The Rise Of Cybercrimes In India And Their Impact On Victims
Author: LawSphereX
Category: Criminal Law
Published:
Updated:
THE RISE OF CYBERCRIMES IN INDIA AND THEIR
IMPACT ON VICTIMS
Tanya Sharma, Manipal University, Jaipur
ABSTRACT
The digital transformation in India has brought remarkable growth in internet penetration, with millions of users integrating the internet into their daily lives for banking, commerce, education, and social interaction. However, this rapid digital expansion has also made India increasingly vulnerable to cybercrimes, which are escalating in both frequency and sophistication. Cybercrimes in India range from financial frauds, phishing scams, identity theft, and cyber harassment to large-scale data breaches and even cyber terrorism. This paper investigates the rise of cybercrimes in India, examining the unique socio-economic and legal challenges posed by these digital offenses. The impact of cybercrimes on victims is profound and multifaceted. Financial losses due to cyber fraud can be devastating for individuals and businesses alike.
Victims of identity theft and social media crimes often face lasting emotional and psychological harm, with reputational damage being another significant consequence. Corporate entities and government institutions, too, suffer from breaches that compromise their operational integrity and lead to huge financial and security losses. Furthermore, privacy violations from unauthorized data access can lead to long-term insecurity and erode public trust in digital systems. While the Information Technology Act, 2000 (IT Act) remains India’s foundational legal framework for addressing cybercrimes, it faces numerous limitations in adapting to evolving threats. The enforcement of cyber laws is challenging due to jurisdictional issues, resource constraints, and the rapid advancement of cybercrime techniques, often outpacing legal adaptations.
This paper highlights these issues and discusses the gaps within existing legal protections and enforcement mechanisms. The study underscores the urgency of legislative reforms, the need for bettertrained law enforcement, and increased public awareness to combat the threat of cybercrime. Strengthening cyber laws, introducing comprehensive data protection regulations, enhancing cross-border cooperation, and conducting
robust cybersecurity education campaigns are essential for fostering a safer digital environment. With a more resilient legal framework and an informed public, India can mitigate the impact of cybercrimes, offering better protection to its citizens and sustaining trust in its digital ecosystem. Introduction: India's digital transformation is a strategic imperative, driving economic growth, inclusivity, and sustainability. Spearheaded by the Digital India initiative, launched in 2015, this shift is projected to help India reach a digital GDP of trillion by 2025. Built on three pillars—digital infrastructure, accessible government services, and digital literacy—the initiative aims to empower citizens and create a robust, knowledge-based society.
Backed by substantial government investments, including INR 14,903 crore from 2021 to 2026, the program aligns India with the global momentum of the Fourth Industrial Revolution, transforming the digital landscape for the country’s 692 million internet users. India's digital journey began with the economic liberalization of the 1990s, which opened markets and attracted global tech players, particularly in cities like Bangalore and Hyderabad. Early e-governance efforts date back to the 1970s with the establishment of the Department of Electronics and the National Informatics Centre (NIC), which launched initiatives like the District Information System (DIS) and the satellite-based NICNET in 1987.
In the 1980s, Indian Railways’ computerized reservation system marked a significant milestone, laying the foundation for digital governance and setting the stage for India’s transformation into a global IT powerhouse. India is rapidly advancing in digital adoption, driven by affordable smartphones, high-speed connectivity, and significant public and private sector initiatives. With 560 million internet subscribers as of 2018, India ranks second globally, following China, in internet user base and app downloads. Public programs like Aadhaar and Jan-Dhan Yojana have expanded digital access and financial inclusion, with Aadhaar enrolling 1. 2 billion people and linking millions of bank accounts. Private players, such as Reliance Jio, have made internet access affordable, spurring a 152% annual increase in mobile data consumption per user, outpacing rates in the U. S. and China.
Digital services tailored to India’s unique market, including regional language content and mobile payments, have attracted millions of new users across socio-economic backgrounds, with lower-income states also making significant gains in internet access.
However, only about 40% of Indians currently have internet subscriptions, and cash remains dominant in retail transactions, indicating substantial growth potential in digital adoption and e-commerce. India’s digital transformation has achieved remarkable growth, yet it faces significant challenges in cybersecurity, especially with limited public education and awareness about online threats and scams. This knowledge gap has left citizens vulnerable to cyber fraud, as many people lack understanding of secure online practices. Additionally, with a relatively low number of cases reported in comparison to the actual occurrences, cybercriminals often operate without fear of apprehension. This lack of deterrence, combined with limited technological literacy, has created fertile ground for online scams.
The rise in cybercrime is evident in data presented by Union Home Minister Amit Shah, highlighting cybersecurity as a critical component of national security. In 2012, there were 3,377 reported cybercrime cases, which surged to 50,035 cases by 2020, according to the National Crime Records Bureau (NCRB)—an 11. 8% increase over the previous year. This rapid rise underscores the need for stronger cybersecurity measures, increased public awareness, and a robust legal and enforcement framework to address the growing threat and ensure India’s digital advancement remains secure and resilient. Types of Cybercrimes in India: 1- Online and social media-related crimes: These crimes accounted for 12. 02% of cybercrimes from January 2020 to June 2023, highlighting various offenses committed via digital platforms. These include cheating by impersonation (1.
