CYBER WARFARE AND CYBER TERRORISM

HIDAYATULLAH NATIONAL LAW UNIVERSITY

TRANSNATIONAL CRIME AND LAW(HONS-II) PROJECT

ON

CYBER WARFARE AND CYBER TERRORISM

SUBMITTED TO

M/s. MADHURIMA DE SARKAR

VIKASH GOEL

SEMESTER IX

ROLL NO. 172

SUBMITTED ON
 CYBER WARFARE AND CYBER TERRORISM

26TH SEPTEMBER, 2016

Acknowledgement

I feel highly elated to work on this dynamic topic on CYBER WARFARE AND CYBER
TERRORISM. Its ratio is significant in todays era when there is significant progress in the field of
internet and technology and growing threat of cyber terrorism on the whole world .

The practical realization of this project has obligated the guidance of many persons. I express my deepest
regard for our faculty M/s. Madhurima De Sarkar. Her consistent supervision, constant inspiration and
invaluable guidance and suggestions have been of immense help in carrying out the project work with
success.

I extend my heartfelt thanks to my family and friends for their moral support and encouragement.

Vikash Goel

Semester IX TH

Roll no. 172

 CYBER WARFARE AND CYBER TERRORISM

Table of Contents

Acknowledgement.....................................................................................................2

INTRODUCTION.....................................................................................................3

STATEMENT OF PROBLEM..................................................................................5

HYPOTHESIS...........................................................................................................5

OBJECTIVE..............................................................................................................5

REVIEW OF LITERATURE....................................................................................6

RESEARCH METHODOLOGY..............................................................................6

CYBER WARFARE AND CYBER TERRORISM - AN INSIGHT.........................7

Growth trends of cyber-terrorism..............................................................................9

The Attraction of Cyberterrorism for Terrorists......................................................12

The Cyber-warfare Ecosystem................................................................................13

CYBER WARFARE AND CYBER TERRORISM - VICTIMS & EXAMPLES. .15

CYBER CRIME & WORLD PERSPECTIVE.......................................................16

PREVENTION/FIGHTING CYBER WARFARE AND CYBER TERRORISM. .17

Multilateral responses to threats of cyber terrorism................................................18

CYBER LAW IN INDIA........................................................................................23

 CYBER WARFARE AND CYBER TERRORISM

CONCLUSION.......................................................................................................26

REFERENCES........................................................................................................28

INTRODUCTION
The world of Internet today has become a parallel form of life and living. The public are now
capable of doing things which were not imaginable few years ago. The Internet is fast becoming
a way of life for millions of people and also a way of living because of growing dependence and
reliance of the mankind on these machines. Internet has enabled the use of website
communication, email and a lot of anytime anywhere IT solutions for the betterment of human
kind.

Internet, though offers great benefit to society, also present opportunities for crime using new
and highly sophisticated technology tools. Today e-mail and websites have become the preferred
means of communication. Organizations provide Internet access to their staff. By their very
nature, they facilitate almost instant exchange and dissemination of data, images and variety of
material. This includes not only educational and informative material but also information that
might be undesirable or anti-social. Regular stories featured in the media on computer crime
include topics covering hacking to viruses, web-jackers, to internet paedophiles, sometimes
accurately portraying events, sometimes misconceiving the role of technology in such activities.
Increase in cyber crime rate has been documented in the news media. Both the increase in the
incidence of criminal activity and the possible emergence of new varieties of criminal activity
pose challenges for legal systems, as well as for law enforcement1

Cyber Warfare is using computers over the Internet to conduct acts of warfare against other

1 Buchan, Glenn C., "Implications of Information Vulnerabilities for Military

Operations, in Khalilzad and White, The Changing Role of Information in Warfare,
Rand, 1999
 CYBER WARFARE AND CYBER TERRORISM

websites or groups on the Internet. This could include defacing websites, distributed denial of
service attacks, distributing propaganda, and gathering classified data over the Internet. Cyber
Terrorism is different from Cyber Warfare. Cyber Warfare can be inconvenient from having to
clean up a website from vandalism or suffering from downtime because of a denial of service
attack. With Cyber Terrorism, violence can result from an attack.2

The term cyber terrorism was coined in1996 by combining the terms cyberspace and
terrorism. Cyber terrorism is the dark side of the web world. Cyber terrorism is the
premeditated, politically motivated attack against information, computer systems, computer
programs, and data which result in violence against noncombatant targets by sub national groups
or clandestine agents. It is the use of disruptive activities or the threat thereof, in cyber space,
with the intention to further social, ideological, religious, political or similar objectives, or to
intimidate any person in furtherance of such objectives.3

According to Mark Pollitt of the Federal Bureau of Investigation, the definition of Cyber
Terrorism is, the premeditated, politically motivated attack against information, computer
systems, computer programs, and data which results in violence against noncombatant targets by
sub national groups or clandestine agents. This definition according to Verton, covers both
cyber terrorism and terrorism in general, he continues on that, not only can systems be
attacked through cyber means, but also attacking the physical hardware that makes up computer
systems.

2 Barton Gellman, Cyber attacks by al Qaeda feared: Experts: Terrorists at

threshold of using Web as deadly tool, The Washington Post, June 27, 2002

3 DeNileon, Guy, The Who, What Why and How of Counter-terrorism Issues,
American Water Works Association Journal, May 2001, Volume 93, No. 5, pp. 7885
 CYBER WARFARE AND CYBER TERRORISM

STATEMENT OF PROBLEM
The research deals with the imminent threat of cyber warfare and cyber terrorism to world
security whose importance has grown owing to the evolution of cyberspace and internet. It also
deals with the various preventive steps that mat be undertaken to tackle the same. Towards the
end, it deals with the various international and national laws that are intended to deal with the
problem.

