Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Showing posts with label National Security. Show all posts

The Growing Role of Cybersecurity in Protecting Nations

 




It is becoming increasingly complex and volatile for nations to cope with the threat landscape facing them in an age when the boundaries between the digital and physical worlds are rapidly dissolving. Cyberattacks have evolved from isolated incidents of data theft to powerful instruments capable of undermining economies, destabilising governments and endangering the lives of civilians. 

It is no secret that the accelerating development of technologies, particularly generative artificial intelligence, has added an additional dimension to the problem at hand. A technology that was once hailed as a revolution in innovation and defence, GenAI has now turned into a double-edged sword.

It has armed malicious actors with the capability of automating large-scale attacks, crafting convincing phishing scams, generating convincing deepfakes, and developing adaptive malware that is capable of sneaking past conventional defences, thereby giving them an edge over conventional adversaries. 

Defenders are facing a growing set of mounting pressures as adversaries become increasingly sophisticated. There is an estimated global cybersecurity talent gap of between 2.8 and 4.8 million unfilled positions, putting nearly 70% of organisations at risk. Meanwhile, regulatory requirements, fragile supply chains, and an ever-increasing digital attack surface have compounded vulnerabilities across a broad range of industries. 

Geopolitics has added to the tensions against this backdrop, exacerbated by the ever-increasing threat of cybercrime. There is no longer much difference between espionage, sabotage, and warfare when it comes to state-sponsored cyber operations, which have transformed cyberspace into a crucial battleground for national power. 

It has been evident in recent weeks that digital offensives can now lead to the destruction of real-world infrastructure—undermining public trust, disrupting critical systems, and redefining the very concept of national security—as they have been used to attack Ukraine's infrastructure as well as campaigns aimed at crippling essential services around the globe. 

In India, there is an ambitious goal to develop a $1 trillion digital economy by the year 2025, and cybersecurity has quietly emerged as a key component of that transformation. In order to support the nation's digital expansion—which covers financial, commerce, healthcare, and governance—a fragile yet vital foundation of trust is being built on a foundation of cybersecurity, which has now become the scaffolding for this expansion. 

It has become more important than ever for enterprises to be capable of anticipating, detecting, and neutralising threats, as artificial intelligence, cloud computing, and data-driven systems are increasingly integrated into their operations. This ability is critical not only to their resilience but also to their long-term competitiveness. In addition to the increasing use of digital technologies, the complexity of safeguarding interconnected ecosystems has increased as well. 

During October's Cybersecurity Awareness Month 2025, a renewed focus has been placed on strengthening artificial intelligence-powered defences as well as encouraging collective security measures. As a senior director at Acuity Knowledge Partners, Sameer Goyal stated that India's financial and digital sectors are increasingly operating within an always-on, API-driven environment defined by instant payments, open platforms, and expanding integrations with third-party services—factors that inevitably widen the attack surface for hackers. He argued that security was not an optional provision; it was fundamental. 

Taking note of the rise in sophisticated threats such as account takeovers, API abuse, ransomware, and deepfake fraud, he indicated that security is not optional. According to him, the primary challenge of a company is to protect its customers' trust while still providing frictionless digital experiences. According to Goyal, forward-thinking organisations are focusing on three key strategic pillars to ensure their digital experiences are frictionless: adopting zero-trust architectures, leveraging artificial intelligence for threat detection, and incorporating secure-by-design principles into development processes. 

Despite this caution, he warned that technology alone cannot guarantee security. For true cyber readiness, employees should be well-informed, well-practised and well-rehearsed in incident response playbooks, as well as participate in proactive red-team and purple-team simulations. “Trust is our currency in today’s digital age,” he said. “By combining zero-trust frameworks with artificial intelligence-driven analytics, cybersecurity has become much more than compliance — it is becoming a crucial element of competitiveness.” 

Among the things that make cybersecurity an exceptionally intricate domain of diplomacy are its deep entanglement with nearly every dimension of international relations-economics, military, and human rights, to name a few. As a result of the interconnectedness of our society, data movement across borders has become as crucial to global commerce as capital and goods moving across borders. It is no longer just tariffs and market access that are at the centre of trade disputes. 

It is also about the issues of data localisation, encryption standards, and technology transfer policies that matter the most. While the General Data Protection Regulation (GDPR) sets an international standard for data protection, it has also become a focal point in a number of ongoing debates regarding digital sovereignty and cross-border data governance that have been ongoing for some time. 

