Cyber Warfare, Cyber Terrorism and Cyber Laws in India and Global: A detailed analysis.

By Jeet Sinha

ABSTRACT

The Internet in modern times is irreplaceable as it is essential for a country’s holistic development. Various kinds of work depending on the internet help in the development of the economy. Due to the growth of the internet, a country’s economy has been positively affected as evidenced by the growth of GDP. The Internet helps in making connections worldwide and is a very powerful means for improving foreign relations. The Internet also plays a vital role in disseminating information. Therefore, there is a necessity for rules and regulations for having a safe and secure internet environment. Due to the widespread use of the internet, it is also misused by people in various ways to disturb a country’s law and order. The Internet can be misused to cause internal disturbance by the Country’s citizens or foreign governments or terrorist organizations. Hence, the internet has the potential to disturb the sovereignty of a country. There are many such events that occurred due to the misuse of the internet, cyber terrorism and cyber warfare are inevitable if the law and order of the country do not regulate it. The Internet in recent years has taken the shape of a fundamental right in the country in relation to freedom of speech and expression. However, reasonable restrictions can only be imposed by the government on the citizens. We need to identify global laws to regulate these kinds of violations through the internet.  Therefore, it is important to observe the changing contours to find out distinctive lines to balance Internet freedom and Cyberwar in India and Globally. In this paper, the author will deal with this issue by comparing the different laws, rules and regulations in different jurisdictions and laws which is governing the international boundaries for the internet.

Keywords: Cyber warfare and terrorism, Internet Security, Rules and Regulations and Sovereignty. 

By Jeet Sinha

I.               INTRODUCTION

The Internet has created a new space called ‘Cyberspace’.[1] Cyberspace is owned by no single country rather it is open to all countries.[2] However, if we look at the distinguishing factors of the state, it has its own territory. The state has all kinds of control over territory or sovereignty over its territory.[3] The proliferation of the internet does not seek any physical boundaries. The internet is circulated everywhere through electronic waves or optic fibers. It is evident that the Internet in modern times is irreplaceable as it is essential for a country’s holistic development. Different kinds of work depending on the internet help in the development of the economy. Due to the growth of the internet, a country’s economy has been positively affected as evidenced by the growth of GDP.[4]

Further, modern technology requires a lot of digital work, we can see that various military missiles, rockets and weapons are signaled and directed only with a few computer operations.[5] Internet security becomes very important in such a scenario. Protection from hackers and other non-state actors to prevent misuse of cyberspace becomes challenge to the state. Waging war from cyberspace is inexpensive and can be done from any place without being traced.  Therefore, it becomes, a weapon for enemy states or non-state actors to disturb the sovereignty of the country.[6]

Additionally, the internet can also be misused to spread misinformation or incite hate against any community which may result in internal aggression and violence. These types of misuse can be countered by the law of the state. However, when one person from a different state causes such an offence in that case international principles must be applied. There are various challenges pertaining to the application of law in international terrain as the exact location or territory from which a person uses the internet is very difficult to identify. Also, the person may be sitting in some neutral country and publishing information about enemy country.[7]

It is important to recognize that the internet has become a battlefield in the modern era, where countries and non-state actors engage in cyber warfare to achieve their objectives. Cyber warfare involves the use of digital tools and techniques to attack computer systems, networks, and information infrastructure for political or military purposes. These attacks can range from stealing sensitive information to disrupting critical infrastructure and causing physical harm. Given the potential consequences of cyber warfare, it is essential to understand its nature, scope, and impact on national security. Therefore, this article will focus on the aspects of cyber warfare and its implications for state sovereignty, national security, and international relations.

The methodology of this article will be qualitative, which involves the analysis of data through observations, interviews, and case studies. The research will focus on three central research questions that will guide the analysis of the topic. First, the article will examine whether there is a threat to national sovereignty through the misuse of the internet. Second, it will explore whether there are appropriate laws and regulations to govern the appreciable misuse of the internet. Finally, the article will investigate whether there should be global standards or international conventions for internet security threats. By addressing these questions, the article aims to provide insights into the complex nature of cyber warfare and its implications for international security and governance.

