BEFORE making any analysis of Russia’s or India’s national cyber security policies, it is necessary to stress the fact that cyber security itself is a complex concept bringing together efforts and policies on a large number of different but interconnected issues (including countering cyber crime and cyber terrorism, privacy protection, global identification of users, resilience of networks, dealing with cyber espionage and cyber sabotage). Prevention of cyber wars and politically motivated malicious activities in cyberspace is a different set of issues.

Even the understanding of cyber security can be drastically different. Russian official documents and international agreements to which Russia is party (like the Shanghai Cooperation Organization Agreement on cooperation in the field of IIS from 16 June 2009) refer to the information space as a ‘sphere of activity connected with the formation, creation, conversion, transfer, use, and storage of information’; Indian National Cyber Security Policy, based on the ISO standard, refers to cyberspace as ‘an environment consisting of interactions between people, software and services supported by worldwide distribution of ICT, devices and software.’ Germany understands cyberspace as ‘the sum of all IT systems linked at data level on a global scale’ – however, no air-gapped Supervisory Control And Data Acquisition (SCADA), are part of cyberspace, if a literal understanding is taken.

Diverging conceptual paradigms of cyberspace give birth to differing cyber security strategies, and this is a major reason behind ongoing global debates on cyber security treaties and international legal mechanisms for making cyberspace more secure.

The official Russian approach towards information security is focused on four major threats to the system of international information security. Those include the strategic triad of threats (the use of ICTs in (i) criminal, (ii) terrorist and (iii) military-political purposes) and also the threat of using ICTs for undermining the nation’s political sovereignty and spreading extremism. The fourth element was introduced to Russian documents and proposals after the events of the Arab Spring of 2011.

These four priorities are perceived in a set of documents and initiatives which are developed and promoted by Russia on several levels: global (through the UN mechanism), regional (Collective Security Treaty Organization, CSTO), Commonwealth of Independent States (CIS), Shanghai Cooperation Organization (SCO), BRICS and with a less priority – G8, G20, Asia-Pacific Economic Cooperation forum (APEC) and Organization for Security and Cooperation in Europe (OSCE) and bilateral.

At the global level, a major Russian initiative is the concept of Convention on International Information Security, presented to the world in November 2011 at the first International Conference on Cyberspace in London. The document is designed as a UN Convention – a first ever legally binding global instrument for cyberspace. Though the convention was not adopted at the UN level and provoked severe criticism from a number of Russia’s partners, including the USA and most western European states, it remains a top priority on the Russian agenda in the field of international information security.

 

At the bilateral level, some important developments have taken place in recent years. For example, in 2010, a bilateral intergovernmental agreement on cooperation in the field of international information and communication security was signed by Russia and Brazil. However, it has not yet been ratified, although recent events related to the disclosures by Edward Snowden increase the probability that work on ratification will continue. Another important bilateral achievement took place on 17 June 2013, when the Russian president and his US counterpart signed a joint statement and three agreements on CBMs in cyberspace, which imply the establishment of a 24x7 US-Russian hotline on cyber incidents, strengthened cooperation of national Computer Emergency Readiness Teams (CERTs) and information sharing on cyber incidents. Implementation of these three agreements, however, could be adversely affected by the Snowden disclosures, as the information on massive electronic surveillance programmes conducted by NSA threatens to seriously undermine mutual trust between Moscow and Washington.

Nationally, Russia has a number of bodies dealing with cyber security. Federal Security Service (FSB), Federal Protective Service (FSO), special units of the Ministry of Interior/Home Affairs and Ministry of Defence, Federal Service on Technical and Export Control (FSTEK) are some of the major ones. On 15 January 2013, President Putin signed the Order 15N, which delegated the responsibility of building a nationwide system protecting governmental networks to FSB – which shows that Russia and India are following a similar path in setting up national institutional frameworks for a cyber security agenda. In the area of cyber defence, the situation has developed dynamically as well. Starting from the winter of 2012, work is ongoing to establish a Russian analogue of a Cyber Command within the structure of the General Staff of Russian Armed Forces.

 

Going back to the hierarchy of Russia’s approach, all of its international priorities are parts of an integrated vision that was recently summarized in a national level document, signed by President Putin in August 2013. It is called the National Policy Guidelines of the Russian Federation in the Field of International Information Security to 2020. The fact that the document was signed just a month after the Indian National Cyber Security Policy (NCSP) makes for an interesting comparative analysis of these two strategic documents and approaches embedded in them.

At first glance, the two documents seem to be almost completely different – the Russian policy guidelines are totally dedicated to the international dimension of cyber security policies, whereas the Indian NCSP is focused on interaction among national stakeholders and strongly emphasize the vital role and contribution of the private sector to Indian cyber security system and policy.

In general, the NCSP is a timely strategic document, which provides a strong incentive for further elaboration of a cyber security agenda and strategy for India. Its advantages are quite clear: correct and clear understanding of the role of the private sector, accent on coordinating role of the government instead of direct and rigid regulation, priority of critical information infrastructure (CII) protection.

