Tuesday, August 15, 2017

Ecommerce Online Consumers can file a case anywhere on Sellers in India

Landmark Decision for Online Marketplaces: Online buyers can register a case on sellers anywhere in India.
By Prashant Mali     
The issue of jurisdiction has made a lot of people sweat in the recent past since the Internet has come into play. With the nation recognizing different forms of businesses that are Internet-dependent, the law has definitely had some catching up to do. I have personally utilized this independence day holiday to research all important legislation and case law in this matter and through this blog, I would like to make my research available for everyone to study.
As a practicing Ecommerce Lawyer and Cyber thought leader of the country, I feel that this recent decision of Supreme Court dated 4th August 2017 in the case of Spicejet Ltd (not yet reported) is krantikari or as it is referred to in Law, a landmark decision. As per the case law deduced from this decision, it will be apt to say that an online buyer may sue a seller at any place. For the purpose of clarification, an online buyer here means any person who has purchased any goods via a seller online.
In my opinion, this will affect all ecommerce buyers like all of us and give them a much needed relief freeing them of the bounds of local jurisdictions but simultaneously, it will also increase the sellers’ overhead now as lawyers will need to appointed across all consumer forum jurisdictions that they have customers in. This observation lays emphasis on my earlier thoughts about ensuring Online Dispute Resolution (ODR) in cases involving Mobile wallets and E-Commerce.
In over-the-counter purchases, a consumer can file a complaint in the consumer court only within the local limits where the company/ opposite party resides, carries on business or where the transaction takes place (by the bare reading of the CPC). However, now the law says that online consumers can sue a company for deficiency in services at any consumer court of their choice. In these times, when E-Commerce trading is growing rapidly, this ruling from the Supreme Court has brought a big relief for consumers purchasing goods through websites and E-Commerce apps. 
A bench of Justices Adarsh K Goel and S Abdul Nazeer on 4th August 2017 upheld a six month old ruling of the National Consumer Dispute Redressal Commission (NCDRC). The NCDRC had ordered Spicejet Ltd. to pay Rs 1.25 lakh compensation to Ms. Ranju Aery for cancellation of a flight. She had booked a ticket (Chandigarh to Delhi via Bagdodra and Kolkata) on yatra.com on June 23, 2015. The airline cancelled her return flight from Kolkata to Delhi without any reason and provided her no alternative. She approached the consumer court in Chandigarh and secured an order against Spicejet. In the appeal, the airline claimed that the Chandigarh court did not have jurisdiction to hear the case as the place of business of the company was at Gurugram. The airline relied on Section 11 of Consumer Protection Act which allows a complaint to be instituted by a consumer within the local limits of where the opposite party resides or carries on business or where cause of action arises.
Rejecting this argument, the NCDRC in its order of February 7, 2017 found the company guilty of cancelling her flight without reason when on that day 128 flights took off from Kolkata without any delay. The NCDRC noted that the airline gave no explanation for cancellation and failed to make any alternative arrangements. The consumer also stated her grief wherein she discloses that she purchased the ticket at a cost of Rs 80,855 after borrowing money from her relatives at Kolkata. Besides the compensation, the NCDRC directed the airline to refund the consumer Rs 80,855 with interest at the rate of nine per cent after deducting the airfare between Kolkata and Delhi. The company was also to compensate Rs 10,000 towards litigation cost. It has also been reported via news houses that the Supreme Court found no reasons to interfere with the National Commission’s order.
By reading the provisions of Consumers Protection Act, 1986 and I.T. Act, 2000 and with the help of the ratio of the judgement in A.B.C. Laminart Pvt. Ltd. and anr.'s case, we can safely hold that, where contracts for services and/or goods are entered into over the internet (or online as such transactions are commonly referred to), for the purposes of consumer complaints, part of the cause of action arises interalia, at the complainant’s place of business, if acceptance of the contract is communicated to her through the internet, including the medium of email. Further, irrespective of the fact, whether or not the contract is one made over the internet, cause of action would also continue to arise at any of the places
(a) where the contract is performed or is to be performed or
(b) where money under the contract is either payable or paid or
(c) where repudiation of the contract is received, if any.
As such, it cannot be disputed that a consumer forum is competent to entertain a consumer complaint, even if only an infinitesimal part of cause of action arises within its territorial jurisdiction. As a result, territorial jurisdiction over a consumer complaint would lie with the consumer forum situated at any place, where any of the aforementioned causes of action arises. This, of course, is in addition to the other places, where a consumer may choose to file a complaint in accordance with the other provisions of Section 11 (2) of the CPA, 1986. It was reiterated in the case of M.D.Air Deccan vs Shri Ram Gopal Agarwal where the State Consumer Disputes Redressal Forum interpreted Section 13 of the IT Act along with Section 11 of the CPA.
To cope up with the technology law has to take the help of technology; as Charles Clark once remarked ‘The answer to the machine is in the machine’. Indeed, the perfect reply to the technological abuses is the application of technological innovation.
This is a landmark case in ecommerce dispute resolution and jurisdiction issues. This is a big relief for ecommerce buyers such as of Amazon, Flipkart, Naaptol, Myntra, online insurance providers, Travel portals etc. I feel online consumers have got clarity now that a case can be filed against online sellers sitting in their own homes as all consumer disputes also can be filed online with or without lawyers help. I feel the ratio held in the above case can safely be included in the next scheduled amendment of The IT Act, 2000 
The Orders for Download available on links below

