34. Indian Cyber Law and Cyber Crime Awareness
34.7 Red vs Blue, Project and Real Incidents
Chala mitrano, IT Act sections, CERT-In 6-hour clock, DPDP, 1930, cybercrime.gov.in, Sanchar Saathi – aata Purple Team loop. Red side madhe fraudster / insider misuse / slow reporting (UPI-KYC call, delayed bank freeze, evidence wipe) dakhavto; Blue citizen + organisation response – 1930 + bank freeze, cybercrime.gov.in complaint, CERT-In report, evidence pack, DPDP note, Sanchar Saathi. Tumhi Sahyadri Traders style OWN tabletop drill madhe build → hack → fix karun Purple report liha. Ha hacking lab nahi – kayda ani response drill aahe. Samjla ka? Real fraud, real victims, real banks – kadhi nahi.
Red Team vs Blue Team – Indian cyber law and fraud response
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Fake UPI / KYC / "digital arrest" call to create urgency | Teach never share OTP/UPI PIN; call bank on official number; 1930 first |
| Push victim to delete chats / screenshots ("we will reverse") | Evidence pack: UTR, screenshots, numbers, URLs, email headers – do not delete |
| Insider misuse of shop systems / customer data | Access control, logging, DPDP-minded handling; least privilege for staff |
| Delay bank freeze so money moves further | Call bank + 1930 immediately; file on cybercrime.gov.in |
| Organisation hides or slow-walks a reportable incident | CERT-In 6-hour clock for specified incidents; IR playbook ready (Ch.31) |
| Vendor / partner leaves passenger or customer PII exposed | Vendor risk + DPDP duties; know who holds your customers' personal data |
Defender chi simple checklist: 1930 + bank freeze → cybercrime.gov.in → evidence pack → account harden (password/2FA) → CERT-In if org incident → DPDP assess → Sanchar Saathi/Chakshu for fraud SIMs → prove drill with tabletop. Red = fraud urgency / delay / wipe; Blue = speed + law + evidence. Interview madhe "I know section numbers" peksha "I built a 1-page IR and fraud response playbook for an OWN shop drill, ran a fake UPI/KYC tabletop, and showed the evidence pack and CERT-In clock" jast strong.
# OWN tabletop only – Sahyadri Traders (Pune) – NO real fraud, NO real banks
mkdir -p ~/labs/sahyadri-cyberlaw
# 1) BUILD – 1-page IR + fraud response playbook (fill YOUR names/phones):
cat > ~/labs/sahyadri-cyberlaw/playbook.md << 'EOF'
# Sahyadri Traders – fraud / cyber IR one-pager (OWN drill)
1. Financial fraud: call 1930 + bank freeze (official number from card/app)
2. File complaint: cybercrime.gov.in – keep acknowledgement number
3. Evidence list: UTR, screenshots, phone numbers, URLs, chat export, email headers
4. Org clock: CERT-In within 6 hours for specified incidents (cert-in.org.in)
5. DPDP note: what personal data was involved; who to tell (check current rules on meity.gov.in)
6. Sanchar Saathi / Chakshu: report fraud call/SMS; check SIMs in your name
7. Do NOT pay "recovery agents" or blackmailers
EOF
# 2) TABLETOP "hack" – role-play only (classmates / Raja-Rani staff fiction):
# Fake UPI/KYC call script – actor never contacts real banks or strangers
echo 'Tabletop: fake KYC caller asks for UPI PIN – victim must refuse + start playbook' \
> ~/labs/sahyadri-cyberlaw/tabletop-script.txt
# 3) FIX / RE-VERIFY:
# Complete drill once; fill evidence pack checklist; Purple 1-pager for Raja/Rani
echo 'Ethics: IT Act – drill only; no real fraud; no third-party accounts' \
>> ~/labs/sahyadri-cyberlaw/playbook.md
Ravindra Bagale's Tip
Students section numbers memorise kartat – pan 1930 call order ani evidence list blank thevtat. Dusri chuk: tabletop madhe real bank / strangers la phone. Rule: OWN/class role-play only → playbook 1-page → fake UPI/KYC drill → evidence pack + CERT-In clock → Purple report. Kayda chapter = response speed chapter. Ghabru naka, checklist ne yetay.
Lab
Sahyadri Traders sathi ~/labs/sahyadri-cyberlaw/playbook.md liha (1930, bank freeze, cybercrime.gov.in, CERT-In 6 hours, evidence list, DPDP note, Sanchar Saathi). Classmate barobar fake KYC/UPI call role-play – OTP/PIN share nahi; real bank nahi. Mag evidence checklist tick kara ani 1-page Purple note Raja/Rani sathi. Real fraudster / random numbers var call nahi.
