Law Enforcement Initiatives Towards Tackling Cyber Crime in India

By Shuchita Thapar

Cyber crime has been rising across India. This post reviews advancements in policing technologically advanced crimes and considers potential next steps. 

With rising instances of cybercrime being noted across the country, the need for vigilance in the cyber sphere has been highlighted by a number of commentators. These crimes have gained attention subsequent to the notification of demonetization, with rising online banking transactions and a governmental push towards a digital economy.

Several new issues stemming from the distrust in digital payment systems have been reported. For example, the cybercrime cell of the Mumbai Police has received several reports of a scam characterized by persons receiving fraudulent calls allegedly from banks, discussing a new RBI policy. These calls informed consumers that credit and debit cards were soon to be deactivated, but if they released their card details, they would be permitted to continue usage. Once released, these details were misused. While issues such as these do not require extensive cyber expertise to resolve, their incidence is on the rise. Countering them requires banks as well as law enforcement agencies to increase their efforts towards educating new adopters.

More concern may be caused by technology-intensive hacking attacks, both from within the country and outside. Recent instances include the hostilities faced by several Telangana-area software companies by alleged Pakistani attackers, as well as attacks by the group known as Legion. Their actions allegedly include the hacking of the twitter and email accounts of Rahul Gandhi, Vijay Mallya and Barkha Dutt, among others. There has also been an upswing in ransomware attacks recently, with over 11,000 attacks being reported in just three months. Reports of India’s first online Ponzi scheme are also now coming to light. This is despite the fact that that 80% of cybercrimes remain unreported according to recent news reports. This post will review some initiatives taken towards the more efficient investigation of cybercrime by law enforcement across the country.

Cyber Policing in India

Crime and Criminal Tracking Network and Systems (CCTNS)

Approved by the Cabinet Committee on Economic Affairs in 2009, with an allocation of INR 2 billion, the CCTNS is a project under the National e-Governance Plan. It aims at creating a nationwide networking infrastructure for an IT-enabled criminal tracking and crime detection system. The integration of about 15,000 police stations, district and state police headquarters and automated services was originally scheduled to be completed by 2012. However, this still remains incomplete.

Apart from the slow pace of implementation and budgetary problems, on-the-ground hurdles to fully operationalizing CCTNS include unreliable Internet connectivity and under-trained personnel at police stations. Other issues include unavailability of facilities for cyber forensic analysis in most locations, and lack of awareness regarding online citizens’ services such as verification of tenants and employees and clearance for processions and events.

Online Complaints

The Central Government, in response to queries by the Supreme Court regarding measures taken to tackle cybercrime, recently announced that they would be setting up a ‘Centre Citizen Portal’. This portal will allow citizens to file complaints online with respect to cybercrimes, including cyber stalking, online financial fraud and others, suffered or observed by them.

The governmental response also details the proposed process, stating that any such complaint on the portal will trigger an alert at the relevant police station and allow the police department to track and update its status, while the complainant too would be able to view updates and escalate the complaint to higher officials.

Cyber Police Stations

Cyber police stations generally include trained personnel as well as the appropriate equipment to analyse and track digital crimes. Maharashtra, where cybercrime has risen over 140% in recent times, and which had the dismal distinction of only recording a single conviction related to cybercrime last year, is converting its existing cybercrime labs into cyber police stations. This will mean there is a cyber police station in each district of the state. The initiative in Maharashtra is useful especially because of the rise in online transactions in Tier II and Tier III cities and the rising cybercrime related thereto. However, despite the rise in cybercrime, complaints remain of low reportage and low success rates in solving crime. Police officers point to problems processing evidence, with complex procedures being required to retrieve data on servers stored abroad.

Further, there have been complaints in Bengaluru of the limited jurisdiction of cyber police stations. Pursuant to a standing order of the DG & IGP of Bengaluru City Police issued in June 2016, only cases with damages of over INR 5 lakh can be registered at cyber police stations in case of bank card fraud. In cases of online cheating, only those instances where damages exceed INR 50 lakh are amenable to the jurisdiction of cyber police stations. All other cases are to be registered with the local police station which, unlike cyber police stations, do not generally include trained personnel or the appropriate equipment to analyse and track digital crimes.

While the order is undoubtedly creating problems for cybercrime victims, it was made taking into account the woefully under-resourced cybercrime police station in Bengaluru which, at the time, consisted of a 15-member staff with two vehicles at its disposal.

