Cybersecurity & it’s Recent Development in India

I. Introduction

In accordance with the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules 2013 (the CERT Rules), the Computer Emergency Response Team (CERT-In) has been established as the nodal agency responsible for the collection, analysis and dissemination of information on cyber incidents and taking emergency measures to contain such incidents.

Other relevant rules framed under the IT Act in context of cybersecurity include:

1. The Information Technology (Reasona-ble security practices and procedures and sensitive personal data or information) Rules 2011 (the SPDI Rules), which prescribe reasonable security practices and procedures to be implemented for collection and the processing of personal or sensitive personal data;

2. The Information Technology (Informa-tion Security Practices and Procedures for Protected System) Rules 2018 (the Protected System Rules²), which require specific information security measures to be implemented by organisations that have protected systems, as defined under the IT Act. More information on protected systems is provided in ‘Scope and jurisdiction’; and

3. the Information Technology (Interme-diaries Guidelines) Rules, 2011 (the Intermediaries Guidelines), which require intermediaries to implement reasonable security practices and procedures for securing their computer resources and information contained therein. The intermediaries are also required to report cybersecurity incidents (including information relating to such incidents) to CERT-In.

Other laws that contain cybersecurity-related provisions include the Indian Penal Code 1860 (IPC), which punishes offences, including those committed in cyberspace (such as defamation, cheating, criminal intimation and obscenity), and the Companies (Management and Administration) Rules 2014³ framed under the Companies Act 2013⁴, which requires companies to ensure that electronic records and security systems are secure from unauthorised access and tampering.

In addition to the above, there are sector-specific regulations issued by regulators such as the Reserve Bank of India, the Insurance Regulatory and Development Authority of India Act 1999, the Department of Telecommunication and the Securities Exchange Board of India, which mandate cybersecurity standards to be maintained by their regulated entities, such as banks, insurance companies, telecoms service providers and listed entities. Regulated entities operating in sensitive sectors, such as financial services, banking, insurance and telecommunications, have exhibited higher standards of cyber security preparedness and awareness, partly because of regulatory intervention as well as voluntary compliance with advanced international standards. Sectors such as ecommerce, IT and IT-enabled services that have seen infusion of foreign direct investment have also proactively deployed robust cyber security frameworks and policies to counter the evolving nature of cyber fraud as they have borrowed advanced cyber security practices and procedures from their parent entities in the United States, the European Union and other matured jurisdictions.

SDPI Rules framed under the IT Act require body corporates that handle sensitive personal data or information to implement 'reasonable security practices and procedures' by maintaining a comprehensive documented information security programme. This programme should include managerial, technical, operational and physical security control measures that are commensurate with the nature of the information being protected. In this context, the SPDI Rules recognise the International Standard on Information technology – Security techniques – Information security management systems – Requirements as one such approved security standard that can be implemented by a body corporate for protection of personal information. All body corporates that comply with this standard are subject to audit checks by an independent government-approved auditor at least once a year or as and when they undertake a significant upgrade of their processes and computer resources.

As per the CAM Rules, the managing director, company secretary, or any other director or officer of the company (as may be decided by the board) is responsible for the maintenance and security of electronic records. This person is required to, inter alia, provide adequate protection against unauthorised access, alteration or tampering of records; ensure that computer systems, software and hardware are secured and validated to ensure their accuracy, reliability and accessibility; and take all necessary steps to ensure the security, integrity and confidentiality of records. Any failure by such personnel in this regard may be construed to be a breach of their duties towards the organisation.

II. Cybersecurity under it act 2000

Under the IT Act, ‘cybersecurity’ means protecting information, equipment, devices, computers, computer resources, communication devices and information stored therein from unauthorised access, use, disclosure, disruption, modification or destruction. ‘Cybercrime’ on the other hand has been defined by the National Cybercrime Reporting Portal (a body set up by the government to facilitate reporting of cybercrime complaints) to ‘mean any unlawful act where a computer or communication device or computer network is used to commit or facilitate the commission of crime’.

