Information Technology Act 2000.
The Information Technology (IT) Act, 2000 is India’s primary law governing cyber activities. It was enacted to provide legal recognition to electronic transactions, digital signatures, and online contracts while also addressing cybersecurity and cybercrime.
The Act enables the use of electronic records in government and business transactions, making digital documents legally valid. It also lays down rules for cybercrimes, such as hacking, identity theft, data breaches, cyber fraud, and publishing obscene content online.
To regulate digital security, the Act introduced the Controller of Certifying Authorities (CCA), responsible for issuing digital signatures. The law empowers the government to intercept, monitor, and block websites for national security concerns under Section 69A, which has been used to ban several apps, including Chinese applications.
The Act was amended in 2008 to introduce stricter cybercrime laws and intermediary guidelines, though Section 66A, which criminalized "offensive" online speech, was later struck down by the Supreme Court in Shreya Singhal v. Union of India (2015) for violating freedom of speech (Article 19(1)(a)).
The IT Act continues to evolve with the introduction of new rules, such as the IT Rules 2021, which mandate social media accountability and traceability of messages. The Digital India Act, expected to replace the IT Act, aims to address modern challenges like AI, data protection, and cybersecurity.
Introduction
- Enacted: 9th June 2000
- Came into force: 17th October 2000
- Objective: To provide legal recognition to electronic transactions, prevent cybercrimes, and promote e-governance.
- Inspired by: UN Model Law on Electronic Commerce adopted by UNCITRAL.
- Jurisdiction: Extends to the whole of India and applies to offences committed outside India if they affect Indian systems.
Key Provisions
1. Digital Signature & Electronic Signature (Sections 3 & 3A)
- Legal recognition for authentication of electronic records.
- Certifying Authorities issue Digital Signature Certificates.
- Controller of Certifying Authorities (CCA) regulates them.
2. Electronic Governance (Sections 4-10A)
- Legal recognition for electronic records and contracts.
- Government agencies can use electronic records for services.
- Audit of electronic records (Section 7A) is mandatory.
3. Regulation of Certifying Authorities (Sections 17-34)
- CCA monitors Certifying Authorities.
- Rules for granting, suspending, or revoking Digital Signature Certificates.
4. Cyber Crimes and Penalties (Sections 65-78)
A. Computer-Related Offences (Section 66)
- Punishment: Up to 3 years imprisonment or ₹5 lakh fine.
- Section 66A: Sending offensive messages online (struck down in 2015).
- Section 66B: Receiving stolen computer resources.
- Section 66C: Identity theft.
- Section 66D: Cheating by impersonation using a computer.
- Section 66E: Violation of privacy.
- Section 66F: Cyber terrorism (life imprisonment).
B. Publishing Obscene Content Online (Section 67)
- 67A: Publishing sexually explicit content.
- 67B: Child pornography (7 years imprisonment).
- 67C: Mandates intermediaries to retain information.
C. Data Protection & Confidentiality (Sections 43A, 72, 72A)
- Section 43A: Compensation for failure to protect sensitive data.
- Section 72: Breach of privacy punishable with up to 2 years imprisonment.
- Section 72A: Disclosure of personal information in breach of contract.
5. Powers of Government (Sections 69-70B)
- Section 69: Government can intercept, monitor, decrypt information.
- Section 69A: Power to block websites (used to ban apps like TikTok).
- Section 69B: Monitoring cyber traffic for security.
- Section 70: Protection of critical IT infrastructure.
- Section 70A & 70B: CERT-In designated as national cybersecurity agency.
6. Safe Harbor for Intermediaries (Section 79)
- Intermediaries (e.g., social media) not liable for third-party content if due diligence is followed.
- 2021 IT Rules: Platforms must appoint grievance officers and track message origin.
7. Investigation and Adjudication (Sections 77B & 78)
- Section 77B: Offences with 3 years of imprisonment are bailable.
- Section 78: Only an Inspector-level officer or higher can investigate offences.
Amendments to IT Act, 2000
1. IT (Amendment) Act, 2008
- Introduced Section 66A (later struck down).
- Section 69A empowered the government to block websites.
- CERT-In given statutory recognition.
IT Act, 2008 Amendments
- The Information Technology (Amendment) Act, 2008 strengthened cybersecurity laws and expanded government powers.
- The amendment introduced Section 66A, which became highly controversial.
- Passed without debate in Parliament.
