Class 21 and 22

Introduction to Cyber Laws,

IT Act

Cyber Crime, Investigation and Surveillance

Friday, 18 March 2016 2



Why Should we know about Cyber-Crime?

• In this Tech-savvy world of 21st Century every one is engaged

with internet, through whatsapp, twitter, facebook, net-banking & lots

of other platforms are there.

• And some criminal minded persons commit crimes here, which is

included under cyber-crime.

• So we should be aware about crimes happening around in the cyber-

space.


Cyber Crime

• Cyber crime refers to any crime that involves a computer/mobile and a

network. The computer may have been used in the commission of a

crime, or it may be the target.


United Nations’ Definition of Cybercrime

• a. Cybercrime in a narrow sense (computer crime): Any illegal behavior

directed by means of electronic operations that targets the security of

computer systems and the data processed by them.

• b. Cybercrime in a broader sense (computer-related crime): Any illegal

behavior committed by means of, or in relation to, a computer system

or network, including such crimes as illegal possession [and] offering or

distributing information by means of a computer system or network.


Various categories of Cyber-Crime.

• Against Persons

• Against Property

• Against Government


Against Person:

• Cybercrimes committed against persons include various crimes like

transmission of child-pornography, harassment of any one with the use

of a computer such as e-mail, and cyber-stalking.

• The distribution, posting, and dissemination of obscene material

including pornography, indecent exposure, and child pornography,

constitutes one of the most important Cybercrimes known today. The

potential harm of such a crime to humanity can hardly be overstated..


Against Property:

• The second category of Cybercrimes is that of Cybercrimes

against all forms of property. These crimes include unauthorized

computer trespassing through cyberspace, computer vandalism,

transmission of harmful programs, and unauthorized possession of

computerized information.


Against Government:

• The third category of Cybercrimes relate to Cybercrimes against

Government. Cyber Terrorism is one distinct kind of crime in this

category. The growth of Internet has shown that the medium of

Cyberspace is being used by individuals and groups to the

international governments as also to threaten the citizens of a

country. This crime manifests itself into terrorism when an

individual "cracks“ into a government or military maintained

website.


What is Cyber law…?

• Cyber law is a term used to describe the legal issues related to use of

communications technology, particularly “cyber space”, i.e. the Internet.

• In essence, cyber law is an attempt to apply laws designed for the

physical world, to human activity on the Internet.

• In India, The IT Act, 2000 as amended by The IT (Amendment) Act,

2008 is known as the Cyber law.


Cyber law

• Cyber law or Internet law is a term that encapsulates the legal issues

related to use of the Internet. It is less a distinct field of law than

intellectual property or contract law, as it is a domain covering many

areas of law and regulation. Some leading topics include internet

access and usage, privacy, freedom of expression, and jurisdiction.


Cyber law encompasses laws relating to

• Cyber crimes

• Electronic and digital signatures

• Intellectual property

• Data protection and privacy


Important terms related to cyber law

• "Access" with its grammatical variations and cognate expressions

means gaining entry into, instructing or communicating with the logical,

arithmetical, or memory function resources of a computer, computer

system or computer network. (Sec.2(1)(a) of IT Act, 2000)

• "Addressee" means a person who is intended by the originator to

receive the electronic record but does not include any intermediary.

(Sec.2(1)(b) of IT Act, 2000)



• "Affixing Electronic Signature" with its grammatical variations and

cognate expressions means adoption of any methodology or procedure

by a person for the purpose of authenticating an electronic record by

means of Electronic Signature. (Sec.2(1)(d) of IT Act, 2000)

• "Asymmetric Crypto System" means a system of a secure key pair

consisting of a private key for creating a digital signature and a public

key to verify the digital signature. (Sec.2(1)(f) of IT Act, 2000)



• "Certifying Authority" means a person who has been granted a license

to issue a Electronic Signature Certificate under section 24.

(Sec.2(1)(g) of IT Act, 2000)

• "Communication Device" means Cell Phones, Personal Digital

Assistance (Sic), or combination of both or any other device used to

communicate, send or transmit any text, video, audio, or image.

