A Mule arrested in Mumbai for Phishing Fraud

Mumbai Police have arrested a person in Delhi and charged him for the phishing fraud in Bank of Maharashtra, Mumbai where a Cooperative Bank (Deccan Merchant Co operative bank)had lost Rs 1.5 crores.

The arrested person is one of the several mules who have been used in the fraud and has reportedly received around Rs 4-5 lakhs.

In this case it is also stated that Rs 89 lakhs were recovered due to timely action by the Bank stopping the withdrawals.

Hope the Bank takes up the balance amount of loss and provides relief to the client.

(Article in TOI)

Naavi

Posted in Bank, Cyber Law | Leave a comment

Plight of Cyber Crime Victims in Karnataka

The plight of Cyber Crime victims of Karnataka has been brought out in an article which appeared in New Indian Express Today.

See the article here

The article provides the background of the dispute which has also been explained in detail in this website earlier.

The irony of the situation is that while the Adjudicator of Karnataka tried to correct a mistake committed earlier,(order of 27th December 2011) by a new order dated 26th April 2013, the Karnataka High Court , (Principal Bench Court Hall No 9: WP 21049/2013) has come in the way of correction by quashing the new order and reverting the validity of the earlier order. Under the circumstances,  the  adjudication order of 27th December 2011 now has the support of the Karnataka High Court and has gained a larger jurisdictional precedence across the Country.

In effect it is the current Karnataka High Court order of 27th May 2013, which has now tied the hands of the Adjudicator from taking up any complaint either by a Company or against a Company and is primarily responsible for the Cyber Crime victims of Karnataka losing the legal remedies provided by Information Technology Act 2000/8.

Though the reason stated in the impugned order of the High Court is one of non compliance of proper procedure by the adjudicator for revoking the earlier order, the facts indicate that the the Court had come to its decision in a hurry and disposed of the case on a “Short Point” without taking into consideration the impact the decision would have on the Cyber Victims in general in the State other than the respondent involved in the specific case nor the actual dispute that was represented by the petition. Further the order of the High Court appears to contain  some incorrect factual information indicating that the Court could have been mislead by lack of proper information.

It must be noted that the Court in its order did not stop at quashing the order of the Adjudicator dated 26th April 2013, but went further as to suggest one of the secondary respondents to the petition to approach Cyber Appellate Tribunal for redressal of its grievance though this did not appear to have been prayed for even by the petitioner.

One intriguing part of the order was that while the High Court expressed the opinion that the victim of Cyber Crime involved in the underlying dispute should approach Cyber Appellate Tribunal for redressal of his grievance if any against the order of the adjudicator dated 27th December 2011, the petitioner was allowed to move the High Court and not ordered to approach the Cyber Appellate Tribunal for redressal of his grievance against the adjudicating order of 26th April 2013.

This meant that there was one course of action suggested for a Cyber Crime victim and another for a business intermediary who was being accused of abetting the crime by negligence or otherwise. It appeared as if the Cyber Crime victim in Karnataka is a second class citizen and does not deserve protection from the State High Court while the business intermediary is a privileged entity which can be provided protection.

The decision of the High Court and the plight of the Cyber Crime victims should be seen in the background that the so called Cyber Appellate Tribunal has not been functional since June 2011, about six months earlier to the disputed adjudication order of 27th December 2011. Even when the order was issued and followed up with two other similar orders in January 2012, the Adjudicator knew that the victim cannot get the order reversed through the intervention of the normal appeal process. Even the Karnataka High Court when it gave its order on 27th May 2013 was aware that the Cyber Appellate Tribunal was dysfunctional. Hence its suggestion that the victim should have approached the Tribunal was like condemning the victim along with the entire community of Cyber crime victims in Karnataka.

The decision of the High Court has defined a judicial precedence that affects all Cyber Crime Victims in Karnataka including others who were affected by defective Adjudication orders similar to the order of 27th December 2011. It also provides immunity for Cyber Criminals from the operation of Section 66 of ITA 2000/8 for all hacking and denial of service and other offences committed against a Company.

The Citizens of Karnataka await a favourable decision of the other bench which is hearing the PIL on the non appointment of the Chair person of the Cyber Appellate Tribunal for the opening up of the channel for grievance redressal for Cyber crime victims. However this case  is pending before the  Court for last 6 months and could drag on for more time. Even if the Court directs the Central Government to appoint a Chair person expeditiously, it could take a long. long time for the appointment to take effect and for the Cyber Appellate Tribunal to hear the appeal and dispose it off.

The more appropriate remedy for the citizens of Karnataka is for the judge who delivered the order of 27th May 2013 to suo-moto review his own order and let the Adjudicator continue his statutory duty cast upon him under ITA 2000/8.

In the meantime the current status of the applicability of Section 43 of ITA 2008 (also linked to Section 66) may come up for discussion in other Courts where the view of the Karnataka High Court would be quoted by Criminals as a precedence to argue that ITA 2008 cannot be invoked against them. This would expose the reputation of Karnataka High Court to a debate in other Courts.

Citizens of Karnataka donot want other High Courts in the country and the Supreme Court to take note of the adverse effect of the order of Karnataka High Court of 27th May 2013 and pass their own comments which could damage the reputation of the Karnataka High Court and hence an immediate suo-moto review appears to be the best course of action.

The Court can atleast clarify that the decision was based on the specific circumstances of the petition and does not constitute a precedence nor validate the contents of the adjudication order of 27th December 2011.

Naavi

(…As a Netizen Activist in the interest of all the Cyber Crime Victims of Karnataka who have been adversely affected by the order of the Karnataka High Court dated 27th May 2013 in the WP 21049/2013.)

