#Fact Check-Misleading Newspaper from Kerala stating ban on paper currency

Introduction

‍

The courts in India have repeatedly emphasised the importance of “enhanced customer protection” and “limited liability” on their part. The rationale behind such imperatives is to extend security against exploitation by institutions that are equipped with all the means to manipulate customers. India, with its looming financial literacy gaps that have to be addressed, needs to curb any manipulation on the part of banking institutions. Various studies have highlighted this gap in recent times; for example, according to the National Centre for Financial Education, only 27% of Indian people are financially literate, which is much less than the 42% global average. With only 19% of millennials exhibiting sufficient financial awareness yet expressing high trust in their financial skills, the issue is very worrisome. Thus, the increasing number of financial frauds intensifies the issue. 

Zero Liability in Cyber Frauds: Regulatory Safeguards for Digital Banking Customers

‍

In light of the growing emphasis on financial inclusion and consumer protection, and in response to the recent rise in complaints regarding unauthorised debits from customer accounts and cards, the framework for assessing customer liability in such cases has been re-evaluated. The RBI’s circular dated July 6, 2017 titled “Customer Protection-Limited Liability of Customers in Unauthorised Electronic Banking Transactions”  serves as the foundation for regulatory protections for Indian customers of digital banking. A clear and organised framework for determining customer accountability is outlined in the circular, which acknowledges the exponential increase in electronic transactions and related scams. It assigns proportional obligations for unauthorised transactions resulting from system-level breaches, client carelessness, and bank contributory negligence. Most importantly it establishes the zero responsibility concept, which protects clients from monetary losses in cases when the bank or another system component is at fault and the client promptly reports the breach. 

This directive’s sophisticated approach to consumer protection is what makes it unique. It requires banks to set up strong fraud prevention systems, proactive alerting systems, and round-the-clock reporting systems. Furthermore, it significantly alters the power dynamics between financial institutions and customers by placing the onus of demonstrating customer negligence completely on the bank. The circular emphasises prompt reversal of funds to impacted customers and requires banks to implement Board-approved policies on liability to redress. As a result, it is a consumer rights charter rather than just a compliance document, promoting confidence and financial accountability in India’s digital banking sector. 

Judicial Endorsement in Reinforcing the Zero Liability Principle

‍

 In the case of Suresh Chandra Negi & Anr. v. Bank of Baroda & Ors. (Writ (C) No. 24192 of 2022) The Allahabad High Court reaffirmed that the burden of proving consumer accountability rests firmly on the banking institution, hence reaffirming the zero liability concept in circumstances of unapproved electronic banking transactions. The Division bench emphasised the regulatory requirement that banks provide adequate proof before assigning blame to customers, citing Clause 12 of the RBI’s circular dated June 6, 2017, Customer Protection—Limited Liability of Customers in Unauthorised Electronic Banking Transactions. In a similar scenario, the Bombay HC held that a customer is entitled to zero liability when an authorized transaction occurs due to a third-party breach, where the deficiency lies neither with the bank nor the customer, provided the fraud is promptly reported. 

The zero liability principle, as envisaged under Clause 8 of the RBI circular, has emerged as a cornerstone of consumer protection in India’s digital banking ecosystem.  

Another landmark judgment that has given this principle the front stage in addressing banking frauds is Hare Ram Singh vs RBI &Ors. (W.P. (C) 13497/2022) laid down by Delhi HC which is an important legal turning point in the development of the zero liability principle under the RBI’s 2017 framework. The court reiterated the need to evaluate customer diligence in light of new fraud tactics like phishing and vishing by holding the State Bank of India (SBI) liable for a cyber fraud incident even though the transactions were authenticated by OTP. The ruling made it clear that when complex social engineering or technical manipulation is used, banks are nonetheless accountable even if they only rely on OTP validation. The legal protection provided to victims of unauthorised electronic banking transactions is strengthened by the court’s emphasis on the bank having the burden of evidence in accordance with RBI standards. 

