The expression “Corporate Espionage” is commonly understood to be a practice wherein a corporate system is impregnated with the help of spies or systems so as to facilitate the leakage of information which could mar the general growth of the victim organization. It covers within itself illegal activities such as theft of trade secrets, business plans, customers’ lists, pricing data, bribery, blackmail, technological surveillance etc. resulting in breach of security of an organization and gaining access to its confidential and sensitive information.

The internet has now become a ‘highway of information’ when it comes to gathering and processing information. Spying involves the use of almost the same technology as the one used for Competitive Intelligence i.e. business intelligence procedures. The basic difference between both is that while indulging in Corporate Espionage, the internet and connections used are equipped with a more advanced ‘attacking’ mode. Cyber attacks are becoming increasingly common in both public and private sectors. Thus there is an urgent need to enact and enforce stringent laws pertaining to cyber offences.

The Information Technology Act, 2000 (‘Act’) in India provides legal recognition for transactions carried out by means of electronic data interchange and other electronic communication. The Information Technology (Amendment) Act, 2008 was enacted which introduced several new provisions relating to data protection, privacy, cyber terrorism etc. Chapter IX of the Act refers to provisions relating to penalties, compensation and adjudication and Section 43 covers cyber contraventions related to unauthorized access to computer, computer system, computer network or resources. Damages of Rupees One crore (approx. USD 200,000) prescribed under this Section before the Amendment has been deleted and now the defaulter is made liable to pay damages by way of compensation to the person so affected. Section 43 A has been inserted to protect sensitive personal data or information possessed by a body corporatein a computer resource which such body owns, or operates. If such a body corporate is negligent in implementing reasonable security practices and it causes wrongful loss or wrongful gain to any person, it shall be liable to pay damages by way of compensation to the person so affected. The phrase ‘sensitive personal data or information’ has not been defined by the Act.

Chapter XI of the Act deals with offences and Section 66 lays down the penalty for contravention of Section 43 amounting to an imprisonment of upto three years or fine upto five lakh rupees or both. Many new Sections (66 A to F) have been added by the Amendment Act prescribing punishment for offences such as sending of offensive through communication service etc. (66A), dishonestly receiving stolen computer resource or communication device (66B), identity theft (66C), cheating by personation by using computer resource (66 D), violation of privacy (66E), cyber terrorism (66F). For the offence of cyber terrorism, the Act prescribes life imprisonment. Section 69 gives power to the state to issue directions for interception or monitoring of decryption of any information through any computer resource. Sections 69 A and B grant powers to the State to issue directions for blocking certain websites for public access if its content is believed to threaten the security and integrity of the State and to monitor and collect traffic data or information. Sections 72 and 72 A deal with penalty for breach of confidentiality and privacy and punishment for disclosure of information in breach of lawful contract. Sections 84 B and C lay down punishments in case of abetment ofoffences under the Act and also for attempt to commit such offences.

The Amendment seems to be a step forward in the direction of reducing instances of Corporate Espionage. In order to cope with the multifarious challenges that technological advancement may bring, it is essential to have in place more efficacious and stricter laws relating to cyber security. There is a need to bring harmony in the laws relating to data protection, copyright, cyber crimes throughout the world because it is this disparity between the laws and rules of various countries that makes it easy for spies to break into the computer networks and resources and carrying on their spying practices.

Thus, all organizations need to re-assess their security policies and take appropriate steps in order to protect themselves from becoming a victim of Corporate Espionage. They must identify their sensitive information. Adequate training should be provided to employees, users, managers etc. so that they can protect the sensitive information of the organization. At the end of the day, the more knowledge organizations have about such malpractices, the better they will be equipped to fight against it.