(Sec.2(1)(ha) of IT Act, 2000)



• "Computer" means any electronic, magnetic, optical or other high-

speed data processing device or system which performs logical,

arithmetic, and memory functions by manipulations of electronic,

magnetic or optical impulses, and includes all input, output, processing,

storage, computer software, or communication facilities which are

connected or related to the computer in a computer system or

computer network (Sec.2(1)(i) of IT Act, 2000)



• "Computer Network" means the interconnection of one or more

Computers or Computer systems or Communication device through-

– the use of satellite, microwave, terrestrial line, wire, wireless or other

communication media; and

– terminals or a complex consisting of two or more interconnected computers or

communication device whether or not the interconnection is continuously

maintained. (Sec.2(1)(j) of IT Act, 2000)



• "Computer Resource" means computer, communication device,

computer system, computer network, data, computer database or

software. (Sec.2(1)(k) of IT Act, 2000)

• "Cyber cafe" means any facility from where access to the Internet is

offered by any person in the ordinary course of business to the

members of the public. (Sec.2(1)(na) of IT Act, 2000)



• "Computer System" means a device or collection of devices, including

input and output support devices and excluding calculators which are

not programmable and capable of being used in conjunction with

external files, which contain computer programmes, electronic

instructions, input data, and output data, that performs logic, arithmetic,

data storage and retrieval, communication control and other functions.

(Sec.2(1)(l) of IT Act, 2000)



• "Cyber Security" means protecting information, equipment, devices,

computer, computer resource, communication device and information

stored therein from unauthorized access, use, disclosure, disruption,

modification or destruction. (Sec.2(1)(nb) of IT Act, 2000)



• "Data" means a representation of information, knowledge, facts,

concepts or instructions which are being prepared or have been

prepared in a formalized manner, and is intended to be processed, is

being processed or has been processed in a computer system or

computer network and may be in any form (including computer

printouts magnetic or optical storage media, punched cards, punched

tapes) or stored internally in the memory of the computer. (Sec.2(1)(o)

of IT Act, 2000)



• "Digital Signature" means authentication of any electronic record by a

subscriber by means of an electronic method or procedure in

accordance with the provisions of section 3. (Sec.2(1)(p) of IT Act,

2000)

• "Electronic Form" with reference to information means any information

generated, sent, received or stored in media, magnetic, optical,

computer memory, micro film, computer generated micro fiche or

similar device. (Sec.2(1)(r) of IT Act, 2000)



• "Electronic Record" means data, record or data generated, image or

sound stored, received or sent in an electronic form or micro film or

computer generated micro fiche. (Sec.2(1)(t) of IT Act, 2000)

• "Electronic signature" means authentication of any electronic record by

a subscriber by means of the electronic technique specified in the

second schedule and includes digital signature. (Sec.2(1)(ta) of IT Act,

2000)



• "Function", in relation to a computer, includes logic, control, arithmetical

process, deletion, storage and retrieval and communication or

telecommunication from or within a computer. (Sec.2(1)(u) of IT Act,

2000)

• "Information" includes data, message, text, images, sound, voice,

codes, computer programmes, software and databases or micro film or

computer generated micro fiche. (Sec.2(1)(v) of IT Act, 2000)



• "Intermediary" with respect to any particular electronic records, means

any person who on behalf of another person receives, stores or

transmits that record or provides any service with respect to that record

and includes telecom service providers, network service providers,

internet service providers, web hosting service providers, search

engines, online payment sites, online-auction sites, online market

places and cyber cafes. (Sec.2(1)(w) of IT Act, 2000)



• "Key Pair", in an asymmetric crypto system, means a private key and

its mathematically related public key, which are so related that the

public key can verify a digital signature created by the private key.

(Sec.2(1)(x) of IT Act, 2000)

• "Originator" means a person who sends, generates, stores or transmits

any electronic message or causes any electronic message to be sent,

generated, stored or transmitted to any other person but does not

include an intermediary. (Sec.2(1)(za) of IT Act, 2000)



• "Private Key" means the key of a key pair used to create a digital

signature. (Sec.2(1)(zc) of IT Act, 2000)

• "Public Key" means the key of a key pair used to verify a digital

signature and listed in the Digital Signature Certificate. (Sec.2(1)(zd) of

IT Act, 2000)

• "Subscriber" means a person in whose name the Electronic Signature

Certificate is issued. (Sec.2(1)(zg) of IT Act, 2000)



• "Secure System" means computer hardware, software, and procedure

that -:

– are reasonably secure from unauthorized access and misuse;

– provide a reasonable level of reliability and correct operation;

– are reasonably suited to performing the intended functions; and

– adhere to generally accepted security procedures.

