Cyber Law Notes Unit 1
Cyber Law Notes Unit 1
Cybersecurity
Cybersecurity Policy
The cybersecurity policy is a developing mission that caters to the entire field of
Information and Communication Technology (ICT) users and providers. It includes −
Home users
Small, medium, and large Enterprises
Government and non-government entities
It serves as an authority framework that defines and guides the activities associated
with the security of cyberspace. It allows all sectors and organizations in designing
suitable cybersecurity policies to meet their requirements. The policy provides an
outline to effectively protect information, information systems and networks.
It gives an understanding into the Government’s approach and strategy for security of
cyber space in the country. It also sketches some pointers to allow collaborative
working across the public and private sectors to safeguard information and
information systems. Therefore, the aim of this policy is to create a cybersecurity
framework, which leads to detailed actions and programs to increase the security
carriage of cyberspace.
Cyber Crime
The Information Technology Act 2000 or any legislation in the Country does not
describe or mention the term Cyber Crime. It can be globally considered as the
gloomier face of technology. The only difference between a traditional crime and a
cyber-crime is that the cyber-crime involves in a crime related to computers. Let us see
the following example to understand it better −
Traditional Theft − A thief breaks into Ram’s house and steals an object kept in the
house.
Hacking − A Cyber Criminal/Hacker sitting in his own house, through his computer,
hacks the computer of Ram and steals the data saved in Ram’s computer without
physically touching the computer or entering in Ram’s house.
The I.T. Act, 2000 defines the terms −
access in computer network in section 2(a)
computer in section 2(i)
computer network in section (2j)
data in section 2(0)
information in section 2(v).
To understand the concept of Cyber Crime, you should know these laws. The object of
offence or target in a cyber-crime are either the computer or the data stored in the
computer.
Nature of Threat
Among the most serious challenges of the 21st century are the prevailing and possible
threats in the sphere of cybersecurity. Threats originate from all kinds of sources, and
mark themselves in disruptive activities that target individuals, businesses, national
infrastructures, and governments alike. The effects of these threats transmit significant
risk for the following −
public safety
security of nations
stability of the globally linked international community
Malicious use of information technology can easily be concealed. It is difficult to
determine the origin or the identity of the criminal. Even the motivation for the
disruption is not an easy task to find out. Criminals of these activities can only be
worked out from the target, the effect, or other circumstantial evidence. Threat actors
can operate with considerable freedom from virtually anywhere. The motives for
disruption can be anything such as −
Enabling People
The lack of information security awareness among users, who could be a simple school
going kid, a system administrator, a developer, or even a CEO of a company, leads to a
variety of cyber vulnerabilities. The awareness policy classifies the following actions
and initiatives for the purpose of user awareness, education, and training −
A complete awareness program to be promoted on a national level.
A comprehensive training program that can cater to the needs of the national
information security (Programs on IT security in schools, colleges, and
universities).
Enhance the effectiveness of the prevailing information security training
programs. Plan domain-specific training programs (e.g., Law Enforcement,
Judiciary, E-Governance, etc.)
Endorse private-sector support for professional information security
certifications.
The Government of India enacted The Information Technology Act with some major
objectives which are as follows −
To deliver lawful recognition for transactions through electronic data
interchange (EDI) and other means of electronic communication, commonly
referred to as electronic commerce or E-Commerce. The aim was to use
replacements of paper-based methods of communication and storage of
information.
To facilitate electronic filing of documents with the Government agencies and
further to amend the Indian Penal Code, the Indian Evidence Act, 1872, the
Bankers' Books Evidence Act, 1891 and the Reserve Bank of India Act, 1934 and
for matters connected therewith or incidental thereto.
The Information Technology Act, 2000, was thus passed as the Act No.21 of 2000. The
I. T. Act got the President’s assent on June 9, 2000 and it was made effective from
October 17, 2000. By adopting this Cyber Legislation, India became the 12th nation in
the world to adopt a Cyber Law regime.
Mission
Vision
To build a secure and resilient cyberspace for citizens, businesses, and Government.
Create Awareness
While the U.S. government has declared October as the National Cybersecurity
Awareness month, India is following the trend to implement some stringent awareness
scheme for the general public.
The general public is partially aware of the crimes related to virus transfer. However,
they are unaware of the bigger picture of the threats that could affect their cyber-lives.
There is a huge lack of knowledge on e-commerce and online banking cyber-crimes
among most of the internet users.
