The fast changing nature of cyber crime is forcing the law enforcement agencies to make rapid adjustments to come to grips with the new menace. In an interaction with Ankita Lahiri, the super cop who has also served with the National Investigation Agency says that lack of forensic experts, tools and low level of awareness are just some of the issues that the department needs to overcome. Excerpts:

How would you describe the emerging scenario of cyber crime in India?
India is going through an unprecedented phase of ICT adoption. As per the 2011 census data there are nearly 23.2 million computer users in the country. Besides, there are around 120 million internet users. This has led to a spurt in technology enabled crimes: from cyber fraud to pornography and hacking. Almost every single kind of cyber crime has been reported in India.

Today, computers and other IT enabled devices are being actively used by criminals to commit offences such as kidnapping, homicide, cheating, forgery and counterfeiting. Terrorists are also making maximum use of computers and other IT-enabled gadgets like tablets, smart phones and encrypted pen drives. This gives them an anonymous channel to commit crimes.

Collection of evidence from such devices is a challenge for the police forces and agencies in India. Investigation and collection of evidence in such cases requires knowledge and skill that most  police personnel in the country do not have. This gives the perpetrators an edge over the agencies.

What kind of challenges do you face during investigation of cyber crime and collection of digital evidence?
The police do not know how to conduct a proper search in a computerised environment, particularly in a networked ecosystem. Most of the times, the police is also not aware of the correct tool or software that needs to be used to collect evidence.

While investigating and collecting cyber evidence, they usually do not take the help of cyber forensic experts. They lose out on vital evidence and clues. This leads to acquittal of criminals. Some improvements have been made but we have to cover a lot of ground and at a much higher speed.

Why are police reluctant to enlist cyber forensic experts?
There are two reasons. Firstly, and most importantly, the police does not realise the necessity in most of the cases. Secondly, there are not many cyber forensic experts in the country. I think the solution lies in training police officers in cyber forensics. Each police station should have at least one such expert.

Does the force have necessary tools for collection of digital evidence?
There are a number of tools available in the market. Few police officers, however, acquire and use them. The problem is we are not sure whether these are standard tools. We are also not aware of their source codes, making them challengeable in court. We cannot counter them. But I am told that the Centre for Development of Advanced Computing (CDAC) is developing tools for collection of digital evidence. The project was started nearly ten years ago. We should use this tool as it has been developed by experts in India who understand the processes and jurisprudence in the country.  Awarenessfor using these tools has to be created by the police leadership.

Do we have adequate forensic labs to deal with cyber crimes?
Cyber forensic facility in India is inadequate. We have a long way to go before we can establish state-of-art labs. We need modern standard operating procedures (SOPs) like those in developed countries. The police leadership in the country must take cognizance of this and work in this direction. The gap needs to be filled quickly.

What are the new challenges?
Botnets, phishing, cloud computing, cloud forensics, VoIP (voice over IP)... the list is endless. Each new technology will throw up its own unique challenge and we need to constantly upgrade our skills to deal with them.

Why do you consider VoIP as a challenge?
Crimes are now being committed through use of mobile phones, disposable data cards and through open Wi-Fi hotspots. We do not have much forensic tools and expertise to deal with this threat.

You also mentioned cloud computing...
There are data networks in place that allow transmission of information from any location in a timely and efficient manner. Data is shared in a cloud. We face challenges during investigations. We have to establish (with evidence) who uploaded what, from where and when. We also need to establish who deleted what, when and where and who copied what, when and from where. Details of modifications also need to be captured.

For conducting investigations in the cloud environment we require dedicated forensic servers that can remain on standby mode in the cloud. But the biggest challenge that we face is related to the legal jurisdiction since data sharing and data flow are trans-border in nature. Then there are issues of contamination or loss of data during investigation.

What is the solution? Are states doing enough?
Training and orientation is the key to dealing with cyber crime. States have made some efforts in training their police officials. In fact, NASSCOM’s Data Security Council of India has opened eight labs to train police officials. The CBI training academy at Ghaziabad, C-DAC’s Cyber Resource Centre in Thiruvanthapuram, National Police Academy and Central Detective Training Schools also impart such kind of training. However, considering the rapid and quick growth and changes in the nature of cyber crimes and digital evidence, we do not have adequate facilities for advanced training in this field.

The good news is that central government with the help of state governments is trying to start such advanced training facilities for the police officials. The project is on the anvil and will be launched very soon. The Bureau of Police Research and Development (BPR&D), along with other government departments, will be playing a crucial role in this project. A plan is being chalked out and it will be in accordance with the IT security policy.

What about training other stake holders?
This is very important aspect for strengthening our criminal justice system. Prosecutors and other judicial officers play an equally important role. There is a need to provide such training for the public prosecutors. The state governments and the central government need to look into this. While few training programmes have already been organised, more initiatives are required. As far as the training of judicial officers is concerned, a well thought out plan has been envisaged by the honourable Supreme Court of India. Judicial academies are imparting such trainings to judges and magistrates.

All these trainings should be continuous as changes are rapid in the world of information technology. Our target is to ensure that at least five officials in city and urban police stations and two to three officers in other police stations should be trained to make a difference. This is a mammoth task as we have to train 50,000 police officials over the next three years.