Abuse of Cyberspace Law and Policy

Guiding questions What are the various kinds of abuse? What is the law with regard to this? What are the agencies to monitor such cyber crimes in India? What are the measures to improve law and policy on cyber crimes?

Introduction Various kinds of cyber crimes  Defamation, Identity theft, Impersonation, Hacking  Spoofing, Morphing  Web defacement, Virus/worm attacks, Bombing, Denial of Service  Online harassment or Cyber bullying  Cyber Stalking  Cyber pornography  Financial Crimes, frauds  Cyber terrorism

Risks faced by youngsters  Exposure to sites offering illegal information  Exposure to online fraudsters  Online harassment/cyber bullying  Cyber stalking  Exposure to online sexual predators--- soliciting/ porn viewing/porn production

Online harassment/cyber bullying Online harassment or Cyber bullying would mean an overt, intentional act of aggression towards another person online, or a willful and repeated harm inflicted through the use of computers, cell phones and other electronic devices. Online harassment may involve: (1) direct communication through internet chatting or text messaging that are abusive, threatening or obscene. (2) semi-public communication through posting harassing messages on lists. (3) public communication whereby web pages are created devoted to uploading abusive and defamatory material of the victim.

Cyber Stalking Defamation, Identity Theft, Impersonation Behavioral patterns: the stalker or predator follows the victim’s movements in cyberspace and continually engaging in mental assault by posting Defamatory/abusive messages on bulletin boards frequented by the victim, entering live chat rooms where the victim is present and sending abusive messages. Impersonation of the victim online – creating separate account and sending abusive s or fraudulent spam in the victim’s name Identity theft- unauthorised entry or damage to data or equipment--the password of the victim is hacked and entered into by the harasser and information is gathered for harassment. E.g. getting telephone number and calling victim– soliciting the victim for sexual purposes. Cyber stalking has been made a criminal offence in the US, UK and Australia.

Pornography Cyber pornography— the publishing of indecent photographs of women and children. Often real pictures of women are morphed and published in pornographic sites. 1 st cyber porn case in Kerala Bazee.com case Balaji case Online Child Pornography which consists of images and videos that depict minors in suggestive poses or explicit sex acts – minors may be real children or computer simulated images of children.  US police act as decoys for potential online sex offenders

Web defacement, virus/worm attacks, DoS attacks Website defacement is usually the substitution of the original home page of a website with another page (usually pornographic or defamatory in nature) by a hacker. Religious and government sites are regularly targeted by hackers in order to display political or religious beliefs. Disturbing images and offensive phrases might be displayed in the process, as well as a signature of sorts, to show who was responsible for the defacement. Computer viruses are small software programs that are designed to spread from one computer to another and to interfere with computer operation. A virus might corrupt or delete data on the victim’s computer, use the victim’s program to spread itself to other computers, or even erase everything on the victim’s hard disk. Worms, unlike viruses do not need the host to attach themselves to. They merely make functional copies of themselves and do this repeatedly till they eat up all the available space on a computer’s memory. bombing is a type of denial-of-service attack. A denial-of-service attack is one in which a flood of information requests is sent to a server, bringing the system to its knees and making the server difficult to access.

Cyber Terrorism Cyber terrorism is the premeditated use of disruptive activities, or the threat thereof, in cyber space, with the intention to further social, ideological, religious, political or similar objectives, or to intimidate any person in furtherance of such objectives.

Financial Crimes, Salami Attacks, frauds Financial crimes include cyber cheating, credit card frauds, money laundering, hacking into bank servers, accounting scams etc. Salami attacks are used for committing financial crimes. The key here is to make the alteration so insignificant that in a single case it would go completely unnoticed. frauds: Nigerian 419 frauds, lottery scam frauds, International Conference frauds

Problems affecting Young people Exposure to sites offering illegal information Exposure to online fraudsters Exposure to online sexual predators--- grooming &/or online porn production

Kerala Many reports of web defacement are being reported in the cyber cells Most cyber crimes affecting women being reported are regarding Orkut abuse- defamatory/pornographic material posted on web pages created spuriously in name of the woman Various instances of abuse of school girls being filmed on mobile camera have been reported Ministry of Women and Child Development:Study on Child Abuse:India % of boys in Kerala are being exposed to dirty pictures among the states of India, followed by boys in Goa (80.43%) Among children being photographed in the nude, children in the category of in Kerala reported the second highest of 51.61%, topped by Mizoram (57.14%) On a total, 48.95% of boys in Kerala face various forms of sexual abuse, in comparison with 40.25% of girls in Kerala. This dispels the popular myth that it is only girls who are vulnerable to sexual abuse.

