B.RAMAN
In recent months, there has been considerable focus----rightly so--- on Chinese cyber snooping and disruption. The intensified debate on the subject started in Governmental circles of the West----particularly in the US----- and has since been given greater credibility by Google's open allegations against the Chinese of indulging in cyber snooping against anti-Beijing political dissidents and Tibetan nationalists patronising Google Mail.it has been reported that the Chinese cyber snooping and disruption attempts were orchestrated in such a manner as to make it appear that they originated from servers in Taiwan. Google claims to have established that they actually originated from China.
2. The Chinese authorities have countered this by flatly denying these allegations and by making counter-allegations of US cyber snooping and disruption attacks directed at China by using servers allegedly in Iran. They have also been disseminating stories of the close links of Google with the administration of President Barack Obama. They have alleged that Mr.Eric Schmidt, the CEO of Google, was among the first to endorse the Presidential bid of Mr.Obama, that Google was the fourth largest corporate contributor to Mr.Obama's funds for the Presidential campaign and that its CEO acts as an adviser on science and technology to Mr.Obama. The attempted Chinese insinuation is that Google and the Obama Administration are acting in tandem in their attempts to create fears about the Chinese cyber capabilities and that the entire campaign is motivated---politically as well as commercially.
3. India as the neighbour of China with a long-pending border dispute with that country and as an aspirant for a leading position in Asia on par with China----an aspiration not liked by Beijing--- has to take note of the increasing reports on the Chinese interest in the use of the cyber space for advancing its national interests.Modernisation of its information warfare capabilities has been an important component of China's military modernisation ever since the first Gulf war of 1991.
4. The Gulf war of 1991 and the US-led military campaign in Iraq in 2003 showed that in modern wars between States, the decisive blows may come in the very beginning if one has the capability to render the adversary information-blind by disrupting, if not destroying, the adversary's information systems. With its information networks paralysed, Saddam Hussein's Army had to literally grope in the dark in its futile attempts to stop the US advance.
5.If the Iraq war demonstrated the decisive role played by information warfare capabilities in a military campaign against a State adversary, the US-led military campaign against Al Qaeda and the Taliban in the Af-Pak region for nine years now has demonstrated that modern information warfare capabilities cannot be decisive against a non-State adversary, not dependent on networked information systems. The Taliban and Al Qaeda have been able to use the Internet for their own campaigns without creating a dependence on them which could increase their vulnerability. As a result, the USA's superior information warfare capabilities have been of very little use to it in its military campaign in the Af-Pak region.
6. Two concerns have been the driving force of the feverish Chinese acquisition of information warfare capabilities since 1991. The first concern relates to Taiwan. They are worried that in the event of a military conflict Taiwan may do unto them what the US did unto Saddam Hussein's Army.China's protective cyber security architecture is meant to defend their networked systems from a surprise attack by Taiwanese information warriors----either acting on their own or with the collusion of the US. At the same time, they are acquiring an offensive information warfare capability against Taiwan. They are aware of their limitations vis-a-vis the US and do not have any pretensions of being able in the near future to disrupt the US information systems. Their interest in the case of the US is limited to collecting intelligence through the Internet and preventing cyber snooping and disruption by the US against China.
7.The second Chinese concern arises from the increasing use of the Internet by political dissidents to discredit the one-party rule and by the Tibetans and the Uighur separatists to destabilise Tibet and Xinjiang. The disturbances in Tibet two years ago and in Xinjiang last year added to the Chinese alarm. Even before these disturbances, the Chinese have been paying attention to creating in their intelligence agencies a capability for cyber intelligence and counter-intelligence and disruption through cyber covert actions. The alleged Chinese attacks against Google seem to have been an outcome of the aggressive Chinese attempts to strengthen their information warfare capabilities against non-State actors to strengthen their internal security.
8. The capabilities, which the Chinese have been developing since 1991 primarily for use against Taiwan and non-state actors, can be used with equal ease against our own information systems as well as those of the US and other countries. Normally, information warfare capabilities are of universal application. They are not nation or adversary specific.However, offensive architectures have to be developed in a country-specific manner even though ultimately they become amenable to universal application. Similarly, protective architectures are of universal application. If one develops a comprehensive protective architecture it can be used to defend oneself against any power----whether China or Pakistan or the US or any other country.
9. India's needs are: Firstly, a protective architecture, which can protect us from cyber attacks of any origin; secondly, an offensive architecture, which could give us a first strike capability against China and Pakistan in the case of a war with either or both of them and thirdly, a cyber intelligence, counter-intelligence and covert action capability for use against State and non-State actors in times of peace as well as military conflict.
10. Having been a pre-eminent information technology power of Asia for many years, India could have had a head-start over China in developing information warfare capabilities----offensive and defensive. However, we were slow to draw the right lessons from the Gulf war of 1991 and remiss in launching a project for acquiring the required capabilities. My own assessment is that we are at least eight to 10 years behind China in developing our information warfare capabilities. If at least now we show a determination to catch up with China and find the necessary financial and human resources, we should be able to do so.
11. In developing our protective architecture, we should not be over-focussed on China and possibly Pakistan.We should be conscious of likely dangers of penetration of our information systems by the agencies of other countries not for aggressive purposes but for collecting intelligence. Countries such as the US have been in this game for longer than China and have better capabilities than the Chinese. The fact that the Chinese are getting caught or exposed frequently shows that there are still deficiencies in their capabilities and that their deniability is still weak.The fact that there have been fewer instances of the US being detected cyber snooping shows that its capabilities and deniability are stronger than those of China. it does not show that the US is a saint in the game of cyber snooping and disruption. (27-1-10)
( The writer is Additional Secretary (retd), Cabinet Secretariat, Govt. of India, New Delhi, and, presently, Director, Institute For Topical Studies, Chennai. He is also associated with the Chennai Centre For China Studies. E-mail: seventyone2@gmail.com )
Wednesday, January 27, 2010
Monday, January 25, 2010
CYBER SNOOPING & DISRUPTION
B.RAMAN
(Shortly after I retired on August 31,1994, I had prepared a brief paper on the dangers of what I called microchip moles----- that is, collection of intelligence through the cyber space by national adversaries.I also wrote a paper for the quarterly journal of the United Service Institute (USI) on what I called weapons of mass disruption---- a reference to microchip moles. On October 14,2000, the "Business Line" of the "Hindu" group of publications of Chennai had published an article written by me titled "Proxy War in Cyber Space". It is repeated below. It is available at http://www.thehindubusinessline.com/2000/10/14/stories/041439ju.htm . In May 2000, I was nominated a member of the Special Task Force For the Revamping of the Intelligence Agencies set up by the Government of then Prime Minister Atal Behari Vajpayee under the chairmanship of Shri G.C.Saxena, former chief of the Research & Analysis Wing (R&AW). I prepared for it a paper on cyber intelligence (using the Internet for the collection of intelligence about others) and cyber counter-intelligence (preventing others from using the Internet for collecting intelligence about us). Some of the suggestions in my paper found mention in the final report of the Task Force. I do not know what follow-up action was taken by the Government. I came to understand that during one of his interactions with his Indian counterparts, Richard Armitage, the then US Deputy Secretary of State, proposed that the US and India co-operate in cyber security. He was reportedly concerned for three reasons---- the increasing Chinese capability for cyber intelligence and cyber disruption; the likelihood of Al Qaeda paralysing the global economy through cyber attacks and the security of the information systems (IS) of the increasing number of US companies outsourcing in India due to what Americans perceived as poor cyber-security consciousness and expertise in India. The Government of Shri Vajpayee accepted his suggestion and an Indo-US Cyber Security Forum was set up consisting of governmental as well as non-governmental experts. Some years later, the Government was shocked to find that the US agencies had used the Forum itself as a Trojan Horse in an attempt to penetrate the IS of the National Security Council Secretariat, which is part of the Prime Minister's Office. One does not know what happened to the Forum thereafter. The recent reports of extensive Chinese use of web snooping against their own nationals and foreigners should not have come as a surprise to those aware of the priority attached by the Chinese to acquiring a capability for information warfare ever since the first Gulf war of 1991. One of the biggest advantages of cyber snooping and disruption in peace time is its deniability. Google may accuse the Chinese of cyber snooping, but will not be able to prove it. Everyday, there are hundreds of instances of cyber snooping going on----- by governmental and non-governmental entities, by lone cyber warriors as well as State warriors. In the conventional intelligence world, physical surveillance is an important tool of counter-intelligence. Many human moles are detected and trapped through physical surveillance. Have we been able to develop a technique of cyber surveillance, as effective as human surveillance? Unless we do so,our cyber counter-intelligence will continue to be weak. Now read what I wrote on October 14,2000 ---B.Raman )
PROXY WAR IN CYBER SPACE
B. Raman
THE principal threats to networked information systems (IS) arise from paralysis or destruction, clandestine data distortion or transfer and defacements.
