Military and C4I

Asia - Grasping Information Warfare?

By Damon Bristow. While Asian countries have been quick to seize the commercial and civilian opportunities presented by the revolution in information technology, they have been slower to appreciate the need to protect their critical infrastructure from electronic warfare and to develop their own attack capabilities. DESPITE the advance of the information technology (IT) revolution in Asia, the degree to which the armed forces and governments in the region have come to terms with the military and security implications of developments is still unclear. What, if anything, are the region's militaries and governments doing to prepare themselves and their populations for the information age? And what kind of information warfare (IW) capabilities do the nations concerned currently possess? Asia's rise as an 'info power' After experiencing an explosion in economic growth in the late 1980s and 1990s, a similarly rapid expansion in the use of communications and IT is now under way in Asia. Access to telephones across the region has increased dramatically in the past decade. According to the United Nations World Development Report (UNWDR), in 1990 there were only six telephone lines per 1,000 people in India, eight in Pakistan, less than one in China, six in Indonesia, 10 in the Philippines, 24 in Thailand, 89 in Malaysia and 385 in Singapore. By 1998 the statistics had changed dramatically, with the number of lines per 1,000 people rising to 70 in China, 222 in India, 27 in Indonesia, and 198 in Malaysia. The pattern is repeating itself across the region (see table 1). Growth in the use of mobile telephones has been even more impressive. Just 10 years ago there were so few mobile telephone users in Asia that the UNWDR did not include them as a development indicator. By 1998, however, there were 19 mobile telephones per 1,000 people in China, one in India, five in Indonesia, 99 in Malaysia, 22 in the Philippines and 346 in Singapore. Access to personal computers is also rising. In 1990 the UN estimated that

there were 8.9 personal computers per 1,000 people in China, 2.7 in India, 8.2 in Indonesia, 58.6 in Malaysia, 3.9 in Pakistan, 21.6 in Thailand and 458.4 in Singapore. Asian companies are also major producers of computer components, computers and their associated hardware. By 1997 Taiwan had become the world's third largest computer hardware supplier, after the USA and Japan. Asia's computer programmers are internationally renowned. India is quickly establishing itself as the software development capital of Asia, with 340,000 software professionals employed in the country, up from 180,000 in 1996. Total exports of IT-related products amounted to US$9 billion last year. Increasing numbers are going online in Asia (see table 2). Over 18% of the world's 319 million registered Internet users are from the region. By 2005 this figure is expected to rise to 24%. The rapid expansion of Asian communications technology and the Internet has been paralleled by a growth in e-commerce. With corporate demand for PCs in the region booming, the International Data Corp estimates that by 2003 the Asian region will account for 25% of global e-commerce revenues. According to other calculations, it is expected that by 2005 the value of business-to-business e-commerce transactions will reach $125 billion in China, $77 billion in South Korea, $55 billion in Taiwan, and $11 billion in Indonesia, Thailand and Singapore. IW: establishing the boundaries What does this mean for the region's armed forces and security-related organisations? As their familiarity with new technology increases, the ability of the region's armed forces to harness these technologies to improve their IW potential will expand. Options currently available to nations interested in acquiring IW capabilities range from targeting other countries' command and control (C(2)) systems - using, for example, electronic warfare (EW) techniques - through to utilising all aspects of the media for psychological warfare, hacker-warfare and cyber-terrorism (see table 3). In theory at least, the introduction of such 'asymmetric' capabilities should allow a country to avoid an opponent's strengths by taking advantage of its relative weaknesses. However, military reliance on IT will inevitably result in an increased vulnerability to attack, not only from neighbouring states but from non-state actors. The more technologically sophisticated a nation, the greater the challenge to defend its critical infrastructure from attack, both for government and business. China and Taiwan Chinese and Taiwanese IW efforts were highlighted after the outbreak of

