Cyber Crime and Safety

A cyber crime is any illegal activity in which a computer, a mobile phone or a computer network is either the target of the attack or the tool used to carry the attack out. That two-part definition is the one to memorise, because almost every classification question in this chapter is answered by deciding which of the two roles the machine is playing.

When the computer is the target, the crime is committed against the system itself. Breaking into a school website and replacing the home page, planting a virus in a computer lab, stealing the student database from a server, or flooding a site with traffic until it stops responding are all crimes of this kind. When the computer is the tool, the machine is only the instrument used to commit a crime that could in principle exist without it. Sending a fake message that pretends to come from a bank, harassing a classmate through a group chat, selling counterfeit goods on a shopping site, or circulating someone's private photograph are crimes of this second kind. Some offences use both roles at once: an attacker may first break into an e-mail account (computer as target) and then use that account to cheat the victim's friends out of money (computer as tool).

Cyber crime behaves very differently from an ordinary crime, and examiners like this comparison. First, the criminal need not be present at the scene — a fraud committed on a person in one Indian city may be carried out from another state or another country. Second, the crime scales: one carefully written message can be sent to lakhs of people in a single click, whereas a pickpocket can rob one person at a time. Third, the evidence is digital — logs, e-mail headers, screenshots, transaction identifiers and timestamps — and digital evidence is easy to delete, which is why victims are told to preserve everything and change nothing. Fourth, the offender can hide behind fake names, borrowed accounts and other people's infected computers, so identifying the person takes specialised investigation. Fifth, the victim often does not notice for days or weeks; stolen card details may sit unused before a fraudulent transaction appears.

The defence against all of this is cyber security — the set of technologies, rules and habits used to protect computers, networks, programs and data from unauthorised access, damage or misuse. Cyber security is usually described as protecting three things: confidentiality (only authorised people can read the data), integrity (the data is not altered without permission) and availability (genuine users can reach the system when they need it). Every safety measure later in this chapter protects at least one of those three.

Two more terms belong here. Cyber law is the branch of law that deals with computers, the Internet and electronic information; in India the principal statute is the Information Technology Act. A digital footprint is the trail of data a person leaves behind while using the Internet — posts, comments, searches, photographs, locations and purchases. The footprint is very hard to erase completely, which is exactly why careless sharing today becomes a safety problem later.

A full-mark answer on this topic does three things: it gives the definition with both roles of the computer, it names a category with a short example, and it adds one line on why the crime is hard to trace. Two sentences of definition alone will not earn the full marks.

Hacking means gaining access to a computer system, an account or a network without the permission of its owner, usually by finding and exploiting a weakness in it. The weakness may be a weak password, a program that has not been updated, a badly written web page or simply a careless user who clicked a link. The word by itself is neutral in the industry, so the syllabus asks you to split it into its harmful and its lawful forms.

Cracking is hacking done with a harmful intention. A cracker breaks into a system in order to steal data, damage files, deface a website, plant malware, spy on the owner or demand money. Cracking is always a crime, because it has neither permission nor a lawful purpose. Common results of cracking are data breaches (private records copied out), website defacement (the visible pages replaced with the attacker's message), account takeover and financial theft.

Ethical hacking is the deliberate testing of a system by a security professional with the written permission of the owner, in order to find weaknesses before a criminal finds them. The ethical hacker uses the same tools and the same techniques as the attacker, but the outcome is a report: here is the flaw, here is how it can be misused, here is how to fix it. Nothing is stolen, nothing is damaged, and everything found is kept confidential. This work is also called penetration testing. Banks, e-commerce companies, examination boards and government departments all employ ethical hackers, and it is a recognised career.

The deciding factor between the two, and the sentence examiners look for, is simple: permission and intention. Same skill, same commands, opposite legality. If the owner has authorised the test in advance and the findings are reported back, it is ethical hacking; if not, it is cracking, however curious or harmless the intruder claims to be. Breaking into a friend's account to prove that his password is weak is still an offence, because the permission was never given.

The three hats are the classification built on that idea. A white hat hacker is the ethical hacker — works with permission, follows the law, reports every weakness to the owner, and is often paid to do so. A black hat hacker is the criminal — no permission, harmful intent, works for money, revenge or destruction, and hides the intrusion so that it can be repeated. A grey hat hacker sits between them: he breaks into a system without permission, which is illegal, but does not intend to cause damage, and typically informs the owner afterwards, sometimes asking for a fee to reveal the fix. Remember that grey hat activity is still unauthorised access, so the good intention does not make it lawful.

Two related terms complete the topic. A vulnerability is a weakness in software, hardware or human behaviour that an attacker can misuse — an unpatched program, a default password such as admin, an open port. An exploit is the actual technique or piece of code that takes advantage of that vulnerability. Security work is largely the business of finding vulnerabilities before somebody writes an exploit for them.

