1. Introduction

Cyber-espionage targeting biotechnology firms refers to the unauthorised acquisition, monitoring, copying or transfer of confidential scientific, commercial or strategic information through digital systems. Biotechnology companies are particularly attractive targets because their research may involve high-value intellectual property, proprietary genetic data, pharmaceutical formulations, vaccine technologies, clinical-trial results and manufacturing processes.

The perpetrators may include competing businesses, criminal groups, contractors, insiders or state-sponsored actors. The legal response depends on the nature of the intrusion, the information stolen, the identity and location of the perpetrators, and the jurisdictions affected.

The central legal issue is how to protect commercially valuable research and sensitive biological data while establishing criminal liability, preserving digital evidence, obtaining compensation and preventing further disclosure.

This explanation focuses primarily on Indian law, with comparative references to the United States, the United Kingdom and international legal principles.

2. Legal character of cyber-espionage against biotech firms

Cyber-espionage can engage several overlapping legal categories.

Unauthorised access and data theft

Intrusion into research servers, cloud repositories, laboratory information systems or employee accounts may trigger cybercrime provisions, even if no physical property is taken.

Trade-secret and intellectual-property misappropriation

Theft of unpublished drug candidates, source code, process parameters, proprietary algorithms or manufacturing methods may support civil claims, contractual remedies and, depending on the facts, criminal proceedings.

Sensitive biological and personal data

Exfiltration of genomic records, clinical-trial participant details or identifiable health information can create separate privacy, confidentiality and regulatory liabilities.

Cross-border or state-linked espionage

Remote intrusions may involve foreign infrastructure, overseas collaborators or alleged state sponsorship, complicating attribution, evidence gathering, extradition and enforcement of judgments.

An important distinction is that cyber-espionage is not automatically the same as conventional industrial espionage, cyberterrorism or a formally recognised international crime. The applicable offences must be established under the law of the relevant jurisdiction.

3. Indian statutory framework

A. Information Technology Act, 2000

The IT Act is the principal Indian statute for many forms of unauthorised computer access and data theft.

Practical application: If an attacker copies unpublished vaccine-development data from an Indian biotechnology company's server without permission, Section 43 may support compensation proceedings, while Section 66 may apply if dishonest or fraudulent intent is proved. Other provisions depend on additional facts.

Section 66F, concerning cyberterrorism, should not be invoked merely because the target is a biotechnology company. Its particular statutory requirements must be satisfied.

B. Bharatiya Nyaya Sanhita, 2023

The Bharatiya Nyaya Sanhita (BNS), in force from 1 July 2024, may apply alongside the IT Act where the conduct independently constitutes an offence under general criminal law.

Depending on the evidence, potentially relevant offences may include:

Cheating and dishonest inducement.

Criminal breach of trust.

Forgery and use of forged documents.

Criminal conspiracy and abetment.

Extortion or other offences where the relevant elements are established.

For example, an employee who steals laboratory credentials, uses forged authorisations to obtain access and conspires with an outside competitor may expose themselves and participating individuals to multiple charges. The precise provisions must be selected according to the proven conduct, not simply the label “cyber-espionage.”

C. Digital personal data protection

The Digital Personal Data Protection Act, 2023 (DPDP Act), its applicable commencement notifications and rules must be considered where the incident involves digital personal data.

Biotech firms may hold identifiable patient records, genomic data, clinical-trial participant information and employee records. A breach involving such data raises questions of lawful processing, security safeguards, breach notification and responsibility for data processors.

Two distinctions matter:

Personal data versus trade secrets: A proprietary protein-production method may be confidential commercial information without being personal data.

Applicability and commencement: The DPDP Act's obligations must be assessed against the relevant commencement provisions and rules in force on the incident date. It should not be assumed that every provision is operative merely because the Act has been enacted.

The IT Act, contractual confidentiality obligations and applicable health-sector requirements may remain relevant independently.

D. Intellectual property and confidential information

India does not have a single, comprehensive standalone trade-secrets statute equivalent to the United States' Defend Trade Secrets Act.

Biotechnology firms therefore commonly rely on a combination of:

Contract law and non-disclosure agreements.

Equitable protection against breach of confidence.

Copyright protection for qualifying source code, research documents and original technical drawings.

Patent law where an invention qualifies for patent protection.