Importantly, this ruling lays the full burden of securing digital banking systems on financial organisations and supports the judiciary’s increasing acknowledgement of the digital asymmetry between banks and consumers. It emphasises that prompt consumer reporting, banks’ failure to disclose important credentials, and their own operational errors must all be taken into consideration when determining culpability. As a result, this decision establishes a strong precedent that will increase consumer confidence, promote systemic advancements in digital risk management, and better integrate the zero liability standard into Indian digital banking law. In a time when cyber vulnerabilities are growing, it acts as a beacon for financial accountability. 

Conclusion

‍

The Zero Liability Principle serves as a vital safety net for customers navigating an increasingly intricate and precarious financial environment in a time when digital transactions are the foundation of contemporary banking. In addition to codifying strong safeguards against unauthorized electronic transactions, the RBI’s 2017 framework rebalanced  the fiduciary relationship by putting financial institutions squarely in charge. Through significant rulings, the courts have upheld this protective culture and emphasised that banks, not the victims of cybercrime, bear the burden of proof. 

It would be crucial to execute these principles consistently, review them frequently, and raise public awareness as India transitions to a more digital economy. In order to ensure that consumers are not only protected but also empowered must become more than just a policy on paper. 

‍

References

• https://www.business-standard.com/content/specials/making-money-vs-managing-money-india-s-critical-financial-literacy-gap-125021900786_1.html 
• https://www.livelaw.in/high-court/allahabad-high-court/allahabad-high-court-ruling-bank-liability-unauthorized-electronic-transaction-and-customer-fault-297962 
• https://www.mondaq.com/india/white-collar-crime-anti-corruption-fraud/1635616/cyber-law-series-2-issue-10-the-zero-liability-principle-in-cyber-fraud-hare-ram-singh-v-reserve-bank-of-india-ors-case 

‍

Introduction

Somewhere right now, a model is reading a library. It does not read like you or I, savouring a good line or skipping to the end. It does not copy, clean and convert text into numbers at the scale that a human reader could. The copyright questions these models raise are not new, but they are new in scale, and they implicate a legal order that prizes borders. A book written in Lagos can be replicated on a server in Virginia, used to train a model sold in Berlin. Whose laws apply? The honest answer is: we don't know.

A Treaty Written Before Computers

The Berne Convention is one of the most important international agreements on copyright, with over 180 countries being party to it. According to Article 9(1) of the Berne Convention, authors have the exclusive right to allow or prohibit the reproduction of their works in any form or way. Article 9(2) provides that certain countries may implement exceptions to the rights granted by the convention, as long as they are consistent with the three-step test. More specifically, a national law exception should be confined to a certain category of works, not prejudice the work’s normal use, and not unreasonably prejudice the rights of the author.

This explains how the Berne Convention could apply to copyright protection for AI. Developers of such technology often argue that since the output of a given model rarely resembles anything learned from the examples provided, there is no copying occurring. However, the Agreed Statements of the WIPO Copyright Treaty provide that the reproduction of a protected item in digital format also constitutes a reproduction. Therefore, if a work is used to train a model, this can be considered a reproduction, and the question then emerges whether a national exception applies.

Three Jurisdictions, Three Answers

Countries have responded in different ways to that question. The United States draws on its fair use doctrine, a flexible, four-factor test that was never intended for machine learning but dominates AI-related disputes anyway. Japan’s Article 30-4 permits uses of works for the purpose of data analysis where the use is not for the enjoyment of the work’s expression, which captures a lot of what training entails. And the European Union’s approach falls somewhere in the middle: its text and data mining rules allow mining of lawfully accessible works, but rightsholders can specify in a machine-readable manner that they do not want their works mined, and developers are required to seek permission.

A recent roundtable from the Columbia Undergraduate Law Review argues that the EU model fits the three-step test best because the opt-out keeps a licensing market alive and gives authors control before their work is used rather than after. It argues that broad US fair use and Japan's provision both struggle at the second and third steps, since they can undercut a foreseeable licensing market. That is one scholarly view and not settled law. The EU system also has its own weak spot: an opt-out only protects authors who know it exists and have the technical means to use it.

Bartz v. Anthropic in Brief

Bartz v. Anthropic is the case that puts these debates in front of a judge. Three authors, including Andrea Bartz, Charles Graeber and Kirk Wallace Johnson, filed a lawsuit against the Anthropic company for using part of their works to create the central library used by Claude and to train the models used in its creation. In addition, in June 2025, Judge William Alsup approved the separation of the case, considering each instance of use separately.

