unauthorized access

Online Revenge Porn-Recourse for Victims under Cyber Laws

– Advocate Puneet Bhasin, Cyber Law Expert, Cyberjure Legal Consulting
http://www.cyberjure.com

revenge porn
Online Revenge Porn means that when there are relationship break ups, then either party puts up nude pictures of the other or videos of their intimate moments on social networking media, blogs and other websites. Online Revenge Porn is on the rise world over with the advent of an open arena of the internet. Most online porn in India is amateur porn or revenge porn. World over, every country has enacted specific legislation to deal with revenge porn.
UK is coming out with the Revenge Porn Law. Many US States already have their Revenge porn laws. Virginia also has a revenge porn law and on 20th October, 2014 the first person was charged and convicted under their law.
In India we do not have a separate Revenge Porn Law, but Sections 67, 67-A and 66-A of the Information Technology Act, 2000 make online publication of Revenge porn a punishable offence.
Section 67 reads as under:
Punishment for publishing or transmitting obscene material in electronic form. -Whoever publishes or transmits or causes to be published or transmitted in the electronic form, any material which is lascivious or appeals to the prurient interest or if its effect is such as to tend to deprave and corrupt persons who are likely, having regard to all relevant circumstances, to read, see or hear the matter contained or embodied in it, shall be punished on first conviction with imprisonment of either description for a term which may extend to three years and with fine which may extend to five lakh rupees and in the event of second or subsequent conviction with imprisonment of either description for a term which may extend to five years and also with fine which may extend to ten lakh rupees.
This section makes a person liable for transmitting or causing to transmit nude photos or content of the nature that it can deprave/corrupt the viewer of such content.
When people are in relationships, they tend to share nude or naughty photos of themselves with each other, and these photos are misused by the jilted partner in the event of a break up.
A victim can seek recourse under Section 67 in such a case.
Section 67 A of the Information Technology Act reads as under:
“Punishment for publishing or transmitting of material containing sexually explicit act, etc. in electronic form. – Whoever publishes or transmits or causes to be published or transmitted in the electronic form any material which contains sexually explicit act or conduct shall be punished on first conviction with imprisonment of either description for a term which may extend to five years and with fine which may extend to ten lakh rupees and in the event of second or subsequent conviction with imprisonment of either description for a term which may extend to seven years and also with fine which may extend to ten lakh rupees.”
This section also criminalizes the act of any party transmitting via email, MMS or video any act or conduct of explicit nature which the parties indulged in during the course of the relationship.
A victim can file a complaint with the Cyber Police Station along with filing an FIR in the Police Station.
In India we definitely need separate and comprehensive revenge porn laws along with an efficient judicial mechanism to deal with these offences in short duration of time. Many countries have a National Helpline along with a separate Cell to deal with Online Revenge Porn, as these matters require immediate redressal before the video goes viral. A National Helpline for revenge should be set up in India too, where victims can complain and there would be immediate pull down of the content from the internet. Most developed countries have enacted specific laws for the same already because of the huge increase in Revenge porn in the virtual world.
Disclaimer: This article is purely for educational purpose and is not in the nature of legal advice. It does not constitute any lawyer-client relationship between the author and the reader.

Advertisements

– Advocate Puneet Bhasin, Cyber Lawyer, Cyberjure Legal Consulting, http://www.cyberjure.com

social 3 social 2

Hacking or unauthorized access to accounts can be of two types. The first is the one that would involve password cracking tools, but most organizations have cyber security features in place to prevent these attacks, however, it’s the second type of attack that can cripple any organization or person’s accounts and databases; this is a social engineering attack.

Social engineers are criminals who take advantage of human behavior to pull off an online scam or hacking attack. Successful social engineers are confident and in control of the situation completely.

There can be two techniques used by social engineers. One is of simple observation and another is of proactive effort.

In the first case, the social engineer simply observes a person’s social networking profiles, linkedin profiles and all data available about him. Most people have passwords that they can easily remember, and for that they have to be words closely related to them. People share their lives on social networking, where their date of birth, favourite colour, pet’s name and everything possibly related to them is freely available. It’s pretty easy to guess passwords in such a scenario. It’s always advisable to be discrete with respect to the data shared on social media. Such data is also collected by the online questionnaires and market research forms that people request to fill in public places.