The courts in India have also recognised cybercrime (eg, the Gujarat High Court in the case of Jaydeep Vrujlal Depani v State of Gujarat⁵ , to mean the offences that are committed against individuals or groups of individ uals with a criminal motive to intentionally harm the reputation of the victim or cause physical or mental harm, or loss, to the victim directly or indirectly, using modern telecommunication networks such as Internet (networks including but not limited to Chat rooms, emails, notice boards and groups) and mobile phones (Bluetooth/SMS/MMS)’.While the IT Act does not make any distinction between cyber security and data privacy, in our view, these issues are distinct but also deeply interconnected as ensuring privacy of an individual's data requires adequate cyber security processes to be implemented by organisations. Further, cyber security and information security frameworks are developed by organisations at a broader level to build resilience against various forms of cyber threat, including cybercrimes that entail more extensive engagement with regulatory authorities depending on the extent of harm caused, the nature of information handled by the body corporate, sector sensitivities, etc.

As per section 70 of the IT Act⁶, the government may notify any computer resource that affects the facility of critical information infrastructure to be a ‘protected system’. CII means any computer resource of which the incapacitation or destruction can have a debilitating impact on national security, economy, public health or safety. Under the Protected System Rules, specific cybersecurity practices are applicable in the context of a protected system, such as setting up an information security steering committee to approve all information security policies relating to the protected systems, designating a chief information security officer and carrying out vulnerability, threat or risk analysis on an annual basis. Significant changes in network configuration would need to be approved by the Committee, and organisations would need to ensure timely communication of cyber incidents to the Committee.

As mentioned above, as per the SPDI Rules, anybody corporate that possesses, deals with or handles any sensitive personal data or information in a computer resource is required to implement prescribed security standards on Information technology. Sectorspecific cybersecurity measures have been made mandatory by regulators for some regulated businesses. For instance, in the banking sector, the RBI requires banks to undertake certain security measures including, inter alia, logical access controls to data, systems, application software, utilities, telecommunication lines, libraries and system software; using the proxy server type of firewall; using secured socket layer for server authentication; and encrypting sensitive data, such as passwords, in transit within the enterprise itself. The RBI specifically mandates that connectivity between the gateway of the bank and the computer system of the member bank should be achieved using a leased line network (and not through the internet) with an appropriate data encryption standard and that 128-bit SSL encryption must be used as a minimum level of security.

Additionally, in the telecommunications sector, the licence conditions imposed by the DOT require every licensee to implement the following measures:

1. ensure protection of privacy of communication so that unauthorised interception of messages does not take place;

2. have an organisational policy on security and security management of its network, including network forensics, network hardening, network penetration tests and risk assessment; and The IT Act and related laws are equally applicable to cyberthreats involving intellectual property and grant similar protection.

3. Under the provisions of the IT Act, a nodal body – the National Critical Information Infrastructure Protection Centre has been set up to work in the interest of CII protection. The NCIIPC is authorised to reduce vulnerabilities of CII against cyberterrorism, cyber warfare and other threats. Certain identified CIIs are in sectors such as transport, telecoms, banking, insurance, finance, power, energy and governance. The cybersecurity provisions relating to specific sectors are described in ‘Legislation’ and ‘Increased Protection’.

III. License for interception

Certain laws, such as the Indian Telegraph Act 1885⁷ (the Telegraph Act) and the IT Act, permit governmental and regulatory authorities to access private communications and personally identifiable data in specific circumstances. The Telegraph Act empowers the government to intercept messages in the interest of public safety, national security or the prevention of crime, subject to certain prescribed safeguards. In that scenario, the telecoms licensee that has been granted a licence by the DOT is mandated to provide necessary facilities to the designated authorities of the central government or the relevant state government for interception of the messages passing through its network.

The IT Act also grants similar authority to the government and its authorised agencies. Any person or officer authorised by the government (central or state) can, inter alia, direct any of its agencies to intercept, monitor or decrypt, or cause to be intercepted, monitored or decrypted, any information that is generated, transmitted, received or stored in any computer resource, in the event it is satisfied that it is necessary or expedient to do so in the interest of sovereignty and the integrity of India, the defence of India, the security of the state, friendly relations with foreign states, public order or preventing incitement to the commission of any cognisable offence relating to the above, or for the investigation of any offence. In our view, the instances described in the IT Act can be relied on by the government agencies to intercept data for cyber security incidents if they relate to contravention or investigation of any crime.