II.            DEFINITION OF CYBER WARFARE

“Indeed, in today’s world, acts of terror could come not only from a few extremists in suicide vests but from a few keystrokes on the computer — a weapon of mass disruption.”[8]

These words coming from the strongest leader of the most developed country show the impact of cyber threats all around the world. It is immensely important to understand the dimension of cyberspace to counteract in all possible means to have sustainable development with the internet. In modern times, everything is dependent on the internet, ranging from small actions like ordering food online to critical actions like military weapons operated by internet which can destroy any country with few keystrokes.  Cyber warfare, in this case, becomes an emerging concept in the era of the internet. It is very important to have a definition of cyber warfare to understand what falls under the definition. Before moving to the definition of Cyber warfare we will investigate the challenges of the exact definition of cyber warfare. Cyber wars can be instigated by both countries and non-state actors. When a country is involved in such kind of activity then it is an act of raging war against another country. So, such an act can be called upon the definition of war as per the Geneva convention. [9]

Now, it is interesting to note that there is no exact definition of cyberwarfare or cyber war.[10] The terms CNA (Computer Network Attack), (offensive) IO (Information Operation), and IW (Information Warfare) are often used to describe cyber war or cyber warfare. The US Department of Defense defines CNA as “actions taken through the use of computer network to disrupt, deny, degrade, or destroy information resident in computers and computer networks, or the computer and networks themselves.”[11] By IO, the DOD means “the integrated employment of the core capabilities of electronic warfare, computer network operations, psychological operations, military deception and operations security, in concert with specified supporting and related capabilities, to influence, disrupt, corrupt or usurp adversarial human and automated decision making while protecting our own.”[12] The distinction between the terms offensive and defensive IO is no longer made by the DOD. However, it applies to both offensive and defensive objectives. IW is sub-category of IO, which was defined as “information operations conducted during time of crisis or conflict or conflict to achieve or promote specific objective over a specific adversary or adversaries.[13]

All these terms are used to describe cyber warfare in the USA by specialized department of defense. Cyber warfare can have multiple aspects such as war through spread of misinformation, through supply of sensitive information, to inciting hate among communities, these kinds of warfare strategies can be called information warfare. Another type of cyber warfare can be incited through hacking the computers of banks, military, governments, companies, etc.

Some authors like Clarke[14] defines “Cyberwar” as “actions by a nation-state to penetrate another nation’s computers; or networks for the purposes of causing damage or disruption.”

There are several recognized forms of Cyber warfare[15]:

1. : It is an act of spying on another country using the cyberspace. It is used to extract sensitive information from the country. According to Cambridge Dictionary, it means discovering of secrets, especially political or military information of another country or the industrial information of a business.[16]
2. : It is an act of hacking the government computer for the advantage of the terrorist organization or enemy country. In this type of warfare strategy, the hacker tries to lure the loopholes in government agencies and exploit them. The hackers try to access the government computer and then try to steal information, destroy sensitive data or leverage insider threats such as dissatisfied or careless employees, or government employees with affiliation to the attacking country.
3. : In this type of strategy, the hacker tries to exhaust the sensitive websites with too many requests and in such a manner that it prevents the legitimate user from accessing the website.[17]
4. : This type of attack is very common in India, where some information is demeaning to some person or community and is spread to cause violence. Also, it is done to gain popularity and people support towards another community or organization. These can range from anything touching people’s sentiments to making them believe cheated and liable to act.[18]
5. : It is an act of terrorism carried through cyberspace. The definition of terrorism means unlawful use of force or violence, or threat of force or violence, against persons or property to inculcate fear, intimidate or coerce a government, the civilian population, or any segment thereof, in furtherance of goals that are generally religion, political or ideological.
6. : There cannot be an exhaustive list of cyber warfare strategies as they can be novel with each attack. There are fewer chances that the country repeats the same mistake. So, as terrorist organizations and enemy states keep on improving the method of attack. It is essential to have an inclusive definition. So, that law can govern all types of Cyber warfare strategies.

III.          THE CYBERSPACE AS A THREAT TO THE SOVEREIGNTY OF A COUNTRY.

a)    General threat to sovereignty

Cyberspace can act as a threat to sovereignty of a country not just because of cyber warfare rather it challenges the three fundamental functions of the state: providing national security, regulating economic activities, and protecting and promoting civic and moral values.[19] In cyberspace, regulations are extremely difficult to impose because of their anarchic nature or non-sovereign status of cyberspace. The peace of Westphalia is said to be starting point for development of modern international law.[20] It mandated defined borders and absolute sovereignty within such borders. The internet has become a convenient tool for various groups with hostile intentions towards governments, such as terrorist organizations, extremist political factions, and religious cults, among others. These groups use the internet to amplify their messages and increase the threat to national security.[21] The online platform has created an environment that facilitates polarization and political extremism. With the internet, terrorist groups and other hostile organizations can easily publicize their agenda and reach a wider audience without resorting to physical violence, such as hijacking aeroplanes.[22] The unique characteristics of the internet make it challenging for certain nations, including the United States, to implement traditional methods of economic regulation on electronic commerce. One of the major issues is the dispute among individual states over the authority to impose taxes or bring internet-based businesses located in other states to court. This highlights the difficulties of economic regulation that arise due to the complex nature of the Internet.