In the second case, the attack is pre-planned and complete checklist is made of the person or companies likes, dislikes, passions, hobbies and professional credentials. Then the second stage of physical access comes into the picture. For example, three income tax officials turn up at your office for an inspection along with relevant badges and check all your office computers and all your documents, and in the process lodge key loggers into your computers, whereby they will receive an email of every key stroke made on the computers, thereby giving out your passwords and confidential data.

An example of this kind of attack would be where a social engineer researches about a person let’s say Mr. A, and knows that this person is fond of foreign holidays. The social engineer then calls up this person as the authorized representative from a reputed travel agency and offers a mind-blowing holiday package. He asks the Mr. A the version of PDF reader he is using on his laptop. The conversation is very friendly and inspires trust in the mind of Mr. A. The social engineer sends the holiday proposal in a PDF format which is not compatible with the PDF reader installed by Mr. A, and along with the proposal sends a compatible PDF reader for Mr. A to download and read the proposal. The PDF reader has malware attached that gives the social engineer access into Mr. A’s computer.

Another example of this type of attack would be where a very pretty woman, who is a journalist, goes to meet the System Administrator of a big company, to get his opinion on cyber security. She flirts a lot with him and after taking his opinion leaves, but “accidently” leaves her pen drive with him. A beautiful woman who flirted with this guy definitely would make him curious about her and he accesses her pen drive to know more about her. Only that the pen drive is infected with key logger and Trojan malware, thereby making the company’s networks very vulnerable.

The 4 basic principles which most social engineers follow are:

  • They project confidence. They do not sneak around and they proactively approach people and draw attention towards themselves.
  • They give you something. Probably just a small favor which creates trust and a perception of indebtedness.
  • They use humor as that is one tool which is endearing and disarming.
  • They make a request and offer a reason and research shows people are likely to respond to any reasoned request.

Attacks by social engineering are offences in India under Section 43 of the Information Technology Act, 2000. This section reads as under:

Penalty and compensation for damage to computer, computer system, etc. -If any person without permission of the owner or any other person who is incharge of a computer, computer system or computer network,-

(a) accesses or secures access to such computer, computer system or computer networkor computer resource;

(b) downloads, copies or extracts any data, computer data base or information from such computer, computer system or computer network including information or data held or stored in any removable storage medium;

(c) introduces or causes to be introduced any computer contaminant or computer virus into any computer, computer system or computer network;

(d) damages or causes to be damaged any computer, computer system or computer network, data, computer data base or any other programmes residing in such computer, computer system or computer network;

(e) disrupts or causes disruption of any computer, computer system or computer network;

(f) denies or causes the denial of access to any person authorised to access any computer, computer system or computer network by any means;

(g) provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made thereunder;

(h) charges the services availed of by a person to the account of another person by tampering with or manipulating any computer, computer system, or computer network,

(i) destroys, deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means;

-he shall be liable to pay damages by way of compensation to the person so affected.

 

A victim is required to make a Complaint in the prescribed format along with the applicable fees to The Adjudicating Officer, Information Technology Act, 2000. The fees are calculated in accordance with the damages claimed. Under the provisions of the Rules for conduct of Adjudicating Proceedings under the Information Technology Act, 2000, the Adjudicating officer shall decide every application in 4 months and the whole matter in 6 months.

