CS Professional · Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice

Cyber Crimes and Investigation Procedures: formula sheet

Full chapter guide

Key formulas

Classification by victim: Cyber crime → against persons | property | government | society; A teaching classification, not a statutory one. One act may fit more than one category.
Role of the computer: Computer as tool | target | both; Use this to explain why an act is a cyber crime.
Identity theft (Section 66C, IT Act): Fraudulent or dishonest use of another's electronic signature, password or unique identification feature → imprisonment up to 3 years + fine up to ₹1 lakh; Imprisonment is of either description. The offender is also liable to fine.
Cyber terrorism (Section 66F, IT Act): Intent to threaten unity, integrity, security or sovereignty of India or to strike terror + prescribed conduct → imprisonment up to life; Covers denying access, unauthorised access and introducing a computer contaminant, with the stated consequences. It also covers unauthorised access to restricted information (clause B).
Failure to protect data (Section 43A, IT Act): Body corporate + sensitive personal data + negligent security practices + wrongful loss or gain → compensation to the affected person; This is a civil liability to pay damages by way of compensation, not an imprisonment provision.
Section 43 trigger: Act listed in clauses (a) to (j) + no permission of owner or person in charge → compensation to person affected; Civil liability. Covers access, copying, virus, damage, disruption, denial of access, assistance, tampering with billing, deletion or alteration, source code.
Section 43A: Body corporate + sensitive personal data + negligent security practices + wrongful loss or gain → compensation; Body corporate includes a company, firm, sole proprietorship or association engaged in commercial or professional activity.
Section 66C: Fraudulent or dishonest use of another's e-signature, password or unique ID → up to 3 years and fine up to ₹1,00,000; Imprisonment of either description.
Section 66D: Cheating by personation using communication device or computer resource → up to 3 years and fine up to ₹1,00,000; Imprisonment of either description.
Section 66F: Commits or conspires to commit cyber terrorism → imprisonment which may extend to life; Needs intent to threaten unity, integrity, security or sovereignty of India or to strike terror, or restricted-information access under clause (B).
Section 77: Compensation or penalty under the Act does not bar other punishment under any other law; Allows civil and criminal action together.
Section 16 power: Central Government may prescribe security procedures and practices for the purposes of sections 14 and 15; It is an enabling power ("may"). The detail comes from rules, not from section 16 itself.
Proviso to section 16: Regard to commercial circumstances + nature of transactions + other related factors considered appropriate; Write all three limbs in your answer. This shows that the standard is flexible.
Secure electronic record (section 14): Security procedure applied at a specific point of time → record deemed secure from that point to the time of verification; The record is deemed secure for that period only.
Rule-making link (section 87): Section 87(2)(ea): security procedures and practices under section 16; Rules are made by notification in the Official Gazette and in the Electronic Gazette under section 87(1). Rules are laid before each House of Parliament under section 87(3).
Section 43A contrast: Negligence in implementing and maintaining reasonable security practices + wrongful loss or gain → damages by way of compensation; Applies to a body corporate handling sensitive personal data. It is separate from section 16.
Establishment: S.70B(1)-(3): Central Government appoints CERT-In by Gazette notification; provides Director General and staff as prescribed; CERT-In is a Government agency, not a statutory company or a private body.
Functions: S.70B(4)(a)-(f): collect, analyse, disseminate incident information; forecast and alerts; emergency measures; coordinate response; guidelines, advisories, vulnerability notes, white papers; other prescribed functions; Remember as: Collect, Alert, Emergency, Coordinate, Advise, Other.
Power to call for information and direct: S.70B(6): may call for information and give direction to service providers, intermediaries, data centres, body corporate and any other person; Exercised to carry out sub-section (4) functions.
Penalty: S.70B(7): imprisonment up to 1 year, or fine up to ₹1,00,00,000, or both; Fine limit was one lakh before 30-11-2023. The punishment is for failing to provide information or to comply with a direction.
Cognizance: S.70B(8): only on a complaint by an officer authorised by CERT-In; Courts cannot take cognizance on any other basis.
Related sections: S.70A: national nodal agency for Critical Information Infrastructure Protection; S.69B: authorised agency monitors traffic data for cyber security; Do not mix these with CERT-In's role under S.70B.
Who investigates (IT Act, Section 78): Investigating officer rank ≥ Inspector; Applies notwithstanding the Code of Criminal Procedure, 1973. Rank was substituted for Deputy Superintendent of Police w.e.f. 27-10-2009.
Entry, search, arrest without warrant (IT Act, Section 80(1)): Inspector or above (or authorised Central/State Government officer) + public place + reasonable suspicion = search and arrest without warrant; Suspicion covers an offence committed, being committed or about to be committed under the IT Act.
Arrest by a non-police officer (Section 80(2)): Arrest → without unnecessary delay → Magistrate or officer-in-charge of a police station; The officer takes or sends the arrested person.
Link between the IT Act and the BNSS (BNSS Section 4(2)): Offences under other laws → BNSS procedure, subject to the special enactment; The special Act prevails where inconsistent (Section 2(1)(l) Explanation).
Cognizable case investigation (BNSS Section 176(1)): Reason to suspect → report to Magistrate → investigate on spot (in person or by subordinate) → arrest offender if necessary; Exceptions: named accused and non-serious case (no spot visit needed); no sufficient ground (no investigation).
Non-cognizable case (BNSS Section 174): Record → refer informant to Magistrate → investigate only on Magistrate's order; With the order, the officer has all powers except arrest without warrant. Mixed case with one cognizable offence is treated as cognizable.
Forensic visit (BNSS Section 176(3)): Offence punishable with ≥ 7 years → forensic expert visits crime scene + videography; Applies from the date notified by the State Government within five years.
Section 188 rule: Subordinate police officer who made an investigation → reports the result → to the officer in charge of the police station; This is the whole section. The report goes to the station officer, not directly to the Magistrate.
Section 176(1) link: Officer in charge may proceed in person OR depute a subordinate officer (of prescribed rank) to investigate; Section 188 applies when the investigation was done by a subordinate.
Section 193(3) link: On completion → officer in charge forwards report to Magistrate empowered to take cognizance on a police report; This may be sent including through electronic communication. The form is as State Government rules provide.
Section 193(1) and (2) timelines: Investigation completed without unnecessary delay; offences under BNS sections 64, 65, 66, 67, 68, 70, 71 and POCSO sections 4, 6, 8, 10 within two months from the date information was recorded; The two-month limit applies only to those listed offences. Section 188 itself fixes no time.
Section 193(3)(ii) progress update: Within ninety days, police officer informs progress of investigation to informant or victim; May be by any means including electronic communication.

