The IT Act creates two categories of wrongs: civil contraventions (Chapter IX: S.43-45, compensated by Adjudicating Officer) and criminal offences (Chapter XI: S.65-78, prosecuted in criminal courts). The 2008 Amendment significantly expanded criminal provisions by inserting S.66A-66F and S.67A-67C.
Legal Framework
| Chapter | Sections | Nature |
|---|---|---|
| Chapter IX | S.43-47 | Civil contraventions (penalty/compensation) |
| Chapter XI | S.65-78 | Criminal offences (imprisonment + fine) |
Civil Contraventions (S.43-45)
| Section | Contravention | Compensation |
|---|---|---|
| S.43(a) | Unauthorized access to computer system | No statutory cap (Adjudicating Officer: up to Rs.5 crores; beyond that: civil court) |
| S.43(b) | Unauthorized download/copy/extract data | As determined by Adjudicating Officer / court |
| S.43(c) | Introducing virus/contaminant | As determined |
| S.43(d) | Damage to computer/data/database | As determined |
| S.43(e) | Disrupting/denying access (DoS) | As determined |
| S.43(f) | Denying access to authorized person | As determined |
| S.43(g) | Providing assistance to any person to facilitate unauthorized access | As determined |
| S.43(h) | Charging services to another's account | As determined |
| S.43(i) | Destroying/altering source code (when required to be maintained) | As determined |
| S.43(j) | Stealing, concealing, destroying evidence | As determined |
Note: Post-2008 Amendment, S.43 has no upper limit on compensation. The Adjudicating Officer's jurisdiction (S.46(1A)) is limited to claims not exceeding Rs.5 crores. Claims exceeding Rs.5 crores must be filed before a competent court of civil jurisdiction. | S.43A | Body corporate failing to implement reasonable security practices causing wrongful loss | Compensation as determined | | S.44 | Failure to furnish information/returns/documents | Rs.1.5 lakhs per failure; Rs.2 lakhs/day for continuing failure | | S.45 | Residuary penalty | Rs.25,000 per contravention |
Criminal Offences (S.65-78)
| Section | Offence | Punishment |
|---|---|---|
| S.65 | Tampering with computer source documents | 3 years + Rs.2 lakhs fine |
| S.66 | Computer-related offences (dishonestly/fraudulently doing acts under S.43) | 3 years + Rs.5 lakhs fine |
| S.66B | Receiving stolen computer resource/communication device | 3 years + Rs.1 lakh fine |
| S.66C | Identity theft (using another's electronic signature/password/unique ID) | 3 years + Rs.1 lakh fine |
| S.66D | Cheating by personation using computer resource | 3 years + Rs.1 lakh fine |
| S.66E | Violation of privacy (publishing private images without consent) | 3 years + Rs.2 lakhs fine |
| Struck down (Shreya Singhal, 2015) | ||
| S.66F | Cyber terrorism (access + threat to national security) | Life imprisonment |
| S.67 | Publishing/transmitting obscene material | First: 3 years + Rs.5 lakhs; Subsequent: 5 years + Rs.10 lakhs |
| S.67A | Publishing/transmitting sexually explicit material | First: 5 years + Rs.10 lakhs; Subsequent: 7 years + Rs.10 lakhs |
| S.67B | Publishing/transmitting child pornography | First: 5 years + Rs.10 lakhs; Subsequent: 7 years + Rs.10 lakhs |
| S.67C | Intermediary failure to preserve/retain information (as directed) | 3 years + fine |
| S.69 | Failure to comply with direction for interception/monitoring/decryption | 7 years + fine |
| S.69A | Failure to comply with direction to block content | 7 years + fine |
| S.70 | Unauthorized access to protected system (Critical Information Infrastructure) | 10 years + fine |
| S.71 | Misrepresentation to Controller/Certifying Authority | 2 years + Rs.1 lakh fine |
| S.72 | Breach of confidentiality/privacy (information obtained under IT Act powers) | 2 years + Rs.1 lakh fine |
| S.72A | Disclosure of personal information in breach of lawful contract | 3 years + Rs.5 lakhs fine |
| S.73 | Publishing false DSC | 2 years + Rs.1 lakh fine |
| S.74 | Publication for fraudulent purpose | 2 years + Rs.1 lakh fine |
Key Section Analysis
S.66F: Cyber Terrorism
Whoever with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people or any section thereof denies or causes denial of access to any authorized person, or attempts to penetrate or access a computer resource without authorization, or introduces any computer contaminant, and by such conduct causes or is likely to cause death or injuries or damage to property or disruption of essential services or causes contamination of critical infrastructure facilities...
Punishment: Life imprisonment.
Why: Cyber terrorism bridges conventional terrorism and technology. A single act (e.g., compromising power grid controls) can cause mass casualties without physical explosives. Life imprisonment reflects the existential threat to national security.
S.66A: Struck Down
S.66A penalized sending "grossly offensive" or "menacing" messages. In Shreya Singhal v. Union of India (2015), the Supreme Court struck it down as unconstitutional:
- Vague and overbroad (terms like "grossly offensive," "annoying," "inconvenient" lacked definition)
- Violated Art.19(1)(a) (freedom of speech)
- Not saved by Art.19(2) (no reasonable restriction nexus)
- Created chilling effect on free speech
Recall Check
- What is the distinction between S.43 (civil) and S.66 (criminal)?
- Which section carries the heaviest punishment under the IT Act and what is it?
- Why was S.66A struck down?
Key Cases
Shreya Singhal v. Union of India (2015) Shreya Singhal v Union of India 2015
Issue: Whether S.66A IT Act (criminalizing "grossly offensive" online messages) violates Art.19(1)(a).
Rule: Penal restrictions on speech must be narrowly tailored and fall within Art.19(2) grounds; vague and overbroad provisions creating chilling effect are unconstitutional.
