Cyber Threats and Cyber Laws: formula sheet

Key formulas

Identity theft, section 66C

Fraudulent or dishonest use of another's electronic signature, password or unique identification feature → imprisonment up to 3 years + fine up to ₹1,00,000

Both fraud or dishonesty and the use of another person's identifier must be present.

Cyber terrorism, section 66F

Intent to threaten India's unity, integrity, security or sovereignty, or to strike terror + denial of access / unauthorised access / contaminant + likely death, injury, damage or disruption → imprisonment up to life

Clause (B) separately covers unauthorised access to information restricted for State security or foreign relations reasons. Conspiracy is also punishable.

Data protection failure, section 43A

Body corporate + sensitive personal data + negligence in reasonable security practices + wrongful loss or gain → compensation to the person affected

This is civil compensation, not imprisonment.

CERT-In directions, section 70B

Failure to provide information or comply with direction → imprisonment up to 1 year or fine up to ₹1,00,00,000 or both

Courts take cognizance only on a complaint by an officer authorised by CERT-In.

Traffic data monitoring, section 69B

Intermediary intentionally or knowingly refusing technical assistance → imprisonment up to 1 year or fine up to ₹1,00,00,000 or both

The Central Government authorises an agency to monitor traffic data for cyber security.

Section 4: electronic records

Writing / typewritten / printed requirement is satisfied if the information is (a) in electronic form AND (b) accessible so as to be usable for a subsequent reference

Both conditions must be met. Access alone, or electronic form alone, is not enough.

Section 5: electronic signatures

Signature requirement is satisfied if authenticated by electronic signature affixed in the manner prescribed by the Central Government

Applies notwithstanding anything in the other law. The Explanation defines 'signed' as affixing a handwritten signature or any mark.

Electronic signature (s 2(1)(ta))

Authentication of an electronic record by a subscriber by the electronic technique specified in the Second Schedule; includes digital signature

Electronic signature is the wider term. Digital signature is included within it.

Digital signature (s 2(1)(p))

Authentication of an electronic record by a subscriber by an electronic method or procedure in accordance with section 3

Created using the private key; verified using the public key (asymmetric crypto system).

Electronic record (s 2(1)(t))

Data, record or data generated, image or sound stored, received or sent in an electronic form or micro film or computer generated micro fiche

Wider than a plain file; includes images and sound.

Intermediary (s 2(1)(w))

A person who on behalf of another receives, stores or transmits that record or provides any service with respect to that record

Includes telecom, network, internet and web-hosting service providers, search engines, online payment sites, auction sites, marketplaces and cyber cafes.

Originator and addressee

Originator: sends, generates, stores or transmits the message. Addressee: the person intended by the originator to receive it

Neither term includes an intermediary.

Section 10: rule-making power

Central Government may prescribe: type of electronic signature; manner and format of affixing; procedure to identify the person affixing; control processes for integrity, security and confidentiality; other matters

Five heads, (a) to (e).

Section 36: Certifying Authority certifies

(a) compliance with Act; (b) certificate published and accepted by subscriber; (c) subscriber holds the private key matching the public key; (ca) key can create a digital signature; (cb) public key can verify it; (d) functioning key pair; (e) information is accurate; (f) no knowledge of a material fact that would adversely affect (a) to (d)

Clauses (ca) and (cb) were inserted by the 2009 amendment.

Section 41: subscriber on acceptance

Subscriber certifies to all who reasonably rely that: (a) holds the private key and is entitled to hold it; (b) all representations to the CA and material facts are true; (c) all information in the certificate within the subscriber's knowledge is true

Acceptance is deemed if the subscriber publishes or authorises publication to one or more persons or in a repository, or otherwise shows approval.

Section 43 (civil)

Act listed in s.43 + without permission of owner/person in charge → damages by way of compensation

No dishonest or fraudulent intention is required. Clauses (a) to (j) list the acts.

Section 66 (criminal)

s.43 act + dishonestly or fraudulently → imprisonment up to 3 years or fine up to ₹5,00,000 or both

'Dishonestly' and 'fraudulently' take their meaning from sections 24 and 25 of the Indian Penal Code.

Section 65

Knowingly or intentionally conceal, destroy or alter source code required by law to be kept → imprisonment up to 3 years or fine up to ₹2,00,000 or both

The source code must be one the law requires to be kept or maintained.

Section 66C

Fraudulent or dishonest use of another's electronic signature, password or unique identification feature → imprisonment up to 3 years and fine up to ₹1,00,000

The text says 'shall also be liable to fine'.

Section 66D

Cheating by personation by means of a communication device or computer resource → imprisonment up to 3 years and fine up to ₹1,00,000

Personation is the key fact, for example a fake bank official on a call or website.

Section 66E

Intentionally or knowingly capture, publish or transmit image of a private area without consent, violating privacy → imprisonment up to 3 years or fine up to ₹2,00,000 or both

Private area means genitals, pubic area, buttocks or female breast, naked or undergarment clad.

