IT Act 2000 – Criminal Aspects

ByS. Prabhakara Rao

CISA, PGDCL&IPR, MBA, LL.B, B.Com.Cell: 9848002242

sreemantulaprao@gmail.com

Cyber crimes – A listing

• Old crimes new medium– Frauds– Alteration and destruction of information– Murder, molestation, eve teasing, theft etc.etc..

• Viruses, Trojan horses, logic bombs and destruction/alteration of digital data

• Hacking without intention to commit any further offence

Cyber Crimes

• Unauthorized access with intention to commit further offences like theft, forgery, frauds, misappropriation etc..

• Defamation

• Cyber stalking

• Pornography

Elements of a crime

• Actus reus– Is the physical result of human conduct.– It includes all the elements in the definition of

the crime except the accused mental element.– Easy to define but difficult to prove in a cyber

crime.– In cyber crimes an occurrence or actus reus is

done when : trying to make a computer function like using the mouse or keyboard,

– Trying to access data stored on a computer or from a computer which has access to data stored outside like a hacker using an authorized password to login to a company’s main server to gain access to information either directly in the main computer or in a huge data storage unit which is located elsewhere, trying to access data or access via the internet where the instructions first given by the person are passing through a chain of computers, attempting to login even if these attempts are failures which may be even running an automatic password hacking program.

Ingradients of a Crime

• Mens rea :– “guilty mind”.– May include different mental attitudes

including intention, recklessness and negligence.

– In cyber crimes mens rea means : access intended by person should be unauthorized and the person should be aware of the same at the time he/she tried to or did secure access.

– If hacker is from outside the organization then it is presumed that the access is unauthorized and that this was known to the person before access was sought.

– If hacker is from within the organization then limited authority is there anyhow and it will have to be proved that there is some explicit mention of authorities over various categories of data or areas and this was made known to the person before access was sought.

Purpose of IT Act 2000

• To provide legal recognition for transactions carried out by means of Electronic Data Interchange (E-Commerce)

• To facilitate Electronic Filing of documents with Government Agencies (E-Governance)

• To Amend IPC Act, Indian Evidence Act, Bankers’ Book Evidence Act and RBI Act.

IT Act and CrimesCh 11 : Offences

• The IT Act does not define a cyber crime, nor does it use this expression anywhere, it only provides definitions and punishment for various offences.

• Narrowly defined cyber crimes would constitute those crimes which are defined as offences in the IT Act, ch 11,secs 65-78.

Some Offences

• IT Act defines offences such as :– Tampering with computer source code

– Hacking

– Cyber pornography

– Cyber fraud

– Defamation

– Harassment

– E-mail abuse

– IPR abuse

• In general cyber crime would be any act or omission committed by the use of or committed on a computer (computer here meaning a computer system) which is prohibited by any law and for which punishment (monetary or corporeal) is provided.

• Therefore the IT Act does not define or

• all kinds of cyber crimes.• However if we take the example of a person

threatening grievous hurt or causing death using an e-mail he shall be liable for the offence of criminal intimidation under IPC 1860 even though it is not an offence under the IT Act and would be covered as a cyber crime under the broad definition of the same.

• Therefore the IT act has to be read with provisions of the IPC 1860 as well as CrPC and other acts which define and provide for punishment for criminal acts of omission and commission.

• The definition of an electronic record has been added to the IPC with an amendment and addition of section 29A.

• This provided for a linkage of all document

related crimes in the IPC to be equally applicable to digital documents.

• Sections affected by this change :– 167 – Public servant framing an incorrect

document with intent to cause injury.– 172 – Absconding to avoid service of summons

etc. to produce a document in a court of justice.

– 173 – Preventing service of summons etc. to produce a document in a court of justice.

– 175 – Omission to produce document to public servant by person legally bound to produce it.

– 192 – Fabricating false evidence.– 204 – Destruction of document to prevent its

production as evidence. Eg.Hughes company e-mail.

– 463 – Forgery.– 464 – Making a false document.– 466 – Forgery of record of court or of public

register etc..– 468 – Forgery for purpose of cheating.– 469 – Forgery for purpose of harming

reputation.– 470 – Forged document.

– 471 – Using as genuine a forged document.– 474 – having possession of document described

in section 466 or 467, knowing it to be forged and intending to use it as genuine.

– 476 – Counterfeiting device or mark used for authenticating documents other than those described in section 467 or possessing counterfeit marked material.

– 477A falsification of accounts.

• Indian Evidence Act 1872 also includes the concept of documents in digital format. In fact even before the IT Act in the case of Ziyauddin Burhanuddin Bukhari vs Brijmohan Ramdas Mehra & Ors. AIR 1975, SC 1788, the SC had included tape recorded speeches as documents.

• Hacking : can be divided into two basic kinds – one where there is an intention to injury and other where the intention is missing – cracking and hacking.

• Sometimes the one without intention to injury is called plain hacking and/or ethical hacking.