71%), where cybercriminals deceive victims by pretending to be trusted individuals, and cyberbullying/stalking/sexting (3. 87%), involving harassment and unwanted explicit content. Email phishing (0. 13%) aims to trick victims into revealing sensitive data, while fake/impersonation profiles (2. 38%) and profile hacking/identity theft (2. 37%) involve creating deceptive online identities or stealing personal information. Other crimes include online job fraud (0. 94%) targeting job seekers, online matrimonial fraud (0. 10%), and provocative speech for unlawful acts (0. 47%), which uses digital platforms to incite illegal actions. Despite varying frequencies, these crimes reveal the growing threats in the digital realm and the need for stronger cybersecurity awareness.
2- Online financial fraud: Online financial fraud constitutes 77. 41% of the total cybercrimes in India, covering various types of criminal activities targeting individuals' financial information. Business Email Compromise (0. 24%) involves unauthorized access to business emails for fraudulent transactions, while debit/credit card and SIM swap fraud (11. 27%) focuses on stealing card details and phone numbers to access sensitive financial data. Demat/depository fraud (0. 61%) involves unauthorized trades in electronic securities accounts. E-wallet fraud (3. 45%) exploits vulnerabilities in digital wallets, and fraud calls/vishing (5. 32%) manipulates victims into revealing personal data over the phone. Internet banking fraud (9. 28%) targets weaknesses in online banking systems for unauthorized transactions. UPI fraud (47.
25%), the highest percentage indicates widespread exploitation of India’s Unified Payments Interface system for fraudulent transactions. These figures highlight the alarming rise in financial cybercrimes and the need for improved security measures. 3- The **Hacking/Damage to Computer Systems: This category covers 1. 57% of total cybercrime, involves unauthorized access, tampering, and damage to computer systems. **Unauthorized access and data breaches** make up the largest share (0. 92%), highlighting significant privacy and security concerns, as breaches expose sensitive data and lead to financial or reputational harm. **Email hacking** follows (0. 38%), reflecting the widespread use of email and its potential for misuse in phishing and unauthorized access. **Computer damage** (0.
11%) and **website defacement** incidents are lower, involving either physical or digital harm, with defacement often driven by ideological motives. **Tampering with computer source documents** (0. 05%) is rare but risky, as altering system code can create vulnerabilities and lead to data loss or system failure. In essence, this category underscores the range of malicious activities that compromise data security and system integrity, though it is less common compared to financial fraud. 4- Online Cyber Trafficking (0. 13%): It refers to illegal online activities such as the trade of illicit goods, human trafficking, and other unlawful transactions. The relatively low percentage suggests that this form of cybercrime is less prevalent compared to other categories during the analyzed period.
This could indicate effective law enforcement measures or the secretive nature of these crimes, which makes them harder to detect and prosecute. Despite its lower frequency, cyber trafficking remains a serious concern requiring continued vigilance and stronger enforcement efforts.
5- Deepfake Crimes (0. 09%): It refers to illegal activities involving AI-generated content, such as sextortion and synthetic audio-video manipulation. Although this category represents a small fraction (0. 09%) of total cybercrime, its impact is significant. **Sextortion** involves using manipulated content to blackmail victims for personal or financial gain, while **synthetic audio-video manipulation** can spread misinformation and create distrust in digital communications. The use of deepfake technology to create lifelike but fake representations highlights the growing risks of digital deceit and exploitation. Despite its lower frequency, deepfake crimes pose a serious threat, necessitating proactive measures to protect individuals and uphold digital integrity. 6- Deepfake Crimes (0.
09%): It refers to illegal activities involving AI-generated content, such as sextortion and synthetic audio-video manipulation. Although this category represents a small fraction (0. 09%) of total cybercrime, its impact is significant. **Sextortion** involves using manipulated content to blackmail victims for personal or financial gain, while **synthetic audio-video manipulation** can spread misinformation and create distrust in digital communications. The use of deepfake technology to create lifelike but fake representations highlights the growing risks of digital deceit and exploitation. Despite its lower frequency, deepfake crimes pose a serious threat, necessitating proactive measures to protect individuals and uphold digital integrity. 7- Cyber Terrorism (0. 16%): It refers to the use of technology to carry out acts of terror or disrupt systems for political or ideological motives.
With a low percentage of 0. 16%, cyber terrorism incidents in India appear to be infrequent, possibly due to strong cybersecurity measures, proactive law enforcement, and heightened vigilance. Despite its limited occurrence, cyber terrorism remains a serious concern, requiring ongoing attention and preparedness to prevent significant disruptions or harm. 8- Online Gambling (0. 30%): It refers to placing bets or wagers on internet platforms, such as casino games, sports events, or other forms of entertainment. The relatively low percentage of 0. 30% suggests that online gambling-related cybercrimes are less prevalent compared to other types of cybercrime. This may be due to stricter regulations and limited access to online gambling platforms in India, which could have helped reduce its occurrence.
However, the potential for growth in this area still requires careful monitoring and enforcement of legal frameworks.
9- Ransomware (0. 07%): It involves cybercriminals infecting computer systems and encrypting files, then demanding a ransom for the decryption key. Despite being highly damaging, ransomware attacks account for a small percentage (0. 07%) of cybercrimes in India. This lower prevalence may be attributed to increased awareness among users, improved cybersecurity measures, and more effective incident response strategies, all of which help mitigate the risk and impact of such attacks. Nonetheless, ransomware remains a significant threat that requires continuous vigilance and preparedness. Impact of Cybercrime on Victims, Society and Indian Economy: Financial Impact of Cybercrime in India Cybercrime significantly harms the Indian economy by affecting individuals, businesses, and financial institutions.
