Skip to content

Artificial Intelligence, Data Analytics and Cyber Security - Laws and Practice · Cyber Crimes and Investigation Procedures

Investigation Procedure for Cyber Crimes under the IT Act and BNSS

Updated 11 October 2026 · Fact-checked

Under the IT Act, 2000, a police officer not below the rank of Inspector investigates offences (Section 78). Section 80 allows entry, search and arrest without warrant in public places. The Bharatiya Nagarik Suraksha Sanhita, 2023 supplies the general procedure, subject to the IT Act.

Understand Investigation Procedure for Cyber Crimes

Cyber offences are not investigated under a separate code. The IT Act, 2000 creates the offences and a few special investigation powers. The general procedure of investigation, inquiry and trial comes from the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS).

The link is Section 4 of the BNSS. Offences under any other law, including the IT Act, are investigated, inquired into and tried under the BNSS provisions, but subject to any enactment that regulates the manner or place of investigation. So the IT Act prevails where it has its own rule. The definition of "investigation" in Section 2(1)(l) of the BNSS also says that where a special Act is inconsistent with the Sanhita, the special Act prevails.

Two IT Act sections matter most. Section 78 says that, notwithstanding the Code of Criminal Procedure, 1973, a police officer not below the rank of Inspector shall investigate any offence under the Act. The rank was raised from Deputy Superintendent of Police to Inspector in 2009. Section 80 lets an Inspector or above, or another Central or State Government officer authorised by the Central Government, enter any public place, search and arrest without warrant any person reasonably suspected of having committed, committing or being about to commit an offence under the Act.

"Public place" includes any public conveyance, hotel, shop or other place intended for use by, or accessible to, the public. If an officer other than a police officer makes the arrest, that officer must without unnecessary delay take or send the person before a magistrate having jurisdiction or before the officer-in-charge of a police station. Section 80(3) applies the criminal procedure code to entry, search and arrest, so far as may be and subject to Section 80. The text refers to the Code of Criminal Procedure, 1973, which the BNSS replaced; in practice you should read it with the BNSS.

Once information reaches a police station, BNSS Section 176 governs. For a cognizable offence the officer in charge must send a report to the Magistrate and go, or depute a subordinate, to the spot to investigate and, if necessary, to discover and arrest the offender. Section 174 deals with non-cognizable cases: the officer records the information, refers the informant to the Magistrate, and cannot investigate without the Magistrate's order. If a case has several offences and at least one is cognizable, it is treated as cognizable. Digital evidence handling in detail (imaging, hash values, chain of custody) is a forensic practice point covered under cyber forensics.

Key rules to remember

Who investigates (IT Act, Section 78)
Investigating officer rank ≥ Inspector
Applies notwithstanding the Code of Criminal Procedure, 1973. Rank was substituted for Deputy Superintendent of Police w.e.f. 27-10-2009.
Entry, search, arrest without warrant (IT Act, Section 80(1))
Inspector or above (or authorised Central/State Government officer) + public place + reasonable suspicion = search and arrest without warrant
Suspicion covers an offence committed, being committed or about to be committed under the IT Act.
Arrest by a non-police officer (Section 80(2))
Arrest → without unnecessary delay → Magistrate or officer-in-charge of a police station
The officer takes or sends the arrested person.
Link between the IT Act and the BNSS (BNSS Section 4(2))
Offences under other laws → BNSS procedure, subject to the special enactment
The special Act prevails where inconsistent (Section 2(1)(l) Explanation).
Cognizable case investigation (BNSS Section 176(1))
Reason to suspect → report to Magistrate → investigate on spot (in person or by subordinate) → arrest offender if necessary
Exceptions: named accused and non-serious case (no spot visit needed); no sufficient ground (no investigation).
Non-cognizable case (BNSS Section 174)
Record → refer informant to Magistrate → investigate only on Magistrate's order
With the order, the officer has all powers except arrest without warrant. Mixed case with one cognizable offence is treated as cognizable.
Forensic visit (BNSS Section 176(3))
Offence punishable with ≥ 7 years → forensic expert visits crime scene + videography
Applies from the date notified by the State Government within five years.

How to solve Investigation Procedure for Cyber Crimes questions

Use a provision-analysis-conclusion structure. Fix the offence, the officer and the place first, then apply the rule.

  1. 1Identify the offence and confirm it is under the IT Act (or a mixed case with another law such as the Bharatiya Nyaya Sanhita).
  2. 2Check the investigating officer's rank. Under Section 78, it must be Inspector or above.
  3. 3Decide whether the action is entry, search or arrest. If so, check Section 80: public place, authorised officer, reasonable suspicion.
  4. 4Where the Act is silent, apply the BNSS through Section 4(2): report to the Magistrate, spot investigation, and the Section 174 route for non-cognizable cases.
  5. 5Note any special points: officer other than police and the duty to produce the arrested person before a Magistrate, the forensic visit under Section 176(3), and the preservation of electronic records.
  6. 6Apply the facts to each condition, one by one, and state whether it is met.
  7. 7Conclude clearly: valid or invalid, and what the officer or company should do next, such as drafting a complaint or preserving logs.

Quickest way: Rank, place, suspicion: the three-check test

When to use it: Use it for short case questions asking whether a search or arrest without warrant was valid.