b)    The Case of India

The recent riots in Bengaluru, India, resulting in the death of three individuals, were triggered by an offensive Facebook post.[23] The post, which allegedly made derogatory comments about a religious figure, quickly went viral, leading to widespread outrage and protests. The situation escalated quickly, and the police were forced to intervene to control the situation. However, the violence had already caused significant damage, including the destruction of public property and several vehicles. This incident highlights the potential dangers of the misuse of cyberspace. Social media platforms like Facebook have become ubiquitous in modern times, providing a platform for individuals to express their views and opinions. However, these platforms can also be misused to spread fake news, hate speech, and other malicious content that can incite violence and conflict. In this case, the offensive post led to a breakdown of law and order, resulting in tragic consequences. This incident also raises questions about the role of social media platforms and their responsibility in preventing the spread of hate speech and other malicious content. While these platforms provide a platform for free speech, they also have a duty to protect users from harmful content that can incite violence and hatred. UNESCO also pointed out the hate speech on social media act as contemporary challenge for regulation of free speech.[24] There is a need for greater regulation and oversight of social media platforms to ensure that they are not being misused to spread hate speech and incite violence. Additionally, individuals must also take responsibility for their actions online and refrain from posting or sharing content that can cause harm or incite violence.[25]

c)     The 2007 case of DoS in Estonia

Another example of cyber war can be seen in the case of the Estonia incident of DDOS in 2007.[26] The Estonia attack was a distributed denial of service attack which is a crime in most jurisdictions including India. The impact of cybercrime was beyond the crime rather it was an attack on the Nation.[27] The media and banking system came under attack; it was more effective than any intrusive strike amounting to an act of war. After this incident, Estonia took the steps forward to draft the rules of war. There are several other attacks that can be done through the internet such as hacking attacks on government infrastructure, entities, hacking official mail ids or even court websites.[28]

In India, so far, we have seen the internet has put threats on the sovereignty of country. It prevents the government from independent decision-making, that is detrimental to stakeholders. Misrepresentation of data can lead to harm for the democracy of a country as voters can cast vote without having the correct information of the right candidate.[29] It is researched fact that Facebook is cause of misinformation and spread of fake news.[30]

d)    Cyber Weapons

The cyber weapons from which cyber warfare activities are carried out can be of different types. So, there is also necessity to define what are cyber weapons that can challenges the sovereignty of a state. Since all these kinds of threats are coming from the internet, it becomes important that government should frame laws in such a manner that it balances internet security with its fair usage rights. Now, we will look at the laws governing cyber warfare in India. We will analyze the sufficiency of laws that are available in India.

IV.          LAW REGULATING CYBER WARFARE.

a.     IT ACT 2000

In India, the IT Act of 2000 is the primary legislation governing cyber security in India.[31] The IT Act contains detailed provisions related to offences that can be done in cyberspace using computers. Under Chapter XI of the IT Act, all the offences are defined. Section 65 of the Act provides that whoever knowingly or intentionally conceals, destroys, or alters any computer program which is protected by law then the person shall be punishable with imprisonment up to three years, or a fine which may extend up to two lakh rupees, or with both.[32]

Sec. 43 of the Act provides a detailed overview of the acts which constitute damage to the computer or computer system. It provides that any person without the permission of owner accesses, downloads introduce virus, damages, disrupt, denial of access, provides any assistance, etc. to the computer shall be liable to pay damages by way of compensation to the person so affected.[33]

Section 66-F of the IT Act provides punishment for cyber terrorism. It states that whoever with the intent to threaten the unity, integrity, security, or sovereignty of India or to strike terror in the people by denying or cause the DoA (denial of access), attempt to gain access without permission or introducing any computer contaminant and by means of such conduct causes or likely to cause death or injuries to persons or damage to or destruction of property. The act of cyber terrorism is punishable with imprisonment for life.[34]