Friday, August 4, 2017

A man from Odisha gets six years of Jail in cyber pornography Section 67A: A Revenge Porn Case

Judgement Dowload link

Judicial Magistrate in Puri today sentenced a man to six years of imprisonment in a cyber pornography (A revenge Porn) case, stated to be the first such case.
Puri Sub-Divisional Judicial Magistrate Shibasis Giri also slapped a Rs-9,000 fine on the convict, Jayanta Kumar Das an alleged RTI activist, A fake profile was created by the accused in the name of the victim woman from Puri Township in a pornographic site, who then had uploaded the woman’s name, address, photo and phone number on a pornographic website in 2012 to take revenge against her husband.After her personal info was posed on the site, the victim started receiving calls from numerous persons enquiring about her interest in paid sex and wife swapping.
The husband of the woman, a local journalist, had written about several cases involving the convict.
The crime branch had arrested Das on September 18, 2012, following a complaint filed by the victim in July.He was booked under several sections of the Indian Penal Code and Information Technology Act, 2000. Sections 292, 465, 469, 500 of the Indian Penal Code and 66(C) and 67A of the Information Technology Act,2000(cyber law of India) were applied
The conviction was procured on evidence, including crucial witness statements of scientists from the Central Forensic Science Laboratory, Kolkata.

My Views:
I highly appreciate the conviction upheld as India is short of convictions for cyber crimes committed. This remains first of a kind of conviction in odisha state and could be a first serious conviction of a revenge porn in India. Maligning and destroying a girls life by defaming her online often kills a ladies zeal to live. 
I feel if the convict moves for appeal, his punishment under sections of IPC would be set aside by the High Court in the light of decision made under Sharat Babu Digumarti Vs State Govt of NCT of Delhi but punishment under Sections 66(c) & 67A could be confirmed on merits of the case.

Thursday, July 27, 2017

What do we mean by a “right of privacy” in India?

What do we mean by a “right of privacy” in India?

