Open Access Research Article
Byte Is The New Bomb: A Critical Analysis Of The Situation Of Cyber Terrorism In India (Authored
Published Paper
Article Details
Byte Is The
New Bomb: A Critical Analysis Of The Situation Of Cyber Terrorism In India
Authored By-1. Harshitaa Arora
2. Charvi Singh
3. Akshat Kalra
Abstract
The public is blessed by the reality
of cyberspace. On the other hand, when it is used improperly with foul
intentions, it proves to be one of the most dreadful technological
breakthroughs ever. Although terrorism has existed since the beginning of time,
with the advancement of technology, conventional terrorism has found its way
into the cyberspace and is now a way for terrorists to disrupt the
peaceful coexistence of nation states. Cyberterrorism harms emerging nations
like India and has the potential to completely devastate an economy and
administrative structure. Since the first cyberattack, termed “Digital Pearl
Harbor” in 1990, there have been an increasing number of cyberattacks that have
successfully disrupted the national peace and security of practically all
countries. Almost all governments are investing their time and effort
developing strict regulations to safeguard their country since it poses a
threat to national security. Following the 26/11 attack in Mumbai, which led to
the acknowledgment of terminology like “cyberwarfare” and “cyberterrorism,”
India too has undertaken various measures to combat this atrocity.
Combating the overt and covert actions of cyber terrorism, however, is a challenge
to the state apparatus as opposed to a typical criminal justice endeavour. This
paper tries to concentrate on the theoretical underpinnings of cyberterrorism.
It further clarifies if Indian laws have been able to control the rising number
of cyberterrorism incidents in India.
Keywords – Cyber, Terrorism, Internet,
Information technology, Crime.
Hypothesis
The researcher is convinced that,
just as technology is developing, so are the tactics used by terrorists to
undermine a nation’s national security. The government must not only make new
policies and alter old ones, but also strictly enforce them. The internet has
been weaponized, and terrorists and their followers frequently utilise it to
incite hatred among the populace and encourage them to follow their leaders. A
targeted piece of legislation that regulates cyberspace and strengthens the
nation’s cybersecurity measures is necessary.
Methodology
The document-based and analytical
approaches are used in this paper. Majority of the literature was gathered
from research journal, newspaper, publications, weeklies, fortnightly
magazine, government report, Information Technology Act 2000, Information
Technology Act 2008, reports published by Cyber security authorities,
etc.
Introduction
“Just as a modern thief can steal
more with a computer than with a bag, tomorrow’s terrorist may be able to cause
more damage with a computer mouse than with a bullet or a bomb.”
– National Research Council
Terrorism has existed throughout
human existence.[1]
Currently, terrorism poses a menace to every nation in the world.[2] It
has overtaken the entire world and presented the world with an extraordinary
dilemma. Because of terrorism, many individuals have lost their lives,
families, and assets. It has had an impact on people’s lives as well as the
development and growth of the economy, society, and politics.[3]
The development of Information and Communication Technology (ICT) has given the
evil of terrorism a great deal of power to carry out deadly acts.[4] In
1990, the first cyberattack, popularly known as “Digital Pearl Harbor”[5]
was experienced and warned about by the National Academy of Sciences.
Cyberterrorism, which was in its
infancy over two decades ago, is now a terrible threat that has
caught everyone off guard.
A Southern Poverty Law Centre expert
named Mark Potok stated[6]:
“The internet is a crucial component of the decentralised struggle strategy. It
enables lone wolves to stay updated about acts, changes in philosophy, and
discussions of tactics — all of which may have an impact on his individual
target selection. The internet, more so than print media, enables the lone wolf
to continue to be a part of a larger movement despite attending no meetings,
putting his name on no lists, and generally attempting to blend in. An
excellent illustration of this is Mathew Williams, the confessed killer of a
gay couple in California, who, prior to pulling the trigger, discreetly
researched a number of radical ideas on the internet”[7].
Many of the terrorist organisations
on the US State Department’s list operate websites using labelled domain
names. The majority of the group tends to use the internet to propagate their
ideology, while US officials suspect that some of those terrorist
groups used encrypted emails to plot terrorist attacks[8]. A
computer hacker who destroyed a portion of a US-based Internet Service
Provider’s (ISP) record-keeping system in 1996 forced the ISP to shut down,
signing off with a threatening message that stated ”you
have yet to witness actual electronic terrorism. This is a promise”[9].