IT Act does not contain anything related to Cyber warfare. However, sec. 66-F of the Act can cover the aspects of cyber warfare. But still there is necessity of detailed provisions for Cyberwarfare. The “Whoever” word used in sec. 66-F can be interpreted to include the military of another country but as this law has only territorial application, this provision can be used against terrorists of those countries where India is a signatory to the extradition treaty, and it must also be a composite offence in that country. The composite offence means the same act would constitute an offence in another country.[35]

All these problems cannot be tackled by the old regime of the IT Act, 2000. Since the inception of the Act there have been various developments in technology. It is impossible for the IT Act 2000 to cover all the unforeseen events arising due to the growth of technology. Therefore, various modifications are required to keep the law updated to meet modern challenges. We can say the current law is unable to tackle the threat posed by Cyber warfare.[36]

Apart from the laws, there are several policies and executive actions taken towards protecting cyber security in India. The following can be listed as:

1.1.National Cyber Security Policy

The Ministry of Electronics and Information Technology has passed a National cyber security policy which helps the users of computers to frame guidelines for Cyber Security. The vision of this policy is to build a secure and resilient cyberspace for citizens, businesses, and government.[37] It provides an overview of goals to achieve in cyberspace. With all the challenges mentioned in chapter II and III, it is important that all the users of computers take coordinated action and in fulfilling that goal national cyber security policy is playing a crucial role.

1.2.Indian Computer Emergency Response team (CERT-In) and Cyber Swachhta Kendra (CSK):

The CERT-In has been in operation since January 2004. It is the national nodal agency for responding to computer security incident as and when they occur.[38] The CSK is a Botnet Cleaning and Malware Analysis Centre, it is a part of the government of India’s digital initiative. It is set up according to the National cyber security policy. The CSK is operated by CERT-In under the provisions of Section 70B of IT Act, 2000.[39]

1.3.National Critical Information Protection Centre (NCIIPC):

The NCIIPC is an organization of GOI established under section 70A of IT Act, 2000.[40] It is the nodal agency created for protection of critical information at National level. It takes all the action for protection of data from unauthorized access, disclosure, disruption, incapacitation. One of its duties is to spread awareness of data security among all the stakeholders.[41]

b.     Data Protection Bill, 2022

The hon’ble supreme court of India in the case of K.S. Puttaswammy case held that right to privacy is integral part of our Indian Constitution.[42] After this the parliament of India to provide a greater extend of privacy introduced data protection bill in 2022.[43] This bill contains 30 sections divided into 6 chapters. The objective of this data protection bill is to balance the right of individual to protect their personal data and process personal data for lawful purposes. It recognizes certain rights and duties of data principal under chapter 3 of the bill. The rights which are given to the data principal are: 1) Right to information about personal data,[44] 2) Right to correction and erasure of personal data,[45] 3) Right of grievance redressal,[46] 4) Right to nominate.[47] Section 16 of the bill states the duties of data principal such as compliance with all the laws, will not register false or frivolous grievance, shall not give false particulars, shall furnish authentic information.[48]

The bills also aims to protect the data from being misused by foreign companies, section 4 of the bill provides that Act shall be applicable to digital personal data outside the territory of India. This bill is a good step taken by the Indian government towards the protection of data and maintaining internet security. Recently, the Hon’ble supreme court while hearing Special leave petition related to use of personal data by WhatsApp took note that this bill would address all the concern raised in this case which will be presented in Monsoon session of 2023.[49]

In conclusion, these laws and regulations are designed to provide a legal framework for cyber security in India and ensure that the country’s cyberspace is secure and resilient against cyber threats, including those related to cyber warfare. However, as the threat landscape continues to evolve, it is essential for India to continuously update and improve its cyber security measures to effectively tackle new and emerging threats. Now, we will look at the international conventions on cyber security.