Held: S.66A struck down as unconstitutional. Also: S.79 read down (intermediary liability triggered only by court order, not private complaint).
Background (no reported judgment): the Ritu Kohli incident (2001) In 2001 a man in Delhi used Ritu Kohli's identity in online chat rooms and shared her phone number, leading to harassing calls. It is often called India's first cyber stalking case, but it was a police case with no reported judgment: the accused was arrested under S.509 IPC (insulting the modesty of a woman), because the IT Act then had no stalking offence. Cyber stalking was later made an offence by S.354D IPC (2013), now S.78 BNS.
Hotmail Corporation v Van Money Pie Inc (1998) Hotmail v Van Money Pie 1998
Citation: 47 U.S.P.Q.2d 1020 (N.D. Cal. 1998)
Rule: Spamming with return addresses falsified to show Hotmail accounts, and using Hotmail 'drop box' accounts opened in breach of its Terms of Service, supported a preliminary injunction on Lanham Act, Computer Fraud and Abuse Act, contract, fraud and trespass claims (US N.D. Cal.).
SMC Pneumatics (India) Pvt Ltd v Jogesh Kwatra (2014) SMC Pneumatics (India) Pvt Ltd v Jogesh Kwatra 2004
Citation: Original Suit No. 1279/2001, Court of the Additional District Judge (Central-14), Delhi, decided 12 February 2014; RFA 268/2014 dismissed for non-prosecution (Delhi HC, 2016)
Rule: Often cited as India's first cyber defamation case for an interim injunction reportedly granted in 2001, but the suit was dismissed in 2014 because authorship of the e-mails was not proved (forwarded copies, no S.65B certificate).
Distinctions
| Aspect | S.43 (Civil Contravention) | S.66 (Criminal Offence) |
|---|---|---|
| Nature | Civil (compensation) | Criminal (imprisonment + fine) |
| Mens rea | Not required (strict liability) | Required: "dishonestly" or "fraudulently" |
| Forum | Adjudicating Officer (S.46) | Criminal court |
| Burden of proof | Preponderance of probability | Beyond reasonable doubt |
| Remedy | Compensation up to Rs.5 crores | Imprisonment up to 3 years + Rs.5 lakhs |
| Same act | Same act can attract both | S.66 uses S.43 acts as basis with added intent |
| Appeal | TDSAT (S.57) | Sessions Court / High Court |
Illustration: S.43 (Civil) vs. S.66 (Criminal) Same Act, Two Paths
Scenario: Rahul, an IT employee, accesses his company's HR database without authorization and downloads salary details of all employees.
Civil path (S.43): Company files before Adjudicating Officer. No need to prove Rahul intended harm. Mere unauthorized access + download = contravention. Compensation awarded based on wrongful loss caused.
Criminal path (S.66): Company files FIR. Prosecution must prove Rahul acted "dishonestly" (intended wrongful gain/loss) or "fraudulently" (intent to deceive). If Rahul was merely curious → S.66 may fail (no mens rea). But if he sold the data to a competitor → both elements satisfied → 3 years + Rs.5 lakhs.
Key takeaway: Same physical act. Civil needs no intent (strict liability). Criminal needs dishonest/fraudulent intent. Company can pursue both simultaneously they are independent proceedings.
Flashcards
What is the maximum punishment under the IT Act?
Life imprisonment under S.66F (cyber terrorism).
What is S.65 IT Act about?
Tampering with computer source documents: concealing, destroying, or altering computer source code when required to be maintained. Punishment: 3 years + Rs.2 lakhs.
What is the difference between S.43 and S.66?
S.43 is civil (compensation, no mens rea required); S.66 criminalizes the same acts when done "dishonestly" or "fraudulently" (requires mens rea).
What is S.67B about?
Publishing or transmitting material depicting children in sexually explicit acts. Punishment: first offence 5 years + Rs.10 lakhs; subsequent 7 years + Rs.10 lakhs.
Why was S.66A unconstitutional?
Vague terms ("grossly offensive," "annoying"), overbroad reach, not within Art.19(2) grounds, chilling effect on free speech. Struck down in Shreya Singhal (2015).
What is S.70 about?
Unauthorized access to "protected system" (Critical Information Infrastructure declared by government). Punishment: 10 years + fine.
What is S.72A?
Disclosure of personal information obtained under lawful contract without consent in breach of that contract. Punishment: 3 years + Rs.5 lakhs.
What is the first cyber stalking case in India?
The Ritu Kohli incident (Delhi, 2001) is usually cited: the accused used her identity in chat rooms and shared her phone number. It was a police case under S.509 IPC with no reported judgment.
Exam Scenario
An employee of a software company, before resigning, deletes critical portions of source code from the company's version control system and corrupts backup files. He had authorized access during employment. Identify applicable provisions.
Acts committed: (1) S.65 IT Act: Tampering with computer source documents. The source code was required to be maintained by the company; destroying/altering it attracts S.65 (3 years + Rs.2 lakhs). (2) S.43(d) + S.66 IT Act: Damage to computer system/data done dishonestly (with intent to cause wrongful loss). Since the employee had authorized access at the time but acted beyond the scope of authorization, the act is still "unauthorized" under S.43 read with S.66. (3) S.43(c): Introducing contaminant (if corruption involved malware). (4) S.378/S.403 BNS: Criminal breach of trust and dishonest misappropriation (if code was company property). (5) Copyright Act S.63B: If source code is copyrighted literary work, destruction/modification may constitute criminal infringement. The company can pursue both: civil compensation (S.43, up to Rs.5 crores) before Adjudicating Officer AND criminal prosecution (S.65, S.66) before criminal court. FIR under S.78 IT Act (cognizable offence).