Some Important Points About Cyber Crime

Cyber crime is any criminal activity that involves computers, network devices, or networks. “Cyber” is a term that denotes the involvement of computers or computer networks; it is derived from the ancient Greek adjective ‘kubernetikos’, meaning to rule, operate, or be skilled in steering. The first credit for cybernetic is given to MIT mathematician Norbert Wiener in the 1940s. Over the years the term ‘cyber’ has become mixed with many words to represent various aspects associated with involvement through computers and computer networks; cyberspace, cybersecurity, cyber advocacy, cyber addiction are some examples where adding the prefix cyber lets one know that the sphere of action is online or virtual. The term cyber crime began to be used in the year 1995 and was first proposed by Sussman and Houston for crimes involving computers and computer networks. In this unit we will learn the meaning and definitions of cyber crimes. How cyber crimes operate in society. What are the major types of cyber crimes that occur in society. How these crimes also happened in the context of women. What do the legal provisions say about cyber crimes.

There is no single definition of cyber crime and it is a term that indicates any criminal act committed using computers and computer-based networks. According to Anderson and Gardner cyber crime is “criminal act implemented through the use of a computer or other form of electronic communication” (2015). Cyberbullying, cyber theft, cyberstalking are some examples of cyber crime, which includes bullying, theft, stalking is done entirely in cyberspace and does not involve any physical contact. Cyber law is the law governing cyber crime; all regulatory mechanisms and legal infrastructure related to cyber activities come under the purview of cyber law. In India, the IT Act, 2000 lists some criminal offenses that can be classified as cyber crime. Some amendments were made to this act in 2008 to update the IT development. The Act covers a wide range of relevant sections on online commercial transactions, digital signatures, e-commerce, e-governance, cyber crime, etc.

The Indian Legislature does not provide a precise definition of cyber crime, even the Information Technology Act (2000), which deals with cyber crime, does not define cyber crime.

Dr. Debarati Halder and Dr. K. Jaishankar in ‘Cyber Crimes against Women in India’ (October 2016) have given the following definition of cyber crimes:

“Crimes which are committed with criminal intent against a person or a group of persons with the intention of intentionally harming the reputation of the victim or causing physical or mental harm or damage to the victim, directly or indirectly, using modern telecommunication networks such as the Internet (chat rooms, email, notice boards and groups) and mobile phones (SMS/MMS).”

According to the ‘Council of Europe Convention on Cybercrime’, cybercrime is: “a wide range of malicious activities, including illegal interception of data, system interference compromising network integrity and availability, and copyright infringement.”

The common factors underlying the various definitions explain cybercrimes as crimes involving computers and computer networks. Cybercrimes are crimes in which a computer or computer network… …is the object of the crime (for example, viruses, malware, DoS (Denial-of-service (DoS) attack is a type of cyber attack in which a computer or another device becomes unavailable to its intended users.) attacks) and/or …is the tool for committing the crime (for example, phishing emails, cyberstalking, identity theft) and/or …is the place of the crime (for example, using a computer to store illegally obtained data).

Cybercrimes can be divided into three categories

Crimes against people
Crimes against property
Crimes against government

The prevalence of internet connectivity and advances in technology have created a new global platform for criminal activities, enabling crimes to be committed with ease and anonymity. This has led to an increase in the volume and pace of cybercrimes, as the internet’s speed, convenience, anonymity and lack of borders have made computer-based crimes such as ransomware, fraud, money laundering, stalking, racketeering, etc. easier to commit and harder to detect.

How Cybercrime Works

Digital data, opportunities, and motives together provide fertile ground that give rise to the possibility of cybercrimes. Cybercrimes are generally not limited to a geographic location and are distributed in nature, which also means that usually a network of criminals is involved in carrying out the crime. Cybercriminals use various attack vectors and are always looking for new methods and techniques to achieve their goals while evading detection. To further reduce the chances of detection and prosecution, cybercriminals often choose to operate in countries with weak or non-existent cybercrime laws. Cybercriminals range from lone users to state-sponsored actors; creators of malware using the dark web to sell code, distributors of illicit pharmaceuticals using crypto-currency brokers to hold virtual money in escrow, state threat actors relying on technology subcontractors to steal intellectual property (IP) are just a few examples of cybercriminals and cybercriminal networks.

Cybercriminal activity can be committed by individuals or groups with very little technical skills, or by highly organized global criminal groups that include skilled developers and other relevant experts. Cybercriminals use a variety of software to commit crimes, but social engineering or psychological manipulation of people often plays a key role in carrying out most cybercrimes.