Predictive Policing

Predictive policing involves the usage of data mining, statistical modeling and machine learning on datasets relating to crimes to make predictions about likely locations for police intervention. Examples of predictive policing include hot-spot mapping to identify temporal and spatial hotspots of criminal activity and regression models based on correlations between earlier, relatively minor, crimes and later, violent offences.

In 2013, the Jharkhand Police, in collaboration with the National Informatics Centre, began developing a data mining software for scanning online records to study crime trends. The Jharkhand Police has also been exploring business analytics skills and resources at IIM-Ranchi, in order to tackle crime in Jharkhand.

The Delhi Police has tapped into the expertise at the Indian Space Research Organisation in order to develop a predictive policing tool called CMAPS – Crime Mapping, Analytics and Predictive System. The system identifies crime hotspots by combining Delhi Police’s Dial 100 helpline calls data with ISRO’s satellite imagery and visualizing it as cluster maps. Using CMAPS, Delhi Police has slashed its analysis time from the 15 days it took with its erstwhile mechanical crime mapping to the three minutes it takes for the system to refresh its database.

The Hyderabad City Police is in the process of building a database, called the ‘Integrated People Information Hub’ which, according to the City Police Commissioner, would offer the police a “360-degree view” of citizens, including names, aliases, family details, addresses and information on various documents including passports, Aadhaar cards and driving licenses.

The data is combed from a wide-ranging variety of sources, including information on arrested persons, offenders’ list, FIRs, phone and electricity connections, tax returns, RTA registrations and e-challans. It is further indexed with unique identifiers, and is used to establish the true identity of a person, and present results to relevant authorities within minutes. While the system is aimed at curbing criminal activity and detecting fraud, a lack of clearly identified cyber security and privacy protocols is a worrying sign.

Conclusion

We recently reviewed the National Crime Records Bureau’s statistics relating to cybercrime, as set out in their Crime in India Report 2015. Some concerns that stemmed from the figures set out in the report were the low conviction rates and high pendency of cases. Experts have linked these issues, amongst other things, with the limited mechanisms available for cyber policing and the effectively-defunct status of the cyber tribunals. A recent report by the Bureau for Police Research and Development also highlighted resource constraints affecting police stations, with several stations lacking basic necessities such as a vehicle or a phone connection. Over five lakh posts sanctioned posts also remain vacant.

Given resource limitations, both in fiscal terms and relating to trained personnel, it is heartening to see the steps that have been taken towards efficient cyber-policing. While this post highlights some steps that have been taken in major jurisdictions, there are several initiatives even in non-metro cities towards tackling cybercrime. A National Cybersecurity Co-ordination Centre is also due to be launched around June this year. In a recent response to the Supreme Court, additional solicitor general Maninder Singh also informed the Court of substantial investments being made by the Central Government towards police and judicial training and towards the creation of cybercrime prevention cells. It is hoped that these measures will help to stem the growing tide of cybercrime in India.

Shuchita Thapar is a Project Manager at the Centre for Communication Governance at National Law University Delhi

 

Tracking Cybercrime through the National Crime Records Bureau’s “Crime in India” Report, 2015

By Shuchita Thapar

The National Crime Records Bureau released their annual “Crime in India” report for the year 2015 earlier this year. This post analyses the trends in cybercrime traced through the report.  

The National Crime Records Bureau (“NCRB”) released their annual “Crime in India” report (“NCRB Report, or “Report”) for the year 2015 earlier this year. The report tracks statistics for various types of crimes across India, and provides useful insight into socio-legal trends, as well as problems being faced by law enforcement agencies in the country. This post seeks to review the findings of the report in relation to cybercrime in the context of issues facing crime deterrence and law enforcement in the country.

The NCRB has been tracking statistics relating to cybercrime since their 2014 report. Based on other trackers, between 2011 and 2015, the country witnessed a surge of nearly 350% in cybercrime cases reported. However, despite an increasing number of cases being reported, conviction rates remain very low. For example, Maharashtra saw only a single conviction in 2015 despite over 2000 cases being registered. While it is true that convictions are not generally related to the cases filed in the same year, low conviction rates are generally indicative of high pendency of cases, as well as an underdeveloped architecture of investigation and deterrence.

The NCRB Crime in India Report 2015

The NCRB Report tracks, in their cybercrime chapter, cases filed which are linked with the use of the internet and IT enabled services. Under this broad categorisation, the report seeks to trace (amongst other things) patterns of cases reported, cases pending, arrest rates, conviction rates, and offender demographics. A total of 11,592 cybercrime cases were registered in 2015, representing an increase of approximately 20.5% over the previous year. These include offences registered under the Information Technology Act (“IT Act”), as well as related sections of the Indian Penal Code and other special or local laws. Uttar Pradesh had the highest rate of reportage of such crimes, followed by Maharashtra and Karnataka.

