The bazee.com case is a crucial one that will dictate the course of cyber crime investigation in the future.
THE Avnish Bajaj episode hogged media attention until about 10 days ago, when the bazee.com chief executive officer (CEO) was released by the Delhi High Court after a lower court had sent him to Tihar Jail for carrying an objectionable video clip on his web site. Bajaj cooled his heels for four days in Tihar, and his arrest led to vociferous protests from industry, with NASSCOM, which articulates the Information Technology (IT) industry's problems, taking the lead.
There are at least three known actors involved here. The first is the 17-year-old Delhi schoolboy who, sometime in July 2004, captured his own indiscretion with a female classmate on his mobile phone camera. He then transmitted the images to two friends on their mobile phones, from whom a three-minute clip got circulated among 50 students.
The next significant player is an Indian Institute of Technology (IIT) Kharagpur student Ravi Raj, who picked up the video clip from the IIT's Local Area Network and then posted it on bazee.com, said to be India's largest Internet auction site. He did this with the help of an electronics firm in Kharagpur. Eight people are reported to have bought the CD from the site. There is also a report that the CD was available in the Delhi market for at least a few days.
The third player is Avnish Bajaj, who was arrested on December 17 under the Information Technology Act case that had been registered by the Delhi Police. Ravi Raj was arrested a few days earlier, on the charge of circulating pornographic material for monetary gain. The schoolboy was granted bail by the Juvenile Justice Board on December 22, after he was taken into police charge and detained at an Observation Home for two days.
According to a statement issued by bazee.com, Bajaj had flown in from Mumbai to assist the Delhi Police in their investigation and that the offending item was, in fact, removed from the site as soon as it was brought to the former's notice. The police, however, claim that the web site sprung into action only after the registration of the case. One version is that there was a 38-hour delay between the police direction and action by bazee.com to delete the offensive material peddled by it, with or without the knowledge that it carried pornography.
THE law on the subject is very clear. The sections slapped on the three players are Section 292 (sale, distribution, public exhibition, etc., of an obscene object) and Section 294 (obscene acts, songs, etc., in a public place) of the Indian Penal Code (IPC), and Section 67 (publishing information which is obscene in electronic form) of the Information Technology Act 2000. In addition, the schoolboy faces a charge under Section 201 of the IPC (destruction of evidence), for there is apprehension that he had destroyed the mobile phone that he used in the episode. These offences invite a stiff penalty, namely, imprisonment ranging from two to five years, in the case of a first time conviction, and/or fines.
From the facts known till now, the stoutest of defence may not be on whether any obscenity was committed and whether the public had access to the obscene material produced and circulated. These two facts seem to be beyond doubt. At present, it looks as if the act indulged in by the boy and the girl was in private and not in the presence of anyone else to whom annoyance was caused. If this is true, the girl and the boy get away from the ambit of Section 294 of the IPC. But the ingredients of Section 292 are attracted by the acts attributed to all three, that is, the schoolboy, the IIT student and the web site.
The Delhi Police investigation will necessarily focus first on establishing the identity of the boy and the girl appearing on the CD, and incidentally find out whether the girl's participation was voluntary or whether she was forced into it. The case against the IIT student will depend on the kind of evidence collected about how he came by the images and the motive (monetary gain or other) that induced him to post them on the web site. Just now, Bajaj's liability has been described as being vicarious. We do not yet have facts on whether he had knowledge of the posting of the objectionable material on his web site before the police told him about it. If he did, the offences with which he is charged become graver.
In the absence of any formal press statement by the Delhi Police, until the time of writing this column, all these are in the realm of speculation, and it would be unfair to both the prosecution and the defence to make any strong assertions. The present Commissioner of Police has a reputation for professionalism and objectivity, and despite the public controversy raised in the case I am sure the quality of investigation will be high. Let us therefore wait till the investigation is completed and the investigator takes a final decision on the manner in which to press the charges. A trial by the media will necessarily have to be guarded against.
