What a black hat hacker is
A black hat hacker is a person who compromises the security of a computer system without the permission of its owner, usually with a harmful or dishonest aim such as theft, fraud, sabotage or the sale of stolen data. The word cracker is sometimes used for the same person. The term is the opposite of white hat, who works with permission, and it is distinct from the grey hat, whose aim is less clear.
The conduct is not new, but the scale is. Offences that once required presence at a place can now be committed from a distance against many people at once, and a single intrusion can expose the data of thousands. The law responds through a set of offences that cover the act of intrusion, the use of what is obtained and the harm that follows.
The offences that apply
The Information Technology Act 2000 deals with black hat conduct in several places. Section 43 lists the acts of unauthorised access, copying of data, introduction of a virus, damage, disruption and denial of access, and makes the person liable to pay compensation. Section 66 makes the same acts a crime when done dishonestly or fraudulently. Other sections cover what the offender does next. The table sets out the main ones.
| Section | Conduct | Punishment |
|---|---|---|
| 65 | Tampering with computer source documents | Up to 3 years, or fine up to Rs 2 lakh, or both |
| 66 | Dishonest or fraudulent act listed in section 43 | Up to 3 years, or fine up to Rs 5 lakh, or both |
| 66B | Dishonestly receiving a stolen computer resource or device | Up to 3 years, or fine up to Rs 1 lakh, or both |
| 66C | Identity theft | Up to 3 years and fine up to Rs 1 lakh |
| 66D | Cheating by personation using a computer resource | Up to 3 years and fine up to Rs 1 lakh |
| 66F | Cyber terrorism | Imprisonment which may extend to life |
These sections are explained in the guide to the IT Act 2000. A single attack usually engages several of them, together with the general offence of cheating where money is taken.
Investigation and evidence
A police officer not below the rank of Inspector investigates offences under the Act, as section 78 provides. The evidence is digital: the logs of the targeted system, the records of any intermediary, and the devices seized from the suspect. Its collection and examination are described in the page on computer forensics, and a prosecution depends on the integrity of that evidence from the moment of seizure.
Black hat intrusions often cross borders. The Act applies, under section 75, to an offence committed outside India by any person, whatever the nationality, if the conduct involves a computer, computer system or computer network located in India. That gives Indian authorities jurisdiction in principle, though obtaining evidence from abroad remains a practical difficulty.
If a system has been attacked
An organisation that has been attacked should preserve its logs, avoid rebuilding the affected system before it has been copied, and report the incident. Individuals who have lost money or data can report on the national portal or the helpline 1930, and the steps are in the guide on how to file a cyber crime complaint online.