Post Session Report on Universal Acceptance and Multilingual Internet at Royal Global University under CyberPeace Center of Excellence (CCoE)

Introduction

Who would have predicted that the crime of slavery would haunt our lives through the digital world? In a recent unfolding of events, the cyber wing of Maharashtra has saved 60 Indian nationals from a cyber slavery racket run by armed rebel groups operating in Myanmar and arrested five suspects who acted as recruiting agents, including a foreign national. As per the reports, the racketeers made contact with various individuals, enticing them with offers of high-paying jobs in East Asian countries. The operation unfolds a carefully designed crime network that operates through bordering states, Myanmar, Thailand, and Malaysia, targeting vulnerable individuals through deceptive means and forcing them to commit cyber fraud and financial crimes, operating as an authentic industrial setup. The disturbing set of events makes up only one of many such cyber-slavery incidents that are uncovered and various other rackets that operate in the shadows of cyberspace. Another similar event was reported in March 2025, where the disturbing ordeal of a 52-year-old father from Bihar’s Gopalganj, whose son was lured into working in a scam call centre under the pretence of a data entry job in Thailand.

Counting the Unseen: The Dark Metrics of Cyber Slavery

As per the United Nations report from October 2024, a large number of young individuals are enslaved, acting under the impression they will be employed in high-paying jobs, often on social media platforms, and what follows is an intricate web of cybercriminals operating from illegal scam compounds.  According to the UN Office on Drugs and Crime (UNODC), financial losses from scams in Southeast Asia reached between $18 billion (Rs 1.6 lakh crore) and $37 billion (Rs 3.2 lakh crore) in 2023, much of it linked to organised crime in these three countries. Also, acting on a similar premise, the Indian Cyber Crime Coordination Centre (I4C), a division under the Ministry of Home Affairs (MHA), organised an inter-ministerial committee to address a significant rise in cybercrime in Southeast Asian countries, which includes Cambodia, Myanmar, and Laos. 

The data from the Bureau of Immigration in the Union Ministry of Home Affairs, which included around 29,466 Indians who travelled on visitor visas to Thailand, Vietnam, Myanmar, and Cambodia between January 2022 and May 2024, has gone missing.

From Rescue to Reform: How India is Tackling Cyber Slavery 

The recent events that unfolded have agitated the government to undertake vigilant rescue operations for the missing individuals who became victims of this modern-day trafficking and coordinate with foreign ministries in Myanmar, Thailand and Cambodia for extradition and repatriation. It is notable that in the year 2015, India along with seven other countries in South Asia, including Afghanistan, Bangladesh, Bhutan, Maldives, Nepal, Pakistan and Sri Lanka, came together to address transnational threats that transcend geographical and cultural borders in cooperation with the United Nations Office on Drugs and Crimes (UNODC). The collaboration brought together a Compendium of Bilateral and Regional Instruments for South Asia providing for International Cooperation in Criminal Matters. Further, in January 2025, UNODC and the European Union launched a €9 million regional project titled "Preventing and Addressing Trafficking in Human Beings and the Smuggling of Migrants in South Asia." The Government of India, through its various agencies, also lays down various guidelines and advisories on the National Cyber Crime Reporting Portal. Additionally, law enforcement agencies are actively involved, and cybersecurity NGOs are proactively spreading awareness about identifying red flags associated with threats such as cyber slavery.

Recommendations: A Call to Action

• The various advisories released by the Gov. of India emphasise the need for Indian nationals to verify the credentials of the employer through the Indian Embassy located in that country.
• The authorities and various agencies also stress the need for individuals to refrain from sharing personal information such as location details, contact information or any information pertaining to personal relationships that can be exploited by such criminals.
• The fundamental manner of tackling the crime of cyber slavery is to ensure digital literacy and increase awareness through public campaigns and educational programmes
• The need of the hour is international cooperation and collaboration to undertake a concerted effort to bring back the victims and penalise all those who facilitate such criminal activities. 

