The statute that governs online speech, interception and platform liability in India is routinely called the Information Technology Act, 2000, but most of the provisions that make it controversial are not the work of 2000 at all. They were inserted by a single amending statute, the IT Amendment Act 2008, which rewrote the parent Act so extensively that the modern statute is best understood as a 2008 text carrying a 2000 title. The blocking power, the widened interception power, the conditional immunity of intermediaries, the first corporate data protection obligation in Indian law and nearly the whole of the offences chapter arrived together, in one instrument, passed by Parliament in the last days of December 2008 with almost no debate. This article walks that amendment trail provision by provision: what the parent Act said before, what the amendment put in its place, and what of it survives.

The field within which this amendment sits is mapped in the complete guide to technology law in India, and the parent statute is treated as a whole in its own pillar article. The focus here is narrower and, for anyone trying to understand where the operative law came from, more useful: the delta between the Act India enacted in 2000 and the Act India has actually lived under since October 2009 is almost entirely the work of one amending Act, and the circumstances of that Act’s passage explain features of the text that no reading of the parent statute can account for. The amendment’s most famous product, Section 66A, is set out in its own words below, because the case against it was always its wording, and paraphrase is how its breadth is usually understated.

A commerce statute with a thin criminal chapter: the IT Act as enacted in 2000

The Information Technology Act, 2000 was built on the UNCITRAL Model Law on Electronic Commerce, and its centre of gravity was facilitative. Its business was to give legal recognition to electronic records and electronic signatures, to validate contracts formed through electronic means, to enable electronic governance, and to set up the Controller of Certifying Authorities and the certifying authorities who would license the digital signature regime. The full architecture of that statute, its chapters and its machinery, is set out in the pillar treatment of the Information Technology Act 2000, and only the parts the 2008 amendment touched need stating here.

The facilitative core deserves a fuller statement, because the amendment’s meaning depends on what kind of statute it was amending. Sections 4 and 5 gave legal recognition to electronic records and electronic signatures, providing that where any law requires information in writing or a signature, the requirement is satisfied by an electronic record or an electronic signature rendered in the prescribed manner. Sections 6 to 8 enabled the use of electronic records and signatures in government and its agencies, and for the electronic filing of forms, licences and payments. Sections 10 to 13 supplied the private law plumbing the Model Law tradition requires: the Central Government’s power to make rules for electronic signatures, the attribution of an electronic record to its originator, and the rules for acknowledgement of receipt and for the time and place of despatch and receipt of an electronic record. Around this core stood the signature infrastructure, the Controller of Certifying Authorities at its head, licensed certifying authorities issuing digital signature certificates, and the duties of subscribers who held them. This was a statute whose typical actor was a contracting party, a filing citizen or a certifying authority, and whose typical problem was validity: whether the record counted, whether the signature bound, whether the filing was in time. The criminal provisions sat at the margin of that design, and the State’s coercive presence was represented chiefly by the Controller, a regulator of signatures who doubled, incongruously, as the authority for interception directions. The amendment of 2008 did not discard this core, which continues to do the quiet work of Indian electronic commerce. It built around and above it a second statute with different typical actors, the poster, the platform, the investigating officer and the data holding company, and different typical problems, not validity but liability, immunity, surveillance and speech. The two statutes share one binding and one table of sections, and the friction between their logics, facilitative below and coercive above, is the permanent condition of the amended text.

The criminal law content of the 2000 Act was strikingly thin. Its offences chapter contained, in substance, three provisions. Section 65 punished tampering with computer source documents. Section 66 punished hacking, defined as destroying, deleting or altering information residing in a computer resource, or diminishing its value or utility, with intent or knowledge of wrongful loss or damage. Section 67 punished publishing or transmitting obscene material in electronic form, on a first conviction with imprisonment that could extend to five years and a fine that could extend to one lakh rupees. Alongside these sat Section 43, a civil provision making a person who accessed a computer system without permission, downloaded or copied data, introduced a computer contaminant or virus, damaged a system, disrupted it, or denied access to an authorised user liable to pay damages by way of compensation, capped at one crore rupees, to the person affected. That was close to the whole of it. There was no offence of identity theft, no offence of cheating by personation through a computer, no offence directed at images of a private area taken or transmitted without consent, no offence of cyber terrorism, no provision addressed to material depicting children in sexually explicit acts, and no offence at all addressed to the content of a message sent through a communication service.

