It Laws 236
It Laws 236
It Laws 236
SUBMITTED TO : SUBMITTED BY :
DR. AMITA VERMA DISHU KUMAR
B.Com. LL.B.
(H)236/18
10TH SEMESTER
2
ACKNOWLEDGEMENT
I would like to take this opportunity to offer my acknowledgment to all those who helped me during
the course of this project. First of all I thank God, without whose blessings this project would not
have been materialised. I am also obliged to DR. Amita Verma, my teacher, without whose support
and supervision this project would not have been a success. I also take this opportunity to thank the
library staff, my friends and seniors in UILS for their kind and generous support rendered to this
project.
3
TABLE OF CONTENT
1. INTRODUCTION 4
2. WHAT IS CYBER LAW 5
3. NEED FOR CYBER LAWS 6
4. THE INDIAN SCENARIO 7
5. THE IT ACT, 2000 8-9
6. SALIENT FEATURES OF THE ACT 10-15
7. SUBSEQUENT DEVELOPMENTS 16
8. CRITICAL ANALYSIS OF THE ACT 17-20
9. BIBLIOGRAPHY 21
4
INTRODUCTION
For many people, going online really did feel like jumping onto the information superhighway and
visiting the websites using chat rooms did feel like entering a new world and traveling around a new
online world. In a very few days, the number of Internet users has sky-rocketed. Back to the 1990s,
less than 100,000 people were able to log on the Internet. Today, around 500 million people are able
to surf the Internet around the globe. With each passing day, the Internet became integrated in human
life with the physical world. The Internet is still at a very nascent stage of development. Being the
newest mode of communication, the laws ruling them are also at a developing stage. As the Internet
gains proliferation, the complexity of Cyber Laws increases and needs to cover more relevant issues.
While many countries and societies are in the process of putting in place the Cyber Laws, a few have
already laid down Cyber Laws and India is proud to be one of them. The traditional legal system has
had great difficulty in keeping pace with the rapid growth of the Internet and its impact throughout
the Internet. The borderless space, anonymity of user’s online, dynamic e-commerce and rapid digital
transmission pose a real challenge to the application of traditional laws in cyberspace. While dealing
with some serious legal problems, people expected the need of cyber laws to govern the new virtual
world. The aim of the cyber laws or cyber related laws worldwide is to harmonize the existing laws.
Cyber Laws are made to lessen the legal issues in the future.1
1 Available at https://poseidon01.ssrn.com/delivery.php?
5
- There is no clear definition of Cyber Law, Computer Law or Information and Communication
Technology Law. However the subject can be briefly defined as the legal subject that emanated
from the development of technologies, the innovation of computers and other related devices, the
use of Internet and Electronic Data Interchange, etc. Cyber Law or, less colloquially, Internet Law,
is a term that encapsulates the legal issues related to the use of communicative, transactional and
distributive aspects of networked information devices and technologies. 2 It is less a distinct fielding
of law in the way that property or contract is, as it is a domain covering many areas of law and
regulation. Cyber Law is the law governing cyber space. Cyber Law is a generic term which refers
to all the legal and regulatory aspects of Internet and the World Wide Web. Anything concerned
with or related to or emanating from any legal aspects or issues concerning any activity of citizens
and others, in Cyberspace comes within the ambit of Cyber Law.
- Cyber law is important because it touches almost all aspects of transactions and activities on and
involving the internet, World Wide Web and cyberspace. Every action and reaction in cyberspace
has some legal and cyber legal perspectives. Cyber law encompasses laws relating to –
• Cyber crimes
• Electronic and digital signatures
• Intellectual property
• Data protection and privacy
2Anupa P. Kumar, Cyber Law - A View to Social Security, 11, Published under the banner YFI andAnupa
Kumar, 2009.
6
When the concept of the Internet was founded and later developed little did the developers know
that the Internet would have the power of being transformed into a monster that could be used for
several illegal and immoral activities and it would eventually need to be regulated. There are several
disturbing things that happen in cyberspace ranging from identity theft and terrorism to money
laundering. Due to the anonymous nature of the Internet, anybody can indulge in a variety of criminal
activities with impunity. These grey areas‟ are being exploited by individuals, companies and their
like to perpetrate criminal activities in cyberspace, thus creating the need for cyber laws.
