Category: Cyber Law

Cyber Law

Understanding the legal meaning of “originator” under Information Technology Act, 2000(amended in 2008) by Dr.Debarati Halder

Image owned by Debarati halder

While scrolling my Instagram in a lazy Sunday morning in late august in 2025, I came across this sad news of a new father carrying his dead new born child to the office of the District Magistrate in a remote place in northern India because he wanted justice for the medical negligence shown to his pregnant wife; due to which their new born baby died. Someone had taken the video of his meeting the official which had become “viral”. The man was able to convince the administration and the audience (of online content) about his ordeal and the administration had taken swift action against the concerned hospital.

Who is an originator?

Who created this content? Who uploaded this content? Can he be rewarded for public service for making us all understand how access to medical services is still a distant dream for many women in India? Which this may make us think about ‘whistle blowing’ and genuine reporting, I wanted to emphasize on the this to explain who is an originator in the present context.

S.2(za) of the Information Technology Act, 2000(amended in 2008) defines the term originator as a person who

(i) sends, generates, stores or transmits any electronic message, or

(ii) causes any electronic message to be sent, generated, stored or transmitted to any other person,

This clause very categorically excludes intermediary from the concept of originator.

As may be seen above, originator may necessarily include a ‘person’, whether a biological person or a juridical person ( which includes any organization, Nation, government etc, represented by authorized human being). If we now see the above incident of capturing the sad moment in camera, uploading the same in the social media platform and sharing the same worldwide through his/her authorized and lawfully possessed account, we may understand that the first person who recorded the same may be the first originator of the content. Let us again see S.2(ZA) of the Information Technology Act, 2000(amended in 2008) : it says if any one generates any content or stores the content (electronic message) or causes to do the same, he may be considered as an originator as well.

Are  ‘originator ‘ and ‘sender’  same?

But here one issue may rise doubts about the literal meaning of “originator: whether the term applies for one who generates or stores electronic message (which may be perceived as content) ? or , whether originator is also one who generates, stores or even transmits or causes to do all these?

I have seen in many instances many practitioners, students and common people who may want to understand their rights, may get extremely confused in this regard. If we go by literal rule of interpretation, does one who originates and stores the message or content (which may be offensive), have to take the responsibility and liability as that of the ‘sender’ who transmits the messages to the addressee or the recipient?  In some understandings like shifting liability to the ‘senders’ in WhatsApp messages whereby the recipients/addresses may get victimized due to such ‘sending’ , the former may be termed as originators because he may originate/curate/store the message and then send the same with a knowledge that such content may affect the addressee. But what about the person who originates and stores the content, but does not send the same?   Here, we may apply both Literal Rule of interpretation and Doctrine of harmonious construction which may provide a holistic interpretation to resolve the conflict. A person who may generate any content and stores it, may do so illegally as well if he generates the content without proper permission like generating child sexual abuse contents by capturing real-life child sexual abuse incidences and storing the same with an intention for self-gratification. But not to forget, the content is stored in an electronic device which may be unauthorisedly accessed: hence, he may have to take the responsibility of not only originating an illegal content, but also the responsibility of ‘sending’/ transmitting’ the illegal content which may have more harmful effect than merely generating and storing the content.  

The draftsmen therefore created the concept of ‘originator’ under S.2(ZA) of the information technology Act, 2000(amended in 2008) from a predictive perspective which will attract the liability of a sender to the originator as well. Clearly, this is evident from S.11 of the Information Technology Act, 2000(amended in 2008) where the provision explains about attribution of electronic records by stating

An electronic record shall be attributed to the originator if

  • It was sent by the originator himself
  • The said electronic record was sent by any authorized person on behalf of the originator
  •  The electronic record was sent by an information system that programmed by or on behalf of the originator to operate automatically.

It is for this reason that every user of digital communication technology must be extremely careful about what is being generated and stored by him and what is being sent by him.

Stay safe, stay aware!

Please note: If you want to share /use the write-up for your work, please cite it as Halder Debarati (2025), Understanding the legal meaning of originator under Information Technology Act, 2000(amended in 2008). Published in https://internetlegalstudies.com/2025/08/24/understanding-the-legal-meaning-of-originator-under-information-technology-act-2000amended-in-2008-by-dr-debarati-halder/ on 24-08-2025

cyber crime against women, Cyber Law

Parties to digital communication: Know who is the addressee and whether she is a victim too. By Dr.Debarati Halder

Image owned by Debarati Halder

Introduction

Often we get to hear about digital arrest, stalking, workplace sexual harassment related communication, online bomb hoax and so on. If we analyse the nature of the above mentioned offences, we may see some are targeted to specific individuals (like threatening or hurling intimidating comments, bullying), some are targeted towards the State (consider bomb hoax cases where the sender generally shares information about places where bomb is kept or place which may fall within the vicinity of the bomb blast). If we look at the communications thus received, we may see that the recipient is the victim and the sender is the accused. But this does not mean that it is only the sender who may be considered as the sole accused or the recipient is the only victim. Criminal cases on offensive digital communication may often fail due to huge lack of understanding about the concepts of recipients and senders and the other concerned stakeholders in this regard.

Let us now analyse two case studies:

  1. In April, 2025 Thiruvananthapuram airport received bomb threat via email. Reportedly several hotels in Kerala, a popular tourist destination for its natural scenic beauty in the south western coastal region in India, received emails containing bomb threats.
  2. In  a news report published in August, 2025, Mumbai police rescued  a 61 year old woman who was reportedly subjected to digital arrest and transferred large sums of money to fraudsters.

The recipient in the first case was the airport. In the second case, the woman is the recipient of communications that made her to believe that if she does not transfer the amount, she would be in legal trouble. While in the latter case,    the victim is a single female recipient, in the former, the mail would have been received by an individual who may have been handling the official mail id of the airport, which is a government entity. But in this case, the individual who opened the mail and read the mail is not the actual recipient. As the mail was received by the airport authorities in its official email id, legally, the recipient would be the Thiruvananthapuram airport authority.

