Securing India’s Cyberspace: A Legal and Policy Perspective
Ashish Kumawat, Former Security Professional with Reliance Group Support Services; PhD in Public Policy and Law from Central University of Rajasthan In any nation, laws and public policies are the torchlights for development within any domain. It sets forth the path to be followed, the existence of a liberal/ restrictive space within which the innovations can flourish or be curtailed. However, the main problem pertains to the long gestation period in the visibility of the outcomes, which may restrict the promptness of the governments to amend the policy or to resort to Parliament to amend the laws. The same may also hold for cyber-space in India. As per the Data Security Council of India (DSCI), India remains the second most cyber-attack-affected country globally. Dr U.K. Vairagade, associate professor, Dr. (Sow.) IBP Women’s College (Aurangabad) says that the modern thief can still do more with a computer than with a gun. Dr Vairagade argues that today’s terrorists can do much more harm with a keyboard than with a bomb. In this age of artificial intelligence, internet of things and cloud computing, do people like Osama still need to hijack a narrow plane? The obvious answer, as we all may agree, is that today, a simple attack on critical infrastructure can be more devastating than any other attack. One of the best and most recent examples of this case is Russia’s cyber-attacks on Ukraine. Therefore, the importance of cyber-security cannot be underestimated. Anju A. Singh, assistant professor, V.N. Patil Law College (Aurangabad), states that we cannot ignore cyber-security in India as it has become an indispensable asset to protect businesses, governments, institutions, and individuals. Legal and policy strategies adopted in India Given the importance of cyber-security and its potential to disrupt the political as well as socio-economic fabric of the nation, India did not remain aloof in the challenges brought about by growing cyberspace. It promptly adopted the following strategies. Legislative strategies A. The Information Technology Act, 2000 (IT Act, 2000) and its Amendment in 2008 (IT Act, 2008): It envisages a coalition of actors where responsibilities are fixed among various stakeholders. The important sections in these Acts are: Section 43: It makes hacking anyone’s computer or network a punishable offence. It includes manipulation of storage, the introduction of contaminants or computer viruses, denial of access, damage to any associated component of computer vision network data etc.; Section 43A: This section was introduced via amendment in 2008 to the original act. It makes a body corporate responsible for protecting the ‘sensitive personal data’ of its stakeholders. Here central government holds the right to prescribe what ‘sensitive personal data’ means. Section 66F: The act of cyber terrorism shall be punishable with imprisonment which can be extended to life imprisonment. Section 72A: This section makes it a criminal offence to disclose personal data without the data subjects’ consent or in any breach of a lawful contract. Here the person performing the contract is aware that their action can likely cause wrongful loss or gain. One of the critical institutional mechanisms that arose from the IT Act of 2008 was the establishment of the Computer Emergency Response Team – India (CERT-IN), which was responsible for scanning internet traffic. B. Draft Digital Personal Data Protection Bill 2022: An upgrade over the withdrawn Draft Data Protection Bill, 2019, it fixes liabilities on data fiduciaries (an institution which keeps the data of users/ citizens). It also gives necessary rights to citizens, like obtaining information and seeking necessary corrections. One crucial aspect is the right to seek the erasure of data once the data’s purpose has been met. However, there is an element of differentiality in this clause’s applicability to private and specific public organisations. C. Indian penal code (IPC): Section 500 (defamatory emails): it attracts imprisonment up to 2 years or a fine or both. IPC under sections 463 and 383 makes email spoofing and web jacking punishable crimes, respectively. Further, sections 201, 292, 294, 409,448 and 509 can be used to govern cyber-crimes. Also, the Supreme Court’s original jurisdiction under Article 21 of the Constitution can be invoked in cyber-crimes affecting privacy. Policy and associated strategies: A. National Cyber Security Policy 2013: One of the most promising aspects of this policy was the set up of the National Critical Information Infrastructure Protection Centre (NCIIPC) under the National Technical Research Organisation (NTRO). India has successfully started leveraging this institution. For example, it’s a successful warning against the Shadow Pad attack. Another key feature of this policy was creating a talent pool of five lakh cybersecurity professionals by 2018. Further, it envisages the concept of shared responsibility for tackling social and economic issues in the form of emphasis on public-private partnerships. One of the successful initiatives has been Cyber Surakshit Bharat Initiative. B. Cyber security and R&D: there have been significant developments in the field of R&D, like the creation of the techno-legal National Cyber Security Database of India. Also, a Cyber Security Software Repository has been created. Further, many initiatives have been taken to advance cyber security at the individual, organisational level. cases: There have been certain landmark Indian cases related to the prevention of cybercrime and various interpretations related to the IT Act of 2000 and 2008, IPC. These also have implications for the evolution of the policies. These are: Suhas Katti case: It is related to posting derogatory messages about a divorced woman. The accused was punished under section 67 of the IT Act, 2000 and section 469, 509 of IPC. Pune City Bank case: Few Citibank employees won customers’ trust, got the pin numbers from them and transferred USD 3,50,000 to bogus accounts. Later, the accounts where the money was transferred had to be frozen. Jogesh Kwatra case: Jogesh Kwatra, an employee of the plaintiff company, started sending defamatory, vulgar emails to his subordinates and customers worldwide. The aim was apparent- to defame the company. Finally, Delhi High Court assumed the jurisdiction in this case. Bank NSP case: This case pertained to deception using…