Chapter 10: Cyber Laws, Safety and Security in India
On an ordinary Tuesday evening, a Class XI student receives a message on her phone. It appears to come from her bank, warns her that her account will be blocked within the hour, and carries a link asking her to confirm her details. She taps it, types in what it asks for, and within two minutes eighteen thousand rupees has left her mother’s account. Nobody broke a lock. Nobody entered a house. Nobody was even in the same state.
The next morning, her family wants to file a complaint. Immediately, three questions appear. Which police station has the case, when the person who sent the message may be sitting a thousand kilometres away, or outside India altogether? What exactly is the offence, when nothing was physically taken and no one was physically present? And what is the evidence, when it is not a signed paper or a torn lock but a line of data sitting on a server nobody in the family can see?
Ordinary criminal law was written for a world of physical places, physical acts and physical proof. The internet has none of those. This chapter is about the body of law that grew up to fill that gap — what cyberspace is, what makes an act a cyber crime, and how India chose to regulate it.
Fig. 10.0 – Cyber crime across jurisdictions.
This chapter will answer each of these questions.
10.1 Introduction: The Internet and Cyberspace
We live in a world where technology moves forward almost daily. New digital tools keep appearing, and each one gives people fresh ways to connect, talk, learn and trade with others anywhere on the planet. Almost every one of those opportunities rests on a single foundation: the Internet.
It helps to be exact about what the Internet actually is. It is not one machine, one company or one wire. A network is simply a group of computers linked together so that they can share information. The Internet is the architecture that allows countless such networks, all over the world, to join up and talk to one another.
That single idea — networks joined to networks — explains why a message typed on a phone in one country can reach a server in another within seconds, as shown in Fig. 10.1.
Fig. 10.1 – The Internet as an interconnected system of networks.
From Network to Cyberspace
Once these networks are joined, something more than wires comes into being. People interact through them, software runs across them, and services operate on them. This computer-generated world of interaction between people, software and services is called cyberspace.
Cyberspace has three qualities worth holding on to. It is dynamic, because it changes constantly. It is exponential, because it grows at a rate far faster than steady addition. And it is undefined, because it has no fixed boundary, no map and no edge you can point to.
That last quality is the one that will matter most as this chapter goes on. Law usually works on territory — a place where an act happened, a court that governs that place. Cyberspace supplies no such place, which is exactly why it needed rules written specially for it.
As information multiplies and the Internet becomes larger and more complex, keeping these systems running correctly and continuously stops being a convenience and becomes critical. That is the point at which safety and security enter the picture — and that is where the next section begins.
10.2 Cyber Safety and Security
Cyber safety means using information and communication technology — phones, computers, apps, networks and the services running on them — in a way that is both safe and responsible.
Two Halves of the Idea
Notice that the definition has two halves, and students usually remember only the first. One half is protective: keeping your information safe and secure. The other half is about conduct: being responsible with that information, and being respectful of other people online.
A person who guards her own password carefully but forwards someone else’s private photograph has met the first half and failed the second. Cyber safety covers both.
How Safety and Security Are Ensured
Two things working together produce cyber safety and security. The first is law — Parliament enacting rules that state what may not be done online and what follows if it is done. The second is practical protection: technologies, processes and practices designed to protect networks, computers, programs and data from attack, damage or unauthorised access.
Neither works alone. A law without technical protection cannot stop an attack while it is happening; technical protection without law cannot punish the attacker afterwards or compensate the victim. This is why the rest of this chapter deals with both — the conduct the law expects, and the statute that enforces it.
10.3 Cyber Crime
Cyber crime refers to an activity done with criminal intent in cyberspace. Put more simply, any offence or crime in which a computer is used is a cyber crime.
How Far the Term Reaches
The reach of this idea is wider than students first assume. Even a petty offence such as stealing can be brought within the broader purview of cyber crime, provided the basic data or the aid to that offence is a computer, or information stored in a computer, used or misused by the fraudster.
The test, then, is not whether the offence sounds futuristic. It is whether the computer or the stored information did real work in committing it.
Whom Cyber Crimes Are Committed Against
Cyber crimes can be committed against persons, against property, or against government. Common examples include the following.
- Cyber stalking — repeatedly following, watching or contacting a person online in a way that causes fear or distress.