 As far as defence and security are concerned, geopolitical stakes are of equal importance to those of air, land, and sea. Since NATO officially recognised cyberspace in 2016—as a distinct operational domain comparable with the other three domains—allies have expanded their collective security frameworks to include cyber defence. To ensure a rapid collective response to cyber incidents, nations share threat intelligence, conduct simulation exercises, and harmonise their policies in coordination with one another. 

The alliance still faces a dilemma which is very sensitive and unresolved to the point where determining the threshold at which a cyberattack would qualify as an act of aggression enough to trigger Article 5, which is the cornerstone of NATO's commitment to mutual defence. Cybersecurity has become inextricable from concerns about human rights and democracy as well, in addition to commerce and defence.

In recent years, authoritarian states have increasingly abused digital tools for spying on dissidents, manipulating public discourse, and undermining democratic institutions abroad. As a consequence of these actions, the global community has been forced to examine issues of accountability and ethical technology use. The diplomatic community struggles with the establishment of international norms for responsible behaviour in cyberspace while it must navigate profound disagreements over internet governance, censorship, and the delicate balancing act between national security and individuals' privacy through the process of developing ethical norms.

There is no doubt that the tensions around cybersecurity have emerged over time from merely being a technical issue to becoming one of the most consequential arenas in modern diplomacy-shaping not only international stability, but also the very principles that underpin global cooperation. Global cybersecurity leaders are facing an age of uncertainty in the face of a raging tide of digital threats to economies and societies around the world. 

Almost six in ten executives, according to the Global Cybersecurity Outlook 2025, feel that cybersecurity risks have intensified over the past year, with almost 60 per cent of them admitting that geopolitical tensions are directly influencing their defence strategies in the near future. According to the survey, one in three CEOs is most concerned about cyber espionage, data theft, and intellectual property loss, and another 45 per cent are concerned about disruption to their business operations. 

Even though cybersecurity has increasingly become a central component of corporate and national strategy, these findings underscore a broader truth: cybersecurity is no longer just for IT departments anymore. Experts point out that the threat landscape has become increasingly complex over the past few years, but generative artificial intelligence offers both a challenge and an opportunity as well. 

Several threat actors have learned to weaponise artificial intelligence so they can craft realistic deepfakes, automate phishing campaigns, and develop adaptive malware, but defenders are also utilising the same technology to enhance their resilience. The advent of AI-enabled security systems has revolutionised the way organisations anticipate and react to threats by analysing anomalies in real time, automating response cycles, and simulating complex attack vectors. 

It is important to note, however, that progress remains uneven, with large corporations and developed economies being able to deploy cutting-edge artificial intelligence defences, but smaller businesses and public institutions continue to suffer from outdated infrastructure and a lack of talented workers, which makes global cybersecurity preparedness a growing concern. However, several nations are taking proactive steps toward closing this gap.

An example is the United Arab Emirates, which embraces cybersecurity not just as a technology imperative but also as a societal responsibility. A National Cybersecurity Strategy for the UAE was unveiled in early 2025. It is based on five pillars — governance, protection, innovation, capacity building, and partnerships. It is structured around five core pillars. It was also a result of these efforts that the UAE Cybersecurity Council, in partnership with the Tawazun Council and Lockheed Martin, established a Cybersecurity Centre of Excellence, which would develop domestic expertise and align national capabilities with global standards.

As a result of its innovative Public-Private-People model, which combines school curricula with nationwide drill and strengthens coordination between government and private sector, the country can further embed cybersecurity awareness across society. As a result of this approach, a more general realisation is taking shape globally: cybersecurity should be enshrined in the fabric of national governance, not as a secondary item but as a fundamental aspect of national governance. If cyber resilience is to be reframed as a core component of national security, sustained investment in infrastructure, talent, and innovation is needed, as well as rigorous oversight at the board and policy levels. 

The plan calls for the establishment of red-team exercises, stress testing, and cross-border intelligence sharing to prevent local incidents from spiralling into systemic crises. The collective action taken by these institutions marks an important shift in global security thinking, a shift that recognises that an economy's vitality and geopolitical stability are inseparable from the resilience of a nation's digital infrastructure. 

In the era of global diplomacy, cybersecurity has grown to be a key component, but it is much more than just an administrative adjustment or a passing policy trend. In this sense, it indicates the acknowledgement that all of the world's security, economic stability, and individual rights are inextricably intertwined within the fabric of the internet and cyberspace that we live in today. 