Be vigilant and follow the tips given below while you participate in online activities −
Filter the visibility of personal information in social sites.
Do not keep the "remember password" button active for any email address and
passwords
Make sure your online banking platform is secure.
Keep a watchful eye while shopping online.
Do not save passwords on mobile devices.
Secure the login details for mobile devices and computers, etc.
Areas of Development
The "Cyberlaw Trends in India 2013" and "Cyber law Developments in India in 2014"
are two prominent and trustworthy cyber-law related research works provided by
Perry4Law Organization (P4LO) for the years 2013 and 2014.
There are some grave cyber law related issues that deserve immediate consideration
by the government of India. The issues were put forward by the Indian cyber law
roundup of 2014 provided by P4LO and Cyber Crimes Investigation Centre of India
(CCICI). Following are some major issues −
Cyber Law is the law governing cyber space. Cyber space is a very wide term and
includes computers, networks, software, data storage devices (such as hard disks, USB
disks etc), the Internet, websites, emails and even electronic devices such as cell phones,
ATM machines etc.
Violation of these rules could lead to government action such as imprisonment or fine or
an order to pay compensation.
Cyber crimes are unlawful acts where the computer is used either as a tool or a target
or both. The enormous growth in electronic commerce (e-commerce) and online share
trading has led to a phenomenal spurt in incidents of cyber crime. These crimes are
discussed in detail further in this chapter. A comprehensive discussion on the Indian
law relating to cybercrimes and digital evidence is provided in the ASCL publication
titled “Cyber Crimes & Digital Evidence – Indian Perspective”.
It also provides for payment and receipt of fees in relation to the Government bodies.
On the same day, the Information Technology (Certifying Authorities) Rules, 2000
also came into force.
These rules prescribe the eligibility, appointment and working of Certifying
Authorities (CA). These rules also lay down the technical standards, procedures
and security methods to be used by a CA.
These rules were amended in 2003, 2004 and 2006.
Information Technology (Certifying Authority) Regulations, 2001 came into
force on 9 July 2001. They provide further technical standards and procedures to
be used by a CA.
Two important guidelines relating to CAs were issued. The first are the
Guidelines for submission of application for license to operate as a Certifying
Authority under the IT Act. These guidelines were issued on 9th July 2001.
Next were the Guidelines for submission of certificates and certification
revocation lists to the Controller of Certifying Authorities for publishing in
National Repository of Digital Certificates. These were issued on 16 th December
2002.
The Cyber Regulations Appellate Tribunal (Procedure) Rules, 2000 also came into
force on 17th October 2000.
These rules prescribe the appointment and working of the Cyber Regulations
Appellate Tribunal (CRAT) whose primary role is to hear appeals against orders
of the Adjudicating Officers.
The Cyber Regulations Appellate Tribunal (Salary, Allowances and other
terms and conditions of service of Presiding Officer) Rules, 2003 prescribe
the salary, allowances and other terms for the Presiding Officer of the CRAT.
Information Technology (Other powers of Civil Court vested in Cyber
Appellate Tribunal) Rules 2003 provided some additional powers to the CRAT.
The Government had not appointed the Adjudicating Officers or the Cyber Regulations
Appellate Tribunal for almost 2 years after the passage of the IT Act. This prompted
ASCL students to file a Public Interest Litigation (PIL) in the Bombay High Court asking
for a speedy
appointment of Adjudicating officers.
The Bombay High Court, in its order dated 9th October 2002, directed the Central
Government to announce the appointment of adjudicating officers in the public media to
make people aware of the appointments. The division bench of the Mumbai High Court
consisting of Hon’ble Justice A.P. Shah and Hon’ble Justice Ranjana Desai also ordered
that the Cyber Regulations Appellate Tribunal be constituted within a reasonable time
frame.
Following this the Central Government passed an order dated 23rd March 2003
appointing the “Secretary of Department of Information Technology of each of the
States or of Union Territories” of India as the adjudicating officers.
The Information Technology (Security Procedure) Rules, 2004 came into force on
29th October 2004. They prescribe provisions relating to secure digital signatures and
secure electronic records. Also relevant are the Information Technology (Other
Standards) Rules, 2003.
The Reserve Bank of India Act was also amended by the IT Act.
ISP Guideline
1. ISPs must prevent unlawful content, messages or communications from being carried
on their network. This includes objectionable, obscene, unauthorized and other
content.