Paralysis or destruction could be caused either by directly interfering with the IS or by indirectly disabling the source of power supply or the telecommunication system, without which networks cannot function.
The Gulf war saw the US and the UK paralysing the networks in Iraq by direct interference with the IS through microchip moles planted in the hardware/software supplied to that country during the Iran-Iraq war of the 1980s as well as by aerial strikes on the telecommunication system. During the Kosovo conflict last year, the power stations in Belgrade were paralysed by the US through the use of the graphite bombs, thereby rendering the networks non-functional.
Effective use of the graphite bombs requires precise identification of the location of the power stations. With the Nuclear-Driven Radio Frequency Warheads (NDRF), reportedly under development by the US, such identification is not necessary.
From a satellite, one can reportedly cause the explosion of the NDRF at a height of 50-100 km above the target area, creating an intense electro-magnetic field which, it is claimed, would disrupt all command and control equipment, computer networks, powe r grids and telecommunication systems within a radius of about 1,000 km, without any radiation fall-out or other collateral damage on the ground.
Data distortion is a new stealth weapon, the dangers of which have not been adequately understood by security experts, particularly in India. When data are destroyed or defaced, one immediately notices it and can manage the resulting crisis with the help of back-up systems and redundancies, consciously created at different nodal points, in the State as well as in the private sector, as in University networks, for example, with the latter's co-operation.
Skillful and clandestine data distortion will often be noticed only after something has seriously gone wrong, such as a missile failing on the launch pad or going astray.
Data transfer, which involves the theft of sensitive or classified data from an IS, often remains unnoticed unless the establishment concerned has a competent computer security staff.
Data defacement is the most widely-reported, but not-so-dangerous of the possible threats to IS from internal or external elements. One notices it immediately after it has occurred and can take the necessary corrective action. In fact, defacements help o ne, in a way, by making one aware of the weak points in the IS.
Governments as well as private establishments avoid admitting penetration of their IS, lest public confidence in the dependability of their systems be shaken. As such, available statistics, tabulated by groups such as `Attrition', are often incomplete. M oreover, they document mostly instances of defacements. No reliable data are available of successful instances of IS penetration, which resulted in paralysis or destruction of systems or in data transfer or distortion.
But these statistics do give an idea of the increasing magnitude of the threats to IS security from hackers, working either independently or at the possible instance of intelligence agencies or alienated anti-government groups, including terrorists. Hack ers are the mercenaries of the new millennium and the advent of the networked IS has enabled individuals to wage a war against a state, unnoticed and often undetected till the worst has happened.
Since August 1995, there have been 7,912 reported instances of penetration for defacements, of which 5,149 or 65.08 per cent were in the US, and the remaining 2,763 or 34.92 per cent in other countries. Among the US establishments whose IS was reportedly penetrated were private companies (3,303), non-governmental organisations (556), network providers (435), universities and research laboratories (376), the navy (58), the National Aeronautics and Space Administration (50), the army (47), the air force ( 12), the Marines (5), other military establishments (34), the Department of Energy, which controls nuclear research laboratories (8), other government departments (231) and banks (47).
The large number of penetrations in the US could be attributed partly to the large spread of networked IS in the US, as compared to other countries, and to the better system of reporting due to the regular sensitisation of public servants and business ex ecutives about the need for prompt reporting of penetrations and about the dangers of a cover-up.
The US is believed to have the best IS security infrastructure in the world in terms of laws, trained computer security experts, protection technologies, and so on. The fact that, despite this, there have been so many instances of reported and often unde tected (until post-event) penetration would give an idea of the seriousness of the threats which countries such as India, which are at least 10 years behind the US in developing similar computer security consciousness and protection infrastructure, face from potential cyber invaders.
In Asia, the largest number of penetrations for defacements since 1995 has been from South Korea (142), followed by Japan (63), China (59), Malaysia (46), India (37), Singapore (20) and Pakistan (17). The much smaller number in Pakistan as compared to In dia does not necessarily mean that IS security there is better than in India. It is more due to the fact of a much larger spread of networks in India. The more the networks, the greater the possibility of penetration.
Pakistan lags far behind India in information technology (IT), but Gen. Pervez Musharraf, its self-styled chief executive, has embarked on an ambitious programme for catching up with India. Budgetary allocations have been increased considerably to promot e computer education and research and to persuade Pakistani IT experts in the West to help in this regard.
However, there is one domain in which Pakistan seems to have taken a lead over India -- in mobilising the resources of overseas Pakistani and other Islamic IT experts and hackers in its electronic psychological warfare (Psywar) against India and in raisi ng a dedicated corps of hackers, who could be used to identify weak points in the IS of Indian establishments and use them appropriately.
The potential of the World Wide Web (WWW) for Psywar purposes was realised by the Inter-Services Intelligence (ISI) long before the Indian intelligence did.
There are about 150 jehadi web sites today. They provide the following services:
*Dissemination of information regarding jehad in different countries.
*Instructions on how to become a Mujahideen, how to prepare improvised explosive devices, and so on.
*Database on where one could purchase arms and ammunition and their prices.
*A bibliography of 266 articles on urban guerilla warfare and low-intensity conflicts.
*Anti-state propaganda.
About one-third of these Web sites relate to the so-called jehad in Kashmir and are run by organisations such as the JKLF, the Harkat-ul-Mujahideen and the Lashkar-e-Toiba.
Groups such as Attrition periodically publish a list of the 10 most active hacker groups of the world. Two groups of Pakistani hackers, calling themselves `GforcePakistan' and `Pakistanhc' figure in this list. The first one is estimated to have caused 11 0 defacements all over the world since 1995 and the second 99. Their targets include not only India, but also the US to protest against the US attitude on Kashmir.
A third group, the Muslim Online Syndicate (MOS), surfaced in March last, with an unverified claim of having defaced almost 600 Web sites in India and taken control of several Indian Government and private computer systems, in protest against alleged Ind ian atrocities in Kashmir.
Mr D. Ian Hopper, the CNN's Interactive Technology editor, reported as follows: ``Unlike the majority of Web vandals, the MOS members say they secretly take control of a server, then deface the site only when they `have no more use' for the data or the s erver itself.''He quoted one of the members of the group as saying as that: ``The servers we control range from harmless mail and Web services to `heavy-duty' government servers. The data is only being archived for later use if deemed necessary.''
It was suspected that the MOS managed to have access to Indian Web sites and IS through Alabanza, a Pakistani-controlled American Internet Service Provider, which had reportedly a collaboration agreement with a well-known Indian dotcom company, without t he latter being aware of its Pakistani connection.