In 1998, when the Euskal Herria Journal, a New York-based journal that
supported Basque in independence, had a website hosted by the Institute
for Global Communication (IGC), Spanish protestors assaulted the IGC with
thousands of spurious emails demanding that they remove the website.[10]
The warning in the hundreds of emails sent daily by the ethnic militants to Sri
Lankan embassies said, “We are the internet black Tigers and are going to
disrupt communication”. According to reports, it was the first known
terrorist cyberattack on a nation’s computer network. In 1999, during
the conflict in Kosovo, denial of service assaults and an onslaught of
emails were directed at NATO computers.[11]
Conceptualizing
Cyber Terrorism
The idea of cyber-terrorism can be
traced back to the early 1990s, when the utilization of the Internet
was rapidly increasing and conversations about the ‘information society’
were in full swing. At that time, numerous studies were conducted on the potential
threats facing the United States which was at that time increasingly
networked and heavily reliant on high tech. Although there may not
be a physical threat from cyberterrorism, its psychological consequences on
vulnerable communities are just as devastating as terrorist explosives.[12]
In the current day, one of the most important economic and national security
challenges that a nation faces, in the opinion of former US President Barack
Obama, is the cyber threat.[13]
In the midst of the 1980s, Barry C.
Collin, a senior person research fellow at the Institute for Security and
Intelligence in California[14],
first coined the term “cyber terrorism”. Collin’s definition of cyber terrorism
at the time was simply “the intersection of cybernetics and terrorism”[15].
It most definitely is a broad term. The process of creating a precise
and unified definition of the term “cyberterrorism” has run across a number of
obstacles. The majority of the discussion around cyberterrorism has
occurred in the mainstream media, where journalists are more intrigued by the
drama and controversy than in providing a uniform and
practical definition to the newly discovered terms. Additionally, it has
become increasingly common for people who use computers to create new phrases
by simply prefixing them with “cyber”, “computer”, or “information”. As a
result, a plethora of terminology, including cyberterrorism, cybercrime,
cyber-tactics, cyberattack, and cyber-break-ins, are used to define what some
political strategists refer to as ”new terrorism” of our times.[16]
All acts of cyberterrorism are
cybercrimes but not all cybercrimes are acts of cyberterrorism.[17]
It would be erroneous to assume that
cyber terrorism is a brand-new category of cybercrime since some studies have
determined that an act of cybercrime encompasses two main sorts of
activities: cybercrime and misuse of information technology[18].
While all cyberterrorism incidents are cybercrimes, not all cybercrimes may be
categorised as cyberterrorism, which is an important distinction to make.
Acts of cyberterrorism may only be defined as cybercrimes that have political
or ideological motivations. An example of this distinction can be incident that
took place at the Maroochy Shire Waste Water Plant in Sunshire Coast City,
Australia where in order to express his discontent with the company’s promotion
policies, an engineer compromised the computers that ran the business in
2000.
As a result, millions of tonnes of
sewage water were released into the city’s parks and seashore, severely harming
the ecosystem. It was incorrectly referred to as a cyberterrorist attack
because it was not intended to cause harm to general public or disrupt nation’s
peace and security i.e., the idea was not politically motivated.
Nevertheless, it was a serious cybercrime.[19]
Today’s cyber terrorists’ primary
goal is to employ cyberattacks to destroy a nation’s vital infrastructure in
order to advance the causes they support as a terrorist organisation. Their
wish lists include essential infrastructure such as banking and finance, water
supply, fuel production and supply chains, military complexes, government
operations, and emergency services.
