Cyber Crimes: The Net Ninjas

IN 2017, a small team from Hyderabad’s cyber crime police made its way to Bihar’s Begusarai district on the trail of crooks who had made an HD-quality pirated version of Baahubali: The Conclusion ahead of the film’s release and were blackmailing the producers. It was a high-profile case and there was a lot at stake, not least of it the lives and the reputation of the young policemen from Hyderabad who were out to prove themselves as an elite unit. “When we tried to apprehend one of the accused, it turned out he was a man with connections, and a crowd was waiting to attack us. So we did the only thing we could have done—we ran. We finally picked him up late in the night,” says Madan Kumar Goud, a superintendent attached to the Hyderabad Cyber Crime Police Station. In his nine-year career, Goud, who is quite the narrative artist, has chased cyber crooks across the country, often at great risk, and with travel budgets sanctioned by senior officers who made it a point to mentor the up-and-coming cyber crimes team.

In a connected world, piracy is only the tip of a sinister iceberg growing larger each passing day. The targets, too, have shifted over time to encompass everyone with a smartphone, a bank account or any form of digital identification. Cyber crime police can only play catch up as transnational criminals spin ever-new scams—from crypto fraud and deepfakes to predatory apps and cyberstalking. “Technology is not an inanimate object—it is a living, breathing thing. We, as humans, can only imagine crimes within the bounds of what we know. In my experience, it is very difficult to find police officers who have the motivation and the bent of mind to apply themselves to understanding emerging technologies and the crimes that can be committed through them,” says Sanjay Sahay, retired additional director-general of police, Karnataka, who is credited with helping set up the state police IT ecosystem. Sahay runs a technology solutions company in Bengaluru and writes and speaks on cyber security, among other subjects. “We know what sections to book regular financial frauds under, what to do when a cheque bounces for instance or in case of extortion. How many cops even know the many types of cyber crime?” Sahay says the swirling vortex of cyber crime today goes largely unnoticed and unreported. “My guess would be that one in hundreds of cases actually gets reported.”

Indeed, statistics paint a disjointed picture of the cyber security situation in the country. According to the Indian Computer Emergency Response Team (CERT-In), the government nodal agency for computer security, India reported 2,08,456 cyber security incidents in 2018, 3,94,499 incidents in 2019, 11,58,208 in 2020 and 14,02,809 in 2021. The National Crime Records Bureau (NCRB), meanwhile, claims India reported 50,035 cyber crimes in 2020—up from 44,546 cases in 2019 and 27,248 in 2018. In 2020, fraud was the most prevalent form of cyber crime and accounted for 60 per cent of cases, followed by sexual exploitation (6.6 per cent) and extortion (4.9 per cent). As per NCRB data, the cyber crime rate was highest in Karnataka, followed by Telangana and Assam.

One can only infer that these states registered cases more diligently than others. In Telangana, 8,828 cases of cyber crime were reported in 2021, out of which 5,833 were major offences including fake customer care rackets, job frauds, loan frauds, bank-related frauds. The remaining cases were related to online impersonation and included cyberstalking, phishing, and sharing obscene content. The story, beyond these numbers, is that crime is increasingly moving online. In a statement made in May this year, Hyderabad city police commissioner CV Anand said as much. “Every fifth case we register is a cyber crime case,” he said, warning that in the years to come, cyber crimes will rise and other crimes may decline as money, banking and citizen services go digital.

Over a WhatsApp call, Goud, 34, is sceptical at first of answering questions about the workings of cyber crime police—and rightly so. “I have given interviews that were never published. I have even been impersonated—in fact, a gang of criminals in Kolkata forged my ID card and got a bank manager to reactivate bank accounts that we had frozen in connection with a case of cyber financial fraud.” As life thrives on the substrate of technology, so does crime. While financial fraud and cheating moved online during the forced virtualisation of life after Covid-19, personal data theft and ransomware have emerged as new threats to individual and organisational integrity. Goud is among the officers investigating the instant loan apps that have flooded app stores, offering credit at high interest and without collateral, with enforcers often distributing sleazy morphed photos of the debtor in the event of a delay or a default. Even as over 90 per cent of households in Telangana remain burdened by agricultural debt, technology that was meant to lift them out of poverty has instead exposed them to a new scourge. Just last month, two young men from Telangana succumbed to such harassment and ended their lives. Both had lost tens of thousands of rupees in online gaming and eventually gave in to the lure of seemingly easy loans.

“A majority of the apps originate in China and don’t appear in Play Store—not that every app that is in there is legit. Even as apps are banned, they appear under new names every week. They can spy on us, randomly listen to our conversations, shape our opinion. We can chase the money but what about the data theft and its consequences?” asks Goud, who has arrested Chinese nationals in loan app cases and frozen “thousands of accounts”. Loan app peddlers have a new modus operandi, he says. “They pay developers in India to develop apps, and modify the code before launching them. As for operations, they hire chartered accountants and lawyers to act as middlemen in India and thereby ensure they themselves leave no digital trail. Hawala and UPI-based accounts linked to fake IDs help them move money easily. By the time we get to the root of it, it is two months and the fraudsters have made away with crores.” Goud is worried that technology is changing faster than law enforcement can hope to. “Virtual phone numbers, encrypted WhatsApp and Telegram calls have made it difficult for police to track conversations. We have to think out of the box now to crack a case.”

