People all over the world are being phished through servers of some of India's well-known Internet service providers (ISPs). The government has a list of 23 organizations; including US finance majors Bank of America and JP Morgan Chase that have reported phishing of their users by Indian servers (Source: CREDIT CARD FRAUD, VIA INDIAN SERVERS, By Mayank Tewari, New Delhi- Hindustan Times).

Not long before we received similar news that Trojans from China are attacking UK’s critical national infrastructure.
 http://news.zdnet.co.uk/internet/security/0,39020375,39206464,00.htm

Now a similar news is there regarding India. However, it is premature to impute the criminal activity and intent to any particular country or region, i.e. that it is originating from China or India. It is commonly understood that the method of “botnets” or “zombie computers” is generally used for various wrongful purposes. The question of liability of a person, organisation or country in such a case does not arise at all because it is almost impossible to prevent a computer from being converted into a zombie. The operating systems have many loopholes and security breaches and recently the hackers have developed the mechanism of exploiting the weaknesses of “anti virus software’s” themselves. If this is the position, then imputing any sort of liability to computers used as botnets is not only unreasonable but also in ignorance of the crude reality of cyberspace. The ultimate solution is to “harmonise” the laws of all the countries by making a compatible and commonly acceptable international treaty safeguarding the cyberspace. It is not a mature action to impute the liability to a particular person, organisation, computer, region, locality or country.

This, however, does not give a license to keep the computers and computer systems in a negligent manner, that is unfortunately the situation in India. A genuine effort must be made by the NSPs to maintain a sound security base. Further, the legislature must enact a law empowering the NSPs to use the “techniques of aggressive defence” to neutralise such threats. The problems of lack of harmonisation, doubt regarding jurisdiction, lack of a uniform extradition law between various countries of the world, etc can be solved only by using a legitimate, proportionate and reasonable mechanism of self-help, which is not only instant but also free from technicalities and formalities.

At the international level, an International Cyber Law Treaty must be formulated to tackle this growing menace.

Praveen Dalal
Arbitrator, Consultant and Advocate
Supreme Court of India
Tele: +91 9899169611
 http://www.blogger.com/profile/8339811