Cyber crime

In short

Cyber crime is any criminal act in which a computer, mobile device, network or data is the target, the tool or the storehouse of evidence. For a forensic science student it is the "offence side" of the digital world: it defines what has to be proved in court, which statute applies, and what the investigator must therefore collect. India governs it mainly through the Information Technology Act, 2000 (as amended in 2008), the Bharatiya Nyaya Sanhita, 2023 together with the Bharatiya Nagarik Suraksha Sanhita, 2023 and the Bharatiya Sakshya Adhiniyam, 2023 (in force from 1 July 2024), and the Digital Personal Data Protection Act, 2023. It is examined in B.Sc Forensic Science papers on cyber law and cyber crime, and tested in interviews for police cyber cells, CERT-In empanelled firms, bank fraud-risk teams, Big Four forensic practices and Cyber Crime Investigation Cell roles.

Explained

Definitions, nature and classification

• Cyber crime: no single statutory definition in Indian law; understood as an unlawful act where a computer or computer network is the subject, object or instrument of the crime. The IT Act, 2000 lists specific "offences" (Chapter XI) and "contraventions" (Chapter IX).
• Computer, computer system, computer network, computer resource, data, information, electronic record are all defined in Section 2(1) of the IT Act - quoting them correctly earns marks, because every charge turns on the definition.
• Cyber crime vs conventional crime: no physical presence, no geographical boundary, evidence is volatile and easily altered, the offender may be anonymous, and a single act can victimise lakhs of people simultaneously. The *locus delicti* (place of offence) is often unclear.
• By target: (a) against individuals - cyber stalking, defamation, identity theft, sextortion, morphing; (b) against property - hacking, data theft, intellectual property theft, online financial fraud; (c) against organisations - ransomware, denial of service, insider data theft, website defacement; (d) against the State/society - cyber terrorism, espionage, circulation of obscene or child sexual abuse material, misinformation.
• By role of the computer: computer as target (hacking, DoS, ransomware), computer as tool (phishing, online fraud, trafficking), computer as incidental/container (drug-trafficking records on a laptop).
• Cyber crime vs cyber-enabled crime: "pure" cyber crime cannot exist without computers (ransomware); cyber-enabled crime is an old crime committed at new scale (cheating, extortion, forgery).
• Other terms: white-collar character (non-violent, economic), transnational character (mutual legal assistance treaties and Letters Rogatory are needed), and low conviction rate because of poor evidence handling.

Major types and how they work

• Hacking / unauthorised access: gaining entry without the owner's permission, by stolen credentials, unpatched vulnerabilities, SQL injection or misconfigured cloud buckets. Punished under Section 66 IT Act read with Section 43.
• Malware: virus (attaches to a host file), worm (self-replicating over networks), trojan (disguised as useful software), spyware/keylogger, rootkit (hides itself in the OS), ransomware (encrypts data and demands cryptocurrency), botnet (network of compromised "zombie" machines used for DDoS or spam).
• Phishing and its variants: mass email/SMS phishing, spear phishing (targeted), vishing (voice calls, typically the fake bank/KYC call), smishing (SMS with a malicious link), pharming (DNS poisoning to redirect a correct URL to a fake site), whaling (targeting senior executives, overlapping with business email compromise).
• Social engineering: manipulating a human rather than a machine - pretexting, baiting, tailgating, quid pro quo, shoulder surfing, dumpster diving. The commonest Indian pattern is the OTP/UPI-collect-request fraud and the fake "army officer" or "customer-care number" fraud.
• Identity theft and impersonation: stealing Aadhaar, PAN, card details or electronic signatures to open accounts or obtain credit; Sections 66C (identity theft, misuse of electronic signature or unique identification feature) and 66D (cheating by personation using a computer resource).
• Financial cyber crimes: card skimming, cloning, ATM jackpotting, SIM swap, man-in-the-middle, business email compromise (fraudulent change of supplier bank details), fake investment and loan apps, Ponzi and crypto frauds, job and matrimonial frauds, digital-arrest scams.
• Data breach and data theft: exfiltration by outsiders or insiders; Section 43 (compensation), Section 72A (disclosure of information in breach of a lawful contract) and, from 13 May 2027, the DPDP Act, 2023 penalties on the data fiduciary.
• Denial of service and DDoS: flooding a server (SYN flood, UDP amplification, HTTP flood) so that legitimate users are denied access - covered by Section 43(f)/66 and, if it targets critical infrastructure, Section 66F.
• Cyber stalking, bullying, trolling, revenge porn: repeated unwanted contact, threats, publishing intimate images. Prosecuted under BNS stalking and criminal-intimidation provisions together with Sections 66E (violation of privacy by capturing or transmitting images of a private area) and 67/67A IT Act.
• Obscenity and child sexual abuse material (CSAM): Section 67 (obscene material), 67A (sexually explicit act), 67B (child, i.e. below 18 - creating, browsing, collecting, facilitating), read with the POCSO Act, 2012.
• Cyber terrorism: Section 66F - acts threatening the unity, integrity, security or sovereignty of India, or unauthorised access to restricted data, punishable with imprisonment up to life.
• Intellectual property offences: software piracy, source-code theft (Section 65 - tampering with computer source documents), cybersquatting and typosquatting (dealt with under trademark law and the .IN Domain Name Dispute Resolution Policy, not the IT Act), deep linking and framing.
• Dark web and anonymity tools: Tor onion routing, VPN chaining, cryptocurrency mixers/tumblers, privacy coins; used for drug markets, arms, stolen data and CSAM. Investigators rely on blockchain analytics and operator errors rather than breaking the encryption.