Justice Cooley in 1888 defined it simply as a right to be left alone. Alternatively, it may be defined as a right to be anonymous. The two definitions are quite different but both are important, and the right to be anonymous is a form of privacy that has particularly significant implications in cyberspace. In legal terms, our right of privacy amounts to a right to be free from government intrusion into certain areas of our lives and a right to be free from intrusion by other individuals into our “private” lives. The former is protected largely through Constitutional interpretation and a number of statutes; the latter is protected largely through the common law under tort principles.
Before 1890 no English or American court had ever granted relief based on such a claim as “invasion of privacy.” 
However, in 1890 a Harvard Law Review article by Samuel Warren and Louis Brandeis examined a number of cases ostensibly decided on other grounds, and concluded that these decisions were actually based on a broader principle, a right of privacy. Warren and Brandeis claimed such a principle was in fact necessary to deal with what was seen as the growing problem of excesses of the press. New York was the first state to confront this issue head on in the wake of the article. Several lower courts had held the existence of a right of privacy.
The New York State Court of Appeals (which is, oddly, the State’s highest court – the “Supreme Court” is the State’s entry level court) got to review the matter in the case of Roberson v. Rochester Folding Box Company in 1902. In this case, the defendant had used a picture of an attractive young woman to advertise its flour without her consent. In a 4–3 decision, the Court of Appeals held that there was no legal precedent for such “right of privacy.” Furthermore, the Court felt that recognizing a right of privacy was a poor idea because, first, the alleged harm was of a purely mental character and would thus be difficult to prove or disprove; second, recognizing a right of privacy would lead to a flood of litigation; third, there would be difficulty in distinguishing between “public” and “private” figures, whose protections under a right of privacy would differ; and finally because it might lead to undue restrictions on the freedom of the press.
A public outcry followed the decision and, in its next session, the New York State Legislature passed a law banning the use of a person’s name or picture “for advertising purposes or for the purposes of trade” without the person’s written consent. By the 1930s “virtually” all jurisdictions had recognized the Right of Privacy, either by statute or through the common law.
Man’s house is his castle.a well-known proverb is also getting legal recognition as Right to Privacy. Human beings have a natural need to autonomy or control over confidential part of their. This need is inherent in human behaviour  and now this has been recognized as fundamental right to privacy. It is not a right against physical restrains but it is a right against psychological restrain or encroachment of right . USA, UK, India, and at International level UDHR, ECHR, ICCPR has recognized this right as fundamental right.
Position in India
Right to Privacy is not explicit in the Constitution of India, so it is a subject of judicial interpretation. The judicial interpretations of fundamental right bring it within the purview of fundamental right. The journey of this project would start from the search of answer of issue that whether the right to privacy is a fundamental right, through analysis of cases and some pioneering work of scholars.
In India, after the case of R. Rajagopal alias R. R. Gopal v State of Tamil Nadu and People s Union for Civil Liberties (PUCL) v Union of India , the right to privacy is well recognized as Right to Life. In the case of People s Union for Civil Liberties (PUCL) v Union of India (Telephone Taping Case) Supreme of India also observed Article 17 of ICCPR and Article 12 of UDHN.
The apex court is hearing the Aadhaar card privacy issue.The Government is of a view and has argued before Supreme Court that “there is a fundamental right to privacy, but it is a wholly qualified right”.  The constitution bench of Supreme Court in the same case have said "Can this court define privacy? You can't make a catalogue of what constitutes privacy. Privacy is so amorphous and includes everything... if we make any attempt to catalogue privacy it will have disastrous consequences," 
What now evolves remains to be seen, but i agree that Privacy cannot be an absolute right. I also agree that Data Privacy is bigger than Right to Privacy in this cyber age. India definitely needs Data Privacy or Data Protection Act.

Sunday, July 23, 2017

Why does India need Data Privacy or Protection Law ?

Why does India need a Data Protection Law?
Apart from appeasing European Union for sharing data with Indian companies, One of the reason is
presently all Data of ours -Search, Emails, Chats of Google, FB, Hotmail, Whatsapp are stored in Californian Servers, USA Jurisdiction.

US Foriegn Intelligence Survivelenace Court (FISA) with a single penstroke court gag order can take all Indian MPs, PMO, Home Minister,MEA's etc Email data and Analyse them for leverage in Intl' Affairs, Thats a severe Threat, #privacy intrusion. 

Not to mention even the Locations of each Citizen,Official in India can be monitored by US NSA analysts as of now with #Whatsapp, Android Phones relaying data back to USA servers. 
Hence a Data Protection Law in India is a need of the Hour.

