Professional Documents
Culture Documents
Rohas Nagpal
Asian School of Cyber Laws
1|Page
w
www.asianlaws.org
2|Page
3|Page
4|Page
Contents
5|Page
6|Page
ONE
Development
1. Information Technology Act, 2000 came into force
2. Indian Penal Code, 1860 amended
3. Indian Evidence Act, 1872 amended
4. Bankers Book Evidence Act, 1879 amended
5. Reserve Bank of India Act, 1934 amended
6. Information Technology (Certifying Authorities)
Rules, 2000 came into force
7. Cyber Regulations Appellate Tribunal (Procedure)
Rules, 2000 came into force
2001
2002
7|Page
2004
8|Page
2009
2011
9|Page
10 | P a g e
Vishal Kumar & Others vs Union of India & Others (Case no PIL 61/02)
13 | P a g e
14 | P a g e
15 | P a g e
16 | P a g e
TWO
Applicable law
Before 27 October, 2009
Scenario 2:
An online hate community is created. This community
displays objectionable information against a particular country,
religious or ethnic group or even against national leaders and
historical figures.
Usual motives: Desire to cause racial hatred and communal
discord and disharmony.
Applicable law
Before 27 October, 2009
18 | P a g e
Scenario 3:
A fake profile of a man is created on Orkut. The profile
contains defamatory information about the victim (such as his
alleged sexual weakness, alleged immoral character etc).
Usual motives: Hatred (e.g. a school student who has failed
may victimize his teachers).
Applicable law
Before 27 October, 2009
19 | P a g e
20 | P a g e
Scenario 2:
The victims email account password is stolen and the hacker
tries to extort money from the victim. The victim is threatened
that if he does not pay the money, the information contained in
the emails will be misused.
Usual motives: Illegal financial gain.
Applicable law
Before 27 October, 2009
Sections 43, 66 and 67of the Section 43, 66, 66A and 67 of
Information Technology Act
the Information Technology
Act Additionally, depending
upon the content, sections 66C
and 67B of the Information
Technology Act may also apply
21 | P a g e
22 | P a g e
Scenario 2:
The victims account passwords are stolen and his share
trading accounts are misused for making unauthorised
transactions that result in the victim making losses.
Usual motives: Revenge, jealousy, hatred.
23 | P a g e
Applicable law
Before 27 October, 2009
Modus Operandi:
The suspect would install keyloggers in public computers (such
as cyber cafes, airport lounges etc) or the computer of the
victim. Unsuspecting victims would use these infected
computers to login to their online banking and share trading
accounts. The passwords and other information of the victim
would be emailed to the suspect.
24 | P a g e
Scenario 2:
The suspect uses virtual storage media for hiding the
information e.g. email accounts, online briefcases, FTP sites,
Gspace etc.
25 | P a g e
Applicable law
Before 27 October, 2009
26 | P a g e
27 | P a g e
Applicable law
Before 27 October, 2009
Scenario 2:
The suspect (usually an employee of the victim) steals the
source code and uses it as a base to make and sell his own
version of the software.
Modus Operandi: If the suspect is an employee of the victim,
he would usually have direct or indirect access to the source
code. He would steal a copy of the source code and hide it using
a virtual or physical storage device. If the suspect is not an
employee of the victim, he would hack into the victims servers
to steal the source code. Or he would use social engineering to
get unauthorised access to the code.
He would then modify the source code (either himself or in
association with other programmers) and launch his own
software.
Usual motives: Illegal financial gain.
28 | P a g e
Applicable law
Before 27 October, 2009
29 | P a g e
Scenario 2:
A criminal obtains the information by hacking or social
engineering and threatens to make the information public
unless the victim pays him some money.
Usual motives: Illegal financial gain.
30 | P a g e
Applicable law
Before 27 October, 2009
Scenario 3:
A disgruntled employee steals the information and mass mails
it to the victims rivals and also posts it to numerous websites
and newsgroups.
Usual motives: Revenge.
Applicable law
Before 27 October, 2009
31 | P a g e
8. Software Piracy
Many people do not consider software piracy to be theft. They
would never steal a rupee from someone but would not think
twice before using pirated software. There is a common
perception amongst normal computer users to not consider
software as property. This has led to software piracy
becoming a flourishing business.
