Skip to content

Corporate and Economic Laws · Laws and Regulations related to Cyber Security and Data Privacy

Cyber Terrorism under Section 66F of the IT Act

Updated 11 October 2026 · Fact-checked

Cyber terrorism under Section 66F of the IT Act, 2000 is an offence with two limbs. Limb (A): acting with intent to threaten India's unity, integrity, security or sovereignty, or to strike terror, by denying access, unauthorised access or introducing a contaminant, causing or likely to cause serious harm. Limb (B): unauthorised access to restricted information. Punishment: imprisonment which may extend to life.

Understand Cyber Terrorism under Section 66F

Section 66F deals with the most serious computer-related offence in the IT Act. It treats a cyber attack as terrorism when it is done with a hostile purpose against the nation or its people, not merely to steal or cause nuisance.

The section has two separate limbs. Limb (A) is about intent plus means plus consequence. The intent is to threaten the unity, integrity, security or sovereignty of India, or to strike terror in the people or any section of them. The means are three: (i) denying or causing denial of access to an authorised person, (ii) attempting to penetrate or access a computer resource without authorisation or exceeding authorised access, or (iii) introducing or causing to introduce any computer contaminant.

The means must lead to a result. Under limb (A) the conduct must cause or be likely to cause death or injury to persons, or damage to or destruction of property. It also covers disrupting supplies or services essential to the life of the community, or knowing that such disruption or damage is likely. It further covers adversely affecting the critical information infrastructure specified under section 70.

Limb (B) is about restricted information. Whoever knowingly or intentionally accesses a computer resource without authorisation or exceeding authorised access, and thereby obtains information, data or a database restricted for reasons of the security of the State or foreign relations, commits the offence. The same applies to any restricted information obtained with reason to believe it may be used to injure the interests of sovereignty and integrity of India, security of the State, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence, or to the advantage of any foreign nation, group of individuals or otherwise.

The punishment is the same for both limbs. Whoever commits or conspires to commit cyber terrorism is punishable with imprisonment which may extend to imprisonment for life. Note that conspiracy is punished as much as the act itself, and the section prescribes no fine.

Key rules to remember

Limb (A) of Section 66F
Intent (threaten unity, integrity, security or sovereignty of India, or strike terror) + Means (denial of access / unauthorised access / computer contaminant) + Consequence (death, injury, damage, disruption of essential supplies or services, or harm to critical information infrastructure)
All three elements must be present. The consequence may be actual or likely.
Limb (B) of Section 66F
Knowing or intentional unauthorised access (or exceeding authorised access) + obtaining restricted information, data or database
Restricted for security of the State or foreign relations, or other restricted information with reason to believe it may be used to the harm listed in the section.
Punishment, Section 66F(2)
Commits or conspires to commit cyber terrorism: imprisonment which may extend to imprisonment for life
Maximum is life imprisonment. The text does not mention fine.
Critical information infrastructure
Adverse effect on critical information infrastructure specified under section 70
This is one of the consequences under limb (A).

How to solve Cyber Terrorism under Section 66F questions

For any question on Section 66F, apply the statutory ingredients to the facts one by one and then state the punishment.

  1. 1Read the facts and identify the act: denial of access, unauthorised access, introducing a contaminant, or obtaining restricted data.
  2. 2Decide which limb applies. Disruption or damage points to limb (A). Obtaining restricted information points to limb (B).
  3. 3For limb (A), test the intent: was it to threaten the unity, integrity, security or sovereignty of India, or to strike terror? If there is no such intent, Section 66F fails.
  4. 4For limb (A), test the consequence: death, injury, damage to property, disruption of essential services, or harm to critical information infrastructure. Likelihood is enough.
  5. 5For limb (B), test unauthorised access or exceeding authorisation, and whether the data is restricted for State security or foreign relations, or is restricted data with reason to believe it can cause the listed harm.
  6. 6State your conclusion clearly: offence of cyber terrorism is made out or not.
  7. 7State the punishment: imprisonment which may extend to life, applying to conspiracy also.
  8. 8If the ingredients fail, say that other provisions of the IT Act on cyber offences may apply instead.

Quickest way: Intent-Means-Result check

When to use it: Use for MCQs and short case scenarios where you must decide whether a given act is cyber terrorism.

  1. Look for the intent words: India's unity, integrity, security, sovereignty, or striking terror.
  2. Look for the means: access denied, unauthorised access, contaminant such as a virus or malware.
  3. Look for the result: harm to people or property, essential services disrupted, or critical information infrastructure affected.
  4. If the case is about restricted State-security data obtained without authority, think limb (B).
  5. Pick the maximum punishment: life imprisonment.

