d%+$ u o 30 ~ ~ ( ~ ; 1 ) 0 4 / 0 0 0 7 / 2 0 0 ~ 9 REGISTERED NO. DL-(N)04/0007/2003-09 mm EXTRAORDINARY o r m r r - ~ 1
PART TI - Section 1 ~ i 3 ~ PUBLISHED BY AUTHORITY 7i0 131 ;If f$F8, mi, 5, 2009 116 W, 1930 No. 131 NEW DELHI, THURSDAY, FEBRUARY 5,2009 I 16 Magha, 1930 ~ m * M q r c r * i t . d % m % ~ m ~ $ w * m w * l Separate paging is given to this Part in order that it may be filed as a separate compilation.
MINISTRY OF LAW AND JUSTICE (Legislative Department) New Delhi, the 5th February, 2009/Magha 16, 1930 (Saka) The following Act of Parliament received the assent of the President on the 5th February, ,2009, and is hereby published for general information:- THE INFORMATION TECHNOLOGY (AMENDMENT) ACT, 2008 No. 10 OF 2009 .
[5th February, 2009.1 An Act further to amend the Information Technology Act, 2000.
BE it enacted by Parliament in the Fifty-ninth Year of the Republic of India as follows:-
PART I
1. ( I ) This Act may be called the Information Technology (Amendment) Act, Short title and
2008. commencement.
(2) It shall come into force on such date as the Central Government may, by notification in the Official Gazette, appoint:
Provided that different dates may be appointed for different provisions ofthis Act and any reference in any such provision to the commencement of this Act shall be construed as a reference to the coming into force of that provision.
2 THE GAZETTE OF INDIA EXTRAORDINARY PART I&
PART I1 , Substitution of 2. In the Information Technology Act, 2000 (hereinafter in this Part referred to as the 21 of 2000.
words "digital principal Act), for the words "digital signature" occurring in the Chapter, section, subsignature" by section and clause referred to in the Table below, the words "electronic signature" shall be words 'celectronic substituted.
signature". TABLE S .No. Chapter/section/sub-section/clause ( I ) clauses (d), (g), (h) and (zg) of section 2;
(2) section 5 and its marginal heading;
(3) marginal heading of section 6;
(4) clauses (a), (b), (c) and (e) of section 10 and its marginal heading;
(5) heading of Chapter V;
(6) clauses Cf) and (g) of section 18;
(7) sub-section (2) of section 19;
sub-sections (I) and (2) of section 21 and its marginal heading;
sub-section (3) of section 25;
clause (c) of section 30;
clauses (a) and (d) of sub-section (I) and sub-section (2) of section 34;
heading of Chapter VII;
section 35 and its marginal heading;
section 64;
section 71 ;
sub-section (I) of section 73 and its marginal heading;
section 74; and
(18) clauses (d), (n) and (0) of sub-section (2) of section 87.
Amendment 3. In section 1 ofthe principal Act, for sub-section (4), the following sub-sections shall of section be substituted, namely:- "(4) Nothing in this Act shall apply to documents or transactions specified in the First Schedule:
Provided that the Central Government may, by notification in the Official Gazette, amend the First Schedule by way of addition or deletion of entries thereto.
Amendment of section 2.
(5) Every notification issued under sub-section (4) shal1,be laid before each House of Parlianlent.".
4. In section 2 of theprincipal Act,- (A) after clause (h), the following clause shall be inserted, namely:- '(ha) "communication device" means cell phones, personal digital assistance or combination of both or any other device used to communicate, send or transmit any text, video, audio or image;';
(B) for clause (j), the following clause shall be substituted, namely:- ' ( j ) "computer network" means the inter-connection of one or more computers or computer systems or communication device through- ( i ) the use of satellite, microwave, terrestrial line, wire, wireless or other communication media; and
(ii) terminals or a complex consisting oftwo or more inter-connected computers or communication device whether or not the inter-connection is continuously maintained;';
SEC. 11 THE GAZEmE OF INDIA EXTRAORDINARY 3 (C) in clause (n), the word "Regulations" shall be omitted;
(D) after clause (n), the following clauses shall be inserted, namely:- '(na) "cyber cafe" means any facility from where access to the internet is offered by any person in the ordinary course of business to the members of the public;
(nb) "cyber security" means protecting information, equipment, devices, computer, computer resource, communication device and information stored therein from unauthorised access, use, disclosure, disruption, modification or destruction;'.
(E) after clause (t), the following clauses shall be inserted, namely:- '(ta) "electronic signature" means authentication of any electronic record by a subscriber by means of the electronic technique specified in the Second Schedule and includes digital signature;
(tb) "Electronic Signature Certificate" means an Electronic Signature Certificate issued under section 35 and includes Digital Signature Certificate;';
(F) after clause (u), the following clause shall be inserted, namely:- '(ua) "Indian Computer Emergency Response Team" means an agency established under sub-section (1) of section 70B;';
(G) in clause (v), for the words "data, text", the words "data, message, text" shall be substituted;
(H) for clause (w), the following clause shall be substituted, namely:- '(w) "intermediary", with respect to any particular electronic records, means any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record and includes telecom service providers, network service providers, internet service providers, webhosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes;'.