Key contributors include: - Online Financial Frauds: Phishing, identity theft, and credit card fraud lead to direct financial losses and reduce public confidence in digital transactions. - Data Breaches: High-profile breaches expose sensitive information, leading to legal costs, reputational damage, and reduced customer trust. - Ransomware Attacks: Attackers demand ransom by encrypting critical data, causing financial losses and downtime for businesses. - Intellectual Property Theft: Cyber espionage threatens industries, particularly tech and innovation, by compromising competitive advantages. -Financial Sector Vulnerabilities: Frequent attacks on financial institutions erode public trust and may destabilize the economy.
These losses, estimated at $4 billion annually, hinder India’s digital growth by reducing consumer confidence, stalling business investment, and limiting digital transformation efforts. Cybercrime-Driven Business Disruptions Cyber-attacks disrupt operations, impose recovery costs, and impact customer trust:
-Downtime and Productivity Loss: Cyber-attacks cause service interruptions, lowering productivity and revenue. -Reputation Damage: Compromised customer data leads to reputational damage, customer loss, and decreased sales. -Financial Burdens: Recovering from attacks is costly and can involve regulatory fines, especially challenging for SMEs. -Supply Chain Disruptions: Attacks on one business can ripple through the supply chain, delaying production and deliveries. These challenges underscore the need for robust cybersecurity measures and collaboration to build resilience. Cybercrime Threats to Digital Transformation Cybercrime hampers India’s digital transformation by creating distrust, reducing service reliability, and impacting the economy: - Fear and Distrust: Security concerns discourage digital adoption, limiting transformation benefits.
- Service Disruptions: Attacks on critical services (e. g. , DDoS attacks) make digital services unreliable. - Economic Impact: Without trust in digital platforms, business investments are limited, slowing economic growth. Addressing these threats requires integrated cybersecurity efforts and public-private cooperation to foster a safe digital environment. Privacy and Data Security Risks Cybercrime poses serious risks to privacy and data security: - Identity Theft and Financial Fraud: Stolen personal information leads to unauthorized
financial activities, harming individuals’ finances and trust in digital platforms. - Harassment and Exploitation: Breaches can lead to cyberbullying, stalking, and other harms, impacting victims’ well-being. - Data Breaches and Corporate Espionage: Businesses suffer from data breaches that expose customer and proprietary data, leading to financial and reputational losses. Mitigating these risks requires strict cybersecurity practices, digital literacy, and regulatory frameworks to build a secure digital ecosystem. Impact of Cybercrime on Victims: The psychological impact of cybercrime on victims can be profound and multifaceted. Cybercrime often affects individuals more deeply than traditional crimes due to its unique nature, which includes elements of permanence, anonymity, and the invasive feeling associated with virtual attacks. The main psychological impacts include:
1. Constant Anxiety and Fear
Victims of cybercrime, especially cyberstalking and harassment, often experience ongoing anxiety and fear because of the **24/7 accessibility** of online platforms. Unlike traditional crimes, where a victim may achieve a sense of closure, cybercrimes can feel ever-present and inescapable, leaving victims to feel unsafe even in their own homes.
2. Loss of Trust and Increased Caution
The invasiveness of cybercrime can make victims wary of sharing information online or engaging with digital platforms altogether. This caution stems from a fear of repeat victimization, leading individuals to isolate themselves digitally, limit online interactions, or change their behaviors to avoid future incidents.
3. Trauma and Emotional Distress
Victims may suffer from **trauma** similar to that experienced by victims of physical crime, especially in cases where intimate information or images are shared without consent (e.g., sextortion or revenge pornography). The permanence of this material on the internet can trigger
ongoing trauma, creating persistent feelings of shame, helplessness, and a sense of being violated.
4. Identity and Self-Image Issues
Cybercrime often targets aspects of identity, and because people view their devices as extensions of themselves, attacks on these devices can feel deeply personal. When victims experience identity theft, unauthorized access to private information, or defamation online, it can lead to a crisis of self-image, causing them to question their self-worth and identity.
5. Depression and Social Withdrawal
Cybercrime victims are often subject to victim-blaming from society, law enforcement, or even friends and family. This lack of support and empathy can exacerbate feelings of isolation and shame, leading some victims to withdraw from social interactions. Long-term impacts can include depression, especially if the individual perceives they are not taken seriously.
6. Reduced Self-Esteem and Sense of Control
Cyber-attacks, particularly when involving financial loss, data breaches, or public embarrassment, can lead to diminished self-esteem. Victims may feel they’ve lost control over their own lives or feel incompetent for “allowing” the attack to happen, leading to lasting feelings of helplessness and self-doubt. The psychological impact of cybercrime can be as profound as physical crime, and in some cases, more enduring. Understanding and acknowledging these effects is essential for providing victims with the support and resources they need for recovery. Cybercrime uniquely impacts victims, often causing greater psychological and social harm than traditional crime. Key factors contributing to this impact include:
1. Scalability and Boundlessness of Cybercrime
Cybercrimes are scalable and boundless, meaning they can reach victims anywhere at any time. Unlike traditional crimes with a clear endpoint, cybercrimes like online harassment or bullying can be ongoing, leaving victims in a constant state of anxiety and distress, unsure when the
harassment will end.
2. Intangible and Permanent Nature
The intangible nature of cybercrime, where perpetrators act anonymously and from a distance, intensifies the victim's sense of vulnerability. The **permanence of online content**—such as images or messages shared without consent—creates a lasting impact. Victims may experience ongoing distress, knowing harmful content remains accessible indefinitely (Leukfeldt et al., 2018; Nadim & Fladmoe, 2021).