Addressee as explained by Information Technology Act, 2000(amended by 2008)

Who now becomes the addressee- ‘victim’? a clear reading of S.2(b) of the Information Technology Act, 2000(amended in 2008) would clear doubts in this regard.

This provision defines the term addressee in the following words:

“Addressee means a person who is intended by the originator to receive the electronic record but does not include any intermediary.”

Essentially the origin of the concept of addressee here can be attributed to Indian Contract Act, 1872 which throws light on completion of communication of a proposal under S.4 : it says

The communication of a proposal is complete when it comes to the knowledge of the person to whom it is made. The communication of an acceptance is complete, — as against the proposer, when it is put in a course of transmission to him, so as to be out of the power of the acceptor; as against the acceptor, when it comes to the knowledge of the proposer.  The communication of a revocation is complete, — as against the person who makes it, when it is put into a course of transmission to the person to whom it is made, so as to be out of the power of the person who makes it; as against the person to whom it is made, when it comes to his knowledge.

The acceptor is the one who receives the communication and has authority to act upon the acceptance or rejection of the proposal made through the communication. This “acceptor” is the recipient and the addressee of the communication.

The term “Addressee” under the S2(b) of the Information Communication Act (Amended in 2008) shall therefore include the direct recipient who can take action on the communication him/herself, or the recipient who may act on the communication on behalf of the organization as he may have been authorized to take any decision. Addressee also necessarily include the organization that has received the communication through its email address or any other communication handle that are operated by authorized stakeholder.

Noticeably, intermediary would not be considered as an addressee even though it provides services to receive, store send messages on electronic platforms.

When addressee becomes a victim?

Addressee therefore can become a victim of offensive communication if the said communication carries threat, hatred, intimidation, misleading or fraudulent in nature or is a part of defamatory statement. Addressee him/her/itself  can also have locus standi in the courts for seeking justice if the communication falls within the parameter of offensive communication.  In cases where the addressee is a minor or have a juridical personality, the parents, guardians and authorized stakeholders /officers can have locus standi. But there remains an exception: if the addressee is a minor and is subjected online sexual offences or offensive communication that creates threat, hatred etc, he/she can also directly lodge complaints with the criminal justice machineries. The courts in such cases may allow the parents and guardians to assist and represent her in specific cases.

In all the above cases, addressee however also retains the right to be rescued/rehabilitated/compensated directly for the offensive communications received by him/her/it.

Concluding remarks

Please note: if you are addressee who may have received any offensive communication, or you may be knowing an addressee  who wants to communicate to reporting authorities of criminal justice machinery or grievance redressal cells, please contact the nearest police station or lodge your complaints through www.cybercrimes.gov.nic  and do not communicate directly with the sender of the offensive communication.

Please note: If you want to use this content, please cite it as Halder Debarati (August, 2025). Parties to digital communication: know who is the addressee and whether she is  a victim too. Published in https://internetlegalstudies.com/2025/08/17/parties-to-digital-communication-know-who-is-the-addressee-and-whether-she-is-a-victim-too-by-dr-debarati-halder/ on 17-08-2025

Cyber crimes against women, Cyber Law

Creation of Porn content (including child porn): who holds the liability ? by Dr.Debarati Halder

In a recent incident, a minor girl discovered a mobile phone in a washroom in local restaurant in Diu, a popular tourist destination in western India. When she alerted her family members who were having a short halt there for refreshment, they found out that an employee of the restaurant installed the device for recording washroom activities of women and children. The man apparently opened the video setting while installing the device and hence his images were also captured: this helped the family to identify the perpetrator and immediately take action. The report suggests that the person was handed over to the police who charged him under S.77 of Bharatiya Nayay Sanhita which penalizes voyeurism and Ss.13, 14 and 15 of the Protection of children from sexual offences Act, 2012 which prescribes punishment for using children for pornographic purposes and for storage of porn contents involving children.

There are two aspects in this case that I would be discussing here:

  • The punishment and the purpose of the same,  and
  • The questions of legal liabilities in such cases

At the onset, let me share that Bharatiya Nyaya Sanhita was brought in to Indianise the criminal acts and the punishments for the same: the colonial concepts of criminal acts were changed to adjust the entire criminal justice system to contemporary Indian understanding.  While many research papers, articles and informative write-ups are created on pornography and its effect on society, surprisingly, the terminology of “pornography” is not properly defined in the laws in India. It is rather defined from the perspective of sexually explicit content, that we get to see in different laws including Information Technology Act, 2000 (amended in 2008). Largely, pornography is explained by private and government stakeholder as some visible representations that arouse and give sexual pleasure. Given this understanding, pornography can have two sides: legal pornography that are created only for medical purposes with contents, images or consensual human activities of adults like sexual acting /performing for sexual arousing of adults; and illegal pornography which is created by different methods including voyeurism, rape videos, using children and disabled people coercively etc. Many stakeholders have huge disagreements regarding legal nature of pornography. But unfortunately the reality needs to be accepted. Diving deep into legal philosophy, we may see that once we can differentiate legal and illegal pornography, the legal liabilities for illegal pornography may become more acceptable and prominent for prohibiting such illegal acts and designing thoughtful restorative justice oriented punishment for the same.  In the contemporary criminal justice system, voyeurism creation, production, circulation of illegal pornography and sexually explicit contents are seen as   bailable offence under Nyaya Sanhita for the first conviction as the maximum time for imprisonment has been set to three years. Protection of children from sexual offences Act however categorized such offences as non bailable in most cases. Indian courts have produced some landmark cases in this regard too. But unfortunately that did not deter   people like this restaurant employee to go ahead for installing device for recording washroom activities of women and children that can not only be viewed for personal sexual gratification, but also can be used for generating illegal profit by selling them in the porn market. Apparently the penal system may have failed to create deterrence feeling and awareness for illegalities for such activities. We however cannot blame the criminal justice system entirely. We need to see the digital technological advances too that provides anonymity and second life for anyone who may need to create multiple avatars to survive in the cyber space. 