Scenario 1:
The software pirate sells the pirated software in physical media
(usually CD ROMs) through a close network of dealers.
Modus Operandi: The suspect uses high speed CD duplication
equipment to create multiple copies of the pirated software.
This software is sold through a network of computer hardware
and software vendors.
Usual motives: Illegal financial gain.
Applicable law
Before 27 October, 2009
32 | P a g e
Scenario 2:
The software pirate sells the pirated software through
electronic downloads through websites, bulletin boards,
newsgroups, spam etc.
Modus Operandi: The suspect registers a domain name using
a fictitious name and then hosts his website using a service
provider that is based in a country that does not have cyber
laws. Such service providers do not divulge client information
to law enforcement officials of other countries.
Usual motives: Illegal financial gain.
Applicable law
Before 27 October, 2009
33 | P a g e
9. Music Piracy
Many people do not consider music piracy to be theft. They
would never steal a rupee from someone but would not think
twice before buying or using pirated music. There is a common
perception amongst people that music is not property. There
is a huge business in music piracy. Thousands of unscrupulous
businessmen sell pirated music at throw away prices.
Scenario 1:
The music pirate sells the pirated music in physical media
(usually CD ROMs) through a close network of dealers.
Modus Operandi: The suspect uses high speed CD duplication
equipment to create multiple copies of the pirated music. This
music is sold through a network of dealers.
Usual motives: Illegal financial gain.
Applicable law
Before 27 October, 2009
34 | P a g e
Scenario 2:
The music pirate sells the pirated music through electronic
downloads through websites, bulletin boards, newsgroups,
spam emails etc.
Modus Operandi: The suspect registers a domain name using
a fictitious name and then hosts his website using a service
provider that is based in a country that does not have cyber
laws. Such service providers do not divulge client information
to law enforcement officials of other countries.
Usual motives: Illegal financial gain.
Applicable law
35 | P a g e
36 | P a g e
11. Phishing
With the tremendous increase in the use of online banking,
online share trading and ecommerce, there has been a
corresponding growth in the incidents of phishing being used
to carry out financial frauds.
Phishing involves fraudulently acquiring sensitive information
(e.g. passwords, credit card details etc) by masquerading as a
trusted entity.
Scenario:
The victim receives an email that appears to have been sent
from his bank. The email urges the victim to click on the link in
the email. When the victim does so, he is taken to a secure
page on the banks website.
The victim believes the web page to be authentic and he enters
his username, password and other information. In reality, the
website is a fake and the victims information is stolen and
misused.
Modus Operandi: The suspect registers a domain name using
fictitious details. The domain name is usually such that can be
misused for spoofing e.g. Noodle Bank has its website at
www.noodle.com The suspect can target Noodle customers
using
a
domain
name
like
www.noodle-bankcustomerlogin.com
The suspect then sends spoofed emails to the victims e.g. the
emails may appear to come from info@noodle.com
37 | P a g e
38 | P a g e
39 | P a g e
40 | P a g e
Applicable law
Before 27 October, 2009
41 | P a g e
42 | P a g e
Apart
from
conventional
terrorism laws, section 69 of
the Information Technology
Act may apply
Apart
from
conventional
terrorism laws, section 69 of
the Information Technology
Act may apply
43 | P a g e
44 | P a g e
Scenario 2:
The virus targets a particular organization. This type of a virus
is not known to anti-virus companies as it is a new virus
created specifically to target a particular organization.
Modus Operandi: A skilled programmer creates a new type or
strain of virus. He does not release it on the Internet. Instead,
he sells it for a huge amount of money. The buyer uses the virus
to target his rival company. Being a new virus, it may go
undetected by the victim companys anti-virus software and
hence would be able to cause a lot of damage. Anti-virus
companies may never get to know about the existence of the
virus.
Applicable law
Before 27 October, 2009
45 | P a g e
Applicable law
Before 27 October, 2009
47 | P a g e
THREE
49 | P a g e
50 | P a g e
BCC did not deliver the coal to PRTA. Instead it e-mailed PRTA
saying that the sale as well as the e-auction in favour of PRTA
stood cancelled "due to some technical and unavoidable
reasons".