5. In Chapter I1 of the principal Act, for the heading, the heading "DIGITAL SIGNATURE Amendment of AND ELECTRONIC SIGNATURE" shall be substituted. heading of Chapter 11.
6. After section 3 of the principal Act, the following section shall be inserted, Insertion of namely:- new section
3A.
"3A. (1) Notwithstanding anything contained in section 3, but subject to the Electronic provisions of sub-section (2), a subscriber may authenticate any electronic record by "E"""~.
such electronic signature or electronic authentication technique which-
(a) is considered reliable; and
(6) may be specified in the Second Schedule.
(2) For the purposes of this section any electronic signature or electronic authentication technique shall be considered reliable if-
(a) the signature creation data or the authentication data are, within the context in which they are used, linked to the signatory or, as the case may be, the authenticator and to no other person;
(6) the signature creation data or the authentication data were, at the time of signing, under the control of the signatory or, as the case may be, the authenticator and of no other person;
jc) any alteration to the electronic signature made after affixing such signature is detectable;
(4 any alteration to the information made after its authentication by electronic signature is detectable; and
(e) it hlfils such other conditions which may be prescribed.
4 THE GAZETTE OF INDIA EXTRAORDINARY PART n- Insertion of new section
6A.
Delivery of services by service provider.
Insertion of new section
7A.
Audit of documents, etc., maintained electronic form.
Insertion of new section
10A.
Validity of conlracts formed through electronic means.
(3) The Central Government may prescribe the procedure for the purpose of ascertaining whether electronic signature is that of the person by whom it is purported to have been affixed or authenticated.
(4) The Central Govenunent may, by notification in the Official Gazette, add to or omit any electronic signature or electronic authentication technique and the procedure for affixing such signature from the Second Schedule:
Provided that no electronic signature or authentication technique shall be specified in the Second Schedule unless such signature or technique is reliable.
(5) Every notification issued under sub-section (4) shall be laid before each House of Parliament.".
7. After section 6 ofthe principal Act, the following section shall be inserted, namely:- '6A. (I) The appropriate Government may, for the purposes ofthis Chapter and for efficient delivery of services to the public through electronic means authorise, by order, any service provider to set up, maintain and upgrade the computerised facilities and perform such other services as it may specify by notification in the Official Gazette.
Exp1anafion.-For the purposes of this section, service provider so authorised includes any individual, private agency, private company, partnership firm, sole proprietor firm or any such other body or agency which has been granted permission by the appropriate Government to offer services through electronic means in accordance with the policy governing such service sector.
(2) The appropriate Government may also authorise any service provider authorised under sub-section (I) to collect, retain and appropriate such service charges, as may be prescribed by the appropriate Government for the purpose of providing such services, from the person availing such service.
(3) Subject to the provisions of sub-section (2), the appropriate Government may authorise the service providers to collect, retain and appropriate service charges under this section notwithstanding the fact that there is no express provision under the Act, rule, regulation or notification under which the service is provided to collect, retain and appropriate e-service charges by the service providers.
(4) The appropriate Government shall, by notification in the Official Gazette, specify the scale of service charges which may be charged and collected by the service providers under this section:
Provided that the appropriate Government may specify different scale of service charges for different types of services.'.
8. After section 7 ofthe principal Act, the following section shall be inserted, namely:- "7A. Where in any law for the time being in force, there is a provision for audit of documents, records or information, that provision shall also be applicable for audit of documents, records or information processed and maintanined in the electronic form.".
9. After section 10 of the principal Act, the following section shall be inserted, namely:- "10A. Where in a contract formation, the communication of proposals, the acceptance of proposals, the revocation of proposals and acceptances, as the case may be, are expressed in electronic form or by means of an electronic record, such contract shall not be deemed to be unenforceable solely on the ground that such electronic form ormeans was used for that purpose.".
SE. 11 THE GAZETTE OF INDIA EXTRAORDINARY 5
10. In section 12 ofthe principal Act, in sub-section (I), for the words "agreed with the A m e n d m e n t addressee", the word "stipulated" shall be substituted. of section 12.
11. For sections 15 and 16 of the principal Act, the following sections shall be Substitution of substituted, namely:- new sections for sections 15 and 16.
'15. An electronic signature shall be deemed to be a secure electronic signature secure if- electronic signature.
( i ) the signature creation data, at the time of affixing signature, was under the exclusive control of signatory and no other person; and
(ii) the signature creation data was stored and affixed in such exclusive manner as may be prescribed.
Explanation.-In case of digital signature, the "signature creation data" means the private key of the subscriber.
16. The Central Government may, for the purposes of sections 14 and 15, Security prescribe the security procedures and practices: procedures and practices.
Provided that in prescribing such security procedures and practices, the Central Government shall have regard to the commercial circumstances, nature of transactions and such other related factors as it may consider appropriate.'.
12. In section 17 ofthe principalAct,- Amendment of
(a) in sub-section ( I ) , for the words "and Assistant Controllers", the words section 17.