When a question asks you to differentiate between ethical hacking and cracking, write three contrasted pairs — permission versus no permission, helpful intent versus harmful intent, report and repair versus theft and damage — rather than one long paragraph. Contrasted pairs are easier for an examiner to award.

Phishing is a fraud in which the attacker sends a message that pretends to come from a trusted organisation — a bank, an examination board, a courier company, a booking site such as IRCTC — in order to trick the receiver into revealing confidential information such as a password, a card number, a Card Verification Value (CVV) or a One Time Password (OTP), or into clicking a link that installs malware. The name comes from fishing: bait is thrown out to many people in the hope that a few will bite. When the same trick is played over a phone call it is called vishing (voice phishing), and over SMS it is called smishing.

A phishing message is recognised by a cluster of signs, and listing these signs is a standard question. The sender's address is a lookalike, not the real domain. The greeting is generic — Dear Customer rather than your name. The message creates urgency or fear: your account will be blocked today, your KYC has expired, your parcel is held. There are spelling and grammar mistakes, and the logo is slightly wrong. The link text and the real destination do not match, so hovering over the link on a computer, or pressing and holding it on a phone, shows a different address. The message asks for something no genuine organisation ever asks for — a password, a PIN, a CVV or an OTP. Finally, it arrives unexpectedly, often with an attachment you did not request. Compare the two addresses below; the second is the kind of lookalike used in a phishing mail.

Genuine : https://www.irctc.co.in/nget/train-search
Fake    : https://irctc-refund-verify.com/login.php

Identity theft is the stealing of a person's personal information — name, date of birth, address, Aadhaar or PAN details, account numbers, photographs, login credentials — and using it to impersonate that person. The information is collected through phishing, from a data breach, from a lost phone, from oversharing on social media, or from documents thrown away carelessly. Once the thief has enough, he can open accounts, apply for a loan, make purchases, or create a fake social media profile in the victim's name and misuse it. The damage is not only financial: a fake profile can destroy a reputation, and clearing the record afterwards takes months.

Credit card and online transaction fraud is the direct financial consequence. Card details may be captured by a skimming device fitted over a card reader, stolen from a hacked shopping site, or handed over by the victim in a phishing call. In India the commonest tricks are the fake customer-care number found through a search engine, the caller who asks the victim to install a remote-access application so that he can see the screen, and the misuse of Unified Payments Interface (UPI) collect requests, where the victim is told to approve a request in order to receive a refund of, say, ₹4,500 and in fact authorises a payment of that amount. Two rules answer most of these questions: never share an OTP, PIN or CVV with anybody, including someone claiming to be from the bank; and a UPI PIN is never required to receive money — entering it always sends money out.

Spam is unsolicited bulk electronic mail or messages sent to a large number of recipients, usually advertising, but frequently carrying phishing links or malware. Spam wastes bandwidth and storage, fills the inbox so that genuine mail is missed, and is the main delivery route for the frauds above. Mail services filter most of it into a spam or junk folder. Do not reply to spam and do not use its unsubscribe link if the sender is unknown, because any response confirms that the address is live.

Cyberbullying is the use of the Internet, mobile phones or social media to deliberately harass, threaten, humiliate or embarrass another person, repeatedly and over time. It takes many forms: abusive messages in a group chat, spreading rumours, sharing an edited or private photograph, creating a fake profile in someone's name, excluding a classmate from a group in order to hurt him, or posting cruel comments under every photograph a person uploads. Two features distinguish it from ordinary bullying and both should appear in an answer. It follows the victim everywhere — the phone is in the bedroom, so there is no safe hour — and the material spreads instantly to a large audience and is very hard to delete once forwarded.

Cyberstalking is the repeated use of electronic communication to follow, monitor, contact or threaten a person until that person feels afraid for their safety. The stalker may send constant messages after being asked to stop, track the victim's location through posts and check-ins, monitor every account, create new accounts each time he is blocked, or contact the victim's friends and family. Cyberbullying aims to humiliate; cyberstalking aims to pursue and control, and it carries a genuine fear of physical harm because online surveillance can lead to offline contact. That is the distinction examiners test.

Cyber trolling is the posting of deliberately offensive, provocative or insulting comments online in order to upset people and start an argument. A troll is usually anonymous, often does not know the target personally, and is looking for a reaction rather than pursuing one victim. Trolling is generally aimed at a post, a video or a public figure and may be a single burst of comments; bullying is a sustained campaign against a particular person. Trolling crosses into a criminal offence the moment it becomes a threat, a sexual comment, hate speech directed at a community, or defamation.