The only reason for this cancellation was that there was some
other person whose bid for the same coal was slightly higher
than that of PRTA. Due to some flaw in the computer or its
programme or feeding of data the higher bid had not been
considered earlier.
This communication was challenged by PRTA in the High Court
of Allahabad. [Note: Allahabad is in the state of Uttar Pradesh
(UP)]
BCC objected to the territorial jurisdiction of the Court on the
grounds that no part of the cause of action had arisen within
U.P.
Issue raised by BCC
The High Court at Allahabad (in U.P.) had no
jurisdiction as no part of the cause of action had
arisen within U.P.
Issues raised by PRTA
1. The communication of the acceptance of the
tender was received by the petitioner by e-mail
at Chandauli (U.P.). Hence, the contract (from
which the dispute arose) was completed at
Chandauli (U.P). The completion of the contract
is a part of the cause of action.
51 | P a g e
53 | P a g e
55 | P a g e
56 | P a g e
a database, knows which cell phone you are using and gives a
ring.
(12) So as to match with the system of the cell phone provider,
every cell phone contains a circuit board, which is the brain of
the phone. It is a combination of several computer chips
programmed to convert analog to digital and digital to analog
conversion and translation of the outgoing audio signals and
incoming signals.
(13) This is a micro processor similar to the one generally used
in the compact disk of a desktop computer. Without the circuit
board, cell phone instrument cannot function.
(14) When a Reliance customer opts for its services, the MIN
and SID are programmed into the handset. If someone
manipulates and alters ESN, handsets which are exclusively
used by them become usable by other service providers like
TATA Indicom.
Conclusions of the court
(1) A cell phone is a computer as envisaged under the
Information Technology Act.
(2) ESN and SID come within the definition of computer
source code under section 65 of the Information Technology
Act.
(3) When ESN is altered, the offence under Section 65 of
Information Technology Act is attracted because every service
provider has to maintain its own SID code and also give a
58 | P a g e
59 | P a g e
60 | P a g e
(3) The sale consideration was not routed through the accused.
(4) Prima facie Baazee.com had endeavored to plug the
loophole.
(5) The accused had actively participated in the investigations.
(6) The nature of the alleged offence is such that the evidence
has already crystallized and may even be tamper proof.
(7) Even though the accused is a foreign citizen, he is of Indian
origin with family roots in India.
(8) The evidence that has been collected indicates only that the
obscene material may have been unwittingly offered for sale on
the website.
(9) The evidence that has been collected indicates that the
heinous nature of the alleged crime may be attributable to
some other person.
62 | P a g e
FOUR
63 | P a g e
Malaysia
Government of India
- Spain (2002)
- Cuba (2003)
- Peru (2004)
Internet Time Theft & the Indian Law white paper prepared for the Corps of
Detectives, Karnataka Police, September
2001.
FIVE
64 | P a g e
Preamble
An Act to provide legal recognition for transactions carried out
by means of electronic data interchange and other means of
electronic communication, commonly referred to as "electronic
commerce", which involve the use of alternative to paperbased methods of communication and storage of information,
to facilitate electronic filing of documents with the Government
agencies and further to amend the Indian Penal Code, the India
Evidence Act, 1872, the Bankers Books Evidence Act, 1891 and
the Reserve Bank of India Act, 1934 and for matters connected
therewith or incidental thereto.
WHEREAS the General Assembly of the United Nations by
resolution A/RES/ 51/162, dated 30th January, 1997 has
adopted the Model Law on Electronic Commerce adopted by
the United Nations Commission on International Trade Law;
AND WHREAS the said resolution recommends inter alia that
all States give favourable consideration to the said Model Law
when they enact or revise their laws, in view of the need for
uniformity of the law applicable to alternatives to paper based
methods of communication and storage of information;
65 | P a g e
CHAPTER I
PRELIMINARY
1. Short title, extent, commencement and application
(1) This Act may be called the Information Technology Act,
2000.
(2) It shall extend to the whole of India and, save as otherwise
provided in this Act, it applies also to any offence or
contravention thereunder committed outside India by any
person.
