⚖️
CyberLaw
Academy
📝 Module 4 Assessment
Cyber Crime Investigation & FIR Drafting
50 Questions • 60 Minutes • 70% Passing Score
Questions
50
Time
60 min
Passing
70%
Parts
5
Part 4.1 — Police Machinery & Jurisdiction
1
NCRP portal (cybercrime.gov.in) is operated by:
CERT-In
I4C under MHA
CBI
NIA
I4C (Indian Cyber Crime Coordination Centre) under Ministry of Home Affairs operates the NCRP portal.
2
1930 helpline is most critical for:
Defamation complaints
Hacking incidents
Financial fraud fund freeze
Copyright violations
1930 helpline is critical for financial frauds — can coordinate immediate fund freeze within hours.
3
Lalita Kumari v. State of U.P. mandates:
Mandatory FIR registration for cognizable offences
Anticipatory bail in all cases
Preliminary inquiry always required
FIR only after court permission
Lalita Kumari: FIR registration mandatory when information discloses cognizable offence.
4
Zero FIR means:
FIR with no accused
FIR with no evidence
Anonymous FIR
FIR regardless of jurisdiction, numbered "0", then transferred
Zero FIR: Registered at any police station regardless of jurisdiction, given "0", transferred to appropriate PS.
5
CBI investigation requires:
Complainant's request only
State consent or court order
Central government notification
No requirement
CBI needs state government consent or High Court/Supreme Court order to investigate.
6
CERT-In is the nodal agency for:
FIR registration
Operating 1930 helpline
Cyber security incidents
Cyber crime prosecution
CERT-In handles cyber security incidents and mandatory breach reporting — under MeitY.
7
If police refuses FIR, complainant should:
File complaint before Magistrate (S.200/223 BNSS)
File RTI application
Approach Election Commission
Accept police decision
Magistrate complaint under S.200/223 BNSS can compel FIR registration.
8
Cyber crime jurisdiction exists at:
Only accused location
Only server location
Only victim location
All: accused, server, victim, consequence locations
Multiple jurisdictions available — strategic forum selection possible.
9
Multiple FIRs on same cause of action (Arnab Goswami):
All should proceed
Subsequent FIRs quashable
Automatically clubbed
Strengthen prosecution
Arnab Goswami: Identical allegations — subsequent FIRs liable to be quashed.
10
NCRP complaint is:
Equivalent to FIR
Automatic FIR in 7 days
Not substitute for FIR — follow up needed
Only for lawyers
NCRP complaint is not FIR — separate FIR needed for court proceedings.
Part 4.2 — FIR & Complaint Drafting
11
FIR under BNSS S.173 is for:
Any offence
Cognizable offences only
IT Act offences only
Bailable offences only
FIR under S.173 BNSS is for cognizable offences.
12
Online defamation (BNS S.356) requires:
FIR at cyber cell
CERT-In complaint
Private complaint before Magistrate
PIL in High Court
Defamation (S.356 BNS) is non-cognizable — private complaint required.
13
Phishing attack FIR should include:
Only IT Act S.66
Only BNS S.318
Only BNSS provisions
IT Act S.66C, 66D + BNS S.318, 319
Phishing: IT Act + BNS combination required.
14
Most critical detail for financial fraud FIR:
Accused's phone, UPI ID, transaction details
Complainant's education
Previous complaints
Family details
Phone numbers, UPI IDs, transaction IDs are investigation starting points.
15
Section 66C IT Act covers:
Hacking
Identity theft
Cyber terrorism
Child pornography
S.66C: Fraudulent use of electronic signature, password, or identification.
16
7 essential FIR elements are:
Date, time, place, witness, motive, weapon, alibi
FIR number, date, PS, IO, court, judge, prosecutor
Victim, accused, witness, evidence, law, procedure, judgment
Complainant, accused, incident, loss, sections, evidence, prayer
7 elements: Complainant, accused, incident, loss, sections, evidence, prayer.
17
Common FIR drafting mistake:
Too many technical details
Filing too early
Vague description without specific IDs
Annexing too much evidence
Vague FIRs without specific details leave no investigation starting point.
18
Ransomware on critical infrastructure attracts:
IT Act S.66F + S.66 + BNS S.308
Only BNS provisions
Only IT Act S.43
Copyright Act
Critical infrastructure ransomware: S.66F (cyber terrorism), S.66, BNS S.308 (extortion).
19
Before filing FIR for financial fraud:
Wait for bank investigation
Call 1930 helpline first
Send legal notice to bank
File RTI
Call 1930 first for immediate fund freeze.
20
S.66D IT Act covers:
Data theft
Hacking
Obscene content
Cheating by personation using computer
S.66D: Cheating by personation using computer resource.
Part 4.3 — Evidence Preservation
21
Telecom CDR retention period:
30 days
6 months
2 years
5 years
TRAI mandates telecom companies retain CDR for approximately 2 years.
22
S.91 BNSS notice can be issued by:
Complainant
Court or Police Officer (SHO+)
Any advocate
CERT-In
S.91 BNSS: Courts or police officers can summon documents.