Types of Cybercrime

As mentioned above, there are three categories to classify different types of cybercrimes. The following are examples of some specific types of cybercrimes:

Cyber extortion: Cyber extortion involves the threat of an attack or an attack in which the hacker holds computer systems, websites, data and sensitive information hostage until a ransom is paid, usually in some form of cryptocurrency. Ransomware and Distributed Denial-ofService (DDoS) fall into this category of attack.
Cryptojacking: Cryptojacking involves the unauthorized use of people’s computers (including servers, smartphones and tablets) to mine crypto currencies. Cryptojacking attacks can involve loading mining software onto the victim’s system or running browser embed code when a malicious site is accessed. The purpose of cryptojacking, like many other cybercrimes, is to make a profit, but unlike many other behaviors it is designed to be completely hidden from the victim.
Identity theft: Identity theft is any crime in which a person steals someone’s personal information and data (including financial details, medical details, video-audio streaming, webmail, etc.) and uses it to deceive and commit fraud. The dark net provides a marketplace for buying and selling stolen identities.
Credit card fraud: Credit card fraud is a term that refers to fraud involving payment cards, such as credit cards or debit cards. Credit card fraud can be of authorized or unauthorized nature. Authorized transactions involve the person being deceived into making fraudulent payments and unauthorized transactions take place without the card owner’s knowledge. Stolen payment cards are bought and sold in bulk in dark net markets; hacking groups that have stolen large amounts of credit cards make a profit by selling it to single criminals who use it to steal from personal accounts.
Cyber espionage: Espionage involves spying on information belonging to a foreign government or a competing company. Cyber espionage occurs when an organization’s or government’s systems or networks are hacked in order to obtain confidential information. These attacks may be motivated by profit or ideology. Cyber espionage includes: – collecting, modifying or destroying data, – spying on an individual or group through network-connected devices such as webcams or closed circuit TV (CCTV), and – monitoring communications, including emails, text messages and instant messages.
Software piracy: Software piracy is the unauthorized use, copying, modification or distribution of software. Trademark infringement, copyright infringement and patent infringement are examples of software piracy. o There are different types of software piracy:
Soft lifting: The most common type of software piracy in which the legal owner of the software is one but the users are many o Hard-disk loading: Another common form of software piracy, in which a shop owner buys a legitimate copy of a software and distributes it to many users. o Counterfeiting: Counterfeiting means making authentic-looking copies of genuine/legal software programs and selling them at a lower price.
Client-server overuse cybercrime: Client-server overuse occurs when more copies of software are installed by the user than the number of licensed copies. o Online piracy: In online piracy, illegal software is obtained from online auction sites and blogs.
Exit scam: An exit scam occurs when a business continues to receive money without delivering the goods, until the buyers understand, and abscond/disappear with the money.
Phishing: Phishing is a technique of extracting confidential information, usually through email spoofing. It masquerades as a legitimate request from a reputable third party.

Impact of Cybercrime on Businesses and its Prevention

Cyber attacks can result in several devastating consequences for businesses, including the following:

Financial damage: Apart from the direct financial damage that a business suffers after a cyber attack, the additional cost of increased insurance premiums, enhanced cybersecurity measures, public relations (PR) and other related services add to the financial loss and burden. A business can be sued for a data breach and the company can be fined and penalized for failing to protect its customers’ data.
Reputational damage: A serious consequence of a cybersecurity breach is the loss of trust that a company faces from both customers and investors. After a cyber attack, firms not only lose existing customers but also lose the ability to acquire new ones. Damage to investor perception can lead to a significant decline in the value of the company. Additionally, the business may face an increase in the cost of borrowing and have difficulty raising additional capital.
Intellectual property damage: A business’s intellectual property such as product designs, technology, and strategies may be compromised, resulting in a loss of competitive edge.
Operational disruption: A cyberattack can render a business inoperable until systems are cleaned up and restored.

