Cyber Crime Offences: IT Act 2000 Penalties and Legal Provisions

Every time you download a file, log into net banking, or share a photo online, you are operating inside a legal framework you may never have read: the Information Technology Act, 2000. This law does more than define what counts as a digital signature or an electronic record. It draws a hard line between everyday internet use and criminal conduct, and it backs that line with jail time and fines that go up to a life sentence. If you are studying cyber law or simply want to know what actually happens when someone hacks an account or leaks a photo without consent, the IT Act’s offences and penalties chapter is where the answers live.

What counts as a cyber offence 🔗

The IT Act does not treat every online mistake as a crime. It draws specific boundaries around conduct that causes real harm: tampering with computer source code, hacking into systems, publishing obscene material, breaching confidentiality, and putting out fraudulent digital signature certificates. Each of these has its own section, its own definition, and its own punishment. This structure matters because it means intent and specific conduct decide the outcome, not just the fact that a computer was involved.

Ten unauthorised activities under Section 43 🔗

Before the Act even gets to criminal punishment, Section 43 lists ten specific acts that trigger liability when done without the owner’s permission. These include accessing a computer or network, downloading or extracting data, introducing a virus or contaminant, damaging a system or its data, disrupting a network, denying authorised access to someone else, helping another person gain unauthorised access, and altering or deleting information. The United Nations Office on Drugs and Crime notes that this section anchors civil liability in Indian cyber law, meaning a victim can claim compensation through an adjudicating officer without needing to prove criminal intent. Section 65, separately, penalises knowingly tampering with computer source documents when the source code is legally required to be maintained, carrying up to three years in prison or a fine that can reach Rs 2 lakh.

This distinction between civil and criminal liability is worth remembering as you go through the rest of the Act. Sections 43 to 47 deal with compensation. Sections 65 onward deal with imprisonment. The same act, like accessing a database without permission, can fall into either category depending on what the person intended to do with that access.

Penalties for computer-related crimes 🔗

Three sections form the backbone of individual cybercrime prosecutions in India: 66B, 66C, and 66D. Each targets a distinct kind of dishonest conduct involving computer resources.

Section 66B: Receiving stolen computer resources 🔗

Section 66B penalises a person who dishonestly receives or retains a stolen computer resource or communication device, knowing or having reason to believe it was stolen. The punishment is imprisonment of up to three years, a fine of up to Rs 1 lakh, or both.

Section 66C: Identity theft 🔗

Section 66C covers identity theft, specifically the fraudulent or dishonest use of someone else’s electronic signature, password, or any other unique identification feature. This is the section that applies when someone logs into another person’s account using stolen credentials. The penalty mirrors 66B: up to three years imprisonment and a fine of up to Rs 1 lakh. [Image: Illustration showing a phishing email leading to stolen login credentials]

Section 66D: Cheating by personation 🔗

Section 66D deals with cheating by personation using a computer resource or communication device, such as creating a fake profile to defraud someone or impersonating a bank official over a call or message to extract money. It carries the same maximum punishment of three years imprisonment and a Rs 1 lakh fine.

Privacy and terrorism provisions 🔗

Two sections in this cluster deal with harms that go beyond financial loss. One protects personal dignity. The other addresses threats to the country itself.

Section 66E: Violation of privacy 🔗

Section 66E penalises intentionally capturing, publishing, or transmitting the image of a person’s private area without consent, in circumstances that violate that person’s privacy. According to a detailed legal analysis of the Act’s obscenity and privacy provisions, this section was significantly shaped by real cases involving non-consensual image sharing, and it now serves as the primary redress for victims of what is commonly called revenge porn or voyeurism. The penalty is imprisonment of up to three years, a fine of up to Rs 2 lakh, or both.

Section 66F: Cyber terrorism 🔗

Section 66F is the only section in the entire Act that carries a life sentence. It applies when a person, with intent to threaten the unity, integrity, security, or sovereignty of India, denies authorised personnel access to a computer resource, attempts to gain unauthorised access to a protected system, or introduces a contaminant likely to cause death or injury, damage property, disrupt essential supplies, or affect critical information infrastructure. Given the scale of harm this section is designed to address, its penalty stands apart from every other provision in the chapter.

