An overview of the digital forensic investigation infrastructure of India

Abstract

The Mumbai terror attacks of 2008 demonstrated that India needs to become more prepared to respond to digital intelligence and also to more effectively conduct post-incident investigations. This paper explores the digital forensic investigation infrastructure of India and in particular explores the judicial statutes, police/law enforcement structures and academic structures. The paper concludes to find that whilst there is a state of advancement and progression in terms of establishing guidelines for digital forensic investigation, these guidelines do not seem to carry the same status as the NIST or ACPO guidelines in the UK and US respectively, there is scope for further international collaboration on the investigation of borderless cyber crimes, there are opportunities for private firms to provide independent investigative and training services to the law enforcement agencies. Furthermore, there is an opportunity for academia in the US/UK to develop collaborative links with HE (Higher Education) institutes in India to develop and strengthen the digital forensic investigation discipline.

Introduction

Digital Forensic Investigation has become a recognised professional and academic discipline in a number of developed countries such as the United Kingdom and the USA, wherein there are a number of HE (Higher Education) courses available at both Undergraduate and Postgraduate level, there exist also a steadily increasing number of professional employment opportunities in this area. At the point of writing, more than 60 Universities in the UK offer an Undergraduate digital forensic investigation degree course (UCAS, 2011) and more than 15 offer a taught Postgraduate degree relating to this subject (Find a masters, 2010, UK Pass, 2010).

Further to this, there exists in the UK and US a reasonably well defined and accepted professional infrastructure that supports the investigation of cyber crime within the national police/secret forces and also the private sector. There is also clear and specific legislation that deals with computer misuse and there exist nationally accepted professional guidelines governing the manner in which digital evidence is processed and presented. The combination of government legislation, appropriate investigative guidelines and investigative structures, and higher education degree courses and professional training opportunities are referred to in this study as the digital forensic investigative infrastructure.

The Mumbai terror attacks of 2008 demonstrated that India and other emerging markets are in their infancy in terms of developing such digital forensic investigative infrastructures. Following the attack, a number of questions were raised regarding India’s preparedness and ability to respond efficiently and effectively to such attacks (Chandran, 2008) furthermore it was suggested that the Mumbai police may have ignored important digital intelligence from the US which warned of a potential attack (Robertson, 2008).

The subsequent investigation highlighted the role of digital devices in the planning and perpetration of the attacks and pointed to particular digital evidence that proved to be important in a dossier produced by the Indian Government relating to the attacks which involved the investigation of a satellite phone, Direct Inward Dialing [DID] facilities and GPS equipment and also the tracing of emails/IP addresses (Federation of American Scientists, 2008).

Whilst this particular incident raised heightened awareness of the use of digital devices in the planning of such attacks in India, a number of incidents had previously raised concern (Acharya, 2008). Indian Internet sites (including government web pages and the web site of an atomic research facility) had been attacked by Pakistani hacker groups for many years (Keegan, 2002). During the Mumbai train bombings of 2006, terrorists used advanced techniques including IP address masking and proxy services to conceal their communications and activities. India is emerging as a highly competent outsourcing destination with an economy that is predicted to overtake China and an outsourced software industry estimated to be worth $12 billion. India’s digital forensics investigative infrastructure is in its infancy and the issues described herein have raised heightened concern about the need for more cyber forensics and cyber security professionals to preserve India’s national critical IT infrastructure against operational sabotage and reputational damage.

This study explores the digital forensic investigative infrastructure in India and in particular investigates the judicial, law enforcement and academic structures. The study will be of value to both academia and industry, the former in light of fast developing changes to the HE sector which are encouraging UK academia to build and strengthen research and collaborative links with overseas markets such as India, and the latter because of the opportunities to develop stronger partnerships in the fight against borderless cyber crime.

There is little or no academic research available that has previously analysed and investigated these digital forensic investigative infrastructures. In this research we have analysed government/professional web sites and appropriate associated documentation in order to understand the current provision. There is no central authority in India governing the academic provision of the HE sector, course details are therefore only available through personal enquiry or internet research.

We begin in Section 2 by outlining the fundamental legislative acts that govern the prosecution of cyber crime. The investigative guidelines – often pertinent to the successful prosecution under such legislation are explored in Section 3. In Section 4 we proceed to explore the law enforcement structure and in Section 5 we conclude by outlining the opportunities for study and research at both undergraduate and postgraduate level and also the opportunities available for independent and professional training.