I.T. Act New Amendments address new issues like cyber security.

Submitted by tushar on Wed, 01/14/2009 - 11:09

Share

Information Technology Act 2000 Amendments

The most awaited amendments to the Information Technology Act 2000, which was the first cyber legislation and came into force from 17th October 2000 has finally been passed by the Parliament of India recently. The new amendments main focus is on the cyber security. The said amendment which is a new version of Information Technology Act is hereinafter referred as Information Technology Act, 2008 (ITA 2008).

The new amended act has attempted to bring in comprehensive information security to the IT industry.

Upon perusal of the new amendments that have been passed my attention got attracted to the Definitions clauses stated in the new act and I found out that new term “Cyber Security” has been newly added in the present act under Section 2 (nb) which is as under–
Section 2 (nb)
“Cyber Security” means protecting information, equipment, devices, computer, computer resource, communication device and information stored therein from unauthorized access, use, disclosure, disruption, modification or destruction.
The said definition provides security in terms of both, physical security to the devices and security to the information stored therein such devices. The said definition provides protection for unauthorised access, use, disclosure, disruption, modification and destruction to both physical device and the information stored therein.
Subsequently Section 43 has also undergone foremost changes under new ITA 2008. Under ITA 2000 i.e. Old Act, there was upper limit of Rs. 1 Crore for any contravention committed under various provisions of Section 43, presently the said upper limit has been removed and now for contraventions committed under Section 46 of ITAA 2008, person may able to demand compensation beyond Rs. 1 Crore. That means there is no upper limit for compensation under Section 43 of ITAA 2008.
The newly added Section 43 (j) reads as under –
“Steals, conceals, destroys or alters or causes any person to steal, conceal, destroy or alter any computer source code used for a computer resource with an intention to cause damage,”
For the purposes of this section, “Computer Source code” means “the listing of programmes, computer commands, design and layout and programme analysis of computer resource in any form”. This again makes it easy for Police to understand how to treat a complaint from a software company about stolen data.
The newly brought Section 43A reads as follows –
“Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation, to the person so affected.”
As I have motioned above, there is no upper limit for the compensation by way of damages under this section to the affected person. In order to determine whether a body corporate is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate, terms reasonable security practices attains extreme importance.
Under penalties we must note that new offence has been inserted exclusively to punish the thieves who steel computer, mobile phones or any other such communication devices.
Section 66B has newly been added under the new ITA 2008, under which, the receiver of a stolen computer resource may be liable for punishment.
The section reads as follows:
Sec 66B: Punishment for dishonestly receiving stolen computer resource or communication device
“Whoever dishonestly receives or retains any stolen computer resource or communication device knowing or having reason to believe the same to be stolen computer resource or communication device, shall be punished with imprisonment of either description for a term which may extend to three years or with fine which may extend to rupees one lakh or with both”
Under the aforesaid provision any person who receives a stolen Computer, or a Mobile or even a CD, or an e-mail containing stolen information may be punishable with 3 years of imprisonment. This offence has been made compoundable and cognizable. But to book person under this section you must prove the person has received the information “Dishonestly” and he was aware of the fact that it “Stolen”.
My dear Advocate colleagues, it’s easy to convince Police authorities to book any such thief under this section than of earlier Sec. 66 of hacking isn’t it?
New added Section 67 C reads as
“(1) Intermediary shall preserve and retain such information as may be specified for such duration and in such manner and format as the Central Government may prescribe.
(2) Any intermediary who intentionally or knowingly contravenes the provisions of sub section (1) shall be punished with an imprisonment for a term which may extend to three years and shall also be liable to fine.”
Under this Section a additional responsibility has been put on the shoulders of “Intermediaries”. The term “Intermediaries” is now includes body corporate, who are required to keep information for a certain amount of time to be specified by the Central Government in the official gazette. So far as the Mobile Services Providers, Internet Service Providers who are avoiding their responsibilities in preserving the information that could be used as evidence in cyber crimes cases are now compulsorily required to maintain such information for some time.
In order to monitor Cyber Security new Section 69 B has been incorporated which reads as under –
“(1) The Central Government may, to enhance Cyber Security and for identification, analysis and prevention of any intrusion or spread of computer contaminant in the country, by notification in the official Gazette, authorize any agency of the Government to monitor and collect traffic data or information generated, transmitted, received or stored in any computer resource.
(2) The Intermediary or any person in-charge of the Computer resource shall when called upon by the agency which has been authorised under sub-section (1), provide technical assistance and extend all facilities to such agency to enable online access or to secure and provide online access to the computer resource generating, transmitting, receiving or storing such traffic data or information.
(3) The procedure and safeguards for monitoring and collecting traffic data or information, shall be such as may be prescribed.
(4) Any intermediary who intentionally or knowingly contravenes the provisions of sub-section (2) shall be punished with an imprisonment for a term which may extend to three years and shall also be liable to fine.”
Explanation: For the purposes of this section,
(i) “Computer Contaminant” shall have the meaning assigned to it in section 43
(ii) “traffic data” means any data identifying or purporting to identify any person, computer system or computer network or location to or from which the communication is or may be transmitted and includes communications origin, destination, route, time, date, size, duration or type of underlying service or any other information.
Section 70 (B) (4) also been newly added by way of amendment which reads as follows –
“The Indian Computer Emergency Response Team shall serve as the national agency for performing the following functions in the area of Cyber Security,-
(a) collection, analysis and dissemination of information on cyber incidents
(b) forecast and alerts of cyber security incidents
(c) emergency measures for handling cyber security incidents
(d) Coordination of cyber incidents response activities
(e) issue guidelines, advisories, vulnerability notes and white papers relating to information security practices, procedures, prevention, response and reporting of cyber incidents
(f) such other functions relating to cyber security as may be prescribed”
Further Section 70 (B) (6) has also been newly added which reads as follows –
“For carrying out the provisions of sub-section (4), the agency referred to in sub-section (1) may call for information and give direction to the service providers, intermediaries, data centers, body corporate and any other person”
Further Section 70 (B) (7) has also been newly added which reads as follows –
“Any service provider, intermediaries, data centers, body corporate or person who fails to provide the information called for or comply with the direction under sub-section (6) , shall be punishable with imprisonment for a term which may extend to one year or with fine which may extend to one lakh rupees or with both.”