Now, let us concentrate on the legal liabilities  of stakeholders for creating porn contents. In the Diu restaurant case, the perpetrator had apparently used device that was under his control and had installed it in the washroom of the restaurant where he was working. The legal liability may be divided for production of the content between the owner/chief operator of the premises, owner of the device and the person who is installing the device   if the owner/operator /chief manager of the premises knew beforehand about the purpose of the installation of the video capturing device in the washroom which may not be subject to surveillance in general times. The same understanding of liability will also be applicable for the owner of the device if the same was being handled by any other person for creation of the porn content. Given the understanding that device owner and the installer of the device in the washroom in this case  may be the same, we now have to turn our attention to the liability of the android service provider and the internet service provider (in case if the content was being live streamed). Apparently, the last two stakeholders may apply immunity veil through liability exemption clause as described under S.79 of the Information Technology Act, 2000(amended in 2008). The provision reads as follows:

S.79(1) Notwithstanding anything contained in any law for the time being in force but subject to the provisions of sub-sections (2) and (3), an intermediary shall not be liable for any third party information, data, or communication link made available or hosted by him.

(2) The provisions of sub-section (1) shall apply if–

(a) the function of the intermediary is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored or hosted; or

(b) the intermediary does not–

(i) initiate the transmission,

(ii) select the receiver of the transmission, and

(iii) select or modify the information contained in the transmission;

(c) the intermediary observes due diligence while discharging his duties under this Act and also observes such other guidelines as the Central Government may prescribe in this behalf.

(3) The provisions of sub-section (1) shall not apply if–

(a) the intermediary has conspired or abetted or aided or induced, whether by threats or promise or otherwise in the commission of the unlawful act;

(b) upon receiving actual knowledge, or on being notified by the appropriate Government or its agency that any information, data or communication link residing in or connected to a computer resource controlled by the intermediary is being used to commit the unlawful act, the intermediary fails to expeditiously remove or disable access to that material on that resource without vitiating the evidence in any manner.

Explanation. — For the purposes of this section, the expression “third party information” means any information dealt with by an intermediary in his capacity as an intermediary

While the statute as shown above, saves the intermediary from being a stakeholder in cases of such as these, Clause (3) of S.79 highlights liabilities of the intermediary in case it knowingly took part in the action of production, creation, circulation of the content that falls in the category of illegal porn content and sexually explicit content, creation, production and circulation of which is criminalized.   

Now, let us see if the perpetrator can be charged and tried under S.15 of the Protection of Children from Sexual Offences Act, 2012. This provision speaks about storing of child porn contents. S.15(1) f the POCSO Act prescribes punishment with a fine of Rs 5000/- in the fist conviction and Rs.10,000/- in the second conviction for a  “ person, who stores or possesses pornographic material in any form involving a child, but fails to delete or destroy or report the same to the designated authority, as may be prescribed, with an intention to share or transmit child pornography”.  This sub clause therefore penalizes storing of child porn content with an intention to share and transmit it and does not report the matter to the designated authority. Clause (2) of S.15 goes ahead further for prescribing punishment of jail term for  a maximum period of 3 years for storing or possessing  “…….pornographic material in any form involving a child for transmitting or propagating or displaying or distributing in any manner at any time except for the purpose of reporting, as may be prescribed, or for use as evidence in court.”

Clause (3) further prescribes punishment stores or possesses pornographic material in any form involving a child for commercial purposes. The maximum punishment is for five years jail term with the minimum time period for the jail term is three years. It may become bailable offence if this very provision is applied for the perpetrators.

Interestingly, in the recent case of JUST RIGHTS FOR CHILDREN ALLIANCE Vs. S. HARISH Diary No.- 8562 – 2024, the Supreme Court has held that mere watching of child pornography is also considered as offence  as this may be considered as inclusive of a chain of behavior like opening the link containing porn content, storing the same with possible control over the possession , reporting of the content and deleting the content without opening the content.

Above discussion may now lead us to understand the followings about legal responsibilities of stakeholders who may be involved for producing, creating and circulating porn contents including child pornography contents:

  1. Production of porn contents may not only mean financially facilitating the creator of the porn content, but also may mean any one who may provide facilities like permitting to use premises under his/her own possession for creation of porn contents mainly with purpose of gaining /sharing illegal profit from illegal distribution of such contents.
  2. Installation of camera devices secretly in washrooms, rest rooms, bed rooms etc, may be considered as an act for the purpose of recording, creating and disseminating voyeur images, child porn and nonconsensual adult porn images.
  3. The mobile phone company, software company that may facilitate operation in the mobile phone or electronic devices and the service provider that may be used to record, store, disseminate the illegal images, may not be held liable for aiding the actual perpetrator unless they are knowingly aiding in such work.
  4. Storing of such images (including illegally captured images of sexual organs of adults and children, people engaged in sexual acts etc, is considered as an offence under POCSO Act as well as under Information Technology Act, 2000(amended in 2008).
  5. Non-reporting of receiving /knowledge of such illegal porn contents can also be considered as an offence especially under POCSO Act.

May every child be safe . May every adult be safe.

Please don’t violate the copyright of this writeup. Please cite as Halder Debarati (2024).. Published in https://internetlegalstudies.com/2024/11/14/Creation of Porn content (including child porn): who holds the liability ?by-dr-debarati-halder/ on 14/11/2024

Cyber Law

Intermediary liability: Are Universities countable? By Dr.Debarati Halder
Image Courtesy: Internet

Behind every data storage mechanism , there is a human intelligence that works to decide how the data store house will be managed, protected and which data may be exposed and how. For Long I have been arguing that behind every breach of data security, there is a human brain. He/she can be a data collector, data fiduciary, data manager, data protection engineers or a designated data protection officer of any website and tech company. My argument becomes stronger with every day update on data breaching methods: this time it is a two member group of  university officials in western India who have been accused for leaking cloud storage password to another university located in central India. while the accused persons have the right to defense for such allegation, such information may suggest that no organization including the banks, hospitals, universities and government departments dealing with civilian’s data are safe.   