So, Cyber Law does concern us on our every day daily life. As the nature of Internet is changing
and this new medium is being seen as the ultimate medium ever evolved in human history, every
activity of ours in cyberspace can and will have a Cyber legal perspective. When we register our e-
mail, or when we conduct an online train reservation, do some electronic commerce transactions, start
a bank account, withdraw money from ATM counter or pay electricity bills, at every point of time,
every day there are various Cyber Law issues involved. We may not be bothered by these issues and
we may think that these laws are very distant from us and they do not have an impact on Cyber
activities. But sooner or later, some process may fail to give response, which may end in loss, and we
will be forced to take note of Cyber Law for our own benefit.3
3R. Raman Nair & L. Sulochana Devi, Sanskrit Informatics, 96, Centre for Informatics Researchand
Development Publications Division, Kerela, 2011
7
The Information Communication Technology revolution in India had its beginning in 1975, when the
Government of India strategically decided to take effective steps for the development of information
systems and the utilization of information resources. The National Informatics Centre under the
Electronic Commission/Department of Electronics was the outcome of this view and was assisted by
United Nations Development Program (UNDP). The formation of National Association of Software
Services Companies in the early 1990s reflects on India’s strength in this sector.Internet in
India came in 1995 and after almost 5 years, India gets ready to legislate its first cyber law.
In India, cyber laws are contained in the Information Technology Act, 2000 which came into force
on October 17, 2000. The main purpose of the Act is to provide legal recognition to electronic
commerce and to facilitate filing of electronic records with the Government. The following Act, Rules
and Regulations are covered under cyber laws:
The Information Technology Act, 2000 heralded a new cyber law regime in the country. India became
the 12th nation in the world to enact cyber laws.
Information Technology Act, 2000 is India’s mother legislation regulating the use of computers,
computer systems and computer networks as also data and information in the electronic format.
This legislation has touched varied aspects pertaining to electronic authentication, digital (electronic)
signatures, cyber crimes and liability of network service providers. The Preamble to the Act states
that it aims at providing legal recognition for transactions carried out by means of electronic data
interchange and other means of electronic communication, commonly referred to as "electronic
commerce", which involve the use of alternatives to paper-based methods of communication and
storage of information and aims at facilitating electronic filing of documents with the Government
agencies. This Act was amended by Information Technology Amendment Bill,2008 which was passed
in Lok Sabha on 22nd December, 2008 and in Rajya Sabha on 23rd December, 2008. It received the
assent of the President on 5th February 2009 and was notified with effect from 27/10/2009.
The IT Act of 2000 was developed to promote the IT industry, regulate ecommerce, facilitate e-
governance and prevent cybercrime. The Act also sought to foster security practices within India that
would serve the country in a global context. The Amendment was created to address issues that the
original bill failed to cover and to accommodate further development of IT and related security
concerns since the original law was passed. The IT Act, 2000 consists of 90 sections spread over 13
chapters [Sections 91, 92, 93 and 94 of the principal Act were omitted by the Information Technology
(Amendment) Act 2008 and has 2 schedules.[ Schedules III and IV were omitted by the Information
Technology (Amendment) Act 2008].
The United Nations Commission on International Trade Law (UNCITRAL) adopted the Model Law
on Electronic Commerce in 1996 in order to bring uniformity in the law of different countries. The
General Assembly of the United Nations by Resolution No. 51/162, dated 30th January 1997,
9
recommended that all the States should give favourable considerations to this Model Law when
they enact or revise their laws.
The Ministry of Commerce Government of India created the first draft of the legislation following
these guidelines termed as "E Commerce Act 1998". Since later a separate ministry for Information
technology came into being, the draft was taken over by the new ministry which re-drafted the
legislation as "Information Technology Bill 1999". This draft was placed in the Parliament in
December 1999 and passed in May 2000. After the assent of the President on June 9, 2000, the act
was finally notified with effect from October 17, 2000 vide notification number G.S.R 788(E).