A business can reduce the risk of a cyberattack through an effective cybersecurity strategy that includes the following steps:

Develop clear policies and procedures for the business and employees and create a cyber-security incident response plant to support these policies and procedures. Regularly train employees on cybersecurity policies and procedures and the steps to take in the event of a security breach.
Outline the security measures in place to protect systems and data.
Regularly back up data and information to minimize damage in the event of a ransomware attack or data breach.
Use two-factor authentication (2FA) apps or physical security keys. Activate 2FA on every online account.
Verbally verify the authenticity of money transfer requests by speaking to the financial manager.
Create intrusion detection system (IDS) rules that flag emails with extensions similar to company emails. Carefully investigate all email requests for money transfers to determine if the requests are unusual.
Keep websites, endpoint devices and systems up to date with all software release updates or patches. Information security and resistance to cybercrime attacks can also be built by encrypting local hard disks and email platforms, using virtual private networks (VPNs) and using private, secure domain name system (DNS) servers.

Cyber Laws and Need for Cyber Laws

The laws governing the cyber space/virtual world are known as cyber laws and all netizens fall under the purview of these laws as the jurisdiction is universal. Cyber law can also be described as the branch of law that deals with legal issues relating to the use of inter-network information technology.

The growing importance of the Internet and the increasing number of Internet users created the need for cyber regulation. Cyber law is important as it affects almost all aspects of transactions and activities on the Internet, World Wide Web and the entire cyberspace. The Internet was initially developed as a research and information sharing tool and was an unregulated space. Over time its prevalence increased and it evolved into a parallel world, mirroring most of the activities of the physical world:

Computers and mobile phones are the primary tools of communication for almost all people around the world.
Most companies keep all their valuable data in electronic form and rely extensively on their computer networks.
Government forms including income tax returns, company law forms etc. are now filled electronically.
Financial resources are stored and accessed virtually.

The anonymity and global connectivity offered by cyberspace makes it an attractive domain for cyber criminals. Cyber crime cases such as online banking fraud, online share trading fraud, source code theft, credit card fraud, tax evasion, virus attacks, cyber sabotage, phishing attacks, email hijacking, denial of service, hacking, pornography etc. are becoming common. Even in “non-cyber crime” cases crucial evidence is found in computers/cell phones e.g. in cases of divorce, murder, kidnapping, tax evasion, organised crime, terrorist operations, counterfeit currency etc. This makes cyber laws indispensable and important, as all legal issues relating to cyberspace are dealt with through cyber laws.

Cybercrimes against women in India

Cybercrimes against women in India recorded a 110% increase between 2018 and 2020. According to the National Crime Records Bureau (NCRB), reported cases of publishing sexually explicit material online increased from 3,076 to 6,308 between 2018 and 2020 (NCRB, 2020). The perpetrators target women by sending obscene e-mails and WhatsApp messages, stalking women online, copying e-mails, converting images of women into pornographic images and developing pornographic videos without their consent.

Indian women are not aware of the procedures for reporting cybercrimes, which becomes a barrier to reporting cybercrimes. Social embarrassment and fear of backlash becomes another factor preventing women from reporting crimes. Many cybercrimes can be tackled effectively if women can report it immediately, as it becomes a warning of strict legal action for the perpetrators. An enabling social and legal environment that allows women to take action against cyber criminals becomes a discouraging environment for cyber criminals.

Some of the major cyber crimes against women are

Cyber stalking: Cyber stalking means following, harassing and psychologically abusing someone online. The cyber stalker does not make direct physical contact with the victim but monitors the victim’s online activity, tries to gather information about the victim, threatens and intimidates.

Harassment through e-mail: Harassment through e-mail includes blackmailing, threats, intimidation and even fraud. It usually involves the use of fake IDs, making it difficult to trace. Spam mails containing viruses and worms like Trojans, love bugs, etc. are sent to women. Men use fake email IDs to blackmail women to meet their demands against the threat of publicizing their morphed images online.

Harassment through online impersonation: This type of cybercrime is on the rise recently in which men create fake emails and/or fake social networking accounts of women and propagate their morphed images.

Misuse of social networking sites: A large number of harassment cases are reported by women these days in which their photographs along with their other personal information are morphed and posted online using their fake IDs. Many times people post morphed pictures with pornographic content on social networking sites.

Defamation: Cyber defamation includes both defamation and libel. It involves publishing derogatory information about a person on a website, or circulating it in the victim’s social circle.

E-mail spoofing: Email spoofing generally refers to emails that appear to come from one source but are sent from another and usually involve financial fraud. When the recipient opens the email, his system is bugged and thus data is accessed illegally.

Phishing: Phishing involves stealing personal information such as username, password, etc. with the aim of using it for fraud and crimes.

Morphing: Morphing is the manipulation of an image by an unauthorized user. The image is manipulated to create pornographic content. Photos of women are downloaded by fake users, manipulated and reposted/uploaded on various websites.