Employment, fiduciary and commercial obligations.

Patent protection and secrecy are not interchangeable. A patent generally requires disclosure of the invention, whereas a trade secret derives value from remaining confidential. Prematurely publishing research stolen during a cyberattack can therefore create serious commercial harm.

4. Important case laws

The following decisions provide useful legal principles. Some concern confidential information or digital rights rather than cyber-espionage specifically; their relevance should be understood accordingly.

Case 1: John Richard Brady v. Chemical Process Equipments Pvt. Ltd. (Delhi High Court, 1987)

AIR 1987 Delhi 372

Facts: The plaintiffs alleged that confidential technical drawings, designs and know-how concerning industrial machinery had been used by the defendants to reproduce competing equipment.

Legal principle: The Delhi High Court considered the protection of confidential technical information and the use of information disclosed for a limited purpose. The case is a leading Indian authority on equitable protection of confidential know-how.

Indian Kanoon+1

Application to biotech firms: If a research partner receives confidential fermentation protocols or manufacturing drawings under restricted access and later uses them to develop a competing product, the company may seek an injunction and other civil relief.

The claimant must establish that the information is sufficiently confidential, that the defendant's use is legally wrongful and that the relevant requirements for the remedy are satisfied.

Case 2: Gagan Harsh Sharma v. State of Maharashtra (Bombay High Court, 2018)

2018 SCC OnLine Bom 6271

Facts and context: The dispute involved allegations concerning computer-related offences in a commercial and corporate conflict.

Legal principle: The decision cautions against using Sections 43 and 66 of the IT Act as a substitute for resolving an essentially civil or commercial dispute over source code or company control. Criminal proceedings require the statutory ingredients of the alleged offences.

IndiaCode

Application to biotech firms: A disagreement about ownership of laboratory software or rights to research developed during employment is not automatically cybercrime. Evidence of unauthorised access, dishonest or fraudulent conduct, and the other necessary elements must be examined separately.

The converse is equally important: a genuine cyber intrusion should not be dismissed as merely a commercial dispute simply because the stolen information is commercially valuable.

Case 3: Justice K.S. Puttaswamy (Retd.) v. Union of India (Supreme Court of India, 2017)

(2017) 10 SCC 1

Facts: The Supreme Court considered whether privacy is constitutionally protected as a fundamental right.

Legal principle: The Court recognised privacy as a fundamental right under the Constitution, including protections associated with dignity, autonomy and informational privacy.

Application to biotech firms: Where cyber-espionage exposes identifiable genomic information, reproductive-health records or clinical-trial data, the incident may affect the privacy rights of individuals as well as the company's commercial interests.

However, Puttaswamy does not itself create a standalone criminal offence of cyber-espionage. It informs constitutional analysis and the interpretation of applicable privacy protections.

Case 4: Shreya Singhal v. Union of India (Supreme Court of India, 2015)

(2015) 5 SCC 1

Facts: The Court reviewed Section 66A of the IT Act, which criminalised certain online communications.

Legal principle: The Court struck down Section 66A as unconstitutional.

Application to biotech firms: Cybercrime complaints must rely on valid, applicable statutory provisions rather than an invalidated section of the IT Act. This is especially important when investigators characterise online conduct broadly without identifying the precise offence.

The case is a general digital-law authority, not a direct ruling on trade-secret theft.

Case 5: United States v. Xanthe Lam and Allen Lam — Genentech trade-secret prosecution (2021)

U.S. District Court, Northern District of California; criminal proceedings

Facts: In July 2021, the U.S. Department of Justice announced that a former principal scientist at Genentech and her husband had pleaded guilty to crimes connected with the theft of confidential corporate information. The information was allegedly shared with other companies, including a Taiwanese biotechnology startup. The case involved trade-secret theft and conspiracy, with computer-related offences also implicated.

United States Department of Justice

Legal significance: Employees and insiders can be liable for misappropriating research even where they originally obtained legitimate access to it through their employment.

Application: A biotech company should not assume that strong perimeter cybersecurity alone is sufficient. Insider access controls, research-data monitoring, contractual restrictions and controls on bulk downloads are also important.

This was a criminal prosecution involving trade-secret theft; it should not be described as exclusively a cyber-espionage case.

