The law and short of cyber crime

An executive uses his credit card for making online purchases regularly. One day he finds he's been charged for something that he isn't sure he's bought. He contacts the card company only to be told that he was at fault for having used the card online and that, in any case, the amount of the transaction was too small to be followed up. Our man has no option but to pay the bill. What else can he do? Approach the authorities? They'll tell him that under the Indian law credit card transactions are a contract between the card company and the card holder. And he should have read the fine print carefully.

A man logs on to a chat site and pretends to be a woman known to him. He gives out the woman's telephone number inviting people to talk to her at odd hours in the night. The woman starts getting obscene calls from hundreds of men. She lodges a complaint and the man is caught red-handed. He's hauled to jail but he won't be in for long. Why? Cyber stalking is still not an offence under Indian law.

These aren't stories, but real life incidents. And they could well happen to you.

With an increase in the number of connected people, cyber crimes too are on the rise. And anyone who logs on is at risk.

Unlike most countries, India has tried to be proactive on cyber crime-it was the 12th country in the world to have a cyber law in place. The police have set up special cyber crime cells where you can register a complaint and there're training cells where cyber cops are acquiring technical expertise needed to deal with these crimes. A few criminals have been arrested for crimes ranging from harassment to defamation to cyber stalking. But policing cyberspace is not easy. There're many loopholes in the laws that make it easy for a criminal to get away. And low awareness levels, both among people and the police, just make it more difficult.

Big-but has no teeth

To be fair to the government, dealing with cyber crime isn't easy. What makes it especially difficult for lawmakers is that except for the model law of UNCITRAL, there're no precedents and experiences in other countries that can help. Formulating cyber laws is also more complex than other laws, as technology keeps changing on the fly. But even after making allowances for the lack of experience, one can't help but notice the gaping holes in India's first attempt to regulate cyberspace.

Indian cyber law-the Information Technology Act, 2000 was enacted on 17th May 2000 with an aim to legalize electronic commerce. Not deal with crimes in particular. The IT Act does mention cyber crimes though, declaring some punishable with imprisonment and a fine. These include hacking, damage to computer source code, publishing lascivious information, breach of privacy and faking digital signatures. But the act is not very clear in defining these crimes. You can now be sent to jail for hacking. But what constitutes hacking? According to section 66 of the Act: "Whoever with the intent to cause or knowing that he is likely to cause wrongful loss or damage to the public or any person destroys or deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means, commits hacking" This definition is not only broad but also vague. How do you prove that data has been diminished or affected injuriously? What if you don't delete or alter any data, just take a peep at it?

In its scope too the IT Act is quite ambitious, applicable to 'not only the whole of India but also to any offence or contravention thereunder committed outside of India by any person.' Just how this provision can be enforced-especially in countries with which India doesn't have an extradition treaty or countries that choose not to cooperate-is anyone's guess.

It's worth noting that the IT Act gives a Deputy Superintendent of Police the power to 'enter any public place and search and arrest without warrant any person who's reasonably suspected of having committed or committing, or of being about to commit any offence under this Act." The act authorizes the officers to confiscate everything-PCs, printers, modems, etc-from a public place they suspect of being the center of such a cyber crime.

But, strange enough, for such an ambitious law, the IT Act leaves out crucial areas like privacy, online transactions and theft of intellectual property. Cyber defamation and stalking-two of the most reported crimes in India don't even find a mention. The only consolation for victims is that thanks to the broadness of the section on hacking, enforcement agencies can take recourse in Section 66 while arresting an individual for crimes, which have not been mentioned in the act.

Few cases get reported

Despite the existence of cyber crime cells, most attacks go unreported for the fear of negative publicity or for lack of awareness as to what constitutes a cyber crime and where you can report it.

Rajeev Vaishnav, Director, The Indus Entrepreneurs (TiE), who's also on the advisory committee of the Mumbai crime cell, says that not more than 10 cases have come to the cell in the first year of their operation. Vaishnav admits that people are also unaware that they can be caught when they commit a crime in cyber space. And this ignorance of the possibility of being caught constitutes 40 to 70 percent of cyber crimes.

Where do you find help?

If someone breaks into your PC, be proactive. Make sure that you

• Don't shut your down 
• Save and back up the evidence
• Take printouts of the evidence
• Call the police

If you're a victim, you can register your complaint with a police officer of the rank of Deputy Superintendent of Police and above or in the cyber crime cell in your area. You could even lodge a complaint at a regular police station. But since the IT Act authorizes only senior officers like DSPs to handle such cases, your complaint would be transferred to them or the cyber cell in the state. The Mumbai cyber cell accepts complaints over e-mail, so you don't have to go to the police station. If you're in Karnataka, your complaint will reach India's first Cyber Police Station in
Bangalore.

Besides approaching the police, victims can also press for damages of up to Rs 1 crore in court under Section 43 of the IT Act. You can also seek help from NGOs and Websites like that of the Cyberlaw Association, which are spreading awareness about cyber laws in India.

Tracking down the culprit

The good news is that the police is training its ranks to handle cases related to cyber crimes. But the impact of this attempt will take some time to be felt and, as of now, awareness of cyber crime-even among the cops-is very low. Most cyber crime cells don't have the expertise to trace the culprit. In cities like Bangalore, experts from the IT industry are hired on a case to case basis. Companies like Wipro and Infosys besides the Indian Institute of Science are helping the police. In Mumbai, there're seven cyber cops who're being trained to tackle such crimes. The cyber crime cell here also has experts from IT industry on the technical and advisory committees for help.

The CBI has a Cyber Crime Research and Development Unit (CCRDU) in Delhi, which collects information on the hi-tech crimes and helps state police forces. It also collects info on the latest cases reported in other countries and the innovations employed by police forces to handle such cases. DIG, CBI, Loknath Behera says that tracing e-mail poses a big problem for the cops. "Tracking it (e-mail) becomes difficult if the host server is outside the country and we don't have effective methods to trace them as of now", he says. Government agencies like the National Crime Records Bureau (NCRB) are developing software that can help police track the criminals.

The numbers are growing

According to an IDC report released in April this year there're 44.7 lakh Internet users in India. This figure will cross 376 lakh in five years. Worldwide, cyber crime has increased proportionately to Internet access. There's no reason why India should be an exception. The threat is on our doorstep-and we can choose to downplay it at our own risk.

Neetu Katyal with Pragya Madan in Mumbai, Suma EP and Vini Goel in Bangalore

Law consultants: Pavan Duggal, Advocate, Supreme Court of India, New Delhi Rohus Nagpal, Asian School of Cyberlaws, Pune

Source: www.computersathome.com