ITAA 2008– Harassment/Bullying Sending offensive messages through a computer resource or communications device is made punishable (Section 66A) Identity theft-- fraudulent use of an electronic signature, password or unique identification feature of another person (Section 66C) cheating by personation (Section 66D)  Violation of all three offences carry a punishment of imprisonment for three years and up to Rs.1 lakh fine.

Section 66E--Violation of Body Privacy Violation of privacy -- whoever intentionally or knowingly captures, publishes or transmits the image of a private area of any person without his or her consent, under circumstances violating the privacy of that person (Section 66E) Punishment -- imprisonment which may extend to three years or with fine not exceeding two lakh rupees, or both

Section 67, 67A of ITAA 2008 Obscene v. Sexually Explicit Section 67 of the ITA publishing or transmitting of obscene material  imprisonment up to 5 years and fine up to Rs.1 lakh, Under ITA 2000, Section 67 offence is cognizable and non-bailable Section 67 of the ITAA 2008—  punishment --imprisonment reduced up to 3 years and fine up to Rs. 5 lakh, Under ITAA 2008, Section 67 offence is non-cognizable and bailable Section 67A, ITAA publishing of material containing sexually explicit act or conduct  imprisonment upto 5 years and fine up to Rs. 10 lakh Under ITAA 2008, Section 67A offence is cognizable and non-bailable

Depicting Children in ‘sexually explicit act’, ‘obscene’, ‘indecent’ manner etc & ‘Abuse of child’ Section 67B--publishing or transmitting of material depicting children in sexually explicit act; collecting, downloading, exchanging, distributing material in electronic form depicting children in obscene, indecent or sexually explicit manner, inducing children to online sexual relationship, facilitating abusing children online, recording in electronic form own abuse or others’ abuse etc. in electronic form. Punishment  1 st conviction– 5 years+ Rs. 10 lakh fine 2 nd conviction- 7 years +Rs.10 lakh fine This Section covers --  using children for child pornography  Perpetrator of abuse may be adult or child  predating on children for online grooming, both by adult and child offenders  Does not define the term – ‘abusing children online’, ‘obscene’, ‘indecent’, ‘sexually explicit act’– what would constitute such ‘abuse’ ?

Cyber Terrorism– Section 66F (1) Whoever,- (A) with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people or any section of the people by – (i) denying or cause the denial of access to any person authorized to access computer resource; or (ii) attempting to penetrate or access a computer resource without authorisation or exceeding authorized access; or (iii) introducing or causing to introduce any Computer Contaminant. and by means of such conduct causes or is likely to cause death or injuries to persons or damage to or destruction of property or disrupts or knowing that it is likely to cause damage or disruption of supplies or services essential to the life of the community or adversely affect the critical information infrastructure specified under section 70, or (B) knowingly or intentionally penetrates or accesses a computer resource without authorisation or exceeding authorized access, and by means of such conduct obtains access to information, data or computer database that is restricted for reasons of the security of the State or foreign relations; or any restricted information, data or computer database, with reasons to believe that such information, data or computer database so obtained may be used to cause or likely to cause injury to the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence, or to the advantage of any foreign nation, group of individuals or otherwise, commits the offence of cyber terrorism. (2) Whoever commits or conspires to commit cyber terrorism shall be punishable with imprisonment which may extend to imprisonment for life’.

