Cyber Crime Investigation: S O P F
Cyber Crime Investigation: S O P F
Cyber Crime Investigation: S O P F
CYBER CRIME
INVESTIGATION
STANDARD OPERATING PROCEDURE
FOR
CYBER CRIME INVESTIGATION
Description 1
TYPES OF CYBER CRIME
Cyber crime may be said to be those where either the computer is an object or subject
of the act constituting crime including conventional crimes. Broadly speaking any
criminal activity that uses a computer either as an instrumentality, target or a means
for perpetuating further crime comes within the ambit of cyber crime. Section 66 of
the Information Technology (Amendment) Act 2008, defining cyber crime, refers to
punishment if the acts detailed in Section 43 of Information Technology Act 2000, are
Judicial Academy Jharkhand
done dishonestly or fraudulently.
Cyber crime can be categorized as 1. Crime against property, 2. Crime against Government
3. Crime against person
1. Crime against property
¾¾ FINANCIAL FRAUD
(Under IPC and Section 66 of IT Act)
¾¾ Financial fraud - These frauds include commercial fraud, investment fraud, hiring
for jobs abroad etc by use of computer.
PAGE |- 2
¾¾ Fraudulent or dishonest use of computer and computer resource to commit crime
against property
¾¾ Vishing fraud- Dishonestly or fraudulently misappropriating property using
voice as a mean to extract private financial information like credit/debit /
internet banking details
¾¾ Job scams -Dishonestly or fraudulently misappropriating property using
spoof emails, creating fake websites.
¾¾ Social media fraud – Dishonestly or fraudulently misappropriating property
by creating fake account on social media or through honey trapping.
¾¾ Intellectual Property Crimes: Intellectual property consists of a bunch
of rights. Any unlawful act by which the owner is deprived completely or
partially of his rights is a crime. The most common type of IPR violation may
be said to be software piracy, infringement of copyright, trademark, patents,
designs and service mark violation, theft of computer source code, etc
¾¾ Salami attack :Also known as salami slicing ,where a series of small fraud
done on a regular basis through computer network/resources that finally adds
up to a bigger fraud. For example a bank employee deducting a small sum of
money daily from various customer’s account which finally adds up to a large
sum
¾¾ DATA MODIFICATION
(Under Section 66 of the Information Technology Act, 2000 and under Sections 403,
Judicial Academy Jharkhand
420,467, 406, 408, 409 etc of the Indian Penal Code, 1860) In this offence, the accused
by accessing the Computer System, changes or damages the existing data/information or
by doing any act mentioned in Section 43 of the IT Act fraudulently or with dishonest
intention, and thereby causes harm to the person or to the institution.
2. Crime against person
3 -|PAGE
Identity theft
(Under Section 66C and 66D of the Information Technology Act, 2000)
¾¾ Identity Theft and Impersonation
¾¾ IDENTITY THEFT :- Identity theft may be categorized as a crime against
property or the crime against person. It is the fraudulent or dishonest use
of electronic signature,password or unique identification of any person to
commit Cyber Crime e.g seeking financial information of any person though
vishing ,e-mail spoofing and causing misappropriation of property.
¾¾ (Section 66C of IT Act deals with Punishment for identity theft.)
¾¾ IMPERSONATION :- A person to said to commit an act of personation if he
cheats by pretending to be some other person ,or by knowingly substituting
one person for another,or representing that he or any other person is a person
other than he or such person (Section 416 of IPC)
¾¾ Section 66 D of IT Act deals with offence of impersonation using electronic
means.e.ga person impersonating as bank manager and seeking private
financial information through social engineering
¾¾ This is done to steal the personal information such as Date of Birth, Name, PAN
number, Passport number, Credit card number, ATM Pin no., E-mail Account
details, or any other unique identification feature etc and with an object to defraud.
This sensitive information of the victim is obtained by various means like phishing,
vishing sending the fake
Judicial Academy Jharkhand
offers of rewards to the
victim’s email address
and obtaining their
confidential information.
Cyber Stalking
¾¾ Whoever follows /
contacts any person or
monitors his/her use of
internet despite showing
PAGE |- 4
clear sense of disinterest commits an offence of cyber stalking.Section 354(D) of
IPC deals with stalking including cyber stalking.
¾¾ Cyber Bullying :-Causing harassment or creating fear through cyber stalking is
cyber bullying.
(Section 66E of IT Act deals with punishment for violation of privacy through computer
network/computer resource)
¾¾ In this offence, by the use of computer or electronic devices, the victim is persistently
followed, harassed and is threatened or intimidated by sending emails or by sending
messages or calls on the mobile and by sending objectionable messages containing
threat to the victim's Social Network Account causing mental and physical harm.
