Introduction: The Digital India Legal Foundation
"The Information Technology Act, 2000 is India's first cyber law, giving legal recognition to electronic transactions and providing a framework for combating cyber crime."
The IT Act 2000, amended significantly in 2008, remains the primary legislation governing cyberspace in India. Every cybersecurity professional must understand its provisions—both for compliance and for understanding the legal consequences of cyber incidents.
🎯 Lesson Objectives
- Explain the structure and key provisions of IT Act 2000
- Identify cyber offences under Sections 43, 66, 66A-F, 67
- Apply intermediary liability provisions (Section 79)
- Analyze landmark cyber law judgments
1. IT Act 2000 Overview
The Information Technology Act, 2000 (IT Act) was enacted on 17 October 2000, making India the 12th nation to adopt cyber legislation. It was significantly amended in 2008 to address emerging cyber threats.
1.1 Key Objectives
- Legal recognition of electronic documents and digital signatures
- Facilitation of electronic commerce and governance
- Prevention of cyber crimes
- Establishment of regulatory authorities (CERT-In, Adjudicating Officers)
1.2 Structure of the Act
| Chapter | Sections | Subject Matter |
|---|---|---|
| I | 1-2 | Preliminary (Title, Definitions) |
| II | 3-3A | Digital Signature & Electronic Signature |
| III | 4-10A | Electronic Governance |
| IV | 11-14 | Attribution & Acknowledgment |
| V | 15-16 | Secure Electronic Records & Signatures |
| VI | 17-34 | Certifying Authorities |
| IX | 43-47 | Penalties & Compensation (Civil) |
| X | 48-64 | Cyber Appellate Tribunal |
| XI | 65-78 | Offences (Criminal) |
| XII | 79-81 | Intermediaries & Exemptions |
| XIII | 82-90 | Miscellaneous |
2. Civil Liability: Section 43
⚖️ Section 43: Penalty for Damage to Computer Systems
If any person without permission of the owner:
- (a) Accesses or secures access to a computer system
- (b) Downloads, copies, or extracts any data
- (c) Introduces any computer virus or contaminant
- (d) Damages or causes damage to computer system
- (e) Disrupts or causes disruption
- (f) Denies or causes denial of access
- (g) Provides assistance to any person to facilitate access
- (h) Charges services availed by unauthorized access
- (i) Destroys, deletes, or alters information
- (j) Steals, conceals, destroys, or alters source code
Penalty: Compensation up to ₹1 crore to affected persons (adjudicated by Adjudicating Officer)
⚖️ Section 43A: Compensation for Failure to Protect Data
Where a body corporate possessing, dealing, or handling any sensitive personal data/information is negligent in implementing reasonable security practices, causing wrongful loss/gain to any person:
Penalty: Liable to pay damages by way of compensation to affected person
Note: "Reasonable security practices" defined by reference to IS/ISO/IEC 27001 or government-approved standards
3. Criminal Offences: Sections 65-74
3.1 Key Offence Provisions
| Section | Offence | Punishment |
|---|---|---|
| 65 | Tampering with computer source documents | 3 years imprisonment + ₹2 lakh fine |
| 66 | Computer related offences (hacking) | 3 years imprisonment + ₹5 lakh fine |
| 66B | Receiving stolen computer resource | 3 years imprisonment + ₹1 lakh fine |
| 66C | Identity theft (using electronic signature/password) | 3 years imprisonment + ₹1 lakh fine |
| 66D | Cheating by personation using computer | 3 years imprisonment + ₹1 lakh fine |
| 66E | Violation of privacy (capturing/publishing images) | 3 years imprisonment + ₹2 lakh fine |
| 66F | Cyber terrorism | Life imprisonment |
| 67 | Publishing obscene material electronically | First: 3 years + ₹5 lakh; Second: 5 years + ₹10 lakh |
| 67A | Publishing sexually explicit content | First: 5 years + ₹10 lakh; Second: 7 years + ₹10 lakh |
| 67B | Child pornography | First: 5 years + ₹10 lakh; Second: 7 years + ₹10 lakh |
| 72 | Breach of confidentiality and privacy | 2 years imprisonment + ₹1 lakh fine |
| 72A | Disclosure of information in breach of lawful contract | 3 years imprisonment + ₹5 lakh fine |
⚠️ Section 66A: Struck Down
Section 66A (sending offensive messages) was struck down by the Supreme Court in Shreya Singhal v. Union of India (2015) as unconstitutional for being vague and overbroad, violating Article 19(1)(a) - Freedom of Speech.
However, some law enforcement agencies continued to register cases under 66A until the Supreme Court ordered purging of all such cases in 2021.
4. Intermediary Liability: Section 79
⚖️ Section 79: Intermediary Safe Harbor
An intermediary shall NOT be liable for any third-party information, data, or communication link made available if:
- (a) Its function is limited to providing access to a communication system
- (b) It does not initiate, select, or modify the information
- (c) It exercises due diligence and observes prescribed guidelines
Exception: Safe harbor does NOT apply if:
- Intermediary conspires, abets, aids, or induces the commission of the unlawful act
- Upon receiving actual knowledge or being notified by government, fails to expeditiously remove/disable access
💡 Landmark Case: Shreya Singhal v. Union of India (2015)
The Supreme Court interpreted Section 79 to require:
- "Actual knowledge" means a court order, not mere user complaints
- Intermediaries need not proactively monitor content
- Reading down of Section 79(3)(b) to mean actual knowledge from court order
Citation: (2015) 5 SCC 1
5. Landmark Cyber Law Cases
📋 Avnish Bajaj v. State (Bazee.com Case) - 2005
Facts: An obscene MMS clip was listed for sale on Bazee.com (now eBay India)
Issue: Is the intermediary liable for user-uploaded content?
Held: CEO was granted bail. Court noted that intermediaries cannot be expected to monitor all content but must act on receiving knowledge.
Impact: Led to amendments clarifying intermediary liability in 2008
📋 Syed Asifuddin v. State of Andhra Pradesh - 2005
Facts: Tampering with electronic subscriber identity in mobile phones
Held: ESN/IMEI tampering falls under Section 65 (tampering with source code)
Significance: First case interpreting "source code" broadly
📋 State of Tamil Nadu v. Suhas Katti - 2004
Facts: Accused posted obscene messages about a woman on Yahoo Groups
Held: First conviction under IT Act—sentenced under Sections 67 and IPC 469
Significance: Landmark first successful cyber crime prosecution in India
6. CERT-In and Enforcement
⚖️ Section 70B: Indian Computer Emergency Response Team
CERT-In is designated as the national agency for:
- Collection, analysis, and dissemination of cyber incident information
- Forecast and alerts of cyber security incidents
- Emergency measures for handling cyber incidents
- Coordination of cyber incident response activities
- Issue guidelines and advisories
Power: Can call for information and give directions to service providers, intermediaries, data centres, and body corporates
Non-compliance: Up to 1 year imprisonment and/or fine
📝 Key Takeaways
Section 43 provides civil remedies (up to ₹1 crore) for unauthorized access and damage
Section 66 criminalizes hacking with up to 3 years imprisonment
Section 66A was struck down as unconstitutional in Shreya Singhal (2015)
Section 79 provides safe harbor for intermediaries with due diligence
CERT-In under Section 70B is the national cyber incident response agency
✅ Lesson Complete!
You've mastered IT Act 2000. Next: The critical DPDPA 2023 Deep Dive.