Social Media Use for Abuse…root cause is Privacy and Anonymity..Solution is on hands..if we care..

Eminent lawyers of the country seem to have taken up a fight against Social Media for enabling “abusive content”.

According to the news reports, they are demanding that Supreme Court should consider “Regulation of Social Media”.

However, we need to point out that Supreme Court should not be diverted from the core issue into getting into regulating social media though this would make a good media copy.

Some time back when Supreme Court scrapped Section 66A of ITA 2000, Naavi.org was a lone dissenting voice stating in no unclear terms that Supreme Court was wrong.The advocates who are now crying hoarse against Social Media had words of great praise for scrapping of Section 66A. (Refer articles here).

Our opposition to Section 66A scrapping was that it was a wrong medicine for the problem which was the wrongful arrest of citizens for innocuous social media activities. The decision was faulty since Section 66A was not meant for addressing abusive posts on Twitter and Facebook but was wrongly blamed. As a result, Cyber Bullying, Cyber Stalking, Harassment through E-Mails, SMS, Spamming and Phishing all went  out of the regulation under Section 66A.

Under the guise of protecting the “Freedom of Speech”, the Supreme Court in this Shreya Singhal judgement gave a “License to Abuse”. What we are observing today has the origin in the perception that “Section 66A was scrapped by Supreme Court because social media abuse was considered as a part of the fundamental right to freedom of speech”.

It is therefore amusing that the same eminent lawyers and the Supreme Court as well as the conventional media are now converging on an attempt to gag the Social Media under some pretext.

If Supreme Court withdraws its Shreya Singhal judgement and reinstates Section 66A, it would be one of the best and easy solutions to reverse the perception.

It must be reiterated here that the arrests of innocent citizens under Section 66A which led to the decision  of scrapping the section was born out of a mis-interpretation of the Police that the section was applicable to “Publishing” in the social media such as FaceBook and the Twitter. The Courts at all levels failed to call the mistake and took to grandstanding as “Champions of Freedom of Speech” and scrapped the section.

Now it appears that the Eminent Jurists are again creating a situation that may lead to another bad decision as regards Social Media.

In the present instance, abuses on Social media can be addressed (in the absence of Section 66A) through relevant sections of IPC provided the electronic evidence is properly presented with Section 65B certification. Hence there is legal protection against misuse of the Social Media except for procedural issues that may require attention. If Section 66A is reinstated, situation would improve substantially.

However, the root problem of Social Media use for abuse is not that there is a freedom to publish anything including irresponsible content but the fact that it can be done “Anonymously”. The same eminent jurists and the Supreme Court are responsible for creating a false impression in the society that “Privacy is protected by hiding one’s identity in social media communications”.

Again, it is not the issue whether “Privacy” is an important fundamental right and needs to be protected or not… but whether the current manner in which we are protecting Privacy through enabling “Anonymity” is the right way to protect Privacy.

All Twitter and Facebook abuses as well as WhatsApp misuse can be stopped if in case of misuse the persons responsible can be identified easily and simply named and shamed. But we are not prepared to do it because we feel “Privacy” right is being curtailed by making the identity of Social Media users hard to get at except with an FIR or Court direction.

We track the location of users of Computers and Mobiles to the last meter to display restaurants around us or for hailing a cab, but we are not prepared to track the location of the social media abusers.

The Twitter and Facebook IDs are dependent on the e-mail IDs of the owners and its use pattern. Similarly, website IDs are dependent on domain name registrations which again are linked to e-mail IDs.

Hence behind most of the issues that we face today and call Cyber Crimes or Social Media abuses, there is a hidden e-mail ID. If Google happens to the biggest e-mail provider, then it is the reason for most of these crimes being encouraged and abetted by the false sense of Privacy protection that the society is now supporting.

I have recently raised a query with Google why it should not take the mandatory consent of the recipients of Gmail to automatically know the originating IP address of the sender. If as a part of the Gmail setting, I declare that all incoming emails should be accepted only if the originating IP address is revealed to the recipients, Google can put in a system where the senders would be notified that their email will be delivered to the destination address only if they permit revealing the originating IP address to the addressee.

This is a simple technical correction which the Supreme Court can mandate if they are really concerned about the social media abuse.

In a similar manner, the dynamic IP address of the ISP or the owner of a mobile  should also be automatically revealed at the request of a recipient of an e-mail or SMS or Call for which ISPs can put in a system where by the request is made by an identified citizen of India (say under his Aadhaar identity) and a declaration that he is in receipt of an e-mail or mobile communication from the person whose identity is being sought and a further assurance that if his request is on false grounds, he may be prosecuted for “Breach of Privacy under false pretensions”.

This is also a simple technical correction which the Supreme Court can mandate if they are really concerned about Social Media abuse.

