The Cyber Crime Monster Will Only Grow Bigger & Dangerous

If the Twitter handle of the most powerful person in our country is not safe, then where do lesser mortals like you and me stand in terms of cyber security?

In the wee hours of Sunday, December 12, 2021, the entire national security apparatus of our country went into a tizzy because Prime Minister Narendra Modi’s twitter account had been reportedly hacked. A fake tweet regarding crypto currency was uploaded from the Prime Minister’s personal twitter handle. Within seconds the tweet was deleted, and the Prime Minister’s Office (PMO) published a tweet informing everyone about the hack and that everything had been restored to normalcy.

The question that pops in mind is – if the Twitter handle of the most powerful person in our country is not safe, then where do lesser mortals like you and me stand in terms of cyber security?

For a few years now, it has been amply clear that cybercrime or cyber fraud is the biggest threat that humanity faces, and it continues to become a monster each passing day. Only we can save ourselves, because police and investigative agencies are lagging way behind, while cyber criminals are always three steps ahead of our agencies.

Newspapers are filled with stories of people having been duped online through various means. There are bank frauds, phishing, Nigerian frauds, multiply your money scams, credit card frauds and other online frauds. Victimizing innocents through social media, identity thefts, financial scams, data theft and manipulations, social engineering, phishing and vishing, lottery, and Ponzi scams.

There have been several scams and frauds which have affected individuals, companies, corporates, governments, and countries. Personal emergency scams, ‘you owe me money’ scam, online dating scams, infected computer scam are some of the scams which target innocent people.

Some of the biggest cyber-crimes which have happened in the past few years include the cyber-attack on India’s CoWin App in January 2021.

In February 2021, India’s flagship airline ‘Air India’ was a victim of a cyber-attack in which confidential data, such as, passport details, ticket information, credit card details, etc., of more than 4.5 million customers was compromised.

In April 2021, a hacker allegedly stole 13 terabytes of data from the Domino’s Pizza in India. As per reports, the data contained details of 18 crore orders, customer names, phone numbers, email addresses and payment details of atleast 10 lakh credit cards.

In the same month in April 2021, hackers posted data of more than 533 million Facebook users for free on a hacking forum. The data shared had information of individuals from 106 countries including the US, UK, and India.

LinkedIn, among the most popular platforms for job search, was also attacked by hackers and confidential data of more than 500 million users was compromised and reportedly attempts were made to sell the information online.

Such is a power and reach of cyber-crime that a hacker can shut down a government sitting in a dingy basement in some far away unknown territory, steal money without being physically close to the crime scene, rob a bank of billions in a minute, shut down power grids and nuclear plants with just a click of the mouse, steal and assume your identity, murder a person without ever going anywhere close to the victim, remotely control your car and crash it at will.

In October 2020, a crucial electricity grid which supplies electricity to Mumbai tripped and the entire city was brought to a halt for several hours. Later investigations revealed that the Chinese hackers had attacked the grid and made it to the trip, it was done to send a warning message after the tension and stand-off between the Indian Army and Chinese army in Ladakh.

It is now well known that Russia influenced the outcome of the US Presidential elections in 2016 by hacking. So, even democracy is not safe from hackers.

How and where can you be targeted?

• Mobile recharge shop:

  A mobile recharge shop is a place where you can be targeted, as scamster get access to your number as well as your phone. Once they have access to your number it is then misused to text you and get confidential information from you and exploit your ignorance.

• Debit Card cloning / skimming:

  This happens when the debit card PIN is shared or revealed to another person. A scamster who has access to the PIN and debit card even for a short span of time, can replicate with a skimming device and withdraw money from your account.

• Personal Computer / Laptop:

  A malicious program called ‘Keylogger’ is installed on your computer/laptop, this is sent to you through spam emails or any other kind of email, where you click on the link and the software gets automatically installed on your computer or laptop. Once it is installed, the malicious software records all the key strokes on the keypads of the computer and emails it to the scammer’s email without your knowledge. With this, the hacker gets all the information which you have typed in your computer and can access all your emails, bank accounts, etc.

• SMS Spoofing:

  An SMS is sent on the phone of the victim in the form of an online sale. Once the victim clicks of the link, all information from victim’s phone is automatically sent to the hacker through a malicious software which is installed on the phone immediately after clicking of the link

• Call Spoofing:

  With the use of an App / Software, the criminal changes the voice to impersonate someone and defraud them or their relatives.

• Ransomware:

  Ransomware is a type of malicious software that threatens to publish the victim’s data or perpetually block access to it unless a ransom is paid. It gains access to data by downloading itself via an email that the unsuspecting victim clicks.

• Cyber-Stalking:

  When a criminal gains illegal access to all information and data which has been posted online by the victim on their social media platforms or other online portals and then uses it against the victim, it is called cyber-stalking.

• Morphing:

  When a picture or a video is morphed or edited in such a way wherein the victim’s face or body is used to create fake photos or videos. Through these fake photos and videos, the criminals then target the victim for various reasons.

• Profile Hacking:

  This happens when your email or social media profile/handle is accessed by a hacker or stalker who then compromises it.

• Online Gaming:

  This is among the major causes of concern for authorities as young and vulnerable boys and girls are first made to get addicted to a game and then are exploited for various reasons to either extort money, committing crimes and in some cases even taking their own lives.

• Job Scam:

  Emails are sent to victims with job offers which look intriguing, luring the unsuspecting victims to open the email and click on the job links. These links are invariably malicious and expose the victim and their computers to hackers.