• Ankit Fadia has made a name for ethical hacking

• In general hackers are variously called as code hackers, phreakers, cyber-punks and crackers.

• Code hackers attack computers and operating systems and system software.

• Phreakers use intricate knowledge of internet and communications to break into networks etc..

• Cyber-punks specialise in cryptography and other information security areas.

• Hacking creates fear in the minds of netizens and also a notion that the network is insecure which is a serious setback for the

• proliferation of e-commerce. • It creates what we call as a reputation risk for

businesses on the net who would rather hide incidents of hacking rather than be forthcoming about them. This makes making estimates of hacking losses and study of hacking activities by law enforcers and internet security experts all the more difficult.

• Hacking has also become a method of protest against institutions and governments.

• The term hactivist has come from the above and was coined from the Mexican Zapatista movement where the rebel forces hacked into government sites and had virtual sit-ins to sabotage government sites.

• The intention behind hacking may be :– For fun as a hobby or as a means to show superiority in

technical knowledge.– To damage business of competitors and/or industrial

espionage.– For furthering it with other offences like fraud and

misappropriation.– For purpose of testing system security as part of

network or IS audits (ethical hacking)

• Section 66: Hacking with Computer System • This section defines and states the punishments for

hacking :– “Whoever with the intent …” gist is that there is an

attempt to destroy and/or alter computer resources which are either public or private/individual in order to and with full knowledge of the fact that this would lead to a reduction in the value of or injure otherwise thec resources in question.

– Punishment of imprisonment of up to three years or/and fine up to 2 lakh rupees.

• As is evident this definition is very broad and comprehensive and does not distinguish between ‘ethical’ hacking or ‘cracking’.

• The intention and/or knowledge of fact that losses are likely to happen is sufficient.

• As the mere knowledge that hacking will cause harm is relatively well known therefore intent or mens rea will in general be assumed to be present by default or presumed.

• As is with a majority of crimes as defined in the IPC and other laws the mens rea and acteus rea are combined in very definition of crime under the Indian law.

• Case Law – In February 2001, two persons Amit Parsai and Kapil Juneja blocked access to the complainant’s web site on the grounds of non payment of charges for hiring web space. They not only blocked the web page but also displayed the message “Site closed due to non payment pf bill..”.

• Blocking access was legal but display of the message amounted to “hacking” and “wrongful loss” under section 66 of IT Act and section 23 of IPC.

• The IT Act also covers damages for up to one crore on the commission of either or more of the following acts which are done

• by any person or person in charge of computer systems, without the permission of the owner (ch 9: Penalties and Adjudication)– Access to computer systems. Sec 43(a).

– Damage to computer systems including networks, computers and databases etc.. Sec 43(d).

– Disruption of any computer system or part of computer systems. Sec 43(e).

– Assistance to any person to facilitate access to computer systems in contravention of the IT Act, rules or regulations made therein. Sec 43(g).

• Hacking is taken care of by sec 66 (1) of IT Act but damages related to the activity are covered by the section 66(2), section 43 (as above) and section 47.

• Section 47 states that in order to determine the quantum of compensation for any wrongful acts as described in the Act the adjudicating officer would have due regard for :– Amount of gain or unfair advantage made as a

result of such defaults

– Amount of loss caused to any person as a result

of the default.– Repetitive nature of the default.

• Cyber frauds – As such a fraud or a cyber fraud has not been defined in the IT Act.

• For a definition of frauds we need to go to the other statutes namely here the Indian Contract Act and the IPC.

• Section 17 of the contract act defines fraud as an intent to deceive by :– stating of a fact knowing fully well that it is

false.– active concealment of a fact knowing that it is

true. – making a false promise.– any other fraudulent act or omission.

• Major areas of fraud on the internet include

misuse of credit cards, bogus get rich fast investment schemes, bogus auctions, bogus sale of goods or services etc..

• Actually cyber fraud is a misnomer as a fraud is usually a civil and contractual wrong in India and would not therefore constitute a criminal act.

• In order to consider it from the criminal point of view it would be more appropriate to define it as a criminal wrong in terms of cyber cheating and cheating as referred to by the IPC.

• Cheating is defined as in section 415 of the IPC and is very similar to that as per the law

• of contracts : representation of facts made which are known to be false with an intent to deceive for the purpose of material gain in terms of property or of any act or omission.

• Punishment as per section 417 of IPC is imprisonment or/and fine.

• Cheating by impersonation – Section 416 of IPC. Punishment is again imprisonment and/or fine section 419 of IPC.

• Cheating of/for property is defined by section 420 of the IPC with punishment of imprisonment and/or fine.

• Other sections of IPC relevant to cheating

are as follows :– 403 – Dishonest misappropriation of property.– 405 and 406 – criminal breach of trust.– 408 – criminal breach of trust by clerk or

servant.– 409 – criminal breach of trust by a public

servant or by banker, merchant, factor, broker, attorney or agent.