Let us first understand what is an intermediary:

Often, we tend to confuse the term intermediary with website, internet service provider and internet. All  three of them denote different meanings but the concept is over lapping with each other. Indian information technology Act 2000 (amended in 2008) defines  intermediary  especially in respect to electronic records and data in S.2(w) as

any person who on behalf of another person (i) receives, stores or transmits that record or

(ii)provides any service with respect to that record and

(iii) includes telecom service providers, network service providers, internet service providers, web hosting service providers, search engines, online payment sites, online-auction sites, online market places and cyber cafes.

Interestingly the word “any person” has got different meanings in this section: when it says “any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record”, it may mean a natural person, i.e. human beings (especially adult human beings, who may be capable to take rational decisions, enter into contracts  etc.) again, when it says “telecom service providers, network service providers, internet service providers, web hosting service providers, search engines, online payment sites, online-auction sites, online market places and cyber cafes” etc, it may mean a juristic person who has legal personality and who may be represented by its human representatives like the CEOs or the  nodal officers etc.

In its preamble (para 4)in  Recommendation CM/Rec(2018)2 of the Committee of Ministers to member States on the roles and responsibilities of internet intermediaries, the Committee of Ministers, Council of Europe has shared some functions of such intermediaries which are as follows: …………………. “internet intermediaries”, facilitate interactions on the internet between natural and legal persons by offering and performing a variety of functions and services.

Some connect users to the internet, enable the processing of information and data, or host web-based services, including for user-generated content.

 Others aggregate information and enable searches; they give access to, host and index content and services designed and/or operated by third parties.

Some facilitate the sale of goods and services, including audio-visual services, and enable other commercial transactions, including payments.

Individual responsibility of the natural person intermediary for failure to protect the confidentiality of the data

As the above discussion may lead us to understand the meaning of intermediary as both natural person as well as juristic person (who may be represented by a natural person), let me now explain how intermediary (natural person) including the data manager and /or the data protection officer as appointed by the data fiduciary may be responsible for leaking of the data saved in data storehouse under the body corporate . He/she may

  1. Intentionally violate the obligation of confidentiality and share the security password for the data to third party without consent of the body corporate or the data fiduciary who may have collected the personal data for specific purpose.
  2. Negligently passes over the security information to third party to allow the confidentiality of the data to be breached.

In both these cases the primary responsibility of data breach may fall upon the Body corporate who may need to pay compensation under S.43A of the information Technology Act, 2000(amended in 2008) to the data principals whose data has been breached while the same was under his custody. But then such individual (natural persons) may also be held responsible under numbers of legal provisions. These may necessarily include S.72A of the Information Technology Act which prescribes punishment for disclosure of information in breach of lawful contract. This bag of penal provisions against such intermediary (including the data manager or the data protection officer) may also include S.43 read with S.66 of the Information Technology Act which prescribes punishment computer related offences.

What we understand from the above especially about universities as intermediaries as well as body corporates?

Universities are also intermediaries and body corporates who collect personal data including sensitive personal data of the teaching and non-teaching staff and of the students.

The personal data of the above-mentioned stakeholders are connected with their family members. Hence it may be easy for the possible perpetrators to fish out sensitive personal data of university employees and students as well as their family members.

Universities as body corporates also hold information about their own examinations, public examinations and data related to foreign university collaborations (which may also include domestic -foreign trade collaborations).

As a matter of fact, then if data is leaked from the university data base or the university is attacked by ransomware attacks, all stakeholders connected with the universities may be affected and women will be particularly vulnerable targets. It is necessary therefore that all universities must set up proper cyber security infrastructure and employ trained data protection officers and data managers who may be providing safe services for all as university intermediaries.

Please don’t violate the copyright of this writeup. Please cite as Halder Debarati (2023)Intermediary liability: Are universities countable? Published on 31-10-2023 @https://wordpress.com/post/internetlegalstudies.com/1463

Cyber Law, Editor's column

ChatGPT : a new legal challenge? by Dr.Debarati Halder

Since November 2022, several stakeholders including those in the education sector have been widely discussing about the new Artificial intelligence based  chatbot ChatGPT.[1] Not so long ago we got to see few AI based human assistance apps Alexa and Siri. These were also connected with internet of things. They answered many questions, guided clients for accessing information of any type and generated any cyber security and data privacy issues. In the legal profession we got to see possibilities of AI based judges. Many lawyers and human-right activists were strongly against this while some actually felt triumphant thinking that AI based judicial work will be accurate and would be giving needed justice to the parties. ChatGPT has created new sensation: not only because it is solving test series[2], but also there are possibilities of probable clash with copyrights of many contents. 

As many resources on ChatGPT had suggested, it works on human fed information and attempts to answers put up before it. There are few implications for this:

  1. For academic evaluations, the chatbot is fed the information and probable assessment questions. The success depends on how accurately and how quickly the AI system matches the correct answers.
  2. Students may misuse the system and possibilities of wide range copyright violation cannot be overruled.
  3. The chatbot is fed about probable legal issues and the nearest legal solutions for the same. The scope of said legal solutions may be expanded by accessing several other contents available on the internet. This may actually make the chatbot more accurate than an attorney farm or a practitioner whose research team may need several days to prepare the brief to support the client. In short, , human emotional intelligence may be lacking while counselling clients, especially in cases of private injuries.
  4. The chatbot interacts with human beings for assistance. Even though the makers of the chatbot claims that it has better data security, at present all AI based human assistance apps are questionable for providing data privacy and security. There is no guarantee that the personal data including sensitive personal data will be protected.

