If you are stuck in such a situation, here is what to do.

Mr. Rohan Kumar, a resident of Suryanagar, had a messaging app account linked to his phone number that he didn’t use frequently. Recently, upon logging in after a long hiatus, he received a notification that his account had been accessed from an unknown device in a distant city, Avantika. The app prompted him to verify the login, which he immediately reported as unauthorized. He promptly took steps to secure his account by logging out of all other devices, changing his password, and enabling two-factor authentication.

Upon reviewing his account activity, he was horrified to discover that the unauthorized user had been using his account to disseminate links to websites selling illegal substances. These messages were sent to various unknown contacts between early and late last month. While some chat histories were automatically deleted, a recent one remained. Mr. Kumar took screenshots of all the evidence and approached his local cybercrime unit. However, the officials there were dismissive, stating that since he had already regained control of his account and some data was deleted, there was little they could do.

Now, Mr. Kumar is deeply concerned about the potential legal repercussions. Since the illegal activities were conducted through his account, which is directly linked to his personal phone number, he fears he might become a suspect in any future police investigation. He is particularly worried as he has plans to travel internationally for his career and cannot afford any legal entanglements. He is seeking clarity on his legal position and the steps he should take to protect himself.

Advice in such cases

If you find yourself in a similar predicament, it is crucial to act swiftly and methodically to protect yourself from potential legal liability. Here are the recommended steps:

• Preserve All Evidence: Do not delete anything. Take clear screenshots of the unauthorized chats, login notifications, account activity logs, and any communication with the hacker. Note down the dates and times of the unauthorized access.
• Report to the Platform: Immediately report the hacking incident to the support team of the messaging application. This creates an official record of your complaint with the service provider.
• File a Cybercrime Complaint: Lodge a formal complaint on the National Cyber Crime Reporting Portal (www.cybercrime.gov.in) or at your nearest cybercrime police station. Insist on receiving a copy of the First Information Report (FIR) or a receipt for your complaint. This official complaint is your primary piece of evidence to show that you were a victim.
• **Consult with Lawyer**: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think

Applicable Sections of Law

Several laws can come into play in such a situation. While you are the victim of hacking, the activities performed through your account fall under serious offenses:

• The Narcotic Drugs and Psychotropic Substances Act, 1985 (NDPS Act): This is the primary legislation dealing with drug-related offenses in India. Any involvement, even indirect, in financing, trafficking, or abetting drug sales can attract severe penalties under this Act. The police might initially investigate the owner of the phone number used.
• Bharatiya Nyaya Sanhita, 2023 (BNS): Provisions related to identity theft and cheating by personation can be invoked.
  • Section 318 of BNS: Punishes identity theft, where someone fraudulently uses another person’s identifying information without consent.
  • Section 317 of BNS: Deals with cheating by personation, which is applicable to the hacker who pretended to be you.
• The Information Technology Act, 2000: While the BNS has introduced new provisions, the IT Act remains relevant for specific computer-related offenses. Section 43 (Penalty and compensation for damage to computer, computer system, etc.) and Section 66 (Computer related offences) are pertinent to the act of hacking itself.

If you are the complainant

As the person whose account was compromised, you are the complainant in this case. Your goal is to establish that you were not the perpetrator of the illegal acts.

• File a Detailed Complaint: Your complaint to the cyber police should be as detailed as possible. Include the timeline of events, the evidence you have collected (screenshots, etc.), and the steps you took to secure your account.
• Document Everything: Keep a record of every action you take – the date you filed the police complaint, the names of officers you spoke with, and any follow-up communication.
• **Consult with Lawyer**: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think

If you are the victim

Being a victim of identity theft where your identity is used for criminal activities can be distressing. Your priority is to create a strong defensive case for yourself.

• Establish Lack of Mens Rea: In criminal law, ‘mens rea’ or a guilty mind is essential to prove a crime. Your immediate actions—reporting the hack, changing passwords, and filing a police complaint—demonstrate your lack of criminal intent.
• Gather Exculpatory Evidence: Collect evidence that proves you were not in control of the account during the time of the illegal activity. This could include location data from your phone, witness testimonies, or digital footprints showing your actual activities during that period.
• **Consult with Lawyer**: The very basic and important step to start is talk to Lawyer / advocate. You should not hesitate in paying his consultation fee i.e. might be in range of Rs. 10,000 to 50,000 depends case to case. He is helping you in this situation of come out. He is expert in the domain and can help you explain the procedure which you might have never explored. A good lawyer can get the issues resolved much faster than you think He can help you file for anticipatory bail under Section 482 of the Bharatiya Nagarik Suraksha Sanhita (BNSS), 2023, if there is a credible threat of arrest.

How the police behave in such cases

The police response can vary. Initially, they might be dismissive, as experienced by Mr. Kumar. However, if a larger drug investigation uncovers the messages sent from your number, they will be obligated to investigate you as the primary owner of the account. The initial investigation will focus on the registered owner of the phone number. You will be presumed to be the person who sent the messages until you can provide sufficient evidence to the contrary. Proving your innocence will be your responsibility, which is why timely reporting and evidence preservation are critical.

FAQs people normally have

What evidence is required?

The most crucial pieces of evidence include:

• Screenshots of the unauthorized messages and account activity.
• Emails or notifications from the service provider about suspicious logins.
• A copy of your complaint filed with the cybercrime police.
• A copy of your report to the messaging platform’s support team.
• Any technical data you can preserve, such as the IP address of the unauthorized login, if available.

How long will the investigation take?

Cybercrime investigations, especially those involving tracing anonymous perpetrators, can be prolonged. It may take several months to years. The process involves coordinating with telecom companies and app developers (who may be located overseas) to trace IP addresses and gather digital evidence. Your proactive cooperation and the evidence you provide can help expedite the process and clear your name.

Advocate Sudhir Rao, Supreme Court of India