• Viruses – explanation (iii) of section 43 of IT Act 2000 :– Means any computer instruction, information, data or

program that destroys, damages, degrades or adversely affects the performance of a computer resource or attaches itself to another computer resource and operates when a program, data or instruction is executed or some other event takes place in that computer resource.

• Section 43 (c) of IT Act states that the person who introduces or causes to be introduced a computer virus shall be liable for providing compensation to a maximum of Rs.1 crore to the affected party or parties

• Again since it is computer offence as per IT

• Act therefore all provisions of section 47 of IT Act which are related to the decision of deciding compensation shall be also relevant in deciding the same.

• In case the virus is introduced with the intention of destroying or altering computer resources then the element of hacking is

• added to the offence and the punishments thereto shall be applicable.

• The introduction of viruses would also be liable to be compounded by the charges of the offence of mischief under section 425 of the IPC which is defined as a action of wrongful loss or damage or

• destruction to persons or the public or property thereof with the express intent of or full knowledge of the likely destruction, damage or wrongful harm.

• Usually viruses are likely to cause widespread damages and loss to property in terms of vital data and computer resources.

• Viruses as defined by the IT Act would

encompass such things such as Trojan horses, logic bombs, spamming etc..

• ‘I love you virus’ was a classic example of viruses that could cause large scale damage – it affected AT&T, Microsoft, Time Warner, Merrill Lynch, Ford Motors, British House of Commons, Pentagon, CIA

• and NASA.

• Defamation : Section 399 of the IPC states that following with regard to defamation :– making or publishing an imputation

concerning any person with an intention or knowledge that the imputation would harm the reputation of such person.

• Defamation occurs when the person makes an imputation concerning the complainant in front of other people or communicates the same to other people that is there is no defamation if the same is made only to the concerned person and is unknown to anyone else.

• Section 500 of IPC states punishment for defamation in terms of imprisonment or fine or both.

• Case law – TOI, 25/07/2000 – man sending e-mail messages from wife’s e-mail id to people after attaching vulgar and pornographic attachments – accused of

• defamation, criminal intimidation and acts intended to insult the modesty of women – Sections 499, 500, 506 and 509 of IPC. He intended to harass his wife as he was facing prosecution for harassment of his wife for dowry.

• Here as we can see internet is offering a

• canvas and powerful communications media for people to exchange information and is being used for traditional crimes such as defamation by taking advantage of its vast reach and ease of use.

• This is a crime using computer systems and has the same elements as that of it’s

• physical/erstwhile counterpart.

• Of course the usual defenses exist for defamation :– A true imputation made for the public good.– An opinion in good faith regarding the conduct

of the public servant in the discharge of his public functions etc..

• Cyberstalking – In general stalking refers to

harassing behavior that a person engages in repeatedly towards another person – willful course of conduct involving repeated or continued harassment of another individual that actually causes the victim to feel terrorized, frightened, intimidated, threatened, harassed or molested and that would cause a reasonable person to do so.

• Though cyber stalking may not involve the physical aspects of physical stalking it does in no manner reduce the effect of the same.

• In fact the relative anonymity that the cyber world offers encourages a lot more people to indulge in this behavior than otherwise.

• Statistics show that a majority of victims are women.

• Cyber stalking may be done via chat rooms, message boards or news groups and e-mail boxes.

• Stalking in general is due to :– Simple obsession– Love obsession– False victimization syndrome

• Under the law of torts and civil law we have some remedies for physical stalking in terms of injunctions it may not be possible to replicate the same in a case of cyber stalking.

• Under the IPC there is a offence of hurt and grievous hurt under sections 319 and 320.

• Both these sections leave us some scope to bring in cyber stalking as an offence :– 319 - … disease or infirmity” clearly these need

not be physical and cyber stalking will cause mental agony and pain which can fall under this definition.

– 320-…endangers life or severe bodily pain, or inability to follow ordinary pursuits” may also

– serve our purpose to a limited extent.

• Therefore some solace is there in some sections but on the whole it is a matter of open interpretation by a court of law.

• Cyber pornography – today child pornography and live sex are rampant on the internet.

• Difficult area to monitor and control because of different limits of morality in different countries.

• In the Indian context the IT Act continues with the definition of obscenity as defined in the IPC section 292.

• Section 67 of the IT Act covers the aspect

• of obscenity in the electronic medium.• Therefore under the IT Act anyone sharing

a sex joke by e-mail with his colleagues could in theory be held liable for online obscenity.

• Obscenity is however a matter of opinion and subject to the interpretation by the court of law.

• Assault, murder, public nuisance,

• Electronic money and electronic banking

• IPR – Copyrights, Trademarks and Patents

• Terrorism, drugs, money laundering and other illegal activities

IT Act 2000 Doesn’t Apply To:

• Negotiable Instruments Act 1881

• Powers of Attorney Act 1882

• Indian Trusts Act 1882

• Indian Succession (Will) Act 1925

• Any contract for the sale or conveyance of immovable property or any interest in such property.

Thank you!