- Computer vandalism — damaging or destroying computers, systems or the data held in them.
- Stealing of data — taking information stored electronically without authority.
- Hacking — gaining access to a computer or network without permission.
- Phishing — tricking a person into revealing personal details by pretending to be a trustworthy organisation.
- Mail fraud — using email to deceive a person into parting with money or information.
A Term the Law Does Not Define
Here is something surprising, and worth remembering. The term “cybercrime” is not defined in the Information Technology Act, 2000. It is not defined in the National Cyber Security Policy, 2013 either, nor in any other regulation in India.
So the definition given at the start of this section is a working description, drawn from how the term is used, rather than a statutory definition you can point to in a section of an Act. Section 10.7 shows where the meaning has come from instead.
10.4 Cyber Law
Cyber law deals with the legal issues that arise from the use of inter-networked information technology. It sets out the legal rights people have when they use that technology, and the restrictions they are under. In short, cyber law is the law governing computers and the internet.
The phrase “rights and restrictions” is worth pausing on, because it captures both directions in which cyber law works. It gives you something — the right to have an electronic contract treated as real, the right to have your data protected. It also takes something away — the freedom to do online whatever you please.
What Cyber Law Covers
Cyber law is not a single narrow subject. It encompasses laws relating to the following areas.
- Cyber crimes — the offences described in section 10.3, and the punishment attached to them.
- Electronic and digital signatures — the rules that decide when a signature made electronically is treated as valid, so that agreements can be signed without paper.
- Intellectual property — the protection of creative and inventive work that now circulates almost entirely online, such as software, music, writing and designs.
- Data protection and privacy — the rules governing how information about a person may be collected, stored, used and shared.
Why Cyber Law Became Necessary
The internet was not built as a regulated space. It was developed initially as a research and information-sharing tool, and for a long time it ran in an unregulated manner. When the traffic on a network is scientists exchanging findings, there is little for law to do.
That changed as the internet became transactional. Money began to move across it, and with it business and government: e-business, e-commerce, e-governance and e-procurement. Once real value is being transferred, real disputes follow — a payment not delivered, a signature denied, a record altered — and every one of them needs a legal answer.
All legal issues relating to internet crime are dealt with through cyber laws. And as the number of internet users continues to rise, the need for cyber laws and their application has gathered great momentum.
10.5 Cyber Law in India
In India, cyber laws are contained in the Information Technology Act, 2000. The Act was passed in the year 2000 and came into force on October 17, 2000.
One statute, then, carries the weight of this whole subject in India. When a question asks which law governs computers and the internet in India, this is the answer.
What the Act Was Meant to Do
The main purpose of the Act is easier to grasp if you picture what business looked like before it. A contract meant paper. A signature meant ink. A document filed with a government office meant a physical file crossing a counter. None of that could simply be moved online, because the law of the time had no reason to treat an electronic record as equal to a paper one.
The Act closed that gap. It provides legal recognition for transactions carried out by means of electronic data interchange and other means of electronic communication — what is commonly referred to as electronic commerce. It also facilitates the filing of electronic records with the Government.
Notice what this tells you about the Act’s original character. It was written first as an enabling law — a law that makes electronic dealing possible — and only secondly as a law that punishes. The offences came into the picture as a necessary consequence of putting real transactions online.
10.6 History of Cyber Law in India
India did not arrive at the Information Technology Act, 2000 on its own. The starting point lies four years earlier, and outside India altogether.
In 1996, the United Nations Commission on International Trade Law (UNCITRAL) adopted the Model Law on Electronic Commerce, with the object of bringing uniformity to the law on this subject in different countries.
What a Model Law Is
A model law is not a treaty and does not bind anyone. It is a carefully drafted template that a country may adopt, adapt or ignore. Its power lies in imitation: if enough countries build their statutes on the same template, traders in those countries end up dealing under compatible rules.
That is precisely the problem the 1996 Model Law was written to solve. Electronic commerce crosses borders by nature, and a seller in one country cannot function if her electronic contract is valid at home and worthless at the buyer’s end.
What the Model Law Aims to Do
The Model Law on Electronic Commerce aims to enable and facilitate commerce conducted by electronic means. It does this by providing countries with a set of universally acceptable rules, aimed at removing legal obstacles and increasing legal predictability for electronic commerce.