Data theft
(Under Section 66 of the Information Technology Act, 2000 and under Section 379 of
the Indian Penal Code, 1860)
¾¾ This offence involves unauthorized access and downloads, copies or extracts data
from victim’s computer containing sensitive information without the permission
of the owner. This sensitive information includes the victim’s personal information
such as name, date of birth, address, contact details, username and password, credit
card / debit card number OTP etc.
Pornography
¾¾ Child Pornography : Use of computer networks to create, distribute, or access
Judicial Academy Jharkhand
materials that sexually exploit underage children. It also includes activities
concerning indecent exposure and obscenity. (Section 67 B of IT Act deals with
Punishment for publishing or transmitting of material depicting children in
sexually explicit act, etc. in electronic form and under Section 292 of the Indian
Penal Code, 1860 and Section 14 and 15 of POCSO Act)
¾¾ Pornography :- Transmission of obscene article/sexually explicit act/images
through electronic means .
(Section 67 and 67A of IT Act deals with punishment for transmission of obscene/
sexually explicit materials through electronic means )
5 -|PAGE
¾¾ Cyber Trafficking: It involves trafficking in drugs, human beings, arms weapons
etc. which affects large number of persons.
¾¾ Publication of pornographic video, images, etc. through E-mail, website, chatting
site, social network site etc. comes under the purview of obscenity crime
¾¾ The possession of above mentioned materials involving a child below the age of 18
years is itself an offence under Section 14 and 15 of the POCSO Act.
Espionage
(Under Sections 66 and 70 of the Information Technology Act, 2000)
¾¾ It involves gathering classified informations from the protected system of the
governmental agencies . Through this, an attempt is made to get access to the
sensitive governmental data.
Hacking
(Under Section 66 of Information Technology Act, 2000)
Judicial Academy Jharkhand
Hacking is a criminal offence committed by illegal use and control of a computer without
the permission of the computer owner.
Denial of Service
Denial of Service attack:
¾¾ A DOS attack is disrupting the use of machine or network by its legitimate user by
flooding it with superfluous traffic/requests .
¾¾ A DDOS (distributed denial of services attack is attacking the target system from
multiple sources i.e using more than one unique IP Address making it difficult to
trackthe source of attack.
PAGE |- 6
(Under Section 66 of Information Technology Act, 2000)
This is a financial offence where access to computer or internet or both is obstructed for
demand of money. Example: Salami attack, Ransomware etc.
Spoofing
(Under Section 66 & 66D of Information Technology Act, 2000)
Sending email by camouflaging it in a such a manner that it appears to have been sent
from someone else’s account to a victim demanding personal information etc.
7 -|PAGE
Skimming
(Under Section 66C of Information Technology Act, 2000)
Obtaining card information by attaching unauthorized device to the ATM, POS machine
etc. It is used against the victims to cause financial harm to them.
PHarming
(Under Section 66 C & 66 D of Information Technology Act, 2000)
Pharming is that cyber crime where victim’s private informations are deceptively extracted
through a website which seems to be real and genuine, causing financial loss, where a
malicious code is able to alter the host file on the target system .Once it is manipulated,
all the traffic of the victim’s system is misdirected to fake or fraudulent websites.
¾¾ Crime against Government:-
¾¾ Cyber espionage – It is gaining illicit access to the confidential information/
data held by Government using computer network/resources.
¾¾ Cyber Terrorism:- It is a politically motivated crime using computer resource/
computer network to cause serious disruption in services, bodily harm or
injury to persons at large in order to create a sense of fear in the society so as
to impinge upon the sovereignty, integrity and security of the State
Penalty for offences of cyber terrorism is dealt under sections of IPC, UAPA and the
other applicable law along with 66 F of the IT Act
¾¾ Cyber warfare :- Cyber warfare is crime against Nations/Governments which may
Judicial Academy Jharkhand
also include Cyber vandalism i.e. destroying/gaining access/modifying critical data
stored in Government installations detrimental to the security of the State.
Description 2
JURISDICTION OF POLICE STATION IN REGISTERING FIR
RELATED TO CYBERCRIME:
1. The concerned police station under the jurisdiction of which the Bank is situated
from where there is illegal withdrawal of money will have the jurisdiction to register
FIR under section 156 (1) read with section 177 of the Code of Procedure and
investigate.
PAGE |- 8
2. In cases of economic offenses where it is not certain under which jurisdiction the
crime has been committed or if the crime has been committed under more than
one jurisdiction or is a continuous offence, FIR can be registered in any related
police station and investigation can be conducted under the provisions of Section
178 read with section 156 (1) Code of Criminal Procedure.