(3) It shall come into force on such date as the Central
Government may, by notification, appoint and different dates
may be appointed for different provisions of this Act and any
reference in any such provision to the commencement of this
Act shall be construed as a reference to the commencement of
that provision2.
66 | P a g e
67 | P a g e
68 | P a g e
69 | P a g e
70 | P a g e
10
12
71 | P a g e
Official
Gazette
13
14
72 | P a g e
16
73 | P a g e
74 | P a g e
18
75 | P a g e
CHAPTER II
DIGITAL SIGNATURE AND ELECTRONIC
SIGNATURE19
3. Authentication of electronic records.
(1) Subject to the provisions of this section, any subscriber
may authenticate an electronic record by affixing his digital
signature.
(2) The authentication of the electronic record shall be effected
by the use of asymmetric crypto system and hash function
which envelop and transform the initial electronic record into
another electronic record.
Explanation - For the purposes of this sub-section, "hash
function" means an algorithm mapping or translation of one
sequence of bits into another, generally smaller, set known as
19
76 | P a g e
77 | P a g e
78 | P a g e
CHAPTER III
ELECTRONIC GOVERNANCE
4. Legal recognition of electronic records
Where any law provides that information or any other matter
shall be in writing or in the typewritten or printed form, then,
notwithstanding anything contained in such law, such
requirement shall be deemed to have been satisfied if such
information or matter is(a) rendered or made available in an electronic form;
and
(b) accessible so as to be usable for a subsequent
reference.
5. Legal recognition of electronic signatures21.
Where any lay provides that information or any other matter
shall be authenticated by affixing the signature or any
document shall be signed or bear the signature of any person,
then, notwithstanding anything contained in such law, such
requirement shall be deemed to have been satisfied, if such
21
79 | P a g e
80 | P a g e
(2) The appropriate Government may, for the purposes of subsection (1), by rules, prescribe(a) the manner and format in which such electronic
records shall be filed, created or issued;
(b) the manner or method of payment of any fee or
charges for filing, creation or issue any electronic
record under clause (a).
6A. Delivery of services by service provider.23
(1) The appropriate Government may, for the purposes of this
Chapter and for efficient delivery of services to the public
through electronic means authorise, by order, any service
provider to set up, maintain and upgrade the computerized
facilities and perform such other services as it may specify by
notification in the Official Gazette.
Explanation For the purposes of this section, service provider
so authorised includes any individual, private agency, private
company, partnership firm, sole proprietor firm or any such
other body or agency which has been granted permission by
the appropriate Government to offer services through
electronic means in accordance with the policy governing such
service sector.
(2) The appropriate Government may also authorise any
service provider authorised under sub-section (1) to collect,
retain and appropriate such service charges, as may be
prescribed by the appropriate Government for the purpose of
providing such services, from the person availing such service.
23
81 | P a g e
82 | P a g e
83 | P a g e
25
The words electronic signature substituted for digital signature by
Information Technology (Amendment) Act, 2008.
26
The words electronic signature substituted for digital signature by
Information Technology (Amendment) Act, 2008.
27
84 | P a g e
CHAPTER IV
ATTRIBUTION, ACKNOWLEDGEMENT AND
DESPATCH OF ELECTRONIC RECORDS
28
The words electronic signature substituted for digital signature by
Information Technology (Amendment) Act, 2008.
29
The words electronic signature substituted for digital signature by
Information Technology (Amendment) Act, 2008.
30
85 | P a g e
11. Attribution of electronic records.An electronic record shall be attributed to the originator,(a) if it was sent by the originator himself;
(b) by a person who had the authority to act on behalf of the
originator in respect of that electronic record; or
(c) by any information system programmed by or on behalf of
the originator to operate automatically.
12. Acknowledge of receipt.(1) Where the originator has not stipulated31 that the
acknowledgement of receipt of electronic record be given in a
particular form or by a particular method, an
acknowledgement may be given by(a) any communication by the addressee, automated or
otherwise; or
(b) any conduct of the addressee, sufficient to indicate
to the originator that the electronic record has been
received.