cyber-warfare skirmishes across the Taiwan Strait, following former President Lee Teng-hui's decision to describe relations between China and Taiwan as "special state-to-state relations" in June 1999. The People's Republic of China (PRC) According to the US Department of Defence (DoD), the PRC's offensive IW programme is in the early stages of research. The DoD believes that China is studying offensive employment of IW against foreign economic, logistics, and command, control, communications, computers and intelligence (C(4)I) systems. Specifically, it is striving to establish a competence in attacking other countries' computers. Is thought to be researching methods to insert computer viruses into foreign military and civilian computer networks. China is also trying to improve its EW capabilities and has focused its attention on interception, direction finding, jamming, imagery reconnaissance, surveillance and electronic intelligence collection, and electronic countermeasures. The development of a dedicated communications system to parallel the improvements in the civilian communications network is another priority for the military. A fibre-optic network linking all provincial capitals in China, with the exception of Lhasa, has been installed and is being extended to connect all cities at the prefecture level. China has also shown an interest in developing its capability to launch psychological operations (psyops), largely using its outlets in the Hong Kong media. The People's Liberation Army (PLA) is working hard to put these technologies to practical use. Since 1997 the PLA has held a number of exercises in which it has attempted to interrupt, paralyse or destroy enemy broadcasting and military communications. Furthermore, at the October 2000 meeting of the Chinese Communist Party Central Committee in Beijing, it is believed that plans were adopted to streamline the military and introduce many of the technologies outlined above. New capabilities, including combined EW-armoured artillery divisions, are expected to be added to the PLA's existing 24 Group Armies. However, as China has become increasingly dependent on technology, it has also become vulnerable to attacks against its information networks. In August a Hong Kong newspaper reported that a series of high-tech combat exercises conducted by the PLA in June were attacked by a computer hacker and had to be suspended. As a result of this and other incidents, the PLA has made enhancing its defensive IW programmes a major priority. Beijing has been aware of its vulnerabilities in this area for some time

and has focused its attentions on defending its computer networks from attack. China has concentrated on anti-virus solutions, network security and advanced data communications technologies. Following the August incident, the State Council established a Y1.2 billion ($145 million) fund to establish a permanent organisation designed to prevent hacker intrusions at the PLA General Staff Headquarters, the Ministry of Public Security, the Ministry of State Security and a number of other departments. China's Ministry of Information Affairs is already thought to have established a China Network Management Centre in an attempt to deflect attacks on its websites. The PLA, meanwhile, is believed to have incorporated IW-related scenarios into several recent operational exercises. It has worked hard to increase its proficiency in defensive measures, especially against computer viruses, or so-called firewalls. In the EW/communications field, the PLA is currently introducing sophisticated encryption technology. Its fibreoptic communications network offers increased security. Lastly, the PRC.is known to be looking at a variety of ways to reduce the vulnerability of its communication systems to interception and jamming. China has invested in switching technology software, allowing for the automatic re-routing of communications traffic if a C(2) node is disabled by an enemy strike. Despite all this, China's IW capability is (and is likely to remain) limited. According to the US-produced Military Critical Technologies List (MCTL), which provides an assessment of the technological capabilities of foreign nations, China's ability to defend itself against an electronic attack remains almost non-existent (see table 4). The Republic of China (ROC - Taiwan) The climate of mistrust and military competition that exists across the Taiwan Strait, as well as the development of China's IW capabilities, has prompted concern in Taipei. According to the director of the information department of Taiwan's National Security Bureau (NSB), Chang Kuangyuan, more than 20 government agency websites were attacked by Chinese hackers in 1999. In March 2000 the Communications and Electronics Service of the ROC Army announced that China was attempting to paralyse parts of Taiwan's national defence, transportation and financial infrastructure by launching tens of

thousands of IW attacks. In response, Taiwan has begun to invest increasing amounts of time and money in developing its own offensive IW capabilities. In terms of planning, the island's former premier and defence minster Tang Fei announced that the government would establish an IW unit by 2000, as well as a committee on IW strategy. The Taiwanese armed forces, meanwhile, have decided that the upgrade of the island's EW capabilities is their main goal. Efforts are being made to incorporate IW capabilities into military exercises. During the 'Hankuang 16' exercise last August, the military is believed to have tested its ability to withstand an attack from the mainland on its C(4)I systems. A number of Taiwanese military officials have also claimed that some 2,000 computer viruses were tested during the exercise. As with China, Taiwan's IW capabilities are believed to be limited, although there is some difference of opinion on the subject. Many analysts believe that Taiwan's systems integration, C(4)I and IW capabilities are among the best in Asia. The consensus of Ministry of National Defence (MND) officials familiar with the area, however, appears to be that Taiwan's strengths in this area are overrated. More specifically, they argue that, although Taiwan's ability to defend its military and civilian infrastructures from attack are strong, its ability to strike back is limited. Northeast Asia Japan Japan's susceptibility to IW attack has been highlighted by a series of attacks on government websites. In January 2000 16 Japanese government websites, including those of the Science and Technology Agency and the Mainichi Shimbum newspaper, were hacked into. Their content was erased and replaced with a Chinese message criticising Japan's role in the Nanjing massacre. Interestingly, in response to these attacks, the Tokyo Metropolitan Police Department announced that 12 of the e-mails had come through servers in the PRC. This prompted Raisuke Miyawaki, a former public relations advisor to former Prime Minister Yasuhiro Nakasone, to complain that these attacks clearly demonstrated the failure of Japanese government officials and business executives to "understand the latest technology involving information and communication using computers". The Japanese Defence Agency (JDA) is also becoming aware of the potential threat posed to Japan from cyber and other IW attacks. Japan's Defence

