Ab tak satara (seventeen)!!!

Rhea & IP address mystery…

Well, we all know that Rhea & team changed IP address of their (Rhea, Rhea’s brother & Sushant’s Company) company 17 times…hearing this piece of information we can easily comprehend that there is something really suspicious about it but, however if we see from a layman’s perspective it really needs a deeper understanding as to why did Rhea & team change Company’s IP address for 17 times? What was the purpose behind it? Was it advisable legally? Was such move allowed according to Company’s protocol? & many more questions…

First, lets understand what is IP address in common man’s understanding…just as we have residential address for communication purposes & contact number for connecting to each other over the phone, similarly when two or more computers communicate IP address comes into picture. IP address i.e., Internet Protocol Address is address which is used by our device to connect via internet various computers/ servers for exchange of information or data.

IP address address helps us to receive information on our device. When data such as a ‘file’, ‘image’ or ‘video’ is transmitted across a network, it is first broken down into small blocks called segments. These are placed into containers called packets, typically by the internet protocol (IP): version 4 & version 6. IP address is responsible for delivering the packets from source to the destination, & regardless of the version being used, packets must use some form of addressing to uniquely identify the message source & message destination. This is very similar to what we do when we send a courier or post, we mention address of the recipient on the front & address of the sender on the back.

Now, just this blog content is stored in SSD (Solid State Drive – which is a storage device) i.e. internal memory of a server which is basically a super computer. The primary function is to store, process, deliver web content to the client through complex network through optical fibers & reach the right recipient. IP address is a numerical label assigned to each device connected to a computer network that uses internet protocol for communication.

So this was just a primary knowledge on how IP address works..!!! Now let us understand what’s happened in Sushant Singh Rajput’s case…We will discuss as to what could have been covered up by changing the IP address 17 times? Will changing of IP address 17 times really be a successful attempt to cover up the financial or other crimes transacted online..?

Let’s discuss…

Let’s break it open that no data or no activity goes unrecorded & untraceable. All the activities or data exchanged online goes no where, it remains in the servers & with the help of IP address all the data deleted on the device can be recovered easily. Even if the device is destroyed completely, data can be recovered without a doubt. In the present case, the internet service provider/s will also be questioned. First let us check what did rhea & team exactly do???
There are four types of IP addresses public, private, dynamic & static. In the present case, Rhea & team changed the static IP address. Hence they will be accountable under the audit & will have to give business justification as to why the IP address were changed 17 times & was the said change made time & again was within the company’s protocol/ parameters & with who’s authorization such decisions as to change in IP address that too multiple times were done..if in the audit it is found that the said changes were not done within parameters of the company’s protocol & that too without the required authorization then it is surely a violation & can be termed as security breach. Here, IP address will be used to ascertain the online activities like emails, messages, video or voice conversations over the internet, access to different bank accounts, visting particular websites, any information sought online by Rhea & team.

Well, as far as the legal aspect of the case is concerned, if we see the provisions of The Information Technology Act, 2000 (as amended)

As soon as, Rhea Chakraborty was about to be summoned by the Enforcement Directorate in July 2020, IP address have been changed multiple times & this was around 6th or 7th of August, 2020. So why did they change the IP address multiple times? What was the purpose behind changing of the IP addresses? To cover up?

Actually, if we see, cyber crimes have parallel provisions in the Information Technology Act, 2000 (as amended) & The Indian Penal Code, 1860. Infact the provisions under Information Technology Act, 2000 & Indian Penal Code have same ingredients & nomenclature. On the 8th June 2020, as admitted by Siddharth Pithani that 7 to 8 people entered Sushant’s house & cleaned out 8 hard disks without Sushant’s permission. Also, after Sushant’s demise on the 13th night or 14th morning his devices/ gadgets were taken over by his flat mate Siddharth Pithani, since Sushant is no more, access to Sushant’s devices or gadgets was illegal as the gadgets or devices were part the crime scene & very crucial piece of evidence. Though Siddharth may be allowed by Sushant during his lifetime to access to his computer & other devices, post his death the same gadgets & devices will have to be sent for detailed investigation irrespective of what had happened with Sushant (as they were alleging his murder as suicide). All of Sushant’s electronic transactions post his death done by even his so called girl friend also stand to be unauthorized as Sushant & rhea were in live in relationship only till 8th June 2020 & at time of death Sushant was not in any relationship whatsoever as claimed by rhea. However, Rhea along with her brother Showik & others kept accessing Sushant’s business websites, business accounts without taking into confidence Sushant’s legal representative post his death. Since Sushant is no longer with us, all his property will have to handed over to his legal heir that is Sushant’s father. Rhea & her master mind associates changed IP address of their Company website without taking authorization that is Sushant’s authorization or his Family’s authorization. Hence, the change in the IP address that too multiple times without reasonable business justification was purely to mislead the investigation. However, it is to be noted that, all the online activities or digital footprints or information accessed or shared online, all the exchange of data between the computers over the cyber space can easily be recovered, it cannot be deleted. Here, the administrator will be questioned as why did he allow to change the IP address multiple times? & this question will arise during the Audit. For tampering with the IP address provisions relating

