1. Workshop on “Cyber Crime”
Wednesday, 18th June Hotel Bristol, M.G. Road, Gurgaon
Session IV- Incident Response and Reporting Cyber Crimes
By Karnika Seth
Managing Partner, SETH ASSOCIATES

2. Presentation plan Incident Response and Reporting Cyber Crimes:
How to handle a cybercrime scenario
Importance of Corporate training in cyberlaws
How to report Cyber Crime
Legal recourse available in cybercrime cases
Role of forensic expert & cyberlawyer.
Steps that lead to effective prosecution & conviction

3. Incident Response – a precursor to Techniques of Cyber investigation & forensic tools
‘Incident response’ could be defined as a precise set of actions to handle any security incident in a responsible ,meaningful and timely manner.
Goals of incident response-
To confirm whether an incident has occurred
To promote accumulation of accurate information
Educate senior management
Help in detection/prevention of such incidents in the future,
To provide rapid detection and containment
Minimize disruption to business and network operations
To facilitate for criminal action against perpetrators

4. Possible reliefs to a cybercrime victim- strategy adoption
A victim of cybercrime needs to immediately report the matter to his local police station and to the nearest cybercrime cell
Depending on the nature of crime there may be civil and criminal remedies.
In civil remedies , injunction and restraint orders , blocking of websites, may be sought, together with damages, delivery up of infringing matter and/or account for profits.
In criminal remedies, a cybercrime case will be registered by police if the offence is cognisable and if the same is non cognisable, a complaint should be filed with metropolitan magistrate
For certain offences, both civil and criminal remedies may be available to the victim

5. Before lodging a cybercrime case
Important parameters-
Gather ample evidence admissible in a court of law
Fulfill the criteria of the pecuniary ,territorial and subject matter jurisdiction of a court.
Determine jurisdiction – case may be filed where the offence is committed or where effect of the offence is felt ( S. 177 to 179, Crpc)

6. The criminal prosecution pyramid

7. Preparation for prosecution
Collect all evidence available & saving snapshots of evidence
Seek a cyberlaw expert’s immediate assistance for advice on preparing for prosecution
Prepare a background history of facts chronologically as per facts
Pen down names and addresses of suspected accused.
Form a draft of complaint and remedies a victim seeks
Cyberlaw expert & police could assist in gathering further evidence e.g tracing the IP in case of s, search & seizure or arrest as appropriate to the situation
A cyber forensic study of the hardware/equipment/ network server related to the cybercrime is generally essential

8. Defending an accused in a cybercrime
Preparation of chain of events table
Probing where evidence could be traced? inbox/files/folders/ web history
Has the accused used any erase evidence software/tools
Forensically screening the hardware/data/files /print outs / camera/mobile/pendrives of evidentiary value
Formatting may not be a solution
Apply for anticipatory bail
Challenge evidence produced by opposite party and look for loopholes
Filing of a cross complaint if appropriate

9. Amendments- Indian Evidence Act 1872
Section 3 of the Evidence Act amended to take care of admissibility of ER as evidence along with the paper based records as part of the documents which can be produced before the court for inspection.
Section 4 of IT Act confers legal recognition to electronic records

10. Societe Des products Nestle SA case 2006 (33 ) PTC 469
By virtue of provision of Section 65A, the contents of electronic records may be proved in evidence by parties in accordance with provision of 65B.
Held- Sub section (1) of section 65B makes admissible as a document, paper print out of electronic records stored in optical or magnetic media produced by a computer subject to fulfillment of conditions specified in subsection 2 of Section 65B .
The computer from which the record is generated was regularly used to store or process information in respect of activity regularly carried on by person having lawful control over the period, and relates to the period over which the computer was regularly used.
Information was fed in the computer in the ordinary course of the activities of the person having lawful control over the computer.
The computer was operating properly, and if not, was not such as to affect the electronic record or its accuracy.
Information reproduced is such as is fed into computer in the ordinary course of activity.
State v Mohd Afzal, 2003 (7) AD (Delhi)1

11. State v Navjot Sandhu (2005)11 SCC 600
Held, while examining Section 65 B Evidence Act, it may be that certificate containing details of subsection 4 of Section 65 is not filed, but that does not mean that secondary evidence cannot be given.
Section 63 & 65 of the Indian Evidence Act enables secondary evidence of contents of a document to be adduced if original is of such a nature as not to be easily movable.

12. Presumptions in law- Section 85 B Indian Evidence Act
The law also presumes that in any proceedings, involving secure digital signature, the court shall presume, unless the contrary is proved, that the secure digital signature is affixed by the subscriber with the intention of signing or approving the electronic record
In any proceedings involving a secure electronic record, the court shall presume, unless contrary is proved, that the secure electronic record has not been altered since the specific point of time, to which the secure status relates

13. Live demo- sending fake e-mails and reading headers ,phising attacks
Use of
Use of Who is
Dissecting header and body of an
message digest,
IP address
Return path
Sender’s address
Live demo phising-

14. Fake bank sites

15. Checking authenticity of e-mail

16. Internet headers - example
Return-Path:
Delivered-To:
Received: (qmail invoked by uid 399); 14 Jun :06:
X-Spam-Checker-Version: SpamAssassin ( ) on
cp.mysticaconsultancy.com
X-Spam-Level: **
X-Spam-Status: No, score=2.2 required=5.0 tests=AWL,DEAR_SOMETHING,
HTML_MESSAGE,RDNS_NONE autolearn=disabled version=3.2.5
X-Virus-Scan: Scanned by ClamAV (no viruses);
Mon, 14 Jun :36:
Received: from unknown (HELO nwt201.smartinfo.com.hk) ( )
by mail.mysticaconsultancy.com with ESMTP; 14 Jun :06:
X-Originating-IP:
Received-SPF: none (mail.mysticaconsultancy.com: domain at indilaw.com does not designate permitted sender hosts)
identity=mailfrom; client-ip= ;
Received: from [ ] (helo=Jamesz17)
by nwt201.smartinfo.com.hk with esmtp (Exim 4.69)
(envelope-from
id 1OO6fd-0007ti-HO
for Mon, 14 Jun :13:
From: "James Burden"
To: "'Karnika Seth'"
References:
In-Reply-To:

17. Subject: RE: A story of interest from India Business Law Journal
Date: Mon, 14 Jun :18:
Message-ID:
MIME-Version: 1.0
Content-Type: multipart/alternative;
boundary="----=_NextPart_000_0092_01CB0BED.F82881B0"
X-Mailer: Microsoft Office Outlook 12.0
Thread-Index: AcrbtlhfkWh1MrOJSyWK5i/aRRropAA1ZBKQAALOomAAAJ4NYAvEM6+w
Content-Language: en-us
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report
X-AntiAbuse: Primary Hostname - nwt201.smartinfo.com.hk

18. Read notify

19. Thank you! SETH ASSOCIATES ADVOCATES AND LEGAL CONSULTANTS
New Delhi Law Office:
C-1/16, Daryaganj, New Delhi , India
Tel:+91 (11) ,
Corporate Law Office:
B-10, Sector 40, NOIDA , N.C.R ,India
Tel: +91 (120) ,
Fax: +91 (120)