The IT Act creates two categories of wrongs: civil contraventions (Chapter IX: S.43-45, compensated by Adjudicating Officer) and criminal offences (Chapter XI: S.65-78, prosecuted in criminal courts). The 2008 Amendment significantly expanded criminal provisions by inserting S.66A-66F and S.67A-67C.
Legal Framework
| Chapter | Sections | Nature |
|---|---|---|
| Chapter IX | S.43-47 | Civil contraventions (penalty/compensation) |
| Chapter XI | S.65-78 | Criminal offences (imprisonment + fine) |
Civil Contraventions (S.43-45)
| Section | Contravention | Compensation |
|---|---|---|
| S.43(a) | Unauthorized access to computer system | No statutory cap (Adjudicating Officer: up to Rs.5 crores; beyond that: civil court) |
| S.43(b) | Unauthorized download/copy/extract data | As determined by Adjudicating Officer / court |
| S.43(c) | Introducing virus/contaminant | As determined |
| S.43(d) | Damage to computer/data/database | As determined |
| S.43(e) | Disrupting/denying access (DoS) | As determined |
| S.43(f) | Denying access to authorized person | As determined |
| S.43(g) | Providing assistance to any person to facilitate unauthorized access | As determined |
| S.43(h) | Charging services to another's account | As determined |
| S.43(i) | Destroying/altering source code (when required to be maintained) | As determined |
| S.43(j) | Stealing, concealing, destroying evidence | As determined |
Note: Post-2008 Amendment, S.43 has no upper limit on compensation. The Adjudicating Officer's jurisdiction (S.46(1A)) is limited to claims not exceeding Rs.5 crores. Claims exceeding Rs.5 crores must be filed before a competent court of civil jurisdiction. | S.43A | Body corporate failing to implement reasonable security practices causing wrongful loss | Compensation as determined | | S.44 | Failure to furnish information/returns/documents | Rs.1.5 lakhs per failure; Rs.2 lakhs/day for continuing failure | | S.45 | Residuary penalty | Rs.25,000 per contravention |
Criminal Offences (S.65-78)
| Section | Offence | Punishment |
|---|---|---|
| S.65 | Tampering with computer source documents | 3 years + Rs.2 lakhs fine |
| S.66 | Computer-related offences (dishonestly/fraudulently doing acts under S.43) | 3 years + Rs.5 lakhs fine |
| S.66B | Receiving stolen computer resource/communication device | 3 years + Rs.1 lakh fine |
| S.66C | Identity theft (using another's electronic signature/password/unique ID) | 3 years + Rs.1 lakh fine |
| S.66D | Cheating by personation using computer resource | 3 years + Rs.1 lakh fine |
| S.66E | Violation of privacy (publishing private images without consent) | 3 years + Rs.2 lakhs fine |
| Struck down (Shreya Singhal, 2015) | ||
| S.66F | Cyber terrorism (access + threat to national security) | Life imprisonment |
| S.67 | Publishing/transmitting obscene material | First: 3 years + Rs.5 lakhs; Subsequent: 5 years + Rs.10 lakhs |
| S.67A | Publishing/transmitting sexually explicit material | First: 5 years + Rs.10 lakhs; Subsequent: 7 years + Rs.10 lakhs |
| S.67B | Publishing/transmitting child pornography | First: 5 years + Rs.10 lakhs; Subsequent: 7 years + Rs.10 lakhs |
| S.67C | Intermediary failure to preserve/retain information (as directed) | 3 years + fine |
| S.69 | Failure to comply with direction for interception/monitoring/decryption | 7 years + fine |
| S.69A | Failure to comply with direction to block content | 7 years + fine |
| S.70 | Unauthorized access to protected system (Critical Information Infrastructure) | 10 years + fine |
| S.71 | Misrepresentation to Controller/Certifying Authority | 2 years + Rs.1 lakh fine |
| S.72 | Breach of confidentiality/privacy (information obtained under IT Act powers) | 2 years + Rs.1 lakh fine |
| S.72A | Disclosure of personal information in breach of lawful contract | 3 years + Rs.5 lakhs fine |
| S.73 | Publishing false DSC | 2 years + Rs.1 lakh fine |
| S.74 | Publication for fraudulent purpose | 2 years + Rs.1 lakh fine |
Key Section Analysis
S.66F: Cyber Terrorism
Whoever with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people or any section thereof denies or causes denial of access to any authorized person, or attempts to penetrate or access a computer resource without authorization, or introduces any computer contaminant, and by such conduct causes or is likely to cause death or injuries or damage to property or disruption of essential services or causes contamination of critical infrastructure facilities...
Punishment: Life imprisonment.
Why: Cyber terrorism bridges conventional terrorism and technology. A single act (e.g., compromising power grid controls) can cause mass casualties without physical explosives. Life imprisonment reflects the existential threat to national security.
S.66A: Struck Down
S.66A penalized sending "grossly offensive" or "menacing" messages. In Shreya Singhal v. Union of India (2015), the Supreme Court struck it down as unconstitutional:
- Vague and overbroad (terms like "grossly offensive," "annoying," "inconvenient" lacked definition)
- Violated Art.19(1)(a) (freedom of speech)
- Not saved by Art.19(2) (no reasonable restriction nexus)
- Created chilling effect on free speech
Recall Check
- What is the distinction between S.43 (civil) and S.66 (criminal)?
