Example No. 1

In 2016, Jamtara in Jharkhand state suddenly received media attention as a notorious cybercrime hotspot as the police reportedly found out that the area had become a chosen space for predators to conduct several types of economic offences in cyberspace. The media reports further suggested that the criminal operations rapidly grew because of the availability of trainers and learners who would learn the art of data mining, hacking and phishing for making a living and due to the poor infrastructure of the local police offices to combat the cyber-offences. The report further suggested that the perpetrators rapidly changed their modalities from simple hacking, smishing and phishing to demand ransoms in Bitcoins. This indicates that the perpetrators could access the cryptocurrency exchanges and blockchain, and had proper training and understanding of Bitcoins and their growing value in the market (Acharya Reference Acharya2016).

Example No. 2

In 2017, in Patiala, Punjab, police arrested six persons who had allegedly kidnapped a trader and demanded ransom in the form of Bitcoins for release. This was the first criminal case in the said region that involved cryptocurrency. The police investigation found that the mastermind of this criminal act was well educated, and he had invested in Bitcoin before committing the crime. He then trained some school dropouts for conducting physical crimes and cybercrimes. The entire gang was planning for further criminal activities for illegal profit gain by illegally accessing cryptocurrencies (Singh Deep Reference Jagdeep2021a,Reference Jagdeepb). The accused were later convicted by the court and were awarded life imprisonment.

Example No. 3

In 2018, the police in Surat, Gujarat, cracked down on a massive case of Bitcoin extortion. The case was later taken over by the state Criminal Investigation Department (CID), which could arrest five accused out of 13. The case involved kidnapping and 155 crores Bitcoin extortion claims. The investigation revealed that the accused was deeply connected with the police department and his associates there. The accused kidnapped an employee of BitConnect, a company engaged in floating Bitcoins in the market. After that, the accused also targeted other Bitcoin traders and extorted Bitcoins and Litecoins worth crores of Rupees, worth more than 10 million dollars (TNN 2018).

Example No. 4

In 2021, the Punjab police arrested four persons for allegedly duping others for Bitcoin investment-related business. The accused had reportedly used the name of Binance, a well-known cryptocurrency exchange company based in India. As the media reports suggest, the accused had also created a fake Facebook account to mislead people into understanding that he possessed the wallet address of Binance for Bitcoin investments (Press Trust of India 2021).

In the course of the present research, the authors were able to also access the web pages of cryptocurrency exchanges like Binance, which claims to be the world’s largest cryptocurrency exchange company, ^{Footnote 8} or UnoCoin, a leading crypto-exchange company based in India, founded in 2013. ^{Footnote 9} This, along with the above case examples, also shows that the cryptocurrency industry is extremely vibrant in India despite the precautionary warnings and the existing penal provisions being executed mainly based on the understanding of financial crimes done over the Internet. In the given background, if we look again at the categories of stakeholders and victims discussed in the Introduction, we may also be able to understand the nature of the victims as well as the criminal liability of these stakeholders.

In case example no. 1, we may clearly understand that the primary targets of the perpetrators are cryptocurrency exchanges and people involved in the blockchain meant for crypto-assets. However, while these stakeholders can be considered primary victims, they may further cause victimization to several other investors who may be trading with such exchanges if the former’s client database is attacked. Suppose the exchanges fail to provide strong protection against unauthorized access to client data, the traders. In that case, investors, etc. may take action against the ransom attackers and the exchanges and cryptocurrency agencies as the latter then may step into the shoes of data repositories. The European Union (EU) general data protection regulations have highlighted the responsibilities of the data repositories. ^{Footnote 10} The Indian Information Technology Act, 2000 (amended in 2008) has also provided provisions towards the responsibilities of the body corporates, which means and includes companies and business entities, that receive information including sensitive personal information of the clients, subscribers and beneficiaries, in Section 43 A which prescribes for payment of damages to the said client/s, beneficiaries, etc., who may have suffered a data breach due to the negligence of the said company, business entity, etc.

In the second example, we see that the trader of Bitcoins is the primary victim. The example may also show that the main perpetrator was also a Bitcoin trader, and under his instruction, other perpetrators were also preparing for data mining of other traders, which may be possible if the perpetrators can access the cryptocurrency exchanges or may access anyone who may be part of crypto-mining and may be connected with other possible traders.

The third example may show that the primary victim was an employee of a cryptocurrency agency. He was targeted because the perpetrators wanted to access the actual agency and the exchange to access the data of cryptocurrency traders.