This Act provides legal recognition for transactions carried out by means of electronic data
interchange and other means of electronic communication, commonly referred to as electronic
commerce, which involves the use of alternatives paper based method of communication and
storage of information, to facilitate electronic filling of documents with the Govt. agencies.
The said Act has also amended:
The Indian Penal Code, 1860
The Indian Evidence Act, 1872
The Banker’s Book Evidence Act, 189
The Reserve Bank of India Act, 1934.
10
Digital Signatures provide a viable solution for creating legally enforceable electronic records,
closing the gap in going fully paperless by completely eliminating the need to print documents for
signing. Digital signatures enable the replacement of slow and expensive paper-based approval
processes with fast, low-cost, and fully digital ones. The purpose of a digital signature is the same
as that of a handwritten signature. Instead of using pen and paper, a digital signature uses digital keys
(public-key cryptography). Like the pen and paper method, a digital signature attaches the identity of
the signer to the document and records a binding commitment to the document. However, unlike a
handwritten signature, it is considered impossible to forge a digital signature the way a written
signature might be. In addition, the digital signature assures that any changes made to the data that
has been signed cannot go undetected.
Digital signatures are easily transportable, cannot be imitated by someone else and can be
automatically time-stamped. A digital signature can be used with any kind of message, whether it is
encrypted or plaintext. Thus Digital Signatures provide the following three features:-
- AUTHENTICATION - Digital signatures are used to authenticate the source of messages.
The ownership of a digital signature key is bound to a specific user and thus a valid signature
shows that the message was sent by that user.
- INTEGRITY - In many scenarios, the sender and receiver of a message need assurance that
the message has not been altered during transmission. Digital Signatures provide this feature
by using cryptographic message digest functions.
- NON REPUDIATION – Digital signatures ensure that the sender who has signed the
information cannot at a later time deny having signed it.
A handwritten signature scanned and digitally attached with a document does not qualify as a
Digital Signature. An ink signature can be easily replicated from one document to another by copying
the image manually or electronically. Digital Signatures cryptographically bind an electronic identity
to an electronic document and the digital signature cannot be copied to another document.
11
Electronic Signature has also been dealt with under Section 3A of the IT Act, 2000. A subscriber
can authenticate any electronic record by such electronic signature or electronic authentication
technique which is considered reliable and may be specified in the Second Schedule. Any electronic
signature or electronic authentication technique will be considered reliable if-
i. the signature creation data or the authentication data are, within the context in which they are
used, linked to the signatory or , as the case may be, the authenticator and of no other person;
ii. the signature creation data or the authentication data were, at the time of signing, under the
control of the signatory or, as the case may be, the authenticator and of no other person;
iii. any alteration to the electronic signature made after affixing such signature is detectable;
iv. any alteration to the information made after its authentication by electronic signature is detectable;
and
v. it fulfills such other conditions which may be prescribed. An electronic signature will be deemed
to be a secure electronic signature if-
vi. the signature creation data, at the time of affixing signature, was under the exclusive control of
signatory and no other person; and (ii) the signature creation data was stored and affixed in such
exclusive manner as may be prescribed. (Sec.15)
12
An Amendment to the IT Act in 2008 introduced the term electronic signatures. The implication of
this Amendment is that it has helped to broaden the scope of the IT Act to include new techniques
as and when technology becomes available for signing electronic records apart from Digital
Signatures.
E- GOVERNANCE
E-governance or Electronic Governance is dealt with under Sections 4 to 10A of the IT Act, 2000. It
provides for legal recognition of electronic records and Electronic signature and also provides for
legal recognition of contracts formed through electronic means. Filing of any form, application or
other documents, creation, retention or preservation of records, issue or grant of any license or permit
or receipt or payment in Government offices and its agencies may be done through the means
of electronic form. The Government may authorise any any service provider to set up, maintain and
upgrade the computerised facilities and perform such other services as it may specify, by notification
in the Official Gazette for efficient delivery of services to the public throughelectronic means.
