Cyber Law Liability of Isp Uner It Act 2000
Cyber Law Liability of Isp Uner It Act 2000
Cyber Law Liability of Isp Uner It Act 2000
ASSIGNMENT 1
Explain the liability aspect of the Internet Service Provider as per
the Information Technology Act 2000.
PROF, KETKI DALVI
BY RUBAB IQBAL
PRN NO 21219001626
LLB 2ND YEAR 2020-21
INTRODUCTION.
Intermediaries are widely recognized as essential cogs in the wheel of exercising the right to
freedom of expression on the Internet. Most major jurisdictions around the world have
introduced legislations for limiting intermediary liability in order to ensure that this wheel does
not stop spinning.
Intermediaries are entities that provide services enabling the delivery of online content to the end
user. The IT Act regulates internet intermediaries using the defined term ‘intermediaries’, which
means,
“with respect to any particular electronic records, any person who on behalf of another person
receives, stores or transmits that record or provides any service with respect to that record and
includes telecom service providers, network service providers, internet service providers, web
hosting service providers, search engines, online payment sites, online-auction sites, online
market places and cyber cafes.”
This definition of intermediaries was inserted by the IT (Amendment) Act, 2008 which replaced
the previous definition as presented in the original act.
Looking at the definition, it appears that any person providing any service with respect to
electronic messages including receiving, storing, transmitting it would qualify as an
Intermediary.
ISP LIABILITY
Internet service providers (or "ISPs") provide Internet access service to customers in exchange
for a fee. ISPs also store data for their customers' use, such as on a Usenet newsgroup server or a
world wide web server.
ISP liability for the activities of its customers is generally based on a knowledge of the
customer's activity. If the ISP is unaware of the behavior of its customer, most courts seem
reluctant to hold the ISP liable for that behavior. However, once the ISP becomes aware of the
customer's activity, or should have become aware of the activity with reasonable diligence,
courts are much more likely to hold the ISP liable for its customer's actions.
ISP liability, most of the following discussion is equally applicable to service providers who do
not connect directly to the Internet, such as bulletin board operators and proprietary information
providers.
A party is guilty of copyright infringement if they violate one of the five exclusive rights given
to copyright owners under the Copyright Act Included in those rights are the right to prevent
others from reproducing (or copying) a work, publicly displaying a work, or distributing a work.
It is clear that on-line service providers will be liable for copyright infringement if they are
directly involved in the copying of protected material. For example, if a service provider were to
place an electronic copy of the latest best-selling novel (or a pirated copy of Microsoft Word) on
their bulletin board or web site, they would be guilty of copyright infringement. In these
circumstances, an ISP is no different than any other party.
However, Internet Service Providers can be found liable for copyright infringement even where
they are not directly engaged in the copying of protected materials. For instance, ISPs are
responsible for equipment, such as a computer operating as a server, that is capable of making
copies without any direct involvement of any person.
Consequently, one relevant question is: "when is an ISP liable under copyright law for the
copies made by its equipment?" As one example, the newsgroup servers controlled by ISPs make
thousands of copies of newsgroup files everyday. Although some of these files undoubtedly
contain copyrighted materials, no ISP has yet to be found guilty of copyright infringement
merely for the unknown, autonomous action of their newsgroup servers.
Nevertheless, an ISP must be aware of the theories under the Copyright Act by which a party can
be held liable for infringement even if they do not directly take part in the copying or distribution
of a work. Under the concept of "contributory infringement," a party may be guilty of copyright
infringement when they cause or contribute to the infringing conduct of another with knowledge
of the other party's infringing activities. In addition, under the concept of "vicariously liability," a
person may be liable for the infringing actions of another if the person has the right and ability to
control the infringer's acts and receives a direct financial benefit from the infringement.
Vicarious liability can be established without the defendant having actual knowledge of the
infringer's activity. Under these two theories, it is possible for an ISP to be held liable for
copyright infringement, even if the ISP was not directly involved in making the infringing copy.