2. Once specific instances of such content are reported to the ISP by the enforcement
agencies, they must immediately prevent the carriage of such material on their
network.
3. ISPs must ensure that content carried by them does not infringe “international and
domestic cyber laws”.
4. The use of ISP networks for anti-national activities would be construed as an offence
punishable under the Indian Penal Code or other laws.
5. ISPs are required to comply with the IT Act provisions. They are responsible for any
damages arising out of default in this compliance.
6. ISPs must ensure that their networks cannot be used to endanger or make vulnerable a
networked infrastructure.
7. ISPs must ensure that their services are not used to break-in or attempt to break-in to
Indian networks.
8. ISPs must provide, without any delay, all the tracing facilities to trace nuisance,
obnoxious or malicious calls, messages or communications transported through their
equipment and network. These tracing facilities are to be provided to authorized
officers of Government of India including Police, Customs, Excise, Intelligence
Department officers etc.
9. ISPs must provide necessary facilities to the Government to counteract espionage,
subversive acts, sabotage or any other unlawful activity.
Industrial designs
Scientific discoveries
Protection against unfair competition
Literary, artistic, and scientific works
Inventions in all fields of human endeavor
Performances of performing artists, phonograms, and broadcasts
Trademarks, service marks, commercial names, and designations
All other rights resulting from intellectual activity in the industrial, scientific, literary, or
artistic fields
Copyright
Patent
Trade Secrets, etc.
Advantages of Intellectual Property Rights
Intellectual property rights are advantageous in the following ways −
Provides exclusive rights to the creators or inventors.
Encourages individuals to distribute and share information and data instead of
keeping it confidential.
Provides legal defense and offers the creators the incentive of their work.
Helps in social and financial development.
Patent
A patent is a form of intellectual property. It consists of a set of exclusive rights granted
by a sovereign state to an inventor or their assignee for a limited period of time in
exchange for the public disclosure of an invention.
A Patent is a legal monopoly, which is granted for a limited time by a country to the
owner of an invention. Merely to have a patent does not give the owner the right to use
or exploit the patented invention. That right may still be affected by other laws such as
health and safety regulation, or the food and drugs regulation or even by other patents.
The patent, in the eyes of the law, is a property right and it can be given away, inherited,
sold, licensed and can even be abandoned. As it is conferred by the government, the
government, in certain cases even after grant or even if it has been, in the meantime,
sold or licensed, can revoke it.
The primary goal of the patent law is to encourage innovation and commercialization of
technological advances. Patent law incentivizes inventors to publicly disclose their
inventions in exchange for certain exclusive rights. A patent protects inventions. These
inventions can include new and useful processes, machines, manufactures,
compositions of matter as well as improvements to these. Certain computer programs
may fall within the subject matter protected by both patents and copyrights. In this
respect the patent system compliments copyright protection by providing protection for
functional aspects of the software, which are not protected by copyright. Unlike with
copyright protection, to get patent protection one must first apply for and be granted a
patent from the U.S. Patent and Trademark Office (USPTO). Unlike the copyright
registration process, the patent application process is expensive, complex, difficult, and
time consuming and generally should not be attempted without the assistance of an
experienced patent attorney or agent
Copyright
A copyright is a collection of rights automatically vested to you once you have created
an original work. To understand how these rights can be used or licensed, it is helpful to
analogize them to a bundle of sticks, where each stick represents a separate right vested
to you as the owner. These rights include the right to reproduce the work, to prepare
derivative works, to distribute copies, to perform the work publicly, and to display the
work publicly.
As the copyright owner, you have the authority to keep each “stick,” to transfer them
individually to one or more people, or to transfer them collectively to one or more
people. This can be accomplished through licensing, assigning, and other forms of
transfers. The power of copyright allows you to choose the way your work is made
available to the public.
Trademark?
According to the USPTO, “a trademark is a word, phrase, symbol, and/or design that
identifies and distinguishes the source of the goods of one party from those of others. A
service mark is a word, phrase, symbol, and/or design that identifies and distinguishes
the source of a service rather than goods. Examples include brand names, slogans, and
logos. (The term “trademark” is often used in a general sense to refer to both
trademarks and service marks.)” Similar to copyright, a person does not need not
register a trademark or service mark to receive protection rights, but there are certain
legal benefits to registering the mark with the USPTO. There is rarely an overlap
between trademark and copyright law but it can happen — for instance, when a graphic
illustration is used as a logo the design may be protected both under copyright and
trademark.