Internal and Forensic Audit · Cyber Forensics

IT Act, 2000: Cyber Offences and Cyber Terrorism (Section 66F)

Updated 11 October 2026 · Fact-checked

Section 66F of the IT Act, 2000 defines cyber terrorism. It covers two situations: acts done with intent to threaten India's unity, security or sovereignty, or to strike terror, that cause or are likely to cause serious harm; and unauthorised access to restricted information. Whoever commits or conspires to commit it is punishable with imprisonment which may extend to life.

Understand IT Act, 2000: Cyber Offences and Cyber Terrorism (Section 66F)

Most cyber offences under the IT Act are about harm to an individual or a business: data theft, damage to a computer, identity fraud. Cyber terrorism is different. The harm is aimed at the nation or the public, or at the security of the State. That is why the law gives it the heaviest punishment in the Act.

Section 66F(1) has two limbs. Limb (A) needs a special intent: to threaten the unity, integrity, security or sovereignty of India, or to strike terror in the people or any section of them. The means are three: (i) denying or causing denial of access to an authorised person; (ii) attempting to penetrate or access a computer resource without authorisation or exceeding authorised access; (iii) introducing or causing to introduce any computer contaminant. The conduct must also cause or be likely to cause death or injuries, or damage to or destruction of property. It also qualifies if it disrupts, or is known to be likely to disrupt, supplies or services essential to the life of the community, or adversely affects the critical information infrastructure specified under section 70.

Limb (B) is about information. A person knowingly or intentionally penetrates or accesses a computer resource without authorisation, or exceeding authorised access, and obtains restricted information, data or database. It is restricted for reasons of the security of the State or foreign relations, or it is any restricted information that the person has reason to believe may be used to cause or likely cause injury to India's sovereignty and integrity, State security, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence, or to the advantage of any foreign nation or group.

Section 66F(2) fixes the punishment: whoever commits or conspires to commit cyber terrorism is punishable with imprisonment which may extend to imprisonment for life. Note that the section itself covers conspiracy. Abetment (section 84B) and attempt (section 84C) are separate provisions of the Act that apply where no express provision exists.

The difference from ordinary hacking is the intent and the result. Plain unauthorised access, without the terror or security intent and without the listed consequences, does not become cyber terrorism. A forensic auditor must therefore look at purpose, means and effect, not just at the intrusion.

Key rules to remember

Section 66F(1)(A) test: Intent (threaten unity, integrity, security or sovereignty of India, or strike terror) + Means (any one of: (i) denial of access to an authorised person / (ii) attempt to penetrate or access without authorisation or exceeding authorised access / (iii) introducing a computer contaminant) + Consequence (death or injuries, damage to or destruction of property, disruption of supplies or services essential to the life of the community, or knowing it is likely to cause such disruption, or adverse effect on critical information infrastructure specified under section 70); All three elements (intent, means, consequence) must be present. Within the means, the three items are alternatives, so any one of (i), (ii) or (iii) is enough. The consequence may be actual or likely.
Section 66F(1)(B) test: Knowing or intentional unauthorised access (or exceeding authorised access) + EITHER (1) information, data or database restricted for reasons of the security of the State or foreign relations, OR (2) any other restricted information, data or database, with reason to believe it may be used to cause or likely cause injury to India's sovereignty and integrity, State security, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence, or to the advantage of any foreign nation, group of individuals or otherwise; No terror intent is needed in this limb. The 'reason to believe' qualifier applies only to category (2). For category (1), knowing or intentional unauthorised access to State-security or foreign-relations information is what matters.
Punishment under Section 66F(2): Commits or conspires to commit cyber terrorism → imprisonment which may extend to life; The text prescribes no fine. Do not add one.
Abetment and attempt: Section 84B: abetment punished as the offence, if the act is committed in consequence. Section 84C: attempt punished up to one-half of the longest term, or fine, or both; Both apply only where no express provision is made. Section 66F(2) expressly covers conspiracy.
Other law and compounding: Section 77: IT Act penalties do not bar punishment under other laws. Section 77A: no compounding of offences punishable with life or imprisonment over three years; Cyber terrorism, punishable with life, cannot be compounded.

How to solve IT Act, 2000: Cyber Offences and Cyber Terrorism (Section 66F) questions

Use this method for any case question asking whether an act is cyber terrorism or what the punishment is.

1Identify the act: what was done to which computer resource, and by whom.
2Check authorisation: was access denied, unauthorised, or beyond authorised access, or was a contaminant introduced?
3Test the intent: was there intent to threaten India's unity, integrity, security or sovereignty, or to strike terror? If yes, move to limb (A).
4Test the consequence: death, injury, property damage, disruption of essential services, or harm to critical information infrastructure (section 70)? Actual or likely is enough.
5If there is no terror intent, check limb (B): was restricted information on State security or foreign relations obtained, or other restricted data with reason to believe it may be misused?
6Conclude with the provision, the facts that satisfy it, and the punishment: imprisonment which may extend to life, including for conspiracy.
7Add the supporting points: sections 84B and 84C for abetment and attempt, section 77 for other laws, and section 77A for no compounding.

Quickest way: Intent-Means-Effect check

When to use it: Use when a short case gives you a cyber incident and asks if section 66F applies.

Write the intent in one line. No terror or security intent and no restricted data means it is not 66F.
Match the means to the three listed in (A): denial, unauthorised access, contaminant. Any one is enough.
Match the effect to the list: harm to life or property, essential services, critical information infrastructure. All three elements (intent, means, effect) must be present.
Close with the punishment: imprisonment which may extend to life.