• (Sec.2(1)(ze) of IT Act,2000)


Salient features of the Information Technology

(Amendment) Act, 2008

• The term 'digital signature' has been replaced with 'electronic signature'

to make the Act more technology neutral.

• A new section has been inserted to define 'communication device‘ to

mean cell phones, personal digital assistance or combination of both or

any other device used to communicate, send or transmit any text video,

audio or image.

• A new section has been added to define cyber cafe as any facility from

where the access to the internet is offered by any person in the

ordinary course of business to the members of the public.

• A new definition has been inserted for intermediary.




• A new section 10A has been inserted to the effect that contracts

concluded electronically shall not be deemed to be unenforceable

solely on the ground that electronic form or means was used.

• Sections 66A to 66F has been added to Section 66 prescribing

punishment for offences such as obscene electronic message

transmissions, identity theft, cheating by impersonation using computer

resource, violation of privacy and cyber terrorism.




• The damages of Rs. One Crore prescribed under section 43 of the

earlier Act of 2000 for damage to computer, computer system etc. has

been deleted and the relevant parts of the section have been

substituted by the words, 'he shall be liable to pay damages by way of

compensation to the person so affected'.




• A new section 43A has been inserted to protect sensitive personal data

or information possessed, dealt or handled by a body corporate in a

computer resource which such body corporate owns, controls or

operates. If such body corporate is negligent in implementing and

maintaining reasonable security practices and procedures and thereby

causes wrongful loss or wrongful gain to any person, it shall be liable to

pay damages by way of compensation to the person so affected.




• Section 67 of the IT Act, 2000 has been amended to reduce the term of imprisonment for publishing or transmitting obscene material in electronic form to three years from five years and increase the fine thereof from Rs.100,000 to Rs. 500,000.

• Sections 67A to 67C have also been inserted. While Sections 67A and B deals with penal provisions in respect of offences of publishing or transmitting of material containing sexually explicit act and child pornography in electronic form, Section 67C deals with the obligation of an intermediary to preserve and retain such information as may be specified for such duration and in such manner and format as the central government may prescribe.




• In view of the increasing threat of terrorism in the country, the new

amendments include an amended section 69 giving power to the state

to issue directions for interception or monitoring of decryption of any

information through any computer resource.

• Further, sections 69A and B, two new sections, grant power to the state

to issue directions for blocking for public access of any information

through any computer resource and to authorize to monitor and collect

traffic data or information through any computer resource for cyber

security.




• A proviso has been added to Section 81 which states that the

provisions of the Act shall have overriding effect. The proviso states

that nothing contained in the Act shall restrict any person from

exercising any right conferred under the Copyright Act, 1957.


Examples of Cybercrime

• Web defacement

• Unauthorized network access

• Cyber-Stalking

• Internet fraud

• Identity theft

• Child pornography

• Interception and fabrication of emails

• Theft of passwords



Types of Cyber Crimes

• Hacking: This is a type of crime wherein a person’s computer is broken into so that his personal or sensitive information can be accessed. In the United States, hacking is classified as a felony and punishable as such. This is different from ethical hacking, which many organizations use to check their Internet security protection. In hacking, the criminal uses a variety of software to enter a person’s computer and the person may not be aware that his computer is being accessed from a remote location.

• Theft: This crime occurs when a person violates copyrights and downloads music, movies, games and software. There are even peer sharing websites which encourage software piracy and many of these websites are now being targeted by the FBI. Today, the justice system is addressing this cyber crime and there are laws that prevent people from illegal downloading.



