Cyber crime is any unlawful act where a computer or electronic device is used as a tool, target, or both. It is not defined in the IT Act 2000 or BNS 2023 but is a collective term for offences involving computer systems and networks.
Legal Framework
| Provision | Subject |
|---|---|
| IT Act S.43 | Penalty for damage to computer system (civil) |
| IT Act S.65 | Tampering with computer source documents |
| IT Act S.66 | Computer related offences (dishonestly/fraudulently) |
| IT Act S.66B | Receiving stolen computer resource or communication device |
| IT Act S.66C | Identity theft |
| IT Act S.66D | Cheating by personation using computer resource |
| IT Act S.66E | Violation of privacy |
| IT Act S.66F | Cyber terrorism |
| IT Act S.67 | Publishing/transmitting obscene material |
| IT Act S.67A | Publishing sexually explicit material |
| IT Act S.67B | Publishing child pornography |
| BNS S.318 | Cheating (includes electronic cheating) |
| BNS S.319 | Cheating by personation |
| BNS S.336 | Forgery (includes electronic forgery) |
| BNS S.303 | Theft (includes data theft) |
Classification of Cyber Crimes
By Target
| Category | Target | Examples |
|---|---|---|
| Crime against individuals | Person's identity, reputation, property | Cyber stalking, identity theft, defamation, phishing |
| Crime against property | Computer systems, data, intellectual property | Hacking, virus attacks, software piracy, data theft |
| Crime against organization | Company, government body | DoS attack, data breach, corporate espionage |
| Crime against society/state | Nation, public order | Cyber terrorism, child pornography, online gambling |
By Nature of Offence
| Category | Type | IT Act Provision |
|---|---|---|
| Unauthorized access | Hacking, cracking | S.66 |
| Data manipulation | Logic bombs, data diddling | S.43(d), S.66 |
| Identity crimes | Identity theft, phishing, spoofing | S.66C, S.66D |
| Content crimes | Obscenity, child porn, defamation | S.67, S.67A, S.67B |
| Economic crimes | Credit card fraud, net extortion | S.66, S.66D |
| Privacy crimes | Voyeurism, data breach, surveillance | S.66E, S.72A |
| Terrorism-related | Cyber terrorism, radicalization | S.66F |
| IPR crimes | Software piracy, copyright infringement | Copyright Act S.63B |
Types of Cyber Crimes (Detailed)
| Crime | Description | Provision |
|---|---|---|
| Hacking | Unauthorized access to computer system with intent to cause damage | S.66 IT Act (3 years + fine up to Rs.5 lakh) |
| Phishing | Fraudulent emails/websites impersonating legitimate entities to steal data | S.66D (3 years + Rs.1 lakh fine) |
| Cyber Stalking | Repeated following, monitoring, harassing through electronic means | S.354D BNS + S.67 IT Act |
| Denial of Service (DoS) | Overwhelming computer resource to deny access to legitimate users | S.43(e) + S.66 IT Act |
| Virus Dissemination | Introducing virus, worm, trojan into computer system | S.43(c) + S.66 IT Act |
| Identity Theft | Fraudulent use of another's electronic identity (password, DSC) | S.66C (3 years + Rs.1 lakh fine) |
| Software Piracy | Unauthorized copying/distribution of copyrighted software | S.63B Copyright Act (7 days-3 years + Rs.50K-2L) |
| Credit Card Fraud | Using stolen card data for unauthorized online transactions | S.66C + S.66D IT Act + S.318 BNS |
| Net Extortion | Threatening to damage computer system unless ransom paid | S.66 IT Act + S.308 BNS (extortion) |
| Child Pornography | Creating, publishing, distributing CSAM electronically | S.67B (5 years first offence; 7 years subsequent) |
| IRC Crime | Using Internet Relay Chat for criminal coordination, trafficking | S.66 + applicable BNS provisions |
| Email Bombing | Sending massive volume of emails to crash recipient's system | S.43(e) (DoS) + S.66 IT Act |
| Web Jacking | Gaining control over website by cracking password | S.66 IT Act |
| Cyber Defamation | Defamatory content published through electronic medium | S.356 BNS |
| Data Theft | Stealing data stored in computer systems | S.43(b) + S.65 + S.66 IT Act |
Cyber Crime Classification Flow
Diagram as text
flowchart TD
A(["Cyber Crime Committed"]) --> B{"Computer as?"}
B -->|Tool| C["Against Persons"]
B -->|Target| D["Against Systems"]
B -->|Incidental| E["Against Society/State"]
C --> C1["Identity Theft S.66C"]
C --> C2["Cyber Stalking S.354D BNS"]
C --> C3["Defamation S.356 BNS"]
D --> D1["Hacking S.66"]
D --> D2["DoS Attack S.43(e)"]
D --> D3["Virus S.43(c)"]
E --> E1["Cyber Terrorism S.66F"]
E --> E2["Child Porn S.67B"]
E --> E3["Online Radicalization"]Recall Check
- Why is "cyber crime" not formally defined in the IT Act 2000?
- Name three crimes where the computer is used as a "tool" and three where it is the "target."
- What is the punishment for identity theft under S.66C?