HYPOTHESIS
The threat of cyber warfare and cyber terrorism can be effectively dealt with under the present
system of crime prevention at national and international level.
 CYBER WARFARE AND CYBER TERRORISM

OBJECTIVE
The objective of the project is:

1. Study the concept of cyber warfare and cyber terrorism

2. Study the victims and examples of the threat

3. Study about the prevention of cyber warfare and cyber terrorism

4. Study the law dealing with the threat in India.

REVIEW OF LITERATURE

Verton, D (2003). Black Ice: The Invisible Threat of Cyber-Terrorism, Cyber-terrorists

are state-sponsored and non-state actors who engage in cyber-attacks to pursue their
objectives. Transnational terrorist organizations, insurgents, and jihadists have used the
Internet as a tool for planning attacks, radicalization and recruitment, a method of
propaganda distribution, and a means of communication, and for disruptive purposes.
While no unclassified reports have been published regarding a cyber-attack on a critical
component of U.S. infrastructure, the vulnerability of critical life-sustaining control
systems being accessed and destroyed via the Internet has been demonstrated.
Singh Talwant, Addl. Distt. & Sessions Judge, Delhi, Cyber Law & Information
Technology, India has a law on evidence that considers admissibility, authenticity,
accuracy, and completeness to convince the judiciary. The challenge in cyber crime cases
includes getting evidence that will stand scrutiny in a foreign court. For this India needs
total international cooperation with specialized agencies of different countries. Police has
to ensure that they have seized exactly what was there at the scene of crime, is the same
that has been analyzed and the report presented in court is based on this evidence. It has
to maintain the chain of custody. The threat is not from the intelligence of criminals but
 CYBER WARFARE AND CYBER TERRORISM

from our ignorance and the will to fight it. The law is stricter now on producing evidence
especially where electronic documents are concerned.

RESEARCH METHODOLOGY

The method of research adopted is analytical in nature. I have referred sources on the internet as
well as a few books on Transnational Law available in the university library besides adding my
personal views and knowledge of the topic. Books and other references as guided by the faculty
of Transnational Law have been primarily helpful in giving this project a firm structure.
Websites, dictionaries and articles have also been referred.

CYBER WARFARE AND CYBER TERRORISM - AN INSIGHT

Cyber Warfare and Cyber Terrorism have both similarities and differences. They are similar in
sense that both involve using computer systems against other computer systems, although with
Cyber Terrorism the physical system can also be targeted. They are both different because in
Cyber Terrorism, violence can occur, such as people can be hurt or killed.

There are many reasons why these attacks occur. Probably one of the main reasons is to state a
goal or objective that disagrees with a view of another community. For example, an anti-abortion
group defacing an abortion clinics website, or performing a denial of service against a website
so that people cannot access it and receive information from it. These would be acts of Cyber
Warfare.

With Cyber Terrorism, these attacks occur because of numerous reasons. The word terrorism
itself has the word terror in it, which means to strike fear and dread into an individual. There
have been many Terrorism attacks throughout history, including the one on September 11, 2001.
 CYBER WARFARE AND CYBER TERRORISM

With Cyber Terrorism, it uses that fear and dread by utilizing it over the Internet to attack
computer systems that control numerous things, hacking government websites and stealing top
secret information that could be used against that government by the terrorists. Similar to Cyber
Warfare, most terrorist goals, besides striking fear into other groups and nations, is to convey a
political message to the government or nation that they oppose.4

There are various reasons for these cyber attacks are:

Fear Factor - The most denominator of the majority of the attacks is terrorists wishing to

create fear in individuals groups and societies. The best example is bombing of Bali
Nightclub, in 2002. This night club was nothing but watering for foreign tourists. The
influx of foreign tourists to Bali was significantly reduced after this attack.

Spectacular Factor - Spectacular means attacks aimed at either creating huge direct losses

and/or resulting in a lot of negative publicity. In 1999, the Amazon.com Web site was
closed for some time due to a denial of service (DOS) attack.

Vulnerability factor - Cyber activities do not always end up with huge financial losses.

Some of the most effective ways to demonstrate an organizations vulnerability is to

cause a denial of service to the commercial server or something as simple as the
defacement of an organizations Web pages, very often referred to as computer graffiti.

In general, todays cyber attacks consist primarily of:

Virus and worm attacks that are delivered via e-mail attachments, Web browser

scripts, and vulnerability exploit engines.

4 M. A. Vatis.. Cyber Attacks During the War on Terrorism: A Predictive Analysis,

2001. Special Report, Institute for Security and Technology Studies
 CYBER WARFARE AND CYBER TERRORISM

Denial of service attacks designed to prevent the use of public systems by legitimate

users by overloading the normal mechanisms inherent in establishing and maintaining

computer-to-computer connections.

Web defacements of informational sites that service governmental and commercial

interests in order to spread disinformation, propaganda, and/or disrupt information

flows.

Unauthorized intrusions into systems that lead to the theft of confidential and/or

proprietary information, the modification and/or corruption of data, and the inappropriate
usage of a system for launching attacks on other systems.

Growth trends of cyber-terrorism

The roots of the notion of cyber-terrorism can be traced back to the early 1990s, when the rapid
growth in Internet use and the debate on the emerging information society sparked several
studies on the potential risks faced by the highly networked, high-tech dependent United States.
As early as 1990, the National Academy of Sciences began a report on computer security with
the words, We are at risk. Increasingly, America depends on computers. . . . Tomorrows
terrorist may be able to do more damage with a keyboard than with a bomb. At the same time,
the prototypical term electronic Pearl Harbor was coined, linking the threat of a computer
attack to an American historical trauma.

Its no surprise, argues Green, that cyber-terrorism now ranks alongside other weapons of
mass destruction in the public consciousness . . . but theres just one problem: There is no such
 CYBER WARFARE AND CYBER TERRORISM

thing as cyber-terrorismno instance of anyone ever having been killed by a terrorist (or
anyone else) using a computer. Nor is there compelling evidence that al Qaeda or any other
terrorist organization has resorted to computers for any sort of serious destructive activity. 5 It
seems fair to say that the current threat posed by cyber-terrorism has been exaggerated. No
single instance of cyber-terrorism has yet been recorded: there were politically motivated cyber-
attacks, as a form of protest, usually involving website defacements (with a political message) or
some types of denial of service (DoS) attack.5 However, while the cyber-attacks were politically
motivated, from the outset the attacks were incapable of harming people or property or instilling
fear into the target population. Its impact was primarily designed to cause disruption and did not
have a serious impact on critical services or infrastructure. The vast majority of cyber-attacks are
launched by hackers with few if any political goals and no desire to cause the mayhem and
carnage of which terrorists dream. So, then, why has so much concern been expressed over a
relatively minor threat?

