THE LEGALITY OF PORT SCANNING

Did You Know What Is ‘Port Scanning’?

Communities in the present generation are highly dependent on the varying digital norms and attached technologies connected via the internet. With innovative newly launched gadgets for most of their tasks both personal as well as professional, individuals have got disconnected from their real-self while diving into the digital age. The invention of computers has been the most iconic invention for the digital era, but as the technology keeps on getting better the vulnerability of cyber threats also increases apparently. One of the most vulnerable means by which the black hat hackers gain access to someone’s system is through port scanning. It is a way by which the hackers gain access through open and unsecured ports in the system, that could be both physical and virtual. Each computer system has a set of ports and each port has a specific function, there are 65,535 possible port numbers, although not all are in common use. Some of the most commonly used ports, along with their associated networking protocol, are:

What does the Hacker target? 

The hacker’s objectives are more relative to gaining access to the complete system. The main reason for port scanning is to gain unauthorized access to other persons’ systems and in turn, stealing their data. While, the technical aspect of it shows us that various tools are there and can be utilized in optimum to prevent and avoid port scanning and is advised by a lot of tech gurus that a user should conduct port scanning in regular intervals, as it would also help the user to recognize the vulnerable ports and also to see if any port is being scanned by an unknown person or not. To pursue that through port scanning, they use certain tools like – Kali Linux, Nmap, Unicorn scan, Angry IP scan, etc. These tools are primarily created to protect the ports in a system; however, hackers use the same tools to find the vulnerability in the systems and then gain unauthorized access to the system. This access can be gained by virtual machine-ware and the same can be tracked through IPv4, IPv6, and Mac addresses of the system as it acts as a digital fingerprint in terms of hacking. Various port scanning tools are essentially designed to prevent port scanning but they use the drawbacks and vulnerabilities of these programs to exploit the end-users. As all computer systems require a regular update in terms of the software they are running, what the hackers do, most commonly is targeting an un-updated computer system as they are not up to date with the recent batch of security patches and hence are most vulnerable to such cyber-attacks.    

Bindings of the Legal Provisions within India 

Coming to the legal liners of Port scanning, as the vulnerability from it is very high the law-makers have taken steps to secure the citizens from such cyber-crimes. They have been very articulate in drafting rules against such cyber threats which can be reflected in the provisions within Information Technology (IT) Act, 2000 and the Indian Penal Code (IPC), 1860 providing such the attached punishments for such crimes. The main issue faced by the legal system to properly administer justice in such cases is the absence of the real accused or battling a virtual accused. The cyber cell of the Govt has been fairly active to tackle such cyber crimes with the help of expert advisors and technicians who in turn are specifically trained as white hat hackers to prevent the black hat hackers from committing such cyber crimes and to track the ones who committed the crime as well. 

Legal provisions related to port scanning-

• Section 43 of the IT Act, 2000- It criminalizes port scanning and holds cases under these provisions under the jurisdiction of a High Court or a Civil Judge Senior Division. The maximum compensation for being the victim under these provisions is Rs 5 Cr.
• Section 66 of the IT Act, 2000- Under this provision, the punishment for port scanning is provided, which is a term extending up to 3 years or a penalty of 5 lakhs or both. 
• Section 84 of the IT Act, 2000- The punishment for attempting cyber-crimes like port scanning has been laid down and it provides for a person if found guilty will be imprisoned for a term of up to 2.3 years and is liable to pay a Penalty. 
• Section 24 of the IPC, 1860- This provision lays down the definition of criminal dishonesty.
• Section 25 of the IPC, 1860- This provision lays down the definition of criminal fraud.

Now it can be seen that port scanning is a boon as well as a bane and hence being safeguarded from such threats is a prime concern in terms of cyber security

About the legal sphere concerning port scanning, we can see that the lawmakers have been very sensible in adding the civil and criminal aspects to the act. The act itself has been criminalized and even the preparation and attempt to the same has been also criminalized, although under the IT act the suits are civil but taken in conjugation with the above-mentioned IPC provisions the suit becomes criminal.   

It can be seen that the threat of port scanning is ever-present and to prevent it one should always keep the computer software up to date, as all new software updates have new security patches to prevent such cyber threats. As it is very commonly said, your safety is in your own hands, similarly the prevention of cyber-attacks like port scanning is also in our own hands and one could do that by following proper cyber security protocols and maintaining cyber hygiene, and by keeping the system and yourself also updated about recent threats. Stay Alert, Stay Safe.    

Author – Mr. Abhishek Parmar, Research Intern, CyberPeace Foundation

Reviewed by– Ms. Kankana Dutta, Manager – Research and Projects, CyberPeace Foundation

1.  https://securitytrails.com/blog/best-port-scanners

2.   https://indiankanoon.org/doc/39800/

3.   https://indiankanoon.org/doc/326206/

4.   https://indiankanoon.org/doc/543216/

 5.  https://legislative.gov.in/sites/default/files/A1860-45.pdf