Example - Money is withdrawn from the account of a person who is located in
Ranchi by a criminal sitting in Jamtara and it is transferred to more than one
account. There will be jurisdiction in all the places from where money has been
transacted.
3. In cases where the offense has been committed within the jurisdiction of one police
station and its effect will be in the jurisdiction of any other police station then the
offence can be registered in either of the two police stations under the provisions of
Section 156 (1) read with Section 189 of Code of Criminal Procedure.
Example- In offences related to social media, if the objectionable post has been
made within the jurisdiction of a police station, and it is uploaded on the social
media through the Internet, and it is seen in other jurisdictions all the concerned
police stations will have jurisdiction.
4. In case the offence is the result of a criminal conspiracy, both the police station will
have jurisdiction to register FIR and investigate, where either the conspiracy was
hatched or where the offence was committed, under the provisions of Section 180
read with Section 156(1) Code of Criminal Procedure.
Judicial Academy Jharkhand
Example - In cases where the illegal withdrawal of funds through cyber crime has
been done on more than one victim, and that amount has been transferred to a bank
account in some other jurisdiction and the beneficiary is found accomplice under
S. 120B IPC, then in this case the offence can be registered either in the jurisdiction
of the bank account of the victim or the beneficiary and the investigation can be
conducted.
5. In cases where financial offence or social media offence is done through
telecommunication like internet, mobile etc., the place where the communication
was made, or where it was received, both the police stations will have jurisdiction
9 -|PAGE
under the provisions of Section 182 read with Section 156(1) of the Code of
Criminal Procedure.
Example: If the OTP of an account holder is obtained by criminals sitting in the
jurisdiction of any other police station through mobile or telecom and internet,
then both the police stations will have jurisdiction.
PAGE |- 10
To obtain copy of the statement of account duly certified under Section u/s
2A and 4 of the Bankers Book Evidence Act, 1891 from the branch manager
of the concerned bank and section 65B of Indian Evidence Act ( if a printout
of the statement is taken )should be obtained from the beneficiary bank.
A notice u/s 91 CrPC should be served to the concerned ISP /TSP for providing
the CDR and CAF of the mobile number in case of vishing frauds.
A certificate u/s 65B of Indian Evidence Act to be obtained from the concerned
ISP
5. In case the above details are not supplied application may be filed in the
concerned court having competent jurisdiction to issue notice under Section
91 of the Code of Criminal Procedure calling for the above documents.
6. In such cases where the above-mentioned details are not made available to the
I.O. in due time after issuance of notice under Section 91 Cr.P.C the concerned
court, if found appropriate, can take cognizance against the branch manager
under Section 175 of the Indian Penal Code, 1860 by filing a separate case.
Or
The I.O. in such cases can also file a complaint under Section 195(1) (a) of
the Code of Criminal Procedure, 1973 and make prayer to the court to take
cognizance under Section 175 of the Indian Penal Code, 1860.
7. Where the account statement is received without certification the prescribed
certificate under the provisions of Section 4 of Bankers Book Evidence Act,
Judicial
1891 may also be Academy Jharkhand
obtained and presented to the court during the trial.
8. From which officer of the bank the statement of account may be obtained
after due certification?
The Bank Managers or the Chief Accountant of every branch of the bank are
competent to issue certified copies of book of accounts under the provisions
of Section 2(8) of the Bankers Book Evidence Act, 1891.
11 -|PAGE
9. In the light of the Section 4 of the Bankers Book Evidence Act, 1891 the
certified copies of the book of accounts shall be admissible in the court of law
as evidence and the bank officer issuing the same will not be required to be
present in the court as a witness. In such circumstances where the statement
of account is obtained by computer printout it will also be mandatory to take
a certificate separately under the provisions of Section 65B (4) the Indian
Evidence Act, 1872.
10. The certificate under Section 65B (4) of the Evidence Act, 1872 must be
obtained from the service provider in case of CDR and other related electronic
evidence and be filed in the Court and the above prescribed procedure of
Section 91 Criminal Procedure Code, 1973 may be followed to obtain the said
certificate.
11. The officer issuing the certificate under Section 65B (4) of the Evidence Act,
1872 will not be required to be presented as a witness. The said certificate
will be proved by identification of the Investigating officer as recipient of the
said certificate.
12. The certificate under Section 65B (4) Evidence Act, 1872 to be presented with
the said CDR or electronic record as far as possible. But in the event of non-
receipt of prescribed certificate during investigation it will be admissible by
the court even during the trial.
13. The aforesaid procedure will also be followed to obtain CCTV footage. In
PAGE |- 12
16. The persons who permit their bank account and ATM to be used in any
manner for cyber crime can be charged under Section 413/411 along with
other sections of the Indian Penal Code, 1860.