 – legal.pb@gmail.com

social 1

– Advocate Puneet Bhasin, Cyber Lawyer, Cyberjure Legal Consulting

ImageImageImage

Cyber space has certain distinct features like anonymity which make it a very dangerous arena. However, this sense of anonymity is not really true as every person and activity on the internet can be traced, but a layman does not have the knowledge to take recourse to the same when he is a victim of a cyber crime.
Email scams are the most commonly committed cyber crimes in India. Gullible people fall prey to these scams which offer great monetary gains. An Email scam is a hoax distributed in an email form which is designed to deceive and defraud the email recipients for monetary gain.
The most common types of Email scams are as follows:
1. Dating Scam: This is a very charming scam that purports to tug at the strings of your heart but end of the day leaves your wallet empty. These scams originate from random chats on online dating or matrimonial portals where email ids are exchanged for further correspondence. Also in many cases there are emails soliciting for a date by a very beautiful and charming woman that are sent to all email ids that would seemingly belong to men. Responding to such emails leads to exchange of photographs and sharing of personal data along with flirting and building an emotional bond. However, it ends with the scammer being in severe need for money for treatment after an accident or to visit the online lover. However, once the money is transferred all correspondences from the scammers end cease. In many cases they are actually Nigerian men who purport to be beautiful women and solicit men for dates, and that’s why this is a type of Nigerian email scam.
2. Phishing Emails: These emails are all over cyber space. They purport to have been sent by a Bank and have a link which directs you to a webpage which carries the logo and feel of the Bank’s website. They require the recipient to update his records immediately otherwise his accounts would be frozen. Most people panic on receiving such an email and enter their online banking passwords and sensitive data on the webpage. Thereafter, the scammers make unauthorized withdrawals from the victim’s bank accounts. The latest is an email from RBI which asks the recipient of the email to secure his bank account details with RBI, requiring him to mention all the banks in which he has his accounts along with the net banking details, credit card numbers including the secret three digit CVV number.
3. Inheritance Scam: These emails mention that the name of the recipient matches that of the relative of a millionaire who has died intestate abroad. If a victim responds positively to this email, he will receive very genuine looking transfer documents for the property along with a bill for the legal fees that would have to be incurred for the transfer. Once the victim transfers the money, he will never hear from the scammer again.
4. Lottery Scam: This is among the most common types of email scams, where a victim receives an email informing him that he has won a big lottery and he has to pay a certain amount of money as transaction costs to claim the prize money.
5. Extortion scam: This is a very interesting type of email scam. In email scams, the scam emails are sent out to millions of people. These scam emails are threatening in nature and demand security money. They will typically say that I am watching you, and I know your wife and child also, if you don’t pay beware of the consequences. The next email would mention that you think I am not serious, but I have been following you, you wore a white shirt and blue trousers today. Now in reality this is just a psychological play to create fear in the mind of the victim. If you just clearly think, then from all the men who receive that email many would have a wife and child, and most men wear white shirts and blue trousers. It’s a game of probability.
In 2012 a 32 year old man from Indore was arrested for allegedly duping a student from Kandivili of Rs. 1.2 Lakhs through an email lottery scam. The Mumbai Cyber Police cracked this case and apprehended the culprit.
If you are a victim of such a scam, then there is legal recourse under the Information Technology Act, 2000.
Section 66-D of the Information Technology Act, 2000 provides for punishment for cheating by Personation by using a computer resource. This legal provision reads as under:
“Whoever, by means for any communication device or computer resource cheats by personating, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to One Lakh rupees.”
A victim can initiate legal action against such scammers. The first step would be filing a complaint with the Cyber Crime Cell to trace the offenders and thereafter a Complaint should be filed with the Adjudicating Officer under the Information Technology Act, in order to initiate legal proceedings against the offenders. In many cases the offenders are Indian citizens only, who pretend to be foreign nationals in the emails.
Always remember, that if something sounds too good to be true, then it probably is. Never volunteer your credit card details, net banking details, PAN card numbers or any other sensitive personal data to any unknown person in cyber space however, credible it may appear to be.
It is always better to be safe in cyber space. However, if you are a victim of such scams, you do have legal recourse to recover your money.

legal.pb@gmail.com

http://www.cyberjure.com

  – Advocate Puneet Bhasin, Cyber Lawyer (Cyberjure Legal Consulting)

3PHISHING12

Online banking revolutionized banking transactions, whereby money could be transferred at a single click. It has been a  time saver and has been an extremely convenient method to undertake commercial transactions. However, it has lead to a slew of litigation against banks. With online banking came phishing emails.

Phishing emails in these cases are those emails which purport to have been sent by the bank and have the look and feel of a legitimate email from a bank. They require the user to enter their username and password to reconfirm their accounts, invariably threatening that if such confirmation is not made immediately the account would be frozen. In many cases these emails are spoofed also whereby a third party sends an email using the email id of the bank, and this can be easily identified by reading the complete header of the email.

Many users panic on receiving such an email and immediately give out their personal sensitive data like banking passwords to third parties purporting to be representing the bank.  They realize that they have been duped only when money is drawn out by such third parties from their bank accounts.