  1. Rank: Inspector or above, or authorised Central/State officer.
  2. Place: public place such as a hotel, shop or public conveyance. A private home is not covered by Section 80.
  3. Suspicion: reasonable, linked to an IT Act offence.
  4. If all three are met, the arrest without warrant is valid. Then check what happens after: a non-police officer must produce the person before a Magistrate or police station without unnecessary delay.

Common mistakes in Investigation Procedure for Cyber Crimes

  • Saying any police officer can investigate an IT Act offence.

    Students remember general police powers under the criminal procedure law.

    Fix: State Section 78: not below the rank of Inspector, notwithstanding the Code of Criminal Procedure.

  • Applying Section 80 to a search of a private residence.

    The words entry, search and arrest sound general.

    Fix: Section 80(1) covers a public place only. Read the Explanation: public conveyance, hotel, shop, or any place accessible to the public.

  • Forgetting that the BNSS applies at all, or ignoring that the IT Act prevails.

    Students treat the IT Act as a complete code.

    Fix: Write both: BNSS Section 4(2) applies the general procedure, subject to any special provision in the IT Act.

  • Quoting the old Deputy Superintendent of Police rank.

    Older notes still carry the pre-2009 text.

    Fix: Use Inspector, as substituted by Act 10 of 2009.

  • Confusing cognizable and non-cognizable procedure.

    Students skip Sections 174 and 176.

    Fix: Cognizable: report and investigate under Section 176. Non-cognizable: Magistrate's order first under Section 174. Mixed case counts as cognizable.

  • Writing exact steps of forensic imaging as if the statute prescribes them.

    Digital evidence practice is mixed with the law.

    Fix: Cite only the statutory points, such as the Section 176(3) forensic visit and videography, and present imaging and chain of custody as accepted practice.

Worked examples

Example 1

Inspector Rao of a State police force receives credible information that Mr. Shah is running a phishing operation from a cyber cafe in Pune. He enters the cafe, searches it and arrests Mr. Shah without a warrant. Is the action valid under the IT Act?

Show the solution
  1. Provision: Section 80(1) lets an officer not below the rank of Inspector enter any public place, search and arrest without warrant a person reasonably suspected of an offence under the Act.
  2. Rank: Inspector Rao meets the requirement.
  3. Place: a cyber cafe is a place accessible to the public, and the Explanation includes any shop or place accessible to the public. It is a public place.
  4. Suspicion: credible information about phishing is a reasonable suspicion of an offence under the IT Act.
  5. Section 80(3) applies the criminal procedure law to the search and arrest so far as may be, so the usual safeguards should be followed.

Answer: The action is valid. All three conditions of Section 80(1) are met: rank, public place and reasonable suspicion. Procedural safeguards of the BNSS still apply.

Example 2

A Sub-Inspector wants to investigate a complaint that an employee of Zenith Pvt. Ltd. stole data from the company server. Can he investigate, and what if the officer is a Central Government officer authorised under Section 80 who arrests the person at a shop?

Show the solution
  1. Investigation rank: Section 78 requires a police officer not below the rank of Inspector to investigate any offence under the Act. A Sub-Inspector is below that rank, so he cannot himself investigate the IT Act offence. An Inspector or above must do it.
  2. Under BNSS Section 176(1), the officer in charge of the police station reports to the Magistrate and investigates, but for IT Act offences the rank rule of Section 78 overrides, since Section 4(2) makes the BNSS subject to the special enactment.
  3. Arrest by an authorised Central Government officer: Section 80(1) allows this at a public place, and a shop is expressly a public place.
  4. Because he is not a police officer, Section 80(2) requires him, without unnecessary delay, to take or send the person before a magistrate having jurisdiction or before the officer-in-charge of a police station.

Answer: The Sub-Inspector cannot investigate the IT Act offence; an officer of Inspector rank or above must. The authorised Central Government officer may arrest at the shop without warrant on reasonable suspicion, but must produce the person before a magistrate or the officer-in-charge of a police station without unnecessary delay.

Exam tips

  • Quote Section 78 and Section 80 by number. Examiners reward exact provisions.
  • In case questions, check rank, place and suspicion separately and write a one-line finding for each.
  • Link the IT Act to the BNSS using Section 4(2), and mention that the special Act prevails if inconsistent.
  • Write the old Code of Criminal Procedure, 1973 only when contrasting. Use BNSS for current procedure.
  • Add a practical line on preserving electronic records and logs, but do not present it as a statutory step unless the text says so.

Practice questions from Cyber Crimes and Investigation Procedures

Investigation Procedure for Cyber Crimes in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Investigation Procedure for Cyber Crimes: frequently asked questions

Who can investigate offences under the IT Act, 2000?

Section 78 says a police officer not below the rank of Inspector shall investigate any offence under the Act. This applies notwithstanding the Code of Criminal Procedure, 1973.

Can the police arrest without a warrant in a cyber crime?

Under Section 80(1), an Inspector or above, or an authorised Central or State Government officer, may arrest without warrant a person found in a public place who is reasonably suspected of an offence under the Act. This is limited to public places.

Which law gives the general procedure for cyber crime investigation now?

The Bharatiya Nagarik Suraksha Sanhita, 2023. Section 4(2) applies its procedure to offences under other laws, including the IT Act, subject to any special provision in that law.

What happens when a non-police officer arrests a person under Section 80?

The officer must, without unnecessary delay, take or send the person before a magistrate having jurisdiction or before the officer-in-charge of a police station.