Monday, July 3, 2017

Prashant Mali Interview in Business Standard Newpaper

Ransom-payers are also the cause of ransomware proliferation: Prashant Mali

The ransom to retrieve files was reportedly $300, to be paid in virtual currency bitcoins

Nikita Puri 
Operations at a terminal of the country’s largest container port, in Mumbai, came to a standstill earlier this week. The process of loading and unloading containers was halted as the port’s computers shut down after a major that swept across the globe. The aggressiveness of the malware showed that such attacks were capable of bringing both corporate and government networks to a sudden halt. The ransom to retrieve files was reportedly $300, to be paid in virtual currency bitcoins. expert Prashant Mali, also an advocate at the Bombay High Court, tells Nikita Puri how to prevent mass-scale civil disruptions that future cyber attacks can result in. Edited excerpts:
First we had individual companies and high-networth individuals who were targets of ransomware, then WannaCry hit servers across the globe. Now another malware, which some are identifying as Petya, has sent corporations into a tizzy. Do you foresee more such threats?

To date, financial cyber crime has only grown and it is yet to peak, so I would say it’s written on the wall that many more such attacks are expected in the near future. Such threats loom large as the ransom is paid in bitcoins, so the criminals aren’t caught. One thing the police and the government can do is to ensure that citizens make compulsory declarations of purchase of bitcoins and other (like ethereum) when they file their income tax returns. This can help the government see who pays and how much because, I feel, ransom-payers are also the cause of ransomware proliferation.
confirm that the malware isn't really a ransomware, but a wiper designed to destroy data. Reportedly, because of “ its aggressive features,” the malware makes it impossible to retrieve certain files leading many to believe that this attack may not have been for money. Can this be seen as an attempt to test how far companies will go to protect data?
Even if cyber attacks don’t cause financial damage, they definitely throw open defences. Identifying fortresses that have holes in their system can be of interest to the state and non-state actors. This data of the number of loopholes is in demand and is sold at a premium price. There are different types of involved in the dark world: many a time those who look for such holes, those who attack, and those who intend to get ransoms are all different.
Companies are often wary of making such attacks public. Security firm Symantec has said that India is the worst hit in Asia, but we have confirmation only from Mumbai’s Do you think information sharing could actually help build a better defence against such attacks?
By not reporting such attacks, companies are depriving the nation of a knowledge database that can help other companies develop better defences. Symantec and other (security) vendors also cannot be fully relied upon because fear is what they harp on. The more fear they put in Indians, the more they sell security products. The Insurance Regulatory and Development Authority of India and insurance companies should make it compulsory for clients to file a First Information Report (FIR) before claiming cyber insurance. Once reporting to some government agency becomes mandatory to claim insurance, companies would be motivated.
What are the security measures that one must take to avoid such attacks? 
No one can be immune in cyber space and that's the reality. Only cyber awareness in organisations can bring in cyber resilience. I would advise organisations to have multi-prong policies to establish a cyber security culture. I feel the highest level of cyber safety can be achieved by establishing a cyber security culture in the company, and a country can be cyber resilient by cultivating a culture of cyber security in society. Government should quadruple its budget for digital literacy programmes. For the government to be ahead of hackers, we need cyber spies: our law and enforcement agencies should implant cyber spies among cyber criminals. The chatter within their group helps the state to be ready for what is coming: we need cyber intelligence. 
Do you think companies should have ethical hackers on their pay rolls
I have an issue with the term “ethical hackers” because legally this isn’t right: those are two contradictory terms put together. who use these terms are either doing it for branding purpose or are students. Companies should opt for services by cyber security researchers. 
Are India’s cyber laws equipped to handle such large-scale attacks?
No. Laws can be invoked when prima facie evidence is found against criminals and investigation can be completed if attribution to a criminal is possible. The legal framework to help enforcement agencies in India has serious flaws. Large-scale cyber attacks need multiple law and enforcement agencies to work together along with CERT-In (Indian Computer Emergency Response Team), but the protocol for this is yet to be developed. 
In the future, cyber attacks are going to affect government facilities meant for citizens: like centres for health, water etcetera. Even municipalities should coordinate with the aforementioned agencies to avoid mass scale civil disruption from cyber attacks.

Tuesday, June 27, 2017

Petya Ransomeware Attack : What to Do immediately

Petya/Petwrap ransomware

What is Petya Ransomeware do?
Ransomware, Petya does not encrypt files on a targeted system one by one.
Instead, Petya reboots victims computers and encrypts the hard drive's master file table (MFT) and rendering the master boot record (MBR) inoperable, restricting access to the full system by seizing information about file names, sizes, and location on the physical disk.