References

• https://www.thehindu.com/news/national/more-than-60-indians-forced-into-cyber-slavery-rescued-from-myanmar-5-arrested/article69438991.ece 
• https://www.indiatoday.in/india-today-insight/story/cyber-slavery-the-new-job-con-trapping-indian-youth-abroad-2637157-2024-11-21 
• https://indianexpress.com/article/india/mha-high-powered-committee-cybercrimes-from-se-asia-9345843/ ‍
• https://www.unodc.org/documents/terrorism/Publications/SAARC%20compendium/SA_Compendium_Volume-2.pdf

Introduction

The government has announced that the new criminal laws will come into force on 1st July 2024. The Union Government notified that three recently enacted criminal laws, viz. Bhartiya Nyaya Sanhita 2023, Bharatiya Nagarik Suraksha Sanhita 2023, and Bharatiya Sakshya Adhiniyam 2023 will be effective from 1st July 2024.  The Indian Penal Code 1860, Code of Criminal Procedure 1973, and Indian Evidence Act 1872 have been replaced by these new criminal laws.

On 23 February 2024, the Ministry of Home Affairs Announced the Effective Date of new criminal laws as follows:

1. Bharatiya Nyaya Sanhita, 2023 Effective from 1-7-2024, except Section 106(2).
2. Bharatiya Sakshya Adhiniyam, 2023 Effective from 1-7-2024.
3. Bharatiya Nagarik Suraksha Sanhita, 2023 The provisions will come into force on 1-7-2024 except the provisions of the entry relating to section 106(2) of the Bharatiya Nyaya Sanhita, 2023, in the First Schedule.

Section 106(2) Will Not Be Enforced

Truckers protested against this provision, which provides 10 years imprisonment and fines for those who cause death by rash and negligent driving of a vehicle not amounting to culpable homicide, and escape without reporting it to a police officer. As of now, the government has promised truckers and transporters that subsection 2 of Section 106 of Bharatiya Nyay Sanhita (BNS) will not come into force. This subsection deals with fatal hit-and-run cases and prescribes higher penalties for not informing authorities immediately after an accident. 

Section 106(2) of Bharatiya Nyaya Sanhita, 2023 read as follows;

106. Causing death by negligence.—

(2) Whoever causes death of any person by rash and negligent driving of vehicle not amounting to culpable homicide, and escapes without reporting it to a police officer or a Magistrate soon after the incident, shall be punished with imprisonment of either description of aterm which may extend to ten years, and shall also be liable to fine.

BHARATIYA SAKSHYA ADHINIYAM, 2023

The Bhartiya Sakshya Adhiniyam 2023 will replace the Indian Evidence Act 1872. The Act has undergone significant modification to maintain its fundamental principles for fair legal proceedings and adapt to technological advancements and changes in societal norms. This Act recognises electronic records as primary evidence under Section 57. It also allows the electronic presentation of oral evidence, enabling remote testimony and ensuring that electronic records will have the same legal effect as paper records.

Bharatiya Nagarik Suraksha Sanhita, 2023

The Bharatiya Nagarik Suraksha Sanhita, 2023 replaces the 1973 Code of Criminal Procedure, introducing certain modifications. This Act, under section 176, requires forensic investigation for crimes punished with seven years' imprisonment or more.  Section 530 of BNSS, 2023 is a newly inserted provision which envisages the use of electronic communication audio-video electronic means for trials, inquiries, proceedings, service and issuance of summons. Electronic mode is permitted for all trials, inquiries, and proceedings under section 173 of this Act. The concept of Zero FIR is also introduced under section 173(1) and mandates police stations to register the FIR, irrespective of jurisdiction.

Conclusion

India's new criminal laws are set to take effect on 1st July 2024. These laws modernise the country's legal framework, replacing outdated statutes and incorporating technological advancements. The concerns from stakeholders led to the withholding of enforcement of Section 106(2) of Bharatiya Nyaya Sanhita 2023. The new criminal laws aim to address contemporary society's complexities while upholding justice and fairness.

References

• https://www.indiatoday.in/india/video/new-criminal-laws-to-come-into-effect-from-july-1-2506664-2024-02-24
• https://www.lawrbit.com/article/ipc-crpc-evidence-act-replaced-by-new-criminal-laws/

‍

Digital vulnerabilities like cyber-attacks and data breaches proliferate rapidly in the hyper-connected world that is created today. These vulnerabilities can compromise sensitive data like personal information, financial data, and intellectual property and can potentially threaten businesses of all sizes and in all sectors. Hence, it has become important to inform all stakeholders about any breach or attack to ensure they can be well-prepared for the consequences of such an incident.  