ChatGPT is heavily supported by LargeLanguage Model (LLM) model tools and this may necessarily have a third-party moderator of the information/data. Within four months of its inception, usage of ChatGPT has become questionable from all sectors including the legal sector: consider this thought provoking article on digital literacy training of the judiciary touching upon the usage of ChatGPT in delivering judgements in the USA[3]: Gutiérre raises question on probable errors in the judgement as judges may not know to check the authenticity of the  information received from ChatGPT. Gutiérre suggests for development of a policy to use the AI based human assistance tools for legal professionals and I completely agree with the same.

Let us not forget that emotional intelligence plays havoc in providing healing touch for cases falling in the category of personal injury. Chatbots or any other robot legal researcher would not be able to map and match the emotional injury with physical injury and quantity of damages and compensation. Similarly an assessment designed to evaluate the positive learning process of a student can not achieved properly if the AI based assistance tools are used without any proper guidelines. It is time that we humans tame our machine intelligence  by setting certain guidelines first. Otherwise the precious human intelligence for creating artificial intelligence will be used only for destruction and overpowering the good by evil intentions.

[1] For more understanding, see https://openai.com/blog/chatgpt/ Accessed on 21.02.2023

[2] See Rosen Kalhan (2023) . ChatGPT passes MBA exam given by a Wharton professor. Published in https://www.nbcnews.com/tech/tech-news/chatgpt-passes-mba-exam-wharton-professor-rcna67036 on 24-01-2023. Accessed on 25-01-2023

[3] Juan David Gutiérrez(2023) ChatGPT in Colombian Courts:

Why we need to have a conversation about the digital literacy of the judiciary. Published in https://verfassungsblog.de/colombian-chatgpt/?fbclid=IwAR3X2r9vVJH5HeYcGf_O4cBNoKae4_TouFLH36TOJqZ1B954NTqLFnrgFug on 23-02-2023 . Accessed on 23-02-2023

Cyber Law

Moonlighting and data security issue for children by Dr.Debarati Halder

Photo courtesy : Internet

Off late several companies had become extremely concerned for moonlighting by their employees. Moonlighting is a term that signifies involving in a second job for profit  while being in a full time employment. The 2020 covid pandemic has increased the tendency for moonlighting for employees in several companies including the tech companies as most of the workplaces reduced the salaries of employees and this caused huge financial tension for many. Legally moonlighting may or may not be safe for many: many European countries, US, Canada, Australia etc, may allow employees for moonlighting. Even academicians including teachers, university professors may also choose for a second job when they are off duty. But the problem arises when the employees go for moonlighting with the company data.

Why and how Moonlighting becomes an offence and who are the victims? in 2022, Tesla terminated an employee for showcasing and discussing  certain automobile features in his YouTube channel. Interestingly running a YouTube channel had not been considered as moonlighting even though such activities may help the YouTuber to earn profit.  But this was considered as offensive by the company because the employee actually criticised certain products using the company data which only he could access being an employee. Now consider the other side of the coin: if this employee had secretly sold the company data to other competing company for profit or may had been engaged in moonlighting works like consumer preference analysis, product marketability analysis, business analysis or even employee data analysis with the help of the confidential data of his employer company, he would have been definitely subjected for legal liabilities and he may even have the chance for being jailed.  This may no longer remain simple harmless moonlighting. Rather, it may involve data privacy breach by the concerned employee because he may  have  violated the integrity and confidentiality of the data owned and maintained by the companies.

Here we have to understand the types of the data and the types of the ‘victims’ that may be affected:

First victim would be the company itself as the company secrets including trade secrets would be affected. The designs, company logo, manufacturing process, company policies for marketing, specific software etc, may fall within the meaning of company’s intellectual properties which many employees fail to acknowledge or may not know. 

The second typology  of the victims has a wider scope than the first: it includes individuals and their  personal data that may have been collected by the companies in the name of customer data, patient data, government beneficiary data, banking related data etc. Presently almost all companies have become body corporates who collect certain kinds of personal as well as sensitive persona data: Tesla itself collects customer data that may include sensitive personal data like birthdates, banking information, social security numbers etc. There are several big tech companies that may be involved directly or indirectly involved  in government data collection and  processing work.

Moonlighting with such data may become extremely dangerous for the second type of the victims, especially children. There are 5 basic reasons for this:

  1. Children’s data including health data, school data, parent’s financial data etc, may be misused by different types of perpetrators. This may also aide in physical space kidnapping, abduction and assault on the child.
  2. Profiles of children may be sold to criminal gangs operating in deep and dark nets for online child sexual abuse related purposes. Often job seekers or individuals looking for moonlighting opportunities may fall in the trap of such gangs who may make them sell such sensitive personal data for a handsome amount. Here the criminal gangs may finely create a very much convincing agreement for the job seekers that in reality may not have much legal value as employer-employee contract. But the language of such agreements may be so finely constructed that it may actually make the employee fall in legal trouble if the entire operation is unearthed by the law enforcement agencies while the actual criminals may escape the clutches of the law.
  3. Child and adolescent victims may not be aware of the victimhood unless they are made aware of the data breach by their peers or by the acquaintances of their parents. Resultant, their online and offline security may be hugely breached and it may be beyond repairing especially for children who may come from socio-economically challenged backgrounds.
  4. Such kind of illegal moonlighting may enlarge the risks of ransom attacks for hospital, schools, public welfare data etc.
  5.  Companies or stakeholders who are engaged in the outsourced work of data collection, processing may also have to face legal action for not providing proper security to the confidential data. In such cases these cases may be held primarily liable as the burden of proof for innocence and strict diligence complied with may fall on the companies.

