Cyber Crimes, Penalties, and Adjudication notes — Unit 4

The IT Act smartly divides wrongful acts in cyberspace into two distinct categories based on their severity:

• Contraventions (Chapter IX - Penalties): These are civil wrongs. They usually involve damage to computer systems or data theft where the primary goal is financial recovery. The remedy is paying Compensation (Damages). Dealt with by an Adjudicating Officer.
• Offences (Chapter XI - Offences): These are criminal acts involving malicious intent (Mens Rea) like cyber terrorism, publishing child pornography, or identity theft. The remedy is Imprisonment and Fine. Dealt with by Criminal Courts (Magistrate/Sessions Court).

Section 43 is the mother of all civil cyber contraventions. If any person, without the permission of the owner, accesses a computer/network, they are liable to pay compensation to the person affected.

⇒Acts covered under Sec 43:

• Downloading/Copying Data: (e.g., A disgruntled employee downloading the client database onto a pendrive before quitting).
• Introducing a Virus: Introducing any computer contaminant or virus.
• Damage: Damaging the computer system or destroying data.
• Disruption: Disrupting any computer system (e.g., a Denial of Service - DoS attack).
• Stealing Source Code: Destroying or stealing the computer source code used for a computer program.

(The compensation awarded can be in crores, proportionate to the loss suffered by the victim).

What if a hospital's database is hacked, and thousands of patients' medical records are leaked? Can the patients sue the hospital for failing to protect their data?

⇒Section 43A (Compensation for failure to protect data)

If a body corporate (company) possessing, dealing, or handling any sensitive personal data or information in a computer resource which it owns, controls, or operates, is negligent in implementing and maintaining reasonable security practices, and thereby causes wrongful loss to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected.

(This is the foundation of data protection liability for corporations in India, forcing them to invest in firewalls and encryption).

Civil courts take decades to grant compensation. To provide fast relief for Section 43 and 43A civil contraventions, the IT Act creates a quasi-judicial authority.

⇒Appointment and Powers

The Central Govt appoints a high-ranking IT Secretary as the "Adjudicating Officer" (AO). The AO has the powers of a civil court (summoning, evidence on oath). The AO conducts inquiries into data theft and virus attacks and orders the offender to pay compensation.

⇒Appeals (TDSAT)

Any person aggrieved by an order of the Adjudicating Officer can appeal to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT). (Further appeals on questions of law go to the High Court).

Now we move to crimes that result in jail time.

⇒Computer Related Offences (Section 66)

Section 66 criminalizes the civil wrongs mentioned in Section 43.

The Rule: If any person, dishonestly or fraudulently, does any act referred to in Section 43 (e.g., data theft, virus attack), he shall be punishable with imprisonment for a term which may extend to three years or with a fine up to five lakh rupees.

(Notice the difference: Sec 43 is merely accessing data without permission (Civil). Sec 66 requires Mens Rea—dishonest or fraudulent intention (Criminal)).

⇒Identity Theft (Section 66C)

Whoever, fraudulently or dishonestly makes use of the electronic signature, password, or any other unique identification feature of any other person, shall be punished with imprisonment up to 3 years.

(This covers hacking someone's email password, stealing credit card CVVs, or cloning ATM cards).

⇒Cheating by Personation (Section 66D)

Whoever, by means of any communication device or computer resource, cheats by personation, shall be punished.

(This covers phishing scams—e.g., creating a fake SBI login page to trick users, or creating a fake Facebook profile using someone else's photos to scam people).

With the advent of smartphones with hidden cameras, privacy invasions exploded.

⇒The Offence

Whoever, intentionally or knowingly captures, publishes or transmits the image of a private area of any person without his or her consent, under circumstances violating the privacy of that person, shall be punished with imprisonment up to 3 years.

This is the most serious offence under the IT Act, carrying a potential sentence of life imprisonment.

⇒What constitutes Cyber Terrorism?

Whoever, with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people:

• Denies access to any person authorized to access a computer resource.
• Attempts to penetrate or accesses a computer resource without authorization.
• Introduces any computer contaminant.

...and by means of such conduct causes or is likely to cause death or injuries to persons, or damage to critical information infrastructure (e.g., hacking the power grid or air traffic control system).

Section 67 is the digital equivalent of Section 292 of the IPC.

⇒Publishing Obscene Material

Whoever publishes or transmits in electronic form, any material which is lascivious or appeals to the prurient interest, shall be punished.

⇒Sexually Explicit Act (Sec 67A)

Publishing or transmitting material containing sexually explicit acts or conduct (hardcore pornography) carries a harsher punishment of up to 5 years (first conviction) and up to 7 years (subsequent conviction).

The law takes the harshest stance on the exploitation of children in cyberspace.

⇒The Offence

Whoever publishes, transmits, or creates any material depicting children engaged in sexually explicit acts shall be punished with imprisonment up to 5 years (7 years for a second offence).

⇒Browsing vs Creating

Section 67B also criminalizes the act of collecting, seeking, browsing, downloading, or promoting child pornography. Even passively viewing or storing such material on a hard drive is a serious criminal offence, regardless of whether the person created or shared it.

No section in the IT Act has been as controversial as Section 66A.

⇒The Draconian Provision

Section 66A criminalized the sending of any information via a computer that was "grossly offensive," "menacing," or caused "annoyance, inconvenience, danger, or insult."

⇒The Misuse

Because terms like "annoying" or "grossly offensive" are highly subjective, the police used Section 66A to arrest citizens, cartoonists, and politicians merely for posting political criticism or sarcastic memes on Facebook.

Two young girls in Palghar were arrested under Sec 66A merely for 'liking' and posting a Facebook comment questioning a city-wide bandh after a politician's death. This sparked a massive constitutional challenge.

⇒The Supreme Court Ruling (2015)

The Supreme Court struck down Section 66A in its entirety, declaring it unconstitutional.

• Vagueness: The Court held the section was incurably vague. What is "annoying" to one person may not be to another. It cast a "chilling effect" on free speech.
• Article 19(1)(a): It violated the Fundamental Right to Freedom of Speech and Expression, and did not fall under the reasonable restrictions of Art 19(2).

• Civil vs Criminal: Sec 43 covers civil data theft (compensation). Sec 66 covers criminal hacking with dishonest intent (jail).
• Sec 43A: Corporate liability for negligence in protecting sensitive personal data.
• Sec 66C & 66D: Covers Identity Theft (stealing passwords) and Cheating by Personation (phishing/fake profiles).
• Sec 66F: Cyber Terrorism, punishable by life imprisonment.
• Sec 67, 67A, 67B: Regulates obscenity, revenge porn, and strictly criminalizes child pornography.
• Sec 66A: Struck down by the SC in Shreya Singhal for violating Free Speech due to vagueness.

⇒Premium Advice for Top Marks

• Section 43 vs Section 66: This is a classic "distinguish between" question. The absolute key is Mens Rea. Point out that Sec 43 only requires the act of accessing without permission (strict civil liability), whereas Sec 66 requires the prosecution to prove the act was done 'dishonestly or fraudulently'.
• Section 66A & Freedom of Speech: A guaranteed essay question. Detail the Shreya Singhal case. Explain the "Chilling Effect" doctrine—when a law is so vaguely worded that citizens self-censor their legitimate speech out of fear of arrest, it violates Article 19(1)(a).
• Corporate Data Liability: If a problem-question involves a company losing customer data, apply Section 43A. Emphasize that the company failed to maintain "reasonable security practices."