Cyber Pornography: Cyber pornography includes pornographic websites and pornographic magazines that are created using computers and the Internet. There have been many cases where morphed and manipulated pictures of women are posted on porn sites.

Trolling: Trolls are professional abusers who use fake social media IDs to create a cold war atmosphere in cyberspace. They spread conflict on the Internet and use the anonymity provided by the Internet to their advantage. The perpetrators post inflammatory or off-topic messages in the online community with the intention of harassing an individual.

Fraud on Dating Websites: There have been innumerable cases where women have been lured by men through dating sites. These encounters lead to rape and in worse cases, murder.

Cyber Crimes Against Women and Cyber Crime Laws

The Constitution of India guarantees equal rights to women. In consonance with the Constitution, the Indian Penal Code and the Code of Criminal Procedure contain specific provisions to deal with crimes against women, but the IT Act 2000 does not contain any specific provision to deal with crimes against women. This neglected aspect and the need to include women specific provisions in the IT Act, 2000 was brought to light by India’s first cyber crime case, the Ritu Kohli case being the first known case of cyber stalking in India. Mrs. Ritu Kohli lodged a police complaint in 2001 against an unknown person who was using her identity to chat over the Internet on a Delhi-based channel http://www.micro.com/.

The person was using her identity to have obscene conversations and also sharing other contact details including her address and phone number. As a result, Mrs. Kohli received about 40 obscene calls in three days, most of them at odd hours. The said calls caused extreme psychological trauma and disturbance in the personal life of the complainant. After the complaint, the police investigated the entire case, traced the IP address of the culprit and arrested him. A case was registered under Section 509 of the IPC for outraging the modesty of Mrs. Ritu Kohli. However, IPC Section 509 refers to ‘words, gestures or acts’ in person and there is no mention of when the same crime is committed over the Internet, which can be done anonymously without direct verbal or physical contact with the victim. The culprit was then released on bail, as none of the conditions mentioned in Section 509 pertained to cyber stalking. This was a wake-up call for the government to make provisions for cyber crimes and protect victims of crimes committed in cyberspace. The impact of cyber crimes on women is more psychological than physical, while laws ensuring women’s safety focus on the physical aspect rather than the psychological one.

The case gave rise to discussions on the need to create cyber crime provisions in the IT Act, 2000. Thus it was enhanced through amendment and the Information Technology Act, 2008 (ITAA 2008) came into existence. ITAA 2008 is the primary law to deal with cyber crimes in India.

Section 66A: Cyber stalking i.e. sending offensive messages through any communication service such as computer or mobile phone. Punishment: Imprisonment up to 3 years with fine. However, in Inshreya Singhal v. Union of India. Writ Petition (Criminal) No. 167/2012- Supreme Court held that Section 66A of the Information Technology Act, 2000 is totally void as violative of Article 19(1)(a) and not saved under Article 19(2).
Section 66B: Dishonestly obtaining stolen computer resources or communication device. Punishment: Imprisonment up to 3 years, or fine up to ₹1 lakh or both.
Section 66C: Identity theft. Punishment: Imprisonment up to 3 years and fine up to ₹1 lakh.

Section 66D: Phishing, i.e., cheating by online impersonation. Punishment: Imprisonment up to 3 years and fine up to ₹1 lakh.
Section 66E: Voyeurism, i.e., violation of privacy of a person. Punishment: Imprisonment up to 3 years with fine up to ₹2 lakh or both.
Section 66F: Cyber terrorism. Punishment: Imprisonment for life.
Section 67. For publishing or transmitting obscene material in electronic form. Punishment: First conviction: Imprisonment of any description for a term which may extend to three years and fine up to Rs 5 lakh. Second or subsequent conviction: Imprisonment of any description for a term which may extend to five years and fine up to Rs 10 lakh.
Section 67A: Publishing/or transmitting sexually explicit material online. Punishment: Imprisonment of up to 5 years for first conviction and fine up to Rs 10 lakh for first offence. Second or subsequent conviction Imprisonment of up to 7 years with fine up to Rs 20 lakh for repeat offence.
Section 67B: Child pornography: Publishing or transmitting in electronic form material depicting children in sexually explicit acts etc. Punishment: Imprisonment of up to 5 years for first conviction and fine up to Rs 10 lakh for first offence. Second or subsequent conviction Imprisonment of up to 7 years with fine up to Rs 10 lakh for repeat offence.