Section 67

Obscene material in electronic form: first conviction up to 3 years and fine up to ₹5,00,000; later conviction up to 5 years and fine up to ₹10,00,000

Test: lascivious, appeals to prurient interest, or tends to deprave and corrupt.

Sections 67A and 67B

First conviction up to 5 years and fine up to ₹10,00,000; later conviction up to 7 years and fine up to ₹10,00,000

67A: sexually explicit act or conduct. 67B: child sexual material and online abuse of children. 'Children' means persons under 18.

Section 43A

Body corporate + sensitive personal data + negligent security + wrongful loss or gain → compensation

Civil liability. Security standards come from agreement, law, or rules prescribed by the Central Government.

Section 77

No compensation awarded, penalty imposed or confiscation made under the Act prevents the award of compensation or imposition of any other penalty or punishment under any other law

Use it to show that remedies under other laws stay open. The link between a section 43 act and punishment under the Act comes from section 66 itself.

Clause (A): terror attack

Intent (threaten unity, integrity, security or sovereignty of India, or strike terror) + Means (denial of access / unauthorised access / computer contaminant) + Consequence (death, injury, damage to property, disruption of essential supplies or services, or harm to critical information infrastructure)

All three elements are needed. Intent is the key separator from ordinary hacking.

Clause (B): restricted information

Knowing or intentional unauthorised access (or exceeding authorisation) + access to information restricted for State security or foreign relations (or other restricted information) + reason to believe it may cause injury or benefit a foreign nation or group

No death, injury or damage is required here. The harm is in the likely use of the information.

Punishment, Section 66F(2)

Commits or conspires to commit cyber terrorism: imprisonment which may extend to imprisonment for life

The text prescribes no fine and no minimum term. Conspiracy is punished the same as commission.

Critical information infrastructure (Section 70 Explanation)

Computer resource whose incapacitation or destruction has a debilitating impact on national security, economy, public health or safety

Harm to it satisfies the consequence limb of clause (A).

Who authorises (s.69B(1))

Central Government → notification in Official Gazette → any agency of the Government

State Governments are not named in s.69B. Authority is by Gazette notification, not by individual order.

Purpose

Enhance cyber security + identify, analyse, prevent intrusion or spread of computer contaminant

Cyber security is the purpose. Unlike s.69, the grounds of sovereignty, public order or investigation are not listed.

Subject matter

Traffic data or information generated, transmitted, received or stored in any computer resource

Traffic data = identifying data plus origin, destination, route, time, data, size, duration, type of service and any other information.

Intermediary duty (s.69B(2))

When called upon: provide technical assistance + extend all facilities for online access

Applies to the intermediary or any person in charge of the computer resource.

Procedure and safeguards (s.69B(3))

As may be prescribed (rule power: s.87(2)(za))

Safeguards sit in the rules, not in the section.

Penalty (s.69B(4))

Intermediary intentionally or knowingly contravening s.69B(2): imprisonment up to 1 year, or fine up to ₹1 crore, or both

Amended by Act 18 of 2023, w.e.f. 30-11-2023. Earlier: up to 3 years and also fine.

Section 69 comparison

s.69: interception, monitoring, decryption of information; reasons recorded in writing; failure to assist: up to 7 years and fine

Section 69 covers Central or State Government, specified grounds, and an order by an authorised officer.

Section 69 – interception, monitoring, decryption

Central/State Government or specially authorised officer → written reasons → order to agency of the appropriate Government

Grounds include investigation of any offence. Procedure and safeguards are as prescribed. Failure to assist: up to 7 years' imprisonment and fine.

Section 69(3) – duty to assist

Subscriber / intermediary / person in charge must give all facilities and technical assistance

Assistance means access to the computer resource, interception, monitoring or decryption, or providing stored information.

Section 69A – blocking

Central Government or specially authorised officer → written reasons → direct Government agency or intermediary to block public access

Intermediary failing to comply: up to 7 years' imprisonment and fine. Investigation of any offence is not a ground.

Section 70 – protected system

Appropriate Government notifies in Official Gazette a resource affecting CII; access only by authorised persons

Unauthorised access or attempt: imprisonment of either description up to 10 years and fine. Central Government prescribes security practices.

Section 70A – national nodal agency

Central Government designates a Government organisation by notification for CII protection

Responsible for all measures including research and development.

Section 70B – CERT-In

Non-compliance with its call for information or directions: up to 1 year, or fine up to ₹1 crore, or both

No court takes cognizance except on a complaint by an officer authorised by CERT-In.

Safe harbour rule

Section 79(1) protection = no liability for third party information, subject to s.79(2) and s.79(3)

It applies notwithstanding any other law, but only when the conditions are met.

Conditions for safe harbour

s.79(2): (a) access-only function, OR (b) no initiating, no selecting receiver, no selecting or modifying information; AND (c) due diligence plus prescribed guidelines

Clause (c) is needed in addition to (a) or (b). Read the connectors in the text carefully.

