18. Ethics, the Law and a Safe Kali Lab
18.3 Reporting Cyber Crime in India
Ethical hacker mhanje tumhi kaydyachya bajune aahat – mhanun report kuthe karaycha he pan mahit hava. He tumchya family aani clients la pan sanga.
| Where | For what |
|---|---|
| cybercrime.gov.in (National Cyber Crime Reporting Portal) | Report any cyber crime; a special section for women/child-related offences |
| 1930 (national cyber crime / financial fraud helpline) | Urgent financial fraud – call fast so the money trail can be frozen |
| Local police / cyber cell | File an FIR for serious offences |
| CERT-In (Indian Computer Emergency Response Team, under s. 70B of the IT Act) | Report security incidents affecting organisations; they issue advisories and vulnerability notes |
| NCIIPC | Incidents affecting Critical Information Infrastructure |
| Responsible disclosure / bug bounty program policy | When you find a bug in a system that has a disclosure program (Part 11) |
If you find a real vulnerability by accident (for example a public S3 bucket), do not download the data or "prove" it further. Note the minimum evidence, stop, and report it through the owner's disclosure channel or CERT-In. Going further can move you from "helpful finder" to "s. 66 offender".
Why this matters for security
Knowing the reporting path is part of incident response (Part 11). The first hour of a financial fraud matters most – 1930 exists so banks can try to freeze the transfer. For organisations, CERT-In reporting is not just good manners; certain incidents must be reported within the timelines CERT-In specifies.
Ravindra Bagale's Tip
If they find a bug by accident, many students pull out more data and take screenshots "just to see" – and that's exactly where the legal trouble starts. Take the minimum evidence, stop, and report it. "I stopped and reported" is your best protection.
Ravindra Bagale's Tip – मराठी
चुकून एखादा bug सापडला तर बरेच students "पाहून तर घेऊ" म्हणून आणखी data काढतात आणि screenshots घेतात – आणि तिथेच कायद्याचा problem सुरू होतो. कमीत कमी पुरावा घ्या, थांबा, आणि report करा. "I stopped and reported" हे तुमचं सगळ्यात चांगलं सुरक्षा कवच आहे.
Ravindra Bagale's Tip – हिंदी
गलती से कोई bug मिल जाए तो बहुत से students "देख तो लें" कहकर और data निकालते हैं और screenshots लेते हैं – और वहीं से क़ानूनी problem शुरू होती है. कम से कम सबूत लो, रुको, और report करो. "I stopped and reported" तुम्हारा सबसे अच्छा सुरक्षा कवच है.
Practice task
Bookmark cybercrime.gov.in and note the 1930 helpline. Write a 3-step personal plan for what you would do if you discovered a data leak: (1) stop and record minimally, (2) do not download, (3) report through which channel.
Reporting channels, explained with examples
The table above lists the main places. Here is when to use each one, with real situations.
Example 1: financial fraud
Suppose your uncle at a SBI branch customer desk tells you a relative transferred ₹45,000 after a fake UPI call. Call 1930 at once so banks can try to freeze the trail. Also file a report on cybercrime.gov.in. Speed matters more than perfect wording.
Example 2: company incident
Suppose we are a junior analyst at a mid-size Indian firm. Ransomware hits a file server. The CISO reports to CERT-In as required under Indian directions for certain classes of incident, and may also involve the local cyber cell and the company's insurer. Your job as a junior is to preserve logs and notes, not to wipe the server in panic.
Example 3: everyday phishing
You receive a "your Aadhaar is locked" SMS with a link. Do not click. Report the number and message on cybercrime.gov.in. Forwarding phishing SMS to 7726 (SPAM) also helps telecom providers.
What good notes look like
- Date and time (IST).
- Screenshots of the message, site or app.
- Transaction IDs, UPI IDs, phone numbers, URLs.
- What you already did (blocked card, changed password).
Global parallel
In the US, people often report to the FBI's Internet Crime Complaint Center (IC3). In the UK, Action Fraud. The idea is the same: one national door for cyber crime reports.
Recap
- 1930 for urgent money fraud. cybercrime.gov.in for records. CERT-In for organisational incidents.
- Notes and speed help more than anger.
Defender's worksheet (do this today)
- Write the lesson title and date in your notebook.
- List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
- Run one safe command or checklist item from the lesson on a lab system only.
- Paste the command and its output under an Evidence heading.
- Write one fix you would give a teammate in two sentences.
- Write one mistake students make with this topic and how to avoid it.
More real-world pictures
Indian workplace (sample data)
Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.
Global practice
Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.
Home and family
Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.
Connect to earlier chapters
Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.
Common mistakes
- Skipping written permission just for a quick scan.
- Practising on hostel or office Wi-Fi targets without authorisation.
- Collecting tool output without writing the fix.
- Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.
Recap
- Evidence, fix, owner, date.
- Own lab only.
- Teach one other person the warning from this lesson.