What is the way out then? EU General Data Protection Regulation has emphasised on the issue of privacy, security and consent for data collection, data processing, data archiving etc. Even though EUGDPR does not mention about moonlighting with confidential data as an offensive behaviour, it however focuses on right to privacy, data collection and processing rules etc.  We also have to look into several international conventions including the 2001 Budapest cybercrime conventions which throws light on content related online crimes, intellectual property rights related crimes and online child abuse related issues. All these prohibit data theft and unethical profit gain from misuse of data. Moonlighting with public, personal and sensitive confidential personal data falls off from the line of ethical moonlighting on the basis of skills of the job seeker/employee and thereby it becomes a punishable offence. But we must note that moonlighting with data involving children can be extremely dangerous because immediate harm to children may not be repaired by restorative and reparative justice quickly. But there is still a silver lining behind the vicious cloud of malicious data and activities. Companies and body corporates who primarily deal with public and personal data of general individuals can strengthen their data protection mechanism by applying stricter surveillance on the access on the said data, purpose of access to such data and mapping footprints of the usage of such data. They may also apply stricter policies against moonlighting especially against those employees who may directly deal with confidential data. Further, punishment for such kinds of moonlighting may not be restricted to termination and other penal actions by the primary companies alone. Such employee must also be made liable for breaching the data confidentiality of the children and he must be made to cooperate with the criminal justice machinery to track the data, pull down the data from vicious domains and also should be responsible for payment of compensation. Above all, courts must also consider banning them from using multiple profiles and they must be put under surveillance for their usage of information and communication technology.

cyber crime against women, Cyber Law

Gender and internet : Cyber law magazine for women news update May 31-June 08, 2022

Derbyshire Police community security officer who was in charge for safeguarding children from cyber crimes gets 27 months sentence from Derby Crown court for filming, possesing and unauthorized distribution of images of children in the changing rooms.
https://www.bbc.com/news/uk-england-derbyshire-61645416

Pakistani nationals get arrested for secretly filming women in Turkey and sharing objectionable images of them on social media.
https://tribune.com.pk/story/2359589/two-pakistanis-arrested-for-secretly-filming-women-in-turkey

Nepali women strengthen their protest against sexual exploitation through #metoo movement on the social media and share horrific details of such exploitation over social media platforms.
https://kathmandupost.com/national/2022/05/21/metoo-gathers-force-but-calls-for-sustained-movement

Male university student from Nigeria posing as American widow pleads guilty in the court for defrauding and impostering for fraudulent monetary gain from victims. Court awards conviction and strict punishment.
https://tribuneonlineng.com/court-sentences-fake-american-widow-to-3-years-imprisonment-in-kwara/

cyber crime against women, Cyber Law, Editor's column

Is using electronic payment mode mandatory?

CYBER CRIME AGAINST WOMEN BY DEBARATI HALDER

We are facing challenge of Covid-19 restrictions. A whole generation is facing another unique challenge. Many senior citizens and people from socio-backward classes and communities are unable to exercise their basic right to life because they may be unable to use the electronic payment mechanisms.

By the end of 1990’s electronic commerce started getting popularity and almost by the first half of the millennium, banks of several countries had expanded their services for electronic money transactions. Soon plastic money in the forms of ATM, credit, debit cards etc., were introduced and the smart generation started relying more on plastic money rather than carrying currency in their wallets. But this proved dangerous for majority. There were physical theft of wallets and the cards, misuse of the cards, hacking of e banking systems which directly affected the card operating systems, ATM machines were unauthorizedly accessed, spycams were installed in the machines to detect the banking information including the passwords etc. Senior citizens were worst affected as most of them in countries like India could not operate the e-banking system or the cards: either they could not understand the operational mechanisms or they were not physically able to conduct the entire transactions either through the ATMs, or through their smart devices. This was due to generation gap.

With the advancement of technology, e wallets were introduced. Through online banking mechanisms, one can deposit a particular amount of money in e—wallets. However, this would not be operating as a single and independent device or mechanism. Users may connect their valid government identity proofs with e-wallets. Such e-wallets may necessarily be used through computers, smart phones etc.[1]Everything remains virtual except the device/s that will help a user to access the online transaction mechanisms. It has been continuously stated that plastic money, e-wallets and e-banking systems are safe and better than carrying the currency.

But do we really know who is safeguarding our money in this system? A few provisions Chapter III of our very own Information Technology Act, 2000(amended in 2008) would make this clear. Chapter III discusses about electronic governance. S.6A of the Information Technology Act (IT Act), 2000, amended in 2008 is noteworthy here: it says as follows:

6A Delivery of services by service provider. –

(1) The appropriate Government may, for the purposes of this Chapter and for efficient delivery of services to the public through electronic means authorise, by order, any service provider to set-up, maintain and upgrade the computerised facilities and perform such other services as it may specify by notification in the Official Gazette. Explanation. -For the purposes of this section, service provider so authorised includes any individual, private agency, private company, partnership firm, sole proprietor firm or any such other body or agency which has been granted permission by the appropriate Government to offer services through electronic means in accordance with the policy governing such service sector.

(2) The appropriate Government may also authorise any service provider authorised under sub-section (1) to collect, retain and appropriate such service charges, as may be prescribed by the appropriate Government for the purpose of providing such services, from the person availing such service.

(3) Subject to the provisions of sub-section (2), the appropriate Government may authorise the service providers to collect, retain and appropriate service charges under this section notwithstanding the fact that there is no express provision under the Act, rule, regulation or notification under which the service is provided to collect, retain and appropriate e-service charges by the service providers.

(4) The appropriate Government shall, by notification in the Official Gazette, specify the scale of service charges which may be charged and collected by the service providers under this section: Provided that the appropriate Government may specify different scale of service charges for different types of services.