17. In cases where the victim or witness resides in any other police station area,
there statement under the proviso I to section 161 Cr.P.C. may be recorded
with the help of the Audio Video Electronic instrument to avoid undue delay.
The investigating officer will mention the transcript of the said statement in
case diary and he will also attach the audio and video of the said statement
with the case diary.
The process
for
collection of
evidence
13 -|PAGE
¾¾ Proper packaging and preservation of electronic evidence and electronic devices.
CHAIN OF CUSTODY
The chain of custody provides written evidence regarding the delivery of electronic
evidence as to when and to whom it is assigned. These are those people who seized the
electronic device and who transfers the evidence from the place of occurrence, send it to
the place of preservation, or to the forensic lab and then to the court.
PAGE |- 14
THE MAIN POINTS IN THE CHAIN OF CUSTODY ARE:
¾¾ The storage medium or device should physically be inspected and photographed
and must be preserved in a temper free environment after preparation of due
seizure memo.
¾¾ Proper protection of evidence from theft and other disasters.
¾¾ Digital / electronic evidence must be protected from external electric and magnetic
fields. Digital evidences especially compact discs must be protected from scratches
and other physical damages.
¾¾ Minimum number of people should be involved in handling of digital evidences.
¾¾ Identification of electronic evidence and devices should be prominent, clear and
written with permanent ink.
¾¾ The Investigating Officer should reach the place of occurrence with all the
preparations for search and seizure . He should have proper and sufficient number
of envelopes, bags and containers available for packaging of digital evidence.
15 -|PAGE
¾¾ Manufacturer – description of the manufacturer of the equipment
¾¾ Model No.
¾¾ Serial number of equipment
¾¾ Preserving hash value and maintaining chain of custody
PAGE |- 16
WHEN THE INVESTIGATING OFFICER FORWARDS THE
COLLECTED ELECTRONIC EVIDENCE FOR FORENSIC ANALYSIS,
THE FOLLOWING GUIDELINES SHOULD BE FOLLOWED.
The electronic evidence should accompany :
¾¾ Brief history of the case and the DEC form.
¾¾ The details of the exhibits seized and their place of seizure.
¾¾ The model, make and description of the hard disk or any storage medium
¾¾ The date and time of the visit to the place of occurrence.
¾¾ The condition of the computer system (on or off) at the place of occurrence.
¾¾ Is the photograph of the place of occurrence taken?
¾¾ Is it a stand-alone computer or in a network?
¾¾ Has the computer any internet connection or any networking with other computers?
¾¾ All electronic evidences must be examined by the examiner of electronic evidence
notified under Section 79A IT Act 2000.
¾¾ All columns in the charge sheet must be filled carefully and the original documents
and seized articles must accompany the charge sheet.
17 -|PAGE
Description 3
IN JHARKHAND THE FOLLOWING CYBER-CRIMES OCCUR MOST FREQUENTLY
1. Commission of fraud by making series calls on various mobile numbers and seeking the
Debit/Credit card detail through various hacks of social engineering (Vishing Fraud)
2. Commission of financial fraud through spoof email
3. Vishing fraud using VoIP
4. ATM cloning by authenticating the Debit card details over IVR system of the banks
5. UPI (Unified Payment Interface )fraud by registering UPI on the registered mobile
number of the victim after getting his details through social engineering
6. Financial frauds through E-commerce services like OLX by publishing fake sale offers
using forged/impersonated identities
PAGE |- 18
Supreme Court’s Order [State of Maharashtra v. Tapas D. Neogy (1999) 7 SCC
685].
¾¾ The victim can register the FIR for cyber stalking and posting of pornographic
material on social network site in any police station under Section 354 (D) 1 (ii) of
Indian Penal Code, 1860. If the police station in-charge refuses to register the FIR,
then legal action will be taken against that police officer-in-charge. Registering of
FIR is mandatory for the Police Station-in-Charge. [Lalita Kumari v. State of Uttar
Pradesh, (2014) 2 SCC 1]
¾¾ Where the printouts of offensive material is brought by the victim it shall be certified
under section 65B of the Evidence Act by the victim and there is no need to further
obtain certificate under section 65B (4) from the service provider and photographs
submitted by the victim will be accepted as secondary evidence.
Note:-
¾¾ The Investigating officer will inform the victim about his right to file application for
grant of compensation under Section 43A of the Information Technology Act 2000
before the Competent Authority (The Secretary of the Department of Information
Technology of every State)
¾¾ The Investigating officer will also inform the victim about the circular of the Reserve
Bank of India RBI/ 2017-18 /15 DBR.NO.Leg.BC.78 /09.07.005/ 2017-18 Dated
6/7/2017.
qqq
19 -|PAGE
Prepared by :