The reasons for the popularity of cyberterrorism angst are many. Psychological, political, and
economic forces have combined to promote the fear of cyberterrorism. First, from a
psychological perspective, two of the greatest fears of modern time are combined in the term
cyberterrorism. The fear of random, violent victimization segues well with the distrust and
outright fear of computer technology. An unknown threat is perceived as more threatening than a
known threat. Although cyberterrorism does not entail a direct threat of violence, its
psychological impact on anxious societies can be as powerful as the effect of terrorist bombs.
Moreover, the most destructive forces working against an understanding of the actual threat of
cyberterrorism are a fear of the unknown and a lack of information or, worse, too much
misinformation. 6

5 Cited in E. Montalbano. 2004. Homeland Security Chair likens Cyber Terrorists to Al

Qaeda. CRN News

6 T. Spellman. 2004. Expert: U.S. At Risk of Cyberterrorism. The Dartmouth Online, 19 April
2004
 CYBER WARFARE AND CYBER TERRORISM

Second, the mass media have added their voice to the fearful chorus, trumpeting the threat with
front-page headlines such as the following, which appeared in The Washington Post in June
2003: Cyber-Attacks by Al Qaeda Feared, Terrorists at Threshold of Using Internet as Tool of
Bloodshed, Experts Say. Cyberterrorism, the media have discovered, makes for eye-catching,
dramatic copy.

Ignorance is a third factor. Cyberterrorism merges two spheresterrorism and technologythat

many people, including most lawmakers and senior administration officials, do not fully
understand and therefore tend to fear. Moreover, some groups are eager to exploit this ignorance:
Numerous technology companies, still reeling from the collapse of the tech bubble, have recast
themselves as innovators crucial to national security and boosted their Washington presence in
an effort to attract federal dollars. As Ohio State University law professor Peter Swire argued,
Many companies that rode the dot-com boom need to find big new sources of income. One is
direct sales to the federal government; another is federal mandates. If we have a big federal push
for new security spending, that could prop up the sagging market.

To study terrorism, on the Internet or elsewhere, a definition of what terrorism is must be found.
Even though most people can recognize terrorism when they see it, experts have had difficulty
coming up with an ironclad definition. There are more than one hundred different definitions
offered by scholars.11 Thus, a more fruitful approach would be to characterize terrorism;
Mullins provides a starting point by highlighting the terror of terrorism, that is, the argument
or pre-condition that without the terror induced by the terrorist, there can be no terrorism. 7Fear
is a key element in terrorism, and it is the fear evoked by the individuals or the small groups of
individuals whose capacity to constraint the behavior of others resides not in reason, in
numerical preponderance, or in any legitimate exercise of authority, but only in their perception
that they are able and willing to use violence unless their demands are satisfied.13 Hoffman
defined terrorism as Violence, or the threat of violence, used and directed in pursuit of, or in
service of, a political aim. The U.S. State Department defines terrorism as premeditated,
7 D. Verton. Cyberterrorism & security: New definitions for new realities, paper presented at
the Cato Institute Book Forum, 12 November 2003b, Washington, DC.
 CYBER WARFARE AND CYBER TERRORISM

politically motivated violence perpetrated against noncombatant targets by subnational groups or

clandestine agents, usually intended to influence an audience. These characteristics clearly
leave most of the cyberattacks if not all of them outside the cyberterrorism category. There is
also the confusion between cyberterrorism and cybercrime. Such confusion is partly caused by
the lack of clear definitions of the two phenomena. Cybercrime and cyberterrorism are not
coterminous. Cyberspace attacks must have a terrorist component in order to be labeled
cyberterrorism. The attacks must instill terror as commonly understood (that is, result in death
and/or large-scale Cyberterrorism destruction), and they must have a political motivation.
Moreover, regarding the distinction between terrorist use of information technology and
terrorism involving computer technology as a weapon/target, only the latter may be defined as
cyberterrorism. Terrorist use of computers as a facilitator of their activities, whether for
propaganda, recruitment, datamining, communication, or other purposes, is simply not
cyberterrorism. Terrorists increasingly are using the Net to post messages, launch psychological
campaigns, learn about potential targets, coordinate their actions, raise funds, and even conduct
virtual training, but all these activities belong to the conventional, instrumental category and not
to cyberattacks aimed at computer networks or the Internet itself.

A fourth reason is that some politicians, whether out of genuine conviction or out of a desire to
stoke public anxiety about terrorism in order to advance their own agendas, have played the role
of prophets of doom. After 9/11, the security and terrorism discourse soon featured
cyberterrorism prominently.

The Attraction of Cyberterrorism for Terrorists

Cyberterrorism is an attractive option for modern terrorists for several reasons:

First, it is cheaper than traditional terrorist methods. All that the terrorist needs is a personal
computer and an online connection. Terrorists do not need to buy weapons such as guns and
explosives; instead, they can create and deliver computer viruses through a telephone line, a
cable, or a wireless connection.
 CYBER WARFARE AND CYBER TERRORISM

Second, cyberterrorism is more anonymous than traditional terrorist methods. Like many
Internet surfers, terrorists use online nicknamesscreen namesor log on to a website as an
unidentified guest user, making it very hard for security agencies and police forces to track
down the terrorists real identity. And in cyberspace there are no physical barriers such as
checkpoints to navigate, no borders to cross, no customs agents to outsmart. 8

Third, the variety and number of targets are enormous. The cyberterrorist could target the
computers and computer networks of governments, individuals, public utilities, private airlines,
and so on. The sheer number and complexity of potential targets guarantees that terrorists can
find weaknesses and vulnerabilities to exploit. Several studies have shown that critical
infrastructures, such as electric power grids and emergency services, are vulnerable to a
cyberterrorist attack because the infrastructures and the computer systems that run them are
highly complex, making it effectively impossible to eliminate all weaknesses.9

Fourth, cyberterrorism can be conducted remotely, a feature that is especially appealing to

terrorists. Cyberterrorism requires less physical training, psychological investment, risk of
mortality, and travel than conventional forms of terrorism, making it easier for terrorist
organizations to recruit and retain followers.