The potential liability of ISPs for the activities of others was explored in Religious Technology
Center v. Netcom, a California case decided in 1995. In that case, files containing copyrighted
materials owned by the Church of Scientology were placed on an Internet newsgroup through a
newsgroup server controlled by Netcom (an ISP). The user that placed the files on the Internet
actually utilized a local bulletin board service (BBS) that provided Internet access through
Netcom. The Church requested that the BBS and Netcom deny access to the individual involved,
and that they remove all documents containing Church materials from the servers they
controlled. When both the BBS and Netcom refused, the case went to court. The court found that
neither the BBS nor Netcom had directly infringed the Church's copyrights, since neither party
had taken any affirmative steps to cause the copies to be made. Although the computer systems
of both parties operated automatically to receive and transmit the postings of subscribers, the
court found that this is not enough to establish a direct infringement claim. On a claim for
vicarious liability, the court also found against the Church, finding that there was no direct
monetary reward to either Netcom or the BBS for the posting of infringing materials. However,
the Court found that Netcom may be liable to the Church under the theory of contributory
infringement by materially contributing to the infringement of the user. Although the court
recognized that there could be no liability even under the contributory infringement theory unless
Netcom knew of the infringement, the court stated that if Netcom knew or should have know
about the presence of the copyrighted materials on its server and failed to remove them, that
failure could amount to contributory infringement. The notice that the Church provided to
Netcom may have been enough for Netcom to be liable for its failure to act on that notice.
Unfortunately, before this final issue could be determined by the court, the parties settled the
lawsuit.
Cases decided since Netcom have followed the Netcom court's analysis. For instance, a bulletin
board operator who knowingly allowed his users to upload and download copyrighted SEGA
games was determined not to be a direct infringer of SEGA's copyrights. However, since the
BBS operator knew about the copies, and developed a scheme to actively encourage the
uploading of such copies, he was found guilty under the theory of contributory infringement.
Earlier cases, however, have implied an even greater liability for BBS operators and ISPs. In the
case of Playboy Enterprises v. Frena, a BBS operator whose bulletin board contained
copyrighted photographs owned by Playboy was found liable of violating the right to display and
publish the photographs. This was true even though the BBS operator did not make the copies
himself, and in fact was never proven to have knowledge of their existence. In effect, this case
held the BBS operator liable merely for providing a means by which copies (made by others)
could be distributed to the public. If this logic were extended to ISPs in general, an ISP could be
held liable for its members activities on the ISPs web and newsgroup servers, even without
knowledge of such activity. However, it is unlikely that such a ruling would ever be made given
the major impact such a position would have on the expansion of and access to the Internet.
Trademark liability
ISPs are liable for their own activities that constitute trademark infringement As a result, if an
ISP were to advertise their services under a trademark that is confusingly similar to a mark of
another party (such as Netcomp, IBM Link, or CompuService), they would be exposed to
charges of trademark infringement. In addition, if an ISP's own web page contained the
trademarks of another, the ISP's use of those marks would be analyzed like any other web page
owner ISPs are in a slightly different position when one of their customers misuses a trademark
of another. In this case, the ISP may very well face possible liability under the theory of
contributory trademark infringement. Much like contributory copyright infringement,
contributory trademark infringement liability may exist where the ISP causes or contributes to
the infringing conduct of another with knowledge of the other party's infringing activities.
Although such a case has not yet been analyzed by any court, one can imagine a situation where
an ISP is notified of trademark infringement on one of its customer's web pages and yet fails to
act on this notification. By analogy to the Netcom decision discussed in connection with recent
ISP copyright cases above, the ISP in this case may in fact face legal action for trademark
infringement.
When America On Line announced that it was shifting to a flat-rate billing policy, AOL's
proprietary and Internet access services were overwhelmed. Customers who tried to dial in were
often greeted by busy signals, and access to the Internet was very slow. Although AOL's
performance improved, that did not stop frustrated customers from bringing lawsuits against the
company. These suits alleged that AOL knew that their service would be overloaded, but
nonetheless went ahead with the flat-rate plan. The suits alleged that AOL was in breach of its
contracts with its customers (by not providing the agreed upon service) and had committed fraud
by knowingly misleading current and prospective customers.
At this point, AOL has not been found liable for its actions. However, the message for ISPs is
clear. Deliver on all of the promises you make to your customers, and only promise what you can
deliver.