Petya replaces the computer's MBR with its own malicious code that displays the ransom note and leaves computers unable to boot.

Why it spreads fast?
Ans : Petya ransomware successful in spreading because it combines both a client-side attack (CVE-2017-0199) and a network based threat (MS17-010)
So patch both first!

Affected countries: UK, Ukraine, India, the Netherlands, Spain, Denmark, and others

Encrypts MFT (Master File Tree) tables for NTFS partitions and overwrites the MBR (Master Boot Record) with a custom bootloader that shows a ransom note and prevents victims from booting their computer.

Actions to be taken:
1. Block source E-mail address
2. Block domains:

3. Block IPs:
4. Apply patches:
Refer(in Russian): https://habrahabr.ru/post/331762/

5. Disable SMBv1

6. Update Anti-Virus hashes

myguy.xls EE29B9C01318A1E23836B949942DB14D4811246FDAE2F41DF9F0DCD922C63BC6
BCA9D6.exe 17DACEDB6F0379A65160D73C0AE3AA1F03465AE75CB6AE754C7DCB3017AF1FBD
As of a Kill-switch can be used for #Petya Ransomware. 
i.e. Just create a file "C:\Windows\perfc"
Does this affect you?* 

Though this attack is largely targeting companies, it's important you stay vigilant and take following precautionary measures.

- Always make sure your anti-virus is up-to-date to maximize the protection available to you.

- Don't click too quickly. This attack may be spreading through phishing or spam emails, so make sure you check an email's content for legitimacy. Hover over a link and see if it's going to a reliable URL. Or, if you're unsure about an email's content or the source it came from, do a quick search and look for other instances of this campaign, and what those instances could tell you about the email's legitimacy.

- Do a complete back up. Back up all your PCs immediately. If your machine becomes infected with Petya ransomware, your data could become completely inaccessible. Make sure you cover all your bases and have your data stored on an external hard drive or elsewhere.

- Apply system and application updates.Making sure your operating system is up to date will help contain the spread of this malware.

Monday, June 19, 2017

Electronic Evidence where to find in Files

Electronic Evidence where to find in files 

Windows Searches — For years, one challenge in digital investigative analysis has been proving a user not only had something significant to an investigation on their computer, but that he knew it was on there. Two of the easiest ways help prove knowledge of a file is to prove the user was searching for it or accessed it. In order for Microsoft to enhance the user experience, Windows tracks the names of files you access and search for in multiple locations. As previously discussed, the Windows registry is essentially several databases called registry hives. Each user has his own primary registry hive called the NTUSER.DAT. This registry hive tracks information specific to each user’s activity and preferences. Starting in Windows 7, when a user conducts a search on his computer using the Windows search function or the “Charm Bar” in Windows 8-10 (the magnifying glass that appears when you move your mouse to the right edge of the screen), Windows records each search in temporal order in the “NTUSER.DAT\ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\WordWheelQuery” registry key. Because the searches are recorded in temporal order, an analyst can frequently see indications of the user’s thought process as he searched for particular files. 

File Access —– Windows also records in numerous artifacts when a user opens or attempts to open non-executable files. Four of the most useful digital artifacts to identify files opened or attempted to be opened are “LNK” files (pronounced as “link” files), Jump Lists, and several “most recently used” registry keys. 

LNK files — A LNK File is an artifact that has existed since Windows XP. LNK files are also known as a “Windows Shortcut” files and are created anytime a user opens or attempts to open a nonexecutable file. A LNK file is created even if the file opened is on a network or external drive. When an opened file is later deleted, its LNK file does not get deleted with it. Windows creates and stores approximately 149 LNK files in the user’s home directory under the “AppData\Roaming\Microsoft\ Windows\Recent” directory. LNK files contain a wealth of information including the modified, accessed, and created dates and times of the file opened; the full directory path, volume name, and volume serial number from which the file was last opened; and the file size. 
Starting in Windows 10, Microsoft added rules to when LNK files would be created in addition to when files are opened. On earlier versions of Windows 10, a LNK file was created for the directory to which any file was copied. The creation of a LNK file for the directory a file was copied to was stopped on later versions of Windows 10. However, on versions as early as version 1607, Microsoft created a LNK file for the directory a file is opened from. Additionally, when a directory is created, Windows creates a LNK file for the directory created and for the created directories “parent” and “grandparent” directory. In addition to all the information LNK files record, LNK files also record the last time a file was opened. 