Cybercrime activities are specifically dealt with under the IT Act. It prescribes penalties ranging from fines to imprisonment for various types of cyber activities, including hacking, tampering of computer source code, denial-of-service attacks, phishing, malware attacks, identity fraud, electronic theft, cyber terrorism, privacy violations and the introduction of any computer contaminant or virus.

IV. Cyber security policy

In addition to the minimum cyber security standards mentioned in ‘Legislation’, various regulatory bodies have advised businesses to adopt more robust measures in areas of cyber security. For example, the Ministry of Communication and Information Technology released the National Cyber Security Policy in 2013, which recommended creating a secure cyber ecosystem and strengthening laws, and creating mechanisms for the early warning of security threats, vulnerability management and the response to security threats. The policy intended to encourage all organisations to develop information security policies integrated with their business plans and implement the policies in accordance with international best practices. Under the Digital India initiative, the Ministry of Electronics and Information Technology (MeitY) has set up the Cyber Swachhta Kendra 197 (Botnet Cleaning and Malware Analysis Centre), operated by CERT-In, to work with internet service providers and product or antivirus companies to provide information and tools to users on botnet and malware threats. Similar proactive measures are deployed by sector-specific regulators from time to time.

In recent years, the government has rolled out some beneficial measures to incentivise both public and private sector organisations to improve cybersecurity standards. One example is the Public Procurement (Preference to Make in India) Order 2018 for Cyber Security Products notified by MeitY on 2 July 2018, wherein cybersecurity was named as a strategic sector, and it was further mentioned that government procurement agencies will give preference to domestically manufactured or produced cybersecurity products. In addition to the IT Act and the applicable rules framed thereunder, industry-specific standards have been prescribed by specific regulators. Some examples are given below.

Financial sector: the RBI has issued various guidelines for ensuring cybersecurity and the handling of cyber fraud within the banking sector. They can be accessed at RBI official website and include the:

i. Cyber Security Framework in Banks, prescribing standards to be followed by banks for securing themselves against cybercrimes

ii. Basic Cyber Security Framework for Primary (Urban) Cooperative Banks (UCBs), prescribing certain basic cybersecurity controls for primary urban cooperative banks;

iii. Sharing of Information Technology Resources by Banks – Guidelines, ensuring that privacy, confidentiality, security and business continuity are fully met;

iv. Information Technology Framework for the NBFC Sector, 2017, focusing on IT policy, IT governance information and cybersecurity; and

v. Working Group on Information Security, Electronic Banking, Technology Risk Management and Cyber Frauds, prescribing IT policy and outsourcing guidelines and recommendations.

The government issues consultation papers to invite feedback and suggestions from the private sector, which aids formulation of policies and laws in respect of cybersecurity. For instance, presently, the government is working with the private sector to develop its 2020 cybersecurity policy. In addition, the National Cyber Security Coordinator and the Data Security Council of India have recently launched an online repository on cyber tech called ‘Techsagar’⁸ to facilitate exchange and collaboration on matters of innovation and cybersecurity between businesses and academia. It is intended to provide an overview of India's cybersecurity preparedness and relevant stakeholders.

V. Indian and international legal frame work for cybercrimes

Convention on Cybercrime, 2001 also known as the Budapest Convention, is the first international treaty which discusses about the Internet and cybercrime by considering national laws, increasing cooperation among nations and improving investigative techniques. United Nations Convention against Transnational Organized Crime (UNTOC): This treaty was adopted by resolution of the UN General Assembly in November 2000. India being a signatory to this joined in 2002. UNTOC is also known as the Palermo Convention, under this the state parties are obliged to enact domestic criminal offences that target organised criminal groups and to adopt new frameworks for extradition, mutual legal assistance, and law enforcement cooperation.

The existing legal framework concerning the cybercrimes committed against women and children during the pandemic includes: Cybercrime complaint registration The victim of cybercrime can register the complaint by any of the following methods:

1) Online Cybercrime complaint (National Cybercrime Reporting Portal),

2) Offline Cybercrime complaint (Cybercrime Cell),

3) FIR (Local Police station).

