The first generation of cybercriminals were mostly driven by the need to show one upmanship. Consider students who would hack the system to send a message to professors if they were unhappy with the grades.

The second generation of cybercriminals were driven by the need to show one upmanship and also convey that they would attack anyone who did not agree with them.

The third generation of cybercriminals are mostly driven by the need to make money. They are organized gangs which invest heavily in developing capabilities to launch cyber-attacks of different forms. They realize that such crimes can be launched conveniently sitting in air-conditioned offices, without running any physical risk. Their risk assessment tells them that the chances of being apprehended are quite low. So the ROI is very high.

Note: Funding by organized gangs with ulterior motives for the internet is not new. In the past pornographic groups invested heavily to increase the speed of the internet. That was necessary to drive their revenues.

Cybercriminals have also infiltrated the systems of standards setting bodies. As an illustration, an error in the computation of the strength of the Crypto primitives has been uncovered recently.

The kind of reach and capabilities which cybercriminals have developed is indeed scary. It will take time for the police to get on top of cybercrime. However, we will get there. It is like the British constabulary which has evolved over 200 years. Different stakeholders will realize the need to come together.

Edwin Sutherland coined the term white collar crime. The distribution of the population in terms of tendency to commit cybercrime follows a Bell curve. In any community, 1 sigma of the population will be inclined to commit cybercrime. 1 sigma will be inclined to stay away from cybercrime. The remaining four sigma people will be cats on the wall. They will fall in the curious but ignorant category. These are the people who will determine the progress towards controlling cybercrime. As an illustration, instead of following the policy of 8 character passwords, these people may think: why not a seven letter password. But they do not understand the implications. These people may either not take precautions or may flaunt the protocols just to see what happens. They are not necessarily malicious and should be educated and made aware of the risks involved.

Academic institutions can play a big role in spreading awareness, creating a pool of trained professionals, and influencing government policies. Dr Subramaniam had worked with Madras University to launch a Masters course in information security.

Government universities are constrained by various rules and procedures. The private universities can seize the initiative and make an impact in this space. They can collect data and influence the people who matter. The government, police and the judiciary will provide full support.

This is a popular methodology used by cybercriminals. In 80% of the cases, there will be small, minute differences from the authentic URL. Sometimes we may notice it. On other occasions, we may not. We should first check if the mail makes sense. If for example, we get a mail from a source which is not relevant to us, (say a bank in which we do not have an account) we should not fall for it.

Dr Subramaniam once did an interesting experiment. When he got a phishing mail (for reworking the bank account), he provided the user id and password of the bank account, both fictitious of course. The system accepted both of them. Then it asked for the credit card number. Now when he gave a fictitious number, the Luhn’s algorithm (not very expensive to procure) immediately caught it and asked for the correct credit card number. This confirmed that it was a phishing mail. (Phishing is a technique to acquire sensitive data, such as bank account numbers, through a fraudulent solicitation in email or on a web site. The cybercriminal misrepresents himself as a legitimate business or reputable person.)

We should not open the mail if we suspect something fishy. Most cybercrimes have happened through at least one suspicious activity.

It is unreasonable to hold the government accountable for controlling cybercrime. The government can only spread awareness. We must report cybercrime and also put in necessary safeguards.

There is no special global all-encompassing law to counter cybercrime as yet. Understanding of cybercrime varies across countries. Some countries follow common law. Others follow civil law / Islamic law.

India has a strong penal code. Cybercrime is often treated under common law as lawyers and judges are more comfortable with common law.

In some countries, law exists only on paper. It is not really implemented.

The understanding of what constitutes a cybercrime varies across countries. Once, there was a threat to the then Prime Minister from a resident of Tamil Nadu. The CBI studied the trail and arrested the person. It was touted as the most significant cybercrime that was averted in the nick of time. But the question rose whether it was really a cybercrime. Many lawyers thought it was a normal crime. The threat may have come online but that was about it.

In the US, different states have different sentencing guidelines. The challenge is how to fit different versions of cybercrime into these guidelines.

The robbery at the central bank of Bangladesh has been touted as the biggest cybercrime so far in the sub-continent. But there have been bigger crimes. The reason for this crime gaining publicity was that the incident had happened at the central bank which is supposed to the citadel of all banking controls.

The biggest crimes in the coming years may however result in an impact on human life rather than just money. Countries have deployed cybercriminals to attack enemies. This has been seen in the Israel Hamas war.

Tomorrow’s cybercriminal will not just look at IP based data but also SCADA (Supervisory Control and Data Acquisition) based systems which control industrial processes. Normally, SCADA based data and IP based data do not talk to each other. If IP and SCADA systems are connected, it may have disastrous consequences. A good example is the Iranian nuclear reactor at Natanz. The incident affected the coolant system network at Natanz, leading to a shut down of the plant until emergency responses kicked in. Next gen attacks on SCADA systems may lead to disruption of water supply, sewage and electricity systems.

Battle tanks are an integral part of land warfare. The protection of the tanks lies in the strength of the armour. This is because of the special metallurgical components used. If SCADA systems are infiltrated, the strength of these components may be seriously undermined. The materials may become as brittle as glass. The result could be severe casualties.

Along with the rise of digital forensics is the rise of anti-digital forensics. The cybercriminals are ensuring that they do not leave behind any traces of the crime.

The police are often helpless. They are understaffed. They have a limited understanding of cybercrime. They do not have enough trained cyber security professionals Today, cybercrime is not their top priority. It will take time. But the government will at some point of time address the problem adequately.

We must take care of security ourselves rather than delegate it to others. There are good protocols and processes available. We just need to follow them. We must do a due diligence at the beginning and end of each day. But we do not pay enough attention to these protocols.

We must not open suspicious emails. If we have a doubt, we must check with our IT department. Most large companies can quarantine such mails. We should not short circuit the prescribed protocols. If we follow prescribed safeguards, we can take care of 99 out of 100 cases. Unfortunately, many of us fall in the category of curious and ignorant.

In case of demat accounts we must follow the guidelines given by the DPs. When we are doing something online, if we suspect something, we must immediately stop what we are doing and talk to the concerned expert who can advise us.

We should not use non secure protocols, like TFT protocol. Enterprise IT must examine the firewall, when there is a ransomware attack. They should determine where the traffic is coming from. Whether we can retrieve our files after a ransomware attack would depend on the nature of the attack.

After a major cyber attack in 2207, Estonia introduced block chain-based security. But Estonia is a small country, like one of our districts. In Estonia, the blockchain regulations were not introduced by the central bank. India is a much larger country. Different states have different regulations. The RBI has introduced various regulations for blockchain. So, replicating the Estonian model in India is not advisable.

For these institutions, data and knowledge are the key assets. They should be put on par with tangible assets. There must be controls which clearly indicate who can access the data, modify the data and so on. Universities must realize the value of their intangible assets. There are examples of universities who have been victims of cyber-attack, though the news has not come out in the open. These arguments also apply to Research, Design and Development organizations for whom the main assets are intangible.