", Assistant Controllers, other officers and employees" shall be substiuted; and
(b) in sub-section (4), for the words "and Assistant Controllers", the words ", Assistant Controllers, other officers and employees" shall be substituted.".
13. Section 20 ofthe principal Act shall be omitted. Omission of section 20.
14. In section 29 of the principal Act, in sub-section (I), for the words "any Amendment of contravention of the provisions of this Act, rules or regulations made thereunder", the 29.
words "any contravention of the provisions of this Chapter" shall be substituted.
15. In section 30 ofthe principalAct,- Amendment of
(i) in clause (c), after the word "assured", the word "and" shall be omitted; section 30.
(ii) after clause (c), the following clauses shall be inserted, namely:- "(ca) be the repository of all Electronic Signature Certificates issued under this Act;
(cb) publish information regarding its practices, Electronic Signature Certificates and current status of such certificates; and".
16. In section34 ofthe principalAct, in sub-section (I), in clause (a), the words "which Amendment of contains the public key corresponding to the private key used by that Certifying Authority section 34.
to digitally sign another Digital Signature Certificate" shall be omitted.
17. In section 35 of the principal Act, in sub-section (4), - Amendment of section 35.
(a) the f i s t proviso shall be omitted;
(b) in the second proviso, for the words "Provided further", the word "Provided" shall be substituted.
18. In section 36 of the principal Act, after clause (c), the following clauses shall be Amendment of inserted, namely:- section 36.
"(ca) the subscriber holds a private key which is capable of creating a digital signature;
(cb) the public key to be listed in the certificate can be used to verify a digital signature a f f ~ e d by the private key held by the subscriber;".
6 THE GAZETTE OF INDIA EXTRAORDINARY PART II- Insertion of new section
40A.
19. After section 40 of the principal Act, the following section shall be inserted, namely:- ~ u t i e ' s ' o f "40A. In respect of Electronic Signature Certificate the subscriber shall perform subscriber of Electronic Signature Certificate.
Amendment of heading of Chapter IX.
Amendment of section 43.
Insertion of new section
43A.
Compensation for failure to protect data.
such duties as may be prescribed.".
20. In Chapter IX of the principal Act, in the heading, for the words "PENALTIES AND ADIUDICATION ", the words "PENALTIES, COMPENSATlON AND ADJUDICATION" shall be substituted.
21. In section 43 of the principal Act,-
(a) in the marginal heading, for the word "Penalty", the words "Penalty and Compensation" shall be substituted;
(b) in clause (a), after the words "computer network", the words "or computer resource" shall be inserted;
(c) after clause (h), the following clauses shall be inserted, namely:- "(i) destroys, deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means;
(j) steal, conceals, destroys or alters or causes any person to steal, conceal, destroy or alter any computer source code used for a computer resource with an intention to cause damage;";
(d) for the portion begining with the words "he shall be liable to pay damages" and ending with the words "persons so affected" the following shall be substituted, namely:- "he shall be liable to pay damages by way of compensation to the person so affected";
(e) in the Explanation, after clause (iv), the following clause shall be inserted, namely:- '(v) "computer source code" means the listing of programmes, computer commands, design and layout and programme analysis of computer resource in any form.".
22. After section 43 of the principal Act, the following section shall be inserted, namely:- '43A. Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongfil gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affected.
Explanation.-For the purposes of this section,-
(i) "body corporate" means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities;
(ii) "reasonable security practices and procedures" means security practices and procedures designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit;
SEC. 11 THE GAZETTE OF MDIA EXTRAORDINARY 7
(iii) "sensitive personal data or information" means such personal information as may be prescribed by the Central Government in consultation with such professional bodies or associations as it may deem fit.'.
23. In section 46 of the principal Act,- Amendment of section 46
(a) in sub-section (I), for the words "direction or order made thereunder", the words "direction or order made thereunder which renders him liable to pay penalty or compensation," shall be substituted;
(b) after sub-section (I), the following sub-section shall be inserted, namely:-- "(IA) The adjudicating officer appointed under sub-section (I) shall exercise jurisdiction to adjudicate matters in which the claim for injury or damage does not exceed rupees five crore:
Provided that the jurisdiction in respect of the claim for injury or damage exceeding rupees five crore shall vest with the competent court.";
(c) in sub-section (9, after clause (b), the following clause shall be inserted, namely:- "(c) shall be deemed to be a civil court for purposes of Order XXI of the Civil Procedure Code, 1908.".
24. In Chapter X ofthe principal Act, in the heading, the word "REGULATIONS" shall be Amendment of omitted. heading of Chapter X.
25. In section 48 of the principal Act, in sub-section (I), the word "Regulations" shall Amendment of be omitted. section 48.
26. For sections 49 to 52 of the principalact, the following sections shall be substituted, Substihition of namely:- new sections for sections 49 to 52.
"49. (1) The Cyber Appellate Tribunal shall consist of a Chairperson and such Composition number of other Members, as the Central Government may, by notification in the of Cyber Official Gazette, appoint: Appellate Tribunal.