I therefore call upon the honourable Chief Justice of India, Mr Dipak Sharma and responsible advocates mike Mr Harish Salve that they should consider these suggestions.

I request readers who re rightly connected, to pass on this request to Mr Harish Salve and Justice Dipak Mishra since they are unlikely to be otherwise informed about the “Solutions” and would be bogged down with the “Problems”.

Naavi






Posted in Cyber Law | Leave a comment

How to Avoid Shapoorji-Pallonji dilemma in e-tendering?

We continue our academic debate on the recent case of Shapoorji Pallonji Vs MHADA  in which the company challenged the e-tender bidding process followed for the award of a major Rs 11000 contract  for reconstruction of BDD Chawls and successfully obtained a ruling that they should be allowed to participate in the bid, though there was a dispute as to whether the bid process was properly concluded or not.

We have already discussed the details in the earlier articles and from the available information it is reported that NIC had created the e-tender system which involved a process of uploading tender documents encrypted with the public key of the tender authority into the server and then clicking a button “Freeze Bid”. The petitioner in this case contended that they were able to successfully upload the document and they got “Successfully Uploaded” message on the screen. However, there after they logged out and the requirement of clicking the “Freeze Bid” button was not displayed. NIC confirmed that the freezing of the bid was not logged in the server and hence the process was not complete.

The reason that the button was not displayed could be due to any number of technical reasons either at the server end or at the user end or at the intermediary network services level. This was considered as a “Technical Glitch” and the Court agreed with the contention that technical glitches should not be allowed to prevent an otherwise valid bid to be taken into consideration.

At this time, I am not going into further debate on this issue and as I have mentioned several times, I donot have any specific vested interest in Ms Shapoorji Pallonji getting an entry into the bid or finally winning it etc. Hence the legal team of Shapoorji Pallonji which consists of some of my friends, need not get upset about what I am objecting to. I am only debating the possibility that if we admit that any unsuccessful e-commerce contracting party can raise non fulfillment of an online process due to claimed technical glitches as a defence to void the contractual requirements, it would create a bad precedent and makes life difficult for all e-commerce entities. I therefore feel if there was any other “Public Good” reasons which required the petition to have been allowed, it should have been allowed under those grounds rather than under the “Technical Glitches” reason.

However, I need to answer one of the points raised by a friend stating

” If you insist the onus of having clicked the freeze button should be on the end point  you are effectively saying all individuals must now have cameras behind them recording their actions. That is just not going to work. “

This is the Shapoorji Pallonji dilemma which is not unique to this case but to any transaction in which electronic documents are relied upon and transaction is considered evidentially important.

We must appreciate that at present, according to Indian law, “Click Wrap Contract” is not considered as a valid “Signed Contract”. Unless a contract is digitally signed by both the offeror and the acceptor, a valid digital contract like a written and signed contract cannot be completed.

The Income Tax department and MCA authorities have therefore adopted a process where at the stage of submitting a return, the entire document is captured in toto and a Digital Signature or e-Sign is applied on the web form and then sent to the receiver.

However, what most E Commerce parties are doing is to adopt the US practice of providing a button at the bottom of a contractual document saying “I Accept” or some other similar words. Some people add an affirmative action such as ticking the check box or having a captcha. Others ignore even this precaution.

In such cases, we consider the contract as a “Deemed Contract” where the contract is implied by circumstances evidenced by the meta data of the transactions but detailed terms of contract is considered as open to dispute as per the usual considerations of an “Unconscionable Contract” and “Standard Form Contract” for which several Supreme Court judgement have set the standards. All practicing advocates should know these cases and there is no need for me to repeat a reference here. I have used the references successfully in the adjudication case of S.Umashankar Vs ICICI Bank which is too old for many to remember, except for its historical importance.

It appears that the NIC tender process has also adopted this “Deemed Contract” principle at least to the process of submission of the tender documents….such as Log in with your registered log in ID and password, upload the documents, click the “Freeze Bid” button etc.

There is a dispute that NIC did not give proper instructions in this regard which is outside the  scope of my knowledge and I leave it to the NIC to confirm or deny beyond what they have already done in the affidavit before the Court which has been rejected.

Whether the process of tendering was completed or not is a “Sub Contract” to the tender process and it has to be analyzed in the “Deemed Contract Status”.

In a deemed contract, either party can dispute on the details and that is what has happened in this case. I suppose the Court has considered all angles and come to a proper decision and if not,  it is for the parties concerned to challenge it in a higher Court.

However, can this process of “Uncertain Deemed Contracts” driving e-commerce transactions and the high value e-tendering systems be allowed to prevail? or should we have a solution? is a matter of concern for “Non Practicing Blog Writers” who are more concerned about the “System” rather than an individual litigant. Practicing advocates argue for one party today and another party the other day while “Non Practicing Blog Writers” have to be accountable for their views to the public and justify change of opinion with reasoning if required.