V.             INTERNATIONAL CONVENTIONS ON CYBER WARFARE AND SECURITY.

As we have seen the insufficiency of Indian law to address the possible threats that may arise due to cyber warfare. Now, it is important to assess the international treaties and conventions that can counter the threats posed by modern technologies. We also need to identify the applicability of war treaties to know whether they can be applied to modern war methods like cyber war. Therefore, we will investigate the provisions of Geneva Convention of 1949 and the Additional Protocols of 1977, various Hague Conventions from 1899 to 1907 and customary international law.[50]

a.     Geneva Convention, 1949 and other war conventions application on Cyber Wars

There is no express provision in all these conventions about cyber war because it is an emerging concept and cannot be foreseen during the time when conventions were agreed upon. These conventions are applicable in case of armed conflicts and consist of two types of rules. Firstly, rules which limit the right of the parties to use means and methods of war, and secondly, rules which protect the persons and property in times of armed conflict.[51] The cyber war cannot be launched without following the rule of war as the mode of war may not be the same, but its effect may result in infrastructural damages and loss of life. Also, new weapons for war does not completely exempt the application of traditional convention on war, however state have accepted impliedly to new wars methods and weapons, and this is evident through the inclusive definition of weapons in Article 36 of Additional protocol which states as:

“In the study, development, acquisition or adoption of a new weapon, means or method of warfare, a High Contracting Party is under an obligation to determine whether its employment would, in some or all circumstances, be prohibited by this Protocol or by any other rule of international law applicable to the High Contracting Party.”[52]

So, it is fair to say that cyber warfare strategies can be covered under the Geneva Convention and other war treaties because of Art. 36 of Additional protocol. However, there are certain challenges to adopting and implementing these conventions into cyber warfare.

First, Article 2 of the Geneva Convention provides that the present convention shall apply to all cases of declared war or any other armed conflict.[53] But it does not explain what an armed conflict means. Further, it does not confer whether a single attack can be constituted as armed conflict.[54]  

There are certain unique problems of cyber warfare which are pointed out by Author Jenny Doge in his research paper “Cyber Warfare Challenges for the Applicability of the Traditional Laws of War Regime.”[55] The followings challenges are listed below:

1.1. Proving the origin of the attack.

It is very difficult to prove the origin of cyber war. As IP addresses can be faked by the countries, they can hide their IP addresses and show that the attack is from some neutral country or from some country that has nothing to do with the attacked country.[56] It is also difficult to prove that the attack is coming from the state or some individual hacker. The ICJ have established test of Control to establish whether the act of individual can be constituted as the act of state.[57] In Nicaragua v. USA,[58] the ICJ analysed using strict control test or agency test, where it stated that the control of the contra forces is such that it is dependent on the US Government and can be said organ of USA. However, the degree of control was not proved because of lack of evidence under agency test. The US was made liable by applying “effective control test” for its own conduct in relation to the contras: “by training, arming, equipping, financing and supplying the contra forces or otherwise encouraging, supporting and aiding military and paramilitary activities in and against Nicaragua, has acted, against the Republic of Nicaragua, in breach of its obligation under customary international law not to intervene in the affairs of another State”.[59] These tests are in relation to the physical military presence. In cyber-attacks, there may not be any physical presence of the attacker, they can work from any remote place other than their countries. Therefore, it is a challenge to prove the origin of an attack.

1.2. Identifying the victim of an attack

It is difficult to identify the victims of cyber-attack as under normal circumstances attacking state subjects or civilian property by another state constitutes an attack on the state. However, when private companies’ computers are attacked by hackers, whether it will constitute an attack on the state or an attack on the company only. An example of one such attack is on Google, where it was hacked by some Chinese hackers.[60] Also, it is important to note that cyber-attack does not fall within the definition of attack in traditional war laws. It is evident from a perusal of Article 49 (1) of Additional Protocol I which states that an “attack” is an act of violence against the adversary.[61] An act of violence means the application of physical force and does not include economic warfare. So, it acts as a challenge to identify the victim of an attack.

1.3. Non-state actors

Non state actors get a cutting-edge advantage as cyber wars are cheap and requires very few infrastructural materials. The non-state actors are not covered under the current war-regime. Therefore, it acts as a challenge in international war jurisprudence.

b.     Budapest Convention

Before delving into Budapest convention, it is important to note that India is not signatory to Budapest Convention. However, we will investigate the efficacy of this convention on Cyber security. The convention was signed in the year 2001 by members states of the Council of Europe and the other States signatory. This convention was signed for a common criminal policy aimed at protecting society against cybercrime. The convention is divided into four chapters, the first chapter contains definitions; the second chapter consists of two sections, first sections dealing with the substantive law and second section dealing with the procedural law; the third chapter contains provisions concerning mutual legal assistance and extradition rules. The fourth and final chapter contains the final clauses, which deal with standard provisions in council of European treaties.[62]