Following are some important sections under the Indian Penal Code to protect individuals from cyber crimes:

Section 354. Assault or use of criminal force to woman with intent to outrage her modesty. Punishment: 2 years imprisonment and/or fine.
Section 354A. punishes the offence of sexual harassment. Punishment: 3 years imprisonment and/or fine.
Section 354B: Criminal force on woman with intent to disrobe. Punishment: 3 to 7 years imprisonment with fine.
Section 354C. Criminalises the offence of voyeurism, i.e., the act of capturing the image of a woman engaged in a private act, and/or disseminating the said image without her consent. Punishment: 3 years imprisonment for the first offence and 7 years imprisonment and fine for the second offence.
Section 354D: Stalking. Punishment: •Upto 3 years + fine for first conviction •Upto 5 years + fine for second or subsequent conviction Read more: https://devgan.in/ipc/section/354D/
Section 469: Making forgery with the intent to harm the reputation of any person or knowing that it is likely to be used for that purpose. Punishment: 3 years + fine.
Section 503 punishes criminal intimidation, wherein a person is threatened with causing harm to his reputation. Punishment: Imprisonment for a term which may extend to 2 years, and/or fine.
Section 507 punishes criminal intimidation by means of anonymous communication. Punishment: Imprisonment for a term which may extend to two years.
Section 509 punishes uttering any words or making any gesture, etc., with intent to insult the modesty of a woman. Punishment: Simple imprisonment for a term which may extend to 3 years + fine.
Section 228A Disclosure of identity of victim of certain offences, etc. Punishment: Imprisonment which may extend to two years and fine.

Apart from the above provisions under IPC and ITAA, 2008, the Government of India has taken the following steps to prevent and address cyber crimes:

Cyber Crime Cells have been set up in all States and Union Territories for reporting and investigation of cyber crimes.
Cyber Forensic and Training Laboratories have been set up in various States like Kerala, Assam, Maharashtra, Mizoram, Manipur, Nagaland, Arunachal Pradesh etc. The training laboratories train police officers and judicial officers to understand cyber crimes better.
Cyber Forensic Labs have been set up in Mumbai, Bengaluru, Pune and Kolkata. These labs have been set up in collaboration with Data Security Council of India (DSCI) and NASSCOM.
Regular awareness and training programmes are organised through law schools and universities; National Law School, Bengaluru/NALSAR Law University, Hyderabad and other Law Universities organize several awareness and training programmes on cyber laws and cyber crimes for judicial officers.

Let us summarise

In today’s digital age the “virtual world” reigns supreme in all spheres of our lives. It shapes our political, social and cultural context and is a place of engagement equal to the physical world. All aspects of human nature, including harassment, abuse and crime, are reflected in cyberspace. However, cybercrime is not confined to cyberspace and staying away from it or going offline does not solve the problem. What is needed is awareness and laws that can curb cybercrimes. Keeping in view the gravity and scope of cybercrimes and understanding the extent of personal and societal damage caused by cybercrimes, laws need to be made and enforced.

Computer networking, newly developed technologies, resulting opportunities and the anonymity offered by cyberspace have given rise to cybercrimes in the last few years. Although cybercrimes are on the rise, detection and arrest have become difficult due to the non-localised and secretive nature of the Internet. India recorded 52,974 cases of cybercrime in 2021, which is more than 5% higher than 2020 (50,035 cases) and 155 higher than 2019 (44,735 cases) (The Quint, 2022) under both the Information Technology (IT) Act and the Indian Penal Code (IPC). To address the problem of cybercrime at the societal level, the Indian government enacted legislation to address the issue.

The Information Technology Act, 2000 and the Information Technology (Amendment) Act, 2008 are steps taken towards cyberspace regulation and combating cybercrimes. In addition to the ITAA-2008, certain sections of the Indian Penal Code (IPC) also book individuals committing such crimes. The Sexual Harassment of Women at Workplace (Prevention, Prohibition and Redressal) Act, 2013 also contains legal provisions on cyber stalking and online harassment. Cybercrime is a serious issue and various types of cybercrimes such as cyber stalking, cyber terrorism, cyber pornography, morphing, fraud, email spoofing, identity theft etc. have extremely harmful effects on the society. Prevention is a big aspect when it comes to cybercrimes and knowledge is the tool that can provide protection individually and collectively. Hence it is important that everyone is aware of these crimes and remains alert and proactive to avoid any personal or business losses.

Read Also: