Thursday, March 7, 2019

Women’s Day, 2019 : Views of a #webwonderwoman

CYBER CRIME AGAINST WOMEN BY DEBARATI HALDER



In a late afternoon in the last week of February, 2019 I received a message from Ministry of Women & Child Affairs, Government of India congratulating me for winning the #webwonderwomen award in the category of Legal/policy . #Webwonderwomen is an initiative of Ministry of women & Child, BreakThrough India, an NGO which works for women and girls and Twitter to honor 30 women  from diverse fields who had used Twitter positively for spreading awareness, reaching out to people in need and above all, advocating for women empowerment. Among the 30 women were women activists, lawyers, journalists, sanitation & public health activists, food blogger & nutritionist, film maker, activist promoting breast-feeding, women government officials and myself, who works for victims, especially women victims of cyber crimes.  There were different heartwarming  as well as heart breaking stories told by award winners ; they shared stories of  failures and success, happiness and pain, the feeling of being ridiculed by others because of their support to other women. No wonder, I have also gone through the same while executing my wish to help victims of cyber crimes: I have been cyber  bullied, stalked, trolled and threatened by men and women for my work . I have been asked ridiculous questions regarding my “attachment” with the virtual world. Finally with this award, I could prove that being on Twitter or Facebook or Instagram or on internet as a whole for more than the time allotted for general women by their families and societies is not that bad. I have an “unlimited” (in regard to time)  access to net and my husband respects my time on net.  I am fortunate to make this space. I have seen many women who are not allowed to be on net for more than a limited period by their families especially men folk, who may be enjoying (consuming) avatars of other women when their women enter the ‘restricted time period’ for net surfing on a daily basis.
This women’s day is special because as #webwonderwomen awardee I have become a proud ambassador of the Ministry of women and children affairs like my fellow award winners. This is also special because on the very day when I received the award, I saw nothing changed when it comes to cyber crimes against women. While going through the newspaper that very morning, I noticed two news items which  made me think how womens day becomes meaningless for several thousands of women victims of cyber crimes : one was regarding a gang rape survivor who came across the clipping of her own rape scene and dared to walk into the police station to report not only about the physical rape, but also about the virtual consumption of her physical assault by many. The second was about duping of a woman in a renowned matrimonial site . None of these incidents is new for me. However, I salute the rape survivor who took the matter to the police. She must have undergone severe secondary victimization and traumatization by now just like the other victim that I mentioned above. We do not know what would happen to them later: how far the police and prosecution  may help  them ? with a limited legal awareness and fear of  societal taboo, many victims like these two have to withdraw their cases and disappear.
Women’s day is necessarily  related to The Convention on elimination of all forms of discrimination against women (CEDAW), which was adopted by the UN general Assembly in 1979 and which defines discrimination against women as "...any distinction, exclusion or restriction made on the basis of sex which has the effect or purpose of impairing or nullifying the recognition, enjoyment or exercise by women, irrespective of their marital status, on a basis of equality of men and women, of human rights and fundamental freedoms in the political, economic, social, cultural, civil or any other field."  The scope of this definition has automatically expanded to include gender discrimination, misogyny and abuse of women’s rights online.  I was more interested in the award ceremony because of Twitter as its  partner.  Social media like Twitter, Faceook , Instagram, YouTube etc are used for women empowerment. But they are notorious platforms for victimization of women. This year’s theme for International women’s day is “Think equal, build smart, innovate for change” , which signifies women empowerment in the field of technology and innovative work by women and men alike for gender equality and betterment of  situation of women across the globe. This won’t fructify unless web companies take the responsibility of  providing safety against gross abuse of women. As women activists, many of us know that there more takers of CEDAW; but how many States are actually ensuring proper implementation of laws especially for women victims of cyber crimes is a question that needs to be researched. There is no uniform law to recognize several cyber offences against women. Majority of countries have no laws for prevention of cyber bullying, stalking, impersonation  of women, online sexual offences  targeting women.  Sexting and revenge porn still fall in the grey line in majority of the countries. It is still considered a taboo for women to watch porn ; women who are caught watching porn/porn contents  are severely moral policed by the society . But on the other hand, when men watch porn including revenge porn and non-consensual porn, it is still considered as normal because unless the websites flag them as illegal , men (and in certain cases women and  children too) may not be prevented even by the courts because apparently the victims would not have moved the police and / or the courts for taking action to take down the offensive contents .   Majority of these victims may be completely unaware of the fact that they have been made subjects of  online consumption as ‘sex items’. Consider the case of  socio-economically poor  women who may be trafficked and their videos of having sexual activities may be floating for many years without making them understand how they are being ‘consumed’ by millions.[1]
“Think equal, build smart, innovate for change” would be possible only when the society including the government stakeholders  as a whole come together to take a holistic step towards preventing cyber victimization of women and creating safe place for women and girls online and in real life.
Wish you all, a very happy WOMEN’S DAY . Lets “Think equal, build smart, innovate for change”.
Please Note: Do not violate copyright of this blog. If you would like to use information provided in this blog for your own assignment/writeup/project/blog/article, please cite it as “Halder D. (2019), " Women’s Day, 2019 : Views of a #webwonderwoman”  8th March, 2019 , published in http://debaraticyberspace.blogspot.com





[1] See for example Halder D., & Jaishankar, K. (2014). Online Victimization of Andaman Jarawa Tribal Women: An Analysis of the Human Safari YouTube Videos (2012) and its Effects. British Journal of Criminology, 54(4), 673-688. (Impact factor 1.556). DOI: 10.1093/bjc/azu026.

Tuesday, January 15, 2019

Trolling on Instagram photos: Should women restrain from uploading personal pictures?

CYBER CRIME AGAINST WOMEN BY DEBARATI HALDER
Image curtsy : Google


Off-late I have been getting to see many incidences of trolling on personal pictures of individuals, especially women on Instagram. These photos may include photos of young women and girls in trendy clothes, showing more skin than expected by orthodox societies. Such pictures may attract the attention of self-acclaimed moral police trolls who wish to condemn women for their choice of outfits; these trolls use extremely harsh words which may even go to the extent of threatening women for their choices. They may even broaden their harassment pattern by sharing the target pictures through different profiles to defame the victims, threat the victims and create many more morphed images of the victims and this may go on till the victims reach a stage to withdraw from the social media. This indeed generates various levels of criminal liability, some of which have been addressed by laws in India. Apart from self-acclaimed moral police trolls, several women have also complained of fashion police trolls who intentionally data mine and troll women, whose fashion sense according to the trolls is not upto the mark. Unlike the moral police trolls, the fashion police trolls  may not create security or life risking threats, but they may definitely target the reputation of the victims and  their self-esteem. 


Now let us see what sorts of harm or damage can be done by both types of trolls:

trolling can creation of threat, intimidation

trolls necessarily create posts which are defamatory; these can be teasing remarks  and extremely  insulting comments

trolling can result in reputation damage, violation of privacy, unauthorised access to data, copyright violation (in certain cases)


Trolls are necessarily bullies. But bullying and trolling are not the same. Trolling can be more vicious than bullying. Trolling infact attracts more perpetrators and more victims in the same thread. These victims and perpetrators may not be known to  each other  previously; resultant, the new “victims” who may have joined the thread to support or disagree with the primary victim  may finally put all blames to the primary victim for the victimisation by way of trolling. Trolling is more public than bullying. As such the effects of trolling may be more traumatising than bullying. Trolling can not only damage reputation of the primary victims, trolls may go a long way to harass cyber bystanders or commenters who may support or disagree with the victims as well as with the trolls. The situation worsens if these bystanders or commenters are women; trolls may threaten these secondary victims with legal consequences (for aggravating the issues) which may force the latter to withdraw from social media just like the primary victims.

This may adversely affect women’s usage of Instagram : Instagram unlike Facebook may instantly help the user to get connected with people/group with common interest especially when the user uses the hashtags. The pictures/videos armed with hashtags may help the user to reach a wider audience. Several people including women aspiring to showcase their creativity in fashion industry, upcoming models, actors singers, anchors, performers etc, who use the platform for getting connected with the industry people, mentors and a wider audience, may suffer hugely if trolls attack them on Instagram. Victims may not only feel completely withdrawn, they may also be pulled into unnecessary legal tangles especially if the trolls misuse their pictures which may have been uploaded by the victims for promoting certain brands (which in turn may not appreciate such negative publicity of their product).

        But this in no way should mean that women should restrain from uploading pictures on Instagram. There are several ways to protect the privacy, reputation and the copyright of the pictures of the users :

1.  Women and girls should always opt for privacy options in Instagram. This may reduce the responsibility of the users and increase that of the website. The victims may directly charge the websites for not applying due diligence and  neglecting the security features which should have restricted unwanted people from infringing the privacy and copyrights. Further, in case the women wish to make the profiles open for public and had been harassed/trolled/stalked/unauthorisedly accessed etc, the victims must report the matter to the websites. The websites would not be letting the victim know the about the original identity of the harasser in case the profile is that of unknown person/s; but they would be duty bound to repair the damage, i.e. , restrict the unauthorised circulation of the image of the victim and generating anymore message that may harm the reputation of the victims. S.79(3) of the Information technology Act, 2000(amended in 2008) (exceptions to exemption from liability of intermediary in certain cases)  may be applied in such cases.

2.  Indian laws do not recognise online trolling and bullying as separate offences. This definitely had created problems for proper justice delivery to the victims. However, basing on the modus operandi for trolling several penal provisions may be applied; for instance, S.509 (punishment for harming the modesty of women), 507 (criminal intimidation by anonymous person), 499 and 500 (defamation and punishment for the same), 354D (punishment for stalking including cyber stalking) of the IPC may be used for posting intimidating, insulting, defamatory comments, stalking, creating threats etc.

3.  If trolling results in creation of Fake avatars especially sexually explicit contents, obscene contents etc, and if this involves unauthorised access to data, manipulation of data etc, the police may also apply provisions including Ss. 43(unauthorized access to the computer, data etc) 66 (punishment for computer related offences), 66C (punishment for fraudulently using password, unique identification features etc of any other person), 66D (punishment for cheating by impersonation), 66E (violation of privacy)(incase the picture has been used to create morphed pictures/images), 67 (punishment for creating sexually explicit contents), 67A (punishment for creating obscene contents ) of the Information technology Act, 2000(amended in 2008), S.354C IPC(punishment for voyeurism) etc. Police may also necessarily apply provisions from Indecent representation of women (prohibition )Act, 1986 for indicting the accused for indecent representation of the victim online.

Some of the above mentioned laws are non bailable and cognizable. This means that trolling may not be considered as a simple offence especially if it results in heavy offences including creation of sexually explicit contents ( the contents include not only the images, but the texts as well) etc. As such, women should not refrain from using Instagram fearing trolling. But they must be aware of their rights against trolling and the duties of the websites.

Let us unite against misogynist trolling. Let us spread the message that trolling, its modus operandi and its consequences should not be taken lightly and the criminal justice machinery must emphasise with the victims of trolling.

  
 Please Note: Do not violate copyright of this blog. If you would like to use informations provided in this blog for your own assignment/writeup/project/blog/article, please cite it as “Halder D. (2018), " Trolling on Instagram photos: should women restrain from uploading personal pictures?” 15th January, 2019, published in http://debaraticyberspace.blogspot.com


Sunday, October 21, 2018

Need for a model prohibitory provision for preventing and punishing Cybercrimes targeting women

CYBER CRIME AGAINST WOMEN BY DEBARATI HALDER



The festive seasons not only bring joy and happiness, but also brings tinges of tensions, disappointment, frustrations and unnecessary worries especially for women and girls. This is because of the negative use of digital and information technology; women and girls may be photographed inappropriately, touched inappropriately and may be photographed in such conditions, they may be stalked, their data may be unauthorisedly accessed and misused and over all, they may also be targeted for revenge porn. It may generally happen even during non-festive seasons too. But during the festive seasons such off-line and online harassment targeting women may increase more. In my previous research I have observed that this may happen due to two main reasons : lack of strict central laws relating to public place photography and engagement of the police force in crowd management. It may necessarily become almost impossible to protect every woman and girl in the crowds from the perpetrators who may be digitally empowered to violet the privacy.  The second reason plays a major role in motivating the perpetrators to take the harassment of women and girls online so that victims may not be able to understand the impact of victimisation immediately; simultaneously the perpetrators may not only satisfy their sadistic ego by harassing women and girls online, but may also gain unethically by  supplying the voyeur pictures and clippings to adult sites and even to YouTube. By the time  the victims understand and feel the impact of victimisation, their reputation may have been badly damaged due to viral spreading of the images.  
A year back the ministry of women and children rolled out project for portal to complain about online harassment. But this could neither reduce the alarming growth of online victimisation of women. The reason could be ill drafted laws and poor execution of the existing laws. These ill drafted laws may include S.66A of the Information Technology Act, 2000(amended in 2008) which prescribed punishment for offensive, annoying etc speech, which was later scrapped off in the case of Shreya Singhal vs Union of india & others (however, the Information Technology Act has not been amended so far to either amend or delete this provision from the present version of the Provision); Ss. 354 C and D of the Indian Penal Code which speaks about voyeurism and cyber stalking, S.509 of the Indian Penal Code which speaks about word gesture etc about harming the modesty of women etc.[1] I have also created a model law for penalising revenge porn and had submitted the same to the ministry of women and child affairs.[2] However, no step has been taken on this so far even though revenge porn does exist in the Indian cyber space context as well.
It needs to be noted that the internet has provided a broader platform for expressing views and opinions and women are using it share their opinion on various issues including sexual harassment that may have been meted out to them through Me too movement. But this would definitely have another side of the coin. Many women may prefer to bring up the issue of sexual harassment on public platforms through social media; but the accused persons may neither leave these victims on the cyber space. They may try to counter attack them through trolls, bullies and hired-hackers who may try to vandalise the victims reputations online by infringing the digital privacy of the Me Too fighters. This in other ways may also affect the documentary evidences that the victim/s may have saved in their electronic devices for further court proceedings.
At this juncture It is time that  the existing law must be amended to include provisions for offensive communication and revenge porn. On behalf of Centre for Cyber Victim Counselling a  draft model Law  is proposed as below:

Model law for prohibiting Cybercrime against women

Chapter 1 : preliminary
S.1 Extent and purpose:
It extends to the whole of India.
It has been seen that even though Criminal Law Amendment Act, 2013 has introduced several new provisions for the safety of women, but still there exists lacuna. Further, the Information technology Act, 2000 (amended in 2008) also failed to prevent crimes against women which include cyber bullying, trolling and revenge porn.
In view of the above, this model law is proposed to bring amendment to (a) the present provisions especially in the Indian penal Code (specifically in Ss. 354 C & D) and insert new provision for prohibiting and punishing revenge porn, (b) amend and introduce new version of S.66A to create preventive law to prevent offensive communication including bullying, trolling, online harassment etc against women and individuals in general, (c) to introduce special provision in the Information technology Act, 2000 (amended in 2008) to provide confidentiality to the victims.
Chapter 2 : Proposed amendments
S.2 Insertion of a new provision on Revenge porn:[3]
The model Revenge porn prohibitory provision :(This can be included in Chapter XVI of the Indian Penal Code as S.354E, which may be inserted after S.354D (stalking)).

1.    Anyone, who in order to satisfy his anger and frustration for a broken relationship, takes revenge  through publishing, transmitting, conveying, publicizing false and sexually provocative portrayal of his/her victim, by misusing the information that he may have known naturally and that he may have stored in his personal computer, or that which may have been conveyed to his electronic device by the victim herself, or may have been stored in the device with the consent of the victim herself; and which may have been done to publicly defame the victim essentially, commits the offence of revenge porn.

2.    Whoever commits the offence of revenge porn, shall be punished in the first conviction with imprisonment of either description for a term which shall not be less than one year, but which may extend to three years, and shall also be liable to fine of not less than 1 lakh rupees and pay reasonable compensation to the victim for damaging his/her reputation in real life and online. If he be punished on a second or subsequent conviction, he shall be punished with imprisonment of either description for a term which shall not be less than three years, but which may extend to seven years, and shall also be liable to fine of not less than 5 lakh Rupees and reasonable compensation to the victim.

 Provided that the perpetrator must also be liable to remove the offensive image either original or morphed, irrespective of the fact whether the image was conveyed to him by the victim herself or not, from his own electronic device/s and from the websites and social media profiles where he may have uploaded the same for the purpose of taking revenge.

Provided further, that the investigating officer shall immediately after coming to know of the offence of revenge porn committed by the perpetrator as reported by the victim or anyone on behalf of the victim, contact the concerned website to remove such contents including any text accompanying the image/s which may falsely portray the victim.
Provided further that if the website concerned fails to cooperate with the police on being alerted by the investigating police officer and also if the website concerned fails to remove the content within 36 hours  after being alerted by the victim herself, the said website would not be exempted from third party liability as has been explained under S.79 of the Information Technology Act, 2000 (amended in 2008) and would be liable to pay compensation to the victim for an amount not less than Rs. 5 lakhs and also fine.

Explanation:

In Subsection 1, the words “publishing, transmitting, conveying, publicizing false and  sexually provocative portrayal of his/her victim” shall include  publishing, transmitting, conveying  any image of woman whether nude, semi-nude or normal to anyone individual and/or to any website including social media, with an intention to take revenge on that said woman.

(Rationale behind proposing a new law: Why S.354C IPC would not be able to regulate revenge porn:

1.    S.354C IPC speaks about voyeurism which is inclusive of “private acts” whereby victim’s private body parts may be shown. It does not mention anything about publishing/conveying/morphing etc of pictures of women for taking revenge. The ultimate motive, i.e., taking revenge is absent here.

2. S.354C does not speak about morphed pictures published/conveyed/transferred etc for gratifying revenge. In cases of revenge porn, majority of the offensive images may be morphed. This has neither been covered under S.66E of the Information Technology Act.

3.    Creation of revenge porn may be done with normal, innocent, un-morphed pictures as well. In such case, we need to look into the accompanying text that describes the image. For example, a normal picture of the woman victim may be published with a text describing her as “horny”, “Prostitute”, “my sexy wife during honeymoon”(when in reality, the woman is not married to the perpetrator, or even if married, did not allow publication of such normal photo with such text ).

4.    Revenge porn differs from non-consensual pornography as well. Non-consensual pornography is a larger term which may include revenge porn, voyeurism or even sexual slavery including forcing the woman to be captured naked for some unethical gain. Hence, revenge porn needs a separate definition.)

S.3.  Amendment to the definition of voyeurism under S.354C of the Indian Penal Code (punishment for voyeurism) : In the place of “Any man”, it should  Any one and the amended provision should be  read as follows:
Any one who watches, or captures the image of a woman engaging in a private act in circumstances where she would usually have the expectation of not being observed either by the perpetrator or by any other person at the behest of the perpetrator or disseminates such image shall be punished on first conviction with imprisonment of either description for a term which shall not be less than one year, but which may extend to three years, and shall also be liable to fine, and be punished on a second or subsequent conviction, with imprisonment of either description for a term which shall not be less than three years, but which may extend to seven years, and shall also be liable to fine.
Explanations:   For the purpose of this section, “private act” includes an act of watching carried out in a place which, in the circumstances, would reasonably be expected to provide privacy and where the victim’s genitals, posterior or breasts are exposed or covered only in underwear; or the victim is using a lavatory; or the victim is doing a sexual act that is not of a kind ordinarily done in public.
  
Where the victim consents to the capture of the images or any act, but not to their dissemination to third persons and where such image or act is disseminated, such dissemination shall be considered an offence under this section.

S.4. Amendment to S.354D of the Indian Penal Code (punishment for stalking including cyber stalking): In the place of Any man, it should be anyone. The amended version should be read as follows:
1) Anyone who—
   follows a woman and contacts, or attempts to contact such woman to foster personal interaction repeatedly despite a clear indication of disinterest by such woman; or
   monitors the use by a woman of the internet, email or any other form of electronic communication,commits the offence of stalking;
 Provided that such conduct shall not amount to stalking if the man who pursued it proves that—

it was pursued for the purpose of preventing or detecting crime and the man accused of stalking had been entrusted with the responsibility of prevention and detection of crime by the State; or
  
it was pursued under any law or to comply with any condition or requirement imposed by any person under any law; or
  
in the particular circumstances such conduct was reasonable and justified.
 (2) Whoever commits the offence of stalking shall be punished on first conviction with imprisonment of either description for a term which may extend to three years, and shall also be liable to fine; and be punished on a second or subsequent conviction, with imprisonment of either description for a term which may extend to five years, and shall also be liable to fine.

(Rationale behind broadening the concept of perpetrator for Ss.354 C&D: It has been seen that women may also commit voyeurism and cyber stalking for victimising fellow women.  This amendment may help reduce such sorts of victimisation.)

S.5. Insertion of new provision prohibiting photography of individuals in general without the consent of the individuals concerned (this may be inserted after S.268 of the Indian penal Code as S.268A)
1. Anyone who uses his camera devices in any public place to capture the images of anyone including men, women, children, people belonging to LGBT groups, with a motive to either sexual gratification of the self, or sexual gratification of others, or uses these images for unethical gain, or for ridiculing or causing hatred,  defamation , damage to the reputation of the said persons by way creating, circulating, spreading etc of such images through electronic medium  without the consent of  such men, women, children  or member of LGBT group when the said men, women, children, or member of LGBT group are  not expected to give consent and/or not expected to be alert for not allowing such photography,  and also publishes, transmits, circulates the same through electronic medium shall be punished with an imprisonment  of either description for a term which shall not be less than six months r, but which may extend to one year , and shall also be liable to fine of not less than 20 thousand  rupees and pay reasonable compensation to the victim for damaging his/her reputation in real life and online. If he be punished on a second or subsequent conviction, he shall be punished with imprisonment of either description for a term which shall not be less than one  year, but which may extend to three years, and shall also be liable to fine of not less than 50 thousand Rupees and reasonable compensation to the victim.

 Provided that the perpetrator must also be liable to remove the non-consensual offensive image either original or morphed, from his own electronic device/s and from the websites and social media profiles where he may have uploaded the same for the purpose mentioned above.

Provided further, that the investigating officer shall immediately after coming to know of the offence mentioned above committed by the perpetrator as reported by the victim or anyone on behalf of the victim, contact the concerned website to remove such contents including any text accompanying the image/s which may falsely portray the victim.
Provided further that if the website concerned fails to cooperate with the police on being alerted by the investigating police officer and also if the website concerned fails to remove the content within 36 hours  after being alerted by the victim herself, the said website would not be exempted from third party liability as has been explained under S.79 of the Information Technology Act, 2000 (amended in 2008) and would be liable to pay compensation to the victim for an amount not less than Rs. 5 lakhs and also fine.

Explanation:

In Subsection 1, the words “capture images” shall also include  capturing images of accident victims and doing so without offering any help to the victim, any other heinous, serious or petty crimes and doing so without reporting the matter to the police and offering help to the victim, capturing images of  rape or sexual molestation or sexual assault of any women or children, taking self portraits or selfies in the above situations.
Explanation 2: The act of capturing the images of men, women, children and members of the LGBT groups may not be considered as an offence if the same is done for academic and research purposes, provided the person/s capturing such images has prior consent of proper authorities, or for medical research purposes or for the purpose of creating documentary evidences which must be provided to the criminal justice machinery including the courts for further legal actions to punish the wrong doers.


S.6. Amendment to Information Technology Act, 2000(amended in 2008):

Punishment for offensive speech (this can be inserted after S.66 (offences related to the computer) of the Information Technology Act, 2000 (amended in 2008). This may also be considered as the amended version of S.66A (punishment for annoying etc speech), which was scrapped off by the Supreme court in Shreya Singhal’s case)
1.      Anyone who sends, posts produces, publishes, creates, circulates or sponsors to be circulates  any offensive speech including any text or cartoon or caricature or image accompanied with text to any woman by way of electronic, digital and information communication, which may damage her reputation, damage the reputation of her family and  children create threat to her, her family and children, damage her reputation to an extent that may affect her job or may affect her reputation in the prospective job, shall be punished with an imprisonment for in the first conviction with imprisonment of either description for a term which shall not be less than one year, but which may extend to three years, and shall also be liable to fine of not less than 1 lakh rupees and pay reasonable compensation to the victim for damaging his/her reputation in real life and online. If he be punished on a second or subsequent conviction, he shall be punished with imprisonment of either description for a term which shall not be less than three years, but which may extend to seven years, and shall also be liable to fine of not less than 5 lakh Rupees and reasonable compensation to the victim.

 Provided that the perpetrator must also be liable to remove the offensive speech from his own electronic device/s and from the websites and social media profiles where he may have published etc the said speech targeting the woman.

Provided further, that the investigating officer shall immediately after coming to know of the offence of posting, publishing etc of the offensive speech committed by the perpetrator as reported by the victim or anyone on behalf of the victim, contact the concerned website to remove such contents including any text accompanying the image/s which may falsely portray the victim and damage her reputation.

Provided further that if the website concerned fails to cooperate with the police on being alerted by the investigating police officer and also if the website concerned fails to remove the content within 36 hours  after being alerted by the victim herself, the said website would not be exempted from third party liability as has been explained under S.79 of the Information Technology Act, 2000 (amended in 2008) and would be liable to pay compensation to the victim for an amount not less than Rs. 5 lakhs and also fine.

Explanation:
For the purpose of this section, offensive speech targeting women shall include the followings:
1.      Any speech which lowers the moral character of the woman concerned within the meaning of Article 19(2) of the constitution of India.
2.    Any speech which defames the woman concerned in the society as a whole within the meaning of Article 19(2) of the constitution of India as well as Ss.499 and 500 of the Indian Penal Code and Indecent representation of women Prohibition Act.
3.    Any speech which includes Cyber bullying. Cyber bullying  may mean attacking anyone with harsh or rude  words in the cyber space, including publicly available web platforms, social media, private and public  chat rooms, emails, blogs etc, and such harsh or rude words are particularly made to ridicule one’s body shape, gender, gender orientation, physical or mental incapability, race, colour, opinion, educational background, language  etc.
4.    Any speech which includes Cyber trolling. Cyber trolling is  an extreme usage of freedom of speech which is exercised to disrupt the community discussions in social networking sites and which is done to deliberately insult ideologies such as feminism, secularism etc; of the topic starter or the supporters of the topic starter.
5.     Any speech which contains Cyber hate propaganda. Cyber hate propaganda may mean offensive communication between the sender and multiple recipients with intent to spread hatred against a particular individual for her opinion, race, gender etc.

It is expected that if this model Act is considered by the government, the growing rate of cyber crimes against women may be brought down.

Please Note: Do not violate copyright of this blog. If you would like to use informations provided in this blog for your own assignment/writeup/project/blog/article, please cite it as “Halder D. (2018), " Need for a model prohibitory provision for preventing and punishing Cybercrimes targeting women”  22nd October 2018 , published in http://debaraticyberspace.blogspot.com


[1] My observations on these laws can be found in my book. (Cyber Crimes against Women in India. New Delhi: SAGE Publishing. ISBN: 978-9385985775, https://in.sagepub.com/en-in/sas/cyber-crimes-against-women-in-india/book253900  (co-authored with Professor K.Jaishankar.
[2] See the model law @Halder.D(2017) Criminalizing Revenge Porn From The Privacy Aspects: The Model Revenge Porn Prohibitory Provision. Available @
[3] This was published in supra@2

Saturday, September 29, 2018

The great Facebook hack: Liability of Facebook as service provider

CYBER CRIME AGAINST WOMEN BY DEBARATI HALDER


Photo curtsy: Google

By the late evening of 28th September, 2018 almost all of Facebook users would have received messages in their electronic devices that their “session expired”. It indicated that the subscriber needs to log in again to continue the Facebook activities. Many of the users felt it was a hoax, many felt it was a hackers act and some could understand it was an alert alarm as they were always ‘online’ and never logged off even when their phones were ‘sleeping’ or switched off. By late night-early morning on 29th September, 2018 the Facebook subscribers got an official information from Facebook help center stating that the company had discovered that there was an attack on their system and the attackers had illegally accessed Facebook access tokens which would give way to access the subscribers’ data. On an emergency precautionary step, Facebook logged off all users so that they can log on again with a secured code provided by Facebook. It was confirmed that Facebook was trying to exercise due diligence to protect the data of the users and in the course of the same users were directed to log off.
Due diligence has been addressed by  S.512 © of the Digital Millennium Copyright Act, 1998 which indicates that the intermediary may be saved from third party liabilities (especially for copyright infringements) if  the intermediary practiced due diligence, i.e., it   did not have the requisite level of information about the said infringement, it must not have been financially benefited from such infringement, it must have taken expeditious measures to take down the content concerned or block the access to the material concerned upon receiving the information of the infringement. The same has also been addressed by S.79 (3) of the Information Technology Act, 2000 (amended in 2008) and has been further explained in Information Technology intermediary guidelines Rules, 2011 whereby the term cyber security incident has been defined as follows:
Rule .2(d) "Cyber security incident” means any real or suspected adverse
event in relation to cyber security that violates an explicit or implicity
applicable security policy resulting in unauthorised access, denial of
service or disruption, unauthorised use of a computer resource for
processing or storage of information or changes to data, information
without authorisation;