There are many other Pakistani and Islamic hacker groups which have been active, with some of them giving online tutorials on how to use malicious software and hack and even providing malicious software, which can be downloaded and sent to someone whose computer one wants to damage.
These groups describe the growing number of hackers in the Pakistani diaspora as ``Pakistan's greatest natural resource''. The fact that they are able to indulge in such blatantly illegal activities online despite stringent Western laws against cyber cri me and vandalism should be a matter of concern to Indian national security managers.
Cyber Space Security Management has already become an important component of National Security Management, Military-related Scientific Security Management and Intelligence Management all over the world. Future intrusions threatening our national security may not necessarily come from across the land frontier, or in air space or across maritime waters, but happen in cyberspace. Intelligence operations and covert actions will increasingly become cyber-based. It is important that our intelligence agencies gear themselves up to this new threat.
It is, therefore, advisable to put in place a `National Cyber Space Security Management Policy' to define the tasks that need attention, specify the responsibilities of the individual agencies and provide for an integrated approach and architecture, whic h is now lacking.
(The author is former Additional Secretary, Cabinet Secretariat, Government of India.)
(Shortly after I retired on August 31,1994, I had prepared a brief paper on the dangers of what I called microchip moles----- that is, collection of intelligence through the cyber space by national adversaries.I also wrote a paper for the quarterly journal of the United Service Institute (USI) on what I called weapons of mass disruption---- a reference to microchip moles. On October 14,2000, the "Business Line" of the "Hindu" group of publications of Chennai had published an article written by me titled "Proxy War in Cyber Space". It is repeated below. It is available at http://www.thehindubusinessline.com/2000/10/14/stories/041439ju.htm . In May 2000, I was nominated a member of the Special Task Force For the Revamping of the Intelligence Agencies set up by the Government of then Prime Minister Atal Behari Vajpayee under the chairmanship of Shri G.C.Saxena, former chief of the Research & Analysis Wing (R&AW). I prepared for it a paper on cyber intelligence (using the Internet for the collection of intelligence about others) and cyber counter-intelligence (preventing others from using the Internet for collecting intelligence about us). Some of the suggestions in my paper found mention in the final report of the Task Force. I do not know what follow-up action was taken by the Government. I came to understand that during one of his interactions with his Indian counterparts, Richard Armitage, the then US Deputy Secretary of State, proposed that the US and India co-operate in cyber security. He was reportedly concerned for three reasons---- the increasing Chinese capability for cyber intelligence and cyber disruption; the likelihood of Al Qaeda paralysing the global economy through cyber attacks and the security of the information systems (IS) of the increasing number of US companies outsourcing in India due to what Americans perceived as poor cyber-security consciousness and expertise in India. The Government of Shri Vajpayee accepted his suggestion and an Indo-US Cyber Security Forum was set up consisting of governmental as well as non-governmental experts. Some years later, the Government was shocked to find that the US agencies had used the Forum itself as a Trojan Horse in an attempt to penetrate the IS of the National Security Council Secretariat, which is part of the Prime Minister's Office. One does not know what happened to the Forum thereafter. The recent reports of extensive Chinese use of web snooping against their own nationals and foreigners should not have come as a surprise to those aware of the priority attached by the Chinese to acquiring a capability for information warfare ever since the first Gulf war of 1991. One of the biggest advantages of cyber snooping and disruption in peace time is its deniability. Google may accuse the Chinese of cyber snooping, but will not be able to prove it. Everyday, there are hundreds of instances of cyber snooping going on----- by governmental and non-governmental entities, by lone cyber warriors as well as State warriors. In the conventional intelligence world, physical surveillance is an important tool of counter-intelligence. Many human moles are detected and trapped through physical surveillance. Have we been able to develop a technique of cyber surveillance, as effective as human surveillance? Unless we do so,our cyber counter-intelligence will continue to be weak. Now read what I wrote on October 14,2000 ---B.Raman )
PROXY WAR IN CYBER SPACE
B. Raman
THE principal threats to networked information systems (IS) arise from paralysis or destruction, clandestine data distortion or transfer and defacements.
Paralysis or destruction could be caused either by directly interfering with the IS or by indirectly disabling the source of power supply or the telecommunication system, without which networks cannot function.
The Gulf war saw the US and the UK paralysing the networks in Iraq by direct interference with the IS through microchip moles planted in the hardware/software supplied to that country during the Iran-Iraq war of the 1980s as well as by aerial strikes on the telecommunication system. During the Kosovo conflict last year, the power stations in Belgrade were paralysed by the US through the use of the graphite bombs, thereby rendering the networks non-functional.
Effective use of the graphite bombs requires precise identification of the location of the power stations. With the Nuclear-Driven Radio Frequency Warheads (NDRF), reportedly under development by the US, such identification is not necessary.
From a satellite, one can reportedly cause the explosion of the NDRF at a height of 50-100 km above the target area, creating an intense electro-magnetic field which, it is claimed, would disrupt all command and control equipment, computer networks, powe r grids and telecommunication systems within a radius of about 1,000 km, without any radiation fall-out or other collateral damage on the ground.
Data distortion is a new stealth weapon, the dangers of which have not been adequately understood by security experts, particularly in India. When data are destroyed or defaced, one immediately notices it and can manage the resulting crisis with the help of back-up systems and redundancies, consciously created at different nodal points, in the State as well as in the private sector, as in University networks, for example, with the latter's co-operation.
Skillful and clandestine data distortion will often be noticed only after something has seriously gone wrong, such as a missile failing on the launch pad or going astray.
Data transfer, which involves the theft of sensitive or classified data from an IS, often remains unnoticed unless the establishment concerned has a competent computer security staff.
Data defacement is the most widely-reported, but not-so-dangerous of the possible threats to IS from internal or external elements. One notices it immediately after it has occurred and can take the necessary corrective action. In fact, defacements help o ne, in a way, by making one aware of the weak points in the IS.
Governments as well as private establishments avoid admitting penetration of their IS, lest public confidence in the dependability of their systems be shaken. As such, available statistics, tabulated by groups such as `Attrition', are often incomplete. M oreover, they document mostly instances of defacements. No reliable data are available of successful instances of IS penetration, which resulted in paralysis or destruction of systems or in data transfer or distortion.
But these statistics do give an idea of the increasing magnitude of the threats to IS security from hackers, working either independently or at the possible instance of intelligence agencies or alienated anti-government groups, including terrorists. Hack ers are the mercenaries of the new millennium and the advent of the networked IS has enabled individuals to wage a war against a state, unnoticed and often undetected till the worst has happened.
Since August 1995, there have been 7,912 reported instances of penetration for defacements, of which 5,149 or 65.08 per cent were in the US, and the remaining 2,763 or 34.92 per cent in other countries. Among the US establishments whose IS was reportedly penetrated were private companies (3,303), non-governmental organisations (556), network providers (435), universities and research laboratories (376), the navy (58), the National Aeronautics and Space Administration (50), the army (47), the air force ( 12), the Marines (5), other military establishments (34), the Department of Energy, which controls nuclear research laboratories (8), other government departments (231) and banks (47).
The large number of penetrations in the US could be attributed partly to the large spread of networked IS in the US, as compared to other countries, and to the better system of reporting due to the regular sensitisation of public servants and business ex ecutives about the need for prompt reporting of penetrations and about the dangers of a cover-up.
The US is believed to have the best IS security infrastructure in the world in terms of laws, trained computer security experts, protection technologies, and so on. The fact that, despite this, there have been so many instances of reported and often unde tected (until post-event) penetration would give an idea of the seriousness of the threats which countries such as India, which are at least 10 years behind the US in developing similar computer security consciousness and protection infrastructure, face from potential cyber invaders.