Sections 43 & 66 of the IT Act penalize a number of activities ranging from hacking into a computer network, data theft, introducing & spreading viruses through computer networks, damaging computers or computer networks or computer programs, disrupting any computer or computer system or computer network, denying an authorized person access to a computer or computer network, damaging or destroying information residing in a computer etc. The maximum punishment for the above offences is imprisonment of up to 3 (three) years or a fine or Rs. 5,00,000 (Rupees five lac) or both. Here it is pertinent to understand meaning of the word hacking in legal parlance.

Sec.66 of the Information Technology Act, 2000 provides Whoever with the intent to cause or knowing that he is likely to cause wrongful loss or damage to the public or any person destroys or deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means, commits hacking.
(2) Whoever commits hacking shall be punished with imprisonment up to three years, or with fine which may extend up to two lakh rupees, or with both.
Considering the present scenario, it can be said that the access to Sushant’s devices & making alterations in network system of the business owned by him is definitely illegal as earlier said. The change in IP address 17 times, means that rhea & team wanted to hide their past, present & future online activities. IP address when probed into can reveal every activity, data or Sushant’s bank account/s, social media accounts etc..only investigation will bring forth the truth..but definitely the data was accessed in unauthorized way, copied, may have been altered, deleted, deterioration of value of data so sections applicable will be Sec. 43 provides for penalty & compensation for damage to computer, computer system etc., Sec.43(a) – Unauthorized Access , Sec.43(b) – Unauthorized downloads, copying or extracting any data or information from computer/ computer system or computer network including information stored in removable medium etc., Sec.43(d) – damages or causes to be damaged any computer, computer system, computer network, data or any program residing in computer, computer system, computer network, Sec.43(e) – disrupts or causes disruption of any computer, computer system, computer network, Sec.43(h) – destroys, deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means read with Sec.66 – Hacking, Sec.66(c) – Identity Theft, Sec.66(d) – Cheating by personation of the Information Technology Act, 2008 (as amended). Also the service providers will have to be booked under Sec.84 B for providing assistance to Rhea & team to commit offences under provisions of Sec.43, Sec.43(a), Sec.43(b), Sec.43(d), Sec.43(e), Sec.43(h) read with Sec.66, Sec.66(c), Sec.66(d) of the Information Technology Act, 2008 (as amended).

Provisions of The Indian Penal Code, 1860 applicable in the present case:

Section 378 of the IPC relating to “theft” of movable property will apply to the theft of any data, online or otherwise, since section 22 of the IPC states that the words “movable property” are intended to include corporeal property of every description, except land & things attached to the earth or permanently fastened to anything which is attached to the earth. The maximum punishment for theft under section 378 of the IPC is imprisonment of up to 3 (three) years or a fine or both.

It may be argued that the word “corporeal” which means ‘physical’ or ‘material’ would exclude digital properties from the ambit of the aforesaid section 378 of the IPC. The counter argument would be that the drafters intended to cover properties of every description, except land & things attached to the earth or permanently fastened to anything which is attached to the earth.

Section 424 of the IPC states that “whoever dishonestly or fraudulently conceals or removes any property of himself or any other person, or dishonestly or fraudulently assists in the concealment or removal thereof, or dishonestly releases any demand & or claim to which he is entitled, shall be punished with imprisonment of either description for a term which may extend to 2 (two) years, or with fine, or with both.” This aforementioned section will also apply to data theft. The maximum punishment under section 424 is imprisonment of up to 2 (two) years or a fine or both.