The Undersigned has anticipated this type of problems several years ago when he launched the services of ceac.in (Those who are unaware, can go through it once again).

Under CEAC service “Certification of a Web Page” now also upgraded as “CEAC-Evidence Drop Box”, it has been suggested that whenever people take critical decisions based on a web document, it is prudent to record the document and get it certified under Section 65B of IEA.

I have submitted many such documents in the case of web based copyright infringements, defamation, matrimonial cases etc. Very recently, there was a demand from a customer who had lost all his accounting records stored on a server in USA which was attacked by a ransomware to show case the evidence that his records were destroyed by the ransomware and the same was provided by CEAC.

Unfortunately many may not  know the existence of such services and I donot have the habit of advertising the same as often as I should perhaps do. Hence people may not know either that such trusted third party services have been available since 2002 nor that the requirements can be fulfilled if not with CEAC, with others.

The CEAC-EDB service is specially designed for requirements which Shapoorji Pallonji persons encountered when they were preparing to submit their documents for a huge contract in the last minutes where there was no time left for alternate submission if the technology had failed.

The idea here is that since there is no time to invite an expert Section 65B certifier to record the process in his presence, and also that it has to be done from the premises of the user and in his computer, the user foregoes the need to involve a trusted third party for recording the observation but does the next best thing of “Archiving” the process with a trusted third party at a time no dispute has arisen so that it can be produced as evidence that the process was completed in a certain manner and there was a technical glitch which appeared as a “Error Statement on the screen” or simply by “Nothing appearing on the screen”.

I am sure that some of the informed readers will suddenly jump to other debate of Section 65B certification but we can keep that discussion for a different time.

I recently submitted one Section 65B certified statement of “Certified E Mail Delivery” to a respondent at the instance of a petitioner so that the Court could proceed with the hearing ex-parte since the respondent was not cooperating in the litigation. Similarly, the “Archival of a user end electronic activity” would be certified as to the “Archival”. It is open to the defendant to raise any argument that the archived document itself was fabricated and the archival cannot save the defense. But the onus of proof will be on the defendant that the document is in fact fabricated. The “Archival” will prove the good faith of the user in recording a process before he was aware that it could land in a dispute and Courts may consider it as better than trying to approach the m without any documentary evidence.

In the Shapoorji Pallonji case, a screen shot was reportedly produced but I am not sure if it was Section 65B certified. Also the point of dispute is more on what happenned after the screen showed “Successfully Uploaded”. Did it go blank? Or was the system shut off immediately without waiting for the next screen to appear? etc. This was not clearly established except through the statement of the petitioner. Had they properly recorded the entire process including a few seconds after the uploading of the documents, a better evidence would have been available. The dispute arose only after the bid was rejected by the committee and had the documents been archived earlier with  a trusted third party, the evidence would have been stronger.

I agree that in this case,  Court was not that strict but if objection had been raised by other bidders, or MHADA had not agreed to accommodate the estranged bidder, Court would have been perhaps stricter. It is better for parties engaged in high value bidding not to take the risk that Court will be always considerate to them to accept the “Technical Glitch” excuse and condone any failure of the tendering process.

Hope this clarifies what I think about “Should we always carry a Camera..”?

Naavi

Also See: 

The e-tendering issues in Maharashtra.. “Uploading” is not the same as “submitting” the tender  

The Pandora’s box of Technical Glitches opened……2: MHDA and NIC need to take not

 The Pandora’s box of Technical Glitches opened….The e-tender judgement in Maharashtra…1

Posted in Cyber Law | Leave a comment

The e-tendering issues in Maharashtra.. “Uploading” is not the same as “submitting” the tender

The decision of the Mumbai High Court in the Writ Petition (L) 2070 of 2017 filed by the well known Construction company Shapoorji Pallonji & Company Private Limited against the State of Maharashtra in respect of an e-Tender rejection has raised interesting debate on the e-tendering process used by Governments in different States and the Center.

Some of the experts in law have made comments on the earlier articles which require some clarification to be provided from my side and I will try to do the same here.

(P.S: The opinion expressed here does not in anyway discount the accepted fact that M/s Shapoorji Pallonji & Company is a reputed and long standing Civil Contracting firm and must be considered as a highly eligible company to win any Civil Contract whether from the State Government of Maharashtra or elsewhere).

One comment is that the e-tendering process is often tampered with in such a manner that bids from genuine parties are prevented from being placed and in the instant case the petitioner had the resources and commitments to challenge such technical glitches and hence the verdict is welcome.