Its central device is equal treatment — the principle that an electronic record or communication should not be denied validity merely because it is electronic rather than written on paper. That single idea is what makes paperless communication workable, and it is essential for fostering efficiency in international trade.
India’s Own Statute
India passed the Information Technology Act, 2000 against this background. With that Act, India became the 12th country to enable cyber law.
Read section 10.5 again with this history in view, and the shape of the Act makes sense. Its main purpose is legal recognition of electronic transactions, because that is exactly what the Model Law set out to achieve.
10.7 Scope or Extent of the Information Technology Act, 2000
Every statute has to answer two questions before it can be applied: where does it operate, and what do its key words mean? This section answers both for the Information Technology Act, 2000.
Where the Act Operates
The Information Technology Act, 2000 extends to the whole of India. That much is ordinary. What follows is not.
The Act also applies to any offence or contravention committed outside India, by any person, irrespective of his nationality — provided that the offence or contravention involves a computer, computer system or computer network located in India.
Read that condition carefully, because everything turns on it. The location of the offender does not matter. The nationality of the offender does not matter. What matters is that a computer, computer system or network situated in India was involved.
This is called extra-territorial operation, and the reason for it is obvious once you recall section 10.1. Cyberspace is undefined and has no borders. A law that stopped at the national boundary would be useless against exactly the people most likely to attack systems in India.
‘Cybersecurity’ Under the Act
The Act itself defines cybersecurity, and the definition is broader than the word suggests. It covers not merely information but the physical equipment that holds it, and it covers six distinct kinds of interference.
Notice that unauthorised access is only the first of the six. A person who does not steal anything, does not damage anything, and merely reads what he had no authority to read has still breached cybersecurity, because unauthorised use and disclosure are named alongside access. So has a person who leaves the data untouched but shuts the system down, because disruption counts too.
Where the Meaning of ‘Cybercrime’ Comes From
Section 10.3 noted that no Indian statute defines “cybercrime”. The meaning has therefore come from two other places.
The first is the National Cyber Crime Reporting Portal, a body set up by the government to facilitate the reporting of cybercrime complaints. It takes cybercrime to mean any unlawful act where a computer, or a communication device, or a computer network is used to commit or facilitate the commission of a crime.
The second is the courts. Indian courts have also recognised the term — for example, the Gujarat High Court in Jaydeep Vrujlal Depani v State of Gujarat, R/SCR.A/5708/2018 Order. The meaning adopted there is narrower in one respect and wider in another: it speaks of offences committed against individuals or groups of individuals with a criminal motive to intentionally harm the reputation of the victim, or to cause physical or mental harm or loss to the victim, directly or indirectly, using modern telecommunication networks such as the Internet — including chat rooms, emails, notice boards and groups — and mobile phones, whether through Bluetooth, SMS or MMS.
The difference between the two is worth seeing. The portal’s meaning is built around the instrument used; the court’s is built around the motive and the harm caused.
10.8 The Journey of Section 66A: Shreya Singhal v. Union of India
Most of this chapter has described law being built. This section describes law being unbuilt — a provision that Parliament inserted, that police used for six years, and that the Supreme Court then removed from the statute book altogether.
The case is Shreya Singhal v. Union of India, AIR 2015 SC 1523, and the provision is Section 66A of the Information Technology Act, 2000.
The Journey in Dates
The whole story fits into seven years, and it is easiest to follow as a sequence, as set out in Fig. 10.2.
- 22.12.2008 — the Information Technology (Amendment) Bill was passed in the Lok Sabha.
- 23.12.2008 — the Bill was passed in the Rajya Sabha.
- 27.10.2009 — the Information Technology Amendment Act, 2008 came into force.
- 2012 — a Public Interest Litigation was filed by Shreya Singhal challenging the constitutionality of Section 66A of the Act.
- 09.01.2013 — the Central Government issued an advisory prohibiting any arrest under Section 66A unless the arrest was approved by a senior police officer, not below the rank of Inspector General of Police in metropolitan areas or Superintendent of Police at the district level.
- 24.03.2015 — the Supreme Court, in Shreya Singhal v. Union of India, declared Section 66A of the Act unconstitutional.
Fig. 10.2 – The legislative and judicial timeline of Section 66A.
