Cyber capabilities leave a lot to be desired

Pakistan is only nuclear state besides North Korea that is not considered cyber power

ISLAMABAD:

In the 1983 Hollywood thriller WarGames, a high school computer geek David Lightman managed to access the US military’s supercomputer WOPR for simulating nuclear war scenarios against the Soviet Union and almost ended up initiating an actual first strike.

Now fast forward to the 2020s, cyberspace like hybrid warfare is the new battlefield as countries look to one up on each other over building computer network security capabilities. Modern wars are fought by attacking on opponents’ critical infrastructure and financial systems instead of using conventional methods.

However, when it comes to the cyber capabilities of Pakistan, it leaves a lot to be desired.

According to the National Cyber Power Index (NCPI) 2022, released by Harvard Kennedy School’s Belfer Centre for Science and International Affairs in September 2022, Pakistan is the only nuclear state besides North Korea that is unranked and is not considered a cyber power or an emerging cyber power.

Surprisingly, Iran ranks at number 10 while India fares far behind at 21 but unfortunately Pakistan is nowhere to be found among the top 30 cyber powers.

However, a deep dive into the NCPI methodology reveals that the index is ill defined.

Not only that it groups defence and offence together, but it also relies on self-reporting of covert capabilities of nation-states.

It remains a burning question that why a country should disclose its status of cyber weapons programme, and even if it does, there is no mechanism to objectively verify that with third-party threat reporting.

Similarly, the US’s cyber index is reported as 43 while that of Iran’s is 15, so does it mean the US cyber investments are only two times more than that of Iran’s, which remains unclear.

The composite index doesn’t make much sense for comparison purpose and the ranking issued remains subjective. It is strange to note that the cyber index of Saudi Arabia and Israel is almost same, even though it was Israel which damaged Iran’s nuclear programme using its cyber weapon Stuxnet.

It is ironical to note that Iran’s infrastructure very often gets hit with cyberattacks such as the recent fire incident in blast furnace.

The index comprises two aspects: actual cyber capabilities and the intent to utilise cyber capabilities (even if a country doesn’t have any).

For example, a higher rate of approval of Google content removal requests made by a government results in more points for the ‘intent’ portion. Similarly, the headcount of national bodies that enforce cyber laws and data protection laws contribute towards the intent score.

The fact that India established the Defence Cyber Agency in 2019, which though remains defunct, helped it seize the 21st position on the NCPI.

Should Pakistan decide to improve its spot on the index, one modus operandi is to establish cyber military planning wings with a clear intent to formulate a strategy that involves design, development and deployment of cyber weapons in the near future.

This cyber strategy document should be updated and published annually, listing potential threats, priorities and timelines.

Moreover, members of the wing should actively participate in the 22 ISO technical committees, ITU’s study groups and UN working groups related to cyber governance as well as the Internet Governance Forum (IGF) and the Global Forum for Cyber Expertise (GFCE).

The above-mentioned action items are a low-hanging fruit if Pakistan needs to get ranked among the top 30 cyber powers in the NCPI. But developing extensive expertise to initiate a full-fledged cyber weapons programme is a totally different ball game.

At present, the idea of developing a cyber arsenal like Russia to influence election results and public opinion in other countries is far-fetched but Pakistan can lease and co-develop potent cyber tools for the purpose of surveillance in the short term.

Pakistan can opt to pursue that trajectory as developing actual offensive capabilities on the lines of Russia and China is a long way to go unless there is a substantial technology transfer from the US and China.

The writer is a Cambridge graduate and is working as a strategy consultant.

 

 

Published in The Express Tribune, October 31^st, 2022.

Like Business on Facebook, follow @TribuneBiz on Twitter to stay informed and join in the conversation.