The widespread use of the Internet has given rise to new opportunities for criminals to commit crimes. As a result, cyber kidnapping has emerged as a crime that challenges our traditional understanding of kidnapping. A Chinese student goes missing in December 2023, only to be found later in a tent. The authorities confirmed that it was an apparent case of cyber kidnapping. This is not just one of the isolated incidents. Australia, Japan, Canada, and the United Kingdom have reported similar incidents of cyber kidnapping. You will see many such cases in India if you read the news regularly. The perpetrators pretend to be government or police officials and ask the victims to turn on their cameras and remain seated without any movements. We have received cases on our helpline where victims have paid crores to escape them. In this context, law enforcement agencies find it challenging to deal with such crimes as they involve a complex mixture of criminology, psychology, and technology.

Traditional v. Cyber Kidnapping

The conventional form of kidnapping involves a person or a group of people using force to abduct a person illegally. However, using force is not necessary. Sometimes, the perpetrators can lure a victim. The reasons for this may include extorting money, forcing the victim to do an illegal act, blackmailing, etc. The reasons for kidnapping have remained the same, although the advancements in technology have aided the perpetrators.

We can understand cyber kidnapping as a crime where perpetrators use digital means and attempt to take control of information or computers and restrict their movement with the intent of extortion or for any other unlawful motive. Imagine a child named Lily who meets someone online. This friend gains access to Lily’s personal information and threatens to expose it if she leaves her location. Lily feels trapped and starts giving in to the perpetrator’s demands. The perpetrator’s control over her life makes her a victim of cyber kidnapping.

Technological advancements have given new means for hackers to exploit individuals to access their information or computers. The increase in the number of data breaches around the globe is apparent, resulting in hackers exploiting private data to target vulnerable sections of society. The perpetrators can use various techniques, but the most common are discussed below.

Techniques

• Social Engineering: It is a manipulation technique in which a perpetrator relies on the victim’s error to access private information. It can be either passive or active. In the passive mode, the perpetrator does not establish contact with the victim. However, in the active mode, the perpetrator establishes contact and tries to win their trust. Phishing is an infamous example of social engineering.
• Malware: Malware, or malicious software, is primarily designed to disrupt the normal operations of a computing device. Sometimes, it encrypts data and holds the entire system hostage or grants hackers remote access. Hackers can access a victim’s personal data and keep it hostage to force them into unlawful activities or extort money.
• Voice Cloning Scams: AI-powered tools have allowed perpetrators to clone the voices of other individuals. They use this to lure victims through digital means, mostly calls. We have seen a lot of cases where people have received calls from perpetrators pretending to be police officers. On these calls, the perpetrators inform that they are calling from a specific police station and they have arrested the call receiver’s son or daughter in a rape case.
• Deep Fakes: If voice cloning was not enough, AI has allowed the perpetrators to create deep fake images and videos. It is challenging for an average internet user to identify whether a piece of content is genuine.

Cyber kidnapping not only involves the use of technology but also exploits trust and vulnerabilities by manipulating emotional triggers like fear and anxiety. This aids the perpetrators in controlling the victims and their families. Generally, perpetrators used to target children or teenagers because of their naïve behaviour. However, this pattern is slowly changing over time.

The Law

Section 137 of the Bhartiya Nyaya Sanhita, 2023 (“BNS”) defines kidnapping and prescribes punishment. Section 138 defines abducting as,

Whoever by force compels, or by any deceitful means induces, any person to go from any place, is said to abduct that person.

This definition could also encompass acts of cyber kidnapping. While BNS does not provide an explicit definition of cyber kidnapping, we can interpret its sections to establish a case of cyber kidnapping. Similarly, there is no explicit definition of cyber kidnapping in the Information Technology Act, 2000. If an incident involves manipulating data stored in a computer, Section 66 is relevant. Section 72 prescribes penalties for breach of confidentiality and privacy. If the case involves fake accounts, identity theft, or personation, Sections 66C and 66D will apply.

Moreover, the lack of global jurisdiction over cyber crimes has made cyber kidnapping one of the most difficult modern-day crimes to investigate. Perpetrators could execute their attacks outside the jurisdiction of the victim’s country. When reported to law enforcement agencies, such crimes would go unexplored and may result in unwarranted delays. The victim may find themselves in a situation where seeking justice becomes challenging due to the complexities of the crime. The difficulty in tracing perpetrators potentially leads to a lack of resolution.

Conclusion

The emergence of AI has helped hackers clone voices, make deep fake videos, design phishing websites at scale, etc. Perpetrators have used these technologies to exploit individuals through manipulative and deceitful tactics. This is a legal lacune in India around AI, and criminals use emerging technologies to further their interests.

The rising cases of cyber kidnapping are pertinent issues that require a deep dive into the world of cyber crimes. The stakeholders must implement safeguards before the uncontrolled spread leads to grave consequences. The cross-border nature of cyber kidnapping calls for international cooperation and mechanisms to resolve jurisdictional disputes.