The 2013 advisory in point 5 deserves a second look. A government does not normally instruct the police to seek an Inspector General’s approval before making an arrest. That step was taken because the section was already being used in ways that were causing public disquiet — which tells you the trouble was visible well before the Court acted.
What Section 66A Was
Section 66A of the Information Technology Act, 2000 made it a punishable offence for any person to send “grossly offensive” or “menacing” information using a computer resource or a communication device.
In plain terms, it criminalised the sending of offensive messages through a computer or other communication device.
Why It Was Inserted
Section 66A was not part of the original Act. It was inserted by way of an amendment in the year 2009.
The reason behind the amendment was to address new forms of cyber crime that had appeared since 2000. These included publishing sexually explicit material in electronic form; video voyeurism; breach of confidentiality and the leakage of data by an intermediary; e-commerce frauds such as personation, commonly known as phishing; identity theft; and offensive messages sent through communication services.
The purpose, then, was not sinister. Parliament was responding to real harms. The difficulty lay in how the response was drafted.
The Words of the Section
Read the words the section turns on and ask yourself who decides them. Grossly offensive. Menacing character. Annoyance. Inconvenience. Insult. Ill will. Not one of these is measurable, and a message that annoys one reader may amuse another. That is the seed of everything that followed.
The Challenge in 2012
In the year 2012, in the matter of Shreya Singhal v. Union of India, a batch of writ petitions was filed under Article 32 of the Indian Constitution. Article 32 is itself a Fundamental Right — the right to move the Supreme Court directly when a Fundamental Right has been infringed.
The petitions raised an important question relating primarily to the fundamental right of free speech and expression guaranteed by Article 19 of the Constitution of India. The immediate cause for concern in these petitions was Section 66A of the Information Technology Act, 2000.
The petitioners made two arguments. First, that the wording of the section was too wide and ambiguous, and that most of the terms used in it had not been specifically defined under the Act. Second, that the section waived off the right to free speech and expression prescribed under Article 19(1)(a) of the Indian Constitution.
It helps to know what the second argument is really claiming. The freedom under Article 19(1)(a) has never been absolute; the Constitution itself permits reasonable restrictions on stated grounds. So the question before the Court was not whether online speech may ever be restricted. It was whether a section drafted in these words amounted to a reasonable restriction at all — or whether it swept up so much lawful speech that it destroyed the freedom instead of limiting it.
What the Supreme Court Decided
On March 24, 2015, the Supreme Court struck down Section 66A of the Information Technology Act, 2000 and declared it unconstitutional for being violative of Article 19(1)(a) of the Constitution of India.
Two consequences follow, and students frequently confuse them. The first is that Section 66A no longer exists as enforceable law; a person cannot be prosecuted under it for anything. The second is that this did not leave the internet unregulated — the rest of the Information Technology Act, 2000 stands, and other provisions and other statutes continue to apply to online conduct.
10.9 Summary
- The Internet is a system architecture that has transformed communication and commerce by allowing computer networks around the world to interconnect.
- Cyberspace is the computer-generated world of the Internet, in which people, software and services interact with one another.
- Cyberspace has three defining qualities:
- it is dynamic, because it changes constantly;
- it is exponential, because it grows far faster than by steady addition;
- it is undefined, because it has no fixed boundary or territory.
- Cyber safety is the safe and responsible use of information and communication technology.
- Cyber safety covers two things — keeping information safe and secure, and being responsible with that information and respectful of other people online.
- Cyber safety and security are ensured both by enacting laws and by using technologies, processes and practices designed to protect networks, computers, programs and data from attack, damage or unauthorised access.
- A cyber crime is an activity done with criminal intent in cyberspace; in short, any offence or crime in which a computer is used.
- Even a petty offence such as stealing falls within the broader purview of cyber crime if the basic data or the aid to that offence is a computer, or information stored in a computer, used or misused by the fraudster.
- Cyber crimes may be committed against persons, against property, or against government.
- Examples of cyber crime include cyber stalking, computer vandalism, stealing of data, hacking, phishing and mail fraud.
- The term “cybercrime” is not defined in the Information Technology Act, 2000, nor in the National Cyber Security Policy, 2013, nor in any other regulation in India.
- Cyber law deals with legal issues relating to the use of inter-networked information technology, and provides the legal rights and restrictions governing that technology.