In the fourth example, we see that the primary target/victim is a cryptocurrency exchange/agency whose registered company name has been illegally used.

The significant questions that may arise here are, can such exchange/agency/company dealing with crypto-asset traders directly or who are also controlling the market be considered victims in the cases mentioned above? Further, can the traders or investors access justice as victims if they are victimized by extortion, etc.?

The following parts of this article will help us understand the situation from an Indian perspective.

Banning of Cryptocurrency & Regulation of Official Digital Currency Bill, 2019

The situation became more critical with the introduction of the Bill by the Indian Parliament. Here, a brief explanation of the Bill mentioned above becomes necessary.

The Bill provides certain significant definitions in the opening sections that had neither been implemented nor revised when this paper was written. These definitions include the digital rupee, ^{Footnote 12} distributed ledger technology ^{Footnote 13} and mining. ^{Footnote 14} We would like to concentrate more on chapters 5 and 6 of the Bill, which discuss the prohibition of cryptocurrency and offences. Chapter 5 is dedicated to statutory prohibitions for the usage of cryptocurrency. Therefore, Section 6 in this chapter prohibits cryptocurrency usage as a medium of exchange, store value, and unit of accounts. Section 6(2) of the Bill further expands the scope of the prohibitory statute, which is impliedly extended over private individuals and to any financial institutions, banks, corporate houses and currency dealers by prohibiting cryptocurrency usage as legal tender or currency anywhere in India. ^{Footnote 15} Section 7 further explains the activities that would be prohibited with cryptocurrency in India: these include using cryptocurrency as a payment system, buying, selling or storing cryptocurrency, providing cryptocurrency-related services, including registering, trading, selling, etc. of the currency for anyone, including traders or investors of cryptocurrency, issuing of cryptocurrency as a mechanism for raising funds or for investments, etc. ^{Footnote 16} Chapter 6 of the Bill concentrates on offences and punishment. Sections 8 and 9 discuss the offences and prescribe different punishments for different offences. It may be seen that Section 8 of the Bill addresses offences from four aspects:

1. (a) Mining, generating, holding, selling, dealing in, transferring, disposing of and/or issuing cryptocurrency for the purpose of issuing cryptocurrency-related financial products, issuing the said currency to raise funds and issuing of the said currency for the purpose of investments is considered an offence with punishable with fine and /or minimum punishment for a one-year jail sentence and maximum punishment of 10 years in jail. ^{Footnote 17}

2. (b) Mining, generating, holding, selling, dealing in, transferring, disposing of and/or issuing of cryptocurrency for trading with Indian and foreign currencies, buying, selling, storing, providing certain services related to cryptocurrency to the consumers and investors, etc., is considered an offence, punishable with a fine and/or a maximum sentence of 10 years. ^{Footnote 18}

3. (c) Directly or indirectly promoting, issuing any advertisement, soliciting, abetting or inducing any participation in any activity which involves the use of cryptocurrency for any of the purposes or activities, including using the said currency as a medium of exchange, selling, buying, storing the said currency, providing any customer services and/or investor-related services, etc., would be considered an offence punishable with a fine and/or imprisonment sentences to a maximum period of seven years.Footnote ¹⁹

4. (d) Acquiring, storing, and disposing of cryptocurrency by anyone for non-commercial purposes would be considered an offence and punishable with a fine. ^{Footnote 20}

As may be understood from the above discussion, the Bill prescribes punishment for every possible use of cryptocurrency for Indian and foreign commercial purposes by any Indian citizen. Some of the punishable offences with a maximum of 10 years of jail term are considered heinous offences and non-bailable. Some with a maximum punishment of seven years are considered serious offences. The Bill also prescribes punishment for abetment of the offence and attempts to commit any offence, as mentioned in Section 9 of the Bill. Interestingly the Bill prescribes punishment as imprisonment and pecuniary fines, which is extremely heavy compared with many other criminal offences recognized in India. ^{Footnote 21} It must be noted that legal recognition of cryptocurrency is still a grey area in many countries. While in some North American countries like the United States and Canada, assets in cryptocurrency are taxable, Canada has not yet recognized it as legal tender. ^{Footnote 22} As such, while some countries, including the United States, Canada, Australia, Ecuador, Japan and some European countries like France, Germany, Denmark, etc. have legalized trading, investing, storing of cryptocurrencies from different legal aspects, including taxable assets, these countries have also generated periodic information regarding the risks involved in cryptocurrency dealings and necessity for registering information about transactions including cryptocurrency transactions. Again, several countries have not yet lifted the strict ban on cryptocurrency. These include certain Afro-Asian and European countries, including India, Bangladesh, Nepal, Kuwait, Bahrain, Burundi, Cameroon, Maldives, Vietnam, India and more (Bajpai Reference Bajpai2021). This makes the stakeholders dealing with cryptocurrency in India more vulnerable. Such vulnerability arises from different aspects discussed in the next segment.