Section 425 of the IPC deals with mischief & states that “whoever with intent to cause, or knowing that he is likely to cause, wrongful loss or damage to the public or to any person, causes the destruction of any property, or any such change in any property or in the situation thereof as destroys or diminishes its value or utility, or affects it injuriously, commits mischief”. Needless to say, damaging computer systems & even denying access to a computer system will fall within the aforesaid section 425 of the IPC. The maximum punishment for mischief as per section 426 of the IPC is imprisonment of up to three months or a fine or both.

Receipt of stolen property: Section 66B of the IT Act prescribes punishment for dishonestly receiving any stolen computer resource or communication device. This section requires that the person receiving the stolen property ought to have done so dishonestly or should have reason to believe that it was stolen property. The punishment for this offence under Section 66B of the IT Act is imprisonment of up to 3 (three) years or a fine of up to Rs. 1,00,000 (Rupees one lac) or both. This applies in case Sushant’s devices or gadgets were taken away by Rhea or any other person out of Sushant’s lawful possession.

Section 411 of the IPC too prescribes punishment for dishonestly receiving stolen property & is worded in a manner that is almost identical to section 66B of the IT Act. The punishment under section 411 of the IPC is imprisonment of either description for a term of up to 3 (three) years, or with fine, or with both. Please note that the only difference in the prescribed punishments is that under the IPC, there is no maximum cap on the fine.

Identity theft & cheating by personation: Section 66C of the IT Act prescribes punishment for identity theft & provides that anyone who fraudulently or dishonestly makes use of the electronic signature, password or any other unique identification feature of any other person shall be punished with imprisonment of either description for a term which may extend to 3 (three) years & shall also be liable to fine which may extend to Rs. 1,00,000 (Rupees one lac).

Section 66D of the IT Act prescribes punishment for ‘cheating by personation by using computer resource & provides that any person who by means of any communication device or computer resource cheats by personation, shall be punished with imprisonment of either description for a term which may extend to 3 (three) years & shall also be liable to fine which may extend to Rs. 1,00,000 (Rupees one lac).

Section 419 of the Indian Penal Code, 1860 also prescribes punishment for ‘Cheating by Personation’ & provides that any person who cheats by personation shall be punished with imprisonment of either description for a term which may extend to 3 (three) years or with a fine or with both. A person is said to be guilty of ‘cheating by personation’ if such person cheats by pretending to be some other person, or by knowingly substituting one person for another, or representing that he or any other person is a person other than he or such other person really is.

The provisions of sections 463, 465 & 468 of the Indian Penal Code, 1860 dealing with forgery & “forgery for the purpose of cheating”, may also be applicable in a case of identity theft. Section 468 of the Indian Penal Code, 1860 prescribes punishment for forgery for the purpose of cheating & provides a punishment of imprisonment of either description for a term which may extend to 7 (seven) years & also a fine. Forgery has been defined in section 463 of the Indian Penal Code, 1860 to mean the making of a false document or part thereof with the intent to cause damage or injury, to the public or to any person, or to support any claim or title, or to cause any person to part with property, or to enter into any express or implied contract, or with intent to commit fraud or that fraud may be committed.

In this background, reference may also be made to section 420 of the Indian Penal Code, 1860 that provides that any person who cheats & thereby dishonestly induces the person deceived to deliver any property to any person, or to make, alter or destroy the whole or any part of a valuable security, or anything which is signed or sealed, & which is capable of being converted into a valuable security shall be punished with imprisonment of either description for a term which may extend to 7 (seven) years, & shall also be liable to fine.

The only difference between the punishments prescribed under sections 66C & 66D of the Information Technology Act, 2008 (as amended) & section 419 of the Indian Penal Code, 1860 is that there is no maximum cap on the fine prescribed under the Indian Penal Code, 1860. However, the punishment under section 468 Indian Penal Code, 1860 is much higher in that the imprisonment may extend to 7 (seven) years. Further, whereas the Information Technology Act, 2000 (as amended) contemplates both the imposition of a fine & imprisonment, the IPC uses the word ‘or’ indicating that the offence could be punished with imprisonment or by imposing a fine. Most importantly, the fundamental distinction between the Indian Penal Code, 1860 & the Information Technology Act, 2000 (as amended) in relation to the offence of identity theft is that the latter requires the offence to be committed with the help of a computer resource.

Happy Reading!!!

Will be back with more..!!

Thank you 🙂