligarh Muslim University and Delhi University (DU), among others. These websites remained offline for five days and started working only after security features were strengthened.
"There's been an ongoing tussle between hackers from the two countries," says Abir Atarthy, co-founder of the Indian School Of Ethical Hacking in Calcutta. "Time and again hackers from both Pakistan and India have hacked and defaced each other's websites. They have left a trace of their pseudo-hacking names and indulged in patriotic slogans or name-calling," says the senior cybersecurity analyst.
After India's surgical strike on terror launch pads across the line-of-control, various Indian websites faced cyber attacks by Pakistanis. The hackers claimed the attacks were an "act of revenge". According to Atarthy, most of these hackers are not experts but just 'script kiddies' who can't write their own code. "So far they haven't been able to do damage to critical infrastructure systems [such as power, defence, communication, water supply, hospitals] of the country."
Some Indian cyber security organisations, however, claim that they are capable of entering Pakistan's critical systems and destroying them if the need rose. Samiran Santra, head of Indian Cyber Security Solutions, claims some Indian hackers are far more skilful than their Pakistani counterparts. "In January Indian hackers got into websites of three Pakistani airports, including the one at Islamabad, and gained access to their back-end server. Not only did they bring down the websites, but also injected them with ransomware [software designed to block access to a computer system until money is paid]," he said.
According to him, Indian hackers usually don't attack vital structures of enemy nations because they don't get support (or moolah) from the government. Russian hackers, supported by their government, have been known to cripple power stations in Ukraine shutting down incubators for babies and life support machines in hospitals; blinded airports forcing pilots to crash land and thrown metropolises into pitch darkness.
Closer home, China's cyber capabilities have evolved with the People's Liberation Army's ongoing modernisation drive. According to Atarthy, China is a bigger threat than Pakistan in cyber space. He analyses cyber security threats on a critical structure and says, "Several Indian companies have seen an increase in cyberattacks originating from China. These are often routed through different proxy servers of North Korea, Africa, and Russia, making it very difficult to trace them."
Why has India not been able to raise an army of lethal hackers? "Unlike most Russian and Chinese hackers, Indians are not adept at coding, which makes it possible to create original software for computers, apps and websites," says Atarthy.
Now that cyberspace has turned into the fourth field of war - after ground, sea and air - it's time India raised a robust cyber command before hackers from enemy nations learn to hit our critical infrastructure and bring about casualties similar to that of a nuclear bomb.
Joydeep Bhattacharya, chief operating officer of Calcutta-based IT company TCG Digital says, "The country urgently needs to develop an elite cadre of cyber warriors. The biggest concern is not merely the advancing threats but also how to find people who can effectively and intelligently respond to cyber terrorism, cyber crimes and nation sponsored attacks."
Last year, TCG developed India's first cyber range - a simulation of a cyber war - that defence establishments, security agencies, government departments and public and private enterprises can use to develop cyber warriors. This elite cadre will defend against sophisticated cyber-attacks, protecting critical components connected to computer networks. The cyber range can also be used to train hackers to undertake offensive operations against enemy targets. Apparently, discussions are on with several government departments to train people in the cyber range.
Just jingoism will not be enough to save the country from a cyber attack or launch a counter attack. The nation needs some real hackers. And she needs them now.