Whose crime is it anyway?

Kripa Raman

IT was with great fanfare that the Mumbai police announced on June 14 the arrest of two men whom they said had hacked into their Web site. The men were presented and paraded like trophies before the press, their faces covered as is customary, with the police (headed by an officer as senior as the Joint Commissioner for Crime, Mumbai) and The Indus Entrepreneur (TiE, a body of persons connected with the IT industry) representatives giving an account of how the captives were traced.

Firstly, it was the excitement of having solved a cybercrime that the police claimed was the first of its kind in the country, which might have led to the hype and hooplah. Secondly, it was the police's own site that was tampered with. Although by their own admission, it was simply an information site and not a secured interactive site protected by firewalls, it clearly irked the police that the someone should hack their site and post obscenities on it. The local press had also been heckling them, saying that if the police could not protect their own Web site, then others could hope for nothing better.

The Mumbai police has a cyber crime cell which has been functional for over a year now. It has a handful of policemen who have been variously trained in technology, with The Indus Entrepreneurs assisting them.

The common matters the cell investigates pertain to harassment through e-mail, said officers in the crime cell. In most cases, the offender is someone known and a settlement is usually reached between the parties. Among the more unusual complaints is one from a prominent corporate which had approached the cell for investigating an anonymous e-mail doing the rounds in its offices. The cell is also said to be investigating a Web site put up by a politician from the Opposition party in Maharashtra. This Web site is said to list and to update the misdemeanours of the ruling party.

Officers at each major police station of the Mumbai police are supposed to be studying the IT Act, to be able to deal with complaints should they arise.

The arrested men in the police site hacking case -- one a drop-out computer engineering student and the other a cybercafe owner, parading under the names of Dr. Neukar and Libran, -- were booked under various sections of the Indian Penal Code pertaining to forgery and allied crimes. ``We consider computer content similar to a document,'' says the Deputy Commissioner of Police, Manoj Lohia, who is in charge of the Economic Offences wing of the Mumbai police under whom the cybercrime cell functions.

The two men were also booked under sections 65 (tampering with computer source documents) and 66 (hacking into computer systems to diminish their value or utility, among other things) of the IT Act 2000.

Some information technology observers feel the police have used too harsh a hand with two people who could be nothing more than pranksters. The two are still in police custody. Others have said the cyber cafe owner should not be held liable for what is done in his cafe.

In this case, technology experts helped police locate the computer address from where the hacking originated. After that, interrogation and search by police led to the hacker. They first arrested a cybercafe owner from where the hacker had uploaded his software. This led them to another cybercafe from where the hacking actually happened.

``We have not been too harsh,'' says DCP Lohia. ``Does one know one person was killed through cyberspace through manipulation of medical transcription? And this hacker we have caught is no prankster. He has several credit card details on him, as well as several computer discs and hard disks containing hacking software.''

As for the cybercafe owner who could be an innocent intermediate being held liable, Joint Commissioner Mohite holds it much like the case of a car owner being liable in an accident, whether he happened to be at the wheel or not. Some observers think this is unfair.

Vijay Mukhi of TiE feels the cyber cafe owner in this particular case is liable. ``It is known that this hacker first went to an iWay cafe, a chain of which is run by the Satyam group. Here he was refused permission to upload; that is, transfer software from his computer to the one in the cafe. So there are cafe owners who know what they are liable for.''

But cafe owners are hoping police will have the sensibility to draw the fine line. How can an owner ensure that no e-mail constituting harassment goes from his cafe? ``Can I stand over the shoulder of every customer and log his usage? Will that not constitute intrusion of privacy? Will I be arrested for that, then?'' asks a cyber cafe owner.

It upset them that the police should talk about the fact that the hacker sat at the cafe late into the night and that they might regulate cafe hours. ``Most people are doing very serious work or having clean fun at the computer. This has bad implications for us,'' said a cafe owner. ``This is like throwing out the baby with the bathwater.''

Apart from the rules that the cybercafes of users will have to naturally follow (for example, blackmail is blackmail whether verbal or through e-mail), as well as going by the provisions in the Act, special regulations may have to be made for cybercafes, say the police, who are also suggesting certain modifications in the IT Act.

``Otherwise, the IT Act, along with the other Acts we already have, are fairly sufficient to deal with most crimes,'' says DCP Lohia.

But it is the interpretation that people are watching out for. And also how the police will act in a case where they are not the aggrieved party.

The police complain that citizens are not ready to come up with complaints. ``And sometimes when we do receive a complaint, say of harassment through e-mail, it turns out that the aggressor is usually a known person. Then a settlement is arrived at between the parties themselves.''

The precedents and practice of the law will be set as cases come and go, say police. However, there are more complicated cases, as in those where the crime could have been committed outside of the country, which could be very difficult to solve.

According to the IT Act, unless at least one computer involved in the crime is located in India, it cannot be pursued.

The IT industry is only hoping the police will employ some sensitivity and judgement in dealing with cybercrime.

Please e-mail us at eworld@thehindu.co.in if you have queries on computer usage or if you find an interesting way of using the computer.