Relevant Orders for Reference

1. Order of the Adjudicator dated 27th December 2011 (Holding that a Company cannot file a complaint under Section 43 of the ITA 2008 nor a complaint can be filed against a Company)

2.Order of the Adjudicator dated 17th January 2012 (Holding that a complaint cannot be filed against a Company under Section 43 of ITA 2008)

2.Order of the Adjudicator dated 26th April 2013 (Holding that the earlier order of 27th December 2011 has been cancelled)

3.Order of the Karnataka High Court dated 27th May 2013 (Holding that the order dated 26th April 2013 is quashed)

Posted in Cyber Crime, Cyber Law, ITA 2008 | 1 Comment

AXIS Bank admits liability for ATM Fraud in Mumbai

It is reported that Axis Bank has agreed to refund the losses suffered by its customers in Mumbai who had lost about Rs 37 lakhs through the ATM card cloning fraud. It is good that Axis Bank has decided to admit its liability rather than fighting a legal battle with the customers.

Perhaps the fact that the customers were members of Police influenced the decision of the Bank. Also since the withdrawals were made abroad, made it difficult for the Bank to blame its customers for causing the fraud.

Further the stand which Axis Bank has adopted in a Phishing case in Bangalore left little legal option for the Bank to pursue any other option. The reason is that in this case against a corporate customer in Bangalore, Axis Bank has argued that ITA 2008 provisions regarding Hacking is not applicable to any crime against a Corporate entity such as itself.

The Bank by adopting this stand stands committed to abdicating the protection available in ITA 2008 for any crimes committed against Axis Bank.

I wish the shareholders of Axis Bank question their management on this voluntary abdication of its rights under ITA 2008 and how it has affected its operational risk profile under Basel II/III.

Related Article

Naavi

Posted in ITA 2008 | Leave a comment

Data Breach Costs in India

A study by Symantec and Ponemon institute on “Cost of Data Breach Study: Global Analysis-2013” has provided some interesting insights into the efficacy of information security and consequences of data breach. The study covers data breach incidents which occurred in 2012.

The study estimated that the global average cost of data breach is Rs 7360/- per compromised record. In India the estimated cost of data breach is Rs 2271/- per compromised record. This is an increase from Rs 2105/- in the previous year showing an annual increase of around 8%. The Indian study covered 28 companies in 11 industries. The size of data breach ranged between 4500 to more than 95000

For the purpose of the study, a “Record” is a unit of information that identifies an individual whose personal information has been compromised.

While system glitches was the primary root cause of data breach causing 46% of the breaches, 29% of the breaches were caused by employee negligence. 25% of the data breaches were caused by malicious attacks.

The criminal activities resulted in the highest per data breach cost at Rs 2470/- per record as against Rs 2150/- for losses arising out of system glitches and Rs 2294/- arising out of employee negligence.

Costs of data breach differed across industries with Financial industries recording a significantly higher per capita loss of Rs 4890/- per record. Loss at Technology companies was placed at Rs 3219/- per record.

Increase in the cost of Data breaches caused by sub contractors and business partners was estimated at Rs 307/- per record. At the same time if the organization had a formal incident response plan and a strong security posture with a CISO and external consultant, the data breach cost reduced by Rs 195/- per record. (8.6%).

It may be noted that the study does not cover “Catastrophic breaches” and hence data breaches of more than 100000 compromised records were not included in the study.

The study is a significant step towards understanding the real impact of Cyber crimes on the industry and should be an eye opener for the Cyber Crime Insurance industry.

(Related Article)

Naavi

Posted in Cyber Crime, Information Assurance, ITA 2008 | Leave a comment

Axis Bank will now has to eat its own words..

In the Adjudicator’s forum in Bangalore, Axis Bank has advanced a mischievous argument that Section 43 of ITA 2008 cannot be invoked by a Company. If this argument is given credence, no company can invoke any offences under Section 66 of ITA 2008 which includes hacking and denial of service etc . Hence Axis Bank cannot file a complaint in Mumbai against the ATM hackers a complaint under Section 66 of ITA 2008.

Since Axis Bank has managed to get the Karnataka High Court endorse this view by implication, the view now has judicial credibility until it is reversed.

It would therefore be interesting if the arrested hackers in Mumbai quote the words of Axis Bank itself in their defense and bind Axis Bank to their own committed position. This will also expose the absurdity of the situation created by Axis Bank in Karnataka to the detriment of all Cyber Crime victims of Karnataka whose cumulative curse should be affecting Axis Bank.

(Please refer to the earlier articles in this site to appreciate the point made here)

Naavi

Posted in Cyber Crime, Cyber Law, ITA 2008 | Leave a comment

ATM Insecurity Exposed

In India, Banks  are pushing Customers to interact with them only through ATMs. Even RBI is encouraging this mode of interaction and discouraging customers from visiting bank branches.

As a result of this policy, Bank customers are being exposed to increased levels of insecurity in their Banking transactions. Apart from the various incidents reported in India involving skimmers and hacking of ATMs, the video in this link provides a clear indication of how unsafe are the current systems.

Please view this Video which contains a demo in a hacker’s conference.

A Complete demonstration and details of how the systems were compromised are available here

Related Article in bankinfosecurity.

In one of the attacks, the demonstrator reprogrammed the ATM remotely over a network, without touching the machine; the second attack required he open the front panel and plug in a USB stick loaded with malware.

The ATM fraud is therefore a threat looming large in Indian Banks. Hence there is a need for a special ATM security mechanism to be introduced by the Banks to protect themselves and their customers.

Hope RBI will take note.

Naavi

Posted in Cyber Law | Leave a comment