Cyber Crimes, Penalties and Adjudication

The IT Act does not define "cyber crime" as such. Conceptually, a cyber crime is an unlawful act where a computer or communication device is the target, the tool, or the incidental medium of the offence. Common classifications: (i) crimes against individuals (cyber stalking, identity theft, online harassment, voyeurism, sextortion, defamation); (ii) crimes against property (hacking, data theft, ransomware, phishing, online banking fraud, software piracy); (iii) crimes against organisations/government (cyber terrorism, attacks on critical information infrastructure, unauthorised access to protected systems); (iv) crimes against society (obscenity, child sexual abuse material, hate speech, fake news). The Act draws a distinction between civil contraventions (Sections 43–47: compensation/penalty, adjudicated by an Adjudicating Officer) and criminal offences (Sections 65–78: prosecuted in a criminal court).

Section 43 (penalty and compensation for damage to computer, computer system, etc.): if any person without permission of the owner or any other person in charge of a computer, computer system or computer network does any of the following, he is liable to pay damages by way of compensation to the person so affected:

• (a) accesses or secures access to the computer/system/network/resource;

• (b) downloads, copies or extracts any data, database or information, including information held or stored in any removable storage medium;

• (c) introduces or causes to be introduced any computer contaminant or computer virus;

• (d) damages or causes damage to any computer, system, network, data, database or programmes;

• (e) disrupts or causes disruption;

• (f) denies or causes denial of access to any authorised person (denial-of-service);

• (g) provides any assistance to any person to facilitate access in contravention of the Act;

• (h) charges the services availed of by a person to the account of another person by tampering or manipulating;

• (i) destroys, deletes or alters any information residing in a computer resource, or diminishes its value or utility, or affects it injuriously by any means;

• (j) steals, conceals, destroys or alters any computer source code used for a computer resource with an intention to cause damage.

(Since the 2008 Amendment there is no cap on compensation under Section 43; the ₹1 crore cap was removed.)

• Section 43A (2008): a body corporate possessing, dealing or handling sensitive personal data or information in a computer resource that it owns, controls or operates, which is negligent in implementing and maintaining reasonable security practices and procedures, is liable to pay damages by way of compensation to the person affected (the 2011 SPDI Rules prescribe standards, e.g. ISO/IEC 27001). This provision is to be omitted by the DPDP Act 2023 upon commencement (Section 44(2) of the DPDP Act).

• Section 44: penalty for failure to furnish information, return or books: up to ₹1.5 lakh for failure to furnish document/return/report to the Controller or CA; ₹5,000 per day for failure to file return within the time; ₹10,000 per day for failure to maintain books of account/records.

• Section 45 (residuary penalty): contravention of any rule/regulation for which no penalty is provided: compensation not exceeding ₹25,000 to the affected person (or penalty not exceeding ₹25,000).

• Section 47: factors the adjudicating officer considers: amount of gain of unfair advantage (where quantifiable), amount of loss caused to any person, and the repetitive nature of the default.

• Section 46: the Central Government appoints an Adjudicating Officer (AO) for contraventions under Chapter IX. The AO must be of the rank of Director in the Government of India or equivalent (State Government: Secretary of IT Department), and must possess IT and legal experience. Section 46(1A): the AO's jurisdiction extends to claims for injury or damage not exceeding ₹5 crore; above that, the civil court has jurisdiction. The AO exercises the powers of a civil court (summons, discovery, evidence) and proceedings are deemed judicial proceedings.

• Section 48 (Cyber Appellate Tribunal) and Section 57: an appeal from the AO's order lies to the Cyber Appellate Tribunal (CAT), within 45 days. The CAT was merged into the Telecom Disputes Settlement and Appellate Tribunal (TDSAT) by the Finance Act 2017; TDSAT now hears these appeals.

• Section 62: appeal to the High Court from the Tribunal's decision within 60 days on any question of fact or law.

• Section 61: civil court jurisdiction is barred in matters within the AO's/CAT's powers.

• Section 64: recovery of penalty as arrears of land revenue.

• Section 63: compounding of contraventions by the Controller/AO.

• Illustrative adjudication: Umashankar Sivasubramanian v. ICICI Bank (Tamil Nadu AO, 2010): first major adjudication under Section 46, a phishing victim was awarded compensation, finding the bank negligent in security.

Other key criminal-procedure provisions

• Section 75: extra-territorial operation: offences committed outside India by any person if the act involves a computer, system or network located in India.

• Section 76: confiscation of computer, system, floppies, CDs or any accessory in respect of which the Act has been contravened.

• Section 77: compensation, penalties or confiscation do not preclude other punishments under any other law.

• Section 77A: compounding of offences by a competent court (except offences for which punishment of life or imprisonment exceeding 3 years is provided, for repeat offenders, or offences affecting the socio-economic conditions of the country or committed against a child below 18 or a woman).