Quick revision

Section 16 of the IT Act: the Central Government may prescribe security procedures and practices for sections 14 and 15.
In prescribing them, it must have regard to commercial circumstances, the nature of transactions and other related factors.
Section 70B: CERT-In is appointed by the Central Government by notification in the Official Gazette.
CERT-In is the national agency for incident response in cyber security.
Its functions include collecting, analysing and disseminating information on cyber incidents, forecasts and alerts, emergency measures and coordination.
It can issue guidelines, advisories, vulnerability notes and white papers.
It may call for information and give directions to service providers, intermediaries, data centres, body corporate and any other person.
Failing to comply is punishable with imprisonment up to one year, or fine up to one crore rupees, or both.
No court takes cognizance of a Section 70B offence except on a complaint by an officer authorised by CERT-In.
Section 78 of the IT Act: an officer not below the rank of Inspector investigates offences under the Act.
Section 188 BNSS: a subordinate officer who investigates reports the result to the officer in charge of the police station.
Section 193 BNSS: the investigation is completed without unnecessary delay, and the report goes to the Magistrate, which includes the sequence of custody of any electronic device.

Common mistakes

Treating the four-way classification as the statutory classification in the IT Act. Fix: Say it is a classification for study. The IT Act lists individual offences and penalties.
Using hacking and phishing as the same thing. Fix: Hacking attacks the system. Phishing deceives the person into giving credentials. Mention the link between them.
Saying section 43 gives imprisonment. Fix: Section 43 gives compensation to the person affected. Criminal punishment sits in other sections such as 66C, 66D and 66F.
Applying section 43A to any person or any data. Fix: It applies only to a body corporate handling sensitive personal data, and needs negligence plus wrongful loss or gain.
Saying section 16 itself lists the security measures. Fix: Say it is an enabling section. The Central Government prescribes the procedures through rules.
Leaving out the proviso on commercial circumstances and nature of transactions. Fix: Always write the proviso as a separate sentence. It carries marks.
Stating the fine as one lakh rupees. Fix: Write fine up to one crore rupees. It was substituted for one lakh from 30 November 2023.
Saying the penalty is imprisonment and fine both mandatory. Fix: Section 70B(7) says imprisonment up to one year or fine or both.
Saying any police officer can investigate an IT Act offence. Fix: State Section 78: not below the rank of Inspector, notwithstanding the Code of Criminal Procedure.
Applying Section 80 to a search of a private residence. Fix: Section 80(1) covers a public place only. Read the Explanation: public conveyance, hotel, shop, or any place accessible to the public.

Exam tips

Begin every answer with a one-line definition and the role of the computer: tool, target or both.
Give a short Indian example for each form you name. Examiners reward application to facts.
Cite Sections 66C, 66F and 43A only with their correct content. Do not guess other numbers.
Use the person, property, government, society headings in a note, and mention overlap in one sentence.
Finish case answers with a practical step: preserve evidence, report, and review compliance.
Always name the section and quote its key condition, such as no permission or negligence.
Separate civil and criminal consequences in your answer.
Learn the punishment figures for 66C, 66D and 66F exactly.