Israel pager attack | Now cyber kinetic warfare

The coordinated pager attacks that struck the Hezbollah raise the spectre of cyber kinetic warfare, which combines communication technologies with physical destruction. India faces a heightened risk as most of its connected devices depend on Chinese and foreign components

ISSUE DATE: Oct 14, 2024

On September 17, around 3.30 pm Beirut time, thousands of pagers used by members of the Hezbollah, the Shia militant group, started exploding across Lebanon. The explosions killed 11 and injured 2,700. The next day, it was the turn of walkie talkies they used to blow up, killing over 20 and injuring 450 people. The mass electronic sabotage, presumed to have been orchestrated by the Israel Defense Forces (IDF) along with the country’s spy agency, Mossad, represents a new chapter in electronic warfare. The pager/ walkie talkie attacks raise the spectre worldwide of the potential widespread weaponisation and targeting of personal gadgets. Though putting explosives in phones and detonating them is an old art in the secret agent’s toolbox, what makes the alleged Israeli attack unique is the deep supply chain interdiction of a large cache of devices and the planting and detonating of explosives in so many of them at once. Meanwhile, the latest instalment of Israeli action against Hezbollah is being pursued through more conventional means and has taken on a dangerous dimension with the killing of Hezbollah’s chief, Hasan Nasrallah, in an Israeli airstrike on September 27. In response to Nasrallah’s death and the Israeli army’s ground offensive against Hezbollah into Lebanon itself, Iran, Israel’s main adversary in the region, launched around 200 ballistic missiles into Israel on October 1. Aimed at air bases and military installations, most were intercepted by Israel’s Iron Dome air defence system.

The reason why military experts are terming the pager attacks as a watershed moment in electronic sabotage is the potential of such attacks on larger targets connected to the internet—say, civilian and military communications systems, or power grids—that can paralyse a country at war. The keyword here is not just cyber warfare, but cyber kinetic warfare. While cyber attacks involve an attempt to damage another nation’s computers or information networks through viruses or denial-of-service attacks, cyber kinetic attacks use cyber attacks to inflict kinetic (or physical) damage on infrastructure or cause injury or death to people. The growth of cyber physical systems in everything, from automobiles, aircraft, personal gadgets and household appliances (the Internet of Things) to large national/ military assets, opens up frightening possibilities of acts of sabotage with both physical and cyber elements.

India is particularly vulnerable to such attacks, given its over-reliance on Chinese equipment in communication networks and Chinese-made surveillance cameras. Though concerns about Chinese surveillance and possible system failure triggered by embedded malware are being acted upon, the use of previously sabotaged hardware—like the pagers—being activated by a cyber attack or a malware that is programmed to trigger destruction, cannot be ruled out now.

“Terrorists can use weaponised electronics but only states have the capability to carry out the kind of large-scale attacks or mass surveillance that impacts national security,” says Lt Gen. D.S. Hooda, former commander of the army’s Northern Command. He says that while cyber attacks and surveillance are nothing new, the addition of a kinetic element is a novelty.

Threats to India

Indian intelligence agencies have been issuing warnings about the country’s communications network, whose hardware and software are largely of Chinese or foreign origin and thus can potentially be used to snoop on India during normal times and for cyber attacks in a future conflict. Indian telecommunications companies, like the state-owned Bharat Sanchar Nigam Limited (BSNL) and its subsidiary, Mahanagar Telephone Nigam Limited (MTNL) as well as Bharti Airtel and Vodafone Idea, are dependent on Chinese equipment. In 2020, the Centre mandated that telcos should use equipment only from vendors that have received “trusted source” certification from the government. The Chinese vendors Huawei and ZTE have yet to receive this certification. “Unless we have our own communications network using indigenous material, no one is safe. BSNL networks are based on Chinese equipment,” says Colonel Hunny Bakshi (retd), former commander of an intelligence unit created after the 26/11 Mumbai attacks.

Lt Gen. Prakash Katoch (retd), former Director General of Information Systems of the Indian Army, says, “China has the capability to carry out cyber kinetic attacks anywhere, as it dominates the electronic market globally. In India, we don’t even have a 100 per cent check of imported items for embedded malware. And even surveillance devices like CCTVs (including in sensitive locations) are Chinese-origin.”

Indeed, experts have raised an alarm over the unchecked proliferation of Chinese-made closed circuit television (CCTV) cameras installed in critical government instituti­ons in India like the naval establishments and the Defence Research and Development Organisation (DRDO). These devices potentially allow remote surveillance and data breaches that Beijing could exploit. The threat is real, for in the past few years the US, UK and Australia have all banned the use of Chinese CCTVs. Now, the Union home ministry has set up a wing of intelligence officials to monitor Chinese firms’ engagement with Indian projects. Additionally, the government is working to phase out Chinese equipment within the national security apparatus.

Experts are also concerned that Chinese manufacturers dominate the global supply of Cellular IoT Modules (CIMs), which enable the working of IoT by extending connectivity to everyday physical devices via the cellular network (4G/ 5G). CIMs are embedded in a wide range of devices, from personal gadgets, CCTVs and drones to production lines and power grids. CIMs can receive firmware updates remotely without the end user’s awareness. These could carry malware, enabling the Chinese to manipulate devices, shut them down, or steal data. A cyber kinetic attack can also not be discounted. How does India deal with this? Experts say the government must ensure strict testing of CIMs supplied by foreign vendors against globally accepted security standards. India should also develop indigenous CIMs for foolproof security.

Particularly vulnerable to cyber kinetic attack is the aviation sector worldwide, which increasingly uses inflight Wi-Fi and fly-by-wire systems—computer-regulated aircraft flight control systems that replace mechanical/ manual flight controls with an electronic interface. An Indian security official working in the aviation sector says the Lebanon attacks have shaken the trust in existing safety protocols. Jaijit Bhattacharya, president of the New Delhi-based Centre for Digital Economy Policy Research (C-DEP), stresses the all-pervasive reach of cyber kinetic warfare—a smart car with built-in explosives that can blow up after cyber surveillance detects a passenger, or drones that can search and kill humans individually. “The possibilities of combining cyber with Artificial Intelligence and kinetics are mindboggling and will have a deep impact on conflicts,” says Bhattacharya.

Soon after the Lebanon attacks, the Indian Army started a course for officers on how future wars will be fought in the cyber, space and electromagnetic domains while exploring the impact of AI, machine learning and hypersonics. After the events of September 17-18, fields of conflict have expanded; India must be battle-ready to meet its exigencies.