Law In Motion : Cyber Crimes - 14

Section 378 in The Indian Penal Code 378. Theft -Whoever, intending to take dishonestly any moveable property out of the possession of any person without that person’s consent, moves that property in order to such taking, is said to commit theft.

Explanation 1 - A thing so long as it is attached to the earth, not being movable property, is not the subject of theft; but it becomes capable of being the subject of theft as soon as it is severed from the earth.

Explanation 2 - A moving effected by the same act which affects the severance may be a theft.

Explanation 3 - A person is said to cause a thing to move by removing an obstacle which prevented it from moving or by separating it from any other thing, as well as by actually moving it.

Explanation 4 - A person, who by any means causes an animal to move, is said to move that animal, and to move everything which, in consequence of the motion so caused, is moved by that animal.

Explanation 5 - The consent mentioned in the definition may be express or implied, and may be given either by the person in possession, or by any person having for that purpose authority either express or implied.

This definition has the following essential ingredients for an act/ omission to be considered as a theft: -

(i) The accused must have a dishonest intention to ‘take’ the property;

(ii) The property must be movable;

(iii) The property must be ‘taken out’ of the possession of another person, resulting in wrongful gain by one and wrongful loss to another;

(iv) The property must be ‘moved’ on order to such taking i.e., obtaining property by deception;

(v) Taking must without that person’s consent – express or implied;

If this basic definition of theft is to be applicable to cyber-crimes, it is immaterial whether the property is physical or corporal (that which can be touched) or incorporeal (which cannot be touched. While the former would imply computers or pen drives or CDs, hard disks, mobiles etc., the latter would cover software, passwords, OTPs etc.

When the above conditions are met, then besides the dishonest act being a ‘cyber-crime’, sections of IPC would also apply.

Similarly, if someone is working in an organization or business or for a person and is ‘enlisted with property’, if he Converts that property to his own use and causes wrongful loss to the person or organisation, IPC sections pertaining to Criminal Misappropriation and Criminal Breach of Trust may be applicable besides cheating.

In all these circumstances, it is Irrelevant whether the property is corporal or non-corporal and sections of IT Act may also be applicable – Usually, together.

Social Engineering

While cheating and trickery are its closest cousins, the concept of social engineering has massive implications in the world of cyber-crimes and information security.

Some definitions –

(1) Social Engineering is the psychological manipulation of people into performing actions or divulging confidential information;

(2) It is a type of confidence trick for the purpose of information gathering, fraud or system access in cyber world;

(3) It is any act that influences a person to take an action that may or may not be in their best interests;

A large proportion of cyber-crime is rooted in social engineering. The attacker manipulates his victim (person or organisation or employer or banker or government, etc.) to cause harm or loss, which, at the time of the manipulation taking place, the victim has no idea about.

While greed is one of the basic instincts exploited by the criminal besides lust or pornography, there are other human attributes which make us vulnerable. Robert Cialdini propounded his ‘theory of influence’ where he lists six principles of human attributes which make us vulnerable to social engineering attacks:

(i) Reciprocity;

(ii) Commitment and consistency;

(iii) Social proof;

(iv) Authority;

(v) Liking and,

(vi) Scarcity.

While details of these attributes are beyond the scope of this series, let me briefly introduce these because any of these attributes or their combination would be definitely exploited by an attacker: -

(i) Reciprocity – It is human nature to ‘return favours’. Therefore, tricksters would typically offer a reward in return for help/ assistance to them;

(ii) Commitment and Consistency – Making a commitment or promise pushes people to honour their words/ actions or commitments and behave in a consistent, predictable manner. Tricksters abuse these habits by seeking commitments, rescinding their own part but extracting consistent behaviour from victims;

(iii) Social Proof – This is more commonly known as CONFORMITY. i.e., people are entrapped to do things which they see others doing. Thus, there is a tendency to behave like the others or a majority; 

(iv) Authority – Humans tend to obey and follow instructions or orders from ‘authority figures’ or ‘influencers’ or ‘powerful people’. Thus, if an unknown caller asks someone that his boss want s to do something, the chances of Compliance are greater;

(v) Liking – people are likely to be persuaded by those whom they like contrary to this, they may end up doing just the opposite of what is said by an enemy or adversary.

(vi) Scarcity – if a situation of perceived scarcity is created, it is easier to extract certain behaviour e.g., ‘limited period offers’ or ‘limited stocks’ sales or offers on internet or ‘first come first serve’ offers are examples.

All these tactics essentially exploit human frailties and vulnerabilities, the chief among which is GREED or AVARICE. Most of the social engineering triggered cyber-crimes exploit our greed. Some, however, also exploit our CARELESSNESS: In fact, most are a clever combination, preying on our greed and carelessness.

Therefore, we need to be careful about people trying to manipulate us to defraud us. Being caution, careful, alive and updates are the best insurance against social media frauds besides greed and gullibility.  

Rupin Sharma
rupinsharma@gmail.com