The rules further goes on to explain what are the due diligence practices that should be adopted by the intermediary under Rule.3(3), which states that  The intermediary shall not knowingly host or publish any information or shall not initiate the transmission, select the receiver of transmission, and select or modify the information contained in the transmission as specified in sub-rule (2):
Interestingly Rule. 4 of the Intermediary Guidelines Rule further provides a clear direction to the intermediaries as what is to be done and within how much time when the intermediary has come to know about any information which harms the interest of users or threatens the security of the nation etc (which are mentioned in rule 3), by stating that The intermediary, on whose computer system the information is stored or hosted or published, upon obtaining knowledge by itself or been brought to actual knowledge by an affected person in writing or through email signed with electronic signature about any such information as mentioned in sub-rule (2) above, shall act within thirty six hours and where applicable, work with user or owner of such information to disable such information that is in contravention of sub-rule (2). Further the intermediary shall preserve such information and associated records for at least ninety days for investigation purposes.
This Rule 4 (read with Rule 3) mentions that the intermediary should either remove the offensive content or block the access to the content. Facebook in its action in practicing due diligence and exercising reasonable security practices (in India, the guiding principle in this regard is mentioned in the Information Technology (Reasonable security practices and procedures and sensitive personal data or information) Rules, 2011), had alerted the users, logged them off and logged them in with fresh code and also expressed that they are not aware whether any individual has been affected by such unauthorised access to the Facebook system as a whole.
By doing this Facebook actually tried to escape its liability as a ‘negligent body corporate’ or a company which may be brought to the courts under S.43A of the Information Technology Act, 2000(amended in 2008). Compare the incident of Facebook- Cambridge analytica data breach and how the EU parliament addressed the issue by accusing Facebook for having extremely poor cyber security measures compared to Europe. Facebook users were also advised by an Illinois court to go for a class suit against the company (Facebook) for unethically scanning and storing personal photos and information of the users.[1] The recent news also suggests that in the US Facebook users have started going for class actions against Facebook for data breach which occurred apparently because of  the company’s negligence in securing the data.[2] Under the Indian information technology Act, 2000(amended in 2008), S.43A empowers the victims of privacy (including data ) breach to claim compensation from the faulting body corporate to a maximum limit of Rs. 5 Crores, which however is subject to modification depending upon the damage suffered by the victims, reputation harm etc and the discretion of the adjudicator. Not many users have applied this law for bringing big companies under the Indian scanners. There are however some cases of bank’s liability or hospital managements liability which are now coming up because of the awareness among the users/data owners and their lawyers.
However, web companies like Google, Facebook etc may have another option to shred the liability: they may always shift the major burden to the data owners or data managers, i.e. the private individuals who upload data almost every minute in average to expose their private information.[3] It is for this that we need to be vigilant on our own practices of data sharing.
Stay safe, play safe.
Please Note: Do not violate copyright of this blog. If you would like to use informations provided in this blog for your own assignment/writeup/project/blog/article, please cite it as “Halder D. (2018), " The great Facebook hack : Liability of Facebook as service provider”  30th September, 2019 , published in http://debaraticyberspace.blogspot.com







[1] See Halder Debarati (2018), FB, Its content regulation policies & photo matching tech: boon or bane for Indian women from privacy law aspect. Published in LiveLaw on April, 20018 @https://www.livelaw.in/fb-its-content-regulation-policies-photo-matching-tech-boon-or-bane-for-indian-women-from-privacy-law-aspects/
[2] See for instance, see Knoop Joseph (2018), Facebook sued over data breach that involved 50 million accounts . available @ https://www.dailydot.com/layer8/facebook-breach-lawsuit/
[3] For better understanding about this see Halder & Jaishankar ((November 2016). Cyber Crime against Women in India. New Delhi: SAGE. ISBN: 978-93-859857-7-5.