3. Psychological Impact Due to Technology-Identity Link
People often view their devices as extensions of themselves, so cyber-attacks feel as invasive as physical crime. Since devices are deeply integrated into daily life, cybercrime can feel like a direct assault on the self, increasing the psychological harm (Longo, 2018; Agustina, 2015). Violations of digital representations or avatars can further heighten this impact, especially when these digital identities are extensions of personal expression (Stol, 2020).
4. Victim Blaming and Stigmatization
Victims of cybercrime frequently encounter **victim-blaming** from society, law enforcement, and even their own social networks. Many view cybercrimes as self-inflicted, leading to a perception that victims are responsible for their own victimization (Cross et al., 2016). This reaction not only isolates victims but also denies them the recognition and empathy they need to heal (Boom et al., 2008).
5. Lack of Comprehensive Support
Despite its severe impact, cybercrime often lacks sufficient recognition as a serious form of victimization. Law enforcement and legal frameworks may prioritize traditional crimes over cybercrimes, leaving victims feeling unsupported. The disconnect between the profound impact of cybercrime and the limited response further aggravates the harm experienced by victims (Van der Vijver, 1993). Each of these factors—scalability, permanence, identity attachment, victim-blaming, and support limitations—contributes to the amplified and enduring impact of cybercrime on
victims. Legal Framework related to Cybercrime in India: Hacking (Unauthorized Access) - Section 43, IT Act, 2000: Unauthorized access, data theft, introducing viruses, or causing denial of access can result in a penalty up to ₹1 crore. - Section 65, IT Act: Tampering with computer source documents, such as concealing, destroying, or altering them, carries penalties of up to three years' imprisonment or a ₹2 lakh fine, or both. - Section 303, BNS (formerly Section 378, IPC): Theft, defined as dishonestly moving property without consent, can apply to unauthorized access and data theft by hackers, with penalties of up to three years' imprisonment or a fine. - Section 314, BNS (formerly Section 403, IPC): Dishonest misappropriation of property, including digital data, can result in up to two years' imprisonment and a fine.
- Section 318, BNS (formerly Section 420, IPC): Cheating by deceiving or fraudulently inducing a person to deliver property is punishable by imprisonment and a fine. In *Rafeeq Ahmad v. State of Karnataka* (2015), the court upheld a conviction for hacking and financial fraud under both IT and IPC sections. Denial-of-Service (DoS) Attacks - Section 66F, IT Act: Intentional attacks that disrupt networks or services are punishable by up to seven years' imprisonment and a fine. - Section 43, IT Act: Damaging computers or systems, including unauthorized access or virus introduction, can result in compensation up to ₹1 crore. - Section 67C, IT Act: Failure to retain information can lead to three years' imprisonment and a fine. - Section 324, BNS (formerly Section 425, IPC): Causing wrongful damage to property,
including digital properties, may be considered mischief and is punishable. Phishing - Section 66D, IT Act: Fraudulent schemes to obtain sensitive information (phishing) are punishable by up to three years’ imprisonment and a fine of up to ₹1 lakh. Notable cases include R v. Bansal (2017) and State v. Singh (2019), which involved convictions for phishing scams.
Section 319, BNS (formerly Section 419, IPC): Cheating by personation is punishable by up to five years’ imprisonment and a fine. For instance, a gang involved in phishing scams targeting banking details was charged under this and other sections for identity theft and fraud. Extraterritorial Application of Cybercrime Laws Certain provisions under the IT Act and the IPC have extraterritorial reach, meaning they can apply to offences committed outside India under specific conditions. - Section 75, IT Act: The IT Act applies to offences or contraventions committed outside India if they involve a computer, computer system, or network located in India. This allows India to prosecute crimes such as hacking (Section 66), identity theft (Section 66C), cyberterrorism (Section 66F), and phishing (Section 66D) when they involve systems in India, regardless of the offender's location.
- Section 1(4), BNS (formerly Section 3, IPC): This section provides for prosecution under the BNS (erstwhile IPC) of any offence committed beyond India if Indian law applies to it, treating the act as if it were committed within Indian territory. This is applicable to crimes such as cheating and forgery, even if they occur outside India. - Section 3(b), Digital Personal Data Protection Act (DPDPA), 2023: This Act also applies to digital personal data processing outside India if it is related to offering goods or services to individuals within India. Cybersecurity Laws in India Applicable Laws India has several cybersecurity laws governing the monitoring, detection, prevention,
mitigation, and management of incidents. Key applicable laws include: - IT Act: This Act, along with associated Rules, is the primary legislation addressing issues related to electronic records, digital signatures, and cybercrime. The IT Amendment Act expanded the scope of the IT Act to address cybercrimes such as data breaches, identity theft, and online harassment. CERT-In, under the IT Act, provides guidelines for incident response, requiring service providers, intermediaries, data centres, corporates, and government organisations to implement specific actions for cyber incident prevention and response. - National Cyber Security Policy 2023: This policy aims to protect both information and infrastructure in cyberspace, developing capacities to prevent, respond to, and mitigate cyber threats.