I do agree that some of the e-tendering software might be tampered with or otherwise be badly built and inadequately tested. This could be part of the larger problem of corruption in administration and not always due to the inadequacy of the software/software developer including NIC.

However, if such a criminal charge was suspected in the instant case, the complaint should have been preferred as a criminal complaint seeking punishment of persons responsible for hacking or denial of service provided there was sufficient evidence.

There is no need to justify this verdict for the reason that tampering for corruption is a possibility or fact and this decision pulls up the Government authorities who are easy targets to blame.

The facts in this case indicate that the petitioner was first of all not ready with his bid until the very end and claims that he encountered technical problems which could not be resolved in time.  Some operator at their end could have simply forgotten the last process and in a hurry to complete the tender might have thought that he was through the process once the “Successfully uploaded” message appeared on  the screen. This is a common mistake many computer operators do.

The petitioner’s claim of having been prevented from completing the process is only a self serving evidence from the petitioner that there was a technical glitch. It is unclear from the judgement (but can be reasonably presumed otherwise) that the screen shot submitted by the petitioner that the “Documents were uploaded successfully” was  supported by a Section 65B certificate.

Even if the successful “Uploading” was proved, it does not complete the process of tender until the “Freeze Bid” is completed. After the documents are uploaded and before the freeze bid process is completed, the bidder may have the option of changing his bid by abandoning the tender or re-submitting the document.

As long as the bidder retains the option to withdraw the submission, the submission has to be treated as incomplete. Hence “Uploading” is not equivalent to “Bidding” but the Judgement will support this anomalous situation.  

In the instant case,  if the bid committee had not rejected the application of the petitioner, they would have been violating the rights of the remaining bidder. Considering the might of the rejected bidder, it would have perhaps required a lot of courage of an honest official to take the decision.

If there was any prima facie evidence of a criminal tampering with the system, the correct remedy for the petitioner to seek was a criminal punishment of those who tampered with the system as also to cancel the tender and arrange a re-tender in due course.

The petitioner however did not chose this option but chose instead to file a simple writ petition to include the late bid.

If the petitioner was really interested in “Public Good” as some critics of my view imply, they could have raised the issue of “Tampering of E-Tender Process” and helped in cleaning up the system which they did not chose to do.

On the other hand, by allowing regularization of “Incomplete Tender Process” the Court has set a precedent where by the “Tender Rules” are amenable to be changeed if any of the unsuccessful bidders are capable of moving a Court in their favour. This could be used as an excuse in every other tender process by a bidder who fails to meet the rigorous tender rules that others have already followed.

I wish that Maharashtra State Government or NIC should challenge the order because this makes every other e-tendering process a “Suspect” and hits at the very integrity of NIC and the Government officials involved.

I request that those Critics who have ferociously defended the judgement may kindly shed their vested interests and look at the Judgement from the perspective of what is right in principle irrespective of which party benefits therefrom.

Naavi

Related Articles:

The Pandora’s box of Technical Glitches opened….The e-tender judgement in Maharashtra…1

The Pandora’s box of Technical Glitches opened……2: MHDA and NIC need to take note

 






Posted in Cyber Law | 3 Comments

The Pandora’s box of Technical Glitches opened……2: MHDA and NIC need to take note

This is in continuation of the earlier article

The essence of the judgement in the case of Shapoorji Pallonji & Company Private Limited vs State of Maharashtra in the disputed e-Tender rejection case is that

An e-tender cannot be denied acceptance of filing even if the process could not be completed or if it is delayed beyond the period of closure.

Though the instant case was that of a large contract involving the State and the application of one of the parties had been rejected reducing the competition from three to two bidders, the principle established in this case can have far-reaching impact on every other E Commerce transaction and hence there is a need to discuss the impact of this judgement in greater detail.

Also, in the instant case, the judgement has not made much of a change in the fortunes of the other parties as the process of selection of the tender party will continue and the final choice is based on many other factors. But in many other cases of E-Commerce one technical issue may decide whether the contract is either valid or not and there is no second chance to correct the error. Hence if the principle established here becomes a universal guideline there could be lot more repercussions to the E Commerce industry than what is apparent.

Technology is a “Tool” that enables a transaction to take place between two legal entities and the law (ITA 2000) recognizes this through Section 11 of ITA 2000.

However whether an intermediary tool used on the web is a tool used by the first party or the second party depends on the factors leading to the use of the tool for completing the transaction. This principle has been well established in law in the case of the intermediary message delivery agency like the Post Office which can be an agent of either the sender or the receiver depending on who between them engaged the services of the Post Office. Today when there is an alternative to the Postal authorities, most of the time it is the sender who choses either the Post office or a particular courier to deliver his message and hence the delivery agency becomes the agency of the sender.

Any omissions of the delivery agency in such a case therefore becomes the legal responsibility of the sender.