Provided that the person appointed as the Presiding Officer ofthe Cyber Appellate Tribunal under the provisions of this Act immediately before the commencement of the Information Technology (Amendment) Act, 2008 shall be deemed to have been appointed as the Chairperson of the said Cyber Appellate Tribunal under the provisions of this Act as amended by the Information Technology (Amendment) Act, 2008.
(2) The selection of Chairperson and Members of the Cyber Appellate Tribunal shall be made by the Central Government in consultation with the Chief Justice of India.
(3) Subject to the provisions of this Act-
(a) the jurisdiction, powers and authority of the Cyber Appellate Tribunal may be exercised by the Benches thereof;
(b) a Bench may be constituted by the Chairperson ofthe Cyber Appellate Tribunal with one or two Members of such Tribunal as the Chairperson may deem fit;
(c) the Benches of the Cyber Appellate Tribunal shall sit at New Delhi and at such other places as the Central Government may, in consultation with the Chairperson of the Cyber Appellate Tribunal, by notification in the Oacial Gazette, specify;
8 THE GAZETTE OF INDIA EXTRAORDINARY [PART U- Qualifications for appointment as Chairperson and Members of Cyber Appellate Tribunal.
Term of office, conditions of service, etc., of Chairperson and Members.
Salary, allowances and other terms and conditions of service of Chairperson and Members.
Powers of superintendencc, direction, etc.
(4 the Central Government shall, by notification in the Official Gazette, specify the areas in relation to which each Bench of the Cyber Appellate Tribunal may exercise its jurisdiction.
(4) Notwithstanding anything contained in sub-section (3), the Chairperson of the Cyber AppellateTribunal may transfer a Member of such Tribunal from one Bench to another Bench.
(5) If at any stage ofthe hearing of any case or matter it appears to the Chairperson or a Member of the Cyber Appellate Tribunal that the case or matter is of such a nature that it ought to be heard by a Bench consisting of more Members, the case or matter may be transferred by the Chairperson to such Bench as the Chairperson may deem fit.
50. (1) A person shall not be qualified for appointment as a Chairperson of the Cyber Appellate Tribunal unless he is, or has been, or is qualified to be, a Judge of a High Court. I
(2) The Members ofthe Cyber Appellate Tribunal, except the Judicial Member to be appointed under sub-section (3), shall be appointed by the Central Government from amongst persons, having special knowledge of, and professional experience in, information technology, telecommunication, industry, management or consumer affairs:
Provided that a person shall not be appointed as a Member, unless he is, or has been, in the service of the Central Government or a State Government, and has held the post of Additional Secretary to the Government of India or any equivalent post in the Central Government or State Government for a period of not less than one year or Joint Secretary to the Government of India or any equivalent post in the Central Government or State Government for a period of not less than seven years.
(3) The Judicial Members of the Cyber Appellate Tribunal shall be appointed by the Central Government from amongst persons who is or has been a member of the Indian Legal Service and has held the post ofAdditional Secretary for a period of not less than one year or Grade I post ofthat Service for a period of not less than five years.
5 1. (1) The Chairperson or Member of the Cyber Appellate Tribunal shall hold office for a term of five years from the date on which he enters upon his office or until he attains the age of sixty-five years, whichever is earlier.
(2) Before appointing any person as the Chairperson or Member of the Cyber Appellate Tribunal, the Central Government shall satisfy itself that the person does not have any such financial or other interest as is likely to affect prejudicially his functions as such Chairperson oi- Member.
(3) An officer of the Central Government or State Government on his selection as the Chairperson or Member ofthe Cyber Appellate Tribu.lal, as the case may be, shall have to retire from service before joining as such Chairperson or Member.
52. The salary and allowances payable to, and the other terms and conditions of service including pension, gratuity and other retirement benefits of, the Chairperson or a Member of the Cyber Appellate Tribunal shall be such as may be prescribed.
52A. The Chairperson of the Cyber Appellate Tribunal shall have powers of general superintendence and directions in the conduct of the affairs of that Tribunal and he shall, in addition to presiding over the meetings of the Tribunal, exercise and discharge such powers and functions of the Tribunal as inay be prescribed.
SEC. 11 THE GAZETTE OF INDIA EXTRAORDINARY 9
52B. Where Benches are constituted, the Chairperson of the Cyber Appellate Distribution Tribunal may, by order, distribute the business of that Tribunal amongst the Benches of b"siness and also the matters to be dealt with by each Bench. among Benches.
52C. On the application of any of the parties and after notice to the parties, and Power of after hearing such of them as he may deem proper to be heard, or suo motu without Chairperson such notice, the Chairperson of the Cyber Appellate Tribunal may transfer any case to transfer cases.
pending before one Bench, for disposal to any other Bench.
52D. If the Members of a Bench consisting of two Members differ in opinion on Decision by any point, they shall state the point or points on which they differ, and make a reference majority.
to the Chairperson of the Cyber Appellate Tribunal who shall hear the point or points himself and such point or points shall be decided according to the opinion of the majority ofthe Members who have heard the case, including those who first heard it.".
