Why computer systems are insecure
Security failures usually come from a short list of causes. Software contains flaws that are found after it is released. Systems are installed with default or weak settings that no one changes. Passwords are short, reused or shared. Updates are delayed, and old equipment stays connected after its makers have stopped supporting it. And people are persuaded to give access: a message that looks like it came from a colleague or a bank is often a quicker way in than any technical attack.
A second source of insecurity is design. Many systems treat everything inside the network as trusted, so once an attacker is inside, little stops further movement. A third is scale: the number of devices, accounts and connections that an organisation has grows faster than the attention paid to each of them. None of these causes is a legal problem on its own, but each is the point at which a legal duty can arise.
What the law requires of an organisation
Indian law places duties on those who hold personal data. Section 43A of the Information Technology Act 2000 makes a body corporate that possesses, deals with or handles sensitive personal data in a computer resource that it owns, controls or operates liable to pay damages by way of compensation to the person affected, if it was negligent in implementing and maintaining reasonable security practices and procedures and thereby caused wrongful loss or wrongful gain. The Digital Personal Data Protection Act 2023 goes further. Section 8(5) requires a Data Fiduciary to protect personal data in its possession or under its control by taking reasonable security safeguards to prevent a personal data breach, and failure to do so carries a penalty of up to Rs 250 crore under its Schedule.
Section 43A is to be omitted under section 44(2)(a) of the Digital Personal Data Protection Act when that provision comes into force, so the later Act is the framework to follow. The guide to the DPDP Act 2023 sets out the duties and the penalties.
Protected systems and the national agency
Some systems matter to the whole country. Section 70 of the Information Technology Act allows the appropriate Government to declare, by notification, a computer resource that directly or indirectly affects the facility of critical information infrastructure to be a protected system. The Act defines critical information infrastructure as a computer resource whose incapacitation or destruction would have a debilitating impact on national security, the economy and public health.
Section 70B establishes the Indian Computer Emergency Response Team as the national agency for incident response, and section 69B allows the Central Government to authorise an agency to monitor and collect traffic data for cyber security. Section 67C requires intermediaries to preserve and retain specified information for the period and in the manner the Central Government prescribes. These provisions give the State tools for preparation and response, as distinct from the offences that apply after an attack.
What good practice looks like
The measures that reduce risk are well known: keep software updated, use unique passwords and a second step of verification, limit each person to the access that the work needs, keep backups that cannot be changed from the main network, and train staff to recognise requests that do not look right. An organisation should also know what personal data it holds and where, because a duty to protect data cannot be met for data that no one has listed. Where an incident occurs, the logs and the affected machines should be kept as they are until they have been copied, as explained in the page on computer forensics, and the incident should be reported, as set out in the guide on filing a cyber crime complaint online.