The highest level of classified and restricted-access documents of India's defence ministry, including several missile systems and details of a military intelligence officer, as also year-long personal emails of exiled Tibetan leader Dalai Lama have been stolen by a China-based computer espionage gang in the second major India-focused cyber attack.

The Indian government was totally in the dark on thefts of sensitive data from its computers and networks despite having a specialised expert unit to deal with cyber terrorism until the Toronto University-based computer security researchers alerted the Indian intelligence officials on March 24, providing them samples of the stolen data that they have been able to dig out from the Chinese intruders' systems.

A report released Monday night by the group says this was much bigger, much sophisticated, different and deeper India-focused Internet spying operation than the surveillance ring known as Ghostnet that cyber-attacked India late last year and again early this year along with Google as also governments and corporations in 103 countries. These are two altogether different hackers, they claimed.

HOW: Titling this second cyber espionage as "Shadow Network", the report based on monitoring of the spying operation for the past eight months says the culprits made extensive use of Internet services like Twitter, Google Groups, Blogspot, blog.com, Baidu Blogs and Yahoo! Mail to automate the control of computers once they had been infected.

The Toronto spy hunters not only learned what kinds of material had been stolen, but were able to see some of the documents, including classified assessments about security in several Indian states, and confidential embassy documents about India’s relationships in West Africa, Russia and the Middle East, the New York Times said.

By gaining access to the control servers used by the second cyber gang, the researchers observed the theft of a wide range of material, including classified documents from the Indian government and reports taken from Indian military analysts and corporations, as well as documents from agencies of the United Nations and other governments. They said this spy ring was more sophisticated and difficult to detect than Ghostnet.

VERY SENSITIVE: The report notes that documents the researchers recovered were found with “Secret,” “Restricted” and “Confidential” notices. “These documents,” the report says, “contain most sensitive information taken from a member of the National Security Council Secretariat concerning secret assessments of India’s security situation in the states of Assam, Manipur, Nagaland and Tripura, as well as concerning the Naxalites and Maoists,” two ultra leftist groups.

Also compromised were computers used by the Indian Military Engineer Services in Bengdubi, Calcutta, Bangalore and Jalandhar; the 21 Mountain Artillery Brigade in Assam and three Air Force bases. Computers at two Indian military colleges were also taken over by the spy ring. Other documents included personal information about a member of the Indian Directorate General of Military Intelligence (DGMI).

The researchers also found evidence that Indian Embassy computers in Kabul, Moscow and Dubai, United Arab Emirates, and at the High Commission of India in Abuja, Nigeria had been compromised.

“We sneaked around behind the backs of the attackers and picked their pockets,” said Ronald J. Deibert, a political scientist who is director of the Citizen Lab, a cyber-security research group at the Munk School in the Toronto University. “I’ve not seen anything remotely close to the depth and the sensitivity of the documents that we’ve recovered.”

The report noted how the Indian Government which had activated a specialised government group to track down the earlier Ghostnet intrusions to prevent any new attacks were totally unaware of the "Shadow Network" spy operation that systematically hacked into personal computers in government offices on several continents.

As recently as early March, Minister of State for Communications Sachin Pilot told reporters that government networks had been attacked by China, but “not one attempt has been successful.” The NYT report says the Toronto researchers contacted the Indian intelligence officials on March 24 to brief them on the spy ring they had been tracking. It said the Indian officials requested and were given instructions on how to dispose of the classified and restricted documents.

Defence Ministry spokesman Sitanshu Kar refused to make any official comment, except to state that the officials were "looking into" the Toronto report.

It was their investigation into Ghostnet that attacked Google among others that the researchers tumbled upon the second Internet spy operation, which is the subject of their new report, titled “Shadows in the Cloud: An investigation Into Cyberespionage 2.0.”

AFGHANISTAN: The intruders even stole documents related to the travel of NATO forces in Afghanistan, illustrating that even though the Indian government was the primary target of the attacks, one chink in computer security can leave many nations exposed.

“It’s not only that you’re only secure as the weakest link in your network,” said Rafal Rohozinski, a member of the Toronto team. “But in an interconnected world, you’re only as secure as the weakest link in the global chain of information.”

The attacks look like the work of a criminal gang based in Sichuan Province, but as with all cyber attacks, it is easy to mask the true origin, the researchers said. Given the sophistication of the intruders and the targets of the operation, the researchers said, it is possible that the Chinese government approved of the spying.

DENIAL: When asked about the new report on Monday, a propaganda official in Sichuan’s capital, Chengdu, said “it’s ridiculous” to suggest that the Chinese government might have played a role. “The Chinese government considers hacking a cancer to the whole society,” said the official, Ye Lao. Tensions have risen between China and the United States this year after a statement by Google in January that it and dozens of other companies had been the victims of computer intrusions coming from China.

Even after eight months of watching the spy ring, the Toronto researchers said they could not determine exactly who was using the Chengdu computers to infiltrate the Indian government. “This would definitely rank in the sophisticated range,” said Steven Adair, a security researcher with the group. “While we don’t know exactly who’s behind it, we know they selected their targets with great care.

“But an important question to be entertained is whether the P.R.C. will take action to shut the Shadow Network down,” the report says, referring to the People’s Republic of China. “Doing so will help to address long-standing concerns that malware ecosystems are actively cultivated, or at the very least tolerated, by governments like the P.R.C. who stand to benefit from their exploits though the black and gray markets for information and data.”

By examining a series of e-mail addresses, the investigators traced the attacks to hackers who appeared to be based in Chengdu, which is home to a large population from neighboring Tibet. Researchers believe that one hacker used the code name “lost33” and that he may have been affiliated with the city’s prestigious University of Electronic Science and Technology. The university publishes books on computer hacking and offers courses in “network attack and defence technology” and “information conflict technology,” according to its Web site.

The People’s Liberation Army also operates a technical reconnaissance bureau in the city, and helps finance the university’s research on computer network defence.

The investigators linked the account of another hacker to a Chengdu resident whose name appeared to be Mr Li. Reached by telephone on Monday, Li denied taking part in computer hacking. Declining to give his full name, he said he must have been confused with someone else. He said he knew little about hacking. “That is not me,” he said. “I’m a wine seller.”

The Canadian researchers stressed that while the new spy ring focused primarily on India, there were clear international ramifications. Rohozinski noted that civilians working for NATO and the reconstruction mission in Afghanistan usually travelled through India and that Indian government computers that issued visas had been compromised in both Kandahar and Kabul in Afghanistan.

“That is an operations security issue for both NATO and the International Security Assistance Force,” said Rohozinski, who is also chief executive of the SecDev Group, a Canadian computer security consulting and research firm.