However, during the time of the pandemic, the most feasible and recommended method to register a cybercrime complaint is the online method via National Cybercrime Reporting Portal. Through this method, the victim can register the complaint of the crime committed against her at the ease of sitting at her home. The victim will not have to visit any police station or cybercrime cell for the formalities or submitting the evidence. The relevant evidence can also be uploaded on the Cybercrime Portal at the time of registering the complaint. Moreover, the victim will have the option of tracking the status of her complaint with the help of her registered mobile number. Cybercrime offenses against women and children such as Child Pornography, Child Sexual Abuse Material containing sexually explicit images/videos of children, sexually explicit content such as rape/gang rape, etc. can be registered by the victim/complainant on the Cybercrime portal⁹. The victim doesn’t need to register the complaint, any person on behalf of the victim can also register the complaint on Cybercrime Portal. Also, the victim/complainant can register the complaint anonymously i.e., the identity of the victim/complainant will not be revealed under this option. To track the status of the complaint in the future, the victim/complainant shall choose the option of “Report and Track” under which he/she will have to register with the mobile number and email ID. Under this option, the victim/complainant will receive a timely update of all the investigations and actions taken by the police officer concerning the complaint registered.

VI. Steps taken by government

These include:

(i) Establishment of National Critical Information Infrastructure Protection Centre (NCIIPC) for protection of critical information infrastructure in the country.

(ii) All organizations providing digital services have been mandated to report cyber security incidents to CERT-In expeditiously.

(iii) Cyber Swachhta Kendra (Botnet Cleaning and Malware Analysis Centre) has been launched for providing detection of malicious programmes and free tools to remove such programmes.

(iv) Issue of alerts and advisories regarding cyber threats and counter-measures by CERT-In.

(v) Issue of guidelines for Chief Information Security Officers (CISOs) regarding their key roles and responsibilities for securing applications / infrastructure and compliance.

(vi) Provision for audit of the government websites and applications prior to their hosting, and thereafter at regular intervals.

(vii) Empanelment of security auditing organisations to support and audit implementation of Information Security Best Practices.

(viii) Formulation of Crisis Management Plan for countering cyber-attacks and cyber terrorism.

(ix) Conducting cyber security mock drills and exercises regularly to enable assessment of cyber security posture and preparedness of organizations in Government and critical sectors.

(x) Conducting regular training programmes for network / system administrators and Chief Information Security Officers (CISOs) of Government and critical sector organisations regarding securing the IT infrastructure and mitigating cyber attacks

VII. Preventive steps

Prevention programs aim to prevent the victim from being harassed and what steps and actions are to be taken to avoid and tackle the victim. Parents and educators should remain vigilant and apply the following tips to prevent online harassment. Dos and don’ts

• Frequent password change of social media accounts
• Use encryption
• Maintain social media hygiene
• Keep software updated
• Don't share passwords.
• Don't leave your webcam connected.
• Don't share more than necessary.
• Don't meet online acquaintances alone.
• Reveal only as much as needed.
• Update all operating systems on your devices.
• Don’t overshare information
• Do not leave data unattended
• Do not leave your computer logged in and
• Don’t be a liability on the society, always be a responsible citizen and before thinking about committing any offence, think about its consequences. “Prevention is better than cure”. So, all the net users, especially women, who are more prone to be the victims of cyber-crime, should not share their personal information to public.
• Social Networking sites like Face book, they should maintain the privacy limit on their information and photos. They should be careful in adding strangers in their friend list. The less accessible their private information and photos will be, the safer they are, behind the screens. If any cyber-crime happens against 125 them, they should immediately report it to the cyber cell of police and ask for immediate actions.

Indian Legal system, as well as Indian justice delivery system is that effective laws should be enacted through required amendments in the present statutes, that can tackle such issues of cyber-crime against women and can provide for deserved punishments to the offenders. Internet security is of vital importance and needs to be taken care of. Also, justice delivery should be speedy and effective. Present law should not lead to injustice being delivered. To prevent and stop crime, some strict actions need to be taken. Those actions should be immediate and effective. There is no benefit of delay, because “Justice delayed is justice denied.”

VIII. Conclusion

Cybercrime against women is on at alarming stage and it may pose as a major threat to the security of a person as a whole. In India the term “cybercrime against women” includes sexual crimes and sexual abuses on the internet. India is considered as one of the very few countries to enact IT Act 2000 to combat cybercrimes. The object of the IT Act is crystal clear from its preamble which shows that it was created mainly for enhancing e-commerce hence it covers commercial or financial crimes i.e. hacking, fraud, and breach of confidentiality etc. but the drafters were unaware about the safety of net users. Cyber defamation, email spoofing, cyber-sex, hacking and trespassing into one’s private domain is very common nowadays but IT Act is not expressly mentioning them under specific Sections or Provisions. Indian Constitution guarantees equal right to live, education, health, food and work to women. But the same modesty of women seems not to be protected in general.