Still, there are certain aspects of the NCSP which might benefit from further efforts and improvement. First, that the NCSP is not a cyber strategy in itself should be clearly understood. A cyber security strategy implies an action plan, probably a concrete time frame with a set of measurable objectives to reach, as well as integrated vision of the institutional framework for its implementation, the range of stakeholders and partners to counteract with and, finally, some resource parameters.

 

What is it that seems to be missing from the NSCP in particular?

1. An international cooperation component. India needs to know with whom to develop international PPPs in the field of cyber security. Another part of the issue is how to cooperate with transnational IT corporations on the issues of identification, privacy and personal data protection. Given that Facebook and Google are transborder actors, what should be the strategy of their engagement in the process of implementation of the NCSP goals? The question then veers towards who could possibly partners India for developing confidence – and trust – building measures (CTBMs) in cyberspace, including information sharing, incident reporting, joint monitoring, etc.

Another aspect is the international framework for fighting cyber crime. While significant attention is now paid by Indian experts to the Council of Europe’s Convention on Cyber Crime, there is no mention in the NCSP on India’s place in the international system of coordinates in countering cyber crime. This agenda should not be approached in an isolated framework of a separate document, as it is an inherent part of a national cyber security strategy.

2. An integrated institutional framework of a nation level cyber security system. Several important steps are mentioned in the NCSP, including establishment of a 24x7 National Critical Information Infrastructure Protection System, as well as the setting up of a nodal agency responsible for coordination of all national cyber security matters and strengthening the national system of CERTs. Still, there is no holistic institutional framework visible in the document. Which cyber issues remain in the domain of the Defence Ministry, how are they handled and how are the responsibilities divided between military and civil agencies and units? Who is in charge of conducting a response against a massive cyber attack against government and private assets in cyberspace? What should be the hierarchy and division of responsibilities between the newly established nodal agency and previously established units like monitoring centres and IT security task forces?

 

There is much work to be done in order to make the next important step – i.e., elaboration of an Indian national cyber security strategy, a currently ongoing process. Among many other vital issues that the authors of Indian strategy will certainly face is international cooperation in the field of CII protection. This is particularly important because recent practice shows that most sophisticated attacks target CII, including nuclear, oil and gas facilities and power grids, and in many cases they are too complicated to be effectively investigated only by national security services or private experts of a state which is facing the attack. A case in point is Stuxnet: the first known precedent of cyber sabotage implemented through the use of a very advanced malware to covertly control the work of SCADA. It was first discovered and investigated by a Belorussian IT-security company, then the Russian Kaspersky lab. Kaspersky lab was invited through the ITU-IMPACT mechanism to investigate the case of sophisticated attacks on SCADA of an oil plant in one of the Gulf states as local experts were not even able to identify the malware properly.

 

The conclusion here is quite clear – the best talent must be recruited not only nationally, but the world over, in order for the best world practices, skills and experience to counter sophisticated attacks against critical information infrastructure. And therefore, a mechanism to share best practices globally is needed. One promising option for that is the mechanism of international public-private partnerships (PPPs), which is also the legal format of the IMPACT-ITU alliance bringing together many private enterprises from the IT security sector (Russian Kaspersky lab and Group IB among them) and 146 nation states including India. The role of ITU-IMPACT in the context of Indian cyber security strategy must be identified. Whether India should use this experience in order to develop similar mechanisms on a regional level where states will be engaged also needs deliberation.

Another topical agenda for India that might require some push on the international front concerns cyber security of nuclear infrastructure. In July 2013, PIR Centre conducted a situation analysis dedicated to cyber attacks against nuclear infrastructure by unknown politically motivated proxy actors. According to the situation analysis, two Indian Nuclear Power Plants (NPPs) Tarapur-1 and Tarapur-2 located 130 kilometres from Mumbai, with their old single circuit reactors were attacked when their SCADA systems of external power grid and condensate-feed water systems were hit by a sophisticated worm. Many issues related to international law emerged, but most of them remain unanswered. One of them was surprisingly related to the India-Pakistan Non-Attack Agreement of 1988 and its provisions concerning a ban on attacks on NPPs. Would a cyber attack similar to Stuxnet fall under the agreement if presumably conducted by Pakistan or Pakistani-led proxy actors? The answer is not clear, and thus the question demands clarification. There are plenty of similar conceptually challenging issues related to critical infrastructure protection, cyber defence and adaptation of international law to cyber conflicts that need hammering out.

 

To conclude, it seems that some homework remains to be done by the Indian government and all major stakeholders to reach a consensus on an integrated national vision of cyber security agenda in its international aspects and implications. The time to do so is now. The NCSP is a timely step, which should be followed by a document focusing on an international agenda. Here, Russia with its rich experience and well developed vision could be an important partner for India; a strategic Russian-Indian dialogue on international cyber security ecosystem might be a fruitful and mutually beneficial initiative, given that Russia also has much to learn from India’s cyber security background, particularly the experience of engaging the private sector to play a leading role in achieving national cyber security goals.