Project: Build it, hack it, fix it
Build: For fictional Sahyadri Traders (Pune wholesale shop):
- Write a 1-page IR + fraud response playbook: 1930, bank freeze, cybercrime.gov.in, CERT-In 6-hour clock, evidence list, DPDP note, Sanchar Saathi/Chakshu
- Scope file: this is a classroom / OWN shop tabletop – no production bank APIs, no third-party customer data
- Ethics card: IT Act – no real fraud, no contacting strangers as "test callers", no paying recovery-scam scripts
Hack (tabletop awareness only – NOT a hacking lab):
- Role-play a fake UPI / KYC / "account freeze" call (classmate as caller; you as shop staff)
- Show how urgency pushes people to share OTP or delete evidence
- Stop the drill when the victim should start the playbook – do not improvise real money movement
Do not call real banks as a prank, do not use real customer phone numbers, do not file false complaints on cybercrime.gov.in, do not run malware against any bank.
Fix:
- Complete the drill once with the playbook open; fill every checkbox
- Build an evidence pack folder (sample UTR/screenshot placeholders labelled FICTIONAL)
- Note CERT-In contact path and who in Sahyadri owns the 6-hour clock
- Add a one-line DPDP reminder: personal data of customers is not "just Excel"
Re-verify: Second short tabletop – staff hits 1930/bank order without prompting; evidence pack complete; Purple 1-page report for owners Raja and Rani. Peer-review with Zoya / Salman. IT Act: legal/response drill only; authorised classroom scope.
Real incident: Cosmos Bank cyber heist (Pune, 2018)
In August 2018, Cosmos Cooperative Bank (Pune) disclosed a major cyber attack. Public reporting described malware on bank systems and a wave of fraudulent ATM withdrawals in multiple countries, along with SWIFT-related fraudulent transfer activity. Indian media and later case coverage treated it as a landmark Indian bank cyber heist; amounts were reported at large scale (treat published crore figures as reported, not as your invention). Weakness: malware persistence on banking infrastructure + insufficient detection/response before card and payment rails were abused across geographies. What would have reduced it: stronger endpoint/malware monitoring on critical bank systems, faster card controls and international withdrawal limits when anomalies appear, network segmentation around payment messaging, and practiced incident response with regulators (CERT-In class reporting for organisations). Lab lesson: your Sahyadri playbook's speed + evidence + CERT-In clock is the small-business cousin of the same Blue habit. Source: Cosmos Bank public statements and major Indian / international news coverage of the August 2018 heist; verify current summaries.
Real incident: Air India / SITA passenger data breach (2021)
In 2021, Air India publicly described a data incident affecting passenger information processed through SITA, a major aviation IT provider whose passenger service systems had been breached in a wider industry event. Reporting described exposure of personal data such as contact and passport-related details for a very large number of passengers (treat published headcounts as reported). Weakness: rich passenger PII held by a vendor – when the vendor is hit, every airline customer on that platform can be affected. What would have reduced harm: tighter vendor risk reviews, least data retained, encryption and access logging at the processor, and clear breach-notification playbooks. DPDP-era lesson for Indian organisations: if you handle personal data for customers, "the vendor was breached" does not erase your duty to know what data you hold and how you respond. Lab lesson: Sahyadri's DPDP note in the playbook is not theory – vendor + PII is the Air India/SITA shape. Source: Air India customer notifications and major coverage of the 2021 SITA / Air India passenger data incident; verify current summaries.
Interview model (clean English): "I wrote a one-page fraud and CERT-In response playbook for an OWN shop drill, ran a fake UPI/KYC tabletop with classmates only, preserved a fictional evidence pack, and explained DPDP and Sanchar Saathi as Blue habits – I do not run real fraud tests."
Thodkyaat: fraud urgency olakha, pan 1930 + evidence + CERT-In + DPDP playbook shika. Aata pudhe careers, certifications ani bug bounty – legally kasa vadhaycha. Chala pudhe, mitrano!
Thodkyaat sangaycha tar
- Beyond sections 43 and 66, know 65, 67, 69, 70B, 72, 79 – and that 66A was struck down in 2015.
- BNS, BNSS and BSA replaced IPC, CrPC and the Evidence Act from 1 July 2024; electronic evidence needs proper certification.
- CERT-In requires specified incidents to be reported within 6 hours and logs kept for 180 days.
- The DPDP Act, 2023 makes organisations protect personal data, with very large penalties.
- Most frauds use fear or greed plus urgency; call 1930 and file on cybercrime.gov.in fast.
Samjla ka? Kayda ani fraud awareness he pratyek security professional che kartavya aahe. Pudhchya chapter madhe careers, certifications ani bug bounty – ya kshetrat job kasa milvaycha. Chala pudhe, mitrano!