Service provider so authorized includes any individual, private agency, private company, partnership
firm, sole proprietor form or any such other body or agency which has been granted permission by
the appropriate Government to offer services through electronic means in accordance with the policy
governing such service sector.
The following are some of the eGovernance applications already using the Digital Signatures:
MCA21 – a Mission Mode project under NeGP (National e-governance plan) which is one of the
first few e-Governance projects under NeGP to successfully implement Digital Signatures in their
project
Income Tax e-filing
Indian Railway Catering and Tourism Corporation (IRCTC)
eProcurement
eOffice
Attribution of electronic records is dealt with under Sec.11 of the IT Act, 2000. An electronic record
will be attributed to the originator - if it was sent by the originator himself; by a person who had the
authority to act on behalf of the originator in respect of that electronic record; or by an information
system programmed by or on behalf of the originator to operate automatically.
According to Section 12, the addressee may acknowledge the receipt of the electronic record either
in a particular manner or form as desired by the originator and in the absence of such requirement, by
communication of the acknowledgement to the addresses or by any conduct that would sufficiently
constitute acknowledgement.
Time and place of dispatch and receipt of electronic record is covered under Sec.13 of the IT Act,
2000. The dispatch of an electronic record occurs when it enters a computer resource outside the
control of the originator. Unless otherwise agreed between the originator and the addressee, the time
of receipt of an electronic record will be determined as follows, namely –
a) If the addressee has designated a computer resource for the purpose of receiving electronic records
–
i. Receipt occurs at the time when the electronic record enters the designated computer resource; or
ii. If the electronic record is sent to a computer resource of the addressee that is not the designated
computer resource, receipt occurs at the time when the electronic record is retrieved by the addressee;
b) If the addressee has not designated a computer resource along with specified timings, if any,
receipt occurs when the electronic record enters the computer resource of the addressee.
An electronic record is generally deemed to be dispatched at the place where the originator has his
place of business, and is deemed to be received at the place where the addressee has his place of
business. If the originator or the addressee has more than one place of business, the principal place of
business will be the place of business.
If the originator or the addressee does not have a place of business, his usual place of residence will
be deemed to be the place of business. "Usual Place of Residence", in relation to a body corporate,
means the place where it is registered.
14
CERTIFYING AUTHORITIES
A Certifying Authority is a trusted body whose central responsibility is to issue, revoke, renew and
provide directories of Digital Certificates. Certifying Authority means a person who has been granted
a license to issue an Electronic Signature Certificate under section 24. Provisions with regard to
Certifying Authorities are covered under Chapter VI i.e. Sec.17 to Sec.34 of the IT Act, 2000. It
contains detailed provisions relating to the appointment and powers of the Controller and Certifying
Authorities.
Provisions relating to Electronic/Digital signature certificates are covered in Chapter VII i.e. Secs.35
to 39 of the IT Act, 2000 and Rules 23 to 30 of the IT (Certifying Authorities) Rules, 2000 and IT
(Certifying Authority) Regulations, 2001.
A Digital Signature Certificate is an electronic document which uses a digital signature to bind
together a public key with an identity — information such as the name of a person or an organization,
their address, and so forth. The certificate can be used to verify that a public key belongs to the
individual. Digital certificates are the digital equivalent (i.e. electronic format) of physical or paper
certificates. Examples of physical certificates are driver's licenses, passports or membership cards.
Digital Signature Certificates is issued by the Certifying Authority (CA). The CA is responsible for
vetting all applications for Digital Signature Certificates, and once satisfied, generates a Digital
Certificate by digitally signing the Public key of the individual along with other information using its
own Private Key.
JURISDICTION
SUBSEQUENT DEVELOPMENTS
1
These rules prescribe the eligibility,
Information Technology
appointment and working of
(Certifying Authorities) Rules, Certifying Authorities (CA). These
2000 rules also lay down the technical
standards, procedures and security
methods to be used by a CA. These
rules were amended in 2003, 2004
and 2006.