Key Cases
SMC Pneumatics (India) v. Jogesh Kwatra (2014) SMC Pneumatics (India) Pvt Ltd v Jogesh Kwatra 2004
Issue: Whether the plaintiffs (a company and its managing director) proved that the defendant sent the defamatory e-mails, so as to obtain a perpetual injunction.
Rule: Often cited as India's first cyber defamation case because of an interim injunction reportedly granted in 2001. The verified final judgment shows that e-mail defamation must be proved like any other wrong: authorship of the e-mails must be established, with a S.65B certificate for the electronic records.
Held: Court of the Additional District Judge, Delhi (12 February 2014) dismissed the suit: most e-mails were forwarded copies, no S.65B certificate was produced, and authorship rested only on inference from their contents. The appeal was dismissed for non-prosecution (Delhi HC, 2016).
State of Tamil Nadu v. Suhas Katti (2004) State of Tamil Nadu v Suhas Katti 2004
Issue: Whether posting obscene and defamatory messages about a woman on an internet group constitutes offence under IT Act.
Rule: Posting obscene material in electronic form violates S.67 IT Act; posting defamatory content violates IPC S.500 (now BNS S.356).
Held: First Indian conviction under IT Act. Accused convicted under S.67 IT Act and S.469/509 IPC (now corresponding BNS sections). Sentenced to rigorous imprisonment.
Rule (cyber stalking): Monitoring a woman's use of the internet, e-mail or other electronic communication is stalking under S.354D IPC (inserted in 2013), now S.78 BNS. S.66A IT Act, once used for offensive online messages, was struck down in Shreya Singhal v. Union of India (2015).
Background (no reported judgment): The 2001 Ritu Kohli incident in Delhi, where a man used her identity in online chat rooms and shared her phone number, is often called India's first cyber stalking case. It was a police case: the accused was arrested under the IPC provision on insulting the modesty of a woman (S.509 IPC), as the IT Act had no stalking offence. No court judgment is reported.
Distinctions
| Aspect | Cyber Crime (IT Act) | Traditional Crime (BNS) |
|---|---|---|
| Medium | Electronic/digital | Physical |
| Jurisdiction | Global (S.75 IT Act) | Territorial (BNSS S.197-199) |
| Evidence | Electronic records (S.62-63 BSA) | Physical/documentary/oral |
| Investigation | Specialized cyber cells (Inspector+) | Regular police |
| Speed of commission | Instantaneous; remote | Requires physical presence |
| Anonymity | High (VPN, proxies, dark web) | Lower (physical witnesses) |
| Cross-border | Common (server in one country, victim in another) | Usually within one jurisdiction |
| Specific statute | IT Act Chapters IX, XI | BNS (general criminal law) |
Flashcards
Is "cyber crime" defined in the IT Act?
No. It is not defined in IT Act 2000, IT Amendment Act 2008, or any other Indian legislation. It is a collective term used for technology-related offences.
What is the punishment for hacking under S.66 IT Act?
Imprisonment up to 3 years or fine up to Rs.5 lakhs or both.
What is identity theft under S.66C?
Fraudulently or dishonestly using the electronic signature, password, or any other unique identification feature of another person. Punishment: 3 years + Rs.1 lakh fine.
What was the first conviction under the IT Act in India?
State of Tamil Nadu v. Suhas Katti (2004): conviction under S.67 for posting obscene content about a woman on an internet group.
What is a Denial of Service (DoS) attack?
Overwhelming a computer system/network with traffic or requests to make it unavailable to legitimate users. Covered under S.43(e) + S.66 IT Act.
Name three types of hackers.
White hat (ethical/authorized), Black hat (malicious/unauthorized), Grey hat (unauthorized but without malicious intent, may disclose vulnerabilities).
What is phishing?
Fraudulent attempt to obtain sensitive information (passwords, card details) by impersonating a trustworthy entity via email, SMS, or fake website. Covered under S.66D IT Act (cheating by personation using computer resource).
What is the difference between S.43 and S.66 IT Act?
S.43 provides civil compensation (up to Rs.5 crore) for damage to computer systems. S.66 makes the same acts criminal if done dishonestly or fraudulently (imprisonment + fine).
Exam Scenario
A disgruntled former employee of a bank uses his old credentials (which were not deactivated) to access the bank's customer database and sells 50,000 customer records on the dark web. Identify the cyber crimes committed and applicable provisions.
Multiple offences committed: (1) S.43(a) IT Act: unauthorized access to computer system (civil compensation up to Rs.5 crore). (2) S.66 IT Act: computer-related offence done dishonestly (3 years + Rs.5 lakh). (3) S.66C IT Act: identity theft (using old credentials belonging to an authorized user account). (4) S.72A IT Act: disclosure of personal information obtained under lawful contract (employment) without consent (3 years + Rs.5 lakh). (5) S.43A IT Act: bank liable to customers for failure to implement reasonable security practices (not revoking credentials upon termination). (6) S.303 BNS: theft of data (movable property). (7) S.318 BNS: cheating (deceiving the dark web buyers' victims). The bank must report to CERT-In within 6 hours. Investigation by police of Inspector rank+ under S.80. The employee faces cumulative sentences. The bank faces regulatory action for security failure and civil liability to affected customers.