The Indian legal framework

• Information Technology Act, 2000, amended by the IT (Amendment) Act, 2008 - the primary statute. Key offences:
  • Section 43 - civil contravention: damaging, deleting, denying access, introducing a virus; liability to pay compensation (no monetary ceiling after 2008; claims up to ₹5 crore are decided by the Adjudicating Officer and above that by a civil court).
  • Section 65 - tampering with computer source documents: up to 3 years and/or ₹2 lakh.
  • Section 66 - computer-related offences (a dishonest or fraudulent act under Section 43): up to 3 years and/or ₹5 lakh.
  • 66B receiving a stolen computer resource - 3 years/₹1 lakh; 66C identity theft - 3 years and ₹1 lakh; 66D cheating by personation - 3 years and ₹1 lakh; 66E privacy violation - 3 years and/or ₹2 lakh; 66F cyber terrorism - up to life.
  • Section 67 - 3 years and ₹5 lakh (5 years and ₹10 lakh on repeat); 67A - 5 years and ₹10 lakh; 67B - 5 years and ₹10 lakh (7 years on repeat); 67C - failure of an intermediary to preserve and retain records.
  • Section 69 - interception, monitoring and decryption on a government direction; 69A blocking of public access to content; 69B collection of traffic data. Non-compliance attracts up to 7 years (69 and 69A) or 3 years (69B).
  • Section 70 - protected systems; 70B - CERT-In as the national nodal agency for incident response.
  • Sections 71-74 - misrepresentation, breach of confidentiality, 72A disclosure in breach of contract, publishing false electronic signature certificates, fraudulent use of a certificate.
  • Sections 77/77A/77B - penalties are in addition to other laws; offences punishable with up to 3 years are compoundable and bailable; offences with 3 years or more are cognizable.
  • Section 75 - extra-territorial application if the computer resource is located in India; Section 79 - safe-harbour exemption for intermediaries subject to due diligence; Section 80 - power of a police officer not below Inspector to enter and search a public place; Section 78 - investigation by an officer not below the rank of Inspector.
  • Chapters II-VII deal with electronic and digital signatures, electronic governance, attribution and dispatch of records, secure electronic records, the Controller of Certifying Authorities and electronic signature certificates; the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) now hears appeals from Adjudicating Officers after the Cyber Appellate Tribunal was merged into it.
• Bharatiya Nyaya Sanhita, 2023 (BNS) replaced the IPC from 1 July 2024. Cyber-relevant provisions include cheating and cheating by personation, extortion, criminal breach of trust, forgery and falsification of records, defamation, stalking, criminal intimidation, and organised crime (which expressly includes cyber-crime having severe consequences). Section numbers were renumbered wholesale - name the offence unless you are certain of the new number.
• Bharatiya Sakshya Adhiniyam, 2023 (BSA) replaced the Indian Evidence Act, 1872: electronic records are documents, and a certificate (the successor of the old Section 65B certificate, in the BSA's Schedule) must accompany electronic evidence. BNSS, 2023 mandates audio-video recording of search and seizure and allows electronic service and trial.
• Digital Personal Data Protection Act, 2023 - consent, purpose limitation, obligations of the data fiduciary, breach notification to the Data Protection Board, penalties up to ₹250 crore for failure to take reasonable security safeguards. The rules were notified in 2025 with phased implementation; check the current commencement status before quoting dates.
• Other laws: IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 (grievance officer, 36-hour takedown, traceability for significant social media intermediaries); IT (Reasonable Security Practices) Rules, 2011 (sensitive personal data, ISO/IEC 27001 as a recognised standard); CERT-In Directions of 28 April 2022 (report specified incidents within 6 hours, maintain logs in India for 180 days, synchronise clocks to NPL/NIC NTP); Copyright Act, 1957; Companies Act, 2013 (audit trail); RBI directions on digital payment security and limited customer liability in unauthorised electronic transactions; POCSO Act, 2012; UAPA for terror financing; PMLA, 2002 for laundering proceeds; Telecommunications Act, 2023.
• Agencies: CERT-In, Indian Cyber Crime Coordination Centre (I4C) under MHA with the National Cyber Crime Reporting Portal cybercrime.gov.in and helpline 1930, the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS), NCIIPC for critical information infrastructure, NCRB (publishes cyber crime statistics in *Crime in India*), state Cyber Crime Investigation Cells and Cyber Police Stations, CBI Cyber Crime Cell, and the National Forensic Sciences University and CFSLs for examination.

