Account Takeover, Morphed Images and Pirated Software on Lab Machines
On Monday 12 January a Class XII student at Nalanda Junior College cannot log in to Instagram: the recovery email has been changed, and the account is posting morphed images of her face on other people's bodies with an abusive caption. A classmate had guessed her password from her dog's name plus her birth year, and the same password protected her college email. Screenshots reach a WhatsApp group of 60 students, and three students forward them to a second group. The same week, someone replaces the college website's index page with a defaced one, and the IT teacher installs a cracked copy of a photo editor on ten lab machines. The principal asks the computer teacher two questions: is the college "also in trouble", and should the students delete everything before the police see it?
1. Identify the IT Act, 2000 provisions engaged by the account takeover and the morphed images, and set out what the student should do in the first 48 hours.
Read the worked answer
Account takeover. Section 66C (identity theft - fraudulent use of another person's password or unique identification feature) and Section 66D (cheating by personation using a computer resource) both fit: the attacker used her credentials and then posted as her. Each carries imprisonment up to three years and a fine.
The images. Section 67 (publishing or transmitting obscene material in electronic form) is the safest hook where the material is lascivious; Section 67A applies if it is sexually explicit. Section 66E (violation of privacy) is narrower than most people assume - it targets capturing or publishing images of a private area without consent, which a face-swap may not satisfy, so plead 67/67A rather than 66E alone. Alongside the IT Act, the corresponding provisions of the Bharatiya Nyaya Sanhita, 2023 cover defamation and criminal intimidation.
First 48 hours. Do not delete anything. Screenshot each post with the handle, URL and visible date/time; save the profile page and the recovery-email change notification. Report the impersonation through Instagram's in-app flow with the ID proof it asks for, file a complaint at cybercrime.gov.in and at the local cyber cell, and keep the acknowledgement number. Reset the college email from a different device, and give the principal a written complaint so the college preserves its own logs and CCTV.
2. Is the college liable for the cracked software on ten lab machines? Separate the Copyright Act question from the IT Act question and name the sections wrongly invoked in each direction.
Read the worked answer
It is a copyright problem, not an IT Act problem. Installing unlicensed copies is infringement of the copyright owner's reproduction right; Section 63 of the Copyright Act, 1957 punishes knowingly infringing copyright for gain, and the college - as owner of the machines on which ten copies run - is the party a software vendor's audit would pursue, regardless of which teacher clicked Install. The practical exposure is a licence true-up plus damages, and an internal disciplinary matter for the teacher.
Sections that do not fit. Section 65 of the IT Act covers knowingly concealing, destroying or altering computer source code - it is about tampering with code, not about unlicensed binaries, so citing it here is wrong. Section 43 (unauthorised access, damage, disruption) likewise addresses access and interference, not licensing.
Where the IT Act does bite. If the college holds student personal data, Section 43A imposes a duty of reasonable security practice and exposes a body corporate to compensation for negligence - a reason to keep the lab image patched and licensed, but a separate obligation from piracy.
Defacing the website is the genuine IT Act matter: unauthorised modification of a web resource engages Sections 43 and 66, and Section 65 if source files were altered. Preserve FTP and web-server logs with timestamps before restoring from backup.
3. Advise the three students who forwarded the images and the college on password practice. Explain why "I only forwarded it" does not end the analysis.
Read the worked answer
The forwarders. Section 67 is framed around publishing or transmitting obscene material in electronic form; transmitting is the act, and the offence is complete when the forward is sent. "I only forwarded it" describes the conduct rather than excusing it - the questions that then matter are knowledge and intent (did they know what the file contained?), the age of the students (juveniles are handled under the juvenile justice framework rather than ordinary prosecution), and whether they acted in furtherance of the original poster's act. The college should stop the circulation, record who received it, and refer the matter to the cyber cell rather than conduct its own inquiry into a cognisable offence.
What not to do. The principal's instinct to have everything deleted destroys the evidence - the post timestamps and the forwarding chain are what link a suspect to the act. Preserve one copy each for the complaint, then stop all further circulation.
Password practice for the college. The takeover succeeded because a guessable passphrase derived from public details protected both accounts. Ban reuse between the college email and social accounts, issue per-student accounts instead of shared lab logins, enable two-factor authentication, and teach passphrases of several unrelated words rather than dog names plus a year. For the defaced site: change all administrator and FTP credentials, restore from a known-good backup, and check file modification times to find the entry point.