On training, he granted summary judgement for Anthropic, holding the use was fair and describing it as exceedingly transformative. He compared it to a reader who studies great writing in order to produce something new. It mattered that the authors did not allege Claude's outputs reproduced their books, so the case turned on inputs alone. He also held that buying print books and scanning them into digital copies was fair use, since it only changed the format of copies Anthropic already owned. But he refused to excuse the more than seven million pirated books Anthropic downloaded to build a permanent library. Building that library from pirated copies, he found, was its own use and not a transformative one, and that part was set for trial.

Two observations are worth making in relation to those thinking across borders. First, the court's assumption that there might be a market for training licences, but its observation that this is not a market which the Copyright Act entitles authors to control, is quite inconsistent with Berne's concern for normal exploitation. Moreover, the order makes no reference to Berne at all, bearing out the observation that the US courts apply the domestic statute and not the treaty.

The story did not end there. Anthropic agreed to a $1.5 billion class settlement covering roughly 482,000 works, and the court granted final approval on 20 July 2026. It resolves claims about past acquisition and copying, so the training ruling remains a trial court's view rather than binding precedent.

Where Borders Break the System

The deeper trouble is that none of this travels well. Berne is not self-executing in the United States, so judges apply the domestic statute, and nobody is required to ask whether a fair use ruling passes the three-step test. Meanwhile, training can happen in one country, on work from dozens of others, for a product used everywhere. The same book might be freely usable in Tokyo, subject to an opt-out in Paris and defended as fair use in San Francisco.

The roundtable suggests one way forward: a new WIPO special agreement, along the lines of the WIPO Copyright Treaty, in response to the internet. It would provide guidance on the application of the three-step test to training, regard licensing markets as an ordinary part of exploitation, and require minimum standards for reservations of rights and compensation. There is one major potential obstacle: many of the most influential AI companies are based in the US, which has a record of opposing international obligations that impinge on fair use. A deal would apply only to the extent that it is not controlled by the US, where most of the training takes place. Market forces, in the form of the so-called Brussels effect, may prove more influential than negotiations at WIPO.

Conclusion

Bartz’s analysis illustrates the importance of characterising a specific use at the level of a particular court. While the former had been viewed as an activity and the latter as an acquisition, the distinction between the use of a work and its acquisition appears more likely to transcend borders than the concept of fair use. Berne was designed to create a common ground for authors. Whether this convention would be able to fulfil its function in the era of generative AI depends on the willingness of nations to adopt a joint understanding of what constitutes its foundations for machines.

‍

Introduction

CyberPeace Chronicles is a one-stop for the latest edition of news, updates, and findings in global cyberspace. As we step into the cyberage, it is pertinent that we need to incorporate cybersecurity practices in our day-to-day activities. From laptops to automated homes and cars, we are all surrounded by technology in some form or another. Thus, with the increased dependency, we need to eradicate the scope of vulnerabilities and threats around us and create robust and sustainable safety mechanisms for us and future generations. 

‍

What, When and How? 

• WIN-RAR Update: CVE-2023-33831, a serious vulnerability, was identified in WinRAR versions prior to 6.23 in April 2023. When users attempted to access seemingly harmless files inside ZIP archives, this vulnerability allowed attackers to run arbitrary code. Cybercriminals transmitted malware families like DarkMe, GuLoader, and Remcos RAT by taking advantage of this vulnerability. It is essential to update WinRAR to version 6.23 or later in order to protect your computer and your data. Follow the following steps to secure your device -

• Checking Your Current WinRAR Version
• Downloading the Latest WinRAR Version
• Installing the Updated WinRAR
• Completing the Installation
• Verifying the Update 
• Cleaning Up 