Jump Lists — One of the newest artifacts to identify files opened by a user are “Jump Lists.” Starting in Windows 7, Microsoft introduced two types of jump lists: “AutomaticDestinations” and “CustomDestinations.” Automatic and Custom jump lists are created and stored in their respective directory in each user’s home directory under the “AppData\ Roaming\ Microsoft\ Windows\Recent” directory. Each application can incorporate its own jump lists as a “mini-start” menu. Automatic Destinations allow a user to quickly “jump” to or access files they recently or frequently used, usually by right-clicking the application in the Windows taskbar. CustomDestinations allow a user to pin recent tasks, such as opening a new browser window or create a new spreadsheet to the jump list. Jump lists are essentially mega LNK files. Each jump list can record upwards of the last 1,000 files opened by each application. As jump lists are essentially compound LNK files, they contain all the same information as LNK files, such as when each file was opened, modified, accessed, and created; dates and times that the file was opened; the full directory path, volume name, and volume serial number from where the file was last opened; and the file size. 

Most Recently Used (MRU) Registry Keys – As previously mentioned, the Windows Registry is a series of massive databases that track system configuration and user activity. There are several registry keys that track most recently used items. An analysis of these registry keys can help an analyst quickly identify files accessed. Every application developer has the option of creating registry keys specific to his application configuration and user activity. Three of the most useful registry keys that track files accessed are “RecentDocs,” “Microsoft Office FileMRU,” and “OpenSavePIDMRU.” 

RecentDocs — The “RecentDocs” registry key tracks the name and order of the last 10 files opened for every file extension (e.g. .doc, .docx, .jpg, etc.). The registry organizes each of the last 10 files opened in sub keys named by the file extension. A sub key named “folder” is also created when the first folder is opened using the Windows Explorer. This sub key tracks the name of the last 30 folders opened. Each user has his own RecentDocs registry key located in his NTUSER.DAT registry hive under the “\Software\ Microsoft\ Windows\ Currentversion\ Explorer” registry key. The master RecentDocs key maintains a master list, organized in temporal order of the last 150 files or folders opened. By analyzing the order that particular files were opened, analysts have often been able to refute claims that a single type of file was opened by mistake. In one trade secret case, it was helpful for the analyst to show the pattern of files opened that all related to the same subject matter. 

Applications Specific Most Recently Used (MRU) — With every Windows application, developers have the ability to create their own set of registry keys to track specific configuration and user activity for their application. If a specific application is used to commit or facilitate a crime or is otherwise significant to an investigation, it is often advantageous for the analyst to determine both if the application has its own set of registry keys and what actions those keys record. Two excellent examples are “Winzip,” which records the name of the last several zip files created using the Microsoft Office suite of applications. Each application in the Office suite has its own set of “FileMRU” (most recently used files) that tracks most recent files used and when they were opened. Additionally, starting with Office version 365 and 2016, Microsoft Office tracks the “reading location” for each Word, PowerPoint, and Excel document opened and when each file was closed. Using this information, an analyst can determine not only what document was last opened and when it was closed, but also that the user had scrolled to and was on page 32 of the document when it was closed. 

OpenSavePIDMRU — Windows has some basic dialog boxes that all programs can use when a user opens or saves a file. Some may have noticed that when saving files, a dropdown arrow in the file name dialog entry location appears. By clicking on the arrow, you will see several of the most recent file names you have saved for that application. These file names are saved as a part of the “OpenSavePIDMRU” registry key which is located under the “NTUSER.DAT \ Software\ Microsoft\ Windows\ CurrentVersion\ Explorer\ ComDlg32\ OpenSaveMRU” registry key. A record of the last 10 to 25 names of the last files opened or saved using the Windows Common Dialog Box are stored under sub keys based on file extension.