Cyber
Terrorism In India
India is no longer delusional about
cyberterrorism.[20] The
Anti India Crew (AIC) of Pakistan infiltrated the websites of India on April 2,
2002, and attempted to wipe and obliterate all of the data contained on
the computer systems and computer networks of 88 websites[21],
including the websites run by Indian Government.[22]
The horrifying 26/11 Mumbai attack is a stark illustration
of how terrorists’ use of ICT made it
challenging for Indian security officials to identify and apprehend these
culprits.[23] The ICT
was misused in the Zaveri bombing on July 13, 2010. ICT was also used for
communication during the 2010 Varanasi bombing[24];
the Indian Mujahidin claimed responsibility for the explosion via e-mail, which
was linked to a WiFi connection in Vashi, Navi Mumbai.[25]
In the Pulwama incident that took place on February 14, 2019, the suicide
bomber from Jaish Mohammad used virtual SIM cards.[26]
In the end, cyberspace has turned into a battlefield and a base for
terrorist activities. The terrorist group views cyber-attacks as an effective
jihadi tool for waging war against their adversaries. Terrorist organisations
have become adept at abusing the online environment.[27]
How
Vulnerable Is India To Cyber Terrorism
How susceptible are we to the
possibility of cyberterrorism is the issue that gets raised
very frequently. The degree to which a nation’s critical infrastructure
depends on networks strongly relates to that nation’s susceptibility to cyber
threats. India is on a path of ardent digital revolution. With over 1.2
billion users, the nation had the second-largest internet population in the
world in 2020. Of these, 750 million users used their mobile phones to access
the internet. India will have 1 billion smartphone users by 2026, according to
a Deloitte report[28].
According to the DBS Digital Readiness survey conducted in 2021, almost 62% of
large and middle-market enterprises in India are still in the early phases of
digitalization. DDoS assaults (77%) and cloud infrastructure security (76%)
were cited by more than half of major enterprises and middle-market companies
as the most pressing cybersecurity threats[29].
These are significant figures that
demonstrate the size of the cyberspace that India must protect. The
attackers are “demonstrating same level of online expertise as by US government
agencies,” according to a report CRS (Congress Research Service) given to US
Congress[30].
According to the same report, Al-Qaeda has established web forums where its
cadres can learn how to hack computers, how to make bombs, etc. Cyber terrorism
has taken on a completely new dimension with the employment of cyber technology
by some countries’ intelligence services for not only snooping but also for
undermining the vital infrastructure of other nations.
Cyber
Security And Legislative Measures
One can define Cyber security as “The
collection of tools, policies, guidelines, training, actions, security concepts
and safeguards, risk management approaches, assurance, and technologies that
can be used to secure and protect the cyber environment as well as the
organizations and user assets”[31].
Its objectives include limiting
unauthorised access to information, preventing inadvertent alteration or loss
of information, and protecting networks, data, computer programmes, and
information technology. In a world where sophisticated communication and
technological infrastructure are essential to security and economic success,
making the use of Internet safe and secure is becoming more and
more crucial to government policy[32]. Joseph
Migga Kizza has defined cyber security as having three components—confidentiality,
integrity, and availability[33].
Information
Technology Act, 2000
Several governments implemented
specialised laws to control online commerce and related e-governance after the
United Nations Commission on International Trade Legislation (UNICITRAL)[34]
model law on e-commerce was released in 1996. To integrate key sections of the
UNICITRAL model law on e-commerce, the Indian parliament passed the Information
Technology Act, 2000.
A close examination of the 26/11
attack in Mumbai[35]
would reveal that the terrorists’ use of the internet for communication and for
learning about their target demographic and the location led
to catastrophic outcomes in India. As a result of this, the Indian
government took decisive action to improve cyber security, including revising
the Indian Information Technology Act, 2000 to outlaw terrorist activity
online.
The following examples are used to
support the claim that, despite the modified IT Act of 2000’s pledge to guarantee
cyber security and the protection of data, particularly sensitive personal
data, the law’s provisions still have gaps.
a) In the Varanasi bombing case of 2010,
the Indian Mujahiddin also made use of cyberspace to spread their message[36].
b) In July 2011, explosive attacks in a
busy city market in Mumbai’s Jhaveri Bazaar were also carried out using digital
technology[37].
c) One of the largest cyberattacks on
banking systems in history was the one that targeted Indian banks in 2016.