Censorship --Intermediary liability under ITAA 2008 Who is an intermediary?– a conduit for transmission of data. When illegal information is transmitted, the intermediary acts as a transmitter and becomes liable for the offence too. No liability for any third party information, data, or communication link hosted by him. Liable if the intermediary has aided in the commission of the unlawful act or, upon receiving actual knowledge, it fails to expeditiously remove or disable access to that material on that resource without vitiating the evidence in any manner (Section 79) intermediary’ includes telecom service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes (Section 2(w) ITAA 2008) Intermediaries shall have to retain information for a specified period of time, or else face imprisonment up to 3 years and fine (Section 67C ITAA 2008)

Agencies for Monitoring, Blocking, Maintaining Cyber Security Only DySp can investigate under ITA 2000– under ITAA 2008, even ‘inspector’ can investigate cyber crimes Cyber police stations– interstate, international jurisdictional blocks interception or monitoring or decryption, blocking from public access. in the interest of public order, sovereignty and integrity of India, defense of India, security of the State, Investigation of any offence.  Compliance failure by Intermediary– imprisonment for seven years and also be liable to fine (Section 69A) Monitoring and collecting traffic data for Cyber Security (Section 69B)  The Intermediary shall provide technical assistance and extend all facilities to such agency to enable online access  Intentionally or knowing failure by Intermediary to provide such assistance -- imprisonment for a term which may extend to three years and fine. The Computer Emergency Response Team of India (CERT-In)-- national nodal agency for maintaining cyber security in India. (Section 70A) Punishment for breach-- Imprisonment up to one year or with fine up to one lakh rupees or both (Section 70B(7))

Improvements in Law & Policy– A Grassroots -level Internet Safety Policy Parental control through filter technology and spy ware Awareness programmes targeting teachers, parents and other caregivers, as well as local self governmental bodies, camps for children Promotion and monitoring of online safety on the curriculum in schools US example--Protecting Children in the 21st Century Act 2008 was passed, requiring schools and libraries that receive governmental funding to have an Internet Safety Policy which must include “educating minors about appropriate online behaviour, including interacting with other individuals on social networking websites and in chat rooms and cyber bullying awareness and response”.

Hotline for Mandatory Reporting of Crimes against Women & Children National hotline for reporting cyber crimes against women and children and linking with international agencies like VGT and EU pan alert platform. Sensitization of IT professionals, ISPs, social service workers, doctors, health personnel, credit card companies and banks, telecom service providers, web- hosting service providers, search engines, online payment sites, online-auction sites, online-market places, and cyber cafes of cyber crimes against children Making Mandatory Reporting a legal obligation USA-- Cyber Tip Line for ISPs mandatory reporting of child pornography material  U.K. -- a non-statutory body called the Internet Watch Foundation (IWF) reports undesirable content to British ISPs and requests them to remove such content. If they do not comply, it is reported to the British police, who deal with the offending ISP.

Civil Preventative Order by Court Civil preventive orders issued by the Courts for restraining cyber criminals who are proven to target vulnerable groups like women and children U.K.-- ‘Risk of Sexual Harm Order' (RSHO) may be imposed which will prohibit adults from  engaging in sexual activity involving or in the presence of a child;  causing a child to watch a person engaging in sexual activity - including still or moving images;  giving a child anything that relates to sexual activity; and communicating with a child where any part of the communication is sexual Any knowledge of such activity must be reported to the police right away. U.K.-- The Sexual Offences Prevention Order (SOPO) is another preventive order placed on a person who has been convicted of crimes with a sexual/violent element.

Agreements with telecom providers  Sri Lankan example National Child Protection Authority of Sri Lanka and Dialog GSM announced in October 2008 the signing of an MoU to restrict access to websites which carry child sexual abuse content through mobile phones.

Protection of Personal Data US– Child Online Privacy Protection Act 1998– protects children under the age of 13 and requires that all commercial operators obtain verifiable parental consent before collecting, disclosing or using personal identifiable information obtained from children Sec. 43-A of ITAA 2008 protects ‘sensitive personal data or information’– inadequate the Personal Data Protection Bill, 2006 lapsed It should be made illegal to divulge information regarding personal details without consent and restrictions should be placed on divulging information regarding minors

Conclusion A Grassroots -level Internet Safety Policy  Promotion of Filter ware and Spy ware technologies  Internet safety policy on school curriculum Hotline for Mandatory Reporting of Crimes against Women & Children Civil Preventative Order by Court Agreements with telecom providers Protection of Personal Data