- Cyber law encompasses laws relating to:
- cyber crimes;
- electronic and digital signatures;
- intellectual property;
- data protection and privacy.
- The Internet was developed initially as a research and information-sharing tool in an unregulated manner, and the need for cyber law grew as it became transactional through e-business, e-commerce, e-governance and e-procurement.
- In India, cyber laws are contained in the Information Technology Act, 2000, which came into force on October 17, 2000.
- The main purpose of the Act is to give legal recognition to transactions carried out by electronic data interchange and other means of electronic communication — commonly called electronic commerce — and to facilitate the filing of electronic records with the Government.
- In 1996, the United Nations Commission on International Trade Law (UNCITRAL) adopted the Model Law on Electronic Commerce to bring uniformity in the law of different countries.
- The Model Law aims to enable and facilitate electronic commerce by giving countries universally acceptable rules that remove legal obstacles and increase legal predictability.
- The Model Law provides for equal treatment, which is essential for paperless communication and for efficiency in international trade.
- India became the 12th country to enable cyber law after it passed the Information Technology Act, 2000.
- The Information Technology Act, 2000 extends to the whole of India.
- The Act also applies to an offence or contravention committed outside India by any person, irrespective of nationality, provided the offence or contravention involves a computer, computer system or network located in India.
- Under the Act, ‘cybersecurity’ means protecting information, equipment, devices, computers, computer resources, communication devices and information stored therein from unauthorised access, use, disclosure, disruption, modification or destruction.
- The National Cyber Crime Reporting Portal takes cybercrime to mean any unlawful act where a computer, communication device or computer network is used to commit or facilitate the commission of a crime.
- Indian courts have also recognised cybercrime, as the Gujarat High Court did in Jaydeep Vrujlal Depani v State of Gujarat, R/SCR.A/5708/2018 Order, describing it in terms of criminal motive and harm caused to the victim through modern telecommunication networks and mobile phones.
- Section 66A was inserted into the Information Technology Act, 2000 by an amendment in 2009, to address new forms of cyber crime such as publishing sexually explicit material in electronic form, video voyeurism, breach of confidentiality and leakage of data by an intermediary, e-commerce frauds such as personation commonly known as phishing, identity theft, and offensive messages through communication services.
- Section 66A made it a punishable offence to send grossly offensive or menacing information by means of a computer resource or a communication device, punishable with imprisonment which may extend to three years and with fine.
- The journey of Section 66A ran through six stages:
- the Information Technology (Amendment) Bill was passed in the Lok Sabha on 22.12.2008;
- it was passed in the Rajya Sabha on 23.12.2008;
- the Information Technology Amendment Act, 2008 came into force on 27.10.2009;
- a Public Interest Litigation was filed by Shreya Singhal in 2012 challenging the constitutionality of Section 66A;
- on 09.01.2013 the Central Government issued an advisory prohibiting arrest under Section 66A without the approval of a senior police officer, not below the rank of Inspector General of Police in metropolitan areas or Superintendent of Police at the district level;
- on 24.03.2015 the Supreme Court declared Section 66A unconstitutional.
- In Shreya Singhal v. Union of India, AIR 2015 SC 1523, a batch of writ petitions was filed under Article 32 of the Constitution, the petitioners arguing that the wording of Section 66A was too wide and ambiguous, that its terms were not defined under the Act, and that it waived off the right to free speech and expression under Article 19(1)(a).
- On March 24, 2015 the Supreme Court struck down Section 66A of the Information Technology Act, 2000 and declared it unconstitutional for being violative of Article 19(1)(a) of the Constitution of India.
10.10 Key Terms
Internet — a system architecture that allows computer networks around the world to interconnect, transforming communication and commerce.
Network — a group of computers linked together so that they can share information.
Cyberspace — the computer-generated world of the Internet, in which people, software and services interact with one another.
Dynamic — a quality of cyberspace: it changes constantly.
Exponential — a quality of cyberspace: it grows far faster than by steady addition.
Undefined — a quality of cyberspace: it has no fixed boundary, map or territory.
Cyber safety — the safe and responsible use of information and communication technology.
Cyber crime — an activity done with criminal intent in cyberspace; any offence or crime in which a computer is used.
Cyber stalking — repeatedly following, watching or contacting a person online in a way that causes fear or distress.