The Protocol on Xenophobia and Racism committed via a computer system was added as a complement to the Convention in 2003.[63] The Convention came into effect on July 1, 2004, marking the first international treaty addressing crimes conducted through the Internet and other computer networks. It specifically addresses offenses involving computer systems and data, such as illegal access, interception, data and system interference, computer-related fraud, child sexual exploitation material, and violations of network security. The primary goal of the Convention is to establish a shared criminal policy aimed at safeguarding society against cybercrime. This is accomplished through the adoption of appropriate legislation and the promotion of international cooperation. The Convention emphasizes the harmonization of domestic laws among member states and the strengthening of collaboration between them. It was developed by the Council of Europe, with the participation of observer states including Canada, Japan, the Philippines, South Africa, and the United States.[64] India has not joined Budapest Convention because of its diplomatic and foreign policy.[65]

In conclusion, this convention is also not an exhaustive convention dealing with all kinds of cybercrimes. Still, there is need for a full-fledged convention regulating the cyber war among different countries.

VI.          CONCLUSION.

After looking into all the challenges posed in cyberspace related to cyber terrorism or cyber warfare. We can conclude that the Internet or cyberspace can threaten a nation’s sovereignty if it is misused by way of cyber warfare. We have seen that there is no law specifically dealing with the issue of cyber warfare. The present law with certain modifications can be applied to the current challenges but it cannot totally address all the problems raised by the issues of cyberwarfare. Further, there is no global standard for cyber warfare which is also detrimental for society as the challenges mentioned Chapter V requires specific conventions to address, the old regime is insufficient to deal with challenges which modern day internet poses. Therefore, there is need to have a global standard for tackling cyber warfare.

In India, we have seen the application of the IT Act, 2000 which is able to deal with certain offences, but it is not a complete Act, various rules and regulations are added afterwards because technology have created raised certain novel problems. Finally, the data protection bill, 2022 which seeks to resolve certain problems related to use of personal data seems promissory to solve the misuse of data by companies and other terrorist organization.

Finally, we can say that a law can tackle all the problems raised by the Internet. As technology is enhancing it is creating a new problem. So, the law must be passed by legislature with dynamic intent. There cannot be rigidity in cyber laws. Also, the conventions should be made between the countries in such a manner that it can address all the possible forthcoming challenges which can be foreseeable.

Read more on similar topics here.

Keywords:

Cyber warfare, Cyber warfare in India, Cyber warfare global laws, Cyber warfare techniques, Cyber warfare challenges, Cyber warfare causes, Cyber warfare solutions, Cyber warfare and international conventions, Cyber warfare and Cybersecurity, Cyber warfare and Cyberlaws, Cyber warfare methods, Cyber warfare in Estonia, Cyber warfare as a challenge to sovereignty of India, Cyber warfare and the ministry of electronics and information technology, cyber warfare and cyber terrorism, Meaning of Cyber warfare in different jurisdictions, International principles governing Cyber warfare, global standards for Cyber warfare, Cyber warfare as gruesome form of cyber crime.

Relevant videos regarding cyber warfare:

---

[1]CSRC, https://csrc.nist.gov/glossary/term/cyberspace (last visited Apr 11, 2023).

[2] Dr. Milton Mueller, Sovereignty and Cyberspace, Indiana University (Apr 11, 2023, 9:12 PM), https://dlc.dlib.indiana.edu/dlc/bitstream/handle/10535/10410/5th-Ostrom-lecture-DLC.pdf?sequence=1&isAllowed=y.  

[3] Janice E. Thomson, State Sovereignty in International Relations: Bridging the gap between theory and empirical research, 39 Oxford Uni Press 213 (1995).

[4] James Manyika and Charles Roxburgh, The great transformed: The impact of the internet on economic growth and prosperity, McKisney (Apr 12, 2023, 12:24 PM), https://www.mckinsey.com/~/media/mckinsey/industries/technology%20media%20and%20telecommunications/high%20tech/our%20insights/the%20great%20transformer/mgi_impact_of_internet_on_economic_growth.pdf.

[5] Captain Paulto Fernando Viegas Nunes, The Impact of New Technologies in the Military Arena: Information Warfare, airuniversity (Apr 12, 2023, 1:20 PM), https://www.airuniversity.af.edu/Portals/10/ASPJ/journals/Chronicles/nunes.pdf. 