In the instant case, the e-Tender application belonged to the Government and hence we can say that the defects in the system becomes attributable to the Government. Whether it is to be attributed to the MHDA or NIC is a fact that needs to be determined from some additional information which is presently not with us. Probably MHDA has used the services of NIC and their contract will determine the inter-se responsibilities.

The reported technical glitch could have arisen out of any of the following reasons.

a) Technical glitch in the tender software owned by NIC and leased out to MHDA for which either of them could be responsible based on the contract

b) Networking service which could be the ISP of the sender or the ISP of the tender processing agency

c) Hosting service provider who hosted the tender related documents

d) The sender’s computer including hardware, OS software, Application Software such as a Java script or Adobe Flash etc., the Anti virus or security software working there in, the configuration of security features, etc

Has the Court determined whether the so called “Technical Glitch” arose out of only the Tender software?… it is not clear.

Has the Court examined the configuration of the computer of the user before arriving at the conclusion that mistake must be with the Government end?…. it is not clear.

The Court has taken note that after the uploading of the documents, there was a process called “Freeze Bid” which involved the need for the party to receive an “Acknowledgement”.  According to the petitioner’s contention, this Acknowledgement was not received but they were able to provide a “Screen Shot” to demonstrate that the bid documents were “Uploaded”.

It is not clear if this “Screen Shot” produced by the petitioner in his own cause was “Section 65B certified.

The bidder paid the EMD in the form of a Bank Guarantee (Not known when this was submitted).

However, the respondent appears to have produced records to show that the portal recorded the transaction as an “Invalid Bid” and the tender document was not found in the place where it was meant to be.

According to the evidence it was stated that there was a “Failure” of the petitioner in “Not Clicking the Freeze Bid Button” and this was mandatory.

In defense the petitioner has argued that “…Even if the Freeze Bid button was not clicked, the uploaded document is stored on NIC’s server or associated file server or network attached storage or storage area network or within the data base.”

It was like a tender document that had to be put in a tender box was thrown into the premises some where but not put inside the tender box. Hence the tender committee could not take it into account.

The argument that it was inside the premises of MHDA (some where in the server) and the cover was unopened (encrypted) etc are arguments which donot have legal sanctity. The Court appears to have therefore seriously erred on this account.

If there is a process for submitting a tender and the contract is complete only when all the aspects are fulfilled, the Court had no right to arbitrarily come to the conclusion that it is enough if the document is uploaded and it was not necessary to “Commit” the document by clicking on the Freeze Bid button.

The Freeze Bid button/process is a mechanism that provides an option to the person submitting the tender not to complete the process even after the uploading of the document so that he can abandon his upload and resubmit his documents again and then click on the Freeze-bid button.

If the petitioner had wanted to change an uploaded document and at that time MHDA had raised the argument that the upload completes the process, the same petitioner would have argued that the process was incomplete and hence it should be given an opportunity to re-submit the document.

I therefore consider that the decision of the Court was not found on proper understanding of the system and it failed to address the need to debate on why the “Freeze Bid Button” was a critical process of tender submission and no matter what was the reason, not getting an acknowledgement was a failure of the submission of the tender document properly.

The Court has also ignored the provisions of ITA 2000, Section 12 which clearly mentions that when an “Acknowledgement” is a stipulated part of completion of a contract, non receipt of the acknowledgement was a clear reason to treat the contract as invalid.

The Court appears to have failed to follow the law in this regard.

Further if the submission was delayed even by just 2 minutes after the closure of the tender, it is a matter that cannot be condoned by the Court. If so, Court can manage the tender process by itself without the administrator in between. This appears to be a case of judicial over reach.

While we are not much concerned about this one decision where one Shapoorji Pallonji & Company Private Limited, got a second chance to make a bid for a huge Government project, we are concerned with the impact that this decision leaves on other E Commerce transactions.

Technical Glitches are not completely avoidable whether it is in a Mobile Wallet system or a E Banking system or any other electronic transaction. When systems are built, several layers of transaction confirmation is built and extensive testing undertaken to take care of the possibilities of technical problems that may arise. Since web platforms always have  a problem that they have to remain compatible with a variety of user end systems operating on multifarious hardware, OS and software platforms, it is impossible to create systems that are 100% foolproof. Hence an E-Transaction cannot be treated as legally complete under the discretion of a Court and not on the system records.

Tomorrow somebody may buy a property on 99acres.com and later challenge it to the judgement of the Court as to whether the purchase was out of technical glitch or not. Somebody  may enter into a transaction on Quikr and later claim that it was a technical glitch. There was a Bank of Maharashtra UPI fraud involving a technical glitch. Now there is perhaps another incident of a Rs 19 crore fraud in MobiKwick which also could be a technical glitch.