About 6 lakh debit card details, including PINs, were stolen as part of a mass
cybercrime. Also mentioned by victims was the unauthorised use of
their credit card information coming from Chinese locations. SBI, YES
Bank, and Axis Bank were the three banks that were most severely impacted.[38].
d) d) In 2018, 200 official government
websites unintentionally published private Aadhaar data; the issue got so bad
that one could easily access thousands of government databases containing
sensitive information by just surfing Google for it[39].
Because unauthorised government employees were accessing Aadhaar data, the
Indian Government was forced to restrict
approximately 5,000 workers[40].
The Tribune further stated that its reporters were able to locate an anonymous
WhatsApp group that was offering to sell Aadhaar card details for as little as
Rs 500
($7.2 US). After the payment was
completed, the journalists were given the Login ID and Username to a platform
where they could readily view all the data associated with that person’s
Aadhaar number[41]. The
Tribune calculated that over 100,000 persons had illegally accessed private
Aadhaar information before this system vulnerability was rectified[42].
e) A conspicuous example of how Indian
markets could be simple targets for financial crime syndicates was the
cyberattack on Cosmos Bank in 2018, which resulted in consumers losing 94
crores. The case’s investigator, Brijesh Singh, said that in only two and a
half hours, fraudulent transactions had been executed in 29 different nations.
The crime was perpetrated in a sophisticated manner, with extensive
collaboration with foreign hackers. What was as stunning, he claimed, was
how internet perpetrators employed unwitting bystanders as money couriers to
finance various illegal enterprises[43].
f) In 2019, a security defect in the
immensely popular WhatsApp messaging service made its 1.5 billion+ users
vulnerable to “Pegasus”[44],
one of the most dangerous spyware programmes in the world. A user’s most
private data stored on phone, including text messages, call logs, and location
information, can be accessed remotely thanks to the spy program. Since the
Pegasus program[45] was
developed by an Israeli corporation called NSO[46],
it was claimed that the Israeli government’s spies were involved in the
cyberattack. WhatsApp accused NSO of enabling government hacking campaigns in
20 countries in a suit brought before a federal court in San
Francisco[47].
In a statement, WhatsApp said that “100 members of civil society had been
targeted”, calling it “an unmistakable pattern of abuse”[48].
The application of Sections 69[49]
and 69B[50]
of the IT Act, 2000 has been the subject of intense controversy as a
result of this case (amended in 2008).
g) Mumbai, India’s financial hub,
experienced a significant power outage on October 12, 2020. Water supply issues
forced the cancellation of train services, and hospitals were forced to use
generators. Up until the situation was addressed two hours later, businesses in
Mumbai, Thane, and Navi Mumbai fought to maintain their operations. Cybersecurity
experts believe that China’s People’s Liberation Army (PLA), which is now
involved in a significant conflict with the Indian Army in Ladakh, may be
involved, notwithstanding allegations of sabotage made by Maharashtra Power
Minister Nitin Raut. 14 Trojan horses, a type of malware that may have been
installed on the systems of the Maharashtra State Electricity Transmission
Company, were the subject of suspicion[51].
h) When SITA, the Geneva-based company
that provides data for more than 90% of the world’s airlines, alerted Air India
in February 2021 that hackers had stolen the personal information of 4.5
million passengers, it created yet another obstacle for India’s cybersecurity
apparatus. Despite the fact that the incident took place outside of Indian territory,
lakhs of Indians were impacted. According to a statement from Air India, the
breach affected personal data that was exposed for almost ten years, from
August 26, 2011, to February 3, 2021. Although, the cyber-warriors of
India made every effort to minimise the harm wrought by the infringement,
they eventually
discovered that it was difficult to
conduct an inquiry into attacks that occurred outside of Indian cyberspace due
to concerns with jurisdiction.[52]
While the first few instances may
raise concerns about privacy and security breaches because the architecture of
the e-governance system was not adequately protected, the last few examples
raise concerns about security and privacy breaches from the standpoint of an
intermediary that is utilised by the public at large for data and digital
communication and by government agencies for e-governance[53].
It is possible to infer from the
definition given under Section 66F[56]
that cyberterrorism is an act of hacking, blocking, and computer infesting in
order to restrict legally authorised persons’ access to computer resources
generally and to gain or obtain unauthorised access to any information that is
a “restricted information” for the purpose of security of the state, foreign
relations, etc. These horrifying acts may cause death and injury to people,
property damage, a disruption of civil services that are necessary for a
community’s survival, and also have an impact on the critical information
infrastructure. They are performed with the intent to endanger the security,
sovereignty, and integrity of India or to instil a sense of terror in the
minds of people or a specific society.