2
These rules prescribe the
Cyber Regulations Appellate
appointment and working of the CRAT
Tribunal (Procedure) Rules, 2000 whose primary role is to hear appeals
against orders of the adjudicating
officers.
3
Provide technical standards and
Information Technology
procedures to be used by a CA. Two
(Certifying Authorities) important guidelines relating to CA's
Regulations, 2001 were issued. The first are the
Guidelines for submission of
application for license to operate as a
Certifying Authority under the IT Act.
4 Negotiable Instruments
IT Act was amended at the concept of
(Amendments and Miscellaneous
electronic cheques and truncated
Provisions) Act, 2002 cheques was introduced.
5
These rules prescribe the qualification
Information Technology
required for adjudicating officers.
(Qualification and Experience of
Adjudicating Officers and Manner
of Holding Enquiry) Rules, 2003
As has been discussed earlier the IT Act 2000 was mainly to ensure legal recognition of e- commerce
within India. Due to this most provisions are mainly concerned with establishing digital certification
processes within the country. Cyber crime as a term was not defined in the act. It only delved with
few instances of computer related crime. The IT Act has several flaws which have been pointed out
by several experts. They are:
a. It is not clear how cyber crimes affecting computers in India committed from outside India using
the Internet will be handled.
b. The Act does not have any provisions regarding domain names and resolving disputes on such
names.
c. Many cyber crimes are not defined in the Act such as cyber defamation, cyber harassment and
cyber stalking.
d. Privacy and protection of personal data such as medical records are not covered by the Act.
e. The Act does not deal with intellectual property rights and has no provision to punish persons or
organizations sending unsolicited mail normally known as spam.
Based on the criticism and experience gained by using the Information Technology Act, 2000, the
Government set up an expert committee to review the IT Act in January 2005. The committee had
representatives from the Government, IT Industry and legal experts and submitted its report in
August, 2005.
The IT (Amendment) Bill, 2006, was introduced in the Lok Sabha on December 15, 2006 by Union
Minister of State for Communication. The 2006 Bill was modified and passed by the Parliament on
23-12-2008. It was notified after the assent of the President on 05-02-1009 as the Information
Technology (Amendment) Act, 2008, (Central Act No. 10 of 2009).
The following rules have also come into force on the same day:
a. Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption
of Information) Rules, 2009
18
b. Information Technology (Procedure and Safeguard for Monitoring and Collecting Traffic Data or
Information) Rules, 2009
c. Information Technology (Procedure and Safeguards for Blocking for Access of Information by
Public) Rules, 2009
d. The Cyber Appellate Tribunal (Salary, Allowances and Other Terms and Conditions of Service of
Chairperson and Members) Rules, 2009
e. Cyber Appellate Tribunal (Procedure for Investigation of Misbehaviour or Incapacity of
Chairperson and Members) Rules, 2009.
The Information Technology (Amendment) Act, 2008 introduces new eight cyber offences:
Sending offensive messages through a computer or mobile phone (Section 66A),
Receiving stolen computer resource or communication device (Section 66B)
Punishment for identity theft (Section 66C)
Punishment for cheating by personation using computer resource (Section 66D)
Punishment for violating privacy or video voyeurism (Section 66E)
Cyber Terrorism (Section 66F)
Publishing or transmitting material in electronic form containing sexually explicit act
(Section 67A), Child pornography (Section 67B)
The IT Amendment Act 2008 brings about various sweeping changes in the existing Cyber law. While
the lawmakers have to be complemented for their appreciable work removing various deficiencies in
the Indian Cyber law and making it technologically neutral, yet it appears that there has been a major
mismatch between the expectation of the nation and the resultant effect of the amended legislation.
The most bizarre and startling aspect of the new amendments is that these amendments seek to make
the Indian cyber law a cyber crime friendly legislation; a legislation that goes extremely soft on cyber
criminals, with a soft heart; a legislation that chooses to encourage
19
cyber criminals by lessening the quantum of punishment accorded to them under the existing law; a
legislation that chooses to give far more freedom to cyber criminals than the existing legislation
envisages; a legislation which actually paves the way for cyber criminals to wipe out the electronic
trails and electronic evidence by granting them bail as a matter of right; a legislation which makes a
majority of cybercrimes stipulated under the IT Act as bailable offences; a legislation that is likely
to pave way for India to become the potential cyber crime capital of the world.