Fifth, as the I LOVE YOU virus showed, cyberterrorism has the potential to affect directly a
larger number of people than traditional terrorist methods, thereby generating greater media
coverage, which is ultimately what terrorists want.

The Cyber-warfare Ecosystem

A Variety of Threat Actors Criminals, terrorists, and spies rely heavily on cyber-based
8 DeNileon, Guy, The Who, What Why and How of Counter-terrorism Issues,
American Water Works Association Journal, May 2001, Volume 93, No. 5, pp. 7885,

9 Larissa Paul, When Cyber Hacktivism Meets Cyberterrorism, SANS Institute,

February 19, 2001
 CYBER WARFARE AND CYBER TERRORISM

technologies to support organizational objectives. Commonly recognized cyber-aggressors and

representative examples of the harm they can inflict include the following:

Cyber-terrorists are state-sponsored and non-state actors who engage in cyber-attacks to pursue
their objectives. Transnational terrorist organizations, insurgents, and jihadists have used the
Internet as a tool for planning attacks, radicalization and recruitment, a method of propaganda
distribution, and a means of communication, and for disruptive purposes. While no unclassified
reports have been published regarding a cyber-attack on a critical component of U.S.
infrastructure, the vulnerability of critical life-sustaining control systems being accessed and
destroyed via the Internet has been demonstrated. In 2009, the Department of Homeland
Security (DHS) conducted an experiment that revealed some of the vulnerabilities to the nations
control systems that manage power generators and grids. The experiment, known as the Aurora
Project, entailed a computer-based attack on a power generators control system that caused
operations to cease and the equipment to be destroyed. Cyber-terrorists may be seeking a
destructive capability to exploit these vulnerabilities in critical infrastructure. 10

Cyber-spies are individuals who steal classified or proprietary information used by governments
or private corporations to gain a competitive strategic, security, financial, or political advantage.
These individuals often work at the behest of, and take direction from, foreign government
entities. Targets include government networks, cleared defense contractors, and private
companies. For example, a 2011 FBI report noted, a company was the victim of an intrusion
and had lost 10 years worth of research and development datavalued at $1 billionvirtually
overnight. Likewise, in 2008 the Department of Defenses (DOD) classified computer network
system was unlawfully accessed and the computer code, placed there by a foreign intelligence
agency, uploaded itself undetected onto both classified and unclassified systems from which data
could be transferred to servers under foreign control.11

10 A. Lake. Six Nightmares (New York: Little, Brown and Company, 2000)

11 . M. A. Vatis.. Cyber Attacks During the War on Terrorism: A Predictive Analysis,

2001. Special Report, Institute for Security and Technology Studies
 CYBER WARFARE AND CYBER TERRORISM

Cyber-thieves are individuals who engage in illegal cyber-attacks for monetary gain. Examples
include an organization or individual who illegally accesses a technology system to steal and use
or sell credit card numbers and someone who deceives a victim into providing access to a
financial account. One estimate has placed the annual cost of cybercrime to individuals in 24
countries at $388 billion. However, given the complex and sometimes ambiguous nature of the
costs associated with cybercrime, and the reluctance in many cases of victims to admit to being
attacked, there does not appear to be any publicly available, comprehensive, reliable assessment
of the overall costs of cyber-attacks.

Cyber-warriors are agents or quasi-agents of nation-states who develop capabilities and

undertake cyber-attacks in support of a countrys strategic objectives.7 These entities may or
may not be acting on behalf of the government with respect to target selection, timing of the
attack, and type(s) of cyber-attack and are often blamed by the host country when accusations
are levied by the nation that has been attacked. Often, when a foreign government is provided
evidence that a cyber-attack is emanating from its country, the nation that has been attacked is
informed that the perpetrators acted of their own volition and not at the behest of the
government. In August 2012 a series of cyber-attacks were directed against Saudi Aramco, the
worlds largest oil and gas producer. The attacks compromised 30,000 computers and the code
was apparently designed to disrupt or halt oil production. Some security officials have suggested
that Iran may have supported this attack. However, numerous groups, some with links to nations
with objectives counter to Saudi Arabia, have claimed credit for this incident.

Cyber-activists are individuals who perform cyber-attacks for pleasure, philosophical, political,
or other nonmonetary reasons. Examples include someone who attacks a technology system as a
personal challenge (who might be termed a classic hacker), and a hacktivist such as a
member of the cyber-group Anonymous who undertakes an attack for political reasons. The
activities of these groups can range from nuisance-related denial of service attacks and website
defacement to disrupting government and private corporation business processes. The threats
posed by these cyber-aggressors and the types of attacks they can pursue are not mutually
exclusive. For example, a hacker targeting the intellectual property of a corporation may be
 CYBER WARFARE AND CYBER TERRORISM

categorized as both a cyber-thief and a cyber-spy.

CYBER WARFARE AND CYBER TERRORISM - VICTIMS &

EXAMPLES

With Cyber Warfare, any website on the Internet and the people who are affiliated with them can
be affected by Cyber Warfare attacks. Going back to the previous example of the abortion clinic,
not only has the website been defaced by an anti-abortion group, it effects the people who run
the website, mainly those of the abortion clinic, and people who support abortion can be affected
by this act of vandalism. Also depending on the intensity of the vandalism, the clinic itself can
lose credibility. On the other side of this spectrum, the people who are against abortion are
pleased with the results.