• Cyber Stalking: This is a kind of online harassment wherein the victim is subjected to a barrage of online messages and emails. Typically, these stalkers know their victims and instead of resorting to offline stalking, they use the Internet to stalk. However, if they notice that cyber stalking is not having the desired effect, they begin offline stalking along with cyber stalking to make the victims’ lives more miserable.

• Identity Theft: This has become a major problem with people using the Internet for cash transactions and banking services. In this cyber crime, a criminal accesses data about a person’s bank account, credit cards, Social Security, debit card and other sensitive information to siphon money or to buy things online in the victim’s name. It can result in major financial losses for the victim and even spoil the victim’s credit history.



• Malicious Software: These are Internet-based software or programs

that are used to disrupt a network. The software is used to gain access

to a system to steal sensitive information or data or causing damage to

software present in the system.

• Child soliciting and Abuse: This is also a type of cyber crime wherein

criminals solicit minors via chat rooms for the purpose of child

pornography. The FBI has been spending a lot of time monitoring chat

rooms frequented by children with the hopes of reducing and

preventing child abuse and soliciting.



Legal aspects of computing

• The first one, historically, was information technology law (or IT law).

("IT law" should not be confused with the IT aspects of law itself,

although there are overlapping issues.) IT law consists of the law

(statutes, regulations, and caselaw) which governs the digital

dissemination of both (digitalized) information and software itself (see

history of free and open-source software), and legal aspects of

information technology more broadly.


SECTIONS OF IT ACT 2000

• Sections 2(d) of the act defines “affixing digital signature” as affixing digital

signature, with its grammatical variations and cognate expressions means

adoption of any methodology or procedure by a person for the purpose of

authenticating an electronic record by means of digital signature.

• Section 2(i) “computer” is defined as any electronic, magnetic, optical or high

speed data proceeding device or systems which performs logical, arithmetic

and memory functions by manipulations of electronic, magnetic or optical

impulses and includes all input, output, proceedings, storage, computer

software or communication facilities which are concerned or related to the

computer in a computer system or computer network.


SECTIONS OF IT ACT 2000

• Section 2(zc) defines private key as the key of a key pair used to create

a digital signature.

• Section 2(zd) defines public key as the key of a key pair used to verify

a digital signature and listed in Digital Signature Certificate.


SECTION 5: LEGAL RECOGNITION OF DIGITAL

SIGNATURES

• Section 5 of the Act gives legal recognition to digital signatures.

• Where any law provides that information or any other matter shall be

authenticated by affixing the signature or any document shall be signed

or bear the signature of any person then, notwithstanding anything

contained in such law, such requirement shall be deemed to have been

satisfied, if such information or matter is authenticated by means of

digital signature affixed in such manner as may be prescribed by the

Central Government.


SECTION 15: SECURE DIGITAL SIGNATURE

• If, by application of a security procedure agreed to by the parties

concerned, it can be verified that a digital signature, at the time it was

affixed, was

– unique to the subscriber affixing it;

– capable of identifying such subscriber;

– created in a manner or using a means under the exclusive control of the

subscriber and is linked to the electronic record to which it relates in such a

manner that if the electronic record was altered the digital signature would be

invalidated,

• then such digital signature shall be deemed to be a secure digital

signature.


SECTION 43: PENALTY FOR DAMAGE TO

COMPUTER• If any person without permission of the owner or any other person who is incharge of a computer,

computer system or computer network, – accesses or secures access to such computer, computer system or computer network;

– downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium;

– introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network;

– damages or causes to be damaged any computer, computer system or computer network, data, computer data base or any other programmes residing in such computer, computer system or computer network;

– disrupts or causes disruption of any computer, computer system or computer network;

– denies or causes the denial of access to any person authorised to access any computer, computer system or computer network by any means;

– provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made there under;

– charges the services availed of by a person to the account of another person by tampering with or manipulating any computer, computer system, or computer network,

• he shall be liable to pay damages by way of compensation not exceeding one crore rupees to the person so affected.