Sunday, September 2, 2018

5 key factors about hacking and the laws

CYBER CRIME AGAINST WOMEN BY DEBARATI HALDER

Photo curtsy: Google 

Hacking is undoubtedly one of the worst issues that one wants to deals with. Often I get to see women complaining about hacking of their social media accounts, people including men and women fearing about and getting victimized by way of hacking of their email accounts , net banking profiles and overall, the computer devices. New netizens are more prone to getting victimized by hacking; so are their parents if these netizens are pre-teens or teenagers. It is important to know some key factors which are associated with hacking. These are as below:
The five key factors which everyone should know about hacking:
1.    The term hacking is not defined in any uniform style. Different researchers have defined hacking in different ways. All most all academic definitions have indicated that computer hacking or cyber hacking may mean unauthorized access to the computer, computer data etc, changing the data without any authorization etc. In a way, it is directly related to unauthorized data privacy infringement. A ‘smart’ example could be the allegedly unauthorized access into the personal documents including bank access details of the TRAI chief by the ethical hackers when the TRAI chief threw challenge that  ADHAR ‘hack proof’.[1]
2.    Indian laws especially Information Technology Act, 2000 (amended in 2008) does not address the issue as “hacking”. The issue is dealt with by not one, but three Sections, namely, Ss. 65 which prescribes punishment for tampering with computer source documents, 66, which prescribes punishment for computer related offences and 43, which speaks about Penalty and compensation for damage to computer, computer system etc.
3.    Hacking may literally start with unauthorized access or securing to the computer, computer system, computer network etc. Accessing or ‘securing access’ can be done by various ways. This may also include giving way to the hackers by opening suspicious mails/messages or links. It is for this reason that new users of internet and digital technology must be extremely cautious while opening suspicious mails/links etc.
4.    Hacking may also include downloading/extracting data etc, modifying such data, reproducing that data in an altered form etc. It may also include unauthorized access to the computer or computer system or data etc and infecting the same with viruses which will immediately or gradually destroy all data, software etc stored in the computer and computer system. Hacking may necessarily include unauthorized accessing and then using of the computer network, email id, phone number or social media profile for impersonating and unethical gain. It is for this reason that often people complaint about hacking when their accounts have been unauthorisedly accessed, data extracted/accessed and modified and email ID/social media profiles etc are used for impersonating by way of a fake avatar.
5.    Hacking may also involve denial of services, which is why a computer or computer system  thus affected may not get connected to the internet easily and according to the wish of the real owner of the computer or computer system etc, but according to the wishes of the hacker only.
Now you may understand that when your computer shows activities which are not generally expected, you must be alarmed that your computer or the computer network or the computer system has been affected by hacking : typically your device may slow down for no reason, you may start getting to see that the data is altered, your net banking account or email or social media account’s password and username and the related phone number and email id may get changed without your authorization, your documents including your photo may get published or circulated elsewhere without your knowledge. Most scary of these is the camera device of your phone or laptop or Ipad (when they are on switch on mode) etc may become active even when you are not using the camera. It is for this reason that  cyber security experts suggest to not to use the electronic devices when one expects complete privacy from the outside world, like when one is in the washroom.

So, what about the punishment?
Do Indian laws address hacking as “hacking” ? The answer is NO.  But this does not mean that the act of hacking is not punishable.  As discussed above, when the constituting elements mentioned under points nos 3, 4 and 5 create unauthorized access to the computer, computer system,  data etc, Sections 65, 66 and 43 may immediately be applicable for booking the offences for tampering the computer source code, computer related offences and damage to the computer  system etc. As such there are two types of punishments that are prescribed for hacking related offences : punishment as per civil offences which are regulated by S.43 and punishments as per criminal nature of the offence, which are regulated by Ss. 65 and 66. In the later, the punishments may include imprisonment for a period upto three years  and/or fine which may extend to Rs. two lakhs. In case S.66 is applied, then the fine amount increases upto Rs. 5 lakhs. Again, if the act of hacking is judged as per S.43, then the provision would be read with S. 45 of the Information technology Act, which indicates that, a maximum of Rs. 25, 000/ may be paid as compensation to the victim for such offences (this is especially so because S.43 does not mention any specific amount of compensation and this lacuna is filled by S.45 which prescribes residuary penalty).  However, the recent trend may show that most of hacking related cases had been booked under Ss. 66, 65 and 43 so that the perpetrators may undergo jail term as well as are bound to pay fine.
Interestingly, the Information Technology Act does not restrict the criminal liability to a specific age as is seen in the Indian penal code. Hence, even if it is a computer genius as young as 10 or 12 years of age, he/she may not escape the clutches of law in case he/she has done the offence/s which may constitute hacking. Considering their age and maturity level, Juvenile Justice  (care and protection) Act , 2015 may also be applicable.  Again, this would NOT mean that parents would be considered completely innocent. Very recently the courts in Gujarat had made the parents liable for underage kids driving two and four wheelers.  If the children are arrested, the parents may have to pay for negligence in monitoring the wrong doing of their children.
I end this piece with a positive note: if we adults are aware, then our children will also be aware and we can prevent the digital as well as real life privacy infringement in a swift way.

Please Note: Do not violate copyright of this blog. If you would like to use informations provided in this blog for your own assignment/writeup/project/blog/article, please cite it as “Halder D. (2018), " 5 key factors  about hacking and the laws”  3rd September, published in http://debaraticyberspace.blogspot.com



[1] See Rachel Chitra(2018), Hackers deposit Re 1 in Trai chief's account. Published in https://timesofindia.indiatimes.com/india/hackers-deposit-re-1-in-trai-chiefs-account/articleshow/65190556.cms on 30/07/2018