Another example of who is affected by Cyber Warfare would be going back to the denial of
service attack against a website. Say this website is a bank website, and a hacker performs a
denial of service attack against this website. The website can now not be accessed by its patrons,
causing them not to be able to access their accounts, forcing them to physically go to the bank to
perform their daily transactions, increasing the business of the bank with lots of unhappy
patrons. This also affects the reputation of the banks online security, possibly scaring people out
of that bank and into another bank where they may feel more secure. On a side note, this attack
could have been performed by a rival bank to scare people out of one bank and having them
come to their bank. These are just a few possible ways of Cyber Warfare.12
With Cyber Terrorism either a small amount of people can be affected or entire nations can be
affected. A sinister Cyber Terrorism plot that was foiled would have occurred sometime in 1996
in London. Members of the Irish Republican Army (IRA) were planning to blow up and destroy
six key electric substations in London. Had the IRA succeeded in their goal, they would have
disrupted power to major portions of London for months.

12 D. Verton. Black Ice: The Invisible Threat of Cyberterrorism (New York: McGraw-
Hill Osborne Media, 2003a).
 CYBER WARFARE AND CYBER TERRORISM

CYBER CRIME & WORLD PERSPECTIVE

The prospect of internet-based warfare has come to the fore after a series of high-profile
international attacks. It has emerged that a gang of hackers, believed to be from China, had
infiltrated computer systems at the Pentagon and launched attacks on government networks in
Britain, Germany, India and Australia. US officials, who have labeled the group Titan Rain, have
accused them of operating under the auspices of officials in Beijing. Another strike in Estonia,
which has one of the most hi-tech governments in the world, was initially blamed on hackers
backed by the Russian authorities. However, only one teenager, an Estonian, has been arrested in
connection with the incident so far.
The annual E-Crime congress is one the largest gatherings of those who work to combat cyber
crime. Delegates included banking experts, police and IT industry luminaries, all keen to
discover new ways to fight online crime.

North Atlantic Treaty Organization (NATO) believes cyber warfare poses as great a threat as a
missile attack. NATO is treating the threat of cyber warfare as seriously as the risk of a missile
strike. Among the chief threats is cyber terrorism, in which attempts are made to shut down
online communication networks or use the internet to attack official institutions. Although some
have warned of the possible threat since the 1980s, it is only in recent years that the issue has
made it onto the radar of governments around the world.

Suleyman Anil, in-charge of protecting NATO against computer attacks and head of NATO's
computer incident response centre, said at the E-Crime congress held in London "Cyber defense
is now mentioned at the highest level along with missile defense and energy security. We have
seen more of these attacks and we don't think this problem will disappear soon. Unless globally
supported measures are taken, it can become a global problem."13

Kevin Poulsen, a former hacker who is now an editor with technology magazine Wired, has
accused politicians and the media of overplaying the fear factor. He opined before the London E-

13 . Hamid Mir, editor of Ausaf newspaper, cited in Verton 2003a, op. cit., p. 108.
 CYBER WARFARE AND CYBER TERRORISM

Crime congress "In some ways, Estonia's attacks were less sophisticated than previous 'cyber
wars' - like those between Israeli and Palestinian hackers, India and Pakistan, China and the US.
Even those attacks fell short of a cyber war, at least as experts have defined the term. I'm
sceptical that real cyber war, or cyber terrorism, will ever take place."

Despite the lack of hard evidence on the nature or identities of cyber terrorists, however, the
threat is deemed serious enough for the White House to allocate $6bn (3bn) for strengthening
its systems against attack.

PREVENTION/FIGHTING CYBER WARFARE AND CYBER

TERRORISM

The real issue is how to prevent cyber crime. For this, there is need to raise the probability of
apprehension and conviction. There is no way to be completely secure from any type of Cyber
Warfare or Cyber Terrorism attack. The more security a computer system has in place, the easier
it can become to attack this system. For Cyber Warfare, one has to deal with securing
information systems, including computer networks, and all the data of a corporation or
government entity, having a good IT security team and security plan will help protect the
companys data. For Cyber Terrorism, physical systems need to be guarded, and if they are high
priority targets subject to attack, the appropriate measures to secure this data need to be in place.

India has a law on evidence that considers admissibility, authenticity, accuracy, and
completeness to convince the judiciary. The challenge in cyber crime cases includes getting
evidence that will stand scrutiny in a foreign court. For this India needs total international
cooperation with specialized agencies of different countries. Police has to ensure that they have
seized exactly what was there at the scene of crime, is the same that has been analyzed and the
report presented in court is based on this evidence. It has to maintain the chain of custody. The
threat is not from the intelligence of criminals but from our ignorance and the will to fight it.
The law is stricter now on producing evidence especially where electronic documents are
 CYBER WARFARE AND CYBER TERRORISM

concerned.

Multilateral responses to threats of cyber terrorism

Response of cyber terrorism by the North Atlantic Treaty Organization (NATO)

As sophisticated political-military alliance, NATO has long been familiar with the use and
defense of electronic and information warfare. For years, NATO is involved in efforts to
transform the military organization and conduct of operations by networking oriented warfare
and network enabled capabilities. At the Prague Summit in November 2002, NATO leaders
decided to strengthen its capabilities to defend against cyber attacks. Decision in Prague resulted
in many initiatives.
A new NATO Cyber Terrorism Program is initiated, involving various NATO bodies: NATO
Communication and Information Systems Services Agency (NCSA), described as the first line
of defense against cyber terrorism, NATO INFOSEC Techinical Center (NITC ), responsible for
communication and computer security; NATO Information Assurance Operations Centre
(NIAOC), responsible for management and coordination of cryptographic equipment in response
to a cyber attack against NATO; NATO Computer Incident Response Capability (NCIRC), whose
task is to protect the NATO encrypted communications systems.14
Following the Summit, NATO established Cyber Defence Management Authority (CDMA), in
order to bring together all key players in the NATO activities related to cyber defense, and better
management of the cyber defense support to any member of the alliance in defense against cyber
attack, upon request.24 At the same time, NATO leaders agreed with the formal establishment of
the NATO Cooperative Cyber Defence Center of Excellence (CCD-CoE), which has been in
development since 2004. The significance of the CCD-CoE, based in Tallinn, was confirmed
during the attack of Estonia in 2007, so in October 2008 the NATO Council grants the Centre