(2) Where the originator has stipulated that the electronic
record shall be binding only on receipt of an acknowledgement
of such electronic record by him, then unless acknowledgement
has been so received, the electronic record shall be deemed to
have been never sent by the originator.
31
The word stipulated substituted for the words agreed with the addressee by
Information Technology (Amendment) Act, 2008.
86 | P a g e
(3) Where the originator has not stipulated that the electronic
record shall be binding only on receipt of such
acknowledgment, and the acknowledgement has not been
received by the originator within the time specified or agreed
or, if no time has been specified or agreed to within a
reasonable time, then the originator may give notice to the
addressee stating that no acknowledgement has been received
by him and specifying a reasonable time by which the
acknowledgement must be received by him and if no
acknowledgement is received within the aforesaid time limit he
may after giving notice to the addressee, treat the electronic
record as though it has never been sent.
13. Time and place of desptach and receipt of electronic
record.
(1) Save as otherwise agreed to between the originator and the
addressee, the despatch of an electronic record occurs when it
enters a computer resources outside the control of the
originator.
(2) Save as otherwise agreed between the originator and the
addressee, the time of receipt of an electronic record shall be
determined as follows, namely:(a) if the addressee has designated a computer
resource for the purpose of receiving electronic
record,(i) receipt occurs at the time when the
electronic record enters the designated
computer resources; or
87 | P a g e
CHAPTER V
SECURE ELECTRONIC RECORDS AND SECURE
ELECTRONIC32 SIGNATURES33
14. Secure electronic record.Where any security procedure has been applied to an
electronic record at a specific point of time, then such record
shall be deemed to be a secure electronic record from such
point of time to the time of verification.
15. Secure electronic signature.-34
An electronic signature shall be deemed to be a secure
electronic signature if
(i) the signature creation data, at the time of affixing signature,
was under the exclusive control of signatory and no other
person; and
32
34
Substituted by Information Technology (Amendment) Act, 2008 for 15. Secure
digital signature.- If, by application of a security procedure agreed to by the
parties concerned, it can be verified that a digital signature, at the time it was
affixed, was (a) unique to the subscriber affixing it; (b) capable of identifying
such subscriber; (c) created in a manner or using a means under the exclusive
control of the subscriber and is linked to the electronic record to which related in
such a manner that if the electronic record was altered the digital signature would
be invalidated, then such digital signature shall be deemed to be a secure digital
signature
89 | P a g e
(ii) the signature creation data was stored and affixed in such
exclusive manner as may be prescribed.
Explanation. In case of digital signature, the signature
creation data means the private key of the subscriber.
16. Security procedures and practices.-35
The Central Government may, for the purposes of sections 14
and 15, prescribe the security procedures and practices:
Provided that in prescribing such security procedures and
practices, the Central Government shall have regard to the
commercial circumstances, nature of transactions and such
other related factors as it may consider appropriate.
CHAPTER VI
REGULATION OF CERTIFYING AUTHORITIES
17. Appointment of Controller and other officers.
35
90 | P a g e
37
The words and Assistant Controllers substituted for the words Assistant
Controllers, other officers and employees by Information Technology
(Amendment) Act, 2008.
91 | P a g e
38
92 | P a g e
40
93 | P a g e
41
Controller to act as repository. (1) The Controller shall be the repository of all
Digital Signature Certificates issued under this Act. (2) The Controller shall- (a)
make use of hardware, software and procedures that are secure from intrusion and
misuse; (b) observe such other standards as may be prescribed by the Central
Government; to ensure that the secrecy and security of the digital signatures are
assured. (3) The Controller shall maintain a computerised data base of all public
keys in such a manner that such data base and the public keys are available to any
member of the public.
42
The words electronic signature substituted for digital signature by
Information Technology (Amendment) Act, 2008.
43
94 | P a g e
(3) A licence granted under this sections shall(a) be valid for such period as may be prescribed by the
Central Government;
(b) not be transferable or heritable;
(c) be subject to such terms and conditions as may be
specified by the regulations.
22. Application for licence45.
(1) Every application for issue of a licence shall be in such form
as may be prescribed by the Central Government.