27. In section 53 of the principal Act, for the words "Presiding Officer", the words Amendment "Chairperson or Member, as the case may be," shall be substituted. of section 5 3 .
28. In section 54 ofthe principal Act, for the words "Presiding Officer" wherever they Amendment occur, the words "Chairperson or the Member" shall be substituted. of scctlon 54.
29. In section 55 of the principal Act, for the words "Presiding Officer", the words Amendment "Chairperson or the Member" shall be substituted. of section 55.
30. In section 56 of the principal Act, for the words "Presiding Officer", the word Amendment "Chairperson" shall be substituted. of section 56.
31. In section 64 ofthe principalAct,- Amendment of section 64.
(i) for the words "penalty imposed", the words "penalty imposed or compensation awarded" shall be substituted;
(ii) in the marginal heading, for the word "penalty", the words "penalty or compensation" shall be substituted.
32. For sections 66 and 67 of the principal Act, the following sections shall be Substitution of substituted, namely:- new sect iol~s for sectiol~s 66 and 67.
'66. If any person, dishonestly or fraudulently, loes any act referred to in section 43, Computer he shall be punishable with imprisonment for a term which may extend to three years or with related fine which may extend to five lakh rupees or with both. offences.
Explanation.-For the purposes of this section,-
(a) the word "dishonestly" shall have the meaning assigned to it in section 24 of the Indian Penal Code;
(b) the word "fraudulently" shall have the meaning assigned to it in section 25 ofthe Indian Penal Code.
66A. Any person who sends, by .means of a computer resource or a Punishment communication device,- for sending offensive
(a) any information that is grossly offensive or has menacing character; or messages through
(b) any information which he knows to be false, but for the purpose of communication causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal service, etc.
intimidation, enmity, hatred or ill will, persistently by making use of such computer resource or a communication device; or
(c) any electronic mail or electronic mail message for the purpose of causing annoyance or inconvenience or to deceive or to mislead the addressee or recipient about the origin of such messages, 10 THE GAZETTE OF INDIA EXTRAORDINARY [PART II- Punishment for dishonestly receiving stolen computer resource or communication device.
shall be punishable with imprisonment for a term which may extend to three years and with fine.
Explanation.-- For the purposes of this section, terms "electronic mail" and "electronic mail message" means a message or information created or transmitted or received on a computer, computer system, computer resource or communication device including attachments in text, image, audio, video and any other electronic record, which may be transmitted with the message.
66B. Whoever dishonestly receives or retains any stolen computer resource or communication device knowing or having reason to believe the same to be stolen computer resource or communication device, shall be punished with imprisonment of either description for a term which may extend to three years or with fine which may extend to rupees one lakh or with both.
Punishment 66C. Whoever, fraudulently or dishonestly make use of the electronic signature, for identity password or any other unique identification feature of any other person, shall be punished theft. with imprisonment of either description for a term which may extend to three years and shall . also be liable to fine which may extend to rupees one lakh.
Punishment for cheating by personation
66D. Whoever, by means of any communication device or computer resource cheats by personation, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to one lakh rupees.
by using computer resource.
Punishment for 66E. Whoever, intentionally or knowingly captures, publishes or transmits the image of of a private area of any person without his or her consent, under circumstances violating the privacy. privacy of that person, shall be punished with imprisonment which may extend to three years or with fine not exceeding two lakh rupees, or with both.
Explanation.- For the purposes of this section-
(a) "transmit" means to electronically send a visual image with the intent that it be viewed by a person or persons;
(b) "capture", with respect to an image, means to videotape, photograph, film or record by any means;
(c) "private area" means the naked or undergarment clad genitals, public area, buttocks or female breast;
(6) "publishes" means reproduction in the printed or electronic form and making it available for public;
( e ) "under circumstances violating privacy" means circumstances in which a person can have a reasonable expectation that- ( i ) he or she could disrobe in privacy, without being concerned that an image of his private area was being captured; or
(ii) any part of his or her private area would not be visible to the public, regardless of whether that person is in a public or private place.
Punishment 66F. (1) Whoever,- for cyber terrorism. (A) with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people or any section of the people by- (9 denying or cause the denial of access to any person authorised to access computer resource; or SEC. 11 THE GAZETTE OF INDIA EXTRAORDINARY 11 ( i i ) attempting to penetrate or access a computer resource without authorisation or exceeding authorised access; or (i i i) introducing or causing to introduce any computer contaminant, and by means of such conduct causes or is likely to cause death or injuries to persons or damage to or destruction of property or disrupts or knowing that it is likely to cause damage or disruption of supplies or services essential to the life of the community or adversely affect the critical information infrastructure specified under section 70; or (B) knowingly or intentionally penetrates or accesses a computer resource without authorisation or exceeding authorised access, and by means of such conduct obtains access to information, data or computer database that is restricted for reasons of the security of the State or foreign relations; or any restricted information, data or computer database, with reasons to believe that such information, data or computer database so obtained may be used to cause or likely to cause injury to the interests of the sovereignty and integrity of India, the security of the State, fiiendlyrelations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence, or to the advantage of any foreign nation, group of individuals or otherwise, commits the offence of cyber terrorism.
