CYBERCRIMES: VICTIMS, RESPONSES, ACCOUNTABILITY

CYBERCRIMES: VICTIMS, RESPONSES, ACCOUNTABILITY

Excerpts From A Panel Discussion

Panellists Launching the Status of Policing in India Report (SPIR) 2026 at New Delhi

The Status of Policing in India Report (SPIR) 2026, jointly produced by Common Cause and Lokniti–CSDS, was launched on September 24, 2026. The report focuses on “Cybercrime: Victims’ Perspectives and Systemic Responses”, based on a 16-State survey of 8,306 citizens mapping cybercrime exposure, vulnerability patterns, and police redressal mechanisms.

A panel discussion was held during the launch at India International Centre, New Delhi, which saw the participation of eminent speakers from varied fields.

Excerpts:

Prof Suhas Palshikar, Social Scientist, Author and Columnist:

While this is a report on status of policing with respect to cybercrimes, earlier we have already done a report on surveillance. In the sense, the intrusion of the digital into our lives has already been noticed, noted and commented upon and experienced too. This report, in a sense, touches upon a one slice of the reality, namely cybercrimes. But the question this report might leave us with is, whether cybercrimes also happen because of the overall culture of surveillance and the fascination with surveillance technologies. At the same time, whether there is a religion called the digital and our faith in that religion is so much that we believe that whatever is digital is secure without necessarily going into the actual security credentials of any gadget or any service. These would be nagging questions.

The other nagging question this report probably leaves inadequately answered and that is not for want of our wish to do it, but for want of the ability to access and get information on various non-financial aspects and methods of cybercrime.

And the third, which comes out repeatedly in the report, is about this deep social divide which we come across every time when we talk of policing. And by policing I am not talking only of the police here, because this report also takes one step further by expanding the idea of policing—whoever is in charge of the function of protection—and thus, banks come into the purview. The social divide is whenever you come across any victim, you first find out who the victim is and by identifying the victim you decide whether you attend to the victim diligently, over-efficiently, casually or carelessly. It is this social divide which comes across all reports on policing so far.

Mr Sanjay Sahay, IPS (Retd.) and Cybersecurity Expert

Cybercrime is a huge gamut of stuff which is primarily happening at an industrial scale. The whole thing starts in the backdrop of a very loose data regimen, and that data regimen is not at all restricted to the government itself. [It is] Because we are desperate to put our data in the public domain. And when that data is there in the public domain, there are people who can harness the data.

Talking about social engineering: How does social engineering come into existence? There is a whole bunch of data which is thrown at you so that you believe that I’m aware of everything and I am in a position by which I can give you some benefits. The biggest challenging part is, why do people who are not a part of any criminal activity, accept this? This is primarily because of the manner in which we hold public authority in this country – primarily fear and complete distrust. From there, everything starts and Indian policing and Indian governance remains a matter of perception rather than a matter of delivering.

Now, the issue of investigation. How can investigation happen? Ninety-seven per cent of the top 500 companies have been hacked, and the other three per cent are not aware that they have been hacked. The most popular password 10-15 years back was 1 2 3 4 5 6 7, and today also it remains the same. That is where we are, and that is the way the Indian police works, where you find passwords on notice boards. That is their capability of keeping their system safe.

We come to the registration of the case. Sixty-five lakh complaints landed to I4C, of which nearly two lakhs have been translated into FIRs. So, what is the total quantum of police you will require? It should be at least as much as the conventional police. Second, what the expertise of that particular imaginary cyber police should be in comparison to the current police? You go to any police station in this country, cyber police in the country, you’ll rarely find a fellow who understands anything of cyber forensics. That’s the reality of life.

This whole issue is [further] complicated by the fact that there is zero ownership and zero responsibility. How can any institution in a democratic country have the audacity to decide to register or not register, investigate or not investigate, communicate or not communicate? They behave in a manner which would, I think, put even a monarchist to shame. Who is primarily responsible for cyber security or cybercrime? Here, only the victim is [held] responsible. That is what the government is telling you.

We are not able to take care of the data which is splashed all around the place. We don’t have anything which we can call as the deep web or the dark web police. However much we talk about AI, I don’t think there is anybody who is working with AI and cybercrimes.

Now the investigation part of it—we have not gone beyond the cases getting charged-sheeted. The first case which got conviction in Karnataka – when we had a [cyber] police station since 2001 or 2002 – was only in 2013–2014.

Now, in this whole gamut of things, one [question] is whether without expertise we can run the show? And second, who has the expertise? These are questions which I leave open. Suffice to say that we are living in a real-time dynamic world. Cybercrimes happen in that manner and any response to it has to be in real time and dynamic.

There are 1.8 million mule accounts. There is no database of mule accounts which is given to us.

One simple thing they can start with is whitelisting of government phone numbers. So, it [is displayed] as a government phone number. Anything which is outside of that, we need not bother. There’s an industrial scale infrastructure which is happening from here to Southeast Asia, from cryptocurrency to variety of other things, and that is what propels the whole thing. Yet, the government has not gained the capability to match something of this nature.