Tuesday, May 2, 2017


Cybercrime :

Comprehensive guidelines referred to in Letter No. 55019/17/2017-Legal Cell, dated ______ of Internal security Division, Ministry of Home Affairs regarding service of summons/notices/judicial process on persons residing abroad. --

1. Section 105 of Criminal Procedure Code (CrPC) speaks of reciprocal arrangements to be made by Central Government with the Foreign Governments with regard to the service of summons / warrants / judicial processes. The Ministry of Home Affairs has entered into Mutual Legal Assistance treaty/Agreements with 22 countries which provide for serving of documents. These countries are Switzerland, Turkey, United Kingdom, Canada, Kazakhastan, United Arab Emirates, Russia, Uzbekistan, Tajikistan, Ukraine, Mongolia, Thailand, France, Bahrain, South Korea, United States of America, Singapore, South Africa, Mauritius, Belarus, Spain and Kuwait. In other cases the ministry makes a request on the basis of assurance of reciprocity to the concerned foreign government through the mission / Embassy. The difference between the two categories of the countries is that the country having MLAT has obligation to consider serving the documents whereas the non-MLAT countries does not have any obligation to consider such a request.Summons/notices/judicial processes issued by the Indian Courts.

2. The summons/warrants/judicial processes received by MHA are forwarded to the concerned Indian Missions/Embassies which in turn, takes up the matter with the designated authority in that country. In case of MLAT countries, the manner of communication is as laid down in MLAT and can be either directly between MHA and the Central Authority or can be through the diplomatic channel. The designated authority after considering the request directs its agency to serve the document on the concerned person and the report of the service, if any is also received through the same chain. This is broadly the system in majority of the countries. However, in some countries private companies/NGOs have also been entrusted with the service of judicial papers.

3. Based on the experience gained, some guidelines are given below which may be followed while making a request to MHA for service of judicial processes. It may, however, be noted that it is the discretion of the requested country to serve the documents and any time frame for a positive response cannot be predicted.

a) All requests for service of summons / notices / judicial processes on persons residing abroad shall be addressed to the Under Secretary(Legal), IS-II Division, Ministry of Home Affairs, 9th Floor, Lok Nayak Bhawan, New Delhi- 110003. 
All requests shall be forwarded through post only with a covering letter from the  Court official giving the following information: 
a) Material facts of the criminal matter including purpose of the request and the nature of the assistance sought. 
b) The offences alleged to have been committed, a copy of the applicable laws and maximum penalties for these offence. 
c) Name, designation, telephone and fax number of the person/officer who will be able to give any clarification, if required. 
d) The complete address of the issuing authority to which the judicial papers/service reports may be returned. 
e) Approval of the competent authority to bear any expenditure, which they be charged by the foreign government/agency for the service of the documents. 
f) Degree of confidentiality required and the reasons therefore(in case of confidentiality requirement). g) Any time limit within which the request should be executed. 
This will be subject to allowance of sufficient margin of time by the requesting agency, as indicated in para 3(iv) of the guidelines b) MHA, on receipt of request, will examine it in view of the provisions of treaty, if exists, with the requested country and as per the provision of CrPC in case of non-treaty country. 
c) MHA requires at least a period of 12 weeks times for service of such notices in the concerned countries. It is, therefore imperative that a date of hearing/appearance may be decided accordingly. 
d) In the case of non English speaking countries, the notices should be accompanied with the certified/authenticated translation(in duplicate) in the official language of the country where the notice is proposed to be served. 
e) Name and address of the individual/organization should be complete in all respect and PO BOX no. and Passport no. will not suffice as address of the individual. 
f) Ministry of Home Affairs responsibility to service the summons is only in Criminal Matters. Hence, summons in Criminal matters only may be sent to the Ministry for service abroad. 
g) MHA does not undertake service of the non-bailable warrants of arrest. The service of non-bailable arrest warrents amounts to the extradition of the individual. 
The request for extradition are based on certain legal procedures contained in applicable treaties negotiated on the basis of the International Principle of Extradition. 
Such requests are to be forwarded to the Ministry of External Affairs, CPV Division, Patiala House Annexe, Tilak Marg, New Delhi – 110001."