14 D. Verton. Cyberterrorism & security: New definitions for new realities, paper
presented at the Cato Institute Book Forum, 12 November 2003b, Washington, DC.
 CYBER WARFARE AND CYBER TERRORISM

full NATO accreditation and the organisation obtains the status of International Military
Organization. The mission and vision of the CCD-CoE are described as follows: enhance the
capability, cooperation and information sharing among NATO, NATO nations and partners
in cyber defence by virtue of education, research and development, lessons learned and
consultation and to be the main source of expertise in the field of cooperative cyber defence by
accumulating, creating, and disseminating knowledge in related matters within NATO, NATO
nations and partners.

The organization current has elevan nationssponsors:

Estonia, Germany, Hungary, Italy, Latvia, Lithuania, the Netherlands, Poland,
Slovakia, Spain and the USA. Invitation for membership is open to all NATO members,
but cooperation projects are also conducted jointly with NATO partner countries, academia
and the private sector.

United Nations (UN)

Cyber security is one of the main themes on the traditional debates on security policy in the UN
system. Normally this refers to those debates related to the threat of terrorism and in the form of
Resolutions of the UN Security Council. The topic is covered in the work of the Counter
Terrorism Committee established by Security Council, and it is mentioned in the UN Global
Counter-Terrorism Strategy.
In the latter case, the goal is not only counter terrorism in all its forms and manifestations on the
Internet, but also with more active approach to use the Internet as a tool for countering the
spread of terrorism. Wider in the UN systems, cyber security is regularly recognized as a
central feature that will be constantly developed in the international agenda for international
security.
In the UN system, the International Telecommunication Union (ITU) has highest responsibility
for the practical aspects and applications of the international cyber security. The ITU mission
statement embraces the issue of cyber security in direct terms. The purpose of the organization is
to develop con dence in the use of cyberspace through enhanced online security. Achieving of
 CYBER WARFARE AND CYBER TERRORISM

the cyber security and cyber peace are some of the most critical concerns in the ICT
development, and ITU takes concrete measures through its Global Cybersecurity Agenda (GCA).
In September 2008, the ITU and the International Multilateral Partnership Against Cyber Threats
(IMPACT) signed an agreement under which GCA is located in IMPACT headquarter in
Cyberjaya, Malaysia.

Organization for Economic Cooperation and Development (OECD)

Issued in 2002 by the Directorate for Science, Technology and Industry of the OECD, Guidelines
for the Security of Information Systems and Networks have become a standard reference point
for national and international cyber security initiatives. Non-binding guidelines adopted by 19 of
the 30 members of the OECD as well as Brazil, and the European Union. The Guidelines apply
to all participants in the new information society and sug- gest the need for a greater awareness
and understanding of security issues and the need to develop a culture of security. The
guidelines are based on nine complementary principles that organize and implement a safety
culture: Awareness (the need for security of information systems and networks); Responsibility
(all participants are responsible for the security of the information systems and networks);
Response (participants should act on security incidents in timely and co-operative manner);
Ethics (respect the legitimate interests of other users and promotion of best practice); Democracy
(security measures should be compatible with the basic values of a democratic society); Risk
assessment (broad assessment of threats and weaknesses as a basis for risk management);
Security design and implementation (security measures should be an essential feature of
information systems and networks); Security management (comprehensive approach involving
all stakeholders at all levels, addressing threats as they appear); Reassessment (continuous
review, revision and modi cation of security measures as risks evolve).
Other cyber security initiatives include a series of OECD reports on information security and
privacy, including topics such as national guidelines for information security, OECD guidelines
for policies to identify radio frequency and many others, and finally the Working Party on
 CYBER WARFARE AND CYBER TERRORISM

Security of Information and Privacy (WPSIP), which aims is to provide a foundation for
developing national co-ordinated policies. 15

Organization for Security and Co-operation in Europe (OSCE)

OSCEs interest in the challenges of cyber security is increasing. In December 2004, the OSCE
Ministerial Council decided to dedicate to the extent of use of the Internet by terrorist
organizations, including a number of activities, such as recruiting of the terrorists, foundation,
organization and propaganda. 35 Two years later, the foreign ministers called for greater
international cooperation and utilizing more effort to protect vital critical information
infrastructures and networks from the threat of cyber attacks.
The participating countries were asked to closely monitor Web pages of the terrorist and
extremist organizations and to exchange information with other governments in the OSCE and
other relevant forums and it is asked more active participation of civil society institutions and
the private sector in preventing and countering the use of the Internet for terrorist purposes.
OSCEs Permanent Council has also been a venue for debate and discussion concerning cyber
security. 37 In June 2008, for example, Estonian Defence Minister Jaak Aaviksoo spoke about
immense amount of work that has to be done in the the field of cyber security.
The OSCEs Forum for Security Co-operation (FSC) also contributed to the organizations
involvement in the field of cyber security. Although the FSCs work has been concentrated
largely on arms control, disarmament and con dence-building measures,39 lately, the forum
began to be more interested in cyber security. In October 2008, FBS (in joint session with the
Permanent Council) decided to convene an OSCE workshop on a Comprehensive approach to
improving cyber security in March 2009. Finally, the OSCE supports national efforts, such as the
Armenian Forces on Cyber Crime and Cyber Security.16

15 Smart, I. The Power of Terror, in Contemporary Terrorism: Selected Readings,

edited by J. D. Elliot and L. K. Gibson (Gaithersburg, MD: IACP, 1978).