The correct response is worth learning as a numbered list, because it is commonly asked as a scenario question. It is this. One, do not reply and do not retaliate — a reply is the reward the bully or troll is waiting for, and an angry response can put you in the wrong. Two, preserve the evidence before anything is deleted: take screenshots showing the message, the profile name and the date and time, and note the account address. Three, block the account and use the platform's own report facility; every major social media and messaging service has one, though the exact menu differs from platform to platform. Four, tell a trusted adult — a parent, a class teacher or the school counsellor. A school is expected to act on harassment among its students, and silence is what allows bullying to continue. Five, if there is a threat, a demand for money, sexual content or an image of the victim being circulated, the matter is a crime and should be reported to the police or on the national cyber crime reporting portal, described later in this chapter. Six, tighten the account afterwards: make the profile private, review the friend list, remove location information and change the password.

Prevention deserves a line too. Share less publicly, keep personal details such as school name, class timings, address and phone number off open profiles, do not accept requests from strangers, never send a private photograph to anybody however trusted, and remember that a message deleted from your phone still exists on the recipient's device. Finally, being a silent spectator matters: forwarding a humiliating post makes a person part of the bullying, and reporting it instead is what stops it spreading.

Malware, short for malicious software, is any program written with the intention of damaging a computer, disrupting its working, or stealing data from it without the user's knowledge. The syllabus names seven kinds, and the marks are in the distinguishing line rather than in the description, so learn each one as a single sentence.

A virus is a malicious program that attaches itself to another file or program and spreads when that infected file is copied or run. Two ideas define it: it needs a host file, and it needs a user action — opening the file, running the program, plugging in an infected pen drive. Effects range from slowing the machine and corrupting files to deleting data outright.

A worm is a malicious program that copies itself and spreads across a network on its own, without attaching to a host file and without any user action. Because it self-replicates, a worm can fill storage, consume bandwidth and slow an entire network within minutes. Virus needs a host and a click; worm needs neither — that single sentence answers the classic comparison question.

A trojan horse, or trojan, is a malicious program that disguises itself as useful or harmless software — a free game, a cracked application, a screen recorder, a fake system cleaner. The user installs it willingly, and it then opens a hidden doorway, called a backdoor, through which the attacker enters. A trojan does not replicate itself; that is what separates it from a virus and a worm.

Ransomware is malware that encrypts the victim's files, or locks the whole device, and then demands a ransom payment in exchange for the key that unlocks them. It typically arrives through an attachment or a fake download. Paying is discouraged, because payment funds the crime and gives no guarantee of recovery; a recent backup kept separately is the only reliable cure, which is why backups appear in the safety section.

Spyware is malware that secretly monitors what a user does and sends that information to a third party — browsing history, files, chats, sometimes camera and microphone access. It works quietly and its main aim is information, not damage. Adware displays unwanted advertisements — pop-ups, redirected pages, a changed home page. Some adware is merely annoying, but much of it also tracks browsing to target the advertisements, which makes it a privacy problem as well. A keylogger is a program, or occasionally a small hardware device plugged between the keyboard and the computer, that records every keystroke typed and passes the record to an attacker; it is the standard method for capturing passwords, card numbers and messages, and it is why typing a password on an unknown machine in a cyber café is unsafe.

A denial of service attack, abbreviated DoS, does not steal anything. It makes a service unavailable to its genuine users by flooding the server with far more requests than it can handle, so that real requests are never answered. Picture a school office counter with one clerk: if fifty people who have no real work crowd the counter, a student with a genuine form cannot reach it. The counter has not been robbed, but it has been made useless. When the flood comes from thousands of infected computers at once, controlled remotely by the attacker, it is a distributed denial of service or DDoS attack, and the network of infected machines is called a botnet. A DDoS is far harder to stop than a DoS because the traffic comes from many ordinary addresses spread across the world. The damage is loss of service and loss of business — an examination result site or a ticket booking site down at its busiest hour affects lakhs of users.

Strong passwords come first because most break-ins start with a guessed or reused one. A strong password is long (a dozen characters or more), mixes uppercase letters, lowercase letters, digits and special symbols, and contains nothing that can be guessed from your life — no name, no birth date, no school name, no cricket team, no dictionary word on its own. It must be different for every account, so that one leaked site does not open all the others, and it must never be shared, written on the inside of a book, or typed while somebody watches. A passphrase made of unrelated words with symbols inserted is both strong and memorable, and a password manager can generate and store the rest.

Weak     : riya2010
Weak     : password@123
Stronger : Mn7#BlueKite-Rail

Two-factor authentication (2FA), also called two-step verification, adds a second proof of identity to the password: something you know (the password) plus something you have (an OTP sent to your phone, a code from an authenticator application, or a security key) or something you are (a fingerprint or face). With 2FA switched on, a stolen password alone is not enough to enter the account, which is why every bank and mail service now offers it. Remember that the OTP is the second factor — handing it to a caller destroys the whole protection.