Considering the sophistication and borderless nature of threats in today's world, the field of cyber diplomacy is becoming more and more important as a defining arena of global engagement as a result. As much as traditional forms of military and economic statecraft play a significant role in shaping global stability, the ability to foster cooperation, set shared norms, and resolve digital conflicts holds as much weight.

In the international community, the central question facing it is no longer whether the concept of cybersecurity deserves to be included in diplomatic dialogue, but rather how effectively global institutions can implement this recognition into tangible results in the future. To maintain peace in an era where the next global conflict could start with just one line of malicious code, it is becoming imperative to establish frameworks for responsible behaviour, enhance transparency, and strengthen crisis communications mechanisms. 

Quite frankly, the stakes are simply too high, as if they were not already high enough. Considering how easily a cyberattack can disrupt power grids, paralyse transportation systems, or compromise electoral integrity, diplomacy in the digital sphere has become crucial to the protection of international order, especially in a world where cyberattacks are a daily occurrence.

The cybersecurity diplomacy sector is now a cornerstone of 21st-century governance – vital to safeguarding the interests of not only national governments, but also the broader ideals of peace, prosperity, and freedom that are at the foundation of globalisation. During these times of technological change and geopolitical uncertainty, the reality of cyber security is undeniable — it is no longer a specialized field but rather a shared global responsibility that requires all nations, corporations, and individuals to embrace a mindset in which digital trust is seen as an investment in long-term prosperity, and cyber resilience is seen as a crucial part of enhancing long-term security. 

The building of this future will not only require advanced technologies but also collaboration between governments, industries, and academia to develop skilled professionals, standardise security frameworks, and create a transparent approach to threat intelligence exchange. For the digital order to remain secure and stable, it will be imperative to raise public awareness, develop ethical technology, and create stronger cross-border partnerships. 

Those countries that are able to embrace cybersecurity in governance, innovation, and education right now will define the next generation of global leaders. There will come a point in the future when the strength of digital economies will not depend merely on their innovation, but on the depth of the protection they provide, for the interconnected world ahead will demand a currency of security that will represent progress in the long run.

Sensitive Intelligence Exposed in DHS Data Hub Security Lapse


 

There has been a serious concern about the integrity of federal data security in the wake of a critical vulnerability in a central data hub of the Department of Homeland Security (DHS). This vulnerability is thought to have exposed highly sensitive data to a broad range of unauthorized users, raising serious questions about the integrity of federal data security. 

An investigation by Wired revealed that a compromised system, intended to serve as a secure repository to consolidate intelligence and law enforcement data from multiple agencies, was compromised because access controls were incorrect. Instead of restricting access to classified material to properly cleared personnel, the flaw provided unauthorized entities, including adversarial actors, with an open door into classified data. 

Not only does the incident undermine the core purpose of the hub, which was designed to streamline and safeguard the intelligence-sharing process, but it also highlights the increasing risks and vulnerabilities that arise from the growing reliance of the federal government on vast, interconnected computer networks. 

Currently, it is estimated that 5,000 unauthorized individuals may have been able to access restricted data in some form or another. Despite this, officials at DHS have tried to minimize concerns by stressing that only a small number of interactions were flagged as potentially malicious after internal audits. 

However, given the scope of the exposure, the entire national security community is very concerned about the implications, especially since the compromised files contained operational intelligence which had been linked to ongoing investigations. There are many instances where such lapses have occurred before, including the breach that occurred in 2018 in which over 247,000 records pertaining to DHS employees were stolen from a secure database, and the phishing attack that occurred on Oregon DHS in 2019 that exposed 350,000 protected health information. 

Nevertheless, investigators in this case emphasize that the risk does not lie in stolen identities, but in the inadvertent visibility of intelligence information that adversaries might exploit to disrupt or undermine the government's operations, as happened here. The DHS Cyber Safety Review Board, along with federal investigators, have been investigating the incident since the incident. 

In their investigation, federal investigators cited systemic weaknesses within the department's IT infrastructure, particularly the reliance on outdated systems that are not integrated with modern cloud technology. An investigation revealed that the breach had been caused by an identity and access management (IAM) flaw in the DHS data hub framework. 

As a result, the platform used by the DHS data hub relied on a third-party vendor platform that went unpatched for over a year prior to the breach. By exploiting weak session tokens, unauthorized users were able to circumvent authentication protocols and gain read-only access to sensitive information. 

In light of these findings, there has been renewed criticism regarding vendor accountability and the persistent disconnect between federal cybersecurity policies and how they are being implemented on the ground. It has been determined that a DHS internal memorandum, which Wired obtained via a Freedom of Information Act (FOIA) request, indicates that the exposure continued from March to May 2023. 