In Asia, the largest number of penetrations for defacements since 1995 has been from South Korea (142), followed by Japan (63), China (59), Malaysia (46), India (37), Singapore (20) and Pakistan (17). The much smaller number in Pakistan as compared to In dia does not necessarily mean that IS security there is better than in India. It is more due to the fact of a much larger spread of networks in India. The more the networks, the greater the possibility of penetration.
Pakistan lags far behind India in information technology (IT), but Gen. Pervez Musharraf, its self-styled chief executive, has embarked on an ambitious programme for catching up with India. Budgetary allocations have been increased considerably to promot e computer education and research and to persuade Pakistani IT experts in the West to help in this regard.
However, there is one domain in which Pakistan seems to have taken a lead over India -- in mobilising the resources of overseas Pakistani and other Islamic IT experts and hackers in its electronic psychological warfare (Psywar) against India and in raisi ng a dedicated corps of hackers, who could be used to identify weak points in the IS of Indian establishments and use them appropriately.
The potential of the World Wide Web (WWW) for Psywar purposes was realised by the Inter-Services Intelligence (ISI) long before the Indian intelligence did.
There are about 150 jehadi web sites today. They provide the following services:
*Dissemination of information regarding jehad in different countries.
*Instructions on how to become a Mujahideen, how to prepare improvised explosive devices, and so on.
*Database on where one could purchase arms and ammunition and their prices.
*A bibliography of 266 articles on urban guerilla warfare and low-intensity conflicts.
*Anti-state propaganda.
About one-third of these Web sites relate to the so-called jehad in Kashmir and are run by organisations such as the JKLF, the Harkat-ul-Mujahideen and the Lashkar-e-Toiba.
Groups such as Attrition periodically publish a list of the 10 most active hacker groups of the world. Two groups of Pakistani hackers, calling themselves `GforcePakistan' and `Pakistanhc' figure in this list. The first one is estimated to have caused 11 0 defacements all over the world since 1995 and the second 99. Their targets include not only India, but also the US to protest against the US attitude on Kashmir.
A third group, the Muslim Online Syndicate (MOS), surfaced in March last, with an unverified claim of having defaced almost 600 Web sites in India and taken control of several Indian Government and private computer systems, in protest against alleged Ind ian atrocities in Kashmir.
Mr D. Ian Hopper, the CNN's Interactive Technology editor, reported as follows: ``Unlike the majority of Web vandals, the MOS members say they secretly take control of a server, then deface the site only when they `have no more use' for the data or the s erver itself.''He quoted one of the members of the group as saying as that: ``The servers we control range from harmless mail and Web services to `heavy-duty' government servers. The data is only being archived for later use if deemed necessary.''
It was suspected that the MOS managed to have access to Indian Web sites and IS through Alabanza, a Pakistani-controlled American Internet Service Provider, which had reportedly a collaboration agreement with a well-known Indian dotcom company, without t he latter being aware of its Pakistani connection.
There are many other Pakistani and Islamic hacker groups which have been active, with some of them giving online tutorials on how to use malicious software and hack and even providing malicious software, which can be downloaded and sent to someone whose computer one wants to damage.
These groups describe the growing number of hackers in the Pakistani diaspora as ``Pakistan's greatest natural resource''. The fact that they are able to indulge in such blatantly illegal activities online despite stringent Western laws against cyber cri me and vandalism should be a matter of concern to Indian national security managers.
Cyber Space Security Management has already become an important component of National Security Management, Military-related Scientific Security Management and Intelligence Management all over the world. Future intrusions threatening our national security may not necessarily come from across the land frontier, or in air space or across maritime waters, but happen in cyberspace. Intelligence operations and covert actions will increasingly become cyber-based. It is important that our intelligence agencies gear themselves up to this new threat.
It is, therefore, advisable to put in place a `National Cyber Space Security Management Policy' to define the tasks that need attention, specify the responsibilities of the individual agencies and provide for an integrated approach and architecture, whic h is now lacking.
(The author is former Additional Secretary, Cabinet Secretariat, Government of India.)
OSAMA BIN LADEN: AN INTRIGUING MESSAGE
INTERNATIONAL TERRORISM MONITOR--PAPER NO. 613
B.RAMAN
Osama bin Laden's unusually brief message of January 24,2010, titled "Osama to Obama", which was broadcast by Al Jazeera, carries three significant points.
2. Firstly, it seeks to convey the impression to his followers in the Muslim world that he continues to be in charge of Al Qaeda despite the recent high profile rise of Al Qaeda groups in Yemen and Somalia.
3.Secondly, it tries to project that it was he who had inspired the Nigerian student who unsuccessfully attempted to blow up a Detroit-bound plane on Christmas Day. He does not use a collective noun. He says: "The message I want to convey to you through the plane of the hero, mujahid Umar al Farouk [Abdul Farouk Abdulmutallab] reaffirms a previous message that the heroes of 9/11 conveyed to you and was repeated frequently. "
4.Thirdly, he attributes the Detroit attempt to the sufferings of the Palestinians in Gaza and warns that the US will continue to be targeted so long as it supports Israel.
5. He does not attribute the Detroit attempt to larger causes such as Iraq or Afghanistan or the US Drone strikes in the Federally-Administered Tribal Areas of Pakistan. Since the message was disseminated just days before the January 28 Afghanistan conference in London, one would have expected a reference at least to Afghanistan, but he is silent.
6. My interpretation is that the message has the limited purpose of underlining that he continues to be in total charge of Al Qaeda and nothing more. ( 25-1-10)
( The writer is Additional Secretary (retd), Cabinet Secretariat, Govt. of India, New Delhi, and, presently, Director, Institute For Topical Stuudies, Chennai. E-mail: seventyone2@gmail.com )
B.RAMAN
Osama bin Laden's unusually brief message of January 24,2010, titled "Osama to Obama", which was broadcast by Al Jazeera, carries three significant points.
2. Firstly, it seeks to convey the impression to his followers in the Muslim world that he continues to be in charge of Al Qaeda despite the recent high profile rise of Al Qaeda groups in Yemen and Somalia.
3.Secondly, it tries to project that it was he who had inspired the Nigerian student who unsuccessfully attempted to blow up a Detroit-bound plane on Christmas Day. He does not use a collective noun. He says: "The message I want to convey to you through the plane of the hero, mujahid Umar al Farouk [Abdul Farouk Abdulmutallab] reaffirms a previous message that the heroes of 9/11 conveyed to you and was repeated frequently. "
4.Thirdly, he attributes the Detroit attempt to the sufferings of the Palestinians in Gaza and warns that the US will continue to be targeted so long as it supports Israel.
5. He does not attribute the Detroit attempt to larger causes such as Iraq or Afghanistan or the US Drone strikes in the Federally-Administered Tribal Areas of Pakistan. Since the message was disseminated just days before the January 28 Afghanistan conference in London, one would have expected a reference at least to Afghanistan, but he is silent.
6. My interpretation is that the message has the limited purpose of underlining that he continues to be in total charge of Al Qaeda and nothing more. ( 25-1-10)
( The writer is Additional Secretary (retd), Cabinet Secretariat, Govt. of India, New Delhi, and, presently, Director, Institute For Topical Stuudies, Chennai. E-mail: seventyone2@gmail.com )
Sunday, January 24, 2010
FEARS OF AIR-BORNE TERRORIST STRIKES IN INDIA,UK
INTERNATIONAL TERRORISM MONITOR --PAPER NO 612
B.RAMAN
The recent reports regarding the interest of the Lashkar-e-Toiba (LET) and the Harkat-ul-Jihad-al-Islami (HUJI) in an air-borne terrorist attack on Indian and British targets have to be taken seriously in the light of the capability exhibited by the LET on 26/11 of 2008 for a sea-borne terrorist attack in Mumbai and the recurrent capabilities of Al Qaeda and pro-Al Qaeda elements for air-borne terrorist strikes.
