Public-Private-Partnership in Cyber Security

Speaking at a seminar on Cyber and Network Security in New Delhi in October 2014, Deputy National Security Advisor (NSA) Dr Arvind Gupta highlighted the need for having public-private-partnership (PPP) in cyber security for protecting the critical online data and creating awareness amongst the public. Dr Gupta said, “Internet has many stakeholders and the government is involved in terms of making laws and the private sectors are involved in creating technologies like hardware, software and so on and this can’t be seen in an isolated manner…. that’s why PPP model is important.”[1]

Although the PPP model continues to be the preferred mode of investment and development in sectors like defence and infrastructure, it has yet to find its feet in the cyber security domain. Cyber security and cyber warfare have so far been under the aegis of the government with private sector participation limited to providing the hardware and technologies needed by the government agencies. However, government and the private sector need to step up their game to protect the cyber space of the country. India was the third most affected country by online banking malware during the April-June quarter of 2014, after the United States and Japan with more than 3000 cyber attacks. In 2012-13, the estimated loss to the economy due to 8,765 fraudulent online transactions was reported to be worth INR 67 crores or close to 11 million USD.

Israel has emerged as the world leader in cyber security and cyber warfare with extra emphasis and focus on integrating the academia with the defence forces and the private sector. The Israeli cyber-defence companies have increased manifold from a modest number of 12 to more than 200 in the last few years, accounting for 5-10% of the global cyber security industry which is estimated to be worth 60-80 billion USD. Israeli Prime Minister Benjamin Netanyahu announced in January 2014 of his country’s desire to export their cyber security expertise to help other nations better protect their critical data[2]. Israel has paved the way for how efficiently and effectively the private sector can be roped in by the government for capacity building and helping monitor the country’s cyber space, both offensively and defensively.

A Joint Working Group on Cyber Security was set up in 2012 to look into effective engagement with the private sector in the field of cyber security and its report released on 15 October, 2012[3]. The report recommended active PPP cooperation in international forums, establishing India as a global hub of development of cyber security products, and to promote indigenisation in R&D. The Working Group also put forth a roadmap for PPP on cyber security issues based on a number of guiding principles. It’s been more than two years since the report was released but there has been no action on the recommendations and the roadmap remains a mere document in the government archives waiting to be out into action.

The National Cyber Security Policy released in July 2013 stressed on the need to facilitate better collaboration between the various stakeholders, but failed to talk about how to bring about this collaboration and how to what role does each stakeholder play for protection of the critical information infrastructure.

Apart from providing the necessary institutional and legal framework, the government needs to build an environment conducive for the private sector to flourish in. Domestic private players should be promoted keeping in mind the sensitivity of the data while allowing foreign entities to carry the mantle whilst the private industry grows. The laws, rules and regulations governing the PPP models should leave little scope for arbitrary and discretionary powers in the hands of the public officials, limiting the levels of corruption as has been evident in recent years in the PPP projects in telecom and coal sectors.

Developing the human capital remains a priority and the existing gap between the required and available resources has to be met by contribution from the private sector. Higher education institutions catering especially towards cyber security should be developed but in the meantime, better placement and recruitment practices should be promoted to shore up the manpower[4].

The government should also take a firm view of the type of PPP model that needs to be implemented in the area of cyber security. The various PPP models under implementation in India in increasing order of duration and private sector risk involvement are as follows:

• Service Contract – The government hires the private company/companies for a specific period (usually 1-3 years) to carry out a specific task while retaining control over the infrastructure service.
• Management Contract – Though the obligation for service provision lies with the government, the private sector has greater say in the management and operation of the service as it provides the working capital for the project.
• Lease contract – The private sector entity undertakes the contract for a period of 10-20 years and is responsible for the service in its entirety, including financing, operation, quality and risks.
• Concessions – The concessionaire (private company) is responsible for the full delivery of services including capital investment, operation, management, maintenance and collection of tariff from the users. Build-Operate-Transfer (BOT) and its variations remain the primary form.
• Joint Venture – Includes a Special Purpose Vehicle (SPV) between the government and the private sector entity/entities wherein both parties co-own and operate the project. Involves sharing of resources and risks.

Looking at the duration of the project, the risks involved, and the resources being invested by the government and the private sector, the government could opt for a joint venture in cyber security due to the sensitivity and confidentiality of the data being protected. There needs to be clear understanding of the terms and conditions of the contract in the beginning to avoid legal troubles later.

India continues to add to its online population as more people are linked to the internet and more services are being provided at the click of a button. The cyber space remains an unchartered territory for the PPP model but looking at the immediate need for protecting the country’s critical information network and the government’s inability to protect it on its own, the private sector has to participate much more considering its increased role as a stakeholder.

The author is Research Assistant at CLAWS. Views expressed are personal.