Defamation
Several years ago, the hottest legal issue relating to the Internet was defamation (a broad term
encompassing slander and libel). This came as a result of two legal cases involving Prodigy and
CompuServe.
In the Prodigy case, Prodigy was sued for defamation based upon the statements made by one of
its customers in a Prodigy discussion group (or bulletin board). In determining whether Prodigy
was liable for the defaming statements of its customer in this case, a New York state judge was
left to determine whether Prodigy was a "distributor" of information, such as a bookstore or
library, or whether Prodigy was a "publisher" of information, such as a newspaper. As a mere
distributor, Prodigy would not be liable for the statement. In contrast, if Prodigy was considered
a publisher (with greater control over the information's content), Prodigy would be liable. In a
decision that shocked most on-line service providers, the judge held that, as a result of Prodigy's
well-publicized policies of monitoring and censoring its forums, Prodigy was a publisher and
was potentially liable for the defaming statement. Although the case was settled by the parties
and Prodigy moved for a withdrawal of the judge's decision, the judge refused.
In the CompuServe case, a similar factual situation was encountered by a federal court. In this
case, however, the court found that CompuServe acted merely as a distributor of information in
its discussion groups, and therefore was not liable. It is important to note that CompuServe
avoided liability because it did not know about the defaming statement, nor did it have any
reason to know about the statement. If a distributor knows about a defaming statement and
continues to distribute the information, liability is not so easily avoided.
In analyzing these cases, most commentators noted the irony that Prodigy was more likely to be
liable for defamation because of the additional steps it took to control the content of its
discussion groups. CompuServe did not attempt to monitor and control its discussion groups to
the extent done by Prodigy, which made it easier for the CompuServe judge to find that
CompuServe was merely a distributor of information. This lead many attorneys to advise their
clients to avoid censoring such discussion groups, for fear of defamation liability. Such a hands-
off approach can only increase the likelihood that defamatory statements will be made in the
future.
“Intermediary” is defined in Section 2(1) (w) of the Information and Technology Act 2000.
"Intermediary" with respect to any particular electronic message means any person who on
behalf of another person receives stores or transmits that message or provides any service with
respect to that message. The liability of the intermediaries is lucidly explained in section 79 of
the Act.
The liability of service providers for copyright infringement is not expressly covered by the
Indian Copyright Act. The Information Technology Act, 2000 exempts ISPs from liability if they
can prove that they had no knowledge of the occurrence of the alleged act, and that they had
taken sufficient steps to prevent a violation. However, the existing provision does not clearly
prescribe liability limits of service providers. For example, if a person makes a representation to
a service provider claiming copyright on the material available on the network, will the service
provider be liable if he fails to take steps within a reasonable time to remove the infringing
material from the network? If the service provider fails to prevent infringement of copyright in
the above circumstances, is the plea of not having knowledge of infringement still available to
him? If the service provider removes the material from the network in pursuance to the
representation made by a person which later on proves false, will the service provider be liable to
the person whose material has been removed?
The Indian position in liability of service providers for copyright infringement must be made
more explicit. The I.T. Act must include sections that address the financial aspect of the
transaction, and the relationship between an ISP and a third party, because this is vital to
determining the identity of the violator. The American concept of contributory infringement can
also be incorporated into the Indian Act so that if any person with knowledge of the infringing
activity, induces, causes, or materially contributes to the infringing conduct of another, the
person can be made liable. In order to be exempt from liability, the Indian Act requires the
service provider to exercise due diligence to prevent the commission of copyright infringement.
The Act does not provide the meaning of the term due diligence. If due diligence means policing
each and every aspect of the Internet, it can lead to loss of privacy and can ultimately have a
disastrous effect. There is a need for a consensus on the meaning of the term due diligence
because the primary function of ISPs is to build the Internet, not to play the role of a policeman.
If the behavior of an ISP is reasonable, then that ISP should not be held liable for each and every
activity on the Internet as has been held by the US Courts.
Copyright act 1957
“the Indian Copyright Act, the act of infringement is when, a person without any licence by
the registrar or the owner of the particular copyright, does an act that is in the contravention
of the conditions of a that licence or condition imposed by a competent authority under this
Act permits for profit any place to be used for the communication of the work to the public
where such communication constitutes an infringement of the copyright in the work, unless
he is unaware as and had no reason to believe that the particular communication to the
general public would result in copyright infringement.”