White Paper, The Defence of Japan 2000, refers for the first time to the threat posed by IW. The paper states that Japan is in the process of studying ways in which it should respond to attacks on its computer networks. It is also rumoured that between 2001-06 the JSDA will establish a cyber-warfare unit to assess the threat from attack. However, in a frank admission of the degree to which Japan has lagged behind in embracing the information revolution, the current Japanese prime minister, Yoshiro Mori, promised that he would make Japan an advanced IT nation within five years. More specifically, Mori stated his intention to draw up a national IT strategy, the 'e-Japan plan', as soon as possible. Mori also committed the government to creating an advanced online network in Japan to lower the costs of the country's Internet services, take steps to improve education in the area of IT and remove or ease current legislation that is hindering the spread of e-commerce in the country. Although little has officially been written on the subject, it is thought that, with its efforts to improve its information-gathering capabilities through the acquisition of observation satellites and airborne early warning aircraft, the JSDA is also developing a limited IW capability. Japan has already acquired electronic attack and electronic protection capabilities (see table 4). Republic of Korea (ROK - South Korea) It is a similar story in South Korea. Attacks on high-profile commercial and government websites are rising - between January and October this year 1,238 cases of hacking attacks in the country were reported. In addition to this, the South Korean MND and the National Intelligence Services issued reports this year that advised, not only that the country's armed forces should "prepare for cyber-warfare in the future from enemy countries", but also that they should consider establishing "specialist units for cyber warfare". The ROK government has also sent out an appeal to the country's universities asking for the assistance of hacker groups in dealing with the problem of cyber-attacks and allocated $226,000 to fund the project. According to the MTCL, South Korea's IW capabilities are similar to those of Japan (see table 4). Democratic People's Republic of Korea (DPRK - North Korea) Even the DPRK is believed to have paid some attention to the development of a range of military IW capabilities. The North Korean government claims that the country's communications network has been upgraded using

fibre-optic cables; that the use of computers is being expanded; and that the computer networks of a number of the country's ministries and agencies, as well as its military units, are being increasingly connected. The DPRK is also beginning to show interest in developing an indigenous computing capability and is thought to possess a large-scale computer production capability. These developments are thought to have led to an improvement in P'yongyang's hacking and virus insertion capabilities. P'yongyang believes that by using information technology it will be able catch up, and eventually surpass, more developed countries, not only in the commercial, but also in the military sphere. However, although North Korea has some limited electronic attack and electronic protection capabilities, and has established the Korea Computer Centre and the P'yongyang Programme Centre to develop information and communications technology, there is no sign yet that it is thinking about ways to defend its networks from attack. India and Pakistan Both India and Pakistan have begun to assess the military benefits of IT, the growing vulnerability of their infrastructure to attack and also to deploy some limited capabilities. However, unlike the situation in the Taiwan Straits, there has yet to be an outbreak of hacker-warfare between the hostile neighbours. India The Indian government was among the first in Asia to realise the potential offered by IT - former Prime Minister Rajiv Ghandi is credited with laying the foundations, back in the late 1980s, for India's success in software development. The military has been slower on the uptake, although it is now looking to redress the balance. In 1999 the Indian army produced a document, IT Roadmap 2000, providing an outline for the introduction of IT into the military. Assessing the current state of India's IW capabilities is harder to gauge. According to the MTCL, India is better prepared than China. It has also developed some networking and switching capabilities. Like China, India is looking to establish a national network of fibre-optic cable. Not surprisingly for a country that currently produces more than 100,000 IT professionals every year, India is also assessed as being extremely capable in the areas of high-performance computing and software. As with China,