(2) Whoever commits or conspires to commit cyber terrorism shall be punishable with imprisonment which may extend to imprisonment for life.
67. Whoever publishes or transmits or causes to be published or transmitted in Punishment the electronic form, any material which is lascivious or appeals to the prurient interest for publishing or if its effect is such as to tend to deprave and corrupt persons who are likely, having :r:nsmitting regard to all relevant circumstances, to read, see or hear the matter coiltained or embodied Gbscene in it, shall be punished on first conviction with imprisonment of either description for material in a term which may extend to three years and with fine which may extend to five lakh electronic rupees and in the event of second or subsequent conviction with imprisonment of form.
either description for a term which may extend to five years and also with fine which may extend to ten lakh rupees.
67A. Whoever publishes or transmits or causes to be published or transmitted Punisluneat for in the electronic form any material which contains sexually explicit act or conduct shall publishing or be punished on first conviction with imprisonment of either description for a term ~ , " r ~ ~ ~ i n g Of which may extend to five years and with fine which may extend to ten lakh rupees and containing in the event of second or subsequent conviction with imprisonment of either description sexually for a term which may extend to seven years and also with fine which may extend to ten explicit act, lakh rupees. etc., In electronic form.
67B. Whoever.- Punishment for publishing
(a) publishes or transmits or causes to be published or transmitted material in or transmitting any electronic form which depicts children engaged in sexually explicit act or conduct; of material or depicting childern in
(b) creates text or digital images, collects, seeks, browses, downloads, advertises, sexually promotes, exchanges or distributes material in any electronic form depicting children act, etc., m in obscene or indecent or sexually explicit manner; or electronic
(c) cultivates, entices or induces children to online relationship with one or more form.
children for and on sexually explicit act or in a manner that may offend a reasonable adult on the computer resource; or (4 facilitates abusing children online; or
(e) records in any electronic form own abuse or that of others pertaining to sexually explicit act with children, 12 THE GAZETTE OF INDIA EXTRAORDINARY [PART II- shaIl be punished on first conviction with imprisonment of either description for a term which may extend to five years and with fine which may extend to ten lakh rupees and in the event of second or subsequent conviction with imprisonment of either discription for a term which may extend to seven years and also with fine which may extend to ten lakh rupees:
Provided that provisions of section 67, section 67A and this section does not extend to any book, pamphlet, paper, writing, drawing, painting representation or figure in electronic form-
(i) the publication of which is proved to be justified as being for the public good on the ground that such book, pamphlet, paper, writing, drawing, painting representation or figure is in the interest of science, literature, art or learning or other objects of general concern; or
(ii) which is kept or used for bonafide heritage or religious purposes.
Explanation.- For the purposes of this section, "children" means a person who has not completed the age of 18 years.
Preservation 67C. (I) Intermediary shall preserve and retain such information as may be and retention specified for such duration and in such manner and format as the Central Government of information may prescribe.
by .
intermediaries. (2) Any intermediary who intentionally or knowingly contravenes the provisions of sub-section (1) shall be punished with an imprisonment for a term which may extend to three years and shall also be liable to fine.'.
Amendment of 33. In section 68 of the principal Act, for sub-section (2), the following sub-section section 6 8 . shall be substituted, namely:- "(2) Any person who intentionally or knowingly fails to comply with any order under sub-section (I) shall be guilty of an offence and shall be liable on conviction to imprisonment for a term not exceeding two years or a fine not exceeding one lakh rupees or with both.".
Substitution of 34. For section 69 of the principal Act, the following sections shall be substituted, new sections namely:- for section 69.
Power to issue directions for interception or monitoring or decryption of any information through any computer resource.
'69. (1) Where the Central Government or a State Government or any of its officers specially authorised by the Central Government or the State Government, as the case may be, in this behalf may, if satisfied that it is necessary or expedient so to do, in the interest of the sovereignty or integrity of India, defence of India, security of the State, friendly relations with foreign States or public order or for preventing incitement to the commission of any cognizable offence relating to above or for investigation of any offence, it may subject to the provisions of sub-section (2), for reasons to be recorded in writing, by order, direct any agency of the appropriate Government to intercept, monitor or decrypt or cause to be intercepted or monitored or decrypted any information generated, transmitted, received or stored in any computer resource.
(2) The procedure and safeguards subject to which such interception or monitoring or decryption may be carried out, shall be such as may be prescribed.
(3) The subscriber or intermediary or any person in-charge of the computer resource shall, when called upon by any agency referred to in sub-section (1), extend all facilities and technical assistance to-
(a) provide access to or secure access to the computer resource generating, transmitting, receiving or storing such information; or
(b) intercept, monitor, or decrypt the information, as the case may be; or (4 provide information stored in computer resource.
SIX. 11 THE GAZETTE OF INDIA EXTRAORDINARY 13
(4) The subscriber or intermediary or any person who fails to assist the agency referred to in sub-section (3) shall be punished with imprisonment for a term which may extend to seven years and shall also be liable to fine.