[6] Id. at 4

[7] Papanastasiou Afroditi, Application of International Law in cyber warfare operations, SSRN (9^th Sep 2010), https://papers.ssrn.com/sol3/papers.cfm?abstract_id=1673785,

[8] The New York Times, Text: Obama’s Remarks on Cyber-Security – The New York Times (nytimes.com) (last visited Apr 11, 2023).

[9]Lawrence T. Greenberg et al., Information War fare and International Law, 1998, p. 37, available at  Information Warfare and International Law (dodccrp.org) (last visited Apr 11, 2023).

[10] Jenny Doge, Cyber Warfare: Challenges for the applicability of the Traditional laws of war regime, 48 Mohr. Sie. GmbH & Co. KG 486, 488 (2010). [hereinafter “Jenny Doge”]

[11] Department of Defense, Dictionary of Military and Associated Terms, (as amended through 31 October 2009), p. Ill, available at Department of Defense Dictionary of Military and Associated Terms – UNT Digital Library (last visited Apr 11, 2023).

[12] Id. at 260.

[13] Department of Defense, Joint Doctrine for Information Operations, Joint Publication 3-13, October 9, 1998, (no longer in force), available at http://www.c4i.org/jp3_13.pdf (last visited April 11, 2023).

[14] R.A. Clarke & R.K. Knake, Cyber War: The Next Threat to National Security and What to Do about it. New York: HarperCollins.

[15] Fortinet, What Is Cyber Warfare? | Fortinet (last visited April 11, 2023).

[16] Cambridge Dictionary, https://dictionary.cambridge.org/dictionary/english/espionage (last visited April 13, 2023).

[17] National Cyber Security Centre, https://www.ncsc.gov.uk/collection/denial-service-dos-guidance-collection (last visited Apr. 11, 2023).

[18] Choi, K.-shick, Lee, C.S. and Cadigan, R. (2018) Spreading propaganda in cyberspace: Comparing Cyber-Resource usage of Al Qaeda and Isis, Virtual Commons – Bridgewater State University, https://vc.bridgew.edu/ijcic/vol1/iss1/4/ (last visited Apr 15, 2023).

[19] United States v. Curtiss-Wright Export Corp., 299 U.S. 304, 315-318 (1936).

[20] L. Gross, The peace of Westphalia, 1648-1948. 42 AJIL 20 (1948). 

[21] Bransilav Todorovic and Darko Trifunovic, Prevention of Abuse of the Internet for Terrorist Plotting and Related Purposes, INTERNATIONAL CENTRE FOR COUNTER TERRORISM (Apr 11, 2023, 9:40 AM), https://www.icct.nl/sites/default/files/2023-01/Chapter-19-Handbook.pdf.

[22] Henry H. Perrit, The Internet as a threat to sovereignty? Thoughts on the Internet’s role in strengthening national and global governance, 5 IJGLS 423, 428 (1998).

[23]Hindustan Times, https://www.hindustantimes.com/bengaluru/2-die-after-communal-violence-breaks-out-in-bengaluru-over-facebook-post/story-kB6zYccSYKgetMK4n4JdNM.html (last visited Apr  11, 2023).

[24] UNESCO, Addressing hate speech on social media: Contemporary challenges (2021) (Apr 11, 2023, 9:20 AM),  https://unesdoc.unesco.org/ark:/48223/pf0000379177.

[25] Business Standard, https://www.business-standard.com/article/politics/offensive-facebook-post-leads-to-riots-in-bengaluru-three-dead-120081201775_1.html (last visited Apr 11, 2023).

[26] Ottis, R. (2007) Www.aei.org, Analysis of the 2007 Cyber Attacks Against Estonia from the Information Warfare Perspective. Available at:https://www.aei.org/https:/ccdcoe.org/uploads/2018/10/Ottis2008_AnalysisOf2007FromTheInformationWarfarePerspective.pdf (last visited Apr 15, 2023).

[27] NS Nappinai, Technology Laws Decoded 17 (Lexis Nexis 2017).

[28] National Centre for State Courts, https://www.ncsc.org/ (last visited Apr 15, 2023).

[29] LSE, https://blogs.lse.ac.uk/socialpolicy/2020/11/04/how-misused-statistics-can-harm-democracy/ (last visited Apr 15, 2023).

[30] Forbes, https://blogs.lse.ac.uk/socialpolicy/2020/11/04/how-misused-statistics-can-harm-democracy/ (last visited Apr 15, 2023).

[31] Information Technology Act, 2000, No. 21, Acts of Parliament, 2000 (India).

[32] Information Technology Act, 2000, § 65 No. 21, Acts of Parliament, 2000 (India).

[33] Information Technology Act, 2000, § 43 No. 21, Acts of Parliament, 2000 (India).

[34] Information Technology Act, 2000, § 66-F No. 21, Acts of Parliament, 2000 (India).

[35] The Extradition Act, 1962, § 2(a) No. 34, Acts of Parliament, 1962 (India).

[36] Sarasji Das, Adequacy and Limitations of the Information Technology Act in Addressing Cyber-Security Issues of Indian Power Systems,2 ICPS 1 (2021). 

[37]MeitY, https://www.meity.gov.in/writereaddata/files/downloads/National_cyber_security_policy-2013%281%29.pdf (last visited Apr 15, 2023).

[38] CERT-In, https://www.cert-in.org.in/ (last visited Apr 16, 2023).

[39] Information Technology Act, 2000, § 70B No. 21, Acts of Parliament, 2000 (India).

[40] Information Technology Act, 2000, § 70A No. 21, Acts of Parliament, 2000 (India).

[41] NCIIPC, https://nciipc.gov.in/ (last visited Apr 16, 2023).

[42] K.S. Puttaswamy v. UOI, (2017) 10 SCC 1. 

[43] Krishnadas Rajagopal, New Digital Personal Data Protection Bill in Monsson Session, The Hindu (Apr 16, 2023), https://www.thehindu.com/news/national/new-data-protection-bill-likely-to-be-introduced-in-monsoon-session-in-parliament-centre-to-supreme-court/article66723887.ece.

[44] The Digital Personal Data Protection Bill, 2022, § 12 (India).  

[45] The Digital Personal Data Protection Bill, 2022, § 13 (India).

[46] The Digital Personal Data Protection Bill, 2022, § 14 (India).

[47] The Digital Personal Data Protection Bill, 2022, § 15 (India).

[48] The Digital Personal Data Protection Bill, 2022, § 16 (India).

[49] Karmanya Singh Sareen & Anr. v. Union of India & Ors., SLP No. 804/2017.

[50] Chirstopher Greenwood, Historical Development and Legal Basis 11 (2 Dieter Fleck ed. 2008).

[51] Knut Dormann, Computer network attack and international humanitarian law, May 19, 2001, point 5, available at http://www.icrc.Org/web/eng/siteengO.nsf/htmlall/5  (last visited Apr 13, 2023).

[52] The International Committee of Red Cross, https://ihl-databases.icrc.org/en/ihl-treaties/api-1977/article-36#:~:text=In%20the%20study%2C%20development%2C%20acquisition,law%20applicable%20to%20the%20High (last visited Apr 13, 2023).

[53] Geneva Convention, 1949, Art. 2.

[54] Jenny Doge, supra note 10, at 497.

[55] Id. at 498.

[56] Radware, https://www.radware.com/security/ddos-threats-attacks/ddos-attack-types/dynamic-ip-address-cyber-attacks/ (last visited Apr 13, 2023).

[57] Elena L.A. Ortega, The attribution of international responsibility to a State for conduct of private individuals within the territory of another State, INDRET (last visited Apr 13, 2023, 2:24 PM), https://indret.com/wp-content/themes/indret/pdf/1116_es.pdf.

[58] Military and Paramilitary Activities in and Against Nicaragua (Nicar. v. U.S.), Judgment 1986 I.C.J. 14 (June 27).

[59] Id. at ¶ 3.

[60] Forbes, https://www.forbes.com/sites/daveywinder/2020/04/21/how-this-chinese-google-hack-made-working-from-home-safer/?sh=139c2f43710c (last visited Apr 14, 2023).

[61] Additional Protocol I, 1977, Art. 49 (1).

[62]Article 19 Organisation, https://www.article19.org/wp-content/uploads/2022/06/Budapest-Convention-analysis-May-2022.pdf (last visited Apr 18, 2023).

[63] Convention on Cybercrimes, Protocol on Xenophobia and Racism, Strasbourg, 28.1.2003.

[64]Council of Europe, https://www.coe.int/en/web/cybercrime/parties-observers (last visited Apr 18, 2023).

[65]ORF, https://www.orfonline.org/expert-speak/india-and-the-budapest-convention-why-not/ (last visited Apr 18, 2023).