• AMENDMENT TO SECTION 4 –
• In section 4, - after clause (2), the following clause shall be inserted namely: -
• Clause 2: any person in any place without and beyond India committing offence targeting a
computer resource located in India
• for the Explanation, the following Explanation shall be substituted, namely:- The word "offence"
includes every act committed outside India which, if committed in India would be punishable
under this code. the expression "computer resource" shall have the meaning
assigned to it in clause (k) of subsection (1) of section 2 of the Information Technology Act,
2000. In clause (2), after the figure "117", the figures ‗118, 119 and 120‘ shall be inserted.
• AMENDMENT OF SECTION 118 – In section 118, for the words ‗voluntarily conceals, by
any act or illegal omission, the existence of a design‟, the words "voluntarily conceals by any
act or omission or by the use of encryption or any other information hiding tool, the existence
of a design" shall be substituted.
• AMENDMENT OF SECTION 119 – In section 119, for the words „voluntarily conceals, by
any act or illegal omission, the existence of a design‟, the words ‗voluntarily conceals by any
act or omission or by the use of encryption or any other information hiding tool, the existence
of a design‘ shall be substituted.
• AMENDMENT OF SECTION 464 – In section 464, for the words ‗digital signature‟
wherever they occur, the words "electronic signature" shall be substituted.
20
2 THE INDIAN EVIDENCE ACT, 1862
Amendments related to the evidence Act were contained in Section 92 and the Second Schedule of
the IT Act, 2000. Pursuant to the enactment of the Information Technology (amendment) Act, 2008,
Section 92 was deleted and the provisions with regard to the Indian Evidence Act were mentioned
in Part IV of the amendment Act.
• AMENDMENT OF SECTION 3 – In section 3 relating to interpretation clause, in the
paragraph appearing at the end, for the words "digital signature" and "Digital Signature
Certificate", the words "Electronic signature" and "Electronic Signature Certificate"
shall be respectively substituted.
• INSERTION OF NEW SECTION 45A – Opinion of Examiner of Electronic evidence –
Section 45A: When in a proceeding, the Court has to form an opinion on any matter relating
to any information transmitted or stored in any computer resource or any other electronic or
digital form, the opinion of the Examiner of Electronic Evidence referred to in section 79A of
the Information Technology Act, 2000, is a relevant fact. Explanation: For the purposesof
this section, an Examiner of Electronic Evidence shall be an expert
• AMENDMENT OF SECTION 47A – In section 47A,-for the words "digital signature", the
words "electronic signature" shall be substituted;
• for the words "Digital Signature Certificate", the words "Electronic Signature Certificate" shall
be substituted.
• AMENDMENT OF SECTION 67A – In section 67 A, - for the words "digital signature",
the words "electronic signature" shall be substituted.
• AMENDMENT OF SECTION 85A – In section 85A, for the words "digital signature",
wherever they occur, and the words "electronic signature" shall be substituted.
• AMENDMENT OF SECTION 85B – In section 85B, - for the words "digital signature",
wherever they occur, and the words "electronic signature" shall be substituted.
• AMENDMENT OF SECTION 85C – In section 85C, for the words "Digital Signature
Certificate", the words "Electronic Signature Certificate" shall be substituted.
• AMENDMENT OF SECTION 90A – In section 90A, the words "digital signature", at both
places where they occur, the words "electronic signature" shall be substituted.
21
BIBLIOGRAPHY
STATUTES:
Information Technology Act, 2000
ARTICLES/ JOURNALS:
http://www.asianlaws.org/library/cyber-laws/intro-indian-cyber-law.pdf
http://gilc.org/privacy/survey/intro.html
http://www.cyberlaws.net/article.htm
http://conventions.coe.int/treaty/en/reports/html/185.htm
http://cyberlawsconsultingcentre.com/regulating-the-cyberspace.html
http://www.cyberlawdb.com/main/india