The State’s powers under the 2000 Act were equally narrow, and they ran through a single office. Section 69, as enacted, empowered the Controller of Certifying Authorities, if satisfied that it was necessary or expedient in the interest of the sovereignty or integrity of India, the security of the State, friendly relations with foreign States or public order, or for preventing incitement to the commission of any cognizable offence, to direct a government agency to intercept any information transmitted through a computer resource. The subscriber or person in charge of the resource was bound to extend all facilities and technical assistance to decrypt the information, and failure to assist was punishable with imprisonment that could extend to seven years. There was no power anywhere in the statute to direct that public access to information be blocked, no power to authorise the monitoring or collection of traffic data, and no statutory charter for any incident response body. The emergency response team that the government set up in January 2004, the Indian Computer Emergency Response Team, worked as an executive creation without a section of the Act behind it.

Intermediaries, finally, were barely in the statute at all. The 2000 Act spoke not of intermediaries but of network service providers, and Section 79 as enacted exempted a network service provider from liability under the Act, its rules or its regulations for an offence or contravention if it proved that the offence was committed without its knowledge or that it had exercised all due diligence to prevent the offence. The exemption was narrow in three ways that mattered later: it covered only the category of network service provider, it answered only for liability under the parent Act itself, and it turned on proof by the provider. When the managing director of an early Indian online marketplace was arrested in 2004 after a user offered an obscene video clip for sale through the platform, in the episode known by the name of its founder, Avnish Bajaj, the gap between the commerce the statute imagined and the platform economy that had actually arrived was exposed in a single prosecution. The 2008 amendment’s rewrite of Section 79 was, in large part, the legislative answer to that exposure.

Two further features of the 2000 text matter for the trail, because the amendment worked on both. The first is the adjudication machinery. Claims under Section 43 were not ordinary civil suits: the parent Act created adjudicating officers, appointed by the Central Government from officers not below the rank of Director to the Government of India or an equivalent officer of a State Government, to hold inquiries and award the compensation the section provided, with appeals lying to the Cyber Regulations Appellate Tribunal the Act established. The one crore rupee ceiling in Section 43 therefore did double duty. It capped the compensation an affected person could recover for the listed acts, and it kept the whole of that compensation jurisdiction inside the specialist machinery the Act had built. When the amendment later removed the ceiling and set the adjudicating officer’s remit at five crore rupees, it was not merely raising a number; it was deciding that the largest data and system damage claims belonged in the ordinary courts, and the amendment to the bar on civil court jurisdiction in Section 61 was made for exactly that accommodation.

The second is Section 72, the parent Act’s only confidentiality offence. As enacted, it punished a person who, in pursuance of powers conferred under the Act, secured access to an electronic record, book, register, correspondence, information, document or other material and disclosed it to another person without the consent of the person concerned, with imprisonment that could extend to two years, or a fine that could extend to one lakh rupees, or both. Its reach was confined to officials and others exercising statutory powers: the Registrar’s and Controller’s world, not the commercial world. The significance of Section 72 for the trail is that the 2008 amendment left it standing and built beside it. Section 72A, inserted in 2008, addressed the different and larger case of the service provider and the outsourcing vendor, the person who holds personal information because a contract put it in his hands rather than because a statute did. Reading the two sections together shows the amendment’s method at its most careful: the old provision was not defective, merely addressed to a smaller world, and the new provision extended its principle to the economy that had grown up outside the old one’s field.

Why a nine-year-old statute was reopened

The pressure to amend came from the distance between the Act’s 2000 assumptions and the internet India had by the middle of the decade. The statute addressed a world of electronic records and digital signatures. It had little to say to a world of mass email, social platforms in their first growth, phishing at industrial scale, and data held by outsourcing companies on behalf of clients on other continents. Investigators, as the government’s own review exercise recorded, were relying principally on the Indian Penal Code for computer related wrongdoing because the parent Act’s offences did not cover the conduct in front of them. The amendment Bill was therefore framed as a general overhaul rather than a repair, and its statement of objects ranged across data protection, cyber security, new forms of crime from sending offensive messages to child pornography and cyber terrorism, and the need to make the signature regime technology neutral in line with the UNCITRAL Model Law on Electronic Signatures.

Why did the IT Act of 2000 need amending within a decade?

The parent Act was written to give legal recognition to electronic commerce, and its offences chapter covered only tampering with source code, hacking and obscenity. By the middle of the decade, identity theft, phishing, voyeurism, child sexual abuse material and handling of personal data by companies sat outside the statute, and investigators were falling back on the Penal Code.