Can the Court stand in judgement of every such transaction? Or will the Court discriminate that only of the contract value is 100,000 crores, they will step in or otherwise no?

Before setting a precedence to over rule what is specified in law the Court should have considered the impact that its decision leaves on the industry. The Court should not have ruled that an Incomplete process can be considered as “complete” even on an “Exception” basis.

This will set up a bad precedent and cause more problems than what it has set out to correct.

By poking its nose in interpreting the “Technical Glitch” aspect, the Court has tried to re-define the concept of “Reasonable Security Practice” which will now require to follow the principle that “Human Spirits should prevail over technology”. This will adversely affect many technology concepts such as Facebook, Twitter, WhatsApp etc.

Given the ingenuity of Cyber Criminals, they can make every transaction look like a technical glitch if they want and Courts will be scratching their heads on understanding the difference between failure of a contract through technical glitch and failure due to a deliberate tweaking of the system. I am sure that it is child’s play to get the tender documents uploaded without an acknowledgement generation in every tender process. Then the sanctity of the “Freeze Bid” process as the final confirmation is defeated.

Similarly, when there is a “Terms and Condition” or “Privacy Policy” that needs to be “Consented” to with the clicking of an “I Accept Button”, some body may claim, even without clicking the button, the transaction is deemed as “Clicked” because the Mumbai High Court has the discretion to declare so.

It is field day for litigants because “Technical Glitch” can be a good excuse for challenging any E Commerce Transaction.

Considering the overwhelming adverse impact that this decision will leave, I wish that the decision is challenged since it violates the principles of Section 12 of ITA 2000… if there is still time.

The better view for the Court to take is that

The technology supplier shall use “Reasonable Security Practices” to ensure that technical errors are minimized though it may not be completely eliminated. Any loss caused to the users on account of inefficeint, inadequately tested products that fail to meet the “Reasonable Security Practice” standards should be covered out of “Cyber Insurance” or through “Claim of damages” in a separate suit rather than regularizing a transaction which failed.

Naavi

Copy of the judgement is available here

Also see: 
The e-tendering issues in Maharashtra.. “Uploading” is not the same as “submitting” the tender
 The Pandora’s box of Technical Glitches opened….The e-tender judgement in Maharashtra…1






Posted in Cyber Law | Leave a comment

The Pandora’s box of Technical Glitches opened….The e-tender judgement in Maharashtra…1

An interesting judgement has come forth from the High Court of Maharashtra in the Shapoorji Pallonji & Company Private Limited vs State of Maharashtra which has debated some less known aspects of Information Technology Act 2000 (ITA2000) and the use of technology in e-Governance. Some aspects of the judgement are presented here for academic information.

Copy of the judgement is available here

The writ petition pertains to the complaint from Shapporji Pallonji & Company Private Limited (SPC) that their tender application made through the e-tender process by Maharashtra  Housing Development Authority (MHDA) was rejected for a technical reason that the tender process was not completed. National Center (NIC) was a Co-Petitioner since they maintained the system. The judgement was delivered on 28th September 2017 by honourable Justices Anoop V Mohta and Smt Bharati H Dangre.

An important observation of the judgement that needs to be taken note of is the statement that

“…it is clear that technology has its own glitches and the moot question is whether such glitches which causes substantial injustice are permitted to be cured manually, when as on today we have not reached a stage where the systems is fool proof and gives a guarantee that it is not susceptible to any error”

“… In the present case we have observed that uncertainty prevails in certain areas and no technology can make the system full proof (Ed: Is it fool proof?..see here or here) and as such a situation where the technology can err, we cannot completely exclude the element of human intervention in exceptional circumstances. Ultimately it is the human being who controls the technology and when it errs, it is for the human being to rectify it”.

“…Since we feel that the technology has failed to serve its intended purpose in the present case, and interest of justice call for intervention”

In summary the Court has ordered that the bid of the petitioner needs to be considered along with the two other bids.

We congratulate the legal team of the petitioner who successfully convinced the Judges that

a) There was a technical glitch in the system

b) The respondent refused to manually intervene and set the adverse effect of the glitch right

c) As a result, a rightful opportunity was denied to the petitioner and public good was adversely affected

With the decision behind us, we can now proceed on the larger impact of the decision on the e-Tender and other e-commerce industry.

Considering that

a) the dependence of the current society on e-transactions is very high, and

b) the technology cannot be fool proof, the possibility of technical glitches real

c) along with malicious interventions of technical nature to subvert an electronic system

a judicial declaration that that “Manual Interventions cannot be excluded in technical processes” opens up a Pandora’s box the impact of which has been ignored by the Judgement.