Loss of safe harbour

s.79(3): (a) conspiracy, abetment, aid or inducement; (b) failure to expeditiously remove or disable access after actual knowledge or Government notification

Removal must be done without vitiating the evidence.

Adjudicating officer

Section 46: officer not below Director to Government of India (or equivalent State officer); claims up to ₹5 crore

Claims exceeding ₹5 crore lie with the competent court (s.46(1A)).

Factors for quantum

Section 47: (a) unfair gain, where quantifiable; (b) loss caused; (c) repetitive nature of default

The adjudicating officer must have due regard to these three.

Appeal

Section 57: appeal within 45 days of receiving the order; disposal endeavoured within 6 months

Delay can be condoned for sufficient cause. No appeal lies from an order made with the consent of parties.

Compounding

Section 63: sum not above maximum penalty; not available for same or similar contravention within 3 years of earlier compounding

Compounding can happen before or after adjudication proceedings begin.

Retention duty

Section 67C: penalty up to ₹25 lakh for intentional or knowing contravention

The duration, manner and format are as the Central Government prescribes.

Quick revision

• Section 66F punishes cyber terrorism; the punishment may extend to imprisonment for life, and conspiracy to commit it is also punishable.
• Section 66F(1)(A) needs intent to threaten the unity, integrity, security or sovereignty of India or to strike terror, plus denial of access, unauthorised access or introducing a computer contaminant.
• Section 66F(1)(B) covers unauthorised access that obtains restricted information, with reason to believe it may be used to harm the interests listed in the section.
• Section 69B lets the Central Government authorise a Government agency to monitor and collect traffic data to enhance cyber security.
• Under Section 69B, an intermediary that intentionally or knowingly fails to give technical assistance may face imprisonment up to one year, a fine up to one crore rupees, or both.
• Traffic data means data identifying a person, computer system, network or location, and includes origin, destination, route, time, size, duration and type of service.
• Section 69 allows interception, monitoring or decryption by order, for reasons recorded in writing; failure to assist can mean imprisonment up to seven years and a fine.
• Section 69A allows blocking of public access by order with reasons recorded in writing; an intermediary that fails to comply faces imprisonment up to seven years and a fine.
• Section 70 lets the appropriate Government declare a computer resource affecting Critical Information Infrastructure a protected system; unauthorised access can mean imprisonment up to ten years and a fine.
• Section 79 protects an intermediary from liability for third party information, if its role is limited as stated and it observes due diligence.
• The Section 79 protection is lost if the intermediary conspired, abetted, aided or induced the act, or fails to expeditiously remove or disable access after actual knowledge or notification.

Common mistakes

• Treating malware, phishing and ransomware as the same thing. Fix: Remember: malware is the software, phishing is the deception, ransomware is malware that demands payment.
• Applying section 66F to every serious hacking incident. Fix: Check for intent to threaten India's unity, integrity, security or sovereignty, or to strike terror, or for access to restricted State information.
• Writing that section 4 needs only electronic form. Fix: Always write both conditions: rendered or made available in electronic form and accessible so as to be usable for a subsequent reference.
• Treating digital signature and electronic signature as identical. Fix: Say electronic signature is the wider term under section 2(1)(ta) and it includes digital signature. Section 5 uses electronic signature.
• Treating section 43 as a criminal provision with jail term. Fix: Remember that section 43 ends in liability to pay damages by way of compensation. Imprisonment comes only through section 66 and other criminal sections.
• Applying section 66 without discussing dishonest or fraudulent intent. Fix: Always write one sentence on intent and cite sections 24 and 25 of the IPC for the meaning of the two words.
• Treating every hacking or malware case as cyber terrorism. Fix: Always check for intent to threaten India's unity, integrity, security or sovereignty or to strike terror, plus the stated consequence.
• Saying a fine is also payable under Section 66F. Fix: Write only: imprisonment which may extend to imprisonment for life. The text of 66F(2) mentions no fine.
• Mixing up s.69 and s.69B Fix: Remember: s.69 is interception, monitoring and decryption of information on listed grounds; s.69B is traffic data for cyber security. Also remember the penalties differ: up to 7 years and fine in s.69, and up to 1 year or fine up to ₹1 crore or both in s.69B.
• Stating the old penalty of three years and fine Fix: Use the current text: up to one year, or fine up to one crore rupees, or both, after Act 18 of 2023 (w.e.f. 30-11-2023).

Exam tips

• Expect case-based questions: spot the threat from the facts first, then name the provision.
• Always show the impact on the individual, the business or the State. Examiners reward this link.
• For distinction questions, use a two-column style in bullets: meaning, method, example, legal provision.
• Do not state penalties you are unsure of. A correct rule in plain words earns more than a wrong section number.
• End answers with a compliance or preventive step, such as reporting to CERT-In.
• Write section 4 and section 5 rules in full. Examiners reward the exact conditions.
• Learn the definitions of electronic record, electronic signature, intermediary, originator and addressee as short quotable lines.
• For case questions, name the parties as subscriber, Certifying Authority or intermediary before applying the rule.