Computer vandalism — damaging or destroying computers, computer systems or the data held in them.
Stealing of data — taking electronically stored information without authority.
Hacking — gaining access to a computer or network without permission.
Phishing — the fraudulent practice of sending emails that appear to come from reputable companies in order to induce individuals to reveal personal information, such as passwords and credit card numbers.
Mail fraud — using email to deceive a person into parting with money or information.
Cyber law — the body of law dealing with legal issues arising from the use of inter-networked information technology, providing the legal rights and restrictions governing that technology.
Electronic and digital signatures — the rules that decide when a signature made electronically is treated as valid, so that agreements may be signed without paper.
Intellectual property — the protection given to creative and inventive work, such as software, music, writing and designs.
Data protection and privacy — the rules governing how information about a person may be collected, stored, used and shared.
Electronic commerce — commerce carried out by means of electronic data interchange and other means of electronic communication.
Information Technology Act, 2000 — the statute in which India’s cyber laws are contained, which came into force on October 17, 2000.
United Nations Commission on International Trade Law (UNCITRAL) — the United Nations body that adopted the Model Law on Electronic Commerce in 1996.
Model Law on Electronic Commerce — a template law adopted by UNCITRAL in 1996 to bring uniformity to the law on electronic commerce in different countries.
Model law — a drafted template that a country may adopt, adapt or ignore, binding on no one until enacted.
Equal treatment — the principle that an electronic record or communication should not be denied validity merely because it is electronic rather than on paper.
Cybersecurity — under the Information Technology Act, 2000, protecting information, equipment, devices, computers, computer resources, communication devices and information stored therein from unauthorised access, use, disclosure, disruption, modification or destruction.
Extra-territorial operation — the application of a statute to acts committed outside the country, here where a computer, computer system or network located in India is involved.
National Cyber Crime Reporting Portal — a body set up by the government to facilitate the reporting of cybercrime complaints, whose description of cybercrime is widely relied on.
Section 66A — the provision inserted into the Information Technology Act, 2000 in 2009 punishing the sending of grossly offensive or menacing information by a computer resource or communication device, struck down in 2015.
Public Interest Litigation — proceedings brought before a court in the interest of the public rather than only for the personal benefit of the petitioner.
Writ petition — a petition filed in a constitutional court seeking a remedy for the infringement of a right, filed before the Supreme Court under Article 32.
Unconstitutional — inconsistent with the Constitution, and therefore void and unenforceable as law.
10.11 Points to Ponder
Cyberspace is described as “undefined” because it has no borders. If law has always worked on territory, on what basis should a country claim the authority to punish an act done on a server thousands of kilometres away?
The Information Technology Act, 2000 applies to a person outside India who involves a computer located in India. Making that claim is one thing; enforcing it is another. What practical difficulties would a victim in India face, and does a right that is hard to enforce still serve a purpose?
Cyber safety asks a person not only to protect her own information but to be respectful of others online. Should conduct of that kind be left to individual judgement, or is there a point at which the law should step in?
Parliament has never defined “cybercrime” in any statute, and the meaning has come instead from a government portal and from judicial decisions. Is leaving a term undefined a weakness in the law, or does it give the law room to grow with the technology?
Section 66A was inserted to deal with genuine harms — voyeurism, identity theft, data leaks, abusive messages. Those harms did not disappear when the section was struck down. How should a legislature write a provision that reaches the harm without reaching lawful speech?
The Supreme Court held that the terms used in Section 66A were too wide and ambiguous. Why does vagueness in a criminal provision matter so much, even before anyone is actually prosecuted under it?
In 2013 the Government told the police to obtain a senior officer’s approval before making an arrest under Section 66A. Was that an adequate response to the problem, and what does it suggest about the difference between how a law is written and how it is used?
India modelled its cyber law on a template drafted by an international body. What is gained when countries adopt similar rules for the internet, and what might be lost when a template drafted elsewhere is adopted at home?
10.12 Textbook Questions
Based on your understanding, answer the following questions:
- Answer the following questions briefly:
- Explain the importance of cyber laws in current times.
- What are the various categories of cyber crime? Give examples.
- What is cyber bullying? How does it take place?
- Answer the following questions in about 150 words:
- Trace the evolution of cyber laws in India.