The Emergence of Guardian-less Victims in the Cryptocurrency Industry

Due to the Supreme Court’s intervention and interpretation of the RBI guidelines, the legal rigidity in dealing with cryptocurrency in India has been relaxed. It is neither considered legal nor illegal for individuals who, in good faith, deal with cryptocurrencies by way of selling, trading, mining, etc. As Rahayuda and Santiari (Reference Rahayuda and Santiari2017) suggest, the web is divided into five levels: common web, surface web, Bergie web, deep web and dark web. Interested investors in cryptocurrency need to have wallets to store the cryptocurrency, and they also need to be aware of the agencies dealing and trading in cryptocurrencies. At present, such agencies and advertisements for investment in cryptocurrencies can be viewed on India’s common and surface web. For example, a search on Google platforms with keywords such as cryptocurrency investment, cryptocurrency agencies, etc. may lead the searcher to different agencies like ZebPay, ^{Footnote 23} Unicoin ^{Footnote 24} and CoinSwitch Kuber. ^{Footnote 25} The web pages of all these agencies mentioned above were easily reachable, and they were fully active when this article was being prepared. Many such agencies have prominent social media handles on Twitter ^{Footnote 26} and they are also advertised privately by many YouTubers (for example, see Raj Thakur Reference Pushkar2021; Trading Copter 2021). Investors’ details may also be stored in the agency platforms and databases. However, as mentioned above, such databases may be vulnerable, and the investors may also face security issues for the misuse of cryptocurrency by various criminal gangs, including terror outfits. Due to the pendency of the Official Digital Currency Bill, 2021, stakeholders who are cryptocurrency dealers and traders have become extremely vulnerable when the said dealing in cryptocurrency becomes directly connected with criminal activities like weapons dealing (Rhumorbarbe et al. Reference Rhumorbarbe, Werner, Gilliéron, Staehli, Broséus and Rossy2018), drug dealing (Van Hout and Bingham Reference Van Hout and Bingham2014) or sex trafficking (Hoyer Reference Hoyer2017) or child sexual abuse (Lee et al. Reference Lee, Ermakova, Ververis and Fabian2020) in the deep dark web.

As the present legal system suggests, in India or in many countries where prohibitory provisions may be prevailing, or the government may not have approved the legality of the dealings of cryptocurrencies, any individual or any company may buy or sell cryptocurrencies, and these buyers or sellers do not have to register the dealing with any government stakeholder. Suppose the transaction is related to criminal activities in the deep and/or dark web. In that case, the buyer/seller may not only face criminal charges from the government irrespective of the fact whether he knew about the criminal intentions and criminal past of the seller/buyer of the cryptocurrency. He may also face personal and data security risks from criminal gangs, who may have hidden connections with the entire trading of cryptocurrencies. It is necessary to understand how general investors may get trapped in the illegal cryptocurrency trading industry. Data related to possible investors, region-based currency value connected with the constant value of the cryptocurrencies, forms of cryptocurrencies, etc. constitute a large blockchain. A public ledger blockchain may enable the distribution of information regarding transactions, trading and traders, miners, investors, etc. to the computers and computer networks connected with the blockchain. This chain is considered extremely secured and hackproof if compared with state-supported blockchains. As mentioned above, stakeholders connected with the blockchain work on a personal trust basis. Hence the trading, mining, investing, etc. of cryptocurrency may be noticed by all the stakeholders, but what may not be noticed is the reason for which cryptocurrency is being used other than trading in this chain of investing, buying and selling.

As such, if the criminal justice agency starts an investigation into the funding for deep web or dark web criminal activities, they may access the traders, buyers, sellers and investors in cryptocurrency who may not be aware of the end use of the crypto-assets even if they may be sellers or investors to the perpetrators. Again, consider several incidents where individuals or companies may be forced to pay ransoms in cryptocurrencies. At this point, perpetrators may enter cryptocurrency dealing. They may also enter into the crypto-blockchain through such illegal ransom gain, becoming future traders. Our concern centres around this very issue: as Indian lawmakers have not yet given legal recognition to cryptocurrency and the pending Bill promises heavy punishment for the stakeholders in dealing with cryptocurrency, the victims of ransom demands may be considered as “guardian-less victims” who may face punishments because of supplying cryptocurrencies according to the demands of the perpetrators. Before such “guardian-less victims” may get justice as victims, their involvement in the criminal activity of fuelling the crypto-asset for illegal gain may make them defenceless. Aside from sanctions of the Bill mentioned above, such “guardian-less victims” may also be penalized by anti-money laundering provisions.