Dr Ranjana Kumari, Director, Centre for Social Research

As a whole generation of people, we are living in a very different time. The reason why we all are very worried about cyber security and cybercrime [is] because it is no more general Artificial Intelligence; it is moving into quantum and then, of course, into super intelligence.

A lot of other countries have e-safety commissions. Have we ever thought of that? We do need to have institutional mechanism, trained personnel and also people who believe in changing the systems.

Policing in our system has a basic [limitation]. The total system is constructed and built upon post-harm response. When the crime happens, then you bring in the police, you bring in the law, you bring in the judiciary. They [the perpetrators] are much, far ahead, much more sophisticated than our systems are.

We deal with cases of non-consensual posting of images. In that situation you don’t even realise, you don’t even know; it moves very fast. It multiplies on various platforms. Hashes are not very easy to control. Even [though] the cyber police [is] trying its best to support, it’s very difficult. What we need [is] a new modern institution which looks at what cybercrime is all about? I4C is there but with a police perspective. They try to do whatever they can in a very limited way. We get lots of reports of women who come and say that post-divorce husbands are is threatening to post intimate images; post friendship young girls come and say that “look my life will be over. I’m going to commit suicide if this is posted.” This is the socio-psychological impact.

So, let me just come to some issues which I feel immediately need to be paid attention to. Identify a separate agency. It cannot be just home ministry, MeitY, etc. Develop a whole new e-safety commission which is going to ensure that systems are put in place. Globally, countries have it now.

A whole unprepared society [is being] pushed into a digital arena. Everybody has a phone, everybody has internet. But how much have we prepared our people? What is the messaging? Are we telling our children how to protect themselves? Who are the predators online? How do children protect themselves while playing games; if somebody enters that game and starts asking for nude photos? We have found in our research that even very young children are posting their nude photos online. So, [we need to] pay attention to awareness-building among the people.

We don’t just start asking for institutions to train. Of course, that’s the most urgent thing the government should respond to at the moment. But also, from the people’s side, we need to build education system around digital [use]. We have to start bringing in the courses [right from] from childhood.

All this [cybercrime] is happening much more to women and children. Women are being seriously victimised and they are not reporting. Women don’t even walk into the police station. Even the most educated and smart ones are not doing it. We should collectively start putting pressure on the systems which should respond to our work.

Mr Saikat Datta, CEO and Co-Founder, DeepStrat

In my view, we are all looking at it [cybercrime] [in a] very piecemeal [manner] without understanding what are the fundamental issues [because of which] cybercrime today has become so pervasive.

The problem with policing is we look at it as a monolith, without realising that in the Indian constitutional scheme of things, law and order is a State subject. It’s very easy to say I4C is doing this and that, but I4C is a central body. It cannot go into the states and address the issues, and nor should it [do so]. Because when a crime takes place in a state, the primary responsibility is of that state. Therefore, what you do at the state level is more important than what we are trying to do at the central level. But because the Centre has more finances, the states end up almost struggling for resources, when they are best placed to actually address that issue.

The second problem is our policemen; think of the constabulary. Whichever states you come from, if you are from a southern states like Telangana, Andhra, Karnataka, Kerala, think of the average policemen you interact with. Then think of the states of say, Haryana, UP or maybe Bihar and think of the local constable, and you can draw your own conclusions on what is your perception is. A lot of this perception is also driven by the level of training, culture, etc., that decides how policing is being done in those states vis-à-vis the southern states.

There is a very stark cultural issue. If I were to go to a state like Kerala, Telangana or Karnataka, the average constable constabulary is far better educated and far better placed. When there is a huge cultural difference for a series of reasons, the response to a technologically-aided crime like cybercrimes becomes very different. When we worked in Haryana, we saw the struggle they have because nobody is aiding them. There is no dedicated training, there is no dedicated orientation for helping the police to deal with cybercrimes. Expecting them to take a deluge of cases and then deal with it is very unrealistic.

In 2020, just after the first lockdown was over, we did a cybercrime study. At that time, Gurgaon had only one police station dedicated to cybercrime, and in that one police station, which was handling entire southern Haryana, there were only about 1,200 complaints [over 10-11 months]. Today, they are getting about 1,500 to 1,600 complaints every day. That’s the scale. The amount of money that was defrauded from the State was close to about {Rs] 800 crores in just eight months. If you then start thinking of recovery, where and how do you begin?

Burking is where the police ensure that no FIR is lodged. Because every police station does wants to maintain a record that crime is low in their jurisdiction. Why is burking a cultural issue? Because there is no capacity in policing today to deal with the deluge of complaints that come their way in various sections of the law.

The next problem is technology, and there is a technology asymmetry globally. Countries which have emerged out of colonialism like India, because of lack of resources and many other issues, we have not been able to keep up with technology, whereas the Western world has moved far ahead.