The majority of the cases (6567) were registered under “Computer Related Offences”, which involve cases registered under Sections 66 to 66E of the IT Act. These include offences such as ‘sending offensive messages through a communication service’ (Section 66A), ‘dishonestly receiving stolen computer resource or communication device’ (Section 66B), ‘identity theft’ (Section 66C) and others. It is interesting to note that despite Section 66A being struck down last year by the Supreme Court in the Shreya Singhal case, convictions under the section have risen, and in some instances new cases have also been filed. Under the IPC, the majority of cases filed were relating to cheating, involving over 65% of the total cases filed.

A total of 8121 persons were arrested during 2015 in relation to cybercrime offences, representing a 41.2% increase over 2014. The maximum number of persons arrested were in Uttar Pradesh. However, tracking the persons arrested may not be the most useful metric, because it does not represent the number of cases that were brought to successful completion. In fact, only 250 persons were finally convicted under the IT Act and 20 were convicted under the IPC.

Over 14,000 cases registered under the IT Act were investigated in 2015, including over 6000 pending cases. At the end of the year, over 8000 cases remained pending for investigation. 2396 cases were charge-sheeted in 2015, and 4191 cases were pending for trial. Trials were completed in 486 cases, with 193 ending in conviction. 5,094 cases under the IPC were investigated in 2015, with over 1600 being pending cases from the previous year. 710 cases were charge-sheeted in 2015, and trials were completed for only 53 cases. In cases registered under the IPC, over 3600 cases remained pending for investigation at the end of 2015 – the majority of these cases related to forgery and data theft. It is clear that the pendency of cases is not only high, but increasing, although the NCRB report does not offer any potential reasons.

In terms of offender demographics, the majority of persons arrested fell within the 18-30 age bracket – over 65% of the arrestees under the IT Act, and 55% of the arrestees under the IPC are within this category. However, the NCRB report does not track other demographic statistics, including gender and socio-economic status.

The largest section of arrestees were characterized as ‘business competitors’, followed by ‘neighbours/friends/relatives’. The vast majority of persons arrested were Indian nationals, with only 4 foreign nationals being captured. Given the rising number of cyber incidents stemming from abroad, it is clear that the existing cyber law framework may be insufficient to tackle transnational cyber crime.

Conclusions

The NCRB report highlights the fact that problems that have plagued most areas of the Indian criminal justice system continue to be issues in relation to cybercrime. These include high pendency of cases, low conviction rates and low reporting. These problems are exacerbated by rising usage of information technology resources with limited knowledge of good cybersecurity principles.  Experts have also suggested that the Indian ecosystem around cyber policing is simply not equipped to secure convictions, because of an inadequately trained police force, limited technical resources, low co-ordination between the public and private sector, and an unequipped judicial system.

The Supreme Court of India has taken suo moto cognizance of the issue after a letter written by Hyderabad-based NGO Prajwala pointed out that 9 videos of sexual assault were being circulated on WhatsApp. After a CBI probe was ordered into these instances, the Centre also set up an expert group to formulate appropriate means to tackle growing cybercrime in India. Following this, the government agreed to take various steps, including the establishment of a National Cyber Crime Coordination Centre (“NCCC”) in order to focus on cybercrimes and national security issues and ensure appropriate communication between agencies. Reports have suggested that Phase I of the NCCC will be live by March 2017. It has also been agreed that cybercrime complaints can be filed online without the necessity of visiting a police station.

There have also been other steps taken, including the establishment of cyber labs promising additional technical, and increased emphasis on international co-operation. It is to be hoped that these measures will go a long way towards assuaging the policing problems currently facing cybercrime in India.

Shuchita Thapar is a Project Manager at the Centre for Communication Governance at National Law University Delhi

 

Supreme Court to pronounce judgment on Criminal Defamation tomorrow

Tomorrow in Supreme Court’s Room no. 4 at 10.30 am a bench of Justices Dipak Misra and Prafulla Pant will pronounce the judgment regarding the constitutional validity of criminal defamation (Sections 499 and 500 of IPC and section 199 of CrPC).

The CCG Blog

A Supreme Court bench of Justices Dipak Misra and Prafulla Pant is hearing a set of at least thirty petitions challenging the constitutional validity of criminal defamation (Sections 499 and 500 of IPC and section 199 of CrPC).