 

Online transactions for e-commerce purposes are directly connected with the concept of service delivery by service providers. S.6A has got two main component parts: (i) authorization to the service providers by the government to set up provisions for delivery of services in the electronic mode; and (ii) collection of service charges by the service charges. Whenever we get to see a smooth or a bumpy operation of services from the banks or from any other government or corporate authorities, we must know that there is a secret team behind that government department, bank or the corporate authority. They may be independent agencies who are commissioned by such government /bank/corporate authorities. These ‘secret teams’ perform all the technical functions for economic transactions, maintenance of the records for money transactions, maintenance of cyber security issues etc.,  and they are duty bound to not to violate the confidentiality of the user-data. Intact there are layers of contracts between the actual user and the bank/government/company, between such service provider and the actual users and the government etc. We know only the first layer of contracts and agreements between us, the actual users and the bank/government /company etc., who are providing us certain services or even goods. But there are several examples of violating the agreements and contracts. These ‘service providers’ know us more than we know ourselves because they know our bank details, our spending habits and even our location data too.

Considering the risk for breaching of confidentiality in all such cases S.7A of the IT Act, 2000(amended in 2008) has prescribed for auditing of documents etc., maintained in electronic forms. This Section says as follows:

“7A Audit of documents, etc., maintained in electronic form. -Where in any law for the time being in force, there is a provision for audit of documents, records or information, that provision shall also be applicable for audit of documents, records or information processed and maintained in the electronic form.”

But this is hugely neglected by many stakeholders and this loophole creates several data breaching related legal issues. The Indian legislature has also brought in the Intermediary guidelines Rules, 2021 which also shifts the liability for data protection for intermediaries in certain cases.

However, we must not forget that there is digital divide in our societies. Adults including men, women and people belonging to LGBTQ communities may not always access information and digital communication systems and services. This is a universal problem. Women may not be empowered to use electronic devices in socio-economically backward classes and communities. Not to forget that even though Indian constitution mandates for equal pay for all, women may not always get equal pay in unorganized sectors. Many households in India as well as in many Asian countries do not allow women to take any decision related to family-finances.  But there are situations when people are forced to use electronic payment/transaction systems. Covid-19 pandemic is one such situation where the WHO advised to reduce usage of anything which may transmit the viruses from people to people: reduction of usage of currency notes were also suggested as it was understood that the materials in the currency notes may get wet with sweat, saliva etc., and this may be extremely dangerous since it might increase the risk of spreading of pandemic. But there are new researches coming up every day which are suggesting how to take precautions while dealing with papers (including materials which are used to make currency notes) or clothes during pandemic times.

In all such cases, aren’t our constitutional rights get violated if the government or any other stakeholder insists on e-transactions? It actually does.

Answer to this question may be found in S.9 of the IT Act, 2000(amended in 2008). This says as follows:

Sections 6, 7 and 8 not to confer right to insist document should be accepted in electronic form.-Nothing contained in sections 6, 7 and 8 shall confer a right upon any person to insist that any Ministry or Department of the Central Government or the State Government or any authority or body established by or under any law or controlled or funded by the Central or State Government should accept, issue, create, retain and preserve any document in the form of electronic records or effect any monetary transaction in the electronic form.

Nonetheless, the above mentioned provision empowers all who may not be able to use or who may want to refuse the use of electronic payment system. But this may not always be considered as the Rule: this is rather Exceptio probat regulam (an exception proves the rule) in the era of internet. Even though the government and other corporate stakeholders may extend their services on humanitarian grounds to help those who may not be able to use the digital payment systems or the e-wallets etc., people’s trust may easily be broken by gross misuse of the powers that such ‘helpers’ may have: ATM debit cards may be stolen, data may be compromised, e-wallets may be illegally operated by such ‘volunteers’ who may want to gain illegal and unethical profits at the cost of innocent people.

It will take longer time to make people from all backgrounds aware about electronic payment modes. It will probably take even longer to control cyber criminality targeting vulnerable people. One must not violate the legal norms and constitutional principles to make the right to life of others almost unachievable. Vulnerable groups including senior citizens, disabled people, socio-economically backward communities, women and children must be given enough protection to gain their trust so that all can survive and win over adverse situations.

Please note: Please  do not violate the copyright of this writeup. Please site it as Halder Debarati (2021) Is using electronic payment mode mandatory?  Published @ https://debaraticyberspace.blogspot.com/2021/04/is-using-electronic-payment-mode.html on 22-04-2021


CYBER CRIME AGAINST WOMEN IN INDIA
cyber crimes against women, Cyber Law, weekly news update on cyber crimes against women and laws

Gender and Internet : Web magazine for Cyber law for women News update for December 15th- December 21, 2020
Picture Credit : Debarati Halder

Japanese man allured women with suicidal tendencies through Twitter to kill them and hid body parts in his apartment. Arrested in 2017, this Twitter killer gets death sentence for murdering.
https://www-bbc-com.cdn.ampproject.org/v/s/www.bbc.com/news/amp/world-asia-55313161?amp_js_v=a6&amp_gsa=1&usqp=mq331AQHKAFQArABIA%3D%3D&fbclid=IwAR2ppKBDUR9QsUMmOfZQ1W8fkS0O8-DlkWsJzzxweQtGuKibamXsYuXEvOs#aoh=16080903667883&referrer=https%3A%2F%2Fwww.google.com&amp_tf=From%20%251%24s&ampshare=https%3A%2F%2Fwww.bbc.com%2Fnews%2Fworld-asia-55313161

Uber refuses to share the data about sexual abuse cases involving Uber drivers on the basis of protection of privacy of victims. California Public utility commission rejects the said ground and slaps $59 million on Uber.
https://www.google.com/search?q=California+Public+Utility+Commission&rlz=1C1CHBF_enIN919IN919&oq=California+Public+Utility+Commission&aqs=chrome..69i57&sourceid=chrome&ie=UTF-8

Federal Trade Commission reaches out every social media company to provide explanation as to what private data of users are collected and why.
https://arstechnica.com/tech-policy/2020/12/ftc-kicks-off-sweeping-privacy-probe-of-nine-major-social-media-firms/?fbclid=IwAR27xPWnAaFmDwEdbgfXHpHdBWQ6vWAAZCqmhY3NrG00DTvDvaYGya6c1Jo