- Critically analyse the importance of Section 66A of the Information Technology Act, 2000.
10.13 Objective Questions
The Information Technology Act, 2000 came into force on:
- 17 October 2000
- 27 October 2009
- 24 March 2015
- 22 December 2008
The Model Law on Electronic Commerce was adopted in 1996 by:
- the World Trade Organization
- the United Nations Commission on International Trade Law
- the International Court of Justice
- the National Cyber Crime Reporting Portal
Section 66A of the Information Technology Act, 2000 was struck down for being violative of:
- Article 14
- Article 19(1)(a)
- Article 21
- Article 32
The petitions in Shreya Singhal v. Union of India were filed before the Supreme Court under:
- Article 19
- Article 32
- Article 226
- Article 136
Which of the following is NOT one of the qualities of cyberspace described in this chapter?
- Dynamic
- Exponential
- Territorial
- Undefined
The punishment prescribed by Section 66A of the Information Technology Act, 2000 was imprisonment which may extend to:
- one year and fine
- two years and fine
- three years and fine
- five years and fine
Fill in the blank: The term “cybercrime” is not defined in the Information Technology Act, 2000, nor in the ____________ Policy, 2013.
Fill in the blank: India became the ____________ country to enable cyber law after it passed the Information Technology Act, 2000.
State whether true or false: The Information Technology Act, 2000 applies only to offences committed within the territory of India.
State whether true or false: Section 66A was part of the Information Technology Act, 2000 as originally enacted.
Match the items in Column A with those in Column B. | Column A | Column B | |—|—| | a. Phishing | i. Gaining access to a computer or network without permission | | b. Computer vandalism | ii. Repeatedly contacting or watching a person online so as to cause fear | | c. Hacking | iii. Posing as a trustworthy organisation to obtain personal details | | d. Cyber stalking | iv. Damaging or destroying computers, systems or the data in them |
Assertion (A): The Information Technology Act, 2000 can apply to a person who has never set foot in India. Reason (R): The Act applies to an offence or contravention committed outside India by any person, irrespective of nationality, provided it involves a computer, computer system or network located in India.
Assertion (A): Section 66A of the Information Technology Act, 2000 was struck down because Parliament had no power to restrict speech on the internet. Reason (R): The petitioners argued that the wording of Section 66A was too wide and ambiguous, and that most of the terms used in it had not been defined under the Act.
Assertion (A): A person who merely reads a file she has no authority to read has breached cybersecurity as the Information Technology Act, 2000 defines it. Reason (R): The Act’s definition of cybersecurity covers protection from unauthorised access, use, disclosure, disruption, modification or destruction.
Give the full form of UNCITRAL.
10.14 Check Your Concepts
Define cyberspace, and explain why it is described as “undefined”.
Distinguish between cyber safety and cyber security on any three bases.
A student protects her own password carefully but forwards a classmate’s private photograph to a group. Has she complied with the idea of cyber safety? Give reasons for your answer.
Why is it said that laws alone cannot ensure cyber safety and security? What must accompany them, and why?
State the test for deciding whether an ordinary offence such as theft falls within the broader purview of cyber crime.
Cyber crimes may be committed against persons, property or government. Give one example of each and explain your classification.
Why is it significant that no Indian statute defines the term “cybercrime”? From where has the meaning of the term been drawn instead?
Distinguish between the meaning of cybercrime adopted by the National Cyber Crime Reporting Portal and the meaning recognised by the Gujarat High Court in Jaydeep Vrujlal Depani v State of Gujarat.
State the four areas of law that cyber law encompasses, and explain briefly why each of them became necessary once the internet turned transactional.
Why did the Internet need almost no legal regulation in its early years, and what changed?
Explain the principle of equal treatment under the Model Law on Electronic Commerce. What would happen to international trade if this principle were not accepted?
A model law binds no country until it is enacted. Why then did the adoption of the Model Law on Electronic Commerce in 1996 matter so much to a country like India?
State the six kinds of interference from which the Information Technology Act, 2000 protects information and equipment under its definition of ‘cybersecurity’.
Explain the extra-territorial operation of the Information Technology Act, 2000, and state the one condition on which it depends.
Correct the error in each of the following statements, and state the correct position.
- The Information Technology Act, 2000 applies only to Indian citizens.