In order to understand the complications that the judgement can bring in, I recall the judgement of the Sonu@Anvar Vs State of Haryana  on Section 65B of Indian Evidence Act in which a convicted criminal wanted to seek aquittal because the evidence against him was procedurally not certified as required under law.

The technical argument of the petitioner in this case was sustainable and there was perhaps a flaw in the application of criminal justice system. However, the Court in this case came up with a practical conclusion that strict application of the procedure “.. is not in the interests of administration of justice as it would necessitate the reopening of a large number of criminal cases”.

In a developing society we need to appreciate that mistakes do happen and the Courts need to consider the larger impact on the society that their decisions and the possibility of a chaotic situation being created in protecting the genuine interest of one petitioner. A myopic view is often more harmful and could be avoided.

This e-Tender case is likely to be one such case where the decision could create avoidable chaotic disturbance to the e-Commerce industry in general.

I would try to explain more in my follow up article.

For the time being, let’s end with congratulating the team that brought this complicated issue into the discussion table which includes the NIC which caused the problem in the first place by not anticipating the technical problems and putting contingent remedies in place through inadequate testing and documentation.

(continuation article)

Naavi






Posted in Cyber Law | Leave a comment

Who is Responsible for Cheque Cloning?

“One fraudster has opened a current account in bombay. Deposited high value cloned cheques of another bank in his banks branch at surat. His banker is a collecting bank. Collecting bank officials have verified the chqs in UV Lamp and the official has signed and confirmed as”Verified under UV lamp”. City Back Office has sent it in CTS clg and the paying banker has passed the same eventhough the signature of the customer are not matching. Who can be held responsible? Is the collecting banker liable to refund the amount. If yes, who is answerable in collecting bank?”

I have received a query as above to an earlier article titled “Cheque Cloning Fraud that exposes the weaknesses in the Banking system”.

Many of the followers of this blog may not know that I was a Banker in my initial professional career and was also a faculty member for a long time teaching Negotiable Instruments Act in particular before the Banking system went digital and integrated Banking laws with Information Technology Act which is the law applicable to electronic documents. Many of the current day Bankers are “Computer Experts” and not experts in “Negotiable Instruments Act”. Veteran Bankers like us some times feel that current day Bankers do Banking as dictated by the systems and many times ignore the transaction behind the computer clicks. I therefore would like to respond to the above query in a little detail.

Before the ITA 2000 came into being, Banking was run on the principles of Banking law and Practice developed over a long time particularly under the British legal system. In India, Banks were administered through the RBI Act 1934, Banking Regulation Act 1939 and Negotiable Instruments Act 1881 among others. After the advent of ITA 2000, “Electronic Documents” were provided with legal recognition along with “Digital Signature”. Initially, Cheque along with Bill of Exchange and Promissory Note (together constituting the family of Negotiable Instruments) were outside the purview of ITA 2000. However, “An Electronic Letter with digital signature” addressed to the Branch manager could be treated as an operating instructions under which debits could be passed to the customer’s account. Later in February 2003, after the Negotiable Instruments Amendment Act 2002 came into force, Cheques in Electronic Form and Truncated Cheques were brought into the system. Since then RBI has been introducing many technical innovations. The Payment and Settlement Act and the more recent UPI and other digital payment systems have brought many changes which often appear to be in conflict with some of the established Banking law provisions.

In June 2001, the RBI under its Internet Banking Guidelines (Following the Mittal Group Report) clearly mentioned that Internet Banking cannot side step Banking laws and Consumer protection regulations applicable to Banking. In 2011, the GGWG Committee (G Gopalakrishna Working Group on E Banking, Information Security and Cyber Frauds) also reiterated that the current legal provisions endorsed by the Internet Banking Guidelines 2001 prevail. Despite this, the current generation of E Bankers often are oblivious to the existence of laws that affect Banking beyond the ITA 2000 and Payment and Settlement Act.

Even the NIBM and the Indian Banker’s Institute have been guilty of neglecting the conventional Banking laws when discussing the technology innovations and hence there is a wide spread ignorance in the industry about how to interpret the Technology along with the legacy laws.

Banking runs on the principles of “Banker-Customer Relation” that has been existing as the foundation of Banking and there is no reason this should be considered as not relevant today. However some aspects of the established principles such as whether  “Banker-Customer Relationship” is between the Customer and his Branch or between the Customer and the Bank as a whole, whether the timing of Banking, the holidays etc require to be re-interpreted in the light of the Anytime, Anywhere Banking and the use of ATMs, Cards, UPI type apps etc., needs elaborate discussion with the Banking law experts.

The query raised above open up an interesting debate on how should we interpret the Paying Bank and Collecting banker’s responsibilities in the current systems.

As per the Negotiable Instruments Act (NI Act), the paying bank is responsible  for “Payment in Due Course” under Section 85 of NI Act. He has to follow the “mandate” of the drawer of the cheque and when alterations have been made, it is liable irrespective of the expertise of a fraudster in committing the fraud through alterations.