2.The meticulous manner in which the LET operatives in Pakistan collected operational intelligence from India through David Coleman Headley of the Chicago cell of the LET and planned and executed the operation spoke of its operational capability, which is almost on par with that of Al Qaeda. For months before 26/11, there were periodic reports of the LET’s plans for a sea-borne attack on Mumbai, but these reports were not taken seriously and a strategy worked out to pre-empt the LET attack and to neutralize it without much damage if preventive measures failed. We should not commit a similar omission in respect of the current reports about the plans of the LET and the HUJI for an air-mounted action.
3. The Palestinian and the Khalistani terrorist organizations and Al Qaeda had always shown a fascination for air-mounted strikes because of their publicity value and their ability to demoralize the civilian population and to discredit the State’s security machinery. One could mention as examples the hijackings by the Palestinians and the Khalistanis, the blowing up of the Kanishka aircraft of the Air India by the Babbar Khalsa in 1985 and of a Pan Am aircraft in 1988 by the Abu Nidal organization with Libyan support, the 9/11 terrorist strikes by Al Qaeda in the US Homeland and its subsequent attempts to blow up two flights to the US through a shoe bomber shortly after 9/11 and by a Nigerian student on December 25,2009. There were two thwarted or failed attempts (Operation Bojinka) by Al Qaeda or pro-Al Qaeda elements to orchestrate the simultaneous blowing-ups of a number of aircraft---- once through Ramzi Yousef, then based in the Philippines, in the 1990s, and a second time through some members of the Pakistani diaspora in the UK in 2006.
4. Apart from nine air attacks by the Khalistani terrorists in the 1980s---- seven hijackings, the blowing up of the Kanishka aircraft and the attempt to blow up another Air India plane at the Narita airport of Tokyo on the same day in 1985, India had also faced a hijacking of an Indian Airlines plane from Kathmandu by the Harkat-ul-Mujahideen (HUM) in 1999. The HUM managed to take the hijacked aircraft to Kandahar and forced the Government of India to accept its demands for the release of some terrorists in custody in Jammu & Kashmir.
5. Faced with difficulties in mounting an air-borne terrorist strike against El Air, the Israeli airline, because of their tight physical security, the Palestinian terrorists focused on attacking the ground capabilities of the El Air. In the 1980s, they mounted a spectacular commando style attack in the Rome airport.
6. The tightening of physical security all over the world during the last 20 years has not made the terrorists give up their attempts to stage air-mounted attacks. Examples of their success in circumventing tightened physical security are the 9/11 strikes in the US homeland and the two attempts to blow up US-bound planes from Europe. These two attempts illustrated the terrorists’ capability to get into planes with concealed explosive devices despite physical security. The 9/11 strikes in the US marked the beginning of air-borne suicide attacks.
7. The recent reports regarding the LET’s plans for an air-mounted strike speak of the possibility of another hijacking similar to the one organized by the HUM in 1999 and its attempts to procure paragliders reminiscent of the LTTE’s initial attempts to procure microlite aircraft and its subsequent procurement of small aircraft capable of ground strikes. Ground strikes from the air with light planes or gliders could help in circumventing access control and targeting critical infrastructure such as oil refineries, off-shore oil/gas platforms, nuclear establishments etc. Paragliders could also be used for infiltration of trained terrorists.
8.According to the “Sunday Times” of the UK as quoted by “The Hindu” of January 25,2010, the Indian intelligence agencies are reported to have alerted MI-5, the British security service,about the suspected plans of Pakistan-based pro-Al Qaeda elements to hijack an Indian aircraft originating from Delhi or Mumbai and crash it into a British city. The recent upgradation of threat level in the UK from “substantial” to “severe” but one below “imminent” has been attributed to this Indian warning. There is a possibility that the terrorist plans might be related to the January 28 London conference on Afghanistan. According to the “Sunday Times”, the Indian intelligence came to know of this plot during the interrogation of Amjad Khwaja of the HUJI, who was arrested recently in India.
9. The “Sunday Times” reported: “ It (the Indian warning) did not state that Britain was a specific target, but police security sources said it had raised fears in London that a British city might be attacked.”
10. The HUJI of Pakistan, which has an active branch in Bangladesh, has close links with the so-called 313 Brigade of Ilyas Kashmiri, who used to operate in Kashmir as the head of the 313 Brigade and now operates from North Waziristan where he has close links with Al Qaeda. Since shifting from Kashmir to North Waziristan, he has embraced the global jihadi agenda of Al Qaeda in place of his previous Kashmir-centric agenda and has been talking of the need for a major terrorist strike in the West.
11. The interrogation of Headley by the FBI brought out his role in trying to use Headley and others in Europe for a spectacular attack on the Danish paper, which published cartoons of Prophet Mohammad in 2005. The Copenhagen plot was thwarted by the arrest of Headley by the FBI on October 3,2009.
12. Against the backdrop of these reports, what Khwaja reportedly told the Indian intelligence about the HUJI’s plans for a 9/11 style terrorist strike using an Indian aircraft hijacked by Pakistani terrorists has to be taken seriously and aviation security on the ground as well as in the air has to be stepped up. The oft-exhibited capability of Al Qaeda and pro-Al Qaeda elements to identify gaps in aviation security and exploit them show that the security measures taken after 9/11 are not adequate and need a continuous review. ( 25-1-10)
( The writer is Additional Secretary (retd), Cabinet Secretariat, Govt. of India, New Delhi, and, presently, Director, Institute For Topical Studies, Chennai. E-mail: seventyone2@gmail.com )
B.RAMAN
The recent reports regarding the interest of the Lashkar-e-Toiba (LET) and the Harkat-ul-Jihad-al-Islami (HUJI) in an air-borne terrorist attack on Indian and British targets have to be taken seriously in the light of the capability exhibited by the LET on 26/11 of 2008 for a sea-borne terrorist attack in Mumbai and the recurrent capabilities of Al Qaeda and pro-Al Qaeda elements for air-borne terrorist strikes.
2.The meticulous manner in which the LET operatives in Pakistan collected operational intelligence from India through David Coleman Headley of the Chicago cell of the LET and planned and executed the operation spoke of its operational capability, which is almost on par with that of Al Qaeda. For months before 26/11, there were periodic reports of the LET’s plans for a sea-borne attack on Mumbai, but these reports were not taken seriously and a strategy worked out to pre-empt the LET attack and to neutralize it without much damage if preventive measures failed. We should not commit a similar omission in respect of the current reports about the plans of the LET and the HUJI for an air-mounted action.
3. The Palestinian and the Khalistani terrorist organizations and Al Qaeda had always shown a fascination for air-mounted strikes because of their publicity value and their ability to demoralize the civilian population and to discredit the State’s security machinery. One could mention as examples the hijackings by the Palestinians and the Khalistanis, the blowing up of the Kanishka aircraft of the Air India by the Babbar Khalsa in 1985 and of a Pan Am aircraft in 1988 by the Abu Nidal organization with Libyan support, the 9/11 terrorist strikes by Al Qaeda in the US Homeland and its subsequent attempts to blow up two flights to the US through a shoe bomber shortly after 9/11 and by a Nigerian student on December 25,2009. There were two thwarted or failed attempts (Operation Bojinka) by Al Qaeda or pro-Al Qaeda elements to orchestrate the simultaneous blowing-ups of a number of aircraft---- once through Ramzi Yousef, then based in the Philippines, in the 1990s, and a second time through some members of the Pakistani diaspora in the UK in 2006.