NEVERTHELESS, there are a few points for debate even at this stage. The arrest of the CEO has been questioned by several people who feel that it could have been avoided without prejudice to the investigation. The police's point of view is not known. All the offences cited by the police under the IPC and the IT Act are cognisable (that is, the police can arrest without a warrant from a judicial authority) and non-bailable (that is, the police cannot themselves normally release an arrested person). So, the Delhi Police may not be faulted on grounds of law. Whether the arrest was justified on facts is a subjective estimation and will depend on the circumstances of the case. The Delhi Police, in the interests of transparency and to promote their own image as a professional body, owe it to the public, at the earliest, to defend their decision, which has caused dismay to the private sector in general and the IT industry in particular. It will be too narrow a focus for either the police or the judiciary to take the stand that criminal justice decisions cannot be swayed by considerations of an impact on the economy or industry or relations with other countries. Arbitrary and unexplained actions by public officials do adversely affect a country's image in these days of globalisation of trade and commerce, particularly when the action is against a foreign national, belonging to a country which outsources a phenomenal volume of work to India in the IT sector. Additionally, issues of human right are involved here.
Naturally, people in public life of the country are greatly exercised over Bajaj's arrest. A lot has been said about how a `service provider' is different from a `content provider' in terms of criminal liability. The argument is that Bajaj was just a service provider, who had no control over what was passing through his web site. The logic here is no doubt unquestionable. What comes to the defence of the Delhi Police is Chapter XII of the IT Act, which specifies the liability of network service providers. Section 79 of the IT Act begins with the caption "Network service providers not to be liable in certain cases".
The section is categorical, that ordinarily the burden of proving that the offence under the IT Act or any contravention of the Act was committed without the knowledge of the service provider, or that he had exercised all due diligence for preventing it, would lie on the latter. This may be considered too stringent, as it runs counter to our jurisprudence that swears by the duty of the prosecution to prove the offence and the mens rea (guilty state of mind). The inherent difficulty of the investigating agency and the prosecution to unearth facts, which would normally be within the sole knowledge of the actors concerned in an IT transaction, had possibly persuaded the lawmakers to ignore the fundamentals of normal criminal law.
This discussion does not, however, settle the question of limits to vicarious liability. This is a grey area, especially in the realm of criminal law and allied law, such as that relating to IT. The arrest of Bajaj would be wholly justified if it is difficult to identify those employees of the web site who are responsible for the day-to-day running of the web site and those who interact with customers such as Ravi Raj. Also relevant is whether any safeguard had been put in place by the web site to protect themselves against offer and acceptance of illegal material. This is a policy matter rightly at the doors of the CEO. If he had been negligent in not having applied his mind to this issue and had not put in place a sound procedure for his employees to follow, he would again be negligent and have attracted vicarious liability, civil and criminal. I quite concede that these are issues that require time and effort on the part of the police. To give themselves this amount of time and also to meet possible criticism of any hasty action, it was possibly prudent for the Delhi Police to have registered the case against the CEO as they did, but ensured he did not leave the country by impounding his passport, without actually arresting him. Of course, commentators like myself have the benefit of hindsight, which the Delhi Police did not have.
THIS is a crucial case that will dictate the future course of cyber crime investigation in the country. I hope the courts concerned (both the trial and appeal courts) will lay down the rules of the game that are not defined specifically by law. Also, even if finally Bajaj is acquitted, the damage done to his reputation and morale would remain irreparable. The positive outcome could, however, be one of greater care and prudence on the part of service providers. It is still debatable whether, despite good intentions and due diligence, the Delhi episode can be prevented in the future.
What about police and judicial sensitivity to the requirements of the cyber world? Despite all claims, I am not convinced that the average police investigator in our larger cities is knowledgeable in the area. Except for a handful of bright young investigators, the majority are abysmally ignorant of the nuances of cyber law and are also disinterested here for a variety of reasons, the chief of which is the lack of incentives and perquisites, both lawful and not so lawful.
The need to keep abreast of technological developments and understand their implications through study and debate with those in industry involves a lot of labour, which appears wasteful to many in the police. The judiciary is no less apathetic. We require extraordinary and innovative members of the Bench in several High Courts to give a thrust to this. `Back to school' should be the slogan, at least for those in the subordinate courts, if they are not to be led by the nose by overzealous and, sometimes, unscrupulous investigators. The danger is too real to be ignored.
The reckless adventure by the two students is a warning to parents, for a greater watch over and guidance to their children. One practical tip is to keep the computer system in an area of the home that is accessible to everyone in the house and facilitates unobtrusive and informal inspection. Browsing outside, in a cyber cafe, is still possible, but could always be curtailed through restrictions on time spent away from home.