Furthermore Section 72 A has newly been inserted under which a provision for criminal prosecution for breach of information security has been added by way of amendment.
This section states reads as follow –
“Save as otherwise provided in this Act or any other law for the time being in force, any person including an intermediary who, while providing services under the terms of lawful contract, has secured access to any material containing personal information about another person, with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in breach of a lawful contract, such material to any other person shall be punished with imprisonment for a term which may extend to three years, or with a fine which may extend to five lakh rupees, or with both.”
Please note that the offence under Section 72 A is cognizable
Another positive change I could see in the new ITA 2008 is that significant changes have been made to Section 78 and Section 80 of ITA 2000 (Old Act) is the level of investigation officer has brought down to Inspectors from Dy. SP But such change may result increase in the workload of Police. The time ahead will able to throw light on this.
Furthermore following new sections have been inserted by way of amendments to the ITA 2000 which are as follows.
Section 84 A - Modes or methods for encryption which reads as follows -

“The Central Government may, for secure use of the electronic medium and for promotion of e-governance and e-commerce, prescribe the modes or methods for encryption”

Section 84 B - Punishment for abetment of offences which reads as follows -
“Whoever abets any offence shall, if the act abetted is committed in consequence of the abetment, and no express provision is made by this Act for the punishment of such abetment, be punished with the punishment provided for the offence under this Act.”
Explanation: An Act or offence is said to be committed in consequence of abetment, when it is committed in consequence of the instigation, or in pursuance of the conspiracy, or with the aid which constitutes the abetment.
Section 84 C - Punishment for attempt to commit offences which reads as follows -
“Whoever attempts to commit an offence punishable by this Act or causes such an offence to be committed, and in such an attempt does any act towards the commission of the offence, shall, where no express provision is made for the punishment of such attempt, be punished with imprisonment of any description provided for the offence, for a term which may extend to one-half of the longest term of imprisonment provided for that offence, or with such fine as is provided for the offence or with both.”
The ITA 2008 is definitely a positive development so far as the cyber security is concerned. The future will throw light on the pros and cons of these amendments.

Tushar Kale
M/s Tusharcons®
Advocates, High Court
Consultants Cyber Laws, IPR