Case 6: U.S. Department of Justice cyber-intrusion indictment concerning infectious-disease research (2021)

U.S. Department of Justice, Southern District of California, 19 July 2021

Facts: U.S. prosecutors announced an indictment against four Chinese nationals alleging a computer-intrusion campaign conducted between 2011 and 2018. The alleged targets included biotechnology and pharmaceutical companies, universities and research institutes. The indictment described alleged theft of genetic-sequencing technology and information relating to infectious diseases, including Ebola, MERS and HIV/AIDS.

United States Department of Justice

Legal significance: The allegations illustrate how cyber-intrusion, trade-secret theft and suspected state-linked activity may overlap. They also demonstrate the evidentiary and jurisdictional challenges of prosecuting alleged foreign operators.

Important qualification: An indictment contains allegations, not proof of guilt. This example should not be treated as a judicial finding against every accused person.

5. Comparative international legal framework

Constituent Services | U.S. Representative Mike Ezell

United States

The Economic Espionage Act, 18 U.S.C. §§ 1831–1839, distinguishes espionage intended to benefit a foreign government or its agent from commercial theft of trade secrets.

Section 1831 addresses economic espionage for a foreign-government benefit.

Section 1832 addresses trade-secret theft intended to benefit someone other than the owner and injure the owner.

Section 1836 provides a federal civil action for trade-secret misappropriation, subject to its statutory requirements.

These provisions can be highly relevant where stolen drug-development or genetic-sequencing technology is connected to the United States.

LII / Legal Information Institute+2

Dozens of divorces wrongly approved due to online system error, High Court told | The Independent

United Kingdom

The Computer Misuse Act 1990 addresses unauthorised access and certain unauthorised computer activities. The Trade Secrets (Enforcement, etc.) Regulations 2018 implement protections against unlawful acquisition, use and disclosure of trade secrets.

Depending on the circumstances, civil injunctions, confidentiality remedies and criminal investigation may proceed through different legal routes.

WIPO: what is the World Intellectual Property Organization and what does it do? - Agent.biz

International framework

The TRIPS Agreement, particularly Article 39, requires WTO members to provide protection for qualifying undisclosed information against specified forms of unfair commercial use and disclosure.

The Budapest Convention on Cybercrime provides a framework for international cooperation among its parties. It is not a universal treaty, and its application depends on the states involved and the relevant legal arrangements.

Jurisdictional principle: An Indian company may have remedies in India even when its research data is hosted abroad. Foreign proceedings may also be possible where a foreign court has jurisdiction over the defendant, conduct or relevant assets. Neither outcome is automatic; territorial rules, evidence-sharing mechanisms and enforceability must be assessed separately.

6. Legal response after an espionage incident

The strongest response combines technical containment, evidence preservation, regulatory compliance and civil or criminal enforcement.

Stage 1 — Contain the incident

Isolate affected systems without unnecessarily destroying evidence.

Revoke compromised credentials and tokens.

Protect critical research repositories and backup environments.

Engage incident-response specialists and legal counsel.

Stage 2 — Preserve admissible evidence

Secure server logs, identity-provider records, cloud audit trails and endpoint artefacts.

Document data accessed, copied or transferred.

Preserve relevant emails, access records and contractual documents.

Maintain forensic integrity, chain of custody and appropriate evidence certifications.

Stage 3 — Notify appropriate authorities

Assess reporting obligations under applicable CERT-In directions, privacy law and sector-specific requirements.

Report suspected criminal conduct to the appropriate law-enforcement agency.

Consider foreign authorities if evidence establishes a legitimate foreign jurisdictional connection.

Make legally required disclosures without unnecessarily revealing trade secrets.

Stage 4 — Seek legal protection

Consider interim and permanent injunctions against use or disclosure.

Seek compensation or damages where legally available.

Pursue appropriate criminal investigation and prosecution.

Evaluate contractual, intellectual-property and confidentiality claims.

Stage 5 — Reduce continuing harm

Identify research already transferred to third parties.

Assess whether stolen information has affected patent filings or product development.

Review patient safety and privacy implications.

Strengthen access restrictions, supplier controls and incident-response procedures.

Reporting requirements in India

CERT-In's directions issued under Section 70B of the IT Act require covered entities to report specified cyber incidents within six hours of noticing them or being informed of them, as applicable under the directions. The scope and reporting procedure should be checked against the operative directions and current CERT-In guidance.