While this was going on, the Office of Intelligence and Analysis (I&A) at the Department of Homeland Security (DHS) was incorrectly configured of an online platform that was intended to facilitate restricted information exchange as well as investigation leads by DHS. It was found that the system that serves as part of the Homeland Security Information Network’s intelligence section, called HSIN-Intel, was incorrectly configured to allow access to “everyone” rather than just authorized members of the intelligence community. 

Due to this, hundreds of thousands of people with HSIN accounts across the country, including some without a connection to intelligence or law enforcement, were inadvertently granted access to restricted information, even if they were not connected to intelligence or law enforcement. There were unintentional accesses of federal employees who were working in unrelated fields like disaster response, private contractors, and even foreign government representatives who were allowed to use the HSIN platform for other purposes. 

In light of the revelations, civil liberties advocates have been sharply critical, with Spencer Reynolds, a lawyer at the Brennan Center for Justice, who obtained the internal memo through a Freedom of Information Act request and shared it with Wired, stating that it raises serious concerns over the department’s commitment to safeguarding the department’s most confidential information. According to Reynolds, DHS advertises HSIN as secure and claims the information it contains is highly sensitive, crucial to national security. 

However, this incident raises serious concerns about the company's dedication to information security. Thousands and thousands of users have had access to information that they weren't supposed to receive. In addition to the trove of classified documents that were compromised, HSIN-Intel's holdings include investigative leads and investigative tips that range from reports on foreign hacking campaigns, disinformation operations, and analyses of domestic protest movements as well as snippets of articles from international publications.

A media report related to demonstrations against the Atlanta Public Safety Training Center, commonly referred to as the "Stop Cop City" protests, cited one example in which media coverage was positive toward confrontational police tactics. In addition to the 1,525 improper access to 439 intelligence products, the DHS inquiry also found that 518 people from the private sector and 46 foreigners had improperly accessed the products. 

There were nearly 40 percent of compromised materials that were associated with cybersecurity threats such as state-sponsored hacking groups targeting government IT infrastructure and cyber security threats. According to officials, some of the unauthorized US users who viewed the data had qualified for access through formal channels but never got the proper approval. In light of the incident, technology professionals in both government and industry should take heed of the warnings that precede rapid digital transformation when safeguards are often lagging behind in keeping up with the process. 

It has already been stated that there are similarities between this incident and the Johnson Controls malware attack of 2023, which, it is reported by SecurityAffairs, may have exposed DHS data through supply-chain vulnerabilities, highlighting similar systemic weaknesses as the misconfigurations that have been at the core of this incident. 

DHS has responded to this problem by engaging external cybersecurity firms to audit its platforms in an effort to make sure that a comprehensive review is being conducted. In addition, the DHS has been monitoring its platforms continuously in order to detect irregular access patterns in real time. In spite of this, Wired noted that long-term consequences may not be visible for years to come, underscoring the delicate balance federal agencies must strike between allowing data access for operational efficiency while safeguarding intelligence vital to national security at the same time. 

It is not only a single security lapse that has been committed by the Department of Homeland Security, but it is a reflection of a broader issue confronting modern governance as it becomes increasingly dependent on technology. The growing dependence on interconnected networks among federal agencies to coordinate intelligence operations and streamline operations has made even minor oversights in configurations or vendor management more likely to create national security vulnerabilities as the interconnected world continues to expand. 

There has been a consensus that to address such risks, more than just technological solutions, such as stronger encryption, automated monitoring and patch management, but cultural shifts within federal agencies will also be required, which should make cybersecurity a priority rather than just a compliance issue within the organization. 

In order to strengthen resilience and rebuild public trust in systems designed to safeguard national interests, better disclosure of breach information, tighter oversight of third-party vendors, and improved training for federal employees could all help strengthen public confidence and build resilience. At the same time, governments, companies, and international partners should collaborate more closely, as adversaries increasingly exploit cross-border digital ecosystems with greater sophistication as they work together to combat future threats. 

As the ten-year anniversary of the DHS breach draws closer, it may be seen as one of those moments of historical significance-an occasion when we should remember that secure information-sharing is a frontline defense for democratic institutions, not simply an administrative function.

Cyber Suraksha': Indian Armed forces Launch Cybersecurity Exercise

 

Under the direction of the Headquarters Integrated Defence Staff, the Indian Defence Cyber Agency has initiated a cyber security exercise called "Cyber Suraksha." June 16 marked the start of the exercise, which will last through June 27. A multi-phased program called "Cyber Suraksha" aims to improve cyber resilience nationally.