16 Cited in P. Thibodeau. US commission eyes cyberterrorism threat ahead,

Computerworld, 17 September 2001,
 CYBER WARFARE AND CYBER TERRORISM

Council of Europe (CoE)

Contribution of the CoE in the international cyber security policy is primarily through the
Convention on Cyber Crime, which was opened for signature in November 2001 and which
entered into force in July 2004. It is important to note that, although the Convention was signed
by 46 countries, including Canada, Japan, South Africa and the U.S., until today it has been rati
ed by only 26 countries, including Macedonia, Albania, Croatia, Estonia, Hungary, Lithuania,
Romania and Slovenia, 11EU states have yet to ratified the Convention and five CoE member
states have not even signed (including Russia). Convention was signed and ratified by countries
that are not members of the CoE (Canada, Japan, South Africa and USA).42 Sixteen other
countries that are not members of the Council of Europe are reported as known to use the
Convention as a guideline for their national legislation (including Brazil and India).
The CoE Convention on Cybercrime is important for several aspects. First, the Convention
addresses the illegal activities and practices that features across spectrum of cyber security
threats. Second, the Convention establishes common standards and procedures that are legally
binding on its signatories. Third, the Convention is open to the Member States of the CoE and
others, which increases its authority as an international instrument. Finally, the Convention
introduced requirements for handling data and access that have led to concerns about the privacy
law and civil liberties.

G-8
The main contribution of the G-8 in international cyber security policy is a Subgroup of High-
Tech Crime, created as a subset of Lyon Group in 1996 to combat trans- national organized
crime. The purpose of this subgroup was to enhance the ability of the G-8 countries to protect,
investigate and prosecute crimes committed using computers, network communications, and
other new technologies. The mission of the subunit was subsequently extended to include the
use of the Internet by terrorists and the protection of critical information infrastructure. Subgroup
is trying to deal with cyber crime not only within the jurisdiction of the G8 countries, but also to
create guidelines that could take and implement other countries. The subgroup has created 24/7
network of contact for high-tech crime and international Critical Information Infrastructure
Protection (CCIP) Directory.
 CYBER WARFARE AND CYBER TERRORISM

Subgroup has published its best practice documents and guidelines for assessment of threats
to computer and network security and has organized international training conferences for cyber-
crime agencies.17

CYBER LAW IN INDIA

Cyber Law is seen as an essential component of criminal justice system all over the world. The
same applies to cyber law of India as well. The computer is the target and the tool for the
perpetration of crime. It is used for the communication of the criminal activity such as the
injection of a virus/worm which can crash entire networks.

The Information Technology (IT) Act, 2000, specifies the acts which have been made
punishable. Since the primary objective of this Act is to create an enabling environment for
commercial use of I.T., certain omissions and commissions of criminals while using computers
have not been included. With the legal recognition of Electronic Records and the amendments
made in the several sections of the IPC vide the IT Act, 2000, several offences having bearing on
cyber-arena are also registered under the appropriate sections of the IPC.

17 R. Bendrath. The American Cyber-Angst and the Real World. In Robert Latham
(Ed.): Bombs and Bandwidth: The Emerging Relationship between IT and Security
(New York: The New Press, 2003), pp. 4973.
 CYBER WARFARE AND CYBER TERRORISM

India is the 12th country of the world having a cyber law. It covers areas like e-governance, e-
commerce, cyber contraventions and cyber offences. However, some critics and cyber law
experts have questioned the strength of IT Act, 2000.

Although India has done a good job by enacting the IT Act, 2000 yet it failed to keep it updated.
For instance, we need express provisions and specified procedures to deal with issues like denial
of service (DOS), distributed denial of services (DDOS), bot, botnets, trojans, backdoors, viruses
and worms, sniffers, SQL injections, buffer overflows etc. These issues cannot be left on mere
luck, implied provisions or traditional penal law of India (IPC). Even issues like cyber war
against India or cyber terrorism against India have not been incorporated into the IT Act, 2000
yet.

Some of these issues are also cross-linked with capacity building requirements of India in the
field of cyber security in India and cyber forensics in India. A crucial truth that India failed to
appreciate is that e-governance in India is useless till we are capable of securing it as well.
Without the crucial capabilities in the fields of cyber security and cyber forensics, India is
heading towards a big trouble. Even the basic e-mail tracking procedures sometimes pose as a
big challenge before the law enforcement agencies in India. Interestingly, some of the legal
experts have shown their support for prosecuting owners of e-mail addresses and Internet
Protocol addresses relying upon common law principles not knowing exactly the nature of the
Internet.

It would be a dangerous trend to follow to arrest or detain suspects on the basis of mere IP
addresses or e-mail addresses as they are very easy to be spoofed and forged. Eve n MAC
addresses can be spoofed in certain circumstances and for many purposes, particularly for
identity theft cases in wireless connections. It is important to apply common sense and first
ascertain the identity of real culprit. Of course, it requires tremendous cyber forensics expertise
to correctly trace the culprit. The recent case of wrongfully arresting an innocent person and
imprisoning him for a considerable time is a glaring example of faulty and novice cyber
forensics application in India. The inability of the Government of India to meet these
 CYBER WARFARE AND CYBER TERRORISM

conspicuous deficiencies of the legal enablement of ICT systems in India is stifling the growth
of ICT laws in India.

The present cyber law of India does not cover these issues and there is a dire need of
incorporating the same as soon as possible.

Some of the Statutory Provisions under Indian Law to combat cyber crimes are:

The Indian parliament considered it necessary to give effect to the resolution by which the
General Assembly adopted Model Law on Electronic Commerce adopted by the United Nations
Commission on Trade Law. As a consequence of which the Information Technology Act 2000
was passed and enforced on 17th May 2000. The preamble of this Act states its objective to
legalise e-commerce and further amend the Indian Penal Code 1860, the Indian Evidence Act
1872, the Bankers Book Evidence Act1891 and the Reserve Bank of India Act 1934. The basic
purpose to incorporate the changes in these Acts is to make them compatible with the Act of
2000. So that they may regulate and control the affairs of the cyber world in an effective
manner.

