Opinion: Cyber crimes could derail Digital India, open reporting mechanism crucial

As India gets going on various projects to connect the country including Digital India, cyber crime is emerging as a big threat area.

By Anup Jayaram

As India gets going on various projects to connect the country including Digital India, cyber crime is emerging as a big threat area. Cyber crimes have cost India $8 billion in 2012 according to the Norton Cybercrime Report. The number of incidents too have risen from around 12,000 in 2011 to well over 180,000 in 2014 according to CERT-In (Indian Computer Emergency Response Team).

The problem area in India is that very few companies or organisations come out to report cyber crimes.
That according to Mukul Shrivastava, partner, Fraud Investigation & Dispute Services, EY is an area of concern. There is thus nobody, be it government or semi-government that has a database of what has happened in India. There is also no formal reporting structure, like in the western world where, if there is an incident, it is compulsory by law that you need to report it. Most companies tend to suppress such information since they fear it could lead to a loss in valuation. However, if the information is public, other organisations would be in a position to protect themselves. “Just like the Companies Act states that you have to report every fraud, you need a system in place where every cyber crime that happens gets reported to a central agency,” states Shrivastava.

There are broadly seven broad categories of cybercrimes. These are unauthorised access & interception (hacking); alteration of computer data (Trojan horse, virus); identity theft (shoulder surfing, phishing); Computer sabotage; computer related frauds (program manipulation, fraud at payment points), unauthorised reproduction (software piracy) and miscellaneous crimes ( theft of trade secrets, eavesdropping, impersonation).

While the threat ended with laptops earlier, today it covers mobile devices too. Almost everyone today uses apps on their mobile devices. While the apps that people download everyday by themselves are not a threat, the area of concern relates to the downloading of games. Shrivastava points out that one does not know what codes are written in the game. And since almost all apps have access to personal information on the mobile device, there is nothing that cannot be extracted.

Cyber crimes happen to large companies too. Shrivastava is investigating a cyber crime in a company where a payment was authorised and paid based on an e-mail. The problem began with one letter in the mail ID being different. The problem did not end there. The person who cleared the payment had done so because the cyber thief had replicated the email writing style of the CEO in the mail. That’s what helped clear the transaction quickly. Shrivastava points out that someone had compromised the system and the hacker knew exactly how a person writes.

The other worry area is because most people are careless about information. Hackers buy information from vendors who collect phone numbers, addresses and e-mail IDs in malls and restaurants. They also source information from courier boys and data in housing society diaries for a price. Such information can be used to compromise a bank account or anything digital that a person uses.
The threat of getting compromised relates to companies that are high on technology usage including telecom, banking and financial services. Companies that have a lot of IPR – life sciences, retail companies, defence – are also on the threat list