4. Apart from nine air attacks by the Khalistani terrorists in the 1980s---- seven hijackings, the blowing up of the Kanishka aircraft and the attempt to blow up another Air India plane at the Narita airport of Tokyo on the same day in 1985, India had also faced a hijacking of an Indian Airlines plane from Kathmandu by the Harkat-ul-Mujahideen (HUM) in 1999. The HUM managed to take the hijacked aircraft to Kandahar and forced the Government of India to accept its demands for the release of some terrorists in custody in Jammu & Kashmir.
5. Faced with difficulties in mounting an air-borne terrorist strike against El Air, the Israeli airline, because of their tight physical security, the Palestinian terrorists focused on attacking the ground capabilities of the El Air. In the 1980s, they mounted a spectacular commando style attack in the Rome airport.
6. The tightening of physical security all over the world during the last 20 years has not made the terrorists give up their attempts to stage air-mounted attacks. Examples of their success in circumventing tightened physical security are the 9/11 strikes in the US homeland and the two attempts to blow up US-bound planes from Europe. These two attempts illustrated the terrorists’ capability to get into planes with concealed explosive devices despite physical security. The 9/11 strikes in the US marked the beginning of air-borne suicide attacks.
7. The recent reports regarding the LET’s plans for an air-mounted strike speak of the possibility of another hijacking similar to the one organized by the HUM in 1999 and its attempts to procure paragliders reminiscent of the LTTE’s initial attempts to procure microlite aircraft and its subsequent procurement of small aircraft capable of ground strikes. Ground strikes from the air with light planes or gliders could help in circumventing access control and targeting critical infrastructure such as oil refineries, off-shore oil/gas platforms, nuclear establishments etc. Paragliders could also be used for infiltration of trained terrorists.
8.According to the “Sunday Times” of the UK as quoted by “The Hindu” of January 25,2010, the Indian intelligence agencies are reported to have alerted MI-5, the British security service,about the suspected plans of Pakistan-based pro-Al Qaeda elements to hijack an Indian aircraft originating from Delhi or Mumbai and crash it into a British city. The recent upgradation of threat level in the UK from “substantial” to “severe” but one below “imminent” has been attributed to this Indian warning. There is a possibility that the terrorist plans might be related to the January 28 London conference on Afghanistan. According to the “Sunday Times”, the Indian intelligence came to know of this plot during the interrogation of Amjad Khwaja of the HUJI, who was arrested recently in India.
9. The “Sunday Times” reported: “ It (the Indian warning) did not state that Britain was a specific target, but police security sources said it had raised fears in London that a British city might be attacked.”
10. The HUJI of Pakistan, which has an active branch in Bangladesh, has close links with the so-called 313 Brigade of Ilyas Kashmiri, who used to operate in Kashmir as the head of the 313 Brigade and now operates from North Waziristan where he has close links with Al Qaeda. Since shifting from Kashmir to North Waziristan, he has embraced the global jihadi agenda of Al Qaeda in place of his previous Kashmir-centric agenda and has been talking of the need for a major terrorist strike in the West.
11. The interrogation of Headley by the FBI brought out his role in trying to use Headley and others in Europe for a spectacular attack on the Danish paper, which published cartoons of Prophet Mohammad in 2005. The Copenhagen plot was thwarted by the arrest of Headley by the FBI on October 3,2009.
12. Against the backdrop of these reports, what Khwaja reportedly told the Indian intelligence about the HUJI’s plans for a 9/11 style terrorist strike using an Indian aircraft hijacked by Pakistani terrorists has to be taken seriously and aviation security on the ground as well as in the air has to be stepped up. The oft-exhibited capability of Al Qaeda and pro-Al Qaeda elements to identify gaps in aviation security and exploit them show that the security measures taken after 9/11 are not adequate and need a continuous review. ( 25-1-10)
( The writer is Additional Secretary (retd), Cabinet Secretariat, Govt. of India, New Delhi, and, presently, Director, Institute For Topical Studies, Chennai. E-mail: seventyone2@gmail.com )
USA'S NATIONAL COUNTER-TERRORISM CENTRE
B.RAMAN
The following reply has been sent by me in response to a query from a journalist-reader of my articles:
Before 9/11, there was a counter-terrorism centre in the CIA, which had officers from various counter-terrorism agencies, who worked under a CIA Officer. This was part of the CIA because Director CIA was also Director Central Intelligence and in that capacity was responsible for co-ordination of all agencies of the intelligence community.The GC Saxena Task Force on intelligence revamp studied its working and recommended the creation of a similar counter-terrorism centre in the IB to consist of officers of various agencies and headed by an IB officer. The Government created it in the IB, but for reasons not clear to me called it a Multi-Agency Centre and not a counter-terrorism centre. It did not get going for a long time because of the reported reluctance of the R&AW and MI to depute their officers to work in the MAC under an IB officer. It has now got going since 26/11 in full steam.In 2004, the post of Director Central Intelligence was replaced by the post of Director, National Intelligence to coordinate. He is a member of the Presidential Executive Staff and works directly under the President. The NCTC was created as a separate organisation and placed under him. Director CIA, who is no longer responsible for co-ordination, has no control over it. The CIA continues to have its Counter-terrorism centre, but since 2004 it does not have a multi-agency role. Now the multi-agency responsibility is that of the NCTC under Director National Intelligence. All agencies have their own counter-terrorism divisions or centres, but their working is co-ordinated by the NCTC. The NCTC does not have an independent operational capability. It operates through different agencies. For example, if the NCTC decides that Drone strikes in the FATA must be stepped up, it is the CIA, which has the control of the Drone fleet, that will carry out the task. The NCTC by itself does not have a Drone capability. If the NCTC decides that there should be a covert ground attack against the Taliban or Al Qaeda in the FATA, it is the special forces of the Pentagon who will carry it out and not the NCTC, which has not been given any capability for covert action. ( 25-1-10)
( The writer is Additional Secretary (retd), Cabinet Secretariat, Govt. of India, New Delhi, and, presently, Director, Institute For Topical Studies, Chennai. E-mail: seventyone2@gmail.com )
The following reply has been sent by me in response to a query from a journalist-reader of my articles:
Before 9/11, there was a counter-terrorism centre in the CIA, which had officers from various counter-terrorism agencies, who worked under a CIA Officer. This was part of the CIA because Director CIA was also Director Central Intelligence and in that capacity was responsible for co-ordination of all agencies of the intelligence community.The GC Saxena Task Force on intelligence revamp studied its working and recommended the creation of a similar counter-terrorism centre in the IB to consist of officers of various agencies and headed by an IB officer. The Government created it in the IB, but for reasons not clear to me called it a Multi-Agency Centre and not a counter-terrorism centre. It did not get going for a long time because of the reported reluctance of the R&AW and MI to depute their officers to work in the MAC under an IB officer. It has now got going since 26/11 in full steam.In 2004, the post of Director Central Intelligence was replaced by the post of Director, National Intelligence to coordinate. He is a member of the Presidential Executive Staff and works directly under the President. The NCTC was created as a separate organisation and placed under him. Director CIA, who is no longer responsible for co-ordination, has no control over it. The CIA continues to have its Counter-terrorism centre, but since 2004 it does not have a multi-agency role. Now the multi-agency responsibility is that of the NCTC under Director National Intelligence. All agencies have their own counter-terrorism divisions or centres, but their working is co-ordinated by the NCTC. The NCTC does not have an independent operational capability. It operates through different agencies. For example, if the NCTC decides that Drone strikes in the FATA must be stepped up, it is the CIA, which has the control of the Drone fleet, that will carry out the task. The NCTC by itself does not have a Drone capability. If the NCTC decides that there should be a covert ground attack against the Taliban or Al Qaeda in the FATA, it is the special forces of the Pentagon who will carry it out and not the NCTC, which has not been given any capability for covert action. ( 25-1-10)
( The writer is Additional Secretary (retd), Cabinet Secretariat, Govt. of India, New Delhi, and, presently, Director, Institute For Topical Studies, Chennai. E-mail: seventyone2@gmail.com )
Saturday, January 23, 2010
Friday, January 22, 2010
AN OPEN LETTER TO THE NEW NSA
B.RAMAN
Dear Shri Menon,
I welcome your appointment as the National Security Adviser and wish you well in your new assignment. My purpose in writing this open letter to you is to share with you my thinking on the tasks ahead of you. Since retiring from the Research & Analysis Wing (R&AW) on August 31, 1994, I have written over a hundred articles on national security management. This letter will repeat some of the points figuring in those articles which are still valid and some others to which I will be giving open expression for the first time.