Over 100 participants from different national-level agencies and defence stakeholders are brought together. In a dynamic, gamified setting, the exercise is intended to mimic actual cyberthreats and assess participants' capacity to react to them. It aims to strengthen security practices and hone participants' analytical and defensive abilities by fusing structured training with real-life issues. 

The exercise included a Chief Information Security Officers (CISOs) conclave, which was designed to bridge the gap between technical execution and leadership roles. The conclave will comprise conversations delivered by notable speakers in the cyber security sphere, followed by an immersive Table-Top Exercise targeted at improving senior leadership's strategic readiness. 

'Cyber Suraksha' highlights the Defence Cyber Agency's proactive approach to maintaining cyber vigilance and cultivating a security-first culture across all levels of the national defence infrastructure. The agency also intends to make such exercises a regular occurrence in order to maintain a high level of preparedness and foster coordinated defence in an ever-changing cyber landscape. 

Defence Minister Rajnath Singh stated in March that "cyber, space, and information warfare" are proving to be as effective as traditional military operations, emphasising that the armed forces "must operate jointly and stay future-ready" in light of the evolving multi-domain environment and technological advances. 

The website of Armoured Vehicles Nigam Limited (AVNL), a defence public sector company that manufactures tanks and armoured vehicles, was taken down for a comprehensive audit two days prior to India's May 7 launch of Operation Sindoor against Pakistan. The site was allegedly defaced by a Pakistani hacker group known as "Pakistan Cyber Force," which posted pictures of a tank and a Pakistani flag.

Experts Warn Trump Officials Using Signal for War Plans Risk Massive Leaks

 

Reports that senior Trump administration officials discussed classified military operations using the encrypted texting app Signal have raised serious security concerns. Although Signal provides encryption, lawmakers and cybersecurity specialists have warned that it is still susceptible to hacking and should never be used for private government communications. 

When journalist Jeffrey Goldberg of The Atlantic was accidentally included in a Signal group discussion where senior Trump officials were discussing military operations in Yemen, the issue became apparent. Goldberg called the conversation an act of "shocking recklessness" and said it included "precise information about weapons packages, targets, and timing.” 

Mark Montgomery, senior director of the Foundation for Defence of Democracies, criticised the decision, saying, "I guess Signal is a few steps above leaving a copy of your war plan at the Chinese Embassy—but it's far below the standards required for discussing any elements of a war plan.” 

Signal has become increasingly popular in Washington despite cybersecurity concerns after Chinese-affiliated hackers significantly compromised U.S. telecommunications networks. To safeguard against spying, officials recommend using encrypted services such as Signal. Experts warn that even while the app has robust encryption and deletes messages automatically, it is not approved for use in government-level sensitive communications. 

Lawmakers call for investigation

Top Democrats have slammed the use of Signal for military discussions, describing it as a significant security breach. Bennie Thompson (D-Miss.), the ranking member of the House Homeland Security Committee, criticised the Trump administration for failing to vet group chat users. “It should go without saying that administration officials should not be using Signal for discussing intelligence matters,” Thompson noted. 

House Foreign Affairs Committee Ranking Member Gregory Meeks (D-N.Y.) has requested a hearing, calling the episode "the most astonishing breach of our national security in recent history." Ranking member of the House Intelligence Committee, Jim Himes (D-Conn.), said he was "horrified" by the usage of an insecure app. He cautioned that lower-level officials might risk criminal charges for such a failure. 

Michael Waltz, Trump's National Security Adviser, admits to organising the Signal group chat, which inadvertently included writer Jeffrey Goldberg. Waltz first blamed a staff member, but later admitted that he founded the group himself. "It is embarrassing, definitely. We're going to get to the bottom of it," he added, adding that he was engaging Elon Musk on technical matters. 

In support of Waltz, Trump described him as a "good man" who had only "learnt a lesson." "The leak was the only glitch in two months, and it turned out not to be a serious one," he said, downplaying the breach as a small mistake. But there has been a quick pushback, with lawmakers and security experts voicing serious concerns.

National Security Faces Risks from Cybercrime Expansion

 


The incidence of cyberattacks globally increased by 125% in 2021 compared to 2020, posing a serious threat to businesses and individuals alike. Phishing continues to be the most prevalent form of cybercrime worldwide and is expected to continue this upward trend into 2022, showing that cybercrime is becoming more prevalent worldwide. 