Cyber Security Questions for Board of Directors

Cyber Security Questions for Board of Directors.

Although Board of directors have added cybersecurity risk to their agendas, there is no standard way for boards to think about cybersecurity, much less time-tested guidelines to help them navigate the issue.
For boards, cybersecurity is an issue of enterprise risk. As with all enterprise risks, the key focus is mitigation, not prevention. This universally understood enterprise risk guideline is especially helpful in the context of cybersecurity because no one can prevent all cyber breaches. Every company is a target, and a sufficiently motivated and well-resourced adversary can and will get into a company’s network.
Consequently, terms like “cyber defense” are insufficient descriptors of an effective posture because they evoke the image that corporations can establish an invincible perimeter around their networks to prevent access by bad actors. Today, it’s more accurate to think of the board-level cybersecurity review goal as “cyber resilience.” The idea behind the cyber resilience mindset is that, because you know network breaches will happen, it is more important to focus on preparing to meet cyberthreats as rapidly as possible and on mitigating the associated risks.

1. How do we integrate Cybersecurity with the current business direction and planning? 
2. What are our main Cybersecurity risks? 
3. Is the right amount of Cybersecurity risk accepted? 
4. Is our process for identifying, assessing and managing Cybersecurity risks effective? 
5. Do we have Cybersecurity culture in our organisation ? Do people in this organisation have a common understanding of the term "Cybersecurity"? 
6. How do we ensure that Cybersecurity risk management is an integral part of the planning and day-to-day operations of individual business units? 
7. How do we ensure that the Board’s expectations for Cybersecurity risk management are communicated to and followed by the employees in the company? 
8. Do we have process to manage Electronic evidence? How do we ensure that our executives and employees act in the best interests of this organisation's Cybersecurity posture? 
9. How is Cybersecurity risk management coordinated across the organisation and vendors?
10. How do we ensure that the organisation is performing according to the business plan and within appropriate Cybersecurity risk tolerance limits? 
11. How do we monitor and evaluate changes in the external environment and their impact on the organisation's strategy and Cybersecurity risk management practices? 
12. What information about the Cybersecurity risks targeting the organisation does the Board get to help it fulfil its stewardship and governance responsibilities? 
13. How do we know that the information the Board gets on Cybersecurity risks or threats and vulnerabilities is timely, accurate and reliable? 
14. How do we decide what information on Cybersecurity risks we should publish? 
15. How do we take advantage of the organisational learning that results from the Cybersecurity risk management corrective actions and/or preventive action plans? 
16. What are our priorities as a Board in the oversight of Cybersecurity risks? 
17. How does the Board handle its responsibility for the oversight of opportunities that introduce Cybersecurity risks to the organisation? 
18. How does the Board ensure that at least some of its members have the requisite knowledge and experience to address Cybersecurity risks and one of the member serves as an expert ?
19. How do we, as a Board, help establish the "tone at the top" that reinforces the organisation's values and promotes a "Cybersecurity culture"? 
20. How many grades the Board wish to give itself for overseeing Cybersecurity risk? 
The board is accountable for the organisation’s investment strategy. In years past, information security spending was part of a larger IT-related budget. Not anymore. Gartner estimates that by 2020, IT security spending will grow from $75 billion to $170 billion. With such levels of spending, boards will be more apt to scrutinize investments and actively manage budgets. 
To manage the risk associated with a cyber attack, leadership must bring together key components of an organisation to develop joint ownership of risks and a comprehensive approach to cybersecurity. Having a policy isn’t enough. Companies also need tools, processes, and up-to-date information on the ever changing threats to their enterprises. 

The Author is Chevening Cyber Security Fellow (UK) and participant of IVLP (USA) on Linking Digital Policy Cyber Crime Law Enforcement Program. He is a Practising Lawyer of Bombay High court. 
He regularly Advices Top Corporate Companies and Government Agencies on Cybersecurity Technical and Legal Issues.

Navy man in Jail for 2 years for Child Pornography, cyber crime in India

Navy man gets 2 years Jail for Child Pornography, cyber crime in India : Cyber crime conviction By Prashant Mali In the case of D...