(2) Every application for issue of a licence shall be
accompanied by(a) a certification practice statement;
(b) a statement including the procedures with respect
to identification of the applicant;
44
Also refer to Circular No. 1/2001 dated 9th July 2001 titled GUIDELINES
FOR SUBMISSION OF APPLICATION FOR LICENCE TO OPERATE AS A
CERTIFYING AUTHORITY UNDER THE IT ACT, 2000 issued by Office of
Controller of Certifying Authorities.
95 | P a g e
46
Substituted for the words (c) failed to maintain the standards specified under
clause (b) of sub-section (2) of section 20; by Information Technology (Removal
of Difficulties) Order, 2002
47
97 | P a g e
48
The words any contravention of the provisions of this Chapter substituted for
any contravention of the provisions of this Act, rules or regulations made
thereunder by Information Technology (Amendment) Act, 2008.
99 | P a g e
51
100 | P a g e
101 | P a g e
CHAPTER VII
ELECTRONIC SIGNATURE56 CERTIFICATES
35. Certifying Authority to issue Electronic Signature57
Certificate.
(1) Any person may make an application to the Certifying
Authority for the issue of a Electronic Signature Certificate in
such form as may be prescribed by the Central Government.
55
The words electronic signature substituted for digital signature by
Information Technology (Amendment) Act, 2008.
56
The words electronic signature substituted for digital signature by
Information Technology (Amendment) Act, 2008.
57
102 | P a g e
Also refer to Executive Order dated 12th September, 2002 which states inter alia
that For the purpose of sub-sections (3) and (4) of Section 35 of the Information
Technology Act, 2000. every application for the issue of a Digital Signature
Certificate shall not be required to be accompanied by a certificate practice
statement as required under the said sub-sections.
59
(a) the applicant holds the private key corresponding to the public key to be
listed in the Digital Signature Certificate;
103 | P a g e
60
104 | P a g e
105 | P a g e
CHAPTER VIII
DUTIES OF SUBSCRIBERS
62
Also refer to Circular No. 1/2002 dated 16th December 2002 titled
GUIDELINES FOR SUBMISSION OF CERTIFICATES AND CRLS TO THE
CCA FOR PUBLISHING IN NRDC BY CERTIFYING AUTHORITIES issued
by Office of Controller of Certifying Authorities.
107 | P a g e
40. Generating key pair.Where any Digital Signature Certificate, the public key of which
corresponds to the private key of that subscriber which is to be
listed in the Digital Signature Certificate has been accepted by a
subscriber, the subscriber shall generate that key pair by
applying the security procedure63.
40A. Duties
Certificate.-
of
subscriber
of
Electronic
Signature
63
Substituted for 40. Where any Digital Signature Certificate, the public key of
which corresponds to the private key of that subscriber which is to be listed in the
Digital Signature Certificate has been accepted by a subscriber, then, the
subscriber shall generate the key pair by applying the security procedure. by
Information Technology (Removal of Difficulties) Order, 2002.
64
108 | P a g e
65
Substituted for (1) Every subscriber shall exercise reasonable care to retain
control of the private key corresponding to the public key listed in his Digital
Signature Certificate and take all steps to prevent its disclosure to a person not
authorised to affix the digital signature of the subscriber. by Information
Technology (Removal of Difficulties) Order, 2002.
109 | P a g e
CHAPTER IX
PENALITIES, COMPENSATION AND
ADJUDICATION 66
43. Penalty and compensation67 for damage to computer,
computer system, etc.If any person without permission of the owner or any other
person who is in charge of a computer, computer system or
computer network,(a) accesses or secures access to such computer,
computer system or computer network or computer
resource68;
(b) downloads, copies or extracts any data, computer
data base or information from such computer,
computer system or computer network including
66
The words PENALITIES, COMPENSATION AND ADJUDICATION
substituted for PENALTIES AND ADJUDICATION by Information
Technology (Amendment) Act, 2008.
67
110 | P a g e
69
111 | P a g e
70
71
The words he shall be liable to pay damages by way of compensation to the
person so affected substituted for he shall be liable to pay damages by way of
compensation not exceeding one crore rupees to the person so affected.