The summary of hearings from the first six days can be found here.

View original post

Innovative Reporting and Policing to curb Cyber Crime

By Shalini S

Cyberspace has been continually emerging as a significant forum of criminal activity that requires specialized monitoring. However, cyber crime cases often go unreported in India further increasing online vulnerability. Even reported cases mostly result in acquittal due to the lack of forensic infrastructure and trained policed personnel, who are able to retrieve and present adequate and admissible digital evidence.

Recognizing the difficulty of investigating high-technology crime by technically untrained police personnel, a specialized cyber crime cell was first established in Bangalore in 1999. Soon after, in 2001, the cell was declared as a cyber crime police station, the first one to have been established in India and exercising jurisdiction over Karnataka. A multidisciplinary group of experts was set to aid the police station in investigating registered cyber crime cases.

To tackle the mounting number of cyber crime cases being reported across the country, other states followed suit and several cyber crime investigation cells were established throughout India. At present at least 21 Indian states including New Delhi, Karnataka, Andhra Pradesh, Tamil Nadu, Maharashtra, Odisha and Uttar Pradesh have such dedicated anti-cyber crime cells. Some states which face higher incidence of cyber crime, such as Maharashtra and Odisha even have multiple cyber crime cells or cyber crime police stations staffed with tech-savvy officers.

These cells have been setup specifically to detect, prevent and investigate cyber crimes that fall within the ambit of Information Technology Amendment Act, 2008 (Central Act, 2000) and assist other law enforcement agencies in investigating computer-related crime. The specialized cells are generally equipped with high-tech software and hardware equipment required to pursue investigation of cyber crimes. They are also typically manned by specially trained police officers proficient in conducting cyber crime probes. They play a critical role in quickly retrieving digital evidence in a manner that allows it to be admissible in courts. Some of these cells also organize occasional awareness drives to educate the general public on cyber crime, in collaboration with other stakeholders.

While bigger cyber cells are sufficiently equipped to handle cyber crime complaints, local cells often lack expertise and competence in dealing with instances of cyber crime. This however, has not discouraged law enforcement agencies as they continue to innovate creatively to address the problem of cyber crime in India. Some of these innovative reporting and policing methods adopted in India have been described below.

The Delhi Police announced that FIRs for economic fraud and cyber crime cases could be filed through a mobile application that they were set to launch. This initiative was launched in order to simplify the procedure involved in filing a cyber crime complaint, increase transparency and encourage more victims to file complaints. Use of technology to enable simplified online cyber crime reporting is likely to increase the rate of reporting of cyber crime by victims, a view also espoused in a recent ASSOCHAM-EY study.

The Mumbai Police launched an interactive platform that is designed to help law enforcement agencies with detection of cyber crimes. The application which is termed Collaborative Online Crime Control Network (Coin) is linked to global cyber law databases of over 50 countries and help investigators identify offences under both the Information Technology Act, 2000 and cyber laws of other jurisdictions.

Additionally, the first private cyber crime reporting helpline has also begun operation in the Delhi-NCR region and provides technical assistance to victims upon receiving a complaint about a cyber offence. The helpline is generally used by victims who did not want to formally report cases to law enforcement agencies. It was conceptualized taking inspiration from the Internet Crime Complaint Centre (IC3.gov) operated by FBI. Of the complaints received, some serious crimes were forwarded to the Delhi police for investigation.

The Central Bureau of Investigation (CBI) is also engaged in the fight against cyber crime and has several specialized structures engaged in understanding and combatting cyber crime in India. It is also seemingly equipped with the expertise and equipment to deal with a high-technology crime as it functions as INTERPOL’s National Central Reference Points for Computer-Related Crime. The Cyber Crime Research and Development Unit (CCRDU) liaises with state police to collect information, track developments and trends in cyber crime and disseminates information on cyber crime.  The Cyber Crime Investigation Cell (CCIC) exercises jurisdiction throughout India and possesses the power to investigate high technology crime even if they are not covered under the IT Act. The Cyber Forensics Laboratory of the CBI even provides technical help to other law enforcement agencies in ongoing cyber crime investigation.

India is facing a slew of cyber-attacks, launched from both within and outside its border and it is undisputed that there must be determined efforts for better protection. While it is unclear whether tangible changes in cyber crime trends have already been noted after their introduction, creative reporting and policing initiatives are bound to effectively curb cyber crime rates by bringing an attitude change in victims and law enforcement officers.