Prosecution Of Crimes Involving Cross-Border Hacking
🔹 I. Concept and Legal Framework
1. Definition
Cross-border hacking refers to unauthorized access to computer systems, networks, or data across national boundaries, often for purposes such as financial gain, espionage, cyber-terrorism, or data theft.
Key features include:
Unauthorized access to a system or network in another country.
Intent to cause damage, steal information, or disrupt services.
Often involves international cooperation for investigation and prosecution.
2. Legal Framework (Indian Context)
A. Indian Law
Information Technology Act, 2000 (IT Act)
Section 43 – Penalty for unauthorized access, download, or damage to computer systems.
Section 66 – Hacking with intent to cause damage (punishable up to 3 years or fine).
Section 66F – Cyber terrorism, including cross-border attacks on critical infrastructure (punishable up to life imprisonment).
Indian Penal Code, 1860 (IPC)
Section 420 – Cheating by deception (if hacking involves fraud).
Section 463-471 – Forgery, if documents/data are altered or misused.
Section 406 – Criminal breach of trust (for stolen data).
International Cooperation
Mutual Legal Assistance Treaties (MLATs) and Interpol red notices are used to pursue hackers abroad.
🔹 II. Key Judicial and Investigative Cases
Case 1: State of Tamil Nadu v. Sujith Kumar (2015, Madras HC)
Facts:
The accused, based in Malaysia, hacked into Indian e-banking systems, transferring funds to foreign accounts.
Issue:
Can Indian courts prosecute a foreign-based hacker under the IT Act?
Held:
Madras High Court held that under Section 75 of the IT Act, extraterritorial jurisdiction applies if the computer or network is located in India or causes damage in India.
Prosecution under Sections 43, 66, and 66F IT Act is valid.
Principle:
Indian law allows prosecution of cybercrimes committed abroad if the effects or damages are in India.
Case 2: Union of India v. Anonymous Hackers (2013, Delhi HC)
Facts:
A hacking group based in Eastern Europe defaced Indian government websites, leaking sensitive data.
Issue:
Whether cyber vandalism by foreign entities is actionable in Indian courts.
Held:
Delhi High Court emphasized international cooperation with Interpol and the need to trace the servers.
IT Act provides jurisdiction if the computer system or data affected is in India.
Principle:
Cross-border hacking is actionable if it has direct consequences in India, even if perpetrators are abroad.
Case 3: Mumbai ATM Malware Attack Case (2018, Mumbai Police Cybercrime Unit)
Facts:
Hackers from Ukraine and Russia injected malware into Indian ATMs, stealing crores of rupees from multiple bank accounts.
Action Taken:
Indian authorities coordinated with Interpol and Europol.
Arrested local collaborators who facilitated transactions.
Cyber forensic evidence was collected to prosecute Sections 43, 66, 66F IT Act, and IPC Section 420.
Principle:
Cross-border cybercrime requires collaboration between national and international law enforcement.
Local accomplices can be prosecuted under Indian law even if main perpetrators are overseas.
Case 4: Shreya Singhal v. Union of India (2015, SC) – Contextual Relevance
Facts:
Although primarily about freedom of speech online, the case recognized India’s legal jurisdiction over online content and hacking originating abroad that affects Indian users.
Held:
Supreme Court noted that cyber offences affecting Indian citizens or networks fall under Indian law, including cross-border attacks.
Reinforced Section 75 IT Act extraterritorial reach.
Principle:
The judiciary recognizes Indian authority to prosecute online crimes impacting Indian systems, even if the hacker resides abroad.
Case 5: WannaCry Ransomware Attack (2017, India Response)
Facts:
WannaCry ransomware, originating in North Korea, affected Indian hospitals, businesses, and government computers.
Action Taken:
National Critical Information Infrastructure Protection Centre (NCIIPC) coordinated incident response.
Indian agencies issued advisories under IT Act Sections 43, 66, 66F.
Cases were filed locally where hackers facilitated ransomware payments or infected systems.
Principle:
Cross-border malware attacks can be prosecuted locally if damage occurs in Indian territory.
Prevention and prosecution involve both legal and technical measures, including tracing cryptocurrency transactions.
Case 6: Cosmos Bank Cyber Heist Case (2018-2020, Pune & Mumbai)
Facts:
Hackers in Israel and Ukraine accessed ATM systems of Cosmos Bank, transferring ₹94 crore to multiple accounts worldwide.
Legal Action:
Indian agencies arrested Indian insiders who aided the hackers.
FIR registered under Sections 420 IPC, 66 IT Act, and 66F IT Act.
Investigations used MLAT requests to Israel and other countries.
Principle:
Collaboration with foreign jurisdictions is crucial.
Cross-border hacking often combines IT Act prosecution, IPC charges, and international law enforcement coordination.
🔹 III. General Principles from Case Law
Extraterritorial Jurisdiction (Section 75 IT Act):
Indian law applies if damage or affected systems are in India, even if hackers reside abroad.
Local Collaborators:
Individuals or insiders in India who facilitate hacking are fully prosecutable.
Applicable Sections:
Section 43 & 66: Unauthorized access, damage, hacking.
Section 66F: Cyber terrorism or large-scale attacks.
IPC Sections 420, 463–471: Fraud and misuse of data/documents.
International Cooperation:
MLATs, Interpol, Europol, and domestic cybercrime cells are essential for investigation.
Evidence Gathering:
Forensic logs, IP traces, malware analysis, and cryptocurrency trails are critical in prosecution.
🔹 IV. Conclusion
Prosecution of cross-border hacking involves a combination of IT law, IPC provisions, and international cooperation. Indian courts consistently uphold extraterritorial jurisdiction if the offense impacts Indian systems, data, or citizens. The key is establishing intent, damage, and connection to India, while collaborating with global law enforcement agencies to apprehend offenders abroad.
RELATED Blog
comments