SECTION 61: CIVIL COURT NOT TO HAVE

JURISDICTION

• No court shall have jurisdiction to entertain any suit or proceeding in

respect of any matter which an adjudicating officer appointed under this

Act or the Cyber Appellate Tribunal constituted under this Act is

empowered by or under this Act to determine and no injunction shall be

granted by any court or other authority in respect of any action taken or

to be taken in pursuance of any power conferred by or under this Act


SECTION 62: APPEAL TO HIGH COURT

• Any person aggrieved by any decision or order of the Cyber Appellate

Tribunal may file an appeal to the High Court within sixty days from the

date of communication of the decision or order of the Cyber Appellate

Tribunal to him on any question of fact or law arising out of such order•

Provided that the High Court may, if it is satisfied that the appellant was

prevented by sufficient cause from filing the appeal within the said

period, allow it to be filed within a further period not exceeding sixty

days.


SECTION 63: COMPOUNDING OF CONTRAVENTIONS

• It states that any contraventions under this Act either before or after the

institution of adjudication proceedings, be compounded by the

Controller or such other officer as may be specially authorised by him in

this behalf or by the adjudicating officer, as the case may be, subject to

such conditions as the Controller or such other officer or the

adjudicating officer may impose.


SECTION 64: RECOVERY OF PENALTY

• A penalty imposed under this Act, if it is not paid, shall be recovered as

an arrear of land revenue and the licence or the Digital Signature

Certificate, as the case may be, shall be suspended till the penalty is

paid.


SECTION 65: TAMPERING WITH COMPUTER

SOURCE DOCUMENTS

• Whoever knowingly or intentionally conceals, destroys or alters or

intentionally or knowingly causes another to conceal, destroy or alter

any computer source code used for a computer, computer programme,

computer system or computer network, when the computer source

code is required to be kept or maintained by law for the time being in

force, shall be punishable with imprisonment up to three years, or with

fine which may extend up to two lakh rupees, or with both


SECTION 66: HACKING WITH COMPUTER SYSTEM

• Whoever with the intent to cause or knowing that he is likely to cause

wrongful loss or damage to the public or any person destroys or

deletes or alters any information residing in a computer resource or

diminishes its value or utility or affects it injuriously by any means,

commits hack:

• Whoever commits hacking shall be punished with imprisonment up to

three years, or with fine which may extend upto two lakh rupees, or with

both.


SECTION 67 PUBLISHING OF OBSCENE

INFORMATION

• Whoever publishes or transmits or causes to be published in the electronic form, any material which is lascivious or appeals to the prurient interest or if its effect is such as to tend to deprave and corrupt persons who are likely, having regard to all relevant circumstances, to read, see or hear the matter contained or embodied in it, shall be punished on first conviction with imprisonment of either description for a term which may extend to five years and with fine which may extend to one lakh rupees and in the event of a second or subsequent conviction with imprisonment of either description for a term which may extend to ten years and also with fine which may extend to two lakh rupees.


SECTION 71 PENALTY FOR MISREPRESENTATION

• Whoever makes any misrepresentation to, or suppresses any material

fact from, the Controller or the Certifying Authority for obtaining any

licence or Digital Signature Certificate, as the case may be, shall be

punished with imprisonment for a term which may extend to two years,

or with fine which may extend to one lakh rupees, or with both.


SECTION 72 PENALTY FOR BREACH OF PRIVACY

• Save as otherwise provided in this Act or any other law for the time

being in force, any person who, in pursuance of any of the powers

conferred under this Act, rules or regulations made there under, has

secured access to any electronic record, book, register,

correspondence, information, document or other material without the

consent of the person concerned is closes such electronic record,

book, register, correspondence, information, document or other

material to any other person shall be punished with imprisonment for a

term which may extend to two years, or with fine which may extend to

one lakh rupees, or with both


SECTION 73 - PENALTY FOR PUBLISHING FALSE

DIGITAL SIGNATURE CERTIFICATE

• No person shall publish a Digital Signature Certificate or otherwise

make it available to any other person with the knowledge that

– the Certifying Authority listed in the certificate has not issued it; or

– the subscriber listed in the certificate has not accepted it; or

– the certificate has been revoked or suspended,

• unless such publication is for the purpose of verifying a digital signature

created prior to such suspension or revocation.

• Any person who contravenes the provisions of sub-section (1) shall be

punished with imprisonment for a term which may extend to two years,

or with fine which may extend to one lakh rupees, or with both.


