THREAT : Cyber security threat to India is real

THREAT : Cyber security threat to India is real

Vicky Nanjappa

Rediff.com

August 05, 2009

http://news.rediff.com/special/2009/aug/05/cyber-security-threat-to-india-is-real.htm

The demand for better methods to enforce cyber security has grown stronger since the November 26 attacks in Mumbai

India has a dedicated organisation, CERT-In -- which operates under the auspices of the department of communication and information technology -- to tackle cyber crimes. However, the agency is not a prosecuting body.

An officer at CERT-In told rediff.com over the telephone from New Delhi that although the agency does not have the legal power to examine cyber crimes, it can probe cases referred to the organisation.

CERT-In, which covers both government and military areas, says the threats relating to cyber security are on the rise. Common targets include critical infrastructure like telecommunication, transportation, energy and finance.

The attackers are not confined to information infrastructures and geographical boundaries. They exploit network interconnections and navigate easily through the infrastructure. More worryingly, these cyber criminals are becoming more skilled at masking their behaviour.

CERT-In consists a group of professionals headed by a director who investigate cases referred to the agency. It submits a report to the police station that has sought the agency's help following which a chargesheet is filed.

Why not a single agency?

Senior police officers say it is difficult to have a single agency looking at such cases.

If a crime is committed in a particular state, it is easier for police officers of that state to probe the case. At present, one police officer adds, no one person has complete charge of cyber security.

Although the Union government drafts all cyber laws and CERT-In assists in investigations, the final call can be taken by the cyber crime wings based in the states.

The only other national agency which can probe cyber crime cases is the Central Bureau of Investigation.

The prosecuting agency

The ministry for communication and information technology governs the system pertaining to cyber security. While the ministry is largely involved in drafting laws, the actual job on the ground is handled by the cyber-crime wings in the states.

The law is clear that a complaint pertaining to a cyber crime or threat can be assigned only to the jurisdictional cyber crime wing in each state. An inspector general of police heads each cyber crime wing; a superintendent of police, inspectors and sub inspectors report to her/him. Only this department can file a chargesheet and prosecute individuals involved in cyber criminal activity.

The inspector general of police reports to the state police chief.

An officer in the Karnataka cyber crime wing said it is often difficult to crack a case as the cell does not have enough IT professionals. In such cases, CERT-In's assistance is sought.

Experts feel the process of investigating a cyber crime is cumbersome under the present set-up. It is difficult to have a national level agency which takes a final call since Indian law clearly states that cases will be probed on a jurisdictional basis for all practical purposes.

R Srikumar, a former Karnataka police chief and chairman of the Cyber Society of India (Karnataka chapter), says that trained personnel could be inducted into cyber crime cells so that the procedure of referring the matter to another agency and then waiting for a report to proceed with the prosecution can be avoided.

Professor Chandrashekar, a forensics expert and a member of the CSI, believes dedicated teams of IT professionals should be appointed by respective state governments to work with the cyber crime wings.

Former CBI Director R Raghavan launched the first cyber society in Tamil Nadu. Professor Chandrashekar explains that the society's role is to train professionals in cracking cyber crimes.

He says the society will sign a Memorandum of Understanding with the National Law School, Bengaluru, to introduce a course in cyber security. The course will issue a certificate to certified cyber crime investigators.

Cyber crime wings in the states could then employ such certified investigators.

Although private security agencies investigate cyber crimes, the Union government has not made full use of their services as is the case in some countries.

Sources say the government may seek the skills of private agencies in select cases, but would prefer to improve official cyber crime wings since such cases often involve national security.