 There was a report in 2021 that around 323,972 internet users were victims of phishing attacks, covering nearly half of all the individuals who were affected by data breaches. During the peak COVID-19 pandemic, around 220% of complaints of phishing were reported, further escalating cybersecurity risks. 

Nearly one billion emails were exposed as well in 2021, which has affected approximately one in five users of the internet, with approximately 60 million emails being exposed. The constant exposure of sensitive information may have contributed to the prevalence of phishing attacks, which reinforces the importance of enacting stronger cybersecurity measures to reduce the risk of such attacks. There have been numerous instances where criminal groups have deployed ransomware to disrupt business operations for extortion. 

They have recently included threats concerning the exposure of their stolen data in their extortion strategies. Now that this method is regarded as a standard practice, it has resulted in a significant increase in the amount of sensitive information that is publicized, which has resulted in such data becoming increasingly accessible, which presents opportunities for state intelligence agencies to obtain and utilize such data to their advantage.

The Mandiant Incident Response Group of Google recently released a report that indicated that in 2024, the organization worked to mitigate nearly four times as many cyber intrusions related to financially motivated groups as those related to nation-states. This report may help shed further light on the issue. Despite the differences in motivation, cybersecurity experts have observed that the tactics, techniques, and procedures used by financially motivated cybercriminals and state-sponsored threat actors appear to be merging, potentially by design, together as they pursue their objectives. 

In the opinion of Ben Read, Senior Manager at Google's Threat Intelligence Group, an expansive cybercriminal ecosystem has increased the number of state-sponsored hacking attacks, most likely because the ecosystem provides malware, exploits weaknesses, and, in some cases, facilitates broad-based cyber operations. In the course of his speech, he pointed out that when outsourcing capabilities to third parties, they are frequently more cost-effective and offer greater functionality than when developed directly by governments. 

According to a geopolitical perspective, a market-driven cyber attack can be just as damaging and disruptive as one orchestrated by a nation-state, underscoring the need for a comprehensive cybersecurity strategy that attracts as many resources as possible. Cybercrime played a significant role in the COVID-19 pandemic. Businesses were compelled to change over to remote working environments rapidly as a result of the virus spreading, which created vulnerabilities in security protocols and network misconfigurations that were exploited by cybercriminals. 

Consequently, malware attacks increased by 358% in 2020 and were 100 times greater than in the previous year as a result of the pandemic. Cybercrime victims per hour were also at an all-time high as a result of the epidemic. Cybercrime victims have been reported to have fallen victim to cybercrime on an average of 53 persons every hour for the entire year of 2019. However, the number is projected to be 90 per hour for 2020, which reflects a surge of 69%. 

It has been demonstrated that cybersecurity risks are increasing as a result of the rapid digital transformation resulting from the global health crisis in Pakistan. Cybercrime has become increasingly common in recent years in Pakistan, with financial fraud being the most common reported crime. The number of financial fraud-related cybercrimes reported in 2020, out of 84,764 total complaints received, surpassed incidents of hacking (7,966), cyber harassment (6,023), and cyber defamation (6,004) by a margin of 20,218 victims. 

Social media has further aggravated the problem as well, with the number of complaints submitted about financial fraud on these platforms increasing by 83% between 2018 and 2021. In 2021 alone, 102,356 complaints were filed, with 23% of the cases being linked to Facebook and one other social network. As a consequence, cybercrime has also seen a sharp increase in India, with reported cases of cybercrime increasing significantly over the last few years. 

In 2018, there were 208,456 reported incidents, and in the first two months of 2022, this number had already exceeded 212,485, which is significantly higher than the number of cases in 2018. There is no doubt the pandemic triggered a steady rise in cybercrime incidents, which increased from 394,499 in 2019 to 1,158,208 in 2020 and to 1,402,809 in 2021 due to the pandemic. In 2022, cybercrime in India is projected to increase by 15.3% from the first quarter to the second quarter, in addition to the number of websites that have been hacked in India, increasing from 17,560 in 2018 to 26,121 in 2020. 

As Ransomware attacks have risen over the years, it has also become a major concern for Indian organizations, with 78% affected by these attacks in 2021, which resulted in 80% of them encrypting data, a number that is higher than the global average of 66% for attacks and 65% for encryption. According to the Home Ministry, financial fraud continues to account for the largest percentage of reported incidents among cybercriminals in India, accounting for 75% of them between 2020 and 2023, reaching a peak at over 77% in that period. 