Investigation and evidentiary chain (offence-side view)

1. Complaint/FIR: zero-FIR permitted; financial frauds should be reported on cybercrime.gov.in or 1930 immediately so that the bank-wise ledger freeze can be attempted.
2. Identify the offence and the section: the charge decides the powers - cognizable or not, bailable or not, who may investigate (Inspector and above under Section 78 IT Act).
3. Preserve: issue preservation notices to intermediaries, banks and telcos; Section 94 BNSS (earlier Section 91 CrPC) notices for logs, KYC, CDR, IPDR and subscriber details; Section 69 orders for interception where lawful.
4. Seize: hash the media, take a write-blocked image, document with audio-video recording as BNSS requires, keep a chain-of-custody form (Form A/B of the CFSL protocol in many states).
5. Trace: IP address → ISP (with correct timestamp and time zone) → subscriber; money trail → beneficiary account → mule network; device → IMEI/IMSI; crypto → wallet clustering.
6. Prove: produce the electronic record with the BSA certificate from the person in charge of the device, plus the examiner's report under the Examiner of Electronic Evidence provision (Section 79A IT Act notification).
7. Limitations: jurisdiction and MLAT delays, end-to-end encryption, VPN and burner SIMs, mule accounts, under-reporting, and the volatility of RAM and cloud data.

Prevention, controls and ethics

• Technical: patching, multi-factor authentication, least privilege, network segmentation, firewalls and IDS/IPS, endpoint detection, full-disk encryption, immutable offline backups (the only real answer to ransomware), DMARC/SPF/DKIM against spoofing, secure coding against the OWASP Top 10.
• Managerial: ISO/IEC 27001:2022 information security management, ISO/IEC 27037 for identification, collection and preservation of digital evidence, ISO/IEC 27035 incident management, PCI DSS for card data, and a documented incident response plan tested by tabletop exercises.
• Human: awareness training, phishing simulations, clear "no bank asks for OTP" messaging, grievance redressal, and the RBI rule that a customer who reports an unauthorised electronic transaction promptly bears limited or zero liability.
• Ethics and legality of testing: penetration testing and vulnerability research are lawful only with written authorisation and defined scope; without it, the same act is an offence under Sections 43/66. Responsible disclosure, bug-bounty terms and non-disclosure obligations matter as much as technical skill.

