UNCLAS SECTION 01 OF 03 NEW DELHI 001520

SIPDIS

SENSITIVE

STATE/PM FOR MICHELE MARKOFF
DOD FOR OASD/NII TIM BLOECHL

E.O. 12958: N/A
TAGS: KCIP TINT KCRM PREL PGOV IN GOI
SUBJECT: GOI UPBEAT ON CYBER-COOPERATION, SERIOUS ABOUT
CYBER-TRAINING

REF: A. NEW DELHI 709

B. NEW DELHI 550

C. 04 NEW DELHI 8060

D. 04 NEW DELHI 7026


1. (SBU) Summary: In a brief February 22 meeting, National
Security Council Secretariat Joint Secretary Arvind Gupta and
Deputy Director (Information Security) Commander Mukesh Saini
were upbeat on US-India cybersecurity cooperation, clarified
the objective of the upcoming April 18-19 Cybersecurity
Seminar in New Delhi, and demonstrated that the GOI is
educating the Indian legal system on cybersecurity and
related issues. They also outlined some of the strengths and
weaknesses of the Indian IT Act (2000) and described the
December 17 arrest of Baazee.com CEO Avnish Bajaj as a case
of inadequate police training on IT issues -- an area they
say they are trying to improve. Gupta also outlined how the
NSCS became the GOI's cybersecurity nodal agency.
Separately, President Kalam in a recent address at the
National Judicial Academy underlined the importance of India
having a robust cybersecurity regime. End Summary.

GOI Very Upbeat on Cyber-Cooperation
--------------


2. (SBU) J/S Gupta opened February 22 discussion by with
Poloff comparing the upcoming April 18-19 Cybersecurity
Seminar (Ref B) in New Delhi to last November's Cybersecurity
Forum: "We shared our concerns then, now we will share
information and cooperation." He also welcomed what he
termed "growing IT interdependence" as part of expanding the
overall US-India relationship, adding that, "The logic of
markets and the logic of globalization make cybersecurity
cooperation a necessary win-win situation."

Goal of April Seminar
--------------


3. (SBU) Gupta then explained that the goal of the April
seminar is to address US concerns regarding Indian legal
issues in the cybersecurity arena, including for example the
IT Act (2000), the Evidence Act, the Criminal and Civil Penal
Codes, digital evidence, data privacy, and confidentiality.

"I was surprised, for example, on how far Indian industry was
ahead of law enforcement regarding due diligence," he
expanded, noting that firms need to be very sensitive due to
their high level of accountability.

Serious about Cybersecurity Legal Training
--------------


4. (SBU) Although Gupta had no data on how much is budgeted
nationally for cybersecurity, he pointed out that related
classes are taught at the Indian Institutes of Science and
that the Indian Institutes of Technology offer both courses
and research opportunities. The Department of Information
Technology also funds cybersecurity research projects, as
does the Banking Research Institute, he added. Cdr. Saini
reiterated GOI interest in on-site co-training in both India
and the US (Ref D), and on cooperation in tackling the "hard
problems" list.


5. (SBU) Gupta told Poloff that the National Judicial
Academy in Bhopal is training new and current judges in
cyberlaw. The training includes a layperson's overview of
the technological possibilities and limits of IT, as well as
training on India's IT laws. Separately, the "Hindustan
Times" on February 25 reported that the first class of a
dozen lower court judges in New Delhi had just completed a
three-day seminar on IT and law as part of its obligations as
a signatory to the UN Commission on International Trade Law.
Their program included overviews of steganography,
encryption, digital signatures, website defacing, and
recovery of digital data as evidence. Gupta hopes to have
some recently-cybertrained judges attend the April Seminar.


6. (U) Separately, in a February 19 address to the Judicial
Colloquium on Science, Laws, and Ethics at the National
Judiciary Academy, President AJP Abdul Kalam offered the
following remarks on modernizing India's cyber laws and cyber
capabilities: "India's cyber laws need to look at the fact
that nowadays nations are electronically connected, with all
their electronic assets. Defense and national security
establishments will be targets for cyber attacks during a
conflict. In such a situation, a country can be defeated
without a missile or aircraft attack, just through
intelligent cyber war. Hence it is essential to generate a
model of the connected economic and defense security system
as a cyber/electronic network. This will reveal the need for
a new policy with redundancy and restriction of external
connectivity and external partnership of certain vital
establishments."

IT Act "India's Most Comprehensive Cybersecurity Tool"
-------------- --------------


7. (SBU) The most comprehensive legal tool New Delhi has for
cybersecurity is the IT Act (2000), Gupta told Poloff. This
statute being revisited, he said, and may be amended to
account for changes in technology and to incorporate lessons
learned, but it is "robust enough and impartial enough to
address the situation" and it "rests on a solid foundation of
Indian civil and criminal law traditions." Gupta underlined
that the problems with the IT Act were that law always lags
behind technology, and that law is bound by borders while IT
is not. "In the UK, Australia, the US, the problems are the
same but the laws are different," he added. Gupta expected
that the US delegation to the April seminar would have many
questions regarding the IT Act.

Baazee.com Arrest Blamed on Inadequate Training
-------------- --


8. (SBU) When asked if the IT Act would be amended in light
of the December 17 arrest of Baazee.com CEO Avnish Bajaj (Ref
C), Gupta answered that his office was surprised when the
arrest happened, and he noted that it drew extensive
criticism from the Indian IT sector as well as from foreign
IT firms. Saini commented that the issue was not the IT Law
itself but the poor police training that led to, as he viewed
it, "improper implementation of the law." Gupta continued
that a major drawback with the IT Law is that even after
almost five years it lacks a substantial body of case law to
guide the police and the courts. Observing that "Personally,
I think the arrest was a mistake," Gupta reiterated the
importance of training judges, police, investigators, and
attorneys on the law, and asked if we could provide US
cybercrime cases that could be used as references as India
develops its own case law. (Note: Mission is following up on
this. End note.) He reiterated that the law is being
revisited and the case is currently in the courts where it
will continue to unfold. He expected the US delegation in
April to discuss this case as well.

Where the NSCS Fits in the GOI
--------------


9. (SBU) Gupta concluded by outlining NSCS's overarching
function as supporting the NSC and NSA MK Narayanan (Ref A),
and providing independent inputs on both traditional and
non-traditional security issues, including cybersecurity. As
such, the NSCS takes the lead in coordinating with agencies
throughout the GOI on national information security policy,
including the Department of Telecommunications, the
Department of Information Technology, and the Ministries of
Law and Home Affairs, as well as academia and private
industry. In the area of international cybersecurity
cooperation, he said that New Delhi's relations with
Washington are "the strongest we have;" although in this
meeting he only specified cybersecurity cooperation with
China, in the past our GOI cybersecurity interlocutors have
referenced relationships with Canada, Russia and Israel (Ref
D).

Comment
--------------


10. (SBU) The brief NSCS conversation and President Kalam's
remarks demonstrate that the GOI understands that the
US-India Cybersecurity Forum can provide New Delhi with the
training and contacts to help it nourish India's growing
information economy and make its governmental organization
and policies regarding cybersecurity more sophisticated. It
provides another strand in the web of functional relations
that strengthens the US-India government-to-government
dynamic. The US-India cybersecurity relationship will
require careful nurturing from both sides to ensure the
working groups fulfill their potential, as well as complete
their stated goals and objectives. However, the groundwork
has been laid for a long-standing and robust cyber exchange
with important political and commercial benefits.
MULFORD