Antivirus software scans files, programs and incoming data for known malware, quarantines or deletes what it finds, and watches running programs for suspicious behaviour. It is only as good as its last update, because it recognises most threats by their known signatures, so the virus definitions must be kept current and scheduled scans should be allowed to run. A firewall is different, and the pair is a common comparison question: a firewall is a security system, in hardware or in software, that sits between a computer or network and the outside world and filters traffic by a set of rules, allowing what is permitted and blocking what is not. Put simply, the firewall is the gatekeeper controlling who comes in and goes out, while the antivirus is the doctor treating what has already entered.

Software updates matter more than students expect. Vendors release patches to close vulnerabilities that attackers already know about, so an operating system, browser or application left un-updated is an open door; enable automatic updates wherever the option exists, and install only from the official site or the official app store.

Use secure sites for anything private. A secure connection uses HTTPS (HyperText Transfer Protocol Secure), which encrypts the data travelling between the browser and the site so that an eavesdropper on the network sees only unreadable text. Check that the address begins with https:// and that the domain is spelt exactly right. Browsers indicate a secure connection differently — some show a padlock, some show a tune or settings icon, some only warn when a site is not secure — so read your own browser's indicator rather than assuming one vendor's symbol. Note carefully that HTTPS proves the connection is encrypted, not that the owner is honest; a phishing site can also have HTTPS.

Public WiFi in a station, café or airport is shared and often unencrypted, and an attacker on the same network can capture traffic or set up a lookalike hotspot. Never do banking, UPI payments or online shopping on public WiFi; use mobile data instead, and switch off automatic connection to open networks. Finally, be careful with app permissions. Grant only what the app genuinely needs — a torch application has no use for your contacts, messages or microphone — install from official stores, read what is requested at installation, and review permissions periodically in the phone's settings, revoking anything unnecessary. Add three habits to complete the list: keep regular backups on a separate drive or in the cloud, always log out from a shared or school computer instead of just closing the window, and never click a link or open an attachment that arrived unexpectedly.

Knowing what to do after an incident is part of the syllabus, and it is usually asked as a short scenario: a student's account has been misused, or a parent has lost money to a fraudulent call. The first rule is speed. In a financial fraud, money moves out of the receiving account within minutes, so the sooner the report is made the better the chance of freezing it.

Three routes exist and they can be used together. First, the National Cyber Crime Reporting Portal at cybercrime.gov.in, run by the Government of India, accepts online complaints from anywhere in the country, including a separate route for complaints concerning women and children, which may be filed anonymously. Second, the national cyber crime helpline number 1930 is meant for reporting online financial fraud immediately, so that the transaction can be traced and held. Third, a complaint may be filed at any police station or at a cyber crime cell; cyber crime is not limited by area, so a station cannot refuse a complaint merely because the offence appears to have taken place elsewhere. In a financial case, telephone the bank as well and ask for the card or account to be blocked at once, and follow the call with a written complaint. Within a school, harassment among students should also be reported to the class teacher, the counsellor or the principal.

Whatever route is used, preserve the evidence first. Take screenshots that show the message together with the sender's name, the account address and the date and time. Keep the original e-mail rather than a forwarded copy, because the technical headers are part of the proof. Note transaction identifiers, reference numbers, amounts, the mobile number or e-mail address used by the fraudster, and the web address of any fake page. Do not delete chats, do not reformat the affected device, and do not reply to the offender. Carry an identity document and the written complaint when going to the police station, and keep a copy of the acknowledgement or the complaint number issued.

The main law is the Information Technology Act, the statute that governs electronic records, electronic communication and computer-related offences in India. You are not expected to quote it; you are expected to describe its scope in general terms. Broadly, the Act gives legal recognition to electronic records and to electronic (digital) signatures, so that a contract made online or a document stored electronically is valid in law and admissible as evidence. It provides for the authorities that issue and supervise digital signature certificates. It makes a range of computer-related acts punishable offences — among them unauthorised access to a computer system, downloading or copying data without permission, introducing a virus or other malware, damaging or disrupting a computer or network, denial of service, identity theft, cheating by pretending to be another person using a computer resource, violating a person's privacy by capturing or publishing private images, and publishing or transmitting obscene or sexually explicit material in electronic form. It also sets out duties for intermediaries such as service providers and platforms, and creates the machinery for adjudicating complaints and compensating victims.

Two further points make an answer complete. Cyber crime is not dealt with by this Act alone: general criminal law and other statutes apply as well, for example where the offence involves cheating, extortion, defamation, obscenity or offences against children. And because most electronic evidence is fragile, Indian law treats the integrity of that evidence seriously, which is the legal reason behind the practical advice above — report early, preserve everything, alter nothing.

For a scenario question of this kind, structure the answer as steps: stop and do not reply, preserve evidence, inform the bank or platform, report on the portal or helpline or at a police station, tell a responsible adult or authority, and then secure the account by changing passwords and enabling two-factor authentication.