Information Technology Act, 2000 is the main act against cybercrime in India, and Sections 43 and 66 of the act have been amended to include cyber extortion and computer damage, respectively. Also, we see that ransomware attacks usually fall in Sections 43(i), 66, and 66F (which is related to cyber terrorism where critical infrastructure is a target) also we have the Bharatiya Nyaya Sanhita of 2023 which has taken the place of the Indian Penal Code.

Mandatory incident reporting is as per the 2022 directions from Computer Emergency Response Team In's which fall under Section 70B of the IT Act and which require that reports of cyber incidents including ransomware be submitted within in 6 hours of their discovery. Also adding to the layer of compliance is the Digital Personal Data Protection Act of 2023 which has put in place that data fiduciary report to the Data Protection Board and to affected individuals in the case of personal data breach. Also, the Intermediary Guidelines and Digital Media Ethics Code have been recently amended to deal with “synthetically generated info” which sees platforms that enable AI content to put in labelled and due diligence measures. It should be noted, however, that none of these frameworks were developed for generative AI assisted ransomware.

There have been three major shifts in the ransomware economics due to generative AI. The first is that they can produce convincing e-mails, voice clones, and deepfakes video calls that fool the typical employee into believing that it is a real phone call or e-mail, making the initial compromised attack easier to carry out. Second, LLMs can help to write and obscure malicious code, making it easier to attack software, a capability that is sometimes referred to as the 'democratisation of cybercrime'. Thirdly, AI can help with automated personalised extortion: Attackers can create threats specific to victims, translate ransom notes and conduct negotiations on a massive scale whilst not having to scale up human resources.

The consequence is a change in the economic performance of the unit. This will enable smaller teams to carry out an attack which would be more technically complex and convincing but less costly as would previously have been accomplished by a more capable team. It is estimated that the losses incurred due to the deepfake fraud in India in the past year is in the tens of thousands of crores.

The problem is which of these is not a crime because of the tool used to make it is not a great legal problem encryption without permission, extortion, data theft are all crime, irrespective of the tool used to do so. What we get instead of the above is the emergence of a series of structural problems as a result of generative AI. For example, it is not easy to determine who is responsible for doing what. We see the use of AI tools across borders and the creation of linguistic patterns, style and behavior that investigators use to determine the hand of the attacker, which makes Section 75 IT act (extraterritorial application) difficult to prove and comply.

Secondly, the intermediary and developer liability remains an issue. However, for a generative AI that is creating ransom notes or assisting with the development of malware what we see in terms of Section 79 of the IT Act is insufficient to address an AI that is taking an active role in creating harmful content which is a very different role to that of a host of third party content. Plus, the scope of due diligence obligations for AI model operators who only have at least part of the answer in the above amendments has yet to be clarified.

Third, our present evidentiary rules under the Bharatiya Sakshya Adhiniyam which include requirements for the certification of electronic evidence are based on a more static picture of what electronic evidence is. In fact, we have learned that AI-generated content or AI that has been “twisted” around some data to create a document that looks remarkably like the original is a different production process that is difficult to fit into existing authentication, forensic analysis, or expert validation processes, which are probably optimised for a more traditional form of digital evidence.

Areas of concerns.

A number of problems remain. The 6-hour reporting requirement for Computer Emergency Response Team In is a helpful guideline for early containment, however, this is not sufficient for incidents when AI accelerates the attack and ransom negotiation phase leaving less time for organizations to be able to detect AI specific indicators. Breach notification framework within the DPDP Act is also focused on personal data, but doesn't do a good job of addressing ransomware attacks on non personal or operational data, which may be outside of the scope of the act altogether.

Likewise, there is no specific statutory time period for cyber crimes that are committed with the help of Artificial Intelligence, which can cause uncertainty in courts and investigators on how to deal with such crimes, when committed with AI assistance. Moreover, there is no specific term for AI-assisted cyber offences that is, offences committed with the help of AI, which can cause interpretative challenges for the courts and investigators in how they interpret and charge-air cyber offences. Finally, in some cybercrime cells and forensic labs, law enforcement is constrained by the capacity limitations. However, in practice, where the law is on the books, there are limits to the ability to detect the deception that can be created by AI or to be able to trace the use of AI in intrusions.

Improving the existing regulatory mechanism.

Multiple strands, rather than one law, would be needed to provide a calibrated response. Regulators could introduce new indicators specific to AI in the reporting mechanism of CERT-In which would enable entities to report on the usage of social engineering by AI and on the use of AI assistance for code this would enhance threat intelligence without altering the reporting period. The above distinction could provide clarity to the size requirements of generative AI hosts that use content created by providers but who are not so clear about their own liability for content. The distinction above could help alleviate doubts regarding liability of intermediary if intermediaries host content generated by an AI provider for use. Enhancing the forensic capabilities such as the development of AI-detection tooling in CERT-In and respective cells in the states would be required to stay abreast with synthetic evidence. If there are no cross-border cooperation mechanisms, the slowdown in investigations attributed to jurisdiction issues would be addressed. A jurisdiction issue is responsible for slowing investigations, particularly for ransomware using AI tools, which would be solved with the lack of cross-border cooperation mechanisms. In the case of a ransomware attack, that could affect both personal data and operational data, fragmentation of compliance framework for organisations could be minimised in case of a breach notification under the DPDP Act.

The development of a more effective legal framework.

Generative AI has not given rise to a new type of crime, but rather given ransomware a new price tag; ransomware is now cheaper to execute, and it is more difficult to connect the dots and locate. Though the currently available statutory structure of India (the IT Act, DPDP Act, CERT-In directions and the Bharatiya Nyaya Sanhita and Bharatiya Sakshya Adhiniyam) offer a pragmatic base, each of these instruments was created prior to the advent of generative AI as an instrument for attackers. While a new legislation may be needed, perhaps a targeted approach focused on specific needs, such as AI-specific reporting, intermediary liability and forensic capacity may be a better approach, which could be the case, if the legislation can be done with the urgency that the evolving economy of cybercrime demands.

Author is a Legal Assistant at Office of Controller General of Patents, Designs & Trade Marks (CGPDTM), Government of India. Views are personal.