The Information Technology Act deals with the various cyber crimes in chapters IX & XI. The
important sections are Ss. 43,65,66,67.
i. Section 43 in particular deals with the unauthorised access, unauthorised downloading,
virus attacks or any contaminant, causes damage, disruption, denial of access,
interference with the service availed by a person. This section provide for a fine up to Rs.
1 Crore by way of remedy.
ii. Section 65 deals with tampering with computer sourcedocuments' and provides for
imprisonment up to 3 years or fine, which may extend up to 2 years or both.
iii. Section 66 deals with hacking with computer system and provides for imprisonment up
to 3 years or fine, which may extend up to 2 years or both.
iv. Section 67 deals with publication of obscene material and provides for imprisonment up
to a term of 10 years and also with fine up to Rs. 2 lakhs
 CYBER WARFARE AND CYBER TERRORISM

CONCLUSION

Cyber Warfare and Cyber Terrorism are a growing threat in this world. More and more groups
are becoming aware of the possibility of Cyber Warfare and Cyber Terrorism. Cyber Terrorism
has been occurring within the last twenty years and as time progresses and more and more
nations become even more computerized, there will be more and more attacks through
cyberspace.

A survey released by the UK government has revealed that the British public is now more
fearful of cyber crime than burglary and crimes against the person. According to its results,
Internet users fear bankcard fraud the most (27 percent), followed by cyber crime (21 percent)
and burglary (16 percent). This shows that hi-tech crime has firmly overtaken conventional
burglaries, muggings and thefts in the list of the publics fears, as the Internet has become firmly
 CYBER WARFARE AND CYBER TERRORISM

embedded into the British society, with some 57 percent of households having online access.
Interestingly, University of Abertay in Dundee, Scotland (UK) is now offering a BSc Hons in
Ethical Hacking and Countermeasures.

Although hard, it is possible to try and combat cyber terrorism through the securing of systems,
but there will always be an exploit someplace whether its through the computer or through the
gullible user. Cyber Terrorism and Cyber Warfare are a looming threat in this technologically
advancing world.

The traditional national defense strategies are ill suited to protect the nations against this threat.
Enemies can launch a devastating attack, from almost anywherea cafe in London, a cave in
Afghanistan, or a coffee shop in our Midwest. They can mobilize large networks of captured
computers from around the world to do their bidding. They can do so with almost no trail, no
return address. Enemies of this kind, attacks of this nature, are almost impossible to deter, and
even harder to preempt.

In the face of threats, the systems that are to be depend upon, are vulnerable to the most
simplistic of hackers, even as constant efforts by sophisticated enemies to penetrate the systems,
probe vulnerabilities, plan future attacks and inject sleeper weapons into the IT systems is faced.

It is high time to make concentrated effort otherwise nations would leave themselves
unacceptably open to a devastating attack on our nation. Such an attack could compromise the
integrity of the financial industry. It could turn off the power to entire regions of the nation. It
could strike at any one of vital infrastructure sectors without warning and with devastating
effect.

Although India has formulated the National Cyber Security Policy of India 2013 (NCSP 2013)
yet it is deficient on many counts. For instance, it has no Coordination with the National Security
Policy of India. Similarly, the NCSP 2013 has Failed to Protect the Privacy Rights in India
(PDF). The Privacy Rights in India in the Information Age (PDF) have not at all been covered by
the NCSP 2013. Similarly, there is no E-Surveillance Policy of India (PDF) framed by Indian
 CYBER WARFARE AND CYBER TERRORISM

Government so far. Obviously, we have no Cyber Warfare Policy of India as well. Even the
Cyber Law of India is weak and ineffective and deserves to be repealed.
The biggest hurdle before curbing Cyber Warfare Threats at the International Level is Lack of
Harmonisation in this regard. Till now we have no Internationally Acceptable Definition of
Cyber Warfare. Further, we have no Universally Acceptable Cyber Crimes Treaty as well. There
is also no International Cyber Security Treaty. India is not a part of any International Treaty or
Conventions regarding Cyber Crimes, Cyber Security, etc. We cannot have a Cyber Warfare
Policy in India till we have a Cyber Crimes Policy in India, Cyber Security Policy in India, cyber
Terrorism Policy in India and other similar Policies. Indian Government must urgently work in
this crucial direction as it is the most urgent need of the hour.

REFERENCES

1. Cyber-Warfare. Wikipedia. Retrieved on April 25, 2008, from http://en.wikipedia.org/wiki/

Cyber-warfare Pollitt, M.M. (1997, October).
2. Cyberterrorism: Fact or Fancy? Proceedings of the 20th National Information Systems
Security Conference, 285-289
3. Verton, D (2003). Black Ice: The Invisible Threat of Cyber-Terrorism, 27-28
4. Johnson Bobbie (2008), The Guardian, Thursday 6 March 2008
5. Information Techology Act, 2000 including its amendments, 2006
 CYBER WARFARE AND CYBER TERRORISM

6. Dalal Praveen (2009), Perry4Law

7. The Washington Post, Internet War, Jan. 25, 2010, available at http://www.
washingtonpost.com/wp-dyn/content/article/2010/01/24/AR2010012402755.html.
8 Kim Zetter, Hackers Targeted Oil Companies for Oil Location Data, Wired.com, Jan. 26,
2010, available at http://www.wired.com/threatlevel/2010/01/hack-for-oil.
9. Federal News Radio, New Cyber Attacks Target Defense Contractors, Jan. 22, 2010, available
at http://www.federalnewsradio.com/?nid=15&sid=1870555.
10.Singh Talwant, Addl. Distt. & Sessions Judge, Delhi, Cyber Law & Information Technology,
available at http://www.indlii.org/CyberLaw.aspx
11.Clinton Hillary, US Secretary of State (2010), Remarks of the Secretary on Internet Freedom,
delivered Jan. 21, 2010, at the Newseum, Washington, D.C.
12.Habiger Gen. Eugene E., USAF (Ret.) (2010) Cyber warfare and Cyber Terrorism: The need
for a new US Strategic Approach, The Cyber Secure Institute, Provoking Cyber Security
Change White Paper Series, White Paper 1:2010