112 | P a g e
73
113 | P a g e
115 | P a g e
Refer to the Order dated 25th March 2003 [G.S.R.240(E)] which states inter alia
that the Secretary of Department of Information Technology of each of the States
or of Union Territories is hereby appointed as Adjudicating Officer for the
purposes of the Information Technology Act, 2000.
Also refer to Information Technology (Qualification and Experience of
Adjudicating Officers and Manner of Holding Enquiry) Rules, 2003 dated 17th
March 2003.
76
116 | P a g e
117 | P a g e
CHAPTER X
THE CYBER APPELLATE TRIBUNAL78
48. Establishment of Cyber Appellate Tribunal.
(1) The Central Government shall, by notification, establish one
or more appellate tribunals to be known as the Cyber Appellate
Tribunal.
(2) The Central Government shall also specify, in the
notification referred to in sub-section (1), the matters and
places in relation to which the Cyber Appellate Tribunal may
exercise jurisdiction.
49. Composition of Cyber Appellate Tribunal.-79
(1) The Cyber Appellate Tribunal shall consist of a
Chairperson and such number of other Members, as the Central
Government may, by notification in the official Gazette,
appoint:
Provided that the person appointed as the Presiding Officer of
the Cyber Appellate Tribunal under the provisions of this Act
immediately before the commencement of the Information
Technology (Amendment) Act, 2008 shall be deemed to have
78
79
118 | P a g e
120 | P a g e
121 | P a g e
The salary and allowances payable to, and the other terms and
conditions of service including pension, gratuity and other
retirement benefits of, the Chairperson or a Member of the
Cyber Appellate Tribunal shall be such as may be prescribed.
52A. Powers of superintendence, direction etc.83
The Chairperson of the Cyber Appellate Tribunal shall have
powers of general superintendence and directions in the
conduct of the affairs of that Tribunal and he shall, in addition
to presiding over the meetings of the Tribunal, exercise and
discharge such powers and functions of the Tribunal as may be
prescribed.
52B. Distribution of business among Benches.84
Where Benches are constituted, the Chairperson of the Cyber
Appellate Tribunal may, by order, distribute the business of
that Tribunal amongst the Benches and also the matters to be
dealt with by each Bench.
52C. Power of Chairperson to transfer cases. 85
82
83
84
85
122 | P a g e
86
87
The words Chairperson or Member, as the case may be, substituted for
Presiding Officer by Information Technology (Amendment) Act, 2008.
123 | P a g e
88
The words Chairperson or Member, as the case may be, substituted for
Presiding Officer by Information Technology (Amendment) Act, 2008.
89
The words Chairperson or Member, as the case may be, substituted for
Presiding Officer by Information Technology (Amendment) Act, 2008.
90
The words Chairperson or Member, as the case may be, substituted for
Presiding Officer by Information Technology (Amendment) Act, 2008.
91
The words Chairperson or Member, as the case may be, substituted for
Presiding Officer by Information Technology (Amendment) Act, 2008.
124 | P a g e
The words Chairperson or Member, as the case may be, substituted for
Presiding Officer by Information Technology (Amendment) Act, 2008.
93
125 | P a g e
126 | P a g e
The word Chapter has been substituted by the word Act by Information
Technology (Removal of Difficulties) Order, 2002.
129 | P a g e
CHAPTER XI
OFFENCES
130 | P a g e
131 | P a g e
99
132 | P a g e
stolen
100
101
102
133 | P a g e
103
134 | P a g e
(1) Whoever, (A) with intent to threaten the unity, integrity, security or
sovereignty of India or to strike terror in the people or any
section of the people by (i) denying or cause the denial of access to any person
authorised to access computer resource; or
(ii) attempting to penetrate or access a computer
resource without authorisation or exceeding
authorised access; or
(iii) introducing or causing to introduce any computer
contaminant,
and by means of such conduct causes or is likely to cause death
or injuries to persons or damage to or destruction of property
or disrupts or knowing that it is likely to cause damage or
disruption of supplies or services essential to the life of the
community or adversely affect the critical information
infrastructure specified under section 70; or
(B) knowingly or intentionally penetrates or accesses a
computer resource without authorisation or exceeding
authorised access, and by means of such conduct obtains access
to information, data or computer database that is restricted for
reasons of the security of the State or foreign relations; or any
restricted information, data or computer database, with
reasons to believe that such information, data or computer
database so obtained may be used to cause or likely to cause
injury to the interests of the sovereignty and integrity of India,
the security of the State, friendly relations with foreign States,
public order, decency or morality, or in relation to contempt of
135 | P a g e
104
Also refer to the Order dated 27th February, 2003 [G.S.R. 181(E)] that
prescribes the procedure for blocking of websites.