It sets up a robust framework through institutional structures, skilled personnel, and technology to secure critical information infrastructure (CII) via a 24/7 National Critical Information Infrastructure Protection Centre (NCIIPC). It enforces security practices across design, procurement, and operation of information resources to increase resilience. - Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021: These guidelines provide a legal framework for social media platforms, OTT platforms, and digital news providers. They establish provisions for data protection, complaint redressal, and safeguarding against harmful content. - Digital Personal Data Protection Act (DPDPA), 2023: This Act governs the processing of digital personal data, ensuring individuals' rights over their personal data while allowing lawful data processing.
It includes mandates for reporting cybersecurity incidents and imposes fines for non-compliance. - Upcoming Digital India Act: The proposed Digital India Act is intended to replace the IT Act, addressing online safety, trust, accountability, open internet, and regulating new technologies like AI and blockchain. Penalties and offences under the IT Act, IT Amendment Act, and Digital Personal Data Protection Act (DPDPA)
1. Confidentiality and Privacy Breaches
Section 72A (IT Act): Breach of confidentiality and privacy through unauthorized
disclosure of personal information. -Penalty: Imprisonment up to 3 years, fine up to Rs 5 lakh, or both.
2. Non-compliance with Cybersecurity Directives
Section 70B(7) of the IT Amendment Act: Failure of service providers, intermediaries, data centers, or corporates to comply with CERT-In directions under Section 70B(6). - Penalty: Imprisonment up to 1 year, fine up to Rs 1 lakh, or both. - Section 44(b) of the IT Act: Failure to furnish information as required under the Act or Rules. - Penalty: Up to Rs 1.5 lakh per failure; Rs 5,000 per day for ongoing delays.
3. Residual and Miscellaneous Violations
Section 45 of the IT Act: Covers contraventions with no specified penalty. - Penalty: Compensation or penalty up to Rs 25,000.
4. Data Protection and Privacy Breaches (DPDPA-Specific)
Section 8(5) DPDPA: Failure of a Data Fiduciary to implement security safeguards to prevent data breaches. - Penalty: Up to Rs 250 crores. - Section 8(6) DPDPA): Failure to notify the Data Protection Board or Data Principal of a data breach. - Penalty: Up to Rs 200 crores. - Section 9 DPDPA: Non-compliance with additional obligations for protecting children’s data. - Penalty: Up to Rs 200 crores.
Section 10 DPDPA: Breach of duties specific to a Significant Data Fiduciary. - Penalty: Up to Rs 150 crores. - Section 15 DPDPA: Violation of assigned duties under Section 15. - Penalty: Up to Rs 10,000 crores. - Other Provisions (DPDPA): Violations of any other provision of the DPDPA or related rules. - Penalty: Up to Rs 50 crores. Cybercrime in India: Government Measures - National Cyber Forensic Laboratory (Investigation): Established in New Delhi, this lab provides early-stage cyber forensic assistance to investigating officers from all State and Union Territory police forces through both online and offline support. - ‘CyTrain’ Portal: A Massive Open Online Courses (MOOC) platform for training various stakeholders, including police, judicial officers, and prosecutors.
The portal offers online courses covering crucial aspects of cybercrime investigation, forensics, and prosecution, with certification upon completion. - National Cyber Security Policy (NCSP): This policy aims to establish a secure cyberspace environment and strengthen India’s cybersecurity infrastructure. - Indian Cyber Crime Coordination Centre (I4C): As the national coordinating body, I4C works to enhance the capacity of law enforcement agencies in preventing and investigating cybercrimes across the country. - National Cyber Crime Reporting Portal: This portal allows the public to report cybercrime incidents, with a particular focus on crimes against women and children. - National Critical Information Infrastructure Protection Centre (NCIIPC): NCIIPC is tasked with protecting critical information infrastructure from cyber threats.
It identifies key sectors and develops guidelines and policies to secure them.
Cyber Swachhta Kendra: An initiative aimed at detecting and removing malware-infected systems, thus mitigating the spread of botnets. - Computer Emergency Response Team (CERT-In): CERT-In serves as the national agency responsible for responding to and managing cybersecurity incidents. It issues alerts and advisories to both public and private sectors to improve cybersecurity preparedness. -Information Technology (IT) Act, 2000: A comprehensive legislation covering aspects of electronic governance, digital signatures, data protection, and penalties for cybercrimes. Global Initiatives to Combat Cybercrime - Interpol Cybercrime Global Strategy 2022-2025: Aims to reduce the global impact of cybercrime, ensuring safer communities worldwide. The strategy supports member countries in their efforts to combat cybercrime through cooperation and resource sharing.
- Potential UN Cybercrime Treaty: UN member states are negotiating an international treaty aimed at addressing cybercrime on a global scale. If adopted, it would be the first binding UN agreement dedicated to tackling cybercrime. - Budapest Convention: Focuses on harmonizing cybercrime laws and promoting international cooperation, allowing cybercrime to be prosecuted across affected nations. India, however, has opted not to participate in this convention. Way Forward to Prevent Cybercrimes in India - Implement Advanced Cybersecurity Frameworks: Establish robust cybersecurity frameworks that encompass best practices, policies, security protocols, and essential tools to secure organizational operations. Investing in cutting-edge cybersecurity technologies is essential to safeguard critical information systems and networks.