Cybercrimes against women are still taken lightly in India, mostly because in general the respect towards women in our modern society is on a decrease also a lot of people are unable to come to terms with the fact that even posting images of someone online in a crime. Cybercrimes such as morphing, e-mail spoofing do-not have a moral backing in society and hence are taken lightly. Hence, to counter cybercrime against women in India, not only stricter penal reforms are the increasing incidents of cybercrime has a detrimental effect in cyber space which in turn possess a threat to national security as well. History of legislation shows that it is almost impossible to eradicate the crime from the virtual world even if the necessary precautions and cyber security measures have been taken.

Therefore, it becomes important that stringent laws must be construed to deal with the matters of cybercrimes wherein the first and foremost question arises about the competency of court that is to say whether the particular court have jurisdiction to entertain the matter. As the cyber space is a world with limitless boundary it becomes difficult to determine the power of court to adjudicate upon the matter hence the need of the hour is to develop a unique law which can be applied to deal with the case of cybercrime without any difficulty or confusion.

The recent incident of cybercrimes clearly shows that India is also in vulnerable position to cyber threats, therefore to address the issue it is important that India should become the signatory to Budapest convention and should ratify it. By showing its presence at global level would definitely aid the country to combat cybercrime cases and resolving the jurisdiction Hence, the issue of jurisdiction can be solved with by invoking CPC along with the IT act, 2000. There is no proper jurisdictional procedure laid in any other statute other than CPC. Issues regarding Jurisdiction of cyberlaw often pose a hurdle for the institution of civil suits. The universal nature of cyber laws has transcended the geographical boundaries and an extraterritorial jurisdiction is required. In addition, execution is a complex process that seems to be futile with regards to the extraterritorial jurisdiction.

Though the use of CPC can help in solving the jurisdiction issues of cyber law. It is suggested that CPC should be amended in order to avoid the complex application i.e., to simplify the procedures. The increasing incidents of cybercrime has a detrimental effect in cyber space which in turn possess a threat to national security as well. History of legislation shows that it is almost impossible to eradicate the crime from the virtual world even if the necessary precautions and cyber security measures have been taken. Therefore, it becomes important that stringent laws must be construed to deal with the matters of cybercrimes wherein the first and foremost question arises about the competency of court that is to say whether the particular court have jurisdiction to entertain the matter As the cyber space is a world with limitless boundary it becomes difficult to determine the power of court to adjudicate upon the matter hence the need of the hour is to develop a unique law which can be applied to deal with the case of cybercrime without any difficulty or confusion. This brings us to the most important part where social advancement is needed, people need to recognise the rights of others and realise what constitutes a crime. They must learn not to interfere with the private lives of others, respect towards 128 women in society needs to increase. All this can only be done if young kids are taught from a young age to respect women. considering the number of cases, the nature and tendency of the crime against women; it is reasonably alarming and dangerous. The situation is a red flag waving with danger written all over it.

To help further victimization of victims/survivor and reduce precious time in registering for a crime against women, besides introducing women helpline and cybercrime units, the lodging procedure and knowhow of the Zero FIR must be made understandable and aware through community policing and legal aid clinics. In the process of development and day to day hustle, individuals and governmental machineries should also not fail to safeguard the women from heinous crimes. It provides abundant indications that the cyber-crimes will become trendy with the time. Cyber space has a pre-dominant role to play in the recurring security problem. It is worth noting that the new features of crimes develop with the development in information and technology. Organized crime networks have increased globally. The reason for these cyber-crimes is due to its openness of the content, interoperability and neutrality. cyber-crime is different from the conventional crime hence the penal provisions should be made stringent to the offenders. World countries need to ensure that cyber threats do not result in erosion of commercial and business activities. Cyber intelligence teams must be established within the companies that deal with the computer data and software. Research and development (R&D) should be encouraged for determining and recognizing the newer crimes that are committed online. If not, these online committed crimes are acknowledged it may become even a global threat i.e., to all the world countries.

*****