105
136 | P a g e
of either description for a term which may extend to ten years and also with fine
which may extend to two lakh rupees.
106
107
137 | P a g e
138 | P a g e
108
109
139 | P a g e
140 | P a g e
111
141 | P a g e
112
142 | P a g e
113
Also refer to Executive Order dated 12th September, 2002 which states inter
alia that For the purpose of sub-section 1 of Section 70 of the Act, details of
every protected computer, computer system or computer network so notified by
appropriate government may be informed to the Controller of Certifying
Authorities, Department of Information Technology, 6 CGO Complex, New Delhi
for the purpose of records and exercising powers under the said Act.
143 | P a g e
114
116
144 | P a g e
dissemination
117
145 | P a g e
of
118
147 | P a g e
Signature120
148 | P a g e
149 | P a g e
123
150 | P a g e
125
126
151 | P a g e
CHAPTER XII
INTERMEDIARIES NOT TO BE LIABLE IN CERTAIN CASES127
79. Exemption from liability of intermediary in certain
cases.
(1) Notwithstanding anything contained in any law for the time
being in force but subject to the provisions of sub-sections (2)
and (3), an intermediary shall not be liable for any third party
information, data, or communication-link made available or
hosted by him.
(2) The provisions of sub-section (1) shall apply if
(a) the function of the intermediary is limited to providing
access to a communication system over which information
made available by third parties is transmitted or temporarily
stored or hosted; or
(b) the intermediary does not
127
153 | P a g e
CHAPTER XIIA
EXAMINER OF ELECTRONIC EVIDENCE128
CHAPTER XIII
MISCELLANEOUS
128
154 | P a g e
155 | P a g e
130
131
132
157 | P a g e
134
158 | P a g e
135
160 | P a g e
136
138
161 | P a g e
139
140
143
162 | P a g e
144
(g) other standards to be observed by the Controller under clause (b) of subsection (2) of section 20;
145
146
163 | P a g e
147
149
150
164 | P a g e
151
154
155
165 | P a g e
156
157
158
159
160
161
166 | P a g e
162
163
164
The words Every notification made by the Central Government under subsection (1) of section 70A and every rule made by it substituted by Information
Technology (Amendment) Act, 2008 for Every notification made by the Central
Government under clause (f) of sub-section (4) of section 1 and every rule made
by it.
165
167 | P a g e
168 | P a g e
(c) any other matter which is required to be provided by rules by the State
Government.
170 | P a g e
FIRST SCHEDULE174
[See sub-section (4) of section 1]
170
171 | P a g e
1.
2.
3.
4.
5.
175
172 | P a g e
Sl. No.
(1)
173 | P a g e
Description
(2)
Procedure
(3)
SIX
Rohas Nagpal
Rohas Nagpal is a lawyer by qualification, a cyber crime
investigator by profession, a hacker at heart and a programmer
by passion.
174 | P a g e
175 | P a g e
177 | P a g e
Contact us
Pune
6th Floor, Pride Senate,
Behind Sigma House,
Senapati Bapat Road,
Pune - 411016
Mumbai
7 Vaswani Mansions,
Opp. H.R. College,
Dinshaw Wachha Road,
Churchgate,
Mumbai - 400020
Delhi (Liaison Office)
Data64 Techno Solutions Pvt. Ltd.
15th Floor,
EROS Corporate Tower,
Nehru Place,
New Delhi - 110019
www.asianlaws.org
Contact Numbers
(020) 25667148
(020) 40033365
(020) 65206029
Contact Numbers
9594996366
9594996363
9594996364
(022) 22814502
(022) 22814503
(022) 66300223
Contact Numbers
09212227459
08800677554
08800644557
www.data64.in
Rohas Nagpal
Asian School of Cyber Laws