Star Health Data Breach: Supreme Court Directs Cybersecurity Expert To Appear Before Trial Court, Furnish Bail Bonds

The Supreme Court on Thursday directed cybersecurity researcher Himanshu Pathak to appear before the XI Metropolitan Magistrate, Chennai, and furnish bail bonds in the criminal case lodged against him by Star Health and Allied Insurance Company.

The direction came while the Court was hearing Pathak's challenge against a Madras High Court judgment refusing to interfere with criminal proceedings initiated on Star Health's complaint.

A bench of Chief Justice Surya Kant and Justices Joymalya Bagchi and V. Mohana heard the matter.

While Pathak claims he identified vulnerabilities in Star Health's systems and sought a court-monitored investigation into them, the insurer alleges that he unauthorisedly accessed and downloaded data from its systems and attempted to extort the company by threatening to disclose the information unless it engaged his cybersecurity services.

Based on Star Health's complaint, the Tamil Nadu Cyber Crime Police registered an FIR against Pathak. A charge sheet has since been filed, and the criminal case is pending before the XI Metropolitan Magistrate, Chennai.

According to Star Health, Pathak failed to comply with the Madras High Court's earlier direction requiring him to appear before the trial court. The company submitted that two non-bailable warrants were subsequently issued against him due to his non-appearance.

At the outset, Senior Advocate Dr. S. Muralidhar, appearing for Star Health, submitted that Pathak had not complied with the High Court's direction.

"The High Court asked him to appear at least once before the trial court... He has not even appeared once. Two NBWs have been issued. First, he should appear before the trial court. He's misusing the liberty."

The bench agreed that Pathak must first comply with the trial court's process.

"Let him appear before the trial court. In the meantime, we will ask you to apply, appear and take regular bail."

Counsel appearing for Pathak assured the court that he would comply with the direction.

"I have no hesitation. I will appear once, procure bail, and subsequently seek permission to appear through video conferencing."

Star Health further alleged that certain persons claiming to be ethical hackers identify vulnerabilities in companies' systems and then demand money by threatening to publish the information.

"In the pretext of being ethical hackers, they prepare reports. In the report, they say, 'If you do not pay money, you are going to publish it internationally.' It's actually like a ransom," Senior Advocate Muralidhar submitted.

The bench, however, said it would first determine whether the allegations reflected a recurring pattern before expressing any opinion.

"Let us see whether this is a habitual practice or not. If it is not, we will take a different view on this."

Pathak denied the allegation and maintained that he had responsibly disclosed vulnerabilities to several organisations in the past.

"In the past, I have made disclosures with respect to reputed agencies, Punjab National Bank and others, and they have taken it in good spirit. They themselves have called me a 'good Samaritan'. I have everything on record.", he said.

During the hearing, the court also expressed concern over the cybersecurity obligations of companies entrusted with sensitive personal information.

"You are the repository of very private information... the data fiduciary.", it noted.

Senior Advocate Muralidhar informed the court that Star Health had engaged an independent cybersecurity expert to audit its systems.

Chief Justice Kant responded that the Court wanted to satisfy itself about the adequacy of the company's cybersecurity measures.

"I wanted to be satisfied myself. I've asked them to show me the report."

The court directed Star Health to place the cybersecurity audit report on record. In the meantime, it directed Pathak to appear before the XI Metropolitan Magistrate, Chennai; furnish bail bonds, and seek regular bail in accordance with law.

Background

On July 24, the Supreme Court had asked Star Health to explore the possibility of settling its dispute with Pathak while hearing his appeal against the Madras High Court judgment.

Pathak had approached the High Court seeking, among other reliefs, an investigation into alleged cybersecurity vulnerabilities in Star Health's systems. After his writ appeals were dismissed, he moved the Supreme Court.

Without expressing any opinion on the merits of the dispute, the bench had observed:

"The ultimate end of the day, no harm has been caused to you. Maybe that this information, and the anxiety to make money out of that information, has really put you on the right track, and you became wiser than what you have been in the past."

The bench had then asked Star Health to consider whether the dispute could be resolved.

"Take instructions whether you can put a quietus to it, so that there can be a closure." It had remarked.