The Bill that carried the overhaul was introduced in the Lok Sabha on 15 December 2006 as the Information Technology (Amendment) Bill, 2006. It was referred to the department related Parliamentary Standing Committee on Information Technology, chaired by Nikhil Kumar, which reported on the Bill in 2007. The Committee’s report was unanimous and wide ranging, and it suggested many changes to the proposed text; on the proposed Section 66A, as the Indian Express recorded in its reconstruction of the provision’s history after the Supreme Court’s judgment, the Committee expressed no concern about possible misuse. One part of the provision arrived even later than the Committee stage. As Pranesh Prakash of the Centre for Internet and Society documented from the amendment papers, the Bill as introduced contained limbs (a) and (b) of Section 66A, and limb (c), the electronic mail limb, was inserted through an official amendment moved by the Minister, A. Raja, on 16 December 2008, days before passage, in response to the Standing Committee’s observation that the Bill contained no provision addressed to spam. That origin matters to everything that follows, because an anti-spam limb drafted in a week, in the last days of a session, was written into a speech offence and read by police forces across the country as one.

The Bill then waited. It had been introduced in December 2006 and reported on in 2007, and through most of 2008 it did not move to passage. What moved it was not a legislative timetable but an atrocity, and the passage record is the subject of the next section. The trail point is worth marking here, because it is the pattern this series has traced in the criminal law and anti-terror clusters as well: the text of the amendment was substantially settled in calmer conditions in 2006 and 2007, but the conditions of its enactment, which determined how much scrutiny its most sensitive clauses received, were set by a crisis two years later. A Bill can be deliberated and still be enacted without deliberation, and this one was.

The committee stage deserves one further paragraph, because it complicates any simple account in which an unexamined Bill was smuggled through. The Standing Committee took evidence, and its record shows the Central Bureau of Investigation pressing before it the case for provision against new forms of computer misuse, child pornography among them; the Indian Express’s reconstruction records that the suggestion came from the Bureau’s presentation and was taken up in the Committee’s deliberations, and the child protection offence that became Section 67B is the point at which that pressure entered the enacted text. The Committee’s membership was not partisan window dressing: it included members who would later hold the information technology portfolio in a government of the other party, among them Ravi Shankar Prasad, and its report was unanimous. The scrutiny failure the trail exposes is therefore specific rather than general. A committee of legislators, assisted by the investigating agency’s evidence, worked the Bill over and improved parts of it, and still the provision that would define the amendment in public memory passed through that process without a recorded word about the breadth of its operative terms or the uses to which a district police force might put the word annoyance. Committee scrutiny examines what a Bill’s sponsors and witnesses put in issue. Nobody put Section 66A in issue, in committee any more than on the floor, and the provision’s drafting antecedent in a foreign telephone statute was not drawn to the Committee’s attention by any witness whose evidence survives in the report’s discussion. The lesson the trail carries for the series’ other crisis statutes is precise: deliberation is not a property a Bill has, clause by clause, merely because a committee sat; it is a property of the questions that were asked, and on this clause they were not asked at all.

December 2008: passage in the shadow of the Mumbai attacks

The attacks in Mumbai began on 26 November 2008 and ended on 29 November 2008. The winter session of Parliament that followed was the first full session after the attacks, and the government’s legislative response to them was assembled at speed: a new investigative agency statute and amendments to the anti-terror law were prepared and passed in the same sitting days, a sequence traced in the lineage of India’s anti-terror laws. The Information Technology (Amendment) Bill, which had been pending for two years, was taken up inside that same compressed and disrupted session.

The record of its passage, as reconstructed by the Indian Express and by legislative trackers, is short enough to state completely. The Lok Sabha was in uproar on 22 December 2008 over remarks by the Minister for Minority Affairs, A. R. Antulay, questioning the circumstances in which the Maharashtra Anti-Terrorism Squad chief Hemant Karkare had been killed in the attacks. In that sitting, with members shouting slogans in the well of the House, A. Raja moved the Bill for consideration, the Deputy Speaker announced that it would be taken up clause by clause, and the Bill was passed, along with three other Bills, in under half an hour. The Rajya Sabha passed it the next day, 23 December 2008, without a discussion. No member debated Section 66A in either House. The provision whose words would generate a decade of arrests was therefore never the subject of a single speech in the legislature that enacted it.

The Bill received the assent of the President on 5 February 2009 and became the Information Technology (Amendment) Act, 2008, Act 10 of 2009; the numbering records the common Indian pattern by which an Act named for the year of its passage carries the serial number of the year of its assent. Its commencement was left to notification, and the Central Government brought it into force on 27 October 2009, the same day on which the principal rules made under the new powers, on interception and on blocking, were also notified. Between assent and commencement, the amendment existed as enacted law that did not yet operate; from 27 October 2009, the statute that India had was, in every part that mattered for speech, surveillance and platforms, the text of December 2008. The interval itself has a small history worth recording. A general election intervened in April and May 2009, and the government that brought the amendment into force in October was the government returned at that election, with A. Raja, the minister who had moved the Bill through the disrupted sitting of the previous December, still holding the communications and information technology portfolio. Commencement was therefore not the act of a successor administration inheriting a predecessor’s text, with the hesitations that can attend that position; it was the same political hands completing their own work, on a timetable set by the preparation of the rules rather than by any reconsideration of the Act. No second look at Section 66A was taken in those eight months, although the interval between assent and commencement is precisely the space in which a legislature or an executive can catch what a hurried passage missed, and nothing in the record suggests the space was used for that purpose. The provision commenced with the rest, unexamined at every stage of its existence: unexamined in committee in its final limb, undebated on either floor, and unreviewed in the eight months its commencement waited.