2. The importance of an action-oriented analytical process was highlighted by Lord Franks of the UK, who was asked by the British Government to enquire into the failure of Britain's national security managers to anticipate and forestall the Argentine occupation of the Falklands Islands in 1982, which led to a brief, but fierce naval conflict. Lord Franks concluded that though there was no secret intelligence regarding the Argentine intentions and plans, there was considerable open source reporting in the US and Argentine media on this, but these reports were not taken seriously and analysed either in the Foreign Office or in the Joint Intelligence Committee (JIC) to see what those reports implied and what action was called for. Hence, the so-called surprise.
3. The US National Commission, which enquired into the 9/11 terrorist strikes in the US Homeland, stressed the importance of the culture of joint action for dealing effectively with terrorism. It pointed out that effective coordination alone would not be adequate unless it was supplemented by the operating principle of joint action by all those having any responsibility for counter-terrorism. This principle implies that every piece of intelligence is analysed jointly by everyone responsible for counter-terrorism and acted upon. One of the main purposes of the National Counter-Terrorism Centre (NCTC), which came into being in 2004 under the supervision of the Director, National Intelligence, (DNI), would be to enforce this responsibility for joint action. Every counter-terrorism agency would be individually and jointly responsible for ensuring that significant pieces of intelligence are promptly analysed and acted upon.
4. The recent enquiries by officials of the Barack Obama Administration into the failed attempt by a Nigerian student to blow up a US commercial flight from Amsterdam to Detroit on Christmas Day brought out that even more than five years after the NCTC was set up, the culture of an action-oriented analytical approach has not taken hold in the US national security establishment.
5. The father of the student alerted a US diplomat and a CIA officer in Nigeria that his son had got radicalised and was suspected to be in Yemen. The diplomat conveyed the information to the State Department and the CIA officer to his agency's headquarters. Both passed on the information to the NCTC. Days before the student boarded the plane at Amsterdam, the information that he is a security risk was available in the data bases of the US Embassy in Nigeria, the State Department, the CIA and the NCTC, but it was not subjected to a joint analysis to see what the information implied and what joint action on it was called for.
6. In his statement in the Lok Sabha after taking over as the Home Minister after the 26/11 terrorist strike, Shri P.Chidambaram mentioned that he found that responsibility for follow-up action on intelligence reports was diffused. In December last year, the "Hindustan Times" had reported that twice in September, 2008, the R&AW had reported about the Lashkar-e-Toiba's plans for a sea-borne terrorist attack in Mumbai. The paper also quoted a senior unnamed official of the R&AW as saying that its responsibility was to collect and disseminate intelligence and that follow-up action on the intelligence disseminated was not its responsibility. This showed the total absence of the culture of joint action in our national security establishment. This should be a matter of serious concern and needs to be addressed.
7. The Kargil conflict of 1999 revealed a serious deficiency in our analysis and follow-up action process. Every year, the Indian Army had been withdrawing its troops from the Kargil heights during winter. Before the onset of the winter of 1998-99, there were intelligence reports of unusual Pakistani Army activity in the Gilgit-Baltistan area. In the middle of 1998, Shri Shyamal Dutta, the then Director of the Intelligence Bureau, had analysed these activities and sent his assessment to the Prime Minister's Office and other Ministries concerned. One would have expected an immediate meeting of the JIC to consider the implications of these developments and to recommend to the Government whether in the light of these developments the annual winter withdrawal by the Army should be cancelled. Nothing was done in Delhi and the decision to withdraw as usual was taken locally. The result: the Pakistani occupation of the heights.
8. One would have thought that in the light of the detailed lessons drawn by the Kargil Review Committee, the analysis and follow-up action process would have improved. Unfortunately, this was not so. This became evident during the 26/11 terrorist strikes in Mumbai. The two reports received in September,2008, about the danger of a sea-borne attack by the LET were analysed and security was upgraded by the Mumbai police, the naval authorities and those in charge of physical security in the Taj Hotel. Subsequently, nothing happened for seven weeks. There were no fresh reports.
9. There should have been an analysis in Delhi on what this lack of activity and absence of fresh reports implied. Did it mean that the threat no longer existed and that the security could be down-graded? These were very important questions which should have been examined in Delhi and instructions issued to the concerned authorities in Mumbai as to whether the high-level of security should continue or could be downgraded. This was not done and there were no fresh instructions to Mumbai from Delhi. The local authorities in Mumbai downgraded the security on their own, presuming that the threat was less likely. Delhi was not aware of this till the terrorists struck on 26/11.
10. The analysis, assessment and follow-up action process has been in a state of neglect for many years. Nothing illustrates this more than the state of the JIC. In 1983, Indira Gandhi, the then Prime Minister, bifurcated the JIC and created a separate JIC for internal security. Two years later, Rajiv Gandhi reversed her decision and re-merged them. Officers of the IB and the R&AW started monopolising the post of the JIC Chairman. When Shri Inder Gujral was the Prime Minister, a move was made to consider military officers too for this post. As no consensus could be reached on this, the post was kept vacant for nearly three years and the chief of the R&AW was asked to hold additional charge as the Chairman of the JIC. He did not have adequate time to discharge this responsibility. The JIC functioned with no head and only half a body. There was a dramatic drop in the flow of military intelligence reports to the JIC.
11. The Atal Behari Vajpayee Government, which created a new national security management mechanism headed by the NSA, felt that with the creation of the National Security Council Secretariat (NSCS), the JIC had become superfluous and made it a subordinate division of the NSCS with very limited independent powers of analysis, assessment and follow-up action. The Task Force for the Revamping of the Intelligence Apparatus headed by Shri G.C.Saxena, former head of the R&AW, recommended in 2000 that the JIC should be rescued from the limbo to which it had remained confined for about five years and restored to its original authority. It took another six years to implement its recommendation.
12. Previously, for nearly a decade, we had no body for analysis, assessment and follow-up action, today we have three---- the JIC of the old vintage, the NSCS of the 1998-99 creation and the National Security Advisory Board (NSAB), which came into existence in 1999 as a body of non-governmental analysts and advisers on national security. From a state of practically no analysis, we have gravitated to one of a plethora of analysis. Analysis for analysis sake without orienting it towards action has become the name of the game.
13. There is a need to re-visit the national security management system created in 1998-99 and subsequently modified by the revival of the JIC in order to ensure that the JIC, the NSCS, the NSAB and the NCTC, to be created in the Ministry of Home Affairs, work in a co-ordinated manner instead of adding to the prevailing confusion. The main responsibility of the JIC and the NCTC should be action-oriented analysis and follow-up action---- the JIC in respect of non-terrorism related threats to national security and the NCTC focusing on terrorism-related threats. The NSCS should confine itself to policy-related analysis to examine how past and present policies in national security matters have been working and whether any changes are called for. The NSAB should provide the inputs for the policy-related work of the NSCS. It should be encouraged to function as the generator of new ideas on specific issues to be referred to it by the PM and the NSA.
Warm regards,
Yours sincerely,
B.Raman, Additional Secretary (retd), Cabinet Secretariat, Govt. of India, New Delhi.