• Deepfakes:

  This is a technique that is used to combine and superimpose images, videos on the original image or video, giving an impression that it is the victim’s photo or video. It is used to create videos where the voice and/or face of another is superimposed on the original in such a way that viewer or listener cannot distinguish if it is an original image/video or a fake one.

• Camera Hacking:

  Cameras installed on smartphones, computers, laptops, etc., are targeted and used to record videos or photos without the victim’s knowledge and they are blackmailed in various ways.

• Digital Payments and online fraud:

  After the Corona Pandemic paralyzed the whole world for more than 18 months, digital payments have risen dramatically in India. As a collateral, it has also resulted in the increase of frauds related to digital and online payments.

How to protect yourself?

• Do not give out personal information to a stranger.
• Do not meet anyone who you have met online, without confirming and re-confirming the authenticity of the individual.
• Receive, accept, and open emails, files, pictures, texts, videos online from reliable sources.
• Seek help from family, friends, and authorities if you are being bullied online.
• Due to poverty and rise in unemployment, there will be an increase in online frauds. Beware of your credit card & banking details
• Keep your social media accounts private.
• Keep your password strong and secret.
• Don’t allow others to access your electronic gadgets.
• Don’t visit the dark web.
• Remember your profiles are being watched by various agencies.
• Allow parental control on electronic devices.
• Don’t get into deadly games.
• Don’t hesitate to approach the cyber police.
• When shopping or banking, look for secure websites.
• Shop only at reputable online merchants.
• Be wary of any offer that’s too good to be true.
• Don’t click on links in email or on social media from banks, credit card companies, government agencies, or other organizations.
• Monitor your online financial account

Cybercrime Capital of India

Did you know that a little-known town called Jamtara situated in Jharkhand is the capital of cybercrime in India? More than 90% of all the phone calls and call centers which indulge in cyber-fraud originate from this town. Out of nowhere this town has seen a construction boom and the entire town is believed to be flush with money.

Residents, young and old, every day sit in Bamboo plantations and other places and keep making calls all through the day to various numbers across the country. They procure fake SIM cards and claim to be calling from Credit Card companies or ATM offices of various banks. Unsuspecting victims are coerced into giving their credit card or bank details and then money is stolen from their accounts by these people.

Investigations and legal issues of cybercrime

It is a well-known fact that cyber criminals, frauds, and hackers are always three steps ahead of the police or any Law Enforcement Agency (LEA). The biggest hurdle in cyber cases is that in majority of the cases the criminal is either in another city, state, country, or continent. It is almost impossible for any agency to physically catch a cyber-criminal, and this is what the criminals take advantage of.

Add to that our laws are still not upto date or playing catch-up with the latest cyber-crimes. Police officers and cyber cells are still not adequately trained or latest technology and equipment is not available to them to track cyber frauds. It is next to impossible for a policeman sitting in Mumbai to track a Chinese hacker sitting in some small village in rural China.

Even now the awareness regarding cyber-crimes is not to the level that citizens know what is happening, hence the number of cases registered is less compared to the actual frauds that take place. People need to be made more aware of the crimes and encouraged to go to the cyber-crime department to lodge their complaints.

Since police officers are not adequately trained and have poor access to latest technology and state-of-art infrastructure the number of cases solved or detected is poor. And the conviction rate in cyber cases is abysmally poor.

One of the things that need to be addressed immediately by the government and the police administration is to increase the number of officers who are trained to tackle cyber frauds. Also, as per the law, an officer of the rank of Inspector needs to be appointed as an Investigating Officer (I.O) in each case. Typically, Inspector rank officers are in short supply and most of them who are available are tasked with investigations of other criminal and economic offenses, leaving almost no one to be I.O for cyber-crimes. This requirement of the law needs to change and officers of the rank of Police Sub-Inspectors (PSI) should be made I.Os, so that there are more officers available to investigate cyber-crimes.

Considering that the majority of the cases in the future are going to be cyber related offenses, the entire police force and its rank and file needs to be trained in dealing and investigating cyber-crimes, so that the police are future-ready. Today, only a handful of officers are trained in dealing with cyber-cases and even these officers have received training which is obsolete.

One of the things that can be done and should be encouraged is young talent from the private sector should be roped in to deal with cyber-crimes. Ethical hackers, tech-savvy individuals, cyber-experts should be roped in to help the police solve cases so that more and more people are encouraged to come forward and file their complaints. More importantly, those who are roped in from outside the system also need to be paid and compensated adequately so that newer talents get attracted.

The legislature and judiciary need to keep an eye on the continuously changing aspects of cyber-crimes and amend existing laws or create new laws to tackle the crimes and criminals.

A few days ago, a private company in India was cyber-attacked, and its data was hacked into, and a ransomware was installed on its servers and entire data was encrypted by hackers. The hackers demanded a huge ransom to be paid in bitcoins (cryptocurrency). Company officials approached the police for help, but the police had no clue what to do with it and refused to register a case. Finally, after much prodding the police registered a case and conveniently washed their hands off the case by saying it was the handiwork of the Russian hackers and criminals and they cannot do anything about it as it is out of their jurisdiction. They also said that the Mutual Legal Assistance Treaty (MLAT) in criminal matters would not be applicable in this case.

Looking at this experience there is a clear need for our laws to be amended to the latest emerging crimes. Police and authorities need to be given more power, training, and access to the latest technology to deal with such cases.

Writer is the Director General of Police (DGP) (Retired), Maharashtra, former Police Commissioner of Mumbai & Ex-chief of the elite Mumbai Crime Branch. He is also an award-winning author.

(Views expressed are personal)