Intermediaries, blocking and interception

1. Who is an intermediary

Section 2(1)(w) defines an intermediary, with respect to any electronic record, as any person who on behalf of another receives, stores or transmits that record or provides any service with respect to it. The definition names telecom service providers, network service providers, internet service providers, web-hosting providers, search engines, online payment sites, online-auction sites, online market places and cyber cafes. Social media and messaging platforms are intermediaries for their users’ content.

2. Safe harbour: section 79

• Section 79(1): notwithstanding any other law, an intermediary is not liable for any third-party information, data or communication link made available or hosted by it.
• Section 79(2): conditions. (a) its function is limited to providing access to a communication system over which third-party information is transmitted, temporarily stored or hosted; or (b) it does not initiate the transmission, select the receiver, or select or modify the information; and (c) it observes due diligence and the guidelines the Central Government prescribes.
• Section 79(3): loss of protection. (a) if it has conspired, abetted, aided or induced the unlawful act; or (b) if, on receiving actual knowledge, or on being notified by the appropriate Government or its agency, that material on its resource is being used to commit an unlawful act, it fails to remove or disable access expeditiously without vitiating the evidence.

“Actual knowledge” read down. In Shreya Singhal v. Union of India, 2015 INSC 257, the Supreme Court held that section 79(3)(b) must be read to mean that the intermediary acquires actual knowledge only from a court order, or on being notified by the appropriate Government or its agency, and that the unlawful act must relate to the grounds in Article 19(2). A private complaint alone does not oblige a platform to judge legality and take content down. The same case upheld section 69A.

Section 79 opens with a non obstante clause, so the safe harbour operates notwithstanding any other law.

3. Interception, monitoring and decryption: section 69

• Who: the Central Government or a State Government, or an officer specially authorised by it.
• Grounds: sovereignty or integrity of India, defence of India, security of the State, friendly relations with foreign States, public order, preventing incitement to a cognizable offence relating to these, or investigation of any offence.
• How: for reasons recorded in writing, by order directing an agency to intercept, monitor or decrypt any information generated, transmitted, received or stored in a computer resource. Procedure and safeguards are in the Interception Rules, 2009 (Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009).
• Duty to assist: the subscriber, intermediary or person in charge must give access and technical help. Failure is punishable with imprisonment up to seven years and fine (section 69(4)).

4. Blocking: section 69A

Only the Central Government (or an officer it specially authorises) may, for reasons recorded in writing, direct any Government agency or intermediary to block public access to information in a computer resource. The grounds are those of section 69 except “investigation of any offence”. The procedure is in the Blocking Rules, 2009 (Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009). An intermediary that fails to comply faces imprisonment up to seven years and fine (section 69A(3)). Shreya Singhal upheld section 69A because it is narrowly drawn: reasons must be recorded, the grounds track Article 19(2), and the rules provide a hearing and review.

5. Traffic data, protected systems, NCIIPC and CERT-In

CERT-In directions of 28 April 2022 (issued under section 70B(6)): listed cyber incidents must be reported to CERT-In within six hours of noticing them, and ICT system logs must be kept for a rolling period of 180 days within Indian jurisdiction.

6. The IT Rules, 2021

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 were notified on 25 February 2021 under section 87 of the IT Act. Part II (due diligence by intermediaries) is administered by MeitY; Part III (code of ethics for digital news publishers and OTT platforms) by the Ministry of Information and Broadcasting.

