Cyber Extortion: Legal Repercussions and Preventive Measures

Most aspects of everyday life are now being digitised, allowing new opportunities for criminals to exploit. Cyber extortion is one of the most dangerous types of cybercrime, impacting people, businesses, healthcare organizations and government offices. With India's digital transformation efforts such as the “Digital India” initiative, cyber extortion has become a critical issue for the legal profession, cybersecurity professionals, and policymakers.

In this article we will comprehensively discuss the legal and practical aspects of Cyber Extortion in India, with a focus on the provisions of the Information Technology Act, 2000 and Bharatiya Nyaya Sanhita, 2023.

Cyber Extortion: What is it?

Cyber extortion is the threat of causing harm (usually through cyber means) to a person or company to make payment or comply with demands. The damage that can be caused can be publishing of personal data, cyberattacks or disclosure of private information.

Cyber extortion can be done without any physical threats or intimidation, and is borderless, anonymous and far more scalable than traditional extortion.

Key Characteristics

• Offenders are distant and may be located in different jurisdictions.
• Victims are forced through digital means, such as stolen data, access to systems, or stolen materials.
• Normally demands are made in cryptocurrency to hide out of detection.
• The threat can be towards a person, a company or towards critical infrastructure.

Also Read :- Cyber Laws in India - Acts & Rules

Cyber Extortion Meaning Explained

The Cyber Extortion Definition covers a wide range of threatening acts in the Cyber domain. In essence, it is a situation in which a cybercriminal obtains — or pretends to obtain — access to important digital assets and demands payment or that compliance will be withheld in order to avoid further damage to the victim.

Examples range from basic ransom demands by a hacker to encrypting a company's files, to a criminal threatening to post intimate photos if a sum of money is not paid. In all these cases, the theme is the ability to force people into a situation by leveraging digital means.

With growing monetisation of data, the use of cryptocurrency to remain anonymous, and the ease of attack on organisations that typically lack adequate cyber security hygiene, cyber extortion continues to be a growing worldwide problem. The National Crime Records Bureau (NCRB) has consistently been recording the rise in cybercrimes every year in India and among these extortion-related crimes have a considerable share and are increasing by the day.

Types of Cyber Extortion

Ransomware Attacks

Ransomware is ransomware software that locks a victim's files or locks down a system preventing the victim from accessing their data. The hacker then sets a ransom — typically in bitcoin or monero — for the release of a decryptor. The ransomware is causing a lot of major problems for hospitals, logistics companies, even municipal governments around the world.

Data Theft Extortion

The variant in which criminals steal sensitive information (such as customer records, financial information, intellectual property), and threaten to publish or sell it unless a ransom is paid. When it's accompanied by ransomware, it can also be referred to as "double extortion".

Sextortion

Sextortion is when the victim is threatened to have personal or sexually explicit photos or videos shared with others if they don't send money. Often the victims are minors or young adults. Sextortion rackets have been found involved in several big cases in India, from students to senior corporate executives.

DDoS Extortion

A Distributed Denial-of-Service (DDoS) attack is an attack that sends traffic to a target server to make it unavailable. The attackers threaten to launch and continue these attacks if a ransom is not paid. Often they are targeted by e-commerce or financial services.

Business Email Compromise (BEC)

BEC is generally a fraud operation, but it can become a case of extortion. Exploit or spoof business email accounts, and trick employees into making transfers or divulging information through implicit or explicit threats.

Cryptocurrency-Related Extortion

As digital currencies came into existence, extortionists have found a near-untraceable payment system. Some attackers would just send out threatening emails with no evidence of attack whatsoever and bank on the victim's fear of what might happen to them if they don't pay.

How does cyber extortion work?

Victims and security experts can decipher and thwart attacks at every stage.

Initial Access: Attacks can be made via phishing emails, exploiting unpatched software vulnerabilities, stealing credentials, or through initial access brokers and dark web forums for a price.

Exploitation: After gaining access to a system, the attacker traverses the network, gaining more access, privileges and finding assets of value like databases, backups and financial records.

Threat Creation: The attacker installs ransomware, extracts valuable information or compromising content, or captures the content. This provides leverage in making a credible threat.

Ransom Stage: Victim receives a ransom note or threatening message outlining the ransom — typically in cryptocurrencies — due date and repercussions of failure to pay.

Payment Mechanisms: The preferred payment method is cryptocurrency wallets, because they are a pseudonymous payment mechanism. Some attackers use mixer services (or privacy coins such as Monero) to further obfuscate money.

Cyber Extortion in India

The increased reliance on internet banking, cloud storage and remote work has greatly increased the attack surface. Small and medium-sized enterprises (SMEs) are particularly vulnerable because they generally may not have the same level of cyber security infrastructure.

Sextortion scams are particularly prevalent and common amongst students and young working professionals. Several national investigations have identified attackers from Mewat, a town in Haryana and Jamtara, in Jharkhand. Moreover, ransomware gangs such as affiliates of international criminal gangs are now targeting Indian healthcare organizations, government portals, and manufacturing organizations.

The monetary loss and reputational damage caused by cyber extortion is in crores every year and a large number of such attacks are not reported due to stigma or fear of reputation loss.