SECTION 74 PUBLICATION FOR FRAUDULENT

PURPOSE

• Whoever knowingly creates, publishes or otherwise makes available a

Digital Signature Certificate for any fraudulent or unlawful purpose shall

be punished with imprisonment for a term which may extend to two

years, or with fine which may extend to one lakh rupees, or with both


SECTION 75 - ACT TO APPLY FOR OFFENCE OR

CONTRAVENTION COMMITTED OUTSIDE INDIA

• Subject to the provisions of sub-section (2), the provisions of this Act

shall apply also to any offence or contravention committed outside India

by any person irrespective of his nationality.

• For the purposes of sub-section (1), this Act shall apply to an offence or

contravention committed outside India by any person if the act or

conduct constituting the offence or contravention involves a computer,

computer system or computer network located in India.


CASE STUDY – 1

State Of Tamil Nadu v/s Suhas Katti Conviction Within 7 Months

• The case related to posting of obscene, defamatory and annoying message about a divorcee woman in the yahoo message group. E-Mails were also forwarded to the victim for information by the accused through a false e-mail account opened by him in the name of the victim. The posting of the message resulted in annoying phone calls to the lady in the belief that she was soliciting.

• The accused was a known family friend of the victim and was reportedly interested in marrying her. She however married another person. This marriage later ended in divorce and the accused started contacting her once again. On her reluctance to marry him, the accused took up the harassment through the Internet.

• The accused is found guilty and convicted for offences under section 469, 509 IPC and 67 of IT Act 2000 . This is considered as the first case convicted under section 67 of Information Technology Act 2000 in India


CASE STUDY – 1

State Of Tamil Nadu v/s Suhas Katti Conviction Within 7 Months

• “ The accused is found guilty of offences under section 469, 509 IPC

and 67 of IT Act 2000 and the accused is convicted and is sentenced

for the offence to undergo RI for 2 years under 469 IPC and to pay fine

of Rs.500/-and for the offence u/s 509 IPC sentenced to undergo 1

year Simple imprisonment and to pay fine of Rs.500/- and for the

offence u/s 67 of IT Act 2000 to undergo RI for 2 years and to pay fine

of Rs.4000/- All sentences to run concurrently.”

• The accused paid fine amount and he was lodged at Central Prison,

Chennai. This is considered as the first case convicted under section

67 of Information Technology Act 2000 in India.


CASE STUDY – 2 Forgery - Andhra Pradesh Tax Case

• In the explanation of the Rs. 22 Crore which was recovered from the

house of the owner of a plastic firm by the sleuths of vigilance

department, the accused person submitted 6000 vouchers to legitimize

the amount recovered, but after careful scrutiny of vouchers and

contents of his computers it revealed that all of them were made after

the raids were conducted . All vouchers were fake computerized

vouchers


CASE STUDY – 3 Cyber Stalking

• Ritu Kohli (first lady to register the cyber stalking case) is a victim of

cyber-stalking. A friend of her husband gave her phone number and

name on a chat site for immoral purposes. A computer expert, Kohli

was able to trace the culprit. Now, the latter is being tried for "outraging

the modesty of a woman", under Section 509 of IPC.


CASE STUDY – 4 Extortion of Money Through Internet

• The complainant has received a threatening email and demanded

protection from unknown person claiming to be the member of Halala

Gang, Dubai. Police registered a case u/s. 384/506/511 IPC.

• The sender of the email used the email ID [email protected] &

[email protected] and signed as Chengez Babar.

• Both the email accounts were tracked, details collected from ISP’s &

locations were identified.

• The Cyber cafes from which the emails has been made were monitored

and the accused person was nabbed red handed.


CASE STUDY – 5 Fir No. 76/02 PS Parliament Street

• Mrs. Sonia Gandhi received threatening e-mails:

• E - mail from

– [email protected]

– [email protected]

• The case was referred to Cyber Cell

• Accused was traces and found that he had lost his parents during 1984

riots



Date post:	21-Jan-2018
Category:	Business
Upload:	dr-ajith-sundaram
View:	124 times
Download:	0 times

Class 21 and 22

Business