- Which section carries the heaviest punishment under the IT Act and what is it?
- Why was S.66A struck down?
Key Cases
Shreya Singhal v. Union of India (2015) Shreya-Singhal-v-Union-of-India-2015 Issue: Whether S.66A IT Act (criminalizing "grossly offensive" online messages) violates Art.19(1)(a). Rule: Penal restrictions on speech must be narrowly tailored and fall within Art.19(2) grounds; vague and overbroad provisions creating chilling effect are unconstitutional. Held: S.66A struck down as unconstitutional. Also: S.79 read down (intermediary liability triggered only by court order, not private complaint).
Ritu Kohli Case (2001) Ritu-Kohli-Case-2001 Issue: Whether impersonating a woman in online chatrooms and sharing her phone number leading to harassment constitutes cyber crime. Rule: Using another's identity online to cause harassment constitutes criminal impersonation and invasion of privacy. Held: First cyber stalking case in India. Accused charged under IPC S.509 (now BNS). Led to recognition of cyber stalking as a distinct offence (later S.354D BNS).
Distinctions
| Aspect | S.43 (Civil Contravention) | S.66 (Criminal Offence) |
|---|---|---|
| Nature | Civil (compensation) | Criminal (imprisonment + fine) |
| Mens rea | Not required (strict liability) | Required: "dishonestly" or "fraudulently" |
| Forum | Adjudicating Officer (S.46) | Criminal court |
| Burden of proof | Preponderance of probability | Beyond reasonable doubt |
| Remedy | Compensation up to Rs.5 crores | Imprisonment up to 3 years + Rs.5 lakhs |
| Same act | Same act can attract both | S.66 uses S.43 acts as basis with added intent |
| Appeal | TDSAT (S.57) | Sessions Court / High Court |
Illustration: S.43 (Civil) vs. S.66 (Criminal) Same Act, Two Paths
Scenario: Rahul, an IT employee, accesses his company's HR database without authorization and downloads salary details of all employees.
Civil path (S.43): Company files before Adjudicating Officer. No need to prove Rahul intended harm. Mere unauthorized access + download = contravention. Compensation awarded based on wrongful loss caused.
Criminal path (S.66): Company files FIR. Prosecution must prove Rahul acted "dishonestly" (intended wrongful gain/loss) or "fraudulently" (intent to deceive). If Rahul was merely curious → S.66 may fail (no mens rea). But if he sold the data to a competitor → both elements satisfied → 3 years + Rs.5 lakhs.
Key takeaway: Same physical act. Civil needs no intent (strict liability). Criminal needs dishonest/fraudulent intent. Company can pursue both simultaneously they are independent proceedings.
Flashcards
Q: What is the maximum punishment under the IT Act? A: Life imprisonment under S.66F (cyber terrorism).
Q: What is S.65 IT Act about? A: Tampering with computer source documents: concealing, destroying, or altering computer source code when required to be maintained. Punishment: 3 years + Rs.2 lakhs.
Q: What is the difference between S.43 and S.66? A: S.43 is civil (compensation, no mens rea required); S.66 criminalizes the same acts when done "dishonestly" or "fraudulently" (requires mens rea).
Q: What is S.67B about? A: Publishing or transmitting material depicting children in sexually explicit acts. Punishment: first offence 5 years + Rs.10 lakhs; subsequent 7 years + Rs.10 lakhs.
Q: Why was S.66A unconstitutional? A: Vague terms ("grossly offensive," "annoying"), overbroad reach, not within Art.19(2) grounds, chilling effect on free speech. Struck down in Shreya Singhal (2015).
Q: What is S.70 about? A: Unauthorized access to "protected system" (Critical Information Infrastructure declared by government). Punishment: 10 years + fine.
Q: What is S.72A? A: Disclosure of personal information obtained under lawful contract without consent in breach of that contract. Punishment: 3 years + Rs.5 lakhs.
Q: What is the first cyber stalking case in India? A: Ritu Kohli Case (2001): accused impersonated woman in chatrooms, shared her phone number causing harassment.
Exam Scenario
An employee of a software company, before resigning, deletes critical portions of source code from the company's version control system and corrupts backup files. He had authorized access during employment. Identify applicable provisions.
Acts committed: (1) S.65 IT Act: Tampering with computer source documents. The source code was required to be maintained by the company; destroying/altering it attracts S.65 (3 years + Rs.2 lakhs). (2) S.43(d) + S.66 IT Act: Damage to computer system/data done dishonestly (with intent to cause wrongful loss). Since the employee had authorized access at the time but acted beyond the scope of authorization, the act is still "unauthorized" under S.43 read with S.66. (3) S.43(c): Introducing contaminant (if corruption involved malware). (4) S.378/S.403 BNS: Criminal breach of trust and dishonest misappropriation (if code was company property). (5) Copyright Act S.63B: If source code is copyrighted literary work, destruction/modification may constitute criminal infringement. The company can pursue both: civil compensation (S.43, up to Rs.5 crores) before Adjudicating Officer AND criminal prosecution (S.65, S.66) before criminal court. FIR under S.78 IT Act (cognizable offence).