In the instance of the 26/11 Mumbai
attacks, it was clear that the terrorists had exploited communication services
to further their heinous ambitions rather than to breach or obstruct the
sensitive data. The intercepted messages that the Indian government used in the
investigation of the Mumbai terror case makes it abundantly evident
that the radicals were only using their own personal freedom of expression to
communicate. However, when the message as a whole was examined, it became clear
that this speech was being made in an effort to undermine India’s sovereignty,
peace, and security. As a result, it no longer qualifies as protected speech
under Article 19A[57]
of the Indian Constitution. It is a terrorist act instead. This specific
element is conspicuously missing from the definition given by section 66F[58].
The notion behind the rule “actus
reus not facit nisi mens sit rea” is embodied in Section 66(F). An act
of cyberterrorism must involve both criminal and immoral activities[59]. Article
19(2)[60] of
the Indian Constitution is somewhat identical to this definition[61].
The Constitution’s Article 19(2) specifies the limits beyond which the right to
free speech and expression may be legally curtailed. Simply put, any conduct
that violates Section 66(F) of the IT Act is a violation of the grounds listed
in Article 19(2), which restricts the right to freedom of speech and
expression, and is therefore considered cyberterrorism[62].
In light of this, cyber terrorism is indicated by Article 19(2) when read in
conjunction with Section 66(F) of the IT Act[63].
Conclusion
“The Internet is a prime example of
how terrorists can behave in a truly transnational way; in response, States
need to think and function in an equally transnational manner.” Ban Ki-moon –
Secretary General of the United Nations
It is tragic to point out that
despite the changes and significant provisions implemented by the government to
combat cybercrimes, India stands to be one of the major victims of cyberattacks
and cyberterrorism as after the introduction of various amendments and new
acts, the government still fails to have the robust cyber-security measures
required to counter the growing threat posed by cyberterrorism. Cyber terrorism
poses one of the greatest threats to all the nations in the modern era.
Terrorists are increasingly turning to more dangerous weapons, and their
original goal of terrorising hundreds of people while killing one has changed
with time. They believe that by slaughtering more and more people, they will
ultimately prevail in the aimless conflict. Their nature has evolved to be more
dangerous, and they profit from society's technological growth as well. They
are using modern technologies to their advantage to spread fear and chaos.
India’s Computer Emergency Response
Team (CERT-In) tracked and received reports on over 14 lakh cyberattack occurrences
in 2021[64].
Ransomware attacks have surged by 120% in India, according to government
statistics. Despite the numerous efforts by the government, India also has far
less cybersecurity initiatives and activities than other advanced nations. Given this dire scenario, the democratic
State's top priority should be to ensure the safety and security of its
citizens, and as a result, it should pass legislation to reduce the threat of
cyberterrorism[65]. The
State must, however, use extreme caution. Since all laws are strengthened by
both public support and the authority of the State, care must be taken to
ensure that innocent people are not persecuted and their fundamental rights are
not violated. Human rights considerations and security concerns should coexist in
harmony[66].
To dissuade, recognise, and track terrorists, there must be regulatory and
monitoring measures in place, but they should not undermine the rights and
liberty of citizens.
Article Information
Byte Is The New Bomb: A Critical Analysis Of The Situation Of Cyber Terrorism In India (Authored
Authors: Harshitaa Arora, Charvi Singh, Akshat Kalra
- Journal IJLRA
- ISSN 2582-6433
- Published 2022/08/22
- Volume 2
- Issue 7
About Journal
International Journal for Legal Research and Analysis
- Abbreviation IJLRA
- ISSN 2582-6433
- Access Open Access
- License CC 4.0
All research articles published in International Journal for Legal Research and Analysis are open access and available to read, download and share, subject to proper citation of the original work.
Disclaimer: The opinions expressed in this publication are those of the authors and do not necessarily reflect the views of International Journal for Legal Research and Analysis.