Types of Cyber Crimes

If cyberspace is a type of community, a giant neighbourhood made up of networked computer users around the world, then it seems natural that many elements of a traditional society can be found taking shape as bits and bytes. With electronic commerce we witness electronic merchants, plugged-in educators and doctors treating patients online. It should not come as a surprise that there are cyber criminals.

As an unregulated medley of corporations, individuals, governments and educational institutions that have agreed to use a standard set of communication protocols, the internet is wide open to exploitation. There are no ‘regulators’ and this lack of law enforcement leaves net users to regulate each other according to the reigning norms of the moment. Community standards in cyberspace are vastly different from the standards found at the corner of a main street. Cyberspace is a virtual tourist spot where faceless, nameless con artists can work the crowds. The critical issues now facing us can be divided into two broad categories:

- Denial of Service Attacks: The criminal’s goal is to cause damage to the system (hacking, cracking and sending malicious code viruses) or computer network.

- The computer is the target of attacks.

At this stage we need to point out that there is a great need for a very vigilant approach in the current phase. In a crisis situation very often guards are lowered and sometimes even routine checks are ignored. A very rigid attitude towards checks needs to be adopted and extra care needs to be taken to ensure that advantage is not taken of by certain rogue elements. Further, we must show that managements of financial institutions (FIS) are vigilant and that excesses of any sort are avoided. Board of Directors and more particularly the Independent Directors must closely watch these aspects and must show zero tolerance towards deviations. Board overview of risk management function is critical and crucial in the current situation. A criminal act takes place when a particular enactment lays down penalties and offences.

More than 50 per cent of 100 million computers are networked. One can imagine the magnitude of the challenge of preventing infiltration into computer systems and challenges to computer security and intellectual property.

Computer criminals comprise co-workers, insiders, disgruntled employees or even the lazy ones, competitors, crackers and hackers. Their attacks range from unauthorized access by employees to break-ins by intruders. Before proceeding further, it might be useful to give a brief note on ‘Computer speak’.

Term Definitions:

- Hackers: Use illegal methods of accessing a computer.

- Crackers: Programmes to extract information and benefit from it.

- Stealers: Beg, borrow or steal—passwords and other critical information.

Computer crimes take several forms including sabotage, revenge, vandalisms, theft, eavesdropping and ‘data diddling’, credit card frauds, counterfeiting, bank embezzlement and theft of secret documents. Introducing ‘worms’/viruses are other forms of computer crimes. The other serious possibilities are information attacks on military, central banks, electricity companies and softwares in use.

Why and how do they occur? The perceived anonymity and the huge financial gain could be the main reasons. Other reasons are as follows: l Research and development expenses, for a competitor who steals the information, would be nil and would allow the competitor to go ahead in technology.

- Network administrators’ laxity.

- Failure to monitor security programmes allows ‘hackers’ to access the networked system and crimes often go undetected.

- Disgruntled employees or those whose services are terminated could create a security breach.

- Social engineering is used to build a friendship with employees and gain access to information.

- Cryptographic keys can be figured out by timing the computers.

- Firewalls and system probing.

- ‘Cracker’ programme to identify passwords is used to try every word in the dictionary as a password.

- Network file used to share files between systems is exploited through well-known vulnerabilities.

- ‘Sniffing’ allows all traffic on a network to the sniffed to collect authorized password.

- Another method of virus infection is transmitted via word files. Word documents are embedded with viruses sent via email. There is no way to see that a document is infected until it is opened.

For the simplicity of analysis one could broadly group these points with reference to certain sections of the IT Act.

- Section 43 (a) lays down that a person who accesses or secures access to such computer system or network would be liable to pay damages by way of compensation not exceeding one crore of rupees to the person so affected.

- Section 43 (b) makes a person liable to pay damages for downloading copies or extract any data or information from such a computer. l Introduction or causing any computer contaminant or computer virus into any computer system or computer network would be liable for paying damages.

- Causing damage to a computer deliberately.

- Any person who does any or all of the following is liable to be charged for committing a crime:

- Assisting another person to gain unauthorized access.

- Damaging a computer system.

- Manipulating the data for financial benefit.

- Transferring service charges to an account of a person who has not availed the service.

The idea is not to present an exhaustive summary of the provisions of the Act, but to make readers aware of the crimes that can be perpetrated and the penalties that are levied for such criminal acts. A word of caution is absolutely necessary. The broad categories listed previously are further broken down and various details emerge. Inserting a CD or a floppy may not be a criminal activity, but browsing could certainly be one. There are a number of interpretations and elaborations not only of these sections, but also of similar sections in other countries like UK or USA.