Legal Framework Governing Cyber Extortion in India

Information Technology Act, 2000

The IT Act, 2000 is the main statute related to cybercrime in India although it doesn't explicitly mention ‘cyber extortion'. There are a number of provisions relating to this behaviour:

Section 43: Gives civil remedies to those who cause damage to computer systems, networks, or data without permission, when the attackers cause destruction of data or alteration to it to coerce the victim.
Section 66: Prohibits actions that are criminal when performed using computers, and imposes a three-year jail term and/or fine of up to five lakh rupees for such actions.
Section 66C: Catches identity theft — which is the misuse of another person's electronic signature, password or unique identification characteristic.
Section 66E: Explicitly criminalises taking, sharing or broadcasting private pictures of a person without permission — directly relevant to sextortion cases.
Section 67 and 67A: Make it a serious crime to publish obscene or sexually explicit material in electronic form, with fines and some substantial imprisonment.
Section 70: This section will help safeguard critical national infrastructure or systems, also known as "protected systems," from unauthorized access. Such systems are ripe for DDoS attacks and face harsh consequences.

Indian Computer Emergency Response Team (CERT-In) is a nodal agency of the IT Act that is responsible for cyber security incident response, including cyber extortion.

Bharatiya Nyaya Sanhita 2023

Bharatiya Nyaya Sanhita has replaced the IPC code of 1860, the BNS was enacted in July 2004 and brought it stricter policies and changes to the law of cyber extortion.

Extortion (308, BNS): Putting another person in fear of injury or to himself or herself, and causing the other person to put in fear the delivery of any property or valuable security, a person commits extortion. The data or images that can be released digitally would fall in line with this definition.

Criminal Intimidation (Section 351, BNS): Threatening to injure, damage to reputation  or property with the intent to cause harm is a crime. Note ransom and sextortion ransom are types of criminal intimidation.

Privacy Related Offence: Strengthening of measures against privacy-related offences – including against victims of sextortion.

The prosecutor may want to count on a cyber extortionist based on that combination of IT Act and BNS section, to cover up the cyber extortionist's crime.

Cyber Extortion Preventive Measures

For Individuals

• Use lengthy and complex passwords.
• Turn MFA on all sensitive accounts.
• Do not click on unknown or suspicious or download attachments from strangers. 
• Back up your all-important files.
• Review and limit the personal information that is accessible to strangers on social media platform.

For Organizations

• Regularly provide cybersecurity awareness training.
• .Adoptings a sophisticated EDR system.
• Install security patches to operating systems and software.
• Prepare and practice an Incident Response Plan with a recovery plan.
• Isolate networks into segments where it is not an easy task to gain access to critical systems if they are attacked in one segment.
• Be prudent in assessing the Cybersecurity posture of third parties (vendor/partner) as cyber-attacks through the supply chain are becoming an entry point.

Incident Response Strategy:

To minimize the impact of cyber extortion act it is advisable to have a structured incident response plan.

Containment: Isolate the affected systems from the network to stop the spread of an attack on other systems and network

Reporting: Report at local Cybercrime Police Station, and/or at Cybercrime Portal (cybercrime.gov.in). Report incidents to CERT-In, in case of some specific incidents. If any personal data take into account duties from laws and regulations in this area.

Forensic Investigation: Get the services of an excellent forensics firm to find out exactly what damage was done, the type of damage and if data was leaked or not.

Recovery: Recover systems from clean backup, reset credentials and implement other security controls. 

How Insaaf99 can assist in Cyber Extortion Matters

Cyber Extortion victims can benefit from Insaaf99, which will match them with a legal consultant that is proficient in handling this specific type of Cyber Extortion. The platform can assist people with knowing their legal rights, collecting and keeping digital proof and submitting proper complaints to cybercrime units. It has an expert legal team to represent and defend the victims in proceedings under the Information Technology Act, 2000 and provisions of Bharatiya Nyaya Sanhita. Insaaf99 also provides online legal advice on “How to react to threats” and “How to protect a privacy right” to the victim, helping him to act in a suitable way and at the proper time against the offender in order to obtain an appropriate remedy and compensation in terms of law.

Also Read :- What is Digital Arrest: Modern day Cyber Scam

Conclusion

Being a victim of cyber extortion is one of the most serious and developing problems of the cyber era. Harms can be very serious and long-lasting – from a ransomware attack on a hospital's records to a sextortion scam targeting a teenager. The law and the manner in which it is articulated in the IT Act, 2000 and the Bharatiya Nyaya Sanhita 2023, offer a few big answers, however victims and potential victims ought to realize that prevention and early reporting can be effective.

With data becoming a valuable asset and connectivity becoming a given, it is best practice and a legal and ethical obligation to be proactive with cybersecurity awareness.

FAQ

Q1. What is cyber extortion?

Ans: Cyber extortion is a type of cybercrime where criminals threaten to leak sensitive data, lock files, disrupt systems, or carry out cyberattacks unless the victim pays money or complies with their demands.

Q2. What is the meaning of cyber extortion?

Ans: Any online act of coercion in which offenders use stolen data, hacked accounts, or digital systems to pressure victims into meeting their demands. It is the digital form of traditional extortion.

Q3. Is cyber extortion punishable in India?

Ans: Yes. Cyber extortion is punishable under the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023. Depending on the offence, penalties may include imprisonment, fines, or both.