A private law website in India receives ‘urgent removal’ removal request for a court judgement from the official incident reporting ID of Computer emergency response team. Cyber secueity infrastructure of top government websites are questioned.
https://www-indiatoday-in.cdn.ampproject.org/v/s/www.indiatoday.in/amp/technology/news/story/cert-in-employees-use-official-incident-reporting-id-to-ask-website-to-censor-indian-court-order-1749417-2020-12-14?amp_js_v=a6&amp_gsa=1&usqp=mq331AQFKAGwASA%3D&fbclid=IwAR2Rrs0TTJJjaVBXO89N9GzMZyynj6g0HPoABLmaPkoiazPac6BKQkrf0RA#csi=1&referrer=https%3A%2F%2Fwww.google.com&amp_tf=From%20%251%24s&ampshare=https%3A%2F%2Fwww.indiatoday.in%2Ftechnology%2Fnews%2Fstory%2Fcert-in-employees-use-official-incident-reporting-id-to-ask-website-to-censor-indian-court-order-1749417-2020-12-14

Victim of physical gang sexual assault in Egypt files compliant with the concerned government agency and gets more threats. On her social media outrage, Egypt Prosecution orders for seven accused.
https://egyptianstreets.com/2020/12/18/sexually-assaulted-and-threatened-egypts-public-prosecution-orders-arrest-of-seven-men-in-mit-ghamr-assault/

Jobless man from Hyderabad, India allured woman by impersonating, collected her personal data and photograph. When the victim refused to chat over Facebook, the accused allegedly threated to share her nude pictures. Police arrests the accused and slaps charges under Sections 66C, 66D, 67 of the IT Act and 354, 506, 509 of the Indian Penal Code.
https://www.siasat.com/hyderabad-man-arrested-for-stalking-blackmailing-women-on-social-media-2047366/

Cyber crimes against women, Cyber Law, Editor's column

“Netizens” by Dr.Debarati Halder
copyright @debaratihalder

During the COVID-19 19 lock down period between march 2020 to almost the end of October 2020, we have seen steep rise of cybercrimes especially cybercrimes against women. These crimes included different patterns: economic crimes, data privacy infringement, child sexual abuse online and creation of widespread hatred. Social media platforms like twitter, Instagram etc., had been flooded with hate messages, fake news, obscene messages etc. but it would be wrong to think that only web-based platforms had been used to creates online harassments or cyber crimes at large. Handheld phones are not spared either. Communication conveyed over phone had been threatening, unwanted and had also taken the nature of bullying. Both the receivers and perpetrators are nothing but Netizens. The concept of Netizens is fiction based just like the concept of cyber space, which finds it roots in the fiction called Neo romancer.

Individuals who live, survive in internet, on the internet and gain infotainment and use internet for connectivity are known as Netizens. The simple connotation of this term could be citizens of net.

But this term has not found any acceptance in any legal statute, international documents speaking about right to access internet, right to be forgotten or even cyber safety, e commerce. This is a popular nickname for all those who use internet, who have been born in the era when internet was booming and those who are connected to each other through information-digital communication technology. Often, we do get to hear that people belonging to the older generation who adopted internet and digital communication technology (because otherwise they could not have survived due to global digital revolution), are called as net immigrants because they may have get accustomed with the digi-culture. But would not prefer to use this term. Worldwide e-governance growth has involved every citizen to become netizen. Digitization by the governments of birth, marriage and death registrations, social security related data, bank data, school data, workplace data, health data, court data and above all internet and digital communication technology consumption data for the purpose of e-governance has therefore made everyone irrespective of age, gender, class, creed etc, netizens.

Netizens play a great role in shaping the livability of themselves as well as other netizens including women and children netizens on cyber space. Laurence Lessig, a pioneering professor on cyberspace regulation predicted that internet will be a virtual livable space with ‘market’ and it would become necessary for State to carefully frame laws to regulate cyber space. His findings stand firm forever. Netizens are important stakeholders for profit generation for internet companies. They also earn by living on the cyber space. By saying this, I however can not ignore the fact that netizens may use internet and cyber space as a whole for ethical as well as unethical profit gain. Consider the positive profit gaining strategies: legal e-commerce activities, earning from content development, etc. The illegal profit gaining part is heavier. Millions of netizens sell and consume data that may have been generated, stored, processed, trafficked in illegal ways. Data of women and girls are the hot priority in this regard. Almost all stakeholders would unanimously agree that cybercrimes against women and girls are rising because of the unmonitored behavior of several netizens.

As such, if we quickly look into the existing constitutional and legal frameworks of different countries, we can see that almost all countries have knowingly or unknowingly developed certain rights and duties for netizens. These rights and duties are universal in nature and may include freedom of speech and expression, right to privacy, right to access justice, right to information, right to live a dignified life and right to be forgotten. Simultaneously the duties may include duty to respect others rights on the cyber space as well as in real life, duty not to incite hatred, not to infringe privacy, copy right of other netizens including organizations and government data etc. the prime duty of every netizen however is to help the victim of online abuse by reporting right violation because if they remain mute spectators, they would become bystanders and add to visual victimization of the victim/s.

We can also see that existing laws have extended penal provisions to charge the netizens for their wrong doings on the cyber space which may affect lives of others in real life.  But major problem lies in the jurisdictional issues. Netizens are ubiquitous especially. Netizen from one geographic region may reach out to other netizens situated another geo location. Initiating criminal proceedings against netizens in such cross border criminal cases  becomes a huge problem  for the criminal justice machinery especially in the absence of treaties to extradite offenders. The international laws and rules also play a major role in charging netizens for offences which may not be considered as indictable offence in the country where the netizen is residing and operating from.

It is expected that the international organizations and States must come together for working towards creation of universal rules for regulating the activities of netizens. This may help all to live and be remembered in a wonderful cyber space.

Please do not violate the copyright of this writeup. Please cite it as Halder Debarati (2020) ‘Netizens’. Published @https://wordpress.com/posts/internetlegalstudies.com on November 3rd, 2020