however, India's ability to wage either a cyber-warfare or broader IW campaign is still limited. Furthermore, there is no sign, as yet, that government and industry are working together to find ways to defend India's critical infrastructure from attack. Pakistan Pakistan has slowly realised that it is lagging behind India in IT. In August this year Pakistan's minister for science and technology, Dr Ataur Rahman, launched Pakistan's first IT policy and action plan. It will attempt to assist the development of IT and communications in Pakistan by establishing four IT universities, strengthening the country's existing IT institutes and modernising the existing telecommunications infrastructure. Pakistan's military is also showing some interest in acquiring IW capabilities. There has been speculation that the government provides financial support to certain groups involved in hacking and 'cybercrime', in much the same way it does to those militant groups operating in Indian-administered Kashmir. Southeast Asia In general, the countries of Southeast Asia lag behind their neighbours in Northeast Asia and India. Singapore The obvious exception to the above statement is Singapore. Not surprisingly for the country most online in Asia, Singapore's IW capabilities are the most advanced in Southeast Asia, if not the entire region. Singapore's interest in developing an offensive and defensive IW capability was openly articulated in its recent defence White Paper, Defending Singapore in the 21st Century. This stresses the need for a strong "indigenous technological capability" and the development of "silver bullets such as electronic warfare for that extra edge". The main organisations involved in Singapore's IW programme are the Defence Science and Technology Agency (DSTA) and the Defence Science Organisation (DSO) National Laboratories, both of which are affiliated to the MINDEF. The DSTA is currently involved in developing C(2) systems and specialised infrastructure "to meet the operational requirements" of the Singapore armed forces. Within the DSTA, the Command, Control Communications and Systems Organisation (CSO) laboratories and the Systems and Computer Organisation (SCO) are believed to be engaged in IW research. Finally, the DSO National Laboratories is researching ways of protecting military communications and computing infrastructure from external attack. In organisational terms, it is an open secret that Singapore's military hierarchy is committed to the development of an offensive cyber-warfare

capability, and has established methods for inserting computer viruses into other countries' computer networks. A dedicated cyber-warfare unit is thought to have been established within the MINDEF. All these developments are believed to have the support of a number of high-ranking politicians. Although they are lacking in the more technical and R&D skills possessed by their neighbours, a number of other Southeast Asian countries have developed niche skills in certain areas across the IW spectrum. Indonesia Indonesia has recently demonstrated its skill at undertaking psyops campaigns, using the national media. From the moment the Australian-led International Force for East Timor (INTERFET) landed in Dili in August 1999, the Indonesian government ran a 'black' media campaign through the national news agency, Antara, against Australian troops, which Canberra was unable to counter for the first week of the operation and which complicated its efforts to build a coalition among other members of the Association of Southeast Asian Nations (ASEAN). Although there is little information currently in the public domain, control over the operation, and others like it, is thought to come under the responsibility of either the Indonesian armed forces (Tentara Nasional Indonesia - TNI), the Ministry of Security or the State Intelligence Co-ordination Agency. There is, as yet, no evidence to suggest that Indonesia has made any advances in other IW areas, such as cyberwarfare, or that is exploring issues such as network security. Myanmar (formerly Burma) The Myanmar government has recently demonstrated its awareness of the power of communications generally, and the Internet specifically, for disseminating propaganda. It has established a website, and sent information by e-mail to foreign correspondents and other relevant parties. This technique is also used by Myanmar exile groups to spread information about developments within the country. General use of the Internet, as well as fax machines and other technologies that allow communication with the outside world, are heavily regulated in Myanmar. Their illegal possession carries a heavy prison sentence. Malaysia and the rest Malaysia has made the development of its information infrastructure a central facet of its economic modernisation policy. In 1997 Kuala Lumpur announced its intention to build a Multimedia Super Corridor, brimming with fibre-optic cables and research laboratories, as well as a new government

capital, Putrajaya. There is currently no evidence to suggest that the Malaysian armed forces have begun to incorporate any of these ideas, although it is possible that individuals have begun to consider the military implications of IT. There is no reason, as yet, to believe that Cambodia, Laos, the Philippines or Thailand are showing any real interest in the military advantages of incorporating IT. Mixed capabilities Current efforts by Asian countries to develop IW capabilities and defend their critical infrastructures from attack, are mixed. The region can be divided into three groups: *those countries actively thinking about the subject and beginning to do something about it - China, Taiwan, Singapore and possibly India; *those just becoming aware of the challenge, such as Japan and South Korea; and *those that have developed some limited capabilities in niche areas, such as Indonesia, but as a whole are unconcerned about the opportunities and threats posed to them by the spread of IT. In the short term, however, it is unlikely that these discrepancies in capability will radically influence the conventional balance of power in the region. Rather, their introduction will complement existing conventional capabilities, thus further underpinning the existing military hierarchy currently emerging within Asia. How the region's governments will deal with threats from less conventional sources, such as dedicated terrorist groups with different agendas to state actors, is a different question altogether. 1. USE OF TELEPHONES AND MOBILE PHONES: 1990-98 Country Telephone mainlines per 1,000 people (1990) Telephone mainlines per 1,000 people (1998) Mobile telephones per 1,000 people (1998) China 19 India 6 1 Indonesia 6 5 Japan 411 374 Korea 310 302 Laos Malaysia 89 99