Obscenity and fraud penalties 🔗

Publishing content and misrepresenting facts to obtain licences or certificates form another distinct category of offences under the Act.

Section 67 and 67A: Obscene and sexually explicit material 🔗

Section 67 penalises publishing or transmitting obscene material in electronic form. A first conviction can bring imprisonment of up to three years and a fine of up to Rs 5 lakh; a second or subsequent conviction raises this to five years imprisonment and a fine of up to Rs 10 lakh. Section 67A deals specifically with material containing sexually explicit acts and carries a steeper penalty: up to five years imprisonment on first conviction, rising to seven years on subsequent conviction, along with a fine that can reach Rs 10 lakh. A study from the National Law University Jodhpur’s criminal law blog points out that Section 67 is gender-neutral and remains the most frequently invoked provision in cybercrime cases against women, often applied alongside Section 66E.

Section 71 and 72: Misrepresentation and confidentiality breach 🔗

Section 71 addresses misrepresentation or suppression of material facts to obtain a licence or an electronic signature certificate from the Controller or a Certifying Authority. Section 72 penalises breach of confidentiality and privacy by anyone who, having gained access to electronic records or information under the powers granted by the Act, discloses that information without the person’s consent. Both sections carry imprisonment of up to two years, a fine of up to Rs 1 lakh, or both.

Additional provisions and confiscation 🔗

The final cluster of sections closes gaps that the earlier provisions leave open, covering contractual data breaches, fraudulent certificates, offences committed from abroad, and what happens to the equipment used in a crime.

Section 72A: Disclosure in breach of contract 🔗

Section 72A targets a person who, while providing services under a lawful contract, discloses personal information about another person without consent, intending to cause or knowing that the disclosure is likely to cause wrongful loss or wrongful gain. This is particularly relevant for employees and service providers who handle customer data. The penalty is imprisonment of up to three years, a fine of up to Rs 5 lakh, or both.

Sections 73 and 74: Fraudulent certificates 🔗

Section 73 penalises publishing an electronic signature certificate that is false in a material particular, or making it available to another person while knowing it to be false. Section 74 covers knowingly creating, publishing, or making available such a certificate for a fraudulent or unlawful purpose. Section 73 carries up to two years imprisonment and a fine of up to Rs 1 lakh, while Section 74 carries a similar range of penalties.

Sections 75 and 76: Reach beyond India and confiscation 🔗

Section 75 gives the Act extraterritorial reach. It applies to any offence or contravention committed outside India by any person, regardless of nationality, as long as the act involves a computer, computer system, or computer network located in India. This matters because a large share of cyber fraud targeting Indian users originates from servers or individuals based abroad. Section 76 allows courts to order the confiscation of any computer, computer system, or related accessory used in contravening the Act, though a person can avoid confiscation of their equipment if they prove it was not actually used to commit the offence.

Reporting a cyber offence 🔗

Knowing which section applies to a crime is only useful if a victim also knows how to act. The Ministry of Home Affairs, through the Indian Cyber Crime Coordination Centre, runs the National Cyber Crime Reporting Portal at cybercrime.gov.in, built specifically to let citizens report incidents including offences against women and children, alongside a 24×7 helpline for immediate financial fraud reporting. Filing a complaint there routes the case to the law enforcement agency in the relevant state, which then registers an FIR and investigates under the applicable IT Act sections.

What do you think? With most of these penalties capped between two and five years, does the punishment scale properly with the harm caused by offences like identity theft or non-consensual image sharing? And should intent-based distinctions, like the one between Sections 66C and 66D, be easier or harder to prove in a country where digital literacy still varies so widely?

References

1. https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf
2. https://www.unodc.org/cld/en/legislation/ind/the_information_technology_act_2000/chapter_ix/section_43/section_43.html
3. https://blog.ipleaders.in/section-67-of-information-technology-act-2000/
4. https://criminallawstudiesnluj.wordpress.com/2020/06/02/section-67-of-it-act-2000-scope-misuse-and-the-striking-inadequacy/
5. https://www.pib.gov.in/PressReleasePage.aspx?PRID=2085609&reg=3&lang=2