- Promote Cyber Hygiene Practices: Encourage both individuals and organizations to adopt strong cyber hygiene practices, such as regularly updating software, managing passwords securely, and practicing safe online behaviour. - Enhance International Cooperation: Strengthen partnerships with global organizations,
law enforcement agencies, and other countries to share threat intelligence, exchange best practices, and coordinate efforts in investigating and prosecuting cross-border cybercrimes. For example, India and Japan have agreed to deepen cooperation on cybersecurity skills at both bilateral and multilateral levels. - Increase Public Awareness and Education: Conduct extensive awareness campaigns to educate the public on common cyber threats, safe online practices, and the importance of cybersecurity in daily life. - Encourage Adoption of Cyber Insurance: Cyber insurance policies can help cover financial losses arising from cyber incidents. Additionally, such policies often assist with costs related to remediation, such as legal assistance, investigative services, crisis communication, and compensations for affected customers. Legal and Policy Recommendations to Address Cybercrime in India
1. Strengthen Cyber Laws and Legislative Framework:
-Update the IT Act: India’s primary law dealing with cybercrime, the Information Technology Act of 2000, was drafted when technology was less advanced. Amendments should address emerging challenges, such as ransomware, AI-driven fraud, and social media-related cybercrimes. - Introduce the Digital India Act: This act should replace the IT Act to comprehensively address issues like data protection, cybersecurity, and regulations for new-age technologies like blockchain and AI. -Stronger Penalties for Cyber Offences: Increasing penalties for cyber offenses could serve as a stronger deterrent against malicious activities, especially those targeting critical sectors like healthcare and finance.
2. Enhance Cybersecurity Infrastructure
Advanced Cybersecurity Technology: The government and private sectors should invest in advanced technologies like artificial intelligence for threat detection, blockchain for secure transactions, and encryption protocols for data protection.
-National Cybersecurity Policy Implementation: A more aggressive implementation of the National Cyber Security Policy could provide a roadmap for securing national information infrastructure and better-equipping law enforcement agencies to handle cyber incidents.
3. Capacity Building and Training
Specialized Training for Law Enforcement: Providing targeted training for law enforcement officers in cybercrime investigation, evidence collection, and digital forensics is critical. Platforms like ‘CyTrain’ should be expanded to include real-life simulation exercises and case studies. - Cyber Education in Curriculum: Integrating cybersecurity courses in academic curriculums, especially in law and technology programs, will ensure that future professionals are equipped with knowledge of cyber laws, digital ethics, and privacy issues.
4. Raise Public Awareness and Promote Cyber Hygiene
Public Awareness Campaigns: Nationwide campaigns on cyber threats and safe online practices could reduce the risk of individuals falling prey to cybercrimes. Emphasis should be placed on common threats like phishing, scams, and identity theft. - Encouraging Cyber Hygiene: Regularly educating the public and private sectors on cyber hygiene practices—such as updating software, using multi-factor authentication, and avoiding suspicious links—can greatly minimize vulnerabilities.
5. Increase International Collaboration and Information Sharing
Collaborate with International Bodies: India should actively collaborate with international organizations like INTERPOL and participate in global treaties (potentially the UN Cybercrime Treaty) to combat cross-border cybercrimes. - Develop Cross-Border Jurisdiction Rules: Indian law should consider rules for crossborder jurisdiction, enabling faster coordination with other countries to track and prosecute cybercriminals who operate outside India.
6. Cyber Insurance and Financial Protection
Promote Cyber Insurance: Cyber insurance can help organizations mitigate financial losses associated with cyberattacks. Establishing a regulatory framework to govern cyber insurance could ensure fair and comprehensive coverage for affected parties. -Data Breach Compensation Mechanisms: Legal provisions for compensating victims of data breaches or financial loss due to cybercrime can incentivize organizations to adopt stronger cybersecurity measures.
7. Enhance the Role of CERT-In and the I4C
-Empower CERT-In CERT-In, as the national cybersecurity response team, should have expanded resources and authority to monitor and issue advisories and to act swiftly on cyber incidents. - Strengthen the Indian Cyber Crime Coordination Centre (I4C): I4C could serve as a stronger centralized body for coordinating cybercrime investigation and prevention across states and fostering collaboration between public and private sectors. By adopting a multi-pronged approach that includes stronger laws, advanced technology, awareness campaigns, and international cooperation, India can effectively address the growing cybercrime landscape. These measures, if implemented effectively, could create a safer digital environment for businesses and individuals alike. Case Laws: 1-Shreya Singhal v.
Union of India1 In this case, the constitutionality of Section 66A of the Information Technology (IT) Act was challenged before the Supreme Court. Facts: Two women were arrested under Section 66A of the IT Act after posting allegedly offensive comments on Facebook about the citywide shutdown in Mumbai following the death of a political leader. Section 66A of the IT Act imposes punishment for sending offensive, false, or irritating messages using computer resources or communication, which may cause
1 https://enhelion.com/blogs/2021/03/01/landmark-cyber-law-cases-in-india/
annoyance, inconvenience, danger, insult, hatred, or injury. The women filed a petition arguing that Section 66A violated their right to freedom of speech and expression guaranteed by the Constitution. Decision: The Supreme Court’s decision centered on three key concepts: discussion, advocacy, and incitement. The Court emphasized that discussion or advocacy of a cause, even if unpopular, lies at the heart of free speech and expression. It noted that Section 66A was overly broad and could restrict all forms of communication without distinguishing between mere advocacy or discussion of a topic, which may be offensive to some, and incitement leading to public disorder or harm.
