Top cyber law expert, Pavan Duggal, pitches for dedicated cybersecurity laws

Pavan Duggal- Cyber Law Expert

India needs a dedicated law for cybersecurity amid increasing cybercrimes, said Supreme Court Advocate and Cyberlaw expert Pavan Duggal in an exclusive interview with Moneycontrol on November 28.

"We don't have a dedicated law on cybersecurity as of yet. Because we don't have a dedicated law in cybersecurity, we find that cybersecurity is not given the kind of prominence that it should be given. So consequently, we require new laws on cybersecurity, "said Duggal.

Commenting on increasing cyber crimes at banks; Duggal said that banks have to realise that cybersecurity is not a lip service or a tick-mark exercise.

Edited excerpts from the interview:

What do you think about the current law related to cybersecurity in India?

There is a distinct need for improvement in cybersecurity-related. laws in India. In fact, we do not have a dedicated law on cybersecurity as of yet. Because we don't have a dedicated law in cybersecurity, we find that cybersecurity is not given the kind of prominence that it should be given. Consequently, we require new laws on cybersecurity. Till such time the new laws come in, we should have rules and regulations under Section 87 of the IT Act, which should be aimed for the purposes of further protecting and preserving cybersecurity. Also, we should follow up on the advisories that are given by nodal agencies like the Computer Emergency Response Team of India, which is the nodal agency on cybersecurity.

What is your initial assessment of the recent cybersecurity lapse that happened at UCO Bank?

You see this entire episode has brought forward the need for us to realise what today's cybercriminals are going to do and take every potential step forward to deprive people of their hard-earned money. And they are now adopting more new, distinctive technologies. But the fact remains that this is a working lesson that if a bank like UCO Bank could potentially be affected, then just about any financial institution can be targeted. And today, we have to realise that we are already in the golden age of cybercrime, where all these cybersecurity breaches will be part of our day-to-day lives. Therefore, there is a need for adopting cybersecurity as a way of life. So I think we'll have to still wait and watch because the final papers and the final details are still not out. We only have some information, which is reported in the public domain.

Also Read | Taj Hotels suffers data breach, exposes information of 1.5 million customers

What are the cautions bank should be adopting now?

Well, I think banks have to realise that cybersecurity is not lip service or a tick-mark exercise. Therefore, they will have to constantly keep on innovating new kinds of approaches for the purposes of further protecting and preserving cyber liberty. So one option is to clearly comply with the applicable norms.

The norms were created by the Reserve Bank of India being the regulator, and I was part of the G. Gopalakrishnan Working Group, set up by the RBI, which laid down the cybersecurity framework for the country. But that alone has to be supplemented by new proactive steps. So that these kinds of activities of erroneous crediting to account holders can be potentially minimised to the best extent possible. Further now, the important issue is that a lot of these bank attacks are taking place using artificial intelligence.

There is now a growing trend across the world that cybercriminals are going ahead and misusing artificial intelligence for the purposes of committing cybersecurity breaches against banks and their customers.

Also Read | CERT-In tackled over 1.39 million cybersecurity incidents in 2022: Annual report

How should the victims of cyber fraud respond immediately? 

If you get caught in any kind of financial fraud, then the first thing you must pick up the phone number and call 1930 which is the National Cyber Crime helpline number for the purposes of trying to see if the money is still in the banking ecosystem, and can be preserved; that the money is not released out of the banking system. You need to report also to the National Cybercrime Reporting Portal. You must also immediately and notify the bank in writing or through a customer care call number so that they can potentially stop these kinds of unknowing, undesirable kinds of transactions. And in case you have completely lost it and you find that the loss has taken place, not because of your negligence, but because of the bank, then the only stuff is that you have to file a complaint to the bank under the Zero Liability notification within the first 72 hours to the bank asking them to refund the money, because if the money has gone as a result of the negligence of the concerned bank, then the bank under the RBI notification is mandated to return the entire money to you.