When it comes to cybercrimes, there is a lack of understanding of how the technology works. Many times the technology and the understanding can come through collaboration and cooperation with some of the technology firms and the Indian law enforcement. The problem is, if the tech companies who understand the technology [and] can collaborate, if they are scared to talk to the police, then where does the collaboration actually start? This is a foundational problem. As a result, there is no collaboration. We want to have a whole of society approach but the whole of society will never happen when parts of the society are in conflict with each other.

When you don’t have a whole of society approach, then you are also dealing with another very important challenge, of digital arrest. Mr Nandkumar Sarvade says, the core reason why we are falling prey to digital arrest today is because of our fear of authority. Even very well-off people will immediately fall prey to it. The fear of authority is then weaponised by the scamster. Unless those issues are addressed, cybercrimes will continue to grow exponentially.

Lastly, definitional clarity is very critical. Our understanding of cybercrime is actually not the global understanding of cybercrime and it is also piecemeal. We don’t look at cyber-security related issues as cybercrimes; we look at it separately. Our understanding of cybercrime is driven mostly as a retail financial services crime.

Today, AI is again changing the way cybercrimes are taking place. Fact of the matter is, technology was already far ahead, and it’s gone to another dimension. Our policemen, who are used to not dealing with even normal everyday crimes, how will you expect them to tackle something at that level? And because our states are not being given adequate funds, training programs, etc., we are never going to get out of this problem.

Mr Nikhil Pahwa, Digital Rights Activist, Founder of Medianama

Let me first start with what my SIR data reveals about me. So, someone sent me an email at the beginning of this month pointing me to a website that he had built. So, I went to that website and put in my own name to see what it reveals. It was able to identify on the basis of my location, my name and the people in the same district as me – who my relatives might be, including generational relationships; who my neighbours are, based on the address of the information and the [people] in my neighbourhood who are on the voters’ list. It creates a relationship graph around each person and that actually is what is at the core of social engineering and our governments have very helpfully released a truckload of this information historically over time.

For example, when we were reporting on Aadhaar in 2013-14, entire government departments had put up spreadsheets of person’s name, addresses, mother’s name, date of birth, phone number and everything that you might need to open a bank account. In some cases in Andhra Pradesh at that time, there were even school children’s data that was available. As we start connecting people to a unique ID, we’ve done very little to protect it. You’ve allowed accumulation of data, you’ve allowed interconnection of that data, which is leading to an information asymmetry between the victim and the perpetrators.

Using AI, someone can mimic the voice of a person because the voice could be cloned from other phone calls. Voice cloning is becoming very easy now and it’s not very expensive to do. So, what you’re seeing is a relationship graph with real-time information on you because of either what you have put [up] on social media or what other databases might reveal about you, which may already be leaked.

Alongside that, you have people who have industrialised social engineering. I remember almost five years ago, Snigdha Poonam had done a story about Nuh in Haryana, where entire call center operations were running. They had daily targets, monthly appraisals, and an annual party where awards were given to the biggest scamsters. They were buying SIM cards by the bulk.

Digital makes things easier for us. It is meant to reduce friction in what we do. As you keep reducing friction, you become, as Nand Nilekani calls it, a data-rich country. This entire system also forms the basis of the fraud that we are seeing today. It’s impossible to address this fraud without dismantling organised crime.

Aadhar is the fountain head of social engineering and fraud and it’s not something that we hadn’t warned against. I would go as far as saying that Aadhaar is actually a national security problem. That data is already on the dark web. If you remember, Rachna Khera had reported that Aadhaar database was being sold by employees of common service centers for 800 rupees. Fraud mule accounts [are] very easy to set up.

It’s easy to blame the banks. But banks themselves don’t know how to deal with the situation. Instead of becoming more convenient, bank apps are becoming increasingly more inconvenient because they’re trying to fight fraud.

The police are also struggling to deal with this. At the core of it lies the fact that we are constantly releasing data about ourselves, not [always] through our own consent, but also by the government. The government is actually responsible for the scale of cyber fraud happening in this country. They have built the infrastructure for fraud in this country because of how much data it leaks out and they have no intention of stepping back because, as we all know, that also is a foundation of the surveillance infrastructure in
the country.

Government bodies are largely exempt from the data protection law in this country. We should never forget that the Government of India went to the Supreme Court arguing that privacy is not a fundamental right. The data protection law that we have is built in order to exempt the government, but also to treat privacy as not a fundamental right.

The government is building system upon system trying to make things more difficult for us with the objective of tackling cybercrime, because they’ve already created a mess that they cannot solve. They’re now trying to create more hindrances for citizens. For example, you have facial recognition when you’re buying a SIM card. How do you know how secure that data is when they’re taking your facial data, that can be used to create AI clones of people?

We can keep holding platforms accountable for what they’re doing, but we should also recognise that a large part of our freedoms is being regulated by the government through the platforms. So, while we want certain harmful content to be censored, also remember it’s nearly impossible for any platform to effectively police a billion people online. The restrictions that we create for safety, those restrictions can also be weaponised for censorship. We should be careful about what we wish for.