Common mistakes in IT Act, 2000: Cyber Offences and Cyber Terrorism (Section 66F)

Calling every hacking incident cyber terrorism.
Students focus on the unauthorised access and ignore the intent requirement.
Fix: Always state the special intent and the consequence. Without them the act falls under other sections, not 66F.
Adding a fine or a minimum term to the punishment.
Other IT Act sections mention fines, so students assume a fine here.
Fix: Write exactly: imprisonment which may extend to imprisonment for life. No minimum term and no fine appear in section 66F(2).
Missing limb (B) and treating terror intent as always essential.
Students remember only the first limb.
Fix: Learn both limbs. Limb (B) needs knowing or intentional unauthorised access to restricted information. For information restricted for State security or foreign relations, that is enough. For any other restricted information, you must also show reason to believe it may be used to cause the listed injury or to benefit a foreign nation or group.
Thinking conspiracy needs section 84B or 84C.
Students confuse general abetment and attempt provisions with the express words of 66F(2).
Fix: Say that 66F(2) itself covers whoever commits or conspires to commit. Sections 84B and 84C apply only where no express provision exists.
Saying the offence can be compounded.
Students recall section 77A without its limit.
Fix: Section 77A bars compounding of offences punishable with life or imprisonment above three years. Section 66F is punishable with life, so it cannot be compounded.
Stating that IT Act punishment excludes action under other laws.
Students treat the Act as a complete code.
Fix: Cite section 77: no compensation, penalty or confiscation under the Act prevents punishment under any other law.

Worked examples

Example 1

A group, intending to strike terror in the public, introduces a computer contaminant into the system of a city power utility. The grid fails for several hours and hospitals lose supply. Does section 66F apply? State the punishment.

Show the solution

Act: a contaminant was introduced into a computer resource. This is one of the means listed in 66F(1)(A)(iii). One listed means is enough.
Intent: the group intended to strike terror in the people. This satisfies the intent requirement.
Consequence: supplies or services essential to the life of the community were disrupted. Injury to persons is also likely. This meets the consequence requirement.
Intent, means and consequence are all present, so the act is cyber terrorism under 66F(1)(A).
Punishment under 66F(2): imprisonment which may extend to life. Conspirators are covered by the same sub-section.

Answer: Yes. The act is cyber terrorism under section 66F(1)(A). Each person who commits or conspires to commit it is punishable with imprisonment which may extend to life.

Example 2

An employee of a private software firm exceeds his authorised access and copies the firm's client list to sell to a rival. There is no link to State security. Is this cyber terrorism? Mention any related provisions.

Show the solution

Act: access beyond authorisation, so the means element is met in principle.
Intent: the aim was commercial gain. There was no intent to threaten India's unity, integrity, security or sovereignty, or to strike terror. Limb (A) fails.
Limb (B): the data is a client list, not information restricted for State security or foreign relations, and nothing shows reason to believe it may injure the interests listed in 66F(1)(B) or help a foreign nation or group. Limb (B) fails.
So section 66F does not apply. The conduct is an ordinary cyber offence or contravention under other provisions of the Act. Section 43A may apply if sensitive personal data was involved and the firm was negligent in keeping reasonable security practices. Section 72A applies only where a person who had access to material containing personal information about another person while providing services under a lawful contract discloses it, with the required intent or knowledge, without consent or in breach of the contract. It is now a penalty of up to twenty-five lakh rupees, and a copied client list by an employee may not clearly fit it.
Section 77 allows action under any other law as well.

Answer: No. It is not cyber terrorism because the terror or security intent and the restricted-data requirement are missing. Depending on the facts, it may fall under section 43A (if sensitive personal data was involved and the firm was negligent) or section 72A (only if its conditions are met; a penalty of up to twenty-five lakh rupees), and action under other laws is allowed by section 77.

Exam tips

Learn the three-part test for limb (A) and write it as intent, means and effect. Examiners reward structure.
Quote the punishment exactly: imprisonment which may extend to life. Do not add a fine.
In a case study, say why 66F does not apply when intent is missing. This distinguishes hacking from cyber terrorism.
Link 66F with sections 77, 77A, 84B and 84C in one closing paragraph to show the full legal picture.
Use section numbers only for those you know: 43A, 66F, 69B, 72A, 77, 77A, 84B and 84C.

Practice questions from Cyber Forensics

IT Act, 2000: Cyber Offences and Cyber Terrorism (Section 66F) in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

CMA FinalCyber Terrorism under Section 66F

IT Act, 2000: Cyber Offences and Cyber Terrorism (Section 66F): frequently asked questions

What is the punishment for cyber terrorism under section 66F?

Whoever commits or conspires to commit cyber terrorism is punishable with imprisonment which may extend to imprisonment for life. The section does not prescribe a fine.

What is the difference between hacking and cyber terrorism under the IT Act?

Hacking is unauthorised access. Cyber terrorism needs more: intent to threaten India's unity, security or sovereignty or to strike terror, plus harm or likely harm of the kind listed, or access to restricted information under limb (B). Without these, the act is not cyber terrorism.

Can a cyber terrorism offence be compounded?

No. Section 77A bars compounding of offences punishable with life or imprisonment for more than three years. Section 66F carries imprisonment up to life, so it cannot be compounded.

Does the IT Act apply to offences committed outside India?

Yes, in the way section 1(2) provides. The Act extends to the whole of India and, save as otherwise provided, also applies to any offence or contravention under it committed outside India by any person.