Nowadays the Internet service providers, instruct their servers transmit and store their users data
across the network. This act of ISP’s helps them to hold any third party liable in case of any
infringement. In order to be liable for the infringement, it is very necessary that the ISP should
benefit financially from it. The ISP’s earn even if they offer some copyrighted illegal material
because of the advertisements that come along with it. Therefore, an ISP can be held liable not
only when they transmit such infringed material but they are liable even if they store it.
Criminal Liability
An ISP can be held criminally liable when, he does an act of infringement or abets infringement
of:
If a person does such an act than the Copyrights Act provides for the punishment to be given to
him, i.e of imprisonment which may extend to one year, or with fine, or with both.[1]
However, the Copyright Act clearly states that the ISP can be held liable only in the case he was
unaware infringing material stored or being transmitted through their servers. This provides an
exception to the liability.
Therefore, the ISP can get away from being liable for the copyright infringement if it is proved
under this section[3]
(b) That he took all the due diligence to prevent such infringement.
However, data has passed through an ISP’s servers or stored in them, that is likely to infringe the
copyright of another, it is considered that such ISP had to have ‘knowledge’ of such data and he
has the duty to take appropriate measures to prevent such infringement. In such a case, the ISP
cannot take a defence that he was unaware of such infringement.
A person is said to have done an act with due diligence when in the layman’s terms he had done
that act or prevented an act by reasonable standards expected out of a prudent person who is said
to have the knowledge about such illegal activity.[4]
(b) Which actions can be termed as done with ‘due diligence’ is not defined anywhere in the
act.
(c) Who is an ISP? The answer to this question is not given under the IT Act. Also, the IT Act
does not provide for the liability of ISP. The liability of ISP is as same as for anyone who is
simply a communication carrier.
(a)That, ISPs are mere “passive carriers” and that they are nothing but a mere messenger.
The court in the case of Sony v Universal Studios, was of the opinion that,
“If one provides means to accomplish an act of infringement is not sufficient to hold the
person liable in the absence of any constructive knowledge of such infringement”.
(b) Every day plenty data flows in through the servers; therefore, it is impossible to check
that all the data that flows through it is not an infringement. Moreover, it is impossible to
achieve 100% accuracy even post-screening.[5]
It was held by the courts in the case of Religious Technology Service Centre v Netcom, that the
ISP’s are unable to exercise any influence on the data. Their duty is to offer an opportunity to
publish what people say on the internet.
In the United States the law regarding online copyright infringement is dealt with in the Digital
Millennium Copyright Act (DCMA) that provides the limitations the a person’s liabilities for
online infringement[6]. The act protects the ISP’s from any liability in the case, he, on the receipt
of an instruction from the copyright owner, had blocked the alleged infringing.
If a person or a publisher wants to limit the use of his material after the sale, he can do so with
the help of Digital Rights Management (DRM). DRM along with the other technologies restrict
the user interactions with the online content and help in reducing the risk of infringement.
In the European Union, Directive on e-Commerce of 2000 provides for the liability for ISP’s.
This act provides rules regarding online information requirements and transparency, commercial
communications.
Both the laws of the United States and the European Union provides for the protection of both
internet service providers as well as content providers. Both of these countries do not hold the
ISP liable unless they are expressly notified of the alleged infringement.
Section 79 of the Information Technology Act, 2000 exempts intermediaries from liability in
certain instances. It states that intermediaries will not be liable for any third party information,
data or communication link made available by them. The Act extends “safe harbor protection”
only to those instances where the intermediary merely acts a facilitator and does not play any
part in creation or modification of the data or information. The provision also makes the safe-
harbor protection contingent on the intermediary removing any unlawful content on its computer
resource on being notified by the appropriate Government or its agency or upon receiving actual
knowledge.