As a result of joint sanctions imposed on Tuesday by the United States, the United Kingdom, and the Australian governments, security experts and experts are concerned about a Russian bulletproof hosting provider, Zservers. Zservers is suspected of facilitating ransomware attacks, including those orchestrated under LockBit. There are certain applications that, according to the UK government, form part of an illicit cyberinfrastructure that facilitates cybercriminal activities, such as ransomware attacks, extortion, and storage of stolen data, and sustains the operations of cybercriminal businesses, which are responsible for such operations.

The British Foreign Secretary, David Lammy, has described Russia as a corrupt and implacable country characterized by its ruthlessness and corruption, stating that it is not at all surprising that some of the world's most notorious cybercriminals operate within its borders. Russian intelligence agencies themselves have been reported to use these cybercriminal tools and services. Google's Threat Intelligence Group has highlighted that Russian military operations in Ukraine are being supported by criminal cyber capabilities as part of Russia's strategy for bolstering military operations.

There are several specific examples, including the Russian military intelligence unit Sandworm, also known as APT44, that utilizes commercial hacking tools for cyber espionage and disruption, and Moscow also uses the RomCom group to conduct espionage activities against Ukraine, a group normally associated with cybercrime. It should also be noted that Russia is not the only country accused of blurring the line between state-sponsored hacking and crime. 

The Iranian threat actors have been reported to use ransomware to generate financial resources. They are also known to engage in cyber espionage, while Chinese cyber espionage groups are known to also get involved in cybercrime as a means to complement their activities. It is suspected that North Korea is a nation that actively exploits cyber operations for financial gain, and it heavily targets cryptocurrency exchanges and individual crypto wallets to generate revenue for its regime to support its nuclear programs. 

The threat of cybercrime is on the rise, and the government is being urged to take stronger measures to combat it. In a recent report, the Google Threat Intelligence Group emphasized the critical importance of disrupting cybercriminal operations, emphasizing that cyber threats are becoming a major national security threat. Google Threat Intelligence head Sandra Joyce recently issued a warning that cybercrime no longer needs to be seen as a minor issue and that considerable efforts are required to mitigate its impacts on international security going forward.

US Imposes Ban on Chinese and Russian Tech in Passenger Cars Over Security Risks

 

The United States has introduced a new regulation barring the use of Chinese and Russian technology in passenger vehicles sold domestically, citing national security risks. According to AFP, the ban covers both hardware and software from these countries, forming part of a broader effort to reduce China's influence in critical industries.

Outgoing President Joe Biden initiated the rule after a prolonged regulatory process aimed at tightening controls on foreign-linked technologies. This follows recent debates over restricting drones and other equipment from adversarial nations. Commerce Secretary Gina Raimondo highlighted the growing reliance of modern cars on advanced technology like cameras, microphones, GPS systems, and internet connectivity, which could pose risks if developed using foreign components.

"This is a targeted approach to keep Chinese and Russian-manufactured tech off American roads," said Raimondo.

The rule initially applies to passenger vehicles under 10,001 pounds, with plans to extend it to commercial vehicles, such as buses and trucks, in the future. It prohibits manufacturers with significant ties to China or Russia from selling cars equipped with foreign-made hardware or software for internet connectivity or autonomous driving.

Implementation will occur in two stages:

  • Software ban: Effective from the 2027 model year.
  • Hardware ban: Beginning with the 2030 model year.Imports of such technology from China and Russia will also face restrictions.

The regulation could affect companies like BYD, a Chinese electric vehicle manufacturer operating a facility in California that produces buses and other vehicles. US officials have raised concerns that connected vehicles equipped with foreign technology could be exploited to misuse sensitive data or interfere with critical systems.

National Economic Advisor Lael Brainard warned, "China is attempting to dominate the future of the auto industry," underscoring the need to shield American vehicles from foreign influence.

The new rule aligns with a broader strategy to bolster domestic industries and reduce dependence on foreign technologies. On the same day, President Biden signed an executive order to fast-track the development of AI infrastructure in the US.

"We will not let America fall behind in building the technology that will define the future," Biden stated.

As Biden prepares to leave office, these measures will transition to the administration of President-elect Donald Trump, who takes office next Monday. While it remains uncertain how Trump will handle these policies, significant shifts in strategy are anticipated.

Concerns Over Starlink in India: Potential Risks to National Security


As Starlink, Elon Musk’s satellite internet service, prepares to enter India’s broadband market, think tank Kutniti Foundation has raised significant concerns about its potential risks to India’s national security. A report cited by PTI claims Starlink’s close ties with U.S. intelligence and military agencies could make it a threat to India’s interests. The foundation described Starlink as “a wolf in sheep’s clothing,” alleging that its dual-use technology serves American governmental agendas. Unlike traditional telecom networks operating under Indian jurisdiction, Starlink’s global satellite system bypasses local control, granting operational authority to U.S.-based entities. 