The Collecting Banker is responsible for checking and ensuring that the apparent tenor of the cheque makes his customer the payee or the last endorsee of the cheque. He is responsible under Section 131 of NI Act for collection without negligence.

Once the system of “Truncated Cheques” came in to being, the responsibilities of the Paying Banker and Collecting banker has been re-defined to some extent.

In the Truncated cheque system, since the physical custody of the cheque remains with the collecting bank and only an image is sent to the paying Bank, the responsibility to check material alterations shifted from the Paying Banker to the Collecting Banker.

The responsibility of the Paying Banker is stated with the provisio “..Where the cheque is an electronic image of a truncated cheque, any difference in apparent tenor of such electronic image and the truncated cheque shall be a material alteration and it shall be the duty of the bank (Ed: the collecting Bank) or the clearing house, as the case may be, to ensure the exactness of the apparent tenor of electronic image of the truncated cheque while truncating and transmitting the image”. (P.S: Since the words while truncating is used in this section, it is considered to be a direction to the collecting banker and not the paying banker)

Only in case the paying banker had a reasonable suspicion about the possibility of material alterations, he was to call for the physical copy of the cheque. Otherwise the certificate of the collecting banker should suffice. The collecting Banker should digitally sign the truncated image and therefore takes the responsibility for the image as transmitted by him. The CTS officer should be personally responsible for applying his digital signature.

The amended Section 131 of the NIAct states “It shall be the duty of the banker who receives payment based on an electronic image of a truncated cheque held with him, to verify the prima facie genuineness of the cheque to be truncated and any fraud, forgery or tampering apparent on the face of the instrument that can be verified with due diligence and ordinary care.”

The 2015 amendment to NI Act further expanded the definition of the Cheque in Electronic form but did not affect the operations of the Truncated cheques.

In the case the query has referred to,  the collecting Bank (Surat?)  is responsible to check the material alterations. I am not sure if the collecting bank has actually checked the cheque under UV lamp and it went undetected. The Certificate may therefore be a “False” certificate.

In the event the UV lamp did not detect the erasure, it means that either the UV lamp could be faulty or the printing of cheque leaves was not on proper security form. The UV lamp deficiency is the collecting Bank’s responsibility.

The improper Cheque leaf or the inability to detect the specimen signature difference squarely belongs to the domain of the paying banker.

Paying Banker can be held liable in the above case if the background printing on the cheque did not get erased when the writing was erased.

If the signature is “Forged”, Paying Banker must reject payment and there is no escape even if the forgery is perfect.

If the signature is of the genuine customer only but differs from the specimen, then the issue is different. The Paying Banker may not be held liable for the signature difference since the mandate is to pay if “Signature is Genuine even if there is any difference” not where “Signature is tallying but not genuine”.

In summary, there is negligence both by the Paying Banker and the Collecting Banker. The relationship between the victim and the bank exists at the paying banker’s level and the Paying Banker by virtue of not being able to identify the material alteration is liable to compensate the drawer of the cheque even if the signature is genuine.

The Collecting Banker is liable to the Paying Banker for not being able to detect the material alteration and for failing to do a proper KYC on the fraudster and contributing to the crime.

Since the privity of contract is between the victim and the paying bank, the Paying Bank should be the first accused and the collecting bank should be the second accused. The fraudster could be the co-accused and I would place him in the last.

Victims should not fall into the trap of filing a complaint against the unknown fraudsters leaving the bankers even if it is suggested by the Police.

Simultaneously victims should launch adjudication since Police may fail to locate the fraudster and not keen on pursuing the case against the bankers and the case will eternally lie in the files of the Judiciary.

After the adjudication, it is likely that the Bankers will continue the legal challenge in an appeal and since TDSAT is the appeal authority for adjudication awards, it will be a pain for the victims to follow. They should therefore escalate the issue directly to the High Court since the merger of Cyber Appellate Tribunal with TDSAT is under challenge in Chennai High Court at present.

When the paying banker pays the customer by reinstating the balance in the account, he can claim the money from the collecting Bank. The collecting Bank can in turn collect the money from the fraudster customer for whom he has opened the account. Internal responsibilities (CTS officer or Account opening officer etc) are the issue of the bank to settle.

I hope this throws some light on the points raised in the query.

Naavi

Related Articles:

Cheque In Electronic Form, redefined, Implications on E Banking

ITA-2000 stands amended through NI Act Amendment: 6th December 2002

ITA-2000 and Negotiable Instruments Act : (2nd Nov 2000)

Virtual Negotiable Instruments…A Fantasy?: 22nd Feb 2001




Posted in Cyber Law | Leave a comment