23
Golden hour for financial fraud:
First 24-48 hours
First week
First month
No timeline
First 24-48 hours critical for fund freeze.
24
Social media IP logs typically retained:
1 week
30 days
180 days
~90 days
Most platforms retain IP logs for approximately 90 days.
25
Self-captured screenshot requires:
No requirements
S.63 BSA certificate
Police attestation
Court permission
Self-captured evidence requires S.63 certificate.
26
CCTV footage auto-overwrites within:
7 days
14 days
30-60 days
6 months
Most CCTV systems auto-overwrite every 30-60 days.
27
Best self-preservation practice:
Full screenshot with URL, timestamp, hash
Cropped screenshot
Verbal description
Memory recall
Full screenshots with URL, timestamp, and hash preserve authenticity.
28
Bank records retention (RBI):
2 years
5 years
7 years
10 years
RBI mandates banks retain records for 10 years.
29
Failure to preserve evidence after notice:
No liability
S.201 BNS liability
Civil damages only
Contempt only
Intentionally destroying evidence after notice attracts S.201 BNS.
30
Independent evidence preservation uses:
Personal diary
Verbal testimony
Web.archive.org
Memory recall
Wayback Machine provides independent third-party preservation.
Part 4.4 — Interim Reliefs
31
Fastest route for account freezing:
1930 helpline
Court application
RBI complaint
FIR only
1930 helpline triggers immediate inter-bank coordination.
32
S.79 IT Act safe harbor lost when:
Hosting any content
Making profits
Not acting on actual knowledge
Allowing user content
Safe harbor conditional on expeditious removal after actual knowledge.
33
S.69A website blocking by:
State governments
Central Government only
Any police officer
Intermediaries
S.69A: Only Central Government can direct blocking.
34
Three-fold injunction test:
Urgency, evidence, damages
FIR, evidence, witnesses
Jurisdiction, limitation, cause
Prima facie, balance, irreparable injury
Courts apply: prima facie case, balance of convenience, irreparable injury.
35
John Doe orders are for:
Blocking sites with unknown operators
Arresting anonymous accused
Freezing accounts
Search warrants
John Doe: Ex-parte blocking orders against unknown operators.
36
IT Rules grievance acknowledgment:
1 hour
12 hours
24 hours
7 days
Platforms must acknowledge within 24 hours, resolve within 15 days.
37
Shreya Singhal on S.69A:
Unconstitutional
Valid but subject to judicial review
Absolute government power
Only for foreign sites
Shreya Singhal: S.69A valid with procedural safeguards.
38
Ex-parte injunctions granted:
After full trial
After hearing both parties
Only in criminal cases
Without hearing other side
Ex-parte: Without hearing other side for extreme urgency.
39
Suppression in ex-parte application:
Vacation of order
Criminal prosecution
Permanent injunction
Higher damages
Courts vacate ex-parte orders obtained by suppression.
40
Best route for defamation takedown:
S.69A blocking
FIR only
Court injunction + Platform notice
CERT-In
Court injunction combined with platform grievance is most effective.
Part 4.5 — Defence & Corporate Response
41
Sushila Aggarwal on anticipatory bail:
Expires after 60 days
Continues even after charge sheet
Requires surrender
Only bailable offences
Sushila Aggarwal: No time limit — continues even after charge sheet.
42
Bhajan Lal provides grounds for:
Anticipatory bail
Regular bail
Quashing FIR
Transfer of investigation
Bhajan Lal: 7 categories for FIR quashing under inherent powers.
43
CERT-In reporting timeline:
6 hours
24 hours
72 hours
7 days
CERT-In Directions (2022): 6 hours for prescribed incidents.
44
NOT a ground for anticipatory bail:
Devices seized
No flight risk
Technical analysis needed
Offence is bailable
If bailable, anticipatory bail not needed.
45
To maintain privilege over investigation:
Use only internal team
Conduct under external counsel
Share with all stakeholders
Submit to regulators
Investigation under external counsel maintains privilege.
46
Upjohn warnings given to:
Employees — lawyer represents company
Regulators
Board
Police
Upjohn: Inform employees lawyer represents company, not them.
47
Common incident response mistake:
Preserving evidence
Engaging counsel
Wiping before forensic imaging
CERT-In reporting
Wiping before forensic imaging loses evidence.
48
Quashing typically avoided in:
Defamation
Civil disputes
Compoundable offences
Cyber terrorism & POCSO
Courts hesitant to quash serious offences like S.66F and POCSO.
49
RBI cyber incident reporting for banks:
1 hour
2-6 hours
24 hours
7 days
RBI: Banks report within 2-6 hours.
50
First step in corporate incident response:
Detection, containment, preservation
Press release
Filing FIR
Regulatory reporting
First contain breach and preserve evidence.
Submit Quiz
0%
Calculating...
Part 4.1
0/10
Part 4.2
0/10
Part 4.3
0/10
Part 4.4
0/10
Part 4.5
0/10