69A. (1) Where the Central Government or any of its officers specially authorised by it in this behalf is satisfied that it is necessary or expedient so to do, in the interest of sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign States or public order or for preventing incitement to the commission of any cognizable offence relating to above, it may subject to the provisions of sub-section (2), for reasons to be recorded in writing, by order, direct any agency of the Government or intermediary to block for access by the public or cause to be blocked for access by the public any information generated, transmitted, received, stored or hosted in any computer resource.
(2) The procedure and safeguards subject to which such blocking for access by the public may be carried out, shall be such as may be prescribed.
(3) The intermediary who fails to comply with the direction issued under sub-section
(1) shall be punished with an imprisonment for a term which may extend to seven years and shall also be liable to fine.
69B. (1) The Central Government may, to enhance cyber security and for identification, analysis and prevention of intrusion or spread of computer contaminant in the country, by notification in the Official Gazette, authorise any agency of the Government to monitor and collect traffic data or information generated, transmitted, received or stored in any computer resource.
(2) The intermediary or any person in-charge or the computer resource shall, when called upon by the agency which has been authorised under sub-section (I), provide technical assistance and extend all facilities to such agency to enable online access or to secure and provide online access to the computer resource generating, transmitting, receiving or storing such traffic data or information.
Power to issue directions for blocking for public access of any information through any computer resource.
Power to authorise to monitor and collect traffic data or information through any computer resource for cyber security.
(3) The procedure and safeguards for monitoring and collecting traffic data or information, shall be such as may be prescribed.
(4) Any intermediary who intentionally or knowingly contravenes the provisions of sub-section (2) shall be punished with an imprisonment for a term which any extend to three years and shall also be liable to fine.
Explanation.-For the purposes of this section,-
(i) "computer con@minant9' shall have the meaning assigned to it in section 43;
(ii) "traffic data" means any data identifying or purporting to identify any person, computer system or computer network or location to or from which the communication is or may be transmitted and includes communications origin, destination, route, time, date, size, duration or type of underlying service and any other information.'.
35. In section 70 of the principal Act,- Amendment of section 70
(a) for sub-section (I) , the following subl$ection shall be substituted, namely:- '(1) The appropriate Government may, by notification in the Official Gazette, declare any computer resource which directly or indirectly affects the facility of Critical Information Infrastructure, to be a protected system.
Explanation.-For the purposes of this section, "Critical Information Infrastructure" means the computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety.';
Insertion of new sections 70A and 70B.
National nodal agency.
Indian Con~puter Emergency Response Team to serve as national agency for incident response.
14 THE GAZETTE OF INDIA EXTRAORDINARY [PART n
(b) after sub-section (3 ) , the following sub-section shall be inserted, namely:- "(4) The Central Government shall prescribe the information security practices and procedures for such protected system.".
36. After section 70 of the principal Act, the following sections shall be inserted, namely:- "70A. ( 1 ) The Central Government may, by notification published in the Oficial Gazette, designate any organisation of the Government as the national nodal agency in respect of Critical Information Infrastructure Protection.
( 2 ) The national nodal agency designated under sub-section ( 1 ) shall be responsible for all measures including Research and Development relating to protection of Critical Information Infrastructure.
( 3 ) The manner of performing functions and duties of the agency referred to in sub-section ( I ) shall be such as may be prescribed.
70B. ( I ) The Central Government shall, by notification in the Official Gazette, appoint an agency of the Government to be called the Indian Computer Emergency Response Team.
( 2 ) The Central Government shall provide the agency referred to in sub-section ( 1 ) with aDirector-General and such other officers and employees as may be prescribed.
( 3 ) The salary and allowances and terms and conditions ofthe Director-General and other officers and employees shall be such as may be prescribed.
(4) The Indian Computer Emergency Response Team shall serve as the national agency for performing the following functions in the area of cyber security,--
(a) collection, analysis and dissemination of information on cyber incidents;
(b) forecast and alerts of cyber security incidents;
(c) emergency measures for handling cyber security incidents;
(d) coordination of cyber incidents response activities;
(e) issue guidelines, advisories, vulnerability notes and whitepapers relating to information security practices, procedures, preventation, response and reporting of cyber incidents;
V) such other functions relating to cyber security as may be prescribed.
( 5 ) The manner of performing functions and duties of the agency referred to in sub-section ( I ) shall be such as may be prescribed.
(6) For carrying out the provisions of sub-section (4 ) , the agency referred to in sub-section ( 1 ) may call for information and give direction to the service providers, intermediarks, data centres, body corporate and any other person.
(7)Any service provider, intermediaries, data centres, body corporate or person who fails to provide the information called for or comply with the direction under subsection (6), shall be punishable with imprisonment for a term which may extend to one year or with fine which may extend to one lakh rupees or with both.
(8) No court shall take cognizance of any offence under this section, except on a complaint made by an officer authorised in this behalf by the agency referred to in sub-section ( I ) ." .
SEC. 11 THE GAZETTE OF INDIA EXTRAORDINARY 15
37. AAer section 72 of the principal Act, the following section shall be inserted, Insertion of namely:- new sectiou
72A.