Kutniti suggests this could allow for activities such as surveillance or other strategic operations without oversight from India. The report also highlights that Starlink’s key clients include U.S. intelligence and military organizations, positioning it within what the foundation calls the U.S. “intel-military-industrial complex.” India’s Communications Minister Jyotiraditya Scindia recently addressed these concerns, stating that Starlink must meet all regulatory and security requirements before its services can be approved. He confirmed that the government will only consider granting a license once the platform fully complies with the country’s safety standards for satellite broadband.  

Kutniti’s report also examines the broader implications of Starlink’s operations, emphasizing how its ownership and infrastructure could support U.S. strategic objectives. The foundation referenced U.S. laws that prioritize national interests in partnerships with private enterprises, suggesting this could undermine the sovereignty of nations relying on Starlink’s technology. The think tank further criticized the role of Musk’s ventures in geopolitical scenarios, pointing to Starlink’s refusal to assist a Ukrainian military operation against Russia as an example of its influence. 

Additionally, Kutniti noted Musk’s association with Palantir Technologies, a firm known for intelligence collaborations, as evidence of the platform’s involvement in sensitive political matters. Highlighting incidents in countries like Brazil, Ukraine, and Iran, Kutniti argued that Starlink’s operations have, at times, bypassed local governance and democratic norms. The report warns that the satellite network could serve as a tool for U.S. geopolitical leverage, further cementing American dominance in space and global communications. 

India’s careful consideration of Starlink reflects a broader need to balance the benefits of cutting-edge technology with national security concerns. Kutniti’s findings underscore the risks of integrating foreign-controlled networks, especially those with potential geopolitical implications, in an increasingly complex global landscape.

CISA Proposes New Security Measures to Protect U.S. Personal and Government Data

 

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has proposed a series of stringent security requirements to safeguard American personal data and sensitive government information from potential adversarial states. The initiative aims to prevent foreign entities from exploiting data vulnerabilities and potentially compromising national security.

These new security protocols target organizations involved in restricted transactions that handle large volumes of U.S. sensitive personal data or government-related data, especially when such information could be exposed to "countries of concern" or "covered persons." This proposal is part of the broader implementation of Executive Order 14117, signed by President Biden earlier this year, which seeks to address critical data security risks that could pose threats to national security.

The scope of affected organizations is wide, including technology companies such as AI developers, cloud service providers, telecommunications firms, health and biotech organizations, financial institutions, and defense contractors. These businesses are expected to comply with the new security measures to prevent unauthorized access to sensitive information.

"CISA’s security requirements are split into two main categories: organizational/system-level requirements and data-level requirements," stated the agency. Below is a breakdown of some of the proposed measures:

  • Monthly Asset Inventory: Organizations must maintain and update a comprehensive asset inventory that includes IP addresses and hardware MAC addresses.
  • Vulnerability Remediation: Known exploited vulnerabilities should be addressed within 14 days, while critical vulnerabilities, regardless of known exploitation, must be remediated within 15 days. High-severity vulnerabilities should be resolved within 30 days.
  • Accurate Network Topology: Companies must maintain a precise network topology, which is crucial for identifying and responding to security incidents swiftly.
  • Multi-Factor Authentication (MFA): All critical systems must enforce MFA, and passwords must be at least 16 characters long. Immediate access revocation is required upon employee termination or a change in roles.
  • Unauthorized Hardware Control: Organizations must ensure that unauthorized hardware, such as USB devices, cannot be connected to systems handling sensitive data.
  • Log Collection: Logs of access and security-related events, including intrusion detection/prevention, firewall activity, data loss prevention, VPN usage, and login events, must be systematically collected.
  • Data Reduction and Masking: To prevent unauthorized access, organizations should reduce the volume of data collected or mask it, and encrypt data during restricted transactions.
  • Encryption Key Security: Encryption keys must not be stored alongside the encrypted data, nor in any country of concern.
  • Advanced Privacy Techniques: The use of techniques like homomorphic encryption or differential privacy is encouraged to ensure sensitive data cannot be reconstructed from processed data.
CISA has called for public feedback on the proposed security measures before they are finalized. Interested parties can submit their comments by visiting regulations.gov, entering CISA-2024-0029 in the search bar, and submitting feedback through the available form.