Shri Shiv Shankar Menon,
NSA,
New Delhi.
Dear Shri Menon,
I welcome your appointment as the National Security Adviser and wish you well in your new assignment. My purpose in writing this open letter to you is to share with you my thinking on the tasks ahead of you. Since retiring from the Research & Analysis Wing (R&AW) on August 31, 1994, I have written over a hundred articles on national security management. This letter will repeat some of the points figuring in those articles which are still valid and some others to which I will be giving open expression for the first time.
2. The importance of an action-oriented analytical process was highlighted by Lord Franks of the UK, who was asked by the British Government to enquire into the failure of Britain's national security managers to anticipate and forestall the Argentine occupation of the Falklands Islands in 1982, which led to a brief, but fierce naval conflict. Lord Franks concluded that though there was no secret intelligence regarding the Argentine intentions and plans, there was considerable open source reporting in the US and Argentine media on this, but these reports were not taken seriously and analysed either in the Foreign Office or in the Joint Intelligence Committee (JIC) to see what those reports implied and what action was called for. Hence, the so-called surprise.
3. The US National Commission, which enquired into the 9/11 terrorist strikes in the US Homeland, stressed the importance of the culture of joint action for dealing effectively with terrorism. It pointed out that effective coordination alone would not be adequate unless it was supplemented by the operating principle of joint action by all those having any responsibility for counter-terrorism. This principle implies that every piece of intelligence is analysed jointly by everyone responsible for counter-terrorism and acted upon. One of the main purposes of the National Counter-Terrorism Centre (NCTC), which came into being in 2004 under the supervision of the Director, National Intelligence, (DNI), would be to enforce this responsibility for joint action. Every counter-terrorism agency would be individually and jointly responsible for ensuring that significant pieces of intelligence are promptly analysed and acted upon.
4. The recent enquiries by officials of the Barack Obama Administration into the failed attempt by a Nigerian student to blow up a US commercial flight from Amsterdam to Detroit on Christmas Day brought out that even more than five years after the NCTC was set up, the culture of an action-oriented analytical approach has not taken hold in the US national security establishment.
5. The father of the student alerted a US diplomat and a CIA officer in Nigeria that his son had got radicalised and was suspected to be in Yemen. The diplomat conveyed the information to the State Department and the CIA officer to his agency's headquarters. Both passed on the information to the NCTC. Days before the student boarded the plane at Amsterdam, the information that he is a security risk was available in the data bases of the US Embassy in Nigeria, the State Department, the CIA and the NCTC, but it was not subjected to a joint analysis to see what the information implied and what joint action on it was called for.
6. In his statement in the Lok Sabha after taking over as the Home Minister after the 26/11 terrorist strike, Shri P.Chidambaram mentioned that he found that responsibility for follow-up action on intelligence reports was diffused. In December last year, the "Hindustan Times" had reported that twice in September, 2008, the R&AW had reported about the Lashkar-e-Toiba's plans for a sea-borne terrorist attack in Mumbai. The paper also quoted a senior unnamed official of the R&AW as saying that its responsibility was to collect and disseminate intelligence and that follow-up action on the intelligence disseminated was not its responsibility. This showed the total absence of the culture of joint action in our national security establishment. This should be a matter of serious concern and needs to be addressed.
7. The Kargil conflict of 1999 revealed a serious deficiency in our analysis and follow-up action process. Every year, the Indian Army had been withdrawing its troops from the Kargil heights during winter. Before the onset of the winter of 1998-99, there were intelligence reports of unusual Pakistani Army activity in the Gilgit-Baltistan area. In the middle of 1998, Shri Shyamal Dutta, the then Director of the Intelligence Bureau, had analysed these activities and sent his assessment to the Prime Minister's Office and other Ministries concerned. One would have expected an immediate meeting of the JIC to consider the implications of these developments and to recommend to the Government whether in the light of these developments the annual winter withdrawal by the Army should be cancelled. Nothing was done in Delhi and the decision to withdraw as usual was taken locally. The result: the Pakistani occupation of the heights.
8. One would have thought that in the light of the detailed lessons drawn by the Kargil Review Committee, the analysis and follow-up action process would have improved. Unfortunately, this was not so. This became evident during the 26/11 terrorist strikes in Mumbai. The two reports received in September,2008, about the danger of a sea-borne attack by the LET were analysed and security was upgraded by the Mumbai police, the naval authorities and those in charge of physical security in the Taj Hotel. Subsequently, nothing happened for seven weeks. There were no fresh reports.
9. There should have been an analysis in Delhi on what this lack of activity and absence of fresh reports implied. Did it mean that the threat no longer existed and that the security could be down-graded? These were very important questions which should have been examined in Delhi and instructions issued to the concerned authorities in Mumbai as to whether the high-level of security should continue or could be downgraded. This was not done and there were no fresh instructions to Mumbai from Delhi. The local authorities in Mumbai downgraded the security on their own, presuming that the threat was less likely. Delhi was not aware of this till the terrorists struck on 26/11.
10. The analysis, assessment and follow-up action process has been in a state of neglect for many years. Nothing illustrates this more than the state of the JIC. In 1983, Indira Gandhi, the then Prime Minister, bifurcated the JIC and created a separate JIC for internal security. Two years later, Rajiv Gandhi reversed her decision and re-merged them. Officers of the IB and the R&AW started monopolising the post of the JIC Chairman. When Shri Inder Gujral was the Prime Minister, a move was made to consider military officers too for this post. As no consensus could be reached on this, the post was kept vacant for nearly three years and the chief of the R&AW was asked to hold additional charge as the Chairman of the JIC. He did not have adequate time to discharge this responsibility. The JIC functioned with no head and only half a body. There was a dramatic drop in the flow of military intelligence reports to the JIC.
11. The Atal Behari Vajpayee Government, which created a new national security management mechanism headed by the NSA, felt that with the creation of the National Security Council Secretariat (NSCS), the JIC had become superfluous and made it a subordinate division of the NSCS with very limited independent powers of analysis, assessment and follow-up action. The Task Force for the Revamping of the Intelligence Apparatus headed by Shri G.C.Saxena, former head of the R&AW, recommended in 2000 that the JIC should be rescued from the limbo to which it had remained confined for about five years and restored to its original authority. It took another six years to implement its recommendation.
12. Previously, for nearly a decade, we had no body for analysis, assessment and follow-up action, today we have three---- the JIC of the old vintage, the NSCS of the 1998-99 creation and the National Security Advisory Board (NSAB), which came into existence in 1999 as a body of non-governmental analysts and advisers on national security. From a state of practically no analysis, we have gravitated to one of a plethora of analysis. Analysis for analysis sake without orienting it towards action has become the name of the game.
13. There is a need to re-visit the national security management system created in 1998-99 and subsequently modified by the revival of the JIC in order to ensure that the JIC, the NSCS, the NSAB and the NCTC, to be created in the Ministry of Home Affairs, work in a co-ordinated manner instead of adding to the prevailing confusion. The main responsibility of the JIC and the NCTC should be action-oriented analysis and follow-up action---- the JIC in respect of non-terrorism related threats to national security and the NCTC focusing on terrorism-related threats. The NSCS should confine itself to policy-related analysis to examine how past and present policies in national security matters have been working and whether any changes are called for. The NSAB should provide the inputs for the policy-related work of the NSCS. It should be encouraged to function as the generator of new ideas on specific issues to be referred to it by the PM and the NSA.
Warm regards,
Yours sincerely,
B.Raman, Additional Secretary (retd), Cabinet Secretariat, Govt. of India, New Delhi.
Shri Shiv Shankar Menon,
NSA,
New Delhi.
Subscribe to:
Posts (Atom)