There has been a slew of litigation against banks whereby, the victims of phishing scams file complaints against the banks under the Information Technology Act, 2000.  The grounds on which such complaints are filed is Section 43, Section 43A and Section 72 A pf the Information Technology Act.

Section 43 of the Information Technology Act deals with Unauthorised Access, and the Complainant in most cases alleges violation of Section 43 (a) which is accessing or securing access to a computer, computer system or computer network without permission of owner or person in charge. However, banks have a very strong legal defence to this because the unauthorised access is by a third party who sent the phishing email and not the bank. The banks on receipt of any information from a online banking services user that his account has been wrongfully debited, must ask him if he responded to any email asking for his password and must ask him to submit documentary proof of that email to the bank. If the user admits that he has replied to such phishing email, the bank must require him to submit a letter to the bank to that effect in order to enable the bank to freeze his account, whereby further unauthorised money transfer should not happen from his account.  The bank should intimate the user by an official letter to file a complaint with the cyber crime cell, and the bank should also file  an FIR against the beneficiary account holders in whose accounts the money has been unauthorisedly credited. This is important to prove the proactive efforts of the bank in a litigation by a victim against the bank under the Information Technology Act.

Section 72 A of the Information Technology Act reads as under:

Punishment for Disclosure of information in breach of lawful contract.- Save as otherwise provided in this Act or any other law for the time being in force, any person including an intermediary who, while providing services under the terms of lawful contract, has secured access to any material containing personal information about another person, with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in breach of a lawful contract, such material to any other person shall be punished with imprisonment for a term which may extend to three years, or with a fine which may extend to five lakh rupees, or with both.”

The main contention of the complainant would be that the bank has access to his password and misused it. However, as per RBI norms all banks have 128 bit encryption of passwords and the bank does not have any access to the same.

The Complainants in most cases attempt to bring the bank within the definition of an “Intermediary” under the Information Technology Act,; however, the exceptions to intermediary liability under Section 79 of the Information Technology Act, 2000, apply to a bank in this case because of the following reasons:

1. the function of the bank  is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored.

2. the bank does not-

(i) initiate the transmission,

(ii) select the receiver of the transmission, and

(iii) select or modify the information contained in the transmission
(c) the bank observes due diligence while discharging his duties under this Act and also observes such other guidelines as the Central Government may prescribe in this behalf.

The banks are required to maintain ISO 27001 standards because they handle confidential and sensitive personal data of users of their services.

In brief, the banks need to undertake the following steps in order to be able to succeed in any litigation against them:

1. They should provide a handbook to the online banking services users at the time they apply for such services. The handbook should mention directions for safe use of online banking and should also contain complete information about phishing emails and scams, including information on how users can protect themselves from such phishing attacks.

2. The Online Banking Services Application should have an Indemnity clause, whereby the user indemnifies the bank.

3. The Terms and Conditions of Online Banking should contain Indemnity clauses with respect to password of the user, online transactions and use of bank’s services.

4. There should be a security tips page which warns users of phishing emails each time they log in for online banking.

5. There should be cyber security and cyber law compliance panel. This panel should comprise of cyber security experts who should ensure that proper cyber security measures are always in place and the cyber lawyer in the panel should ensure that the online banking user agreement clauses  are up-to-date to restrict the bank’s liability in an environment where new cyber crimes get added each day.

6. The online user should be made to agree to indemnify the bank with respect to his usage of his password and online banking transactions with each log in.

7. There should be a well drafted Privacy Policy whereby the bank’s liability is reduced to a negligible level.

8. The cyber security and cyber law compliance panel should send emails on a routine basis to all users of online banking about the latest cyber crimes and safe guard measures. This helps show the banks active role in prevention of cyber crimes and shows the bank in positive light in cyber crime litigation against the bank.

9. The Online Banking Services Agreement should have a well drafted Alternative Dispute Resolution Clause. This clause is very important as it helps preserve the image and reputation of a bank, which can get damaged when the bank is accused in such matters involving litigation.

10. The bank should actively follow-up the case investigation after filing the FIR.

In the current scenario most cases where the victim in phishing scams files a complaint against the bank manages to succeed in getting compensated for his losses.

These are a few guidelines which can help a Bank succeed in litigation faced by them due to phishing scams.

 

legal.pb@gmail.com

http://www.cyberjure.com