Chambers Desk
You are counsel receiving a live cyber incident. Your task is not to identify the largest possible list of sections. Your task is to determine what happened, what must happen next, what evidence exists, what can actually be proved, and where the opposing case is vulnerable.
1. Triage
Loss, systems, accounts, continuing compromise, reporting clocks and immediate preservation.
2. Investigate
Separate victim narrative, system events, device evidence, payment trail and provider records.
3. Prove
Provenance, completeness, §63 route, attribution, expert evidence and corroboration.
4. Challenge
Account ≠ actor. Device ≠ user. IP ≠ identity. Transaction record ≠ proof of deception.
Your progress
0 of 15 chambers tasks completed.
Matter Board
Choose a file. Full matters open a complete fact/evidence/decision sequence. Preview matters open a structured chambers brief without pretending the full record has been built.
CYB-001 · Account-Takeover / UPI Fraud
SIM replacement, new-device registration, disputed UPI transfers, beneficiary accounts and contested attribution.
Open matter →CYB-002 · Business Email Compromise
Mailbox compromise, forwarding rules, altered invoice, diverted corporate payment and uncertain actor identity.
Open matter →CYB-003 · Ransomware
Encryption, claimed exfiltration, containment, evidence preservation, CERT-In timing and DPDP readiness.
Open matter →CYB-004 · Cloud Intrusion
Compromised admin account, token use, bulk download and uncertain human attribution.
Open preview →CYB-005 · Messaging Impersonation
Executive impersonation, urgent payment instruction, spoofed identity and device/account evidence.
Open preview →CYB-006 · Contested Attribution
Shared device, VPN exit IP, credential reuse and a prosecution theory that moves faster than the evidence.
Open preview →CYB-001 · The 43-Minute Window
Role: You act for the complainant initially. You will later switch sides.
Matter Core · Evidence Locker
CYB-001-A01Useful for notice and chronology. Not the strongest source for the underlying payment-system event.
CYB-001-A02Shows debits and transaction references. Does not by itself establish who initiated them.
CYB-001-A03Potentially important to takeover theory. Requires provenance and identity/process analysis.
CYB-001-A04Potentially shows technical account events. Account/device event is not automatically a human identity finding.
CYB-001-A05Important for reporting chronology and follow-up. It does not prove the substantive offence.
CYB-001-A06May support tracing. Receipt of funds must still be distinguished from knowledge, participation and ultimate control.
Decision 1 · Your first instruction?
CYB-002 · The Altered Invoice
Role: You act as incident counsel to an Indian engineering company after a supplier payment is diverted. Your first job is to preserve the record before deciding whether this was spoofing, mailbox compromise, insider conduct, or a combination.
Matter Core · Evidence Locker
CYB-002-A01Preserve the native message source, headers, timestamps, message IDs and attachments rather than relying only on screenshots or forwarded copies.
CYB-002-A02May show account events, IP/network fields, client/app context and timestamps. They still require provenance and attribution analysis.
CYB-002-A03Potentially explains concealment or interception. Determine when the rule appeared, how it was created and what logs survive.
CYB-002-A04Compare file content, metadata, hashes and delivery path. Visual similarity is not proof of common authorship.
CYB-002-A05Establishes the payment path. Beneficiary KYC/receipt must not be collapsed into proof of the antecedent deception.
CYB-002-A06Browser sessions, MFA events, token/session data and endpoint artefacts may corroborate or contradict the mailbox theory.
CYB-002-A07Record who knew of the bank change, normal verification practice, account access, shared credentials and the point at which the incident was discovered.
Decision 4 · What should happen first?
Attribution Board
Look for session/audit evidence, rule creation, token/MFA events, endpoint evidence and timing consistent with hostile control.
Test domains, envelope/header path, reply behavior and whether the message actually originated from the genuine service/account.
Do not infer it merely from knowledge of invoice details. Identify access, motive, communications and actions that connect a human actor.
An account can be authentically accessed while the operator remains unidentified. Build the bridge rather than assuming it.
Decision 5 · The SaaS log shows a successful login from an unfamiliar IP. What is the safe proposition?
CYB-003 · The Six-Hour Ransomware Window
Role: You advise an Indian company during an active ransomware incident. Technical containment, legal reporting and evidence preservation are running in parallel; none should silently destroy the others.
First-hour evidence plan
Contain without erasing
Isolation may be necessary, but document what was disconnected, by whom, when, and what volatile/native evidence may be lost by shutdown or reimaging.
Preserve control-plane records
Collect identity, EDR, firewall, VPN, cloud, DNS, authentication and relevant application logs with native timestamps/timezone context.
Separate encryption from exfiltration
Encryption is observed. Exfiltration is presently a claim plus circumstantial network evidence. Treat them as different propositions until the record supports the second.
Build a decision log
Record notice time, reporter, containment decisions, preservation choices, reporting actions, business impact and the evidence supporting each conclusion.
Decision 6 · What is the reporting approach?
What does the record prove?
| Item | Safe proposition | Do not silently infer |
|---|---|---|
| Encrypted files | Systems/files were altered into an encrypted/unusable state during the incident window. | Who did it, initial access vector, or whether data was stolen. |
| Ransom note | An artefact containing a threat/claim was placed on affected systems. | That the claimed 450 GB was actually exfiltrated. |
| Outbound traffic spike | A system generated/received an unusual volume of network traffic in the period recorded. | That the bytes were personal data, the complete dataset, or were received by the attacker claimed in the note. |
| Privileged credential event | The credential/account was used in recorded system activity. | The identity of the human operator or whether the credential owner participated. |
Decision 7 · The ransom note claims exfiltration. What do you tell management?
CYB-004 · Cloud Intrusion
Proposed record
Admin sign-ins, token/session use, bulk object access, cloud audit exports, identity-provider logs and endpoint evidence.
Core question
Does a valid token prove the authorised employee acted, or only that the system accepted a credential/session?
Full build target
Cloud provenance, provider retention, cross-border evidence, production requests, BSA route and competing attribution hypotheses.
CYB-005 · Messaging Impersonation
Proposed record
Message export, profile/account identifiers, phone/SIM records, payment instructions, device artefacts and witness verification practice.
Core question
What proves personation, and what proves that the accused—not merely an account or number—made the representation?
Full build target
Platform records, message completeness, §90 limits, personation ingredients, money trail and defence attack on authorship.
CYB-006 · Contested Attribution
Proposed record
Shared laptop, VPN exit IP, reused credentials, router/DHCP evidence, endpoint timeline and inconsistent witness accounts.
Core question
How many inferential steps separate a network/account observation from a finding about the human actor?
Full build target
Prosecution and defence theory boards, alternative hypotheses, expert cross-examination and appellate record preservation.
Offence Mapping Workbench
Do not charge by keyword. Test each statutory ingredient against evidence.
| Provision | Why it may matter | What still needs proof |
|---|---|---|
| IT Act §43 / §66 | Unauthorised computer-resource conduct may engage §43; dishonest or fraudulent commission of a §43 act is the criminal route under §66. | The actual act, lack/excess of authority, relevant mental element, and linkage to the accused. |
| IT Act §66C | Potential identity-theft route where another person's password or other unique identification feature is fraudulently or dishonestly used. | Use of the protected feature and attribution to the accused. |
| IT Act §66D | Potential route where cheating by personation occurs through a communication device or computer resource. | Personation, cheating, use of the relevant technology and accused linkage. |
| BNS §318 | General cheating analysis, including dishonest inducement to deliver property. | Deception, inducement, mental element, delivery/harm and attribution. |
| BNS §319 | General cheating-by-personation provision. | The representation/personation and the accused's participation. |
Decision 2 · What does A04 prove?
Digital Investigation Chambers
BNSS §94
Production can extend to documents, electronic communications and communication devices likely to contain digital evidence. Ask: who has possession or power, and exactly what should be sought?
BNSS §105
The specified search/seizure process must be recorded through audio-video electronic means, preferably mobile phone, with the statutory forwarding requirement.
BNSS §106
Police power to seize property suspected stolen or found in circumstances creating suspicion of an offence. Do not collapse seizure into final confiscation.
BNSS §107
Separate proceeds-of-crime attachment/restoration procedure involving approval and the Court/Magistrate. Keep this analytically distinct from §106.
BNSS §185
Search by an investigating police officer requires the statutory grounds and record; the search is to be audio-video recorded as specified.
Preservation request builder
Do not ask a provider to certify a fact its system does not record. Do not describe a dynamic IP address as a person. Do not describe KYC identity as proof of the human actor at a later transaction.
Electronic Evidence Bridge
BSA §§61–63
Electronic/digital records are not excluded merely because of their form. The §63 route and certificate requirements must be analysed for the computer output being tendered.
BSA §90
The electronic-message presumption is limited. It does not permit the Court to presume the identity of the person who sent the message.
Attribution
Ask separately: whose account, whose device, whose credential, whose network connection, whose conduct, whose knowledge?
Decision 3 · Prosecution says “the accused’s KYC account received the money, therefore the accused committed the phishing.”
Incident & Regulatory Response
Individual financial-fraud response
Prompt bank notification and prompt reporting through the Government financial-cyber-fraud mechanism are time-sensitive practical steps. Preserve the acknowledgement, transaction identifiers and supporting evidence.
1930 NCRP BANK FRAUD CHANNEL
RBI customer-liability analysis
Do not promise reimbursement. Identify the regulated entity, the applicable RBI framework, whether the transaction was unauthorised, the cause category, when the customer received transaction communication, when the customer reported it, and the bank's applicable policy.
CERT-In gate
For a covered organisation, test whether the incident falls within the CERT-In reporting directions and the applicable six-hour reporting clock. Do not mechanically apply an organisational CERT-In duty to every individual fraud victim.
DPDP commencement gate
As of 5 October 2026: the principal substantive DPDP processing/security/breach regime scheduled for the eighteen-month phase is not yet operative. Treat it as readiness analysis for incidents occurring before commencement, not as a present breach-notification duty.
Re-check before relying on this statement after 13 May 2027 or after any intervening notification/amendment.
From Incident Record to Legal Work Product
This desk trains the transition from facts and artefacts to a defensible next step. It does not manufacture certainty: every draft must preserve the difference between what the record shows, what is inferred, and what remains unproved.
Complaint / FIR Issue-Spotter
Convert a narrative into chronology, loss/impact, evidence held, evidence missing, competing hypotheses and offence ingredients—without asserting an identity the record has not proved.
Preservation Request
Build a precise, non-compulsory preservation request: systems, custodians, time window, timezone, native format, metadata and routine-deletion risk.
BNSS §94 Production Plan
Plan what a competent authority may need to seek from a person in possession or power of documents, electronic communications, communication devices likely to contain digital evidence, or other things.
Search / Seizure Review
Pressure-test the record against BNSS §§105, 106, 107 and 185: recording, seizure reporting, proceeds-of-crime attachment and recorded search grounds.
Case Theory Ladder
Interactive Drafting Desk
Everything runs locally in the browser. Free-text entered here is not persisted by this page. Do not paste confidential client material into a training environment unless your organisation permits it.
Choose a matter and workpad, then generate. The output will separate facts, inferences, authority limits and evidence gaps.
BSA handoff
Before a computer output becomes trial proof, plan the BSA §§61–63 route. Section 63(4)(c) uses the statutory Schedule certificate; the Schedule separates Part A (Party) and Part B (Expert) and includes source/device/hash particulars.
Attribution handoff
Build corroboration before converting a system event into a human allegation: device possession, credential access, telecom/provider records, endpoint artefacts, money movement, witness evidence and alternative explanations.
Regulatory handoff
For organisational incidents, keep CERT-In reporting analysis separate from criminal proof. For DPDP, apply the commencement clock before teaching a future obligation as a present duty.
Learning Counsel · Senior Cybercrime Counsel
The learning counsel now follows you throughout the workbench as a floating chambers dock. It is section- and matter-aware: when you enter CYB-002, CYB-003 or the Investigation & Drafting Chambers, its prompts switch to the evidence, attribution and work-product problem in that context. It can explain the current section, question your reasoning, expose weaknesses, argue as opposing counsel, or pressure-test you from the Bench.
Verified Source Layer
The core statutory and regulatory propositions used in this workbench were checked against primary/official materials current to the legal-source review date. Fictional matter facts are training scenarios, not assertions about a real incident. Drafting tools are educational workpads and do not purport to exercise statutory powers.
| Tier | Authority | Use in this chamber |
|---|---|---|
| PRIMARY LAW | Information Technology Act, 2000 — India Code consolidated text | §§43, 66, 66C, 66D, 67C, 70B, 75, 77B, 78; §66A guardrail. |
| PRIMARY LAW | Bharatiya Nyaya Sanhita, 2023 | §§318–319 cheating/personation analysis. |
| PRIMARY LAW | Bharatiya Nagarik Suraksha Sanhita, 2023 | §§94, 105–107, 185 production/search/seizure/attachment architecture and drafting guardrails. |
| PRIMARY LAW | Bharatiya Sakshya Adhiniyam, 2023 | §§61–63, statutory §63 Schedule certificate, and §90 electronic-message presumption. |
| OFFICIAL DIRECTION | CERT-In Directions dated 28 April 2022 + official FAQ | Covered-entity incident reporting and six-hour clock. |
| OFFICIAL GOVERNMENT | National Cyber Crime Reporting Portal / I4C | 1930, financial-fraud reporting and complaint evidence. |
| REGULATORY | Reserve Bank of India customer-protection directions | Unauthorised electronic-banking transaction liability analysis. |
| OFFICIAL INDUSTRY SYSTEM | NPCI UPI guidance | UPI mechanics and bank-facing fraud complaint route. |
| PRIMARY LAW / NOTIFICATION | DPDP Act 2023 + 2025 commencement notification and Rules | Commencement gate; future-readiness bridge. |