Section 66A
- Gave authorities the power to arrest anyone for posting ‘offensive’ content online.
- Allowed conviction for sending ‘information that is grossly offensive or has a menacing character’.
- Criminalized false information sent for annoyance, inconvenience, enmity, hatred, or ill-will.
- Punishment: Up to 3 years imprisonment and a fine.
Arguments Against Section 66A
- Terms like ‘offensive’, ‘menacing’, ‘annoyance’ were vague and ill-defined.
- Could be misused to intimidate media personnel and critics.
- Violated freedom of speech (Article 19(1)(a)) of the Constitution.
- Used to arrest people criticizing politicians.
- Government argued that internet content needed regulation like print and electronic media.
- Struck down by Supreme Court in 2015 (Shreya Singhal v. Union of India) as unconstitutional.
Section 69A
- Empowered the government to intercept, monitor, or decrypt any information in the interest of national security, defense, sovereignty, and public order.
- Allowed authorities to block internet sites if deemed necessary.
- Law contained procedural safeguards for blocking content.
- Supreme Court upheld national security over individual privacy in privacy law debates.
- Used to ban Chinese apps in recent years.
Additional Notes
- Indian Telegraph Act, 1885 allows phone tapping but only in case of a ‘public emergency’ (as per a 1996 SC judgment).
- Section 69A does not require a public emergency for the government to act.
2. Information Technology Intermediary Guidelines (Amendment) Rules, 2018
Introduction
- Framed under Section 79 of the Information Technology Act, 2000.
- Covers intermediary liability and due diligence obligations for online platforms.
- Amended to curb fake news, cybercrimes, and unlawful content.
Intermediaries under the IT Act
- Intermediary: A service facilitating internet use (e.g., ISPs, search engines, social media platforms).
- Two Categories:
- Conduits – Providers of internet access (e.g., ISPs).
- Hosts – Providers of content storage and online platforms (e.g., Facebook, WhatsApp).
Background of 2018 Amendment
- Triggered by mob lynchings due to fake news circulated via WhatsApp.
- Government tightened regulations on intermediaries under Section 79.
Key Provisions of the 2018 Rules
- Intermediaries must publish privacy policies to curb harmful online content (paedophilic, pornographic, hateful, invasive of privacy, etc.).
- Mandatory compliance with government orders within 72 hours for cybersecurity assistance.
- Appointment of a ‘Nodal Person of Contact’ for 24x7 coordination with law enforcement.
- Deployment of automated tools to detect and remove unlawful content.
- Intermediaries must track message origins by breaking end-to-end encryption.
- Obligation to remove unlawful content within 24 hours and preserve records for 180 days.
Rationale Behind the Rules
- Ensure accountability of social media platforms.
- Curb fake news, misinformation, and online crimes.
- Prevent mob violence and lynchings.
- Regulate misleading content posing as news.
Criticism of the Rules
- Concerns over privacy violations and state surveillance.
- Some argue it widens government control over online speech.
- However, rules align with Supreme Court rulings.
Relevant Supreme Court Cases
- Tehseen S. Poonawalla Case (2018): SC ruled that authorities have the right to curb irresponsible social media messages inciting mob violence.
- Prajwala Letter Case (2018): SC directed the government to frame guidelines to eliminate child pornography, rape, and gang rape imagery from content hosting platforms.
3. IT Rules, 2021
- Stricter regulations for social media and OTT platforms.
- Mandatory grievance redressal mechanisms.
- Platforms required to trace first originator of messages (e.g., WhatsApp).
Current Affairs & Latest Developments
1. 2023-24 Updates
- Digital Personal Data Protection Act, 2023: Strengthens data protection.
- CERT-In Directives (2022): Cyber incidents must be reported within 6 hours.
- Government bans Chinese apps under Section 69A.
- WhatsApp Privacy Policy Case: IT Ministry enforced compliance with new rules.
- Proposed Digital India Act: Aims to replace IT Act, 2000 for modern cyber threats.
Conclusion
- IT Act, 2000 is India’s primary cyber law for e-governance and cybersecurity.
- Regular amendments address emerging digital threats.
- The upcoming Digital India Act is expected to modernize regulations for AI, data privacy, and cybercrime.
This concise UPSC Prelims Notes covers all major aspects of the Information Technology Act, 2000 in easy language. Let me know if you need further elaboration! 🚀