• Section 77B: offences punishable with imprisonment of 3 years and above are cognizable and offences punishable with imprisonment of 3 years are bailable.

• Section 78: investigation by a police officer not below the rank of Inspector.

• Section 80: a police officer not below Inspector (or other authorised officer) may enter any public place, search and arrest without warrant any person reasonably suspected of having committed or being about to commit an offence under the Act.

• Section 81: overriding effect of the Act, with the proviso (2008) that nothing in the Act restricts rights of any person to exercise any right under the Copyright Act 1957 or the Patents Act 1970.

• Section 85: offences by companies (liability of persons in charge).

• Section 69: power to issue directions for interception, monitoring or decryption by the Central/State Government (the competent authority) in the interest of sovereignty or integrity of India, defence, security of the State, friendly relations with foreign states, public order, or for preventing incitement to the commission of any cognizable offence, or for investigation of any offence. Subject to the IT (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules 2009. (Compare Section 5(2) of the Indian Telegraph Act and PUCL v. Union of India (1997), which set safeguards for telephone tapping.)

• Section 69A: power to block public access to information on grounds similar to Article 19(2); Blocking Rules 2009 (reviewing committee; procedure). Upheld in Shreya Singhal as it has procedural safeguards and reasons recorded in writing.

• Section 69B: monitoring and collection of traffic data to enhance cyber security.

• Section 70: declaration of any computer resource that directly or indirectly affects the facility of Critical Information Infrastructure (CII) as a protected system; Section 70A: the National Nodal Agency for CII protection (the NCIIPC, established 2014 under the NTRO); Section 70B: Indian Computer Emergency Response Team (CERT-In) as the national agency for incident response; CERT-In Directions of 28 April 2022 require reporting of cyber incidents within 6 hours, maintenance of logs for 180 days, and synchronisation of clocks with NIC/NPL servers.

• Other institutions: Indian Cyber Crime Coordination Centre (I4C) under the MHA (2018), the National Cyber Crime Reporting Portal (cybercrime.gov.in) and helpline 1930; National Cyber Security Policy 2013.

Cyber offences are frequently charged together with offences in the Bharatiya Nyaya Sanhita 2023 (BNS), which replaced the IPC on 1 July 2024 (with the BNSS 2023 replacing the CrPC and the BSA 2023 replacing the Evidence Act). Examples (old → new; verify section numbers against the bare Act before the exam):

The POCSO Act 2012 (Sections 13–15) overlaps with Section 67B IT Act. Sharat Babu Digumarti v. Government of NCT of Delhi (SC 2016) held that because the IT Act is a special law with a non-obstante clause (Section 81), a person cannot be prosecuted under both Section 67 IT Act and IPC Section 292 for the same electronic obscenity (a classic overriding-effect case).

• BNS/BNSS/BSA 2023 (in force 1 July 2024): the new codes recognise electronic records as documents and evidence, e-FIR, electronic summons, audio-video recording of searches, and include organised crime (including cyber crime) in BNS Section 111.

• DPDP Act 2023 and DPDP Rules 2025: a new data-protection regime replacing Section 43A (verify commencement dates for each phase).

• CERT-In Directions 2022: 6-hour incident reporting, 180-day log retention.

• IT Rules 2021 (as amended): SSMI obligations, grievance redressal, Grievance Appellate Committees (2022), and the 2023 amendments for online gaming, followed by the Promotion and Regulation of Online Gaming Act 2025.

• Deepfakes and synthetic media: MeitY advisories (2023–24) and proposals to require labelling of AI-generated content under the IT Rules (verify whether notified); courts have granted personality-rights injunctions.

• Digital arrest scams, UPI fraud, sextortion: growing prosecutions under Sections 66C, 66D, 66E, 67, and BNS 318/319; I4C and portal 1930.

• International: the Budapest Convention on Cybercrime (2001): India is not a party; the UN Convention against Cybercrime was adopted by the UN General Assembly in December 2024 (signature opened in 2025; verify India's position).

• Proposed Digital India Act (to replace the IT Act 2000) has been discussed but, as of the last reliable information, not enacted (verify).

Quick facts for revision (Section 10). Section 43 (civil, compensation) vs 66 (criminal, "dishonestly or fraudulently"). 43A: body corporate; 46: AO (≤ ₹5 crore); appeal to TDSAT within 45 days; High Court within 60 days. 65: 3 yrs/₹2 lakh; 66: 3 yrs/₹5 lakh; 66C/66D: 3 yrs + ₹1 lakh; 66E: 3 yrs/₹2 lakh; 66F: life; 67: 3 yrs/₹5 lakh then 5 yrs/₹10 lakh; 67A/67B: 5 yrs/₹10 lakh then 7 yrs; 69/69A: 7 yrs; 70: 10 yrs; 72A: 3 yrs/₹5 lakh. 66A struck down (2015). Section 77B: 3 years and above cognizable; exactly 3 years bailable. Investigating officer: Inspector (Section 78).