Offences under the IT Act

1. Punishment table

The entries for sections 67C, 68, 69B, 70B, 72 and 72A reflect the Jan Vishwas (Amendment of Provisions) Act, 2023, in force for the IT Act from 30 November 2023; older books show the earlier prison terms. Sections 84B and 84C add abetment (punishment for the offence abetted) and attempt (up to half the longest term).

2. Sections 65 and 66

Section 65 protects source code (listing of programmes, computer commands, design and layout and programme analysis) that is required to be kept or maintained by law. The act must be knowing or intentional concealment, destruction or alteration. Section 66 criminalises the ten civil wrongs of section 43 when done dishonestly (section 24 IPC: intent to cause wrongful gain or wrongful loss) or fraudulently (section 25 IPC: intent to defraud).

3. Section 66A: struck down and omitted

Section 66A punished sending, by computer or communication device, information that was grossly offensive or menacing, information known to be false sent persistently to cause annoyance, inconvenience, insult or ill will, and e-mails meant to annoy or mislead about their origin. In Shreya Singhal v. Union of India, 2015 INSC 257, the Supreme Court struck it down in its entirety as violating Article 19(1)(a) and not saved by Article 19(2): its terms were vague and overbroad, had no proximate link with public order, and would chill protected speech. It upheld section 69A and read down section 79 (see the note on intermediaries and blocking).

In October 2022 the Supreme Court directed that no citizen be prosecuted under section 66A, that reference to and reliance on it be deleted in all pending cases, and that the police not register complaints under it. The Jan Vishwas Act, 2023 then omitted section 66A from the statute with effect from 30 November 2023. In an MCQ, a false or annoying message is not an offence under section 66A; test it against the surviving sections and the BNS.

4. Sections 66B to 66F

• 66B: receiving or retaining a stolen computer resource or communication device, knowing or having reason to believe it stolen (the cyber version of receiving stolen property).
• 66C: identity theft, for example using someone’s OTP, password or digital signature.
• 66D: cheating by personation through a computer resource: fake customer care calls, phishing messages posing as a bank.
• 66E: violation of privacy. “Private area” means the naked or undergarment-clad genitals, pubic area, buttocks or female breast; the circumstances must be such that the person had a reasonable expectation of privacy.
• 66F: cyber terrorism has two limbs. (A) With intent to threaten the unity, integrity, security or sovereignty of India or to strike terror, denying access, penetrating without authorisation or introducing a contaminant, causing or likely to cause death, injury, damage to property, disruption of essential services, or harm to critical information infrastructure. (B) Penetrating without authorisation to obtain information restricted for State security or foreign relations, with reason to believe it may be used against India’s interests.

5. Sections 67 to 67C

• 67: material that is lascivious, appeals to the prurient interest, or tends to deprave and corrupt likely readers or viewers. In Sharat Babu Digumarti v. Govt. of NCT of Delhi, 2016 INSC 1131, the Supreme Court held that where an act falls under section 67 the accused cannot be prosecuted for it under section 292 IPC, because the IT Act is a special law with overriding effect (section 81).
• 67A: material containing a sexually explicit act or conduct.
• 67B: covers publishing or transmitting material depicting children (under 18) in sexually explicit acts, and also creating, collecting, seeking, browsing, downloading, advertising, exchanging or distributing such material, grooming children online and recording abuse. In Just Rights for Children Alliance v. S. Harish, 2024 INSC 716, the Supreme Court held that viewing, storing or possessing such material can be an offence (under the POCSO Act and section 67B), set aside a High Court order that had quashed the prosecution, and suggested the term “child sexual exploitative and abuse material” in place of “child pornography”.
• Exception (proviso to 67B, applying to 67, 67A and 67B): material justified as for the public good in the interest of science, literature, art or learning, or kept or used for bona fide heritage or religious purposes.

6. Sections 68 to 74

Sections 69, 69A and 69B (interception, blocking, traffic data) are covered in the note on intermediaries and blocking; only their punishments appear above. Section 70: the appropriate Government may declare a computer resource affecting Critical Information Infrastructure (whose incapacitation would have a debilitating impact on national security, economy, public health or safety) a protected system. Section 70B makes CERT-In the national agency for incident response. Sections 71, 73 and 74 are covered in the note on Certifying Authorities.

7. Procedure: sections 77A to 78 and 85

• 77A: a court may compound offences other than those punishable with life or with imprisonment exceeding three years. It may not compound where the accused is liable to enhanced punishment because of a previous conviction, or where the offence affects the socio-economic conditions of the country or is committed against a child below 18 or a woman. The application is made in the trial court under the plea-bargaining provisions (CrPC sections 265B and 265C, now in the BNSS).
• 77B: notwithstanding the CrPC, an offence punishable with three years and above is cognizable, and an offence punishable with three years is bailable. So sections 66 and 66B to 66E are cognizable but bailable; sections 66F, 67A, 67B and 70 are cognizable and non-bailable.
• 78: investigation by a police officer not below the rank of Inspector.
• 85: where a company commits a contravention, every person in charge of and responsible to the company for its business, as well as the company, is guilty, unless he proves lack of knowledge or due diligence; a director, manager, secretary or officer whose consent, connivance or neglect is proved is also guilty. In Aneeta Hada v. Godfather Travels & Tours Pvt. Ltd., 2012 INSC 187, which included an appeal under section 85 of the IT Act, the Supreme Court held that the company must be arraigned; without it, the director cannot be prosecuted.

Cyber offences under the Bharatiya Nyaya Sanhita, 2023 (cheating, extortion, organised crime, defamation and others) are covered in the note on BNS and BNSS cyber offences.

How AIBE asks this

The usual question matches a section to its offence (66C identity theft, 66D personation, 66E privacy, 66F cyber terrorism) or to its maximum punishment (life for 66F, ten years for 70). The 2015 striking down of section 66A in Shreya Singhal is asked almost every cycle. Section 77B (cognizable and bailable) and section 78 (Inspector) are frequent one-liners.

Quick check

1. The maximum punishment for cyber terrorism under section 66F is:
   (A) 7 years
   (B) 10 years
   (C) imprisonment for life
   (D) death
   Answer

   (C). Section 66F(2): imprisonment which may extend to imprisonment for life.
2. Section 66A of the IT Act was struck down in:
   (A) Justice K.S. Puttaswamy v. Union of India
   (B) Shreya Singhal v. Union of India
   (C) Aneeta Hada v. Godfather Travels & Tours Pvt. Ltd.
   (D) Sharat Babu Digumarti v. Govt. of NCT of Delhi
   Answer

   (B). 2015 INSC 257; it violated Article 19(1)(a) and was not saved by Article 19(2).
3. X uses Y’s net-banking password without authority to transfer money. The specific IT Act offence is:
   (A) section 66C
   (B) section 66E
   (C) section 67
   (D) section 72
   Answer

   (A). Fraudulent use of another’s password is identity theft.
4. Under section 77B, an offence under the IT Act punishable with three years’ imprisonment is:
   (A) non-cognizable and bailable
   (B) cognizable and bailable
   (C) cognizable and non-bailable
   (D) non-cognizable and non-bailable
   Answer

   (B). Three years and above is cognizable; exactly three years is bailable.
5. Unauthorised access to a protected system under section 70 is punishable with imprisonment up to:
   (A) 3 years
   (B) 5 years
   (C) 7 years
   (D) 10 years
   Answer

   (D). Section 70(3): up to ten years and fine.