This provision was added to the Act by the Information Technology (Amendment) Act, 2008 on
the demand of the software industry and industry bodies to have protection from liability that
could arise because of user generated content. This was mainly prompted by the controversial
case[3] in which Avnish Bajaj, the CEO of Baazee.com, an auction portal, was arrested for an
obscene MMS clip that was put up for sale on the site by a user. The provision states that an
intermediary needs to observe due diligence while discharging its duties under the Act and
observe such other guidelines as prescribed by the Central Government. These other guidelines
were laid down in the Information Technology (Intermediaries Guidelines) Rules, 2011 framed
in the exercise of powers conferred by Section 87 read with subsection (2) of Section 79 of the
Information Technology Act, 2000. The Rules were notified on April 11, 2011.
According to Section 79 of Information and Technology Act, 2000, for the removal of doubts,
any person who is providing any service as a network service provider shall not be liable under
this act for certain cases, rules or regulations made there under for any third party information or
data made available by him. Even if proves that the offence or contravention was committed
without his knowledge or that he had exercised all due diligence to prevent the commission of
such offence or contravention. For the purposes of this section, —
"Third party information" means any information dealt with by a network service provider in his
capacity as an intermediary;
An intermediary would be liable and lose the immunity, if the intermediary has conspired or
abetted or aided or induced whether by threats or promise or otherwise in the commission of the
unlawful act. Sections 79 also introduced the concept of “notice and take down” provision as
prevalent in many foreign jurisdictions. It provides that an intermediary would lose its immunity
if upon receiving actual knowledge or on being notified that any information, data or
communication link residing in or connected to a computer resource controlled by it is being
used to commit an unlawful act and it fails to expeditiously remove or disable access to that
material. On the other hand, another interpretation can be drawn where section 79 of the IT Act,
2000 absolves ISPs (the internet service providers), who work as intermediaries, of its liability if
it can prove its ignorance and due diligence, it does not specify who would be held liable for
such contravention in such an event. Therefore, this provision will cause problems when an
offence regarding third party information or provision of data is committed.
The Intermediaries Guidelines Rules lay down the guidelines that the intermediaries have to
follow so that they qualify for the safe-harbour protection provided under the Act.
The Intermediaries Guidelines Rules lay down the procedures that an intermediary has to follow
to avail safe harbour. Rule 3(2)7 of the Intermediaries Guidelines Rules lists the categories of
information, if posted online, which could be considered as illegal. According to Rule 3(4)8 an
affected person could write to the intermediary to remove any content which is listed as unlawful
under Rule 3(2). The intermediary has to act within 36 hours to remove the content. If the
intermediary does not act within the stipulated time then the intermediary cannot avail safe
harbour.
This provision was criticized by intermediaries who said that it is not easy to take down content
or take action in 36 (thirty six) hours. Thereafter, a clarification9 was issued by the Government
on March 18, 2013 stating that the intermediary shall respond or acknowledge the complaint
within 36 hours. Thereafter, the intermediary has 30 (thirty) days time to redress such
complaints. What constitutes redressal is unclear and no guidance has been provided by the rules.
The Information Technology (Intermediary Guidelines) Rules, 2011 make it obligatory for
intermediaries to appoint a grievance officer and provide the name and contact details of such
officer on their website. The grievance officer shall redress the complaints within 30 days from
the receipt of complaint.
Making matters worse, a 2008 Amendment introduced to the Act the now-infamous Section
66A. This section defines the punishment for sending “offensive” messages through a computer
or any other communication device like a mobile phone or a tablet. A conviction can fetch a
maximum of three years in jail and a fine. The main problem with this section is the vagueness
about what is “offensive”. The word has a very wide connotation, and is open to distinctive,
varied interpretations. It is subjective, and what may be innocuous for one person, may lead to a
complaint from someone else and, consequently, an arrest under Section 66A if the police prima
facie accepts the latter person’s view.
Apart from Section 66A, the Information Technology (Intermediaries Guidelines) Rules, 2011
have also seen their fair share of criticism. While Section 79 exempts intermediaries from
liability in certain cases, the Rules water down these exemptions and force intermediaries to
screen content and exercise on-line censorship. Additionally, the Information Technology
(Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009
provide for blocking of web pages without proper publication or notice to public containing the
reasons for blocking. The process of blocking is undisclosed and fails to meet Constitutional
safeguards of natural justice.
