Why are cybercrime convictions low in India? ‘Weak forensics, dark net & cross-border attacks’

New Delhi: Data on the abysmally poor cybercrime conviction rates released by the central government in Lok Sabha last week has rekindled discussions on how law enforcement agencies across the country continue to battle crimes committed digitally, struggle in narrowing down suspects and trawling the darknet.

According to the five-year data — spanning 2017 to 2021 — shared by the union home ministry, in 2017, out of chargesheets filed in 5,180 cases across all states and Union Territories (UTs), only 152 ended in convictions. In 2018, of 7,000 cases in which chargesheets were filed, there were convictions in only over 490.

In 2019, chargesheets were filed in 9,000 cases of which 360 ended in convictions and in 2020, there were nearly 1,109 convictions in 14,087 cases where chargesheets were filed. In 2021, the numbers shrunk to 490 convictions in more than 18,000 cases for which chargesheets were filed.

In 2021, the maximum number of convictions were from Uttar Pradesh — 292 cases out of 4,407 chargesheets, while 18 states and UTs had zero convictions, according to the data.

‘Inadequacies in cyber forensics’

Experts believe that one of the reasons behind the low convictions is inadequacies in cyber forensics, coupled with issues pertaining to assimilating digital evidence.

“Security agencies lack adequate resources and training for cyber forensics, the ability of law enforcement agencies including the police to assimilate digital evidence and make sense of what exactly happened and where to assign accountability. There is also a problem with registering cases according to the existing law and then presenting them to the judiciary. Even the judiciary has faced challenges on that front,” said Sameer Patil, senior fellow, Observer Research Foundation (ORF), a multi-disciplinary think-tank.

Both the police and cybercrime experts agreed that cybercriminals have advanced rapidly, primarily because of the already existing tools to trawl the darknet and finding ways to escape identification. So while the police are using the darknet to just try and identify cybercriminals and struggling at it, cybercriminals have far more expertise in this.

“Innovation for cybercriminals has baffled security agencies and the usage of the darknet has led to immense anonymity. It is difficult these days to parse through networks and identify crimes and criminals on the darknet and we have seen repeated use in the recent past. Security agencies are well aware of this phenomenon but they lack resources and training, even the judiciary has not undergone an overhaul in this aspect,” Patil explained.

Also Read: 40% of Indian firms lost $50k-$100k to fraud, economic crime during peak Covid, says PwC report

Trans-border nature of attacks & privacy concerns

Police personnel have increasingly found that foreign entities are somewhat involved in malware or ransomware attacks in India, a trend witnessed in the past few months.

To narrow them down, they believe that they need to build security collaborations across the world. Although the idea may sound hassle-free and noble, it is difficult for the police to follow up every time.

According to Prashant Gautam, deputy commissioner of police, Intelligence Fusion Strategic Operations (IFSO) unit of Special Cell, Delhi Police, one of the main reasons behind the difficulty in detection of cybercrimes and low conviction rates is the fact that most crimes are trans-border in nature and that directly translates into more time and collaborations with international bodies.

The IFSO unit of the Delhi Police deals with cases of cyber fraud, online harassment, data theft, etc.

“One of the main issues with cybercrime is that it is boundary-less and processes take long since the number of stakeholders increases. This is not like finding a gangster and narrowing down his location, the stealth element is higher and it is difficult to identify. Also, we must remember that law and order is a state subject and with crimes involving international elements procedures become longer,” Gautam told ThePrint.

He claimed: “It would be wrong to say that the police are not trying. All of us have been trying to educate the public. It takes us longer to extract information from organisations especially social media intermediaries like Google, Meta and Twitter who are always unhelpful since they keep citing privacy. It becomes difficult for us to work if this policy prevails because many will take advantage of this bone of contention. But prosecution is either undergoing or the police are still investigating cases and that is primarily why the conviction rates seem low. But over the years we have identified ways in which few cyber criminals could be caught, we have backtracked, found financial linkages, money trails to narrow down on suspects.”

Citing difficulty, especially with regard to cases related to bitcoin, he said, “The investigation is mostly on the lines of traditional methods but this is a capability-driven area. There is a lack somewhere, but that happens in regular offline cases as well. There is a lack of regulatory authority decisions, especially with cases pertaining to bitcoin. Tools to trawl the darknet are available online and that too readily. It is so easy to find such aspects and it is necessary to identify these harmful elements and remove them.”

Also Read: How police, probe agencies are tackling growing menace of illegal call centres

Available digital tools to streamline the system

Experts are of the view that there are available digital tools today that could be accessed to create a cohesive structure for digital forensic teams across the country.

“There is a range of tools and the spectrum is wide, ranging from digital forensics, penetration testing, disk investigation, among others for law enforcement agencies,” said Sanchit Gogia, chief analyst and chief executive officer, Greyhound Research, a company providing research and insights within the digital ecosystem.

He added: “Imaging hard disks in case of any physical police recoveries in cybercrime is also an important element in the process. There is also a need to demarcate different kinds of cyber crimes. For example, there is a need for teams who deal specifically with corporate frauds and the movement of funds using machine learning and artificial intelligence.”

Gogia also spoke about a “hub and spoke” model, wherein a centralised knowledge database would help in binding the system.

“In theory, there needs to be a hub and spoke model with a centralised team that accumulates and disburses knowledge. It is otherwise difficult for individual states to work in silos otherwise there would not be a standardised procedure that may lead to more confusion,” he explained.

(Edited by Anumeha Saxena)

Also Read: Mewat is India’s latest Jamtara. And sextortion is the new kill