Anti-Money Laundering Laws and Victimization of “Guardian-less Victims”

Here, it becomes necessary to understand how anti-money laundering laws may affect such “guardian-less victims” in the crypto-industry. Anti-money laundering laws emphasize investing/selling/buying, etc. of property through unlawful monetary transactions. In India, Section 3 of the Prevention of Money Laundering Act, 2002 provides a narrow description of the term money laundering as follows:

An explanation added to this provision further explains the activities connected with the proceeds of crime, including “concealment, or possession, or acquisition, or use; or projecting as untainted property; or claiming as untainted property, in any manner whatsoever”. ^{Footnote 27}

This understanding is also seen in the federal anti-money laundering act in the United States ^{Footnote 28} which covered three types of criminal offences, including domestic, international and undercover money laundering transactions. This provision also indicates four essential ingredients for charging the accused: these include: (a) intention to promote the execution of unlawful activities; (b) intention for engaging in tax evasions or tax fraud; (c) knowledge that the transaction is intended to conceal the nature, location, source, ownership or control of the proceeds of the unlawful activities; and (d) knowledge that the transaction was designed to avoid the requirement of transaction reporting as has been mandated in the state or federal laws. ^{Footnote 29}

Both Indian and US anti-money laundering laws target the result of the unlawful transaction, that is, the “property”, which in the present context would mean cryptocurrency. The United States has already considered cryptocurrency as a taxable asset. India, on the other hand, still has not decided on the legality of cryptocurrency, but recent discussions in parliament have revealed that the government may be preparing to consider cryptocurrency as a taxable asset too (Anand Reference Anand2022). As the Bill suggests that any dealing with cryptocurrency would be considered a punishable offence, it may lead us to understand that holding cryptocurrencies as assets or buying or selling of cryptocurrencies may also be scrutinized by the government in the light of penal provisions, including anti-money laundering laws. Further, an in-depth investigation of the chain of owners of cryptocurrencies may lead the investigators to presume that whoever had handled cryptocurrency as a buyer, seller or investor may be directly or indirectly liable not only under the proposed Bill but also under several other penal laws because the Bill holds anyone who is involved in buying or selling of cryptocurrencies liable for offences.

Issues for Victim Assistance for Guardian-less Victims in the Cryptocurrency Industry

The United Nations (UN) Declaration of Basic Principles of Justice for Victims of Crime and Abuse of Power emphasizes victim assistance by the State. ^{Footnote 30} Considering the right to access assistance as a prime right for victims, the UN Declaration emphasizes planning and organizing victim service programmes that will enable the government and community stakeholders to assess the situation, plan for a victim survey to understand the specific needs of the victims, build up support system for supporting the victim during an investigation, trial and post-trial of the cases in the courts, etc. ^{Footnote 31} the Declaration also addresses planning and programming for customized support for victims to overcome the trauma of victimization. ^{Footnote 32} However, this may also show that the criminal justice machinery and victim assistance provider stakeholders must have sufficient training and infrastructure to assist victims. This may be a Herculean task for the victim service providers and victims. This answers our three questions from the above section discussing the existing legal vacuum on legal recognition of cryptocurrency, traders and cryptocurrency exchanges in India:

1. (a) Exchange/agency/company dealing with crypto-asset traders directly or who are also controlling the market may not be considered victims in the backdrop of the Bill unless such exchanges, etc., are successfully establishing their innocence for the occurrence of criminal activity. Given the understanding of prohibitory regulations mentioned in the Bill, such exchanges may not be eligible for victim assistance.

2. (b) The same point discussed above applies to investors and buyers.

3. (c) Sellers of cryptocurrencies may face challenges from the criminal justice machinery for lack of clarity in the laws. Even if they try to seek assistance as victims of unnecessary harassment, questions may be raised about their power and eligibility to store cryptocurrencies, especially when such entities may face ransomware attacks that may ask for cryptocurrencies like Bitcoins for the release of the data. Instead of being protected by the criminal justice machinery, including the police and the courts, they may have to take the stand of confused defendants to prove their innocence.