Section 66A of the Information Technology Act, 2000 was struck down in its entirety for being
in violation of Article 19(1) (a) and not falling under the scope of 'reasonable restriction', under
Article 19(2) of the Indian Constitution. Section 66-A of the Act stipulates punishment for
sending offensive messages through communication service by the Supreme Court while
determining its constitutionality in Shreya Singhal v Union of India[4]. Section 66A is
ambiguous in its phraseology and imposes statutory limits on the exercise of internet freedom.
Further, the Intermediaries Guidelines Rules are similarly ambiguous and require private
intermediaries to subjectively assess objectionable content. They actively water down the
exemptions from liability granted to intermediaries by Section 79 of the IT Act, and prescribe
unfeasibly minuscule time-frames for the removal of objectionable content. Section 66A of the
Act, and the Rules are thus violative of Articles 14, 19 and 21 of the Constitution and the
petitioner prays that they be declared as such.[5] The vagueness of language invites blatant
transgressions of Fundamental Rights and the grounds for incrimination under 66A are beyond
the scope of reasonable restrictions on Fundamental Rights allowed by Article 19(2) of the
Constitution.[6] Due to the vague and undefined purported offences contained within 66A, the
power to punish speakers and writers through arrest and threat of criminal trial is at the first
instance granted to complainants with offended sentiments and police officials. A significant
proportion of the offences in Section 66A do not even fall within the permissible categories of
restriction in Article 19(2) of the Constitution. Further, the Intermediaries Guidelines Rules
provide for vague and undefined categories that require legal determinations and effective
censorship by private online service providers. The Information Technology (Procedure and
Safeguards for Blocking for Access of Information by Public) Rules, 2009 provide for blocking
of web pages without proper publication or notice to public containing the reasons for blocking.
The process of blocking is entirely secret and ex facie fail to meet constitutional safeguards of
natural justice.[7]
CONCLUSION
There is an urgent need to incorporate certain laws or bring amendments in the acts because the
absence of specific laws regarding the liability of the ISP in the Indian Law results in the ISP’s
escaping the liability in case of infringement. In order to pave way for sound legislation with
regard to ISP liability in India, it is essential to address some of the key issues mentioned
hereunder;
a) There is an urgent need to provide a definition of Internet Service Provider. Unless it is done,
it would always create confusion as to who can be put under the liability. It is also important to
define “due diligence”
b) effective tools like DCMA can be used. Various effective measures should be adopted so that
the liabilities of ISP’s are clearly identified.
c) It should be made sure that, the Information Technology Act makes it obligatory for ISPs to
terminate services of subscribers who frequently violate.
[4]https://www.researchgate.net/publication/268049156_Liability_of_Internet_Service_Provider
s_for_Third_Party_Online_Copyright_Infringement_A_Study_of_the_US_and_Indian_Laws
[5]Protection Of Copyright In The Digital Age The Role And Liabilities Of ISPs In India see at
http://www.legalservicesindia.com/article/article/protection-of-copyright-in-the-digital-age-the-
role-and-liabilities-of-isps-in-india-1638-1.html
There is a dying need for express provisions either in the Copyright Act or the Information
Technology Act, 2000 prescribing liability of service providers for copyright infringement in the
light of the issues raised in the paper. Issues concerning ISPs should be taken seriously, because
any hesitation over implementing policies or regulation of ISPs can prove detrimental to the
development of the institution of Internet as a whole
The intermediaries should be classified and according to this classification all the different
intermediaries, rules should be followed for different types of intermediaries, as an intermediary
which might need more than 36 hours time for applying action on take down notice. Also the
guidelines should be refined and advanced for not infringing the essentials of Article 19 of
Indian constitution and provide natural justice for better functioning in the dynamic India which
is becoming promoter of freedom of speech and expression.
[1] Shashank Pathak, Information and Technology (Intermediaries Guidelines) Rules 2011: Thin
Gain with Bouquet of Problems.
[2] Section 2(1)(w), IT Act.
[3] Avnish Bajaj v. State, 150 (2008) DLT 769
[4] Shreya Singhal v Union of India, (2013) 12 SCC 73.
[5] Rajeev Chandrashekhar v Union of India, W.P.(C) No. 23 of 2013.
[6] Common Cause v Union of India, W.P. (C) No. 21 of 2013.
[7] People’s Union for Civil Liberties v Union of India, (1997) 1 SCC 301.