Countering Military Cyber Espionage – Analysis

The Indian military faces persistent cyber espionage challenges, especially from social media platforms. It’s time for a pro-active approach.

By Sameer Patil*

The recent media revelations of the Pakistan Army snooping on Indian army personnel’s phones and computers, reportedly through a malware called ‘SmeshApp,’ is the latest instance of the challenges faced by the Indian military in guarding sensitive and classified information such as the deployment and movement of troops and details of counter-terrorism operations like the January 2016 Pathankot airbase attack. [1] Worse, some personnel were allegedly honey-trapped through fake Facebook profiles to divulge confidential information.

Exactly how much and what kind of information was funneled into Pakistan remains unclear. But it is evident that cyber threats from Pakistan are gradually moving away from website defacing nuisance-value attacks, to serious cyber espionage.

The current revelations come on the heels of the busting of the spy module – which had Indian Air Force and paramilitary personnel who provided national security information to the Pakistan Army’s Inter Services Intelligence. Here too, honey-traps had been used. [2]

Espionage is a game, where any country engaged in harvesting information has to keep upping the ante by constantly inventing new methods and developing new sources to acquire information, by hook or by crook. Therefore, taking a dispassionate view of the tactics of our hostile neighbours, will help to better understand this espionage challenge, especially as cyber snooping technology has become sophisticated and social media has opened new avenues for connecting and communicating with strangers.

The Indian Army is not the only institution subjected to these problems:

• In 2014, the Indian Air Force had alerted its personnel with regard to Xiaomi smart phones as the devices were found to be transmitting phone data to its servers in China. [3]
• In 2012, suspected hackers had breached the computers of the Indian Navy’s Eastern Naval Command and planted malware which transmitted confidential data abroad. [4]

The military is taking preventive steps to plug the leakage of any sensitive information, particularly through social media platforms. Banning sites is not an answer, as the Indian army found when it banned Orkut and MySpace a decade ago, as these are observed more in the breach. And, as serving personnel pointed out, no such ban was imposed on civilian officials working in sensitive security postings, even though those establishments are also exposed. In 2013 for instance, an internal inquiry by the Ministry of Home Affairs on its confidential nationwide information-sharing computer network found that 40% of its computers were connected to the internet, despite written orders prohibiting it.

The Indian Army now has a social media advisory which prohibits Army personnel from disclosing their identity on social media as well as from discussing operational or administrative matters. [5]

This must be complimented by raising awareness within its ranks, especially to emphasise the importance of cyber hygiene, i.e. healthy security practices for online communication. Other countries have taken steps in this direction. For instance, the U.S. Army has issued a social media handbook detailing steps to be taken and Standard Operating Procedures to be followed for its personnel and their families. [6] The Chinese People’s Liberation Army regularly organises lectures on responsible social media behavior, for personnel and their families. [7]

India does neither – despite being a global IT power. A more thoughtful response is required. Social media is an important tool in the battle of perception. Therefore the military has to avoid the barrage of misinformation put forth by inimical elements as well as make strenuous efforts to avoid public criticism of the political leadership by its personnel.

It is critical that India’s military present a comprehensive response. First, is to augment its technical capabilities through upgrading legacy computer systems, installing firewalls and encrypted communication facilities. Second, it must address the weakest link in the cyber security chain: the human element. For instance, the 2012 breach in the navy computers became possible because of the navy personnel’s careless use of the USB pen drives, despite ban on the use of such devices.

After all, this is the age of information warfare.

About the author:
*Sameer Patil is Fellow, National Security, Ethnic Conflict and Terrorism, at Gateway House.

Source:
This feature was written for Gateway House: Indian Council on Global Relations.

References:
[1] Firstpost, SmeshApp: How Pakistan spied on Indian military personnel using an app from the Play Store, 16 March 2016, <http://tech.firstpost.com/news-analysis/smeshapp-how-pakistan-spied-on-indian-military-personnel-using-an-app-from-the-play-store-304377.html>

[2] Indian Express, Espionage racket with ISI links busted in Jammu, Kolkata; BSF jawan among 5 held,30 November 2015,< http://indianexpress.com/article/india/india-news-india/delhi-police-arrests-bsf-personnel-isi-operative-in-jammu-for-alleged-espionage/#sthash.zD51289H.dpuf>

[3] Deccan Chronicle, Indian Air Force initiates high-alert on Xiaomi smartphones, 22 October 2014, <http://www.deccanchronicle.com/141022/technology-mobiles-and-tabs/article/indian-air-force-ban-xiaomi-smartphones>

[4] Indian Express, China hackers enter Navy computers, plant bug to extract sensitive data, 1 July 2012, <http://archive.indianexpress.com/news/china-hackers-enter-navy-computers-plant-bug-to-extract-sensitive-data/968897/1>

[5] NDTV, Army’s Tough Rules for Social Media Use After WhatsApp Trouble, 11 December 2014, <http://www.ndtv.com/india-news/armys-tough-rules-for-social-media-use-after-whatsapp-trouble-711779>

[6] Office of the Chief of Public Affairs, The United States Army Social Media Handbook, March 2014, <http://www.usar.army.mil/Portals/98/Documents/Armysocialmediahandbook.pdf>

[7] China Daily, Military wives warned about risk of secret leakage on WeChat, 7 April 2015, <http://www.chinadaily.com.cn/china/2015-04/07/content_20011532.htm>