70 22 27 503 433 6 1 198

Myanmar (Burma) Pakistan 1 The Philippines 22 Singapore 346 Thailand 32 Vietnam 2

8 10 385 24 -

5 0 19 37 562 84 26

Source: UN World Development Reports, 1994 and 2000 2. INTERNET USAGE IN ASIA: 1997-2000 Country pop 1997 China 1.34 India 0.45 Indonesia 0.01 Japan 21.38 Korea 6.88 Myanmar 500 Pakistan 0.85 Philippines 0.62 Singapore 41.91 Taiwan 28.84 Thailand 1.65 Vietnam 0.13 Users 1997 200,000 80,000 80,000 8.6 million 700,000 % pop 1997 0.0001 0.01 6.80 1.53 Users 2000 16.9 million 4.5 million 400,000 27.06 million 15.3 million 1.2 million 500,000 1.74 million 6.4 million 1 million 100,000 %

84,425 500,000 1.06 million 131,000 6,000

14.7 5 -

Source: Compiled from various sources by Nue Internet Systems, http://www.nue.ie 3. ASYMMETRIC THREATS TO UK MILITARY INTERVENTION OPERATIONS - IW TECHNIQUES Form Subtype Methods C(2)W Anti-head Targets C(2) Systems rather than commanders. Anti-neck Severs links between C(2) 'head' and fielded military forces ('body').

IBW Targets ISR systems that sense the battlespace and disseminate results (such as AWACS, JSTARS). EW Anti-radar Either by jamming or direct attack using High-speed Anti Radiation Missiles (HARM). Anti-communications That is, 'spoofing' (substituting deceptive messages for valid ones). Cryptography Code-making/breaking. PSYW Anti-will Propaganda using global media/Direct-Broadcast Satellites (DBS); based on 'the iron fist in a velvet glove'. Anti-troop Instill fear of death among fielded forces/resentment 'between the trench and the castle'. Anti-commander 'Nothing so much suggests the imminence of defeat than confused and disoriented commanders'. Hackerwarfare Penetrating computer networks using 'Computer Malicious Codes' (CMCs) in order to read, distort or destroy vital warfare information. EIW Economic Blockade Blocking (or restricting access to) 'Technohigh-bandwidth information flows that Imperialism' facilitate global commerce. (Information) Cyber Info-Terrorism Terrorists using information means to warfare achieve their goals. ('cyber-terrorism') Semantic Unlike 'hacker attack', which produces random or systematic failures with systems ceasing to operate, a system under attack 'semantic attack' will be perceived as operating correctly but will generate answers at variance with reality. Simula-warfare 'Virtual Reality' warfare; based on the premise that fighting a simulated war could prove to the enemy that it would lose. 'Gibson' warfare The stuff of science-fiction (named after William Gibson's movie Neuromancer). Source: US National Defense University 4. SUMMARY OF IW CAPABILITIES Country Optical Counter-Measures Australia Belgium Canada China Czech Republic France X Electronic Attack X X X X X XX Electronic Protection X X X X X XX

Optical Counter-Counter-Measures X X X XX

Germany XX India Israel XX Japan N. Korea Russia XX S. Korea UK XX US XX

XX X XX X X XX XX XX XX

X X XX X X XX X X XX

XX X X XX X X X X XX X X XX XX

Critical Technologies Capabilities: All XX Majority XX Some X Limited X Source: Military Critical Technologies List (MTCL) Graphic: While Asian countries have been quick to seize the commercial and civilian opportunities presented by the revolution in information technology, theyhave been slower to appreciate the need to protect their critical infrastructure from electronic warfare and to develop their own attack capabilities. In this month's Focus, Damon Bristow and Tim Thomas report on who has the high ground in Asian information warfare. (Source: A Hird Design) Photograph: Taiwans former premier and defence minister, Tang Fei, announced that the government would establish an IW unit by 2000, as well as a committee on IW strategy. (Source: PA News) Photograph: Japanese Prime Minister Yoshiro Mori has promised that he will make Japan an advanced IT nation within five years. He intends to draw up a national IT strategy, the 'e-Japan plan', as soon as possible. (Source: PA NEWS). Volume 012/012