The crimes, certainly, are studies in out-of-the-box thinking. Earlier this year, investigators at the Cyberabad Cyber Crime Police Station—each of the three commissionerates in the city has a dedicated cyber crime police station—tracked down a seven-member group led by Nallagalla Venkateshwarlu that had cloned over 2,500 fingerprints exploiting a vulnerability in the Inspector-General of Revenue and Stamps portal, and used them to withdraw over ₹14 lakh from 149 accounts. The Cyberabad Police also recently unmasked gangs running fake call centres in north India in the name of RBL Bank and SBI. “I don’t think any commissionerate in the country has handled the volume and variety of cases that Cyberabad has,” says Cyberabad Commissioner of Police Stephen Raveendra. “We register 15-20 cases each day, and we have been able to streamline investigations.” To keep up with and tackle the latest in cyber crime, Telangana is setting up a Cyber Security Centre of Excellence in association with the Data Security Council of India, departments of the state government, IT firms, educational institutions and domain experts. The centre, located in Cyberabad, will be unveiled shortly, Raveendra says. “Collaboration with industry and experts will be the backbone of cyber crime investigations of the future and we understand this.” For instance, a couple of months ago, Hyderabad cyber crime police decided to rope in ethical hackers to help them crack a payment gateway hack and theft to the tune of ₹52 lakh. The culprit, a software engineer, had used open source software to assess the vulnerability of a payment gateway and gained access to its database. Using stolen Aadhaar data from the internet for KYC (know your customer), he had created virtual bank accounts. He also took the added precaution of converting the stolen money into Bitcoin before liquidating and wiring it to his bank accounts.

When the internet is the crime scene, investigation can be very resource-intensive. Early this year, Hyderabad cyber crime police began looking into what has turned out to be one of the most sophisticated cases of cyber financial fraud in India. At the heart of it was a phishing attack at AP Mahesh Cooperative Urban Bank Limited, allowing the criminals, allegedly led by Nigerian national Ikpa Stephen Orji and a co-conspirator who goes by the name Capital, to transfer ₹12.48 crore from four accounts to 115 accounts and then to another 398 accounts, before withdrawing the money from 938 ATMs across India. Police teams were dispatched to 14 states and cities, with about a hundred officers working simultaneously to find the IP logs for internet banking for the hundreds of accounts, which were then identified as proxies with locations indicating the US, Canada and Romania. “Beyond our sanctioned strength of about 40, we have nine inspectors, 24 sub-inspectors and 18 constables working with us temporarily to manage the case load,” says KVM Prasad, assistant commissioner of police in charge of the Hyderabad Cyber Crime Police Station. In 2021, the police station registered over 2,000 FIRs and took over 1,600 cases of cyber crime registered elsewhere. “Social engineering frauds are the most common type of cyber crime, followed by investment and job frauds, sextortion and social media cases,” Prasad says.

As India becomes increasingly vulnerable to internet crime, every police station will need to undergo training in cyber crime registration. Investigators will need access to both hardware and software to safely retrieve data and analyse files. In May, Union Home Minister Amit Shah inaugurated the National Cyber Forensic Laboratory (NCFL) at the Central Forensic Science Laboratory (CFSL) campus in Hyderabad to help speed up cyber crime investigation in the country. Infrastructure, however, is only one side of the story. “The cyber forensics lab at our PS is equipped with forensic tools but when it comes to emerging crimes like crypto scams, we have no tools or know-how at our disposal,” says TH Gangadhar, an inspector at the Hyderabad Cyber Crime Police Station who handles crypto fraud cases. “When a fraud is reported, we email all the crypto exchanges—nearly 500 of them—asking for details of the wallet involved, but only a handful of exchanges respond. There is no way for us to find out which exchange the wallet ID belongs to.” While there is no framework yet for investigating crypto crime, a five-day workshop in dark web investigation conducted at the Telangana State Police Academy last month aimed to introduce officers to the unprecedented threats that lurk in the murky waters of anonymous web where personal information, drugs and arms can be sold and bought freely.

With hustlers and predators roaming the web waiting to bait the vulnerable, it is important to step up awareness activities, especially among women and children, says Swati Lakra, the additional director-general of police, Women Safety Wing, Telangana. “We held a state-wide cyber safety awareness programme over 10 months across 1,650 schools. We are also hoping to incubate cyber safety clubs in colleges—we will train a group of 30 students from each college on various cyber security verticals and they will in turn conduct awareness activities in their community along with a mentor-teacher,” Lakra says.

About The Author

V Shoba

•