Key points

• Cyber crime - an offence where a computer or network is the target, the tool or the container of evidence; not separately defined in Indian law.
• IT Act, 2000 - the primary Indian statute; Chapter IX contraventions (civil) and Chapter XI offences (criminal); amended substantially in 2008.
• Section 43 - civil liability to pay compensation for unauthorised access, damage or virus introduction; Adjudicating Officer up to ₹5 crore.
• Section 66 - any Section 43 act done dishonestly or fraudulently: 3 years and/or ₹5 lakh.
• Sections 66C and 66D - identity theft and cheating by personation; the sections behind most OTP and fake-KYC frauds, usually charged with BNS cheating.
• Section 66E - capturing or publishing images of a private area without consent; 66F - cyber terrorism, up to life imprisonment.
• Section 67 series - obscene material (67), sexually explicit act (67A), child sexual abuse material (67B, read with POCSO).
• Sections 69, 69A, 69B - lawful interception/decryption, blocking of content, and monitoring of traffic data.
• Section 79 - intermediary safe harbour, conditional on the due diligence required by the Intermediary Guidelines Rules, 2021.
• Section 75 - extra-territorial reach when the computer resource involved is in India.
• BNS 2023, BNSS 2023 and BSA 2023 - replaced the IPC, CrPC and Evidence Act from 1 July 2024; electronic records are documents and need the statutory certificate.
• CERT-In 2022 Directions - report specified incidents within 6 hours, retain logs in India for 180 days, KYC retention for 5 years by VPN/cloud/VPS providers.
• DPDP Act, 2023 - data fiduciary duties and penalties up to ₹250 crore for inadequate security safeguards; implementation phased via the 2025 Rules.
• I4C, cybercrime.gov.in and 1930 - the national reporting route; speed of reporting decides whether the money can be frozen.
• Phishing vs pharming - phishing lures the user to a fake site, pharming redirects a correct address by poisoning DNS or the hosts file.
• Virus vs worm vs trojan - needs a host, self-replicates over a network, or disguises itself as legitimate software.
• Mens rea matters - "dishonestly or fraudulently" converts a Section 43 contravention into a Section 66 offence; authorisation is the line between a pentester and a hacker.
• Compoundability - IT Act offences punishable up to 3 years are bailable and compoundable; 3 years and above are cognizable.

Formulas and examples

Example 1 - identifying sections in an OTP fraud. A caller posing as a bank official obtains Mrs Rao's card number and OTP and transfers ₹1,80,000.

• The caller pretended to be someone else using a computer resource → Section 66D (3 years and ₹1 lakh).
• He misused her unique identification/credential → Section 66C (3 years and ₹1 lakh).
• Dishonest access to her account data → Section 66 read with Section 43 (3 years and/or ₹5 lakh).
• Deception causing delivery of property → cheating under the BNS, 2023.
• Maximum fine exposure from the three IT Act sections alone = 1,00,000 + 1,00,000 + 5,00,000 = ₹7,00,000; the sentences may run concurrently but the fines are cumulative.
• Civil remedy: she may claim ₹1,80,000 compensation under Section 43 before the Adjudicating Officer (within the ₹5 crore limit), and under RBI's limited-liability rules her liability may be nil if she reported within the prescribed window.

Example 2 - CERT-In reporting window. A hospital notices a ransomware infection at 22:40 IST on 3 November.

• Deadline = 22:40 + 6 h = 04:40 IST on 4 November for reporting to CERT-In.
• Logs must be retained in India for 180 days; if the attack is dated 3 November 2026, logs from on or after 7 May 2026 must still exist (180 days before 3 November 2026).
• Also applicable: Section 70B IT Act (CERT-In directions), Section 66 (dishonest damage), and, from 13 May 2027, DPDP Act breach intimation to the Data Protection Board if personal data is affected.

Example 3 - data-theft loss computation. An employee copies a client database before resigning; the firm proves ₹12,00,000 lost business, ₹3,50,000 forensic investigation cost and ₹1,20,000 of re-engineering.

• Claim under Section 43 = 12,00,000 + 3,50,000 + 1,20,000 = ₹16,70,000, within the Adjudicating Officer's ₹5 crore jurisdiction.
• Criminal side: Section 66 (dishonest extraction of data), Section 72A if disclosure breached a lawful contract, Section 65 if source code was altered, plus criminal breach of trust under the BNS.

Example 4 - case growth and reporting speed. A state cyber cell logs 2,400 cases in 2024 and 3,120 in 2025; of ₹48 crore defrauded in 2025, ₹7.2 crore was put on hold.

• Growth = (3,120 − 2,400)/2,400 × 100 = 30%.
• Recovery (hold) ratio = 7.2/48 × 100 = 15%.
• Cases per working day (260 days) = 3,120/260 = 12 per day. (Figures illustrative; NCRB publishes the authoritative annual numbers.)

Where it is used

• Police and State cyber cells: Cyber Crime Investigation Cells, Cyber Police Stations and I4C-supported units classify complaints from cybercrime.gov.in, trace money trails and draft charge sheets under the IT Act and BNS.
• Banking, NBFC and fintech fraud-risk teams: HDFC, ICICI, SBI, Paytm, PhonePe and Razorpay run fraud-monitoring, chargeback, mule-account detection and RBI-mandated customer-liability investigations.
• Forensic and consulting practices: Deloitte, EY, KPMG, PwC and Grant Thornton forensic technology teams handle data-breach response, employee fraud and IP-theft investigations for Indian corporates.
• IT and security operations: SOC analyst, incident responder, VAPT and red-team roles in TCS, Infosys, Wipro, HCLTech, Cognizant, Quick Heal and CERT-In empanelled auditors - with threat intelligence on Indian phishing kits and loan apps.
• Public institutions and academia: NFSU, CFSLs and state FSLs examine seized devices; NCIIPC protects power, banking, telecom and transport infrastructure; NCRB compiles national cyber crime statistics.
• Compliance and legal: DPDP Act readiness, intermediary grievance officer roles, ISO/IEC 27001 implementation, and cyber-insurance underwriting and claims assessment.

