The Many Faces Of An Indian Hacker

13/03/2015 8:27 AM IST | Updated 15/07/2016 8:25 AM IST
Bill Hinton via Getty Images
Computer hacker silhouette. Green binary code background

Indians are communicating, transacting and storing information online in larger numbers each year. We have a higher smart-phone user base than the US now, second only to China. But at the same time, cyber crime is on the rise in India and we are one of the top 10 worst-hit countries in the world. Some of these crimes are orchestrated from outside India's borders, but local hackers are doing damage as well. Where, then, are the stories and images of these homegrown cyber criminals?

When we think of a hacker, only global images creep into our minds. We may have heard of the American cyber bad boy turned ethical hacker Kevin Mitnick, or the German programmer Robin Seggelman who created the Heartbleed bug. We might have heard of online hacker groups like Anonymous or Lulzsec, which have hacked into and defaced major sites around the world.

Through countless editorials, reportage and even movies, we now have a stereotype for the Western hacker. Usually a young male, a loner, very bright, extremely savvy in online skills but socially maladjusted. There isn't a clear social stratum for the typical hacker. Clearly they have access to computers and are savvy, but they could be affluent, middle class or financially constrained. Motives can vary -- from proving their mettle, to protesting against the business practices of an organisation, to stealing money or data. There are intermediaries, of course. The mafia lords or masterminds of online rings are probably the street-smart gang leaders who mastermind plans and are good with real world details. They in turn can employ or partner with the reclusive hacker described above.

Cybercrime in India

How does this translate into the Indian landscape? We do have a growing tribe of security professionals and cyber-forensics experts. Industry experts rue that there is a gap, like in many other sectors, and that more education and training is needed to increase capacity. But who are the individuals using the internet for nefarious means? Are there gangs that operate online? We have heard of MMS scandals and cyber-stalking cases, but who is committing the larger crimes?

There is some data released about the economic impact of cyber crime in India, but experts say that the real number could be even higher given that many cases go unreported. FIRs are not filed for a variety of reasons, and unless there is an official complaint, there is not much that the law enforcement and judicial machinery can do. Possibly that's the reason we know of the Target or Sony or FBI attacks, but not much about what is happening in India.

online hackers

Types of Indian Hackers

While researching for my book Breach, I met with cyber security and forensics experts and cybercrime lawyers. They believe that individuals, typically young males, are committing fraud and data theft. They steal account information or credit card details. They siphon money from bank accounts, bank cards, telecom recharge cards and others. Some target individual consumers, some target organisations such as banks, BPOs, telecom firms and others.

Who are these scammers? The field is really wide.

The insider: In many instances, the criminal is an insider or knows the company or person being targeted. The person is discovered to be a tech-savvy junior employee or an IT support contractor. Motives vary. There have been cases of techies wanting to be employed, misguidedly hacking to showcase their tech skills. Then there are people in the broader ecosystem of a firm -- dealers, vendors, suppliers -- who committed fraud because they knew some loophole in the systems.

The professional: In yet other cases, professional hackers stole data or money. It is still not clear if mafias or organised cybercrime syndicates are operating in India. Certainly, smaller cells are known to be active in video piracy and in targeting consumer or companies. Some say that anyone's phone records can be bought in the lanes of Dharavi.

The dabbler: Then there are those who break into apps or games for the fun of it, or to win a prize. These might tend to be more urban and affluent kids.

The ambitious youth-turned-criminal: A separate set of reports and conversations have indicated that internet usage on mobile is particularly high outside the affluent urban areas. There have been stories of youth walking for miles to access signal in order to get onto social networks. There are studies on slum youth, which indicate that they are digitally skilled enough to get onto networks without English language skills or substantial formal education. Many use fake identities to create a different persona for themselves. The internet is egalitarian. The internet is murky. It is easy to pretend to be someone else, as long as you can manage the technologies, which are particularly intuitive to the young. For some the path towards petty crime is a short one, if the opportunity presents and need is high.

This then creates the portrait of one category of hackers in India. Those with computer skills, but without the English skills or interpersonal finesse needed to get the better jobs, the higher pay, that next raise. Who have access to data, networks, bank accounts, and more; who diligently do their work, while others take the profits or a promotion; who resist temptation till one day they can't; who drift into crime, petty or otherwise, because a better opportunity didn't come by in their lives.

But piecing the puzzle on different types of hackers indicates one cluster that can be highlighted: people with access, information, cyber skills and need - need for money, need for a job.

What Digital India Can Do

Recently at a launch event for Breach, the Minister for IT & Telecom called it a "timely book". It is timely not just because it shines the light on the perils and pitfalls of remaining unsecured in the digital world. It is timely also because Sandman, a young hacker in the book, whom The Economic Times Corporate Dossier labeled "Slumdog Hacker" is prescient of a possibility waiting to happen.

As the government looks at its Digital India initiatives, it has indicated its focus on rural India. I couldn't agree more that this is paramount. It should be expanded to include the urban poor and urban migrants as well. On the positive side, the internet disseminates information to all. Access to news and media transforms the ideas and expectations of youth across all strata. Aspirations are high. The economically constrained youth whether in urban or rural areas, don't just want the basics anymore. They want access. They want opportunity. Not in fields and factories only, but also in this new shiny digital world. On the negative side, it is but natural that as online access and participation increases, more cyber crimes will happen. But if Digital India initiatives don't include this section of disenfranchised but aspiring youth, or provide them with new opportunities, then the slide towards crime can become a much larger problem.

More On This Topic