Regarding the argument that Section 66A was intended to protect individuals from defamation, the Court clarified that the provision penalized offensive statements that might annoy an individual but did not necessarily affect their reputation. However, the Court concluded that Section 66A did not violate Article 14 of the Constitution, as there was a reasonable distinction between internet-based communication and other forms of speech. The Court did not address the challenge of procedural unreasonableness, ruling that the provision was unconstitutional on substantive grounds. 2-Syed Asifuddin and Ors. v. State of Andhra Pradesh and Anr. 2 Facts: The subscriber purchased a Reliance handset along with Reliance mobile services under the Dhirubhai Ambani Pioneer Scheme.
However, attracted by more favorable tariff plans from other service providers, the subscriber sought to switch to a different provider. The petitioners, who were staff members of TATA Indicom, hacked the Electronic Serial Number (ESN) of the mobile device. The Mobile Identification Number (MIN) of Reliance handsets was permanently integrated with the ESN, and by reprogramming the ESN, the handset was validated by the petitioners' service provider instead of Reliance Infocomm. Questions before the Court:
1. Whether a telephone handset qualifies as a "computer" under Section 2(1)(i) of the IT Act?
2 https://enhelion.com/blogs/2021/03/01/landmark-cyber-law-cases-in-india/
2. Whether the manipulation of the ESN programmed into a mobile handset constitutes an
alteration of the source code under Section 65 of the IT Act? Decision: (i) According to Section 2(1)(i) of the IT Act, a "computer" is defined as any device or system that performs logical, arithmetic, or memory functions through the manipulation of electronic, magnetic, or optical impulses, and includes associated input, output, processing, storage, computer software, or communication facilities within a computer system or network. Therefore, a telephone handset falls within the definition of a "computer" under this provision of the IT Act. (ii) The alteration of the ESN allowed the handset, which was exclusively used by Reliance, to be compatible with TATA Indicom services.
This modification of the ESN constitutes an offence under Section 65 of the IT Act, as each service provider must maintain its unique Service Identifier (SID) code and assign specific numbers to the devices used to access its services. Consequently, the offence registered against the petitioners under Section 65 cannot be quashed. 3-State of Tamil Nadu v. Suhas Katti3 This case is a significant one in the field of cyber law, known for its swift and effective handling, leading to a conviction within seven months from the date the First Information Report (FIR) was filed. Facts: The accused, who was a family friend of the victim, had a romantic interest in her and sought to marry her. However, the victim chose to marry another man, leading to the accused's disappointment. After the victim's divorce, the accused once again proposed to her, but she refused.
In retaliation, the accused resorted to cyber harassment. He created a fraudulent email account in the victim's name and used it to post defamatory, obscene, and derogatory content that caused harm to her reputation. This act of cyber harassment led to the filing of charges against the accused.
3 https://enhelion.com/blogs/2021/03/01/landmark-cyber-law-cases-in-india/
The charge sheet filed against the accused included sections under the Indian Penal Code (IPC) and the Information Technology (IT) Act. Specifically, Section 67 of the IT Act was invoked for publishing obscene material online, while Sections 469 and 509 of the IPC were applied for committing acts of forgery and insulting the woman's modesty through electronic means. Decision: The Additional Chief Metropolitan Magistrate, Egmore, delivered a conviction against the accused based on the charges brought against him. The court convicted the accused under the following sections:
1. Section 469 of the IPC (for forgery with the intent to harm the reputation of the victim): The
accused was sentenced to **rigorous imprisonment for 2 years** and a fine of Rs. 500.
2. Section 509 of the IPC (for insulting the modesty of a woman through electronic
communication): The accused was sentenced to simple imprisonment for 1 year and a fine of Rs. 500.
3. Section 67 of the IT Act (for publishing obscene content in electronic form): The accused
was sentenced to rigorous imprisonment for 2 years and a fine of Rs. 4,000. This case is notable not only for its legal significance but also for the relatively quick resolution of the case, highlighting the growing importance of cyber laws in India. The conviction served as a reminder of the seriousness with which the judiciary handles cases of cybercrimes, especially those involving harassment and defamation online. 4-CBI vs Arif Azim (Sony Sambandh Case)4 Background Facts: The case revolves around an incident involving a fraudulent transaction on the website www. sony-sambandh. com. This platform allowed Non-Resident Indians (NRIs) to send Sony products to their friends and relatives in India by making online payments.
In May 2002, an individual, who identified herself as Barbara Campa, logged into the website and ordered a Sony Colour TV set and a cordless telephone for Arif Azim in Noida. The payment was made using a credit card, and the order was delivered to Azim.
4 https://www.lawyersclubindia.com/articles/landmark-judgments-on-cyber-law-14025.asp
However, the credit card company later flagged the payment as unauthorized, and the legitimate owner of the credit card, Barbara Campa, denied making the transaction. Upon investigation, it was revealed that Arif Azim, who worked at a call center in Noida, had gained unauthorized access to Barbara Campa's credit card details and misused them to place the order. Following this, a formal complaint was filed with the Central Bureau of Investigation (CBI), and a case was registered under Sections 419 (Punishment for cheating by personation), 418 (Cheating with knowledge that wrongful loss may ensue), and 420 (Cheating and dishonestly inducing delivery of property) of the Indian Penal Code (IPC), 1860.
Issue: One of the central legal questions raised in the case was whether the Indian Penal Code (IPC), 1860, could be relied upon as an effective and adequate legal framework for dealing with cybercrimes, particularly when the Information Technology (IT) Act, which governs cybercrimes in India, was not exhaustive enough to cover all aspects of such crimes. Court Decision: The court found Arif Azim guilty of misappropriating the credit card details and committing fraud. However, taking into account that Azim was a young first-time offender, the court showed leniency in its sentencing. Instead of imposing a stringent prison sentence, the court decided to place him under **one-year probation.