Interview questions

• Q: What is the difference between Section 43 and Section 66 of the IT Act? A: Section 43 is a civil contravention giving rise to compensation; the same act done dishonestly or fraudulently becomes a criminal offence under Section 66, punishable with up to 3 years and/or ₹5 lakh.
• Q: Which section covers cyber terrorism and what is the punishment? A: Section 66F, covering acts threatening India's unity, integrity, security or sovereignty, or unauthorised access to restricted data; punishable with imprisonment up to life.
• Q: How does the law treat an ethical hacker who finds a vulnerability without permission? A: Lack of authorisation makes it unauthorised access under Sections 43/66 regardless of good intent; only written scope and consent, or a bug-bounty programme's terms, make it lawful.
• Q: What replaced the IPC, CrPC and the Indian Evidence Act for cyber cases? A: The Bharatiya Nyaya Sanhita, 2023, Bharatiya Nagarik Suraksha Sanhita, 2023 and Bharatiya Sakshya Adhiniyam, 2023, all in force from 1 July 2024; the BSA treats electronic records as documents and requires the prescribed certificate.
• Q: Within what time must a cyber incident be reported to CERT-In? A: Within 6 hours of noticing it, for the categories listed in CERT-In's directions of 28 April 2022, along with log retention in India for 180 days.
• Q: Difference between phishing, vishing and pharming? A: Phishing uses a deceptive email or message, vishing uses a voice call, and pharming silently redirects a correct web address to a fake server by poisoning DNS or the hosts file.
• Q: What is a mule account and why does it matter? A: An account - often of an unsuspecting or paid individual - used to receive and layer fraud proceeds; it breaks the money trail and is why 1930 reporting speed decides recoverability.
• Q: Does the IT Act apply to an offence committed from outside India? A: Yes - Section 75 gives extra-territorial application if the offence involves a computer, computer system or network located in India.
• Q: What is intermediary safe harbour and when is it lost? A: Section 79 exempts an intermediary from liability for third-party content, provided it is only a conduit and observes the due diligence in the Intermediary Guidelines Rules, 2021; failure to act on actual knowledge or a court/government order removes the exemption.
• Q: Which section applies to a morphed obscene image of a minor shared on social media? A: Section 67B IT Act for child sexual abuse material, read with the POCSO Act, 2012 and the relevant BNS provisions; Section 66E may apply if a private area was captured.
• Q: What penalty can a company face for a data breach caused by weak security? A: Under the DPDP Act, 2023, up to ₹250 crore for failing to take reasonable security safeguards (enforceable from 13 May 2027; until then compensation under IT Act s.43A), besides compensation claims under Section 43 and liability under Section 72A for contractual breaches of confidentiality.
• Q: Why is the conviction rate in cyber crime low in India? A: Delayed reporting, anonymisation through VPNs and mule accounts, cross-border evidence requests through MLATs, and above all defective seizure, hashing and certification of electronic evidence.

Common mistakes

• Quoting old IPC/CrPC/Evidence Act sections (379, 420, 65B) instead of the BNS, BNSS and BSA, 2023 provisions now in force.
• Mixing up Section 66C (identity theft) with 66D (cheating by personation), or treating Section 43 as a criminal provision.
• Writing "Section 66A" as live law - it was struck down as unconstitutional in *Shreya Singhal v. Union of India* (2015).
• Claiming the IT Act punishes cybersquatting - it does not; that is handled under trademark law and the INDRP.
• Calling every malware a "virus", or saying ransomware is defeated by antivirus alone rather than by offline immutable backups.
• Forgetting the time zone when converting server log timestamps (usually UTC) to IST while fixing the time of the offence - an error that destroys the IP-to-subscriber match.
• Reporting a fine or jurisdiction figure from memory without noting that limits, rules and DPDP commencement dates have changed and should be verified against the current text.

Related topics

Digital forensics · Forensic psychology · Cyber law and the IT Act, 2000 · Network security and cryptography · Questioned documents and forgery · Financial fraud investigation