Common mistakes in Cyber Terrorism under Section 66F

  • Treating every hacking or virus case as cyber terrorism.

    Students focus on the means and ignore the required intent.

    Fix: Under limb (A), check for intent to threaten India's unity, integrity, security or sovereignty, or to strike terror. A financial motive alone does not satisfy it.

  • Saying the maximum punishment is a fixed term such as seven years.

    Confusion with other IT Act sections, such as the seven-year terms in sections 69 and 69A.

    Fix: Section 66F(2) provides imprisonment which may extend to imprisonment for life.

  • Forgetting that conspiracy is punishable.

    Students read only 'commits'.

    Fix: Remember the words 'commits or conspires to commit'. Conspiracy carries the same punishment.

  • Thinking actual harm must have occurred under limb (A).

    The word 'causes' is noticed but 'is likely to cause' is missed.

    Fix: The section covers conduct that causes or is likely to cause the listed consequences.

  • Ignoring limb (B) and treating the section as only about attacks.

    Cyber terrorism is popularly imagined as a destructive attack.

    Fix: Unauthorised access to restricted State-security or foreign-relations data is itself covered, even with no damage.

  • Confusing Section 66F with Section 69B or CERT-In functions.

    All concern cyber security.

    Fix: 66F is a penal offence. Section 69B concerns monitoring and collecting traffic data. Section 70B makes CERT-In the national incident-response agency.

Worked examples

Example 1

A group, with the aim of threatening the security of India, introduces malware into the control system of a power grid operator. The grid fails and hospitals in a city lose electricity. Is this cyber terrorism under Section 66F? State the punishment.

Show the solution
  1. Act: introducing a computer contaminant, which is a listed means under limb (A)(iii).
  2. Intent: the aim was to threaten the security of India, which matches the intent required.
  3. Consequence: disruption of supplies or services essential to the life of the community, and likely harm to persons, are within limb (A). Power supply to hospitals is an essential service.
  4. All three elements are present, so the offence of cyber terrorism is made out.
  5. Punishment under Section 66F(2): imprisonment which may extend to life. Conspirators are also liable.

Answer: Yes. The facts satisfy intent, means and consequence under Section 66F(1)(A). Punishment is imprisonment which may extend to life, including for those who conspire.

Example 2

Ravi, an employee of a private contractor, exceeds his authorised access and downloads a database restricted for reasons of the security of the State. He knew it was restricted. Discuss whether Section 66F applies even though no damage was caused.

Show the solution
  1. Identify the limb: obtaining restricted data points to limb (B), not limb (A).
  2. Check access: Ravi exceeded his authorised access, and did so knowingly.
  3. Check the data: it is a database restricted for the security of the State, which the section names expressly.
  4. Damage is not an ingredient of limb (B). Obtaining access to such restricted data by unauthorised means or by exceeding authority is enough.
  5. Conclude the offence of cyber terrorism is made out and state the punishment.

Answer: Yes. Section 66F(1)(B) applies because Ravi knowingly exceeded authorised access and obtained State-security restricted data. No damage is needed. Punishment may extend to imprisonment for life.

Exam tips

  • Write the section as two limbs: (A) intent, means and consequence, and (B) restricted information. Examiners reward structure.
  • In case scenarios, quote the intent words from the facts. Without intent to threaten India or strike terror, limb (A) does not apply.
  • Learn the three means in limb (A) by key words: deny, penetrate, contaminate.
  • For MCQs, remember the punishment: imprisonment which may extend to life, covering conspiracy.
  • Keep related sections apart: 66F is punishment for cyber terrorism, 69 and 69A carry up to seven years, 69B and 70B deal with monitoring and CERT-In.

Practice questions from Laws and Regulations related to Cyber Security and Data Privacy

Cyber Terrorism under Section 66F in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Cyber Terrorism under Section 66F: frequently asked questions

What is the punishment under Section 66F of the IT Act?

Whoever commits or conspires to commit cyber terrorism is punishable with imprisonment which may extend to imprisonment for life. The section text does not mention a fine.

Is intent necessary for cyber terrorism under Section 66F?

Yes, under limb (A) the act must be done with intent to threaten the unity, integrity, security or sovereignty of India, or to strike terror in the people or any section of them. Limb (B) instead requires knowing or intentional unauthorised access and the obtaining of restricted data.

Does actual damage have to occur for Section 66F to apply?

No. Under limb (A) it is enough that the conduct causes or is likely to cause the listed consequences. Under limb (B) damage is not an ingredient at all.

What is critical information infrastructure in Section 66F?

Section 66F refers to critical information infrastructure specified under section 70. Adversely affecting it through the listed conduct, with the required intent, can amount to cyber terrorism.