In its decision, the court acknowledged the Indian Penal Code (IPC) as a reliable piece of legislation for addressing cybercrimes, particularly in situations where the IT Act does not provide a comprehensive legal solution. The court emphasized that while the IT Act may not have been exhaustive in its provisions, the IPC still remained an effective tool for prosecuting fraud, identity theft, and similar cybercrimes. This case underscored the growing need for a more specialized legal framework in India to handle cybercrimes but also highlighted how existing laws like the IPC could be applied effectively to address emerging challenges in the digital space. The case also demonstrated the importance of a hybrid legal approach, combining traditional laws with modern technological legislation, especially in areas like cyber fraud and identity theft. 5- Pune Citibank Mphasis Call Center Fraud5
5 https://www.lawyersclubindia.com/articles/landmark-judgments-on-cyber-law-14025.asp
Background Facts: In 2005, a significant fraud amounting to $350,000 occurred, where the funds were fraudulently transferred from four Citibank accounts in the United States to several fictitious accounts through the internet. The perpetrators were employees of Mphasis, a call center service provider, who gained the trust of Citibank customers by posing as customer service representatives. Under the pretext of assisting customers with complex issues, these call center employees obtained customers' Personal Identification Numbers (PINs). Instead of helping customers, they exploited this information to carry out the fraudulent transactions. The employees did not need to breach sophisticated security measures like encrypted software or firewalls. Instead, they focused on finding vulnerabilities in the Mphasis system that allowed them unauthorized access to customer accounts.
The fraud was executed using SWIFT (Society for Worldwide Interbank Financial Telecommunication) technology, which is widely used for transferring money between financial institutions globally. The fraudulent transfers were carried out by exploiting unauthorized access to customers' electronic accounts. Decision: The court identified the defendants in this case as former employees of the Mphasis call center. Given the nature of the fraud, the court noted that every time an employee entered or exited the organization, they were subjected to scrutiny, which indicated that the employees had memorized sensitive account information, including customer PINs. The fraud was carried out by unauthorized access to the customers' electronic accounts, which made this case a clear example of cybercrime.
The court ruled that the provisions under the Information Technology (IT) Act, 2000 were applicable to the case. The IT Act, which provides comprehensive coverage for cybercrimes, was deemed wide enough to address such fraudulent activities, even those that involve traditional crimes like fraud and forgery, as long as electronic documents or systems were involved. In this instance, the crime involved illegal access to customer accounts through the Mphasis system, and the court held that Section 43(a) of the IT Act, which deals with unauthorized access to computer systems, was applicable. Additionally, the defendants were charged under Sections 66 (punishment for hacking), 420 (cheating), 465 (forgery), 467 (forgery of valuable security), and 471 (using forged documents) of the Indian Penal Code (IPC), 1860.
This case highlights the critical issue of cybersecurity in financial transactions, the importance of safeguarding sensitive customer information, and the need for stringent regulatory oversight in the digital era. It also exemplifies how traditional laws, such as those under the IPC, and modern cyber laws, such as the IT Act, can be used together to prosecute cyber crimes effectively. The decision emphasizes the applicability of both legal frameworks in cases of cyber fraud, particularly when the offenses involve unauthorized access to electronic systems and data. Conclusion: Cybercrime in India has evolved into a significant challenge, demanding robust measures and cohesive efforts across technological, legal, and educational domains.
Despite various initiatives like the National Cyber Security Policy, establishment of institutions like CERT-In and the Indian Cyber Crime Coordination Centre (I4C), and frameworks like the IT Act, there remain gaps in addressing the complexity and scale of cyber threats. Strengthening the nation’s cybersecurity requires implementing advanced cybersecurity frameworks, promoting cyber hygiene practices, fostering public awareness, and enhancing international cooperation for intelligence-sharing and cross-border prosecution. Moving forward, legal reforms and policy enhancements should emphasize stringent penalties for cyber offenders, mandatory reporting of breaches, and support for victims. Moreover, introducing cybersecurity education from an early age and incentivizing the adoption of cyber insurance can provide long-term resilience.
Addressing cybercrime with a comprehensive approach will not only help protect citizens and organizations but also enhance India’s digital economy and foster a secure cyberspace for future growth.
REFERENCES:
(https://www. cnbctv18. com/india/cyber-crime-are-on-a-rise-in-india-amit-shah-cybersecurity-ncrb-data-13913912. htm, n. d. ) (https://www. researchgate. net/publication/372960099_Understanding_the_Dynamics_of_Cy bercrime_in_India_a_Comprehensive_Study_and_Recommendations, n. d. ) (https://pwonlyias. com/current-affairs/cyber-crime-in-india/#ncrb-data-on-cyber-crimes-inindia, n. d. ) (https://enhelion. com/blogs/2021/03/01/landmark-cyber-law-cases-in-india/, n. d. ) (LegalServicesIndia, n. d. ) (https://www. researchgate. net/publication/372960099_Understanding_the_Dynamics_of_Cy bercrime_in_India_a_Comprehensive_Study_and_Recommendations, n. d. ) (https://iclg. com/practice-areas/cybersecurity-laws-and-regulations/india, n. d. ) (https://www. geeksforgeeks. org/cyber-security-in-india-challenges-and-measures/, n. d. ) (https://ccoe. dsci.
in/blog/the-role-of-government-initiatives-in-tackling-cybersecuritychallenges-in-india, n. d. )