"72A. Save as otherwise provided in this Act or any other law for the time being Pu~lishment in force, any person including an intermediary who, while providing services under the for of information terms of l a h l contract, has secured access to any material containing personal in breach information about another person, with the intent to cause or knowing that he is likely of lawhl to cause wrongful loss or wrongful gain discloses, without the consent of the person contract.
concerned, or in breach of a l a h l contract, such material to any other person, shall be punished with imprisonment for a term which may extend to three years, or with fine which may extend to five lakh rupees, or with both.".
38. For section 77 of the principal Act, the following sections shall be substituted, substitution of namely:- new sections for section 77.
"77. No compensation awarded, penalty imposed or confiscation made under Compensation, this Act shall prevent the award of compensation or imposition of any other penalty or penalties Or punishment under any other law for the time being in force. confiscation not to interfere with other punishment
77A. A court of competent jurisdiction may compound offences, other than Compounding offences for which the punishment for life or imprisonment for a term exceeding three of offences.
years has been provided, under this Act:
Provided that the court shall not compound such offence where the accused is, by reason of his previous conviction, liable to either enhanced punishment or to a punishment of a different kind:
Provided further that the court shall not compound any offence where such offence affects the socio economic conditions of the country or has been committed against a chiid below the age of 18 years or a woman.
(2) The person accused of an offence under this Act may file an application for compounding in the court in which offence is pending for trial and the provisions of 2 of 1974. sections 265B and 265C of the Code of Criminal Procedure, 1973 shall apply.
77B. Notwithstanding anything contained in the Code of Criminal Procedure, Offences with 2 of 1974. 1973, the offence punishable with imprisonment of three years and above shall be !hree years ~mprisonment cognizable and the offence punishable with imprisonment ofthree years shall be bailable, to be ballable,
39. In section 78 of the principal Act, for the words "Deputy Superintendent of Amendment of Police" the word "Inspector" shall be substituted. section 78.
40. For Chapter XI1 of the principal Act, the following Chapters shall be substituted, Substitution of namely:- new Chapters for Chapter XI.
'CHAPTER XII
79. (1) Notwithstanding anything contained in any law for the time being in force Exemption but subject to the provisions of sub-sections (2) and (3), an intermediary f'om liability Of ~nter~nediarp in shall not be liable for any third party information, data, or communication link made ,,Hain cases, available or hosted by him.
(2) The provisions of sub-section (1) shall apply if-
(a) the function of the intermediary is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored or hosted; or 16 THE GAZETTE OF INDIA EXTRAORDINARY [PART 11-
(b) the intermediary does not-
(i) initiate the transmission,
(ii) select the receiver of the transmission, and
(iii) select or modify the information contained in the transmission;
(c) the intermediary observes due diligence while discharging his duties under this Act and also observes s ~ ~ h other guidelines as the Central Government may prescribe in this behalf.
(3) The provisions of sub-section (1) shall not apply if-
(a) the intermediary has conspired or abetted or aided or induced, whether by threats or promise or otherwise in the commission of the unlawfbl act;
(b) upon receiving actual knowledge, or on being notified by the appropriate Government or its agency that any information, data or communication link residing in or connected to a computer resource controlled by the intermediary is being used to commit the unlawfbl act, the intermediary fails to expeditiously remove or disable access to that material on that resource without vitiating the evidence in any manner.
Explanation.-For the purposes of this section, the expression "third party information" means any information dealt with by an intermediary in his capacity as an intermediary,
CHAPTER XIIA EXAMINER OF ELECTRONIC EVIDENCE Central B A . The Central Government may, for the purposes of providing expert opinion Government on electronic form evidence before any court or other authority specify, by notification to notify Examiner of in the Official Gazette, any Department, body or agency of the Central Government or Electronic a State Government q an Examiner of Electronic Evidence.
Evidence. Explanation.-For the purposes of this section, "electronic form evidence" means any information of probative value that is either stored or transmitted in electronic form and includes computer evidence, digital audio, digital video, cell phones, digital fax machines.'.
Amendment of section 80.
Amendment of section 81.
Amendment of section 82.
Amendment of section 84.
Insertion of new sections 84A, 84B and
84C.
41. In section 80 of the principal Act, in sub-section (I), for the words "Deputy Superintendent of Police", the word "Inspector" shall be substituted.
42. In section 8 1 of the principal Act, the following proviso shall be inserted at the end, namely:- "Provided that nothing contained in this Act shall restrict any person from exercising any right conferred under the CopyrightAct, 1957 or the PatentsAct, 1970.". 14 of 1957.
39 of 1970.
43. In section 82 of the principal Act,-
(a) for the marginal heading, the following marginal heading shall be substituted, namely:- "Chairperson, Members, officers and employees to be public servants.";
(b) for the words "Presiding Officer", the words "Chairperson, Members" shall be substituted.
44. In section 84 of the principal Act, for the words "Presiding Officer", the words "Chairperson, Members" shall be substituted.
45. After section 84 of the principal Act, the following sections shall be inserted, namely:-