- Section 66A was part of the Information Technology Act, 2000 when it was first enacted.
- The Supreme Court struck down the whole of the Information Technology Act, 2000 in 2015.
Arrange the following events in the correct chronological order, giving the date or year of each: the Central Government advisory on arrests under Section 66A; the Information Technology Amendment Act, 2008 coming into force; the filing of the Public Interest Litigation by Shreya Singhal; the passing of the Information Technology (Amendment) Bill in the Lok Sabha; the Supreme Court declaring Section 66A unconstitutional.
Why did the petitioners in Shreya Singhal v. Union of India object to the wording of Section 66A rather than only to the way the police were using it? Explain what vagueness in a criminal provision does to an ordinary citizen.
Section 66A was inserted to deal with real harms such as identity theft, voyeurism and data leakage by intermediaries. Explain why a provision may be struck down even though the purpose behind it was legitimate.
After 24 March 2015, is conduct on the internet in India unregulated? Justify your answer.
10.15 Case-Based Questions
- Rehana runs a small online business from Kota. One night, a person operating from another country and holding no Indian passport gains access to the company’s customer database, which is stored on a server located in Pune. He does not delete or alter anything; he copies the customer list and sends it to a rival trader. Rehana is told by a neighbour that “Indian law cannot touch someone sitting abroad”.
- Is the neighbour correct? State the provision of the Information Technology Act, 2000 that governs this situation and the condition on which it depends.
- Does it matter that the intruder neither deleted nor altered any data? Answer with reference to the meaning of ‘cybersecurity’ under the Act.
- Suppose the server had been located outside India and no computer, computer system or network in India had been involved at all. Would your answer to (a) change? Give reasons.
- Ashok receives a message on his phone that appears to come from his bank, warning that his account will be blocked within the hour and carrying a link. He enters his details on the page that opens, and money is withdrawn from his account within minutes. The message was sent by a person who has never met Ashok and does not know his name.
- Identify the cyber crime involved and define it.
- Ashok argues that this is plain cheating and has nothing to do with cyber law, since all that happened was that he was tricked into typing his own details. Do you agree? Give reasons.
- Which of the four areas encompassed by cyber law does this situation fall under, and why?
- In 2013, a college student posts a sharply worded criticism of a local civic decision on a social media page. A complaint is made that the post is “grossly offensive”, and the student is arrested. The same post is made again by another student in 2019, and an identical complaint is filed.
- Under which provision of the Information Technology Act, 2000 could the 2013 arrest have been made, and what did that provision punish?
- Explain why the position in 2019 is different, naming the decision that changed it and the Article of the Constitution on which it turned.
- State one safeguard that the Central Government had introduced in January 2013 in relation to arrests under this provision, and explain why such a safeguard was thought necessary.
- Does the 2015 decision mean that no online post can ever attract legal consequences in India? Justify your answer.
- Meera works in the accounts department of a hospital. She is authorised to open patient billing records but not medical records. Out of curiosity she opens the medical file of a person she recognises, reads it, and closes it without changing anything. She later tells a friend what she read. Her supervisor says that since nothing was damaged or stolen, no question of cybersecurity arises.
- Is the supervisor correct? Answer with reference to the six forms of interference named in the Act’s definition of ‘cybersecurity’.
- Which limb of cyber safety — protecting information, or being responsible and respectful with it — does Meera’s conduct offend, and why?
- Suppose Meera had opened the file, read nothing, and closed it immediately. Would any part of your answer to (a) change? Give reasons.
10.16 Landmark Cases & Maxims
Name the case in which the Supreme Court declared Section 66A of the Information Technology Act, 2000 unconstitutional, give its citation, and state the date of the decision.
State the principle settled by Shreya Singhal v. Union of India, AIR 2015 SC 1523, in your own words.
Which authority would you rely on to answer each of the following, and why?
- A student asks whether a person can be prosecuted today for sending a “grossly offensive” message.
- A student asks how an Indian court has described what cybercrime means, given that no statute defines it.
Name the decision of the Gujarat High Court referred to in this chapter, and state the meaning of cybercrime recognised in it.
A provision of a statute is challenged on the ground that its key terms are undefined and open-ended, so that no citizen can tell in advance what conduct is forbidden. Which decision studied in this chapter governs such a challenge, and what would it require the court to consider?