• Due diligence (rule 3). Publish rules and privacy policy; inform users not to host specified unlawful content (rule 3(1)(b)); remove unlawful information on actual knowledge (rule 3(1)(d)); retain information of a deregistered user for 180 days; help lawful investigating agencies.
• Takedown time. Under rule 3(1)(d), actual knowledge arises only from a court order or a reasoned written intimation from an authorised officer (not below Joint Secretary or equivalent, or a Director where no such officer exists; for police, not below DIG). After the amendment of 10 February 2026, the content must be removed within three hours (earlier thirty-six hours).
• Grievance Officer (rule 3(2)). Acknowledge a complaint within 24 hours and resolve it within seven days (earlier fifteen); removal requests within thirty-six hours (earlier seventy-two). Content showing a person’s private area, nudity, sexual acts or impersonation, including morphed images, must be taken down within two hours of a complaint (earlier twenty-four).
• Significant social media intermediary (SSMI) (rules 2(1)(v) and 4): a social media intermediary with registered users in India above the notified threshold of fifty lakh. It must appoint a Chief Compliance Officer, a nodal contact person for 24x7 coordination with law enforcement, and a Resident Grievance Officer (all resident in India), and publish a monthly compliance report.
• Traceability (rule 4(2)). An SSMI providing mainly messaging services must enable identification of the first originator of information when required by a court order or an order under section 69. The order may be passed only for offences relating to sovereignty, security of the State, public order, friendly relations, or rape, sexually explicit material or child sexual abuse material, punishable with at least five years; not where less intrusive means work; and the SSMI need not disclose the content of messages. If the first originator is outside India, the first person in India is treated as the first originator.
• Grievance Appellate Committees (rule 3A). Inserted by the 2022 amendment (notified 28 October 2022). A user aggrieved by the Grievance Officer’s decision may appeal within thirty days; the Committee tries to decide within thirty days, entirely online; the intermediary must comply. Three Committees were set up in January 2023; appeals are filed at gac.gov.in.
• Synthetically generated information (2026). The February 2026 amendment covers deepfakes and similar AI content: permitted synthetic content must be labelled and carry metadata; unlawful synthetic content is treated like other unlawful information.

An intermediary that does not follow these rules loses the section 79 exemption and can be proceeded against under the general law.

7. Internet shutdowns: Anuradha Bhasin

In Anuradha Bhasin v. Union of India, 2020 INSC 31, on the communication restrictions in Jammu and Kashmir, the Supreme Court held:

• Freedom of speech and expression and freedom to carry on any trade or business through the medium of the internet are protected under Articles 19(1)(a) and 19(1)(g); restrictions must satisfy Articles 19(2) and 19(6), including proportionality.
• An order suspending the internet indefinitely is impermissible; suspension must be temporary and is subject to periodic review by the review committee.
• Orders must be published or made available so that they can be challenged in court.
• Section 144 orders cannot be used to suppress legitimate expression; “law and order”, “public order” and “security of State” are distinct standards.

The power to suspend telecom services now lies in section 20 of the Telecommunications Act, 2023, with rules made in 2024 that replaced the 2017 Suspension Rules. Note the difference: section 69A blocks specific content; a shutdown suspends the service itself.

How AIBE asks this

Expect a direct section question (“Blocking of public access is provided under section ___”, “Exemption of intermediaries is in section ___”), a case-to-holding match (Shreya Singhal: 66A struck down, 69A upheld, 79 read down; Anuradha Bhasin: internet and proportionality), or a number from the rules (fifty lakh users, first originator, six-hour CERT-In reporting).

Quick check

1. Under section 69A of the IT Act, the power to direct blocking of public access to information vests in:
   (A) the Central Government or a State Government
   (B) the Central Government only
   (C) the Controller of Certifying Authorities
   (D) CERT-In
   Answer

   (B). Section 69A confers the blocking power on the Central Government or an officer specially authorised by it; section 69 (interception) is the one that also names State Governments.
2. In Shreya Singhal, “actual knowledge” under section 79(3)(b) was read to mean knowledge received through:
   (A) any complaint by an affected user
   (B) a court order or notification by the appropriate Government or its agency
   (C) a news report
   (D) the intermediary’s own monitoring
   Answer

   (B). The Court read down section 79(3)(b) so that the intermediary must act only on a court order or a government notification.
3. Which ground for interception in section 69 is not a ground for blocking under section 69A?
   (A) Public order
   (B) Security of the State
   (C) Investigation of any offence
   (D) Friendly relations with foreign States
   Answer

   (C). “Investigation of any offence” appears in section 69 only.
4. Under rule 4(2) of the IT Rules, 2021, an order to identify the first originator can be passed only for offences punishable with imprisonment of not less than:
   (A) three years
   (B) five years
   (C) seven years
   (D) ten years
   Answer

   (B). The first proviso to rule 4(2) limits such orders to the listed offences punishable with not less than five years.
5. The national agency for incident response in cyber security under section 70B is:
   (A) NCIIPC
   (B) CERT-In
   (C) the Data Protection Board of India
   (D) the Grievance Appellate Committee
   Answer

   (B). Section 70B establishes CERT-In; NCIIPC is the nodal agency for Critical Information Infrastructure under section 70A.