Category: GUEST POST

In the 21^st century, advertising forms a key method of marketing for commodities. With the advent of technology, it has expanded to the online world. Advertisements are regularly seen on any website for various goods and services. Clicking on the advertisement link leads to direction to the page of the company showing the ad. However, advancements in technology have also led to advancements in cybercrime utilizing advertisements. One such crime is “Malvertising”.

Malvertising, also known as malicious advertising, refers to advertisements, which are criminally controlled, and harm people and organizations via malwares, scams, unwanted programs and unlawful activities on the internet. It does not involve creating specific advertisements, but involves perpetrators adding malicious codes onto legitimate everyday advertisement networks. The malicious codes often redirect unsuspecting individuals to other malicious websites. Types of crimes committed via malvertising include identity theft, theft of personal information, financial theft, illegal encryption, spying on activities done by the victim and many others.

Those who profit from malvertising rely on two main methods to infect a system. The first one is where malicious code inserted into an advertisement which induces people to click on the ad. This may be in the form of alerts stating that there is malware in the system, or offering to try a free program. Clicking the ad link causes redirection or malware to be downloaded into the system. The second method is known as “drive by download”. Here, an infected ad uses background web pages to perform illegal activities. Any web page that hosts the infected ad serves as a background web page. Loading such web pages results in redirection to other pages, which access the system of the victim.

Prevention and mitigation of the risk of malvertising can be done by both individuals and organizations. Individuals can take measures such as installing antivirus software (which can offer some protection against certain drive by downloads), enabling ad blockers on browses, and frequently updating their browsers and plugins when the option to update comes up. Organizations can take measures such as scanning their advertisements so as to discover any malware or unwanted codes, or enforcing policies to show only certain file types in the advertisement.

It is in this author’s view that malvertising is an issue that needs to be combatted both at the individual level as well as the organization level. As stated before, preventive strategies can be undertaken by both individuals and organizations, as they can both be targets of malvertising. Taking preventive actions against the threat of malvertising not only protects the user from malvertising in itself, but also protects the user against other cybercrimes that can occur as a result of malvertising.

JEI SHRINIVAS SRIDHAR

1st YEAR STUDENT

SYMBIOSIS LAW SCHOOL, HYDERABAD

Citations:

https://www.imperva.com/learn/application-security/malvertising/

https://www.malwarebytes.com/malvertising/

The 21^st century is often referred to as the century of technology, with new types being created or modified everyday. One of such technologies that is constantly evolving is the internet and the online world. The evolution of the internet and the cyber world gives new interpretations to how business is conducted, how people are able to communicate and share information instantly via the internet.

The adaptation and evolution of the law with respect to the internet, giving rise to the domain of cyber law is important due to the fact that browsing, communicating and conducting transactions online is not limited to one’s own national territory.  An individual in the US can easily share, or communicate, or conduct transactions with another in the UK, as an example.  Cyber law focuses on aspects such as regulating behavior on the internet, regulating the sharing and communication of information, as well as regulating how transactions are conducted on the internet. Through these regulations, cyber law gives birth to new rights, arising out of new interpretations. One of these rights is the Right to Forget.

Right To Forget

The right to forget is a concept that has developed in the recent years. It focuses on the idea that individuals have the right to request that personal information about them on the internet is to be removed. This concept is also known as the right to Erasure in the European Union.

The origin of the concept of Right to Forget comes in 2014 when a Spanish man asked Google to remove links to a newspaper article highlighting his name. The individual put forward that in the present day, the article in question had no reason to be accessible via internet. The European court of Justice (ECJ) ruled that under EU law, online search engines were data controllers and as such had the responsibility to take into account all requests and complaints to remove outdated or irrelevant information.

The right to forget is formally addressed in article 17 of the European Unions General Data Protection Regulation (GDPR). The article states that all individuals have the right to request search engines for removal of personal data from the internet without any delay.

The EU law on right to forget is seen as controversial in countries like the US due to the fact that it contradicts the principles of free flow of information as well as the open nature of the web. Currently the laws on Right to Forget are only being enforced in the EU. 

Right To Forget In India

As of today, there is no formal law that addresses Right to Forget in India. However, there have been reports published on the same as well as bills drafted for the same. A report put forward by the BN Shrikrishna committee first addressed the concept of Right to Forget in the country, stating that obtaining the consent of individuals to process and display data is required as a part of Right to Forget. The consent must be such that it is easy to withdraw as well as put forward. The committee also stated that the consent of a person be “specific”, “informed” and “clear”.

The aspect of right to forget in India is addressed in the Personal Data Protection Bill 2018. It must be noted that the Personal Data Protection Bill 2018 has not been presented in the Parliament, and as such has not been passed into law as of yet.

This bill has also been proposed by the BN Shrikrishna committee. Section 27 of the aforementioned act gives 3 reasons under which Right to forget can be enacted. They are

• When the content in question has served the purpose for which it is made
•  Whether content was made on basis of consent which has been withdrawn
• Content was made contrary to provisions of the act or other laws passed by the central or state governments of India

Section 27 also stipulates that an adjudicating officer would be responsible for deciding if any published article needs to be removed from the internet, on request of a citizen.  Furthermore, it states there are five factors that have to be determined for the same. They are:

• Sensitivity of data
• Disclosure of data and accessibility
• Role of the data for the public
• Relevance of data to the public
• Nature of the disclosure of data.

It is in this individuals’ view that the Right to Forget is a benchmark interpretation in the field of cyber law. It grants individuals the freedom to decide when something has outlived its usefulness or purpose on the web. It serves as a means for individuals to exercise their right to freedom of speech and expression, as well as protect their person and reputation online.

JEI SHRINIVAS SRIDHAR

1st YEAR STUDENT

SYMBIOSIS LAW SCHOOL, HYDERABAD

Citations

https://indianexpress.com/article/opinion/columns/personal-data-protection-bill-2018-justice-bn-srikrishna-committee-5355284/

https://www.livelaw.in/first-indian-court-upholds-right-forgotten-read-order/

https://www.livemint.com/Money/yO3nlG7Xj4vo2VJsmo8blL/What-is-the-right-to-be-forgotten-in-India.html