A company should not wait for complete forensic attribution before assessing whether a report is required. Reporting, preservation and containment can proceed in parallel.

7. Civil remedies and damages

A biotech company affected by espionage may consider several forms of relief.

The company should quantify loss carefully. Potential evidence includes diverted research expenditure, the cost of reproducing work, loss of licensing opportunities, commercial advantage obtained by a competitor and costs of investigating or mitigating the incident.

A claimed loss is not automatically recoverable merely because it is commercially significant. Causation, proof, applicable legal standards and the particular remedy matter.

8. Special issues for biotechnology companies

A. Patent confidentiality and priority

If stolen information appears in a foreign patent application, the company should urgently assess inventorship, ownership, filing dates, confidentiality obligations and available opposition or invalidation procedures. Patent law does not automatically transfer ownership merely because someone obtained the underlying information unlawfully.

B. Clinical-trial and genomic data

A breach may harm trial participants even when the company retains its intellectual property. The company should assess the exposure of identifiable records, potential re-identification, participant notification duties and applicable research ethics or regulatory requirements.

C. Biological safety and dual-use research

Where the stolen information concerns dangerous pathogens, biological containment systems or technologies capable of harmful misuse, the incident may also warrant specialist biosecurity assessment. Not every theft of biological research is a biosecurity offence; additional statutory requirements must be established.

D. Third-party laboratories and cloud providers

Contractual arrangements should specify security controls, incident reporting, evidence preservation, access logging, cooperation with investigations and responsibility for breach-related costs. A vendor's involvement does not automatically eliminate the biotech company's own legal obligations.

9. Principal legal challenges

Attribution: An IP address, compromised account or foreign server alone does not establish the identity of the attacker or state sponsorship.

Trade-secret proof: The claimant must identify the protected information and establish the required degree of secrecy and control.

Cross-border enforcement: Investigations may require preservation requests, mutual legal assistance, extradition procedures or foreign court orders.

Confidentiality during litigation: Pleadings and evidence must be handled so that the litigation itself does not unnecessarily disclose the very research being protected.

Competing obligations: Companies must reconcile investigative cooperation with privacy, clinical-trial confidentiality, contractual duties and legitimate disclosure requirements.

10. Model legal analysis

Assume an Indian biotech company discovers that a former researcher used compromised credentials to download unpublished vaccine-manufacturing protocols and patient-linked genomic datasets, then transmitted them to a foreign competitor.

The legal analysis would proceed as follows:

Computer-related conduct: Investigate whether unauthorised access or copying engages Section 43 of the IT Act and whether the dishonest or fraudulent elements of Section 66 are established.

Confidential information: Determine whether the protocols qualify for protection under contract and breach-of-confidence principles, applying John Richard Brady where relevant.

Personal data: Assess the applicable data-protection regime, commencement provisions, security obligations and notification requirements for the genomic records.

Evidence: Preserve access logs, forensic images, download histories, relevant communications and evidence linking the recipient to the transfer.

Civil relief: Consider an urgent injunction against use or disclosure, subject to the applicable procedural and substantive requirements.

International enforcement: Determine whether the foreign competitor or suspected recipient can be pursued in a foreign jurisdiction and whether any foreign trade-secret or cybercrime law applies.

Damages: Establish the actual commercial and data-related harm without assuming that every projected loss will be recoverable.

The company should avoid publicly accusing a named competitor or foreign government before the evidence supports the allegation.

11. Conclusion

Cyber-espionage targeting biotechnology firms is a multidimensional legal problem involving cybersecurity, confidential information, intellectual property, privacy, corporate governance and cross-border criminal enforcement.

In India, the IT Act provides important routes for addressing unauthorised access and copying, while contractual and equitable principles can protect confidential research. Privacy legislation may apply when personal data is compromised, and foreign legal regimes may become relevant where jurisdictional requirements are met.

The most important practical principle is to preserve evidence, contain the breach, meet applicable reporting obligations and pursue remedies supported by provable facts. The legal response should distinguish ordinary commercial disputes from genuine unauthorised intrusions and distinguish proven wrongdoing from allegations of state-sponsored espionage.

This is a general legal research overview, not jurisdiction-specific legal advice. For an actual incident, the applicable statutes, current commencement notifications, reporting deadlines and court procedures should be verified as of the incident date.