• Indonesian Hacker Groups Target Indian Digital Infrastructure: As India geared up to host the G20 delegation as part of the Leadership Summit, various reports pointed towards different forms and intensity-based cyber attacks on Indian organisations and digital infrastructure. Tech firms in India have been successful in tracing the origination of the attacks to be from Indonesia. It is believed that hacker groups backed by anti-India elements have been trying to target the digital resources of India. Organisations and central agencies like Computer Emergency Response Team (CERT-In), National Critical Information Infrastructure Protection Centre (NCIIPC), I4C (Indian Cybercrime Coordination Centre), Delhi Police, Intelligence Bureau (IB), Research and Analysis Wing (R&AW), National Investigation Agency (NIA) and Central Bureau of Investigation (CBI) have constantly been working in keeping the Digital interests of India safe and secure, and with the ongoing G20 summit, it is very pertinent to be mindful of potential threats prevailing to prepare counter tactics for the same. 
• CLOP Ransomware: The CL0P ransomware is thought to have initially surfaced in 2019 and was developed by a cybercriminal organisation that spoke Russian. The threat actor FIN11 (also known as TA505 and Snakefly), who is notorious for being financially driven, is frequently connected to the CL0P ransomware, which had its roots at the beginning of 2019. By utilising this technique, CL0P has targeted businesses utilising the "Accellion FTA" file transfer appliance's vulnerable version. Accordingly, it has been asserted that the following vulnerabilities have been used to access victim data and maybe switch to victim networks. Numerous well-publicized attacks carried out by CL0P have had an impact on organisations all across the world. Especially for Managed File Transfer (MFT) programmes, the CL0P performers are well known for their talent in developing zero-day vulnerabilities. The gang went after Accellion File Transfer Appliance (FTA) devices in both 2020 and 2021, then early in 2023, they went after Fortran/Linoma GoAnywhere MFT servers, and then later in June, they went after MOVEit transfer deployments. Up to 500 organisations are thought to have been harmed by this aggressive operation. Some of the ways to mitigate the risk are as follows: 

• Regular Software Updates: Updating programmes and systems helps prevent known security flaws that fraudsters frequently exploit.
• Employee Training: Employee training can significantly lower the likelihood of successful penetration by educating staff members about phishing scams and safe internet conduct.
• Network Segmentation: By separating networks and restricting lateral movement, a ransomware attack's potential effects can be reduced.
• Regular Data backups: Data backups can lessen the effects of encryption and deter payment by regularly backing up data and storing it offsite.
• Security solutions: Putting in place effective cybersecurity measures like firewalls, intrusion detection systems, and cutting-edge endpoint protection can greatly improve an organisation's defences.

• Increased scrutiny for SIM card vendors: As phishing and smishing scams are on the rise in India, the Telecom Regulatory Authority of India (TRAI) has repeatedly issued notifications and consultation papers to address this growing concern. Earlier this year, TRAI notified that promotional calling will not be continued from 10-digit personal numbers. Instead, companies will now have to take authorised 9-digit numbers for promotional calls and SMSs. Similarly, to increase the efficiency of the same, TRAI has laid down that all the SIM card vendors will now have to be verified again, and any discrepancy found against any of the vendors will lead to blacklisting and penal actions against the vendor. 

‍

Conclusion

In conclusion, the digital landscape in 2023 is rife with both opportunities and challenges. The recent discovery of a critical vulnerability in WinRAR underscores the importance of regularly updating software to protect against malicious attacks. It is imperative for users to follow the provided steps to secure their devices and safeguard their data. Furthermore, the cyber threat landscape continues to evolve, with Indonesian hacker groups targeting Indian digital infrastructure, particularly during significant events like the G20 summit. Indian organisations and cybersecurity agencies are working diligently to defend against these threats and ensure the security of digital assets. The emergence of ransomware attacks, exemplified by the CL0P ransomware, serves as a stark reminder of the need for robust cybersecurity measures. Regular software updates, employee training, network segmentation, data backups, and advanced security solutions are crucial components of a comprehensive defence strategy against ransomware and other cyber threats. Additionally, the Telecom Regulatory Authority of India's efforts to enhance security in the telecommunications sector, such as stricter verification of SIM card vendors, demonstrate a proactive approach to addressing the rising threat of phishing and smishing scams. In this dynamic digital landscape, staying informed and implementing proactive cybersecurity measures is essential for individuals, organisations, and nations to protect their digital assets and maintain a secure online environment. Vigilance, collaboration, and ongoing adaptation are key to meeting the challenges posed by cyber threats in 2023 and beyond.

‍