The non-reporting of reporting can result in heavy fines in many parts of the world. Data breaches caused by malicious acts are crimes and need proper investigation. Organisations may face significant penalties for failing to report the event. Failing to report data breach incidents can result in huge financial setbacks and legal complications. To understand why transparency is vital and understanding the regulatory framework that governs data breaches is the first step. 

The Current Indian Regulatory Framework on Data Breach Disclosure

A data breach essentially, is the unauthorised processing or accidental disclosure of personal data, which may occur through its acquisition, sharing, use, alteration, destruction, or loss of access. Such incidents can compromise the affected data’s confidentiality, integrity, or availability. In India, the Information Technology Act of 2000 and the Digital Personal Data Protection Act of 2023 are the primary legislation that tackles cybercrimes like data breaches. 

• Under the DPDP Act, neither materiality thresholds nor express timelines have been prescribed for the reporting requirement. Data Fiduciaries are required to report incidents of personal data breach, regardless of their sensitivity or impact on the Data Principal. 
• The IT (Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, along with the Cyber Security Directions, under section 70B(6) of the IT Act, 2000, relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet prescribed in 2022 impose mandatory notification requirements on service providers, intermediaries, data centres and corporate entities, upon the occurrence of certain cybersecurity incidents. 
• These laws and regulations obligate companies to report any breach and any incident to regulators such as the CERT-In and the Data Protection Board.

The Consequences of Non-Disclosure

A non-disclosure of a data breach has a manifold of consequences. They are as follows:

• Legal and financial penalties are the immediate consequence of a data breach in India. The DPDP Act prescribes a fine of up to Rs 250 Crore from the affected parties, along with suits of a civil nature and regulatory scrutiny. Non-compliance can also attract action from CERT-In, leading to more reputational damage.
• In the long term, failure to disclose data breaches can erode customer trust as they are less likely to engage with a brand that is deemed unreliable. Investor confidence may potentially waver due to concerns about governance and security, leading to stock price drops or reduced funding opportunities. Brand reputation can be significantly tarnished, and companies may struggle with retaining and attracting customers and employees. This can affect long-term profitability and growth.
• Companies such as BigBasket and Jio in 2020 and Haldiram in 2022 have suffered from data breaches recently. Poor transparency and delay in disclosures led to significant reputational damage, legal scrutiny, and regulatory actions for the companies.

Measures for Improvement: Building Corporate Reputation via Transparency

Transparency is critical when disclosing data breaches. It enhances trust and loyalty for a company when the priority is data privacy for stakeholders. Ensuring transparency mitigates backlash. It demonstrates a company’s willingness to cooperate with authorities. A farsighted approach instils confidence in all stakeholders in showcasing a company's resilience and commitment to governance. These measures can be further improved upon by:

• Offering actionable steps for companies to establish robust data breach policies, including regular audits, prompt notifications, and clear communication strategies. 
• Highlighting the importance of cooperation with regulatory bodies and how to ensure compliance with the DPDP Act and other relevant laws. 
• Sharing best public communications practices post-breach to manage reputational and legal risks.

Conclusion

Maintaining transparency when a data breach happens is more than a legal obligation. It is a good strategy to retain a corporate reputation. Companies can mitigate the potential risks (legal, financial and reputational) by informing stakeholders and cooperating with regulatory bodies proactively. In an era where digital vulnerabilities are ever-present, clear communication and compliance with data protection laws such as the DPDP Act build trust, enhance corporate governance, and secure long-term business success. Proactive measures, including audits, breach policies, and effective public communication, are critical in reinforcing resilience and fostering stakeholder confidence in the face of cyber threats.

References

• https://www.meity.gov.in/writereaddata/files/Digital%20Personal%20Data%20Protection%20Act%202023.pdf 
• https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf 
• https://chawdamrunal.medium.com/the-dark-side-of-covering-up-data-breaches-why-transparency-is-crucial-fe9ed10aac27 
• https://www.dlapiperdataprotection.com/index.html?t=breach-notification&c=IN