Two things should be said about this record before the provisions are examined, because the stance of this series is to state contested matters at full strength on each side. The first is that speed after an atrocity is not, without more, a defect in a legislature; the same session enacted the National Investigation Agency Act, and some of what the amendment contained, the child protection offences and the data obligation among them, answered gaps that had been documented for years by the Standing Committee process itself. The second is that the absence of debate fell unevenly across the Bill. The parts that had been through the Standing Committee, which was most of them, had received a form of scrutiny outside the chamber. The parts that had not, and the official amendment of 16 December 2008 inserting the electronic mail limb of Section 66A is the documented instance, received none at all: not in committee, because it postdated the report, and not on the floor, because the floor did not discuss the Bill. The criticism of the amendment’s passage is therefore most precise when it is aimed not at the session’s speed in general but at the combination the record shows, a two-year-old Bill, a late official amendment, and a chamber that passed the whole in the noise of an unrelated uproar.

The shape of the IT Amendment Act 2008

The amending Act is organised in parts. Part II contains the amendments to the Information Technology Act, 2000. The parts that follow it carry the consequential amendments to the Indian Penal Code, the Indian Evidence Act, the Bankers’ Books Evidence Act and the Reserve Bank of India Act, aligning the older statutes’ treatment of electronic records with the parent Act’s scheme. Within Part II, the changes fall into distinct operations that are worth separating, because later commentary often treats the amendment as though it only inserted offences. It substituted the words electronic signature for digital signature throughout the signature chapters, making the Act technology neutral so that techniques beyond the original public key model could be recognised. It inserted Section 3A, under which electronic signature techniques set out in the Second Schedule could be prescribed, and it rewired the definitions on which the rest of the statute runs.

The definitional changes were load bearing. Section 2 acquired a definition of communication device, covering cell phones, personal digital assistants and any other device used to communicate, send or transmit text, video, audio or image; a definition of cyber café; a definition of cyber security, drawn around protecting information, equipment, devices and computer resources from unauthorised access, use, disclosure, disruption, modification or destruction; and a substituted definition of intermediary, which replaced the narrower network service provider with a functional description reaching any person who on behalf of another receives, stores or transmits an electronic record or provides a service in respect of it, expressly including telecom service providers, network service providers, internet service providers, web hosting providers, search engines, online payment sites, online auction sites, online market places and cyber cafés. Nearly every later dispute about platform liability begins inside that definition, and it was written in 2008.

The consequential parts of the amending Act deserve a paragraph of their own, because they show the amendment working as a piece of legal engineering rather than as a political gesture. A technology statute does not operate alone: the conduct it criminalises must meet the general criminal law, the proof of its electronic records must pass through the evidence code, and the financial transactions it enables run through the banking statutes. The 2000 Act had performed the necessary alignment of the Indian Penal Code, the Indian Evidence Act, the Bankers’ Books Evidence Act and the Reserve Bank of India Act through its own amendment sections and schedules, and by 2008 that alignment needed renewal in step with the parent Act’s new vocabulary, electronic signature in place of digital signature, and its new institutions. The amending Act therefore took the consequential amendments into its own later parts, amending among other things the Reserve Bank’s rule making power to carry an express head for the regulation of electronic fund transfers between banks and financial institutions, and the Evidence Act’s arrangements touching electronic form evidence, the field in which its own new Examiner of Electronic Evidence would operate. The omission of the parent Act’s spent amendment sections, recorded above, is the mirror image of the same operation. A statute amended as thoroughly as this one was in 2008 has to be re-sewn into the body of the law at every seam, and the seams are where later litigants look first for inconsistency; that the consequential work was done inside the one instrument, rather than left to accumulate as discrepancy, is part of why the 2008 text has proved so durable as a working whole.

What did the 2008 amendment do to electronic signatures?

It made the signature regime technology neutral. The words digital signature, which described one public key technique, were replaced throughout by electronic signature, and a new Section 3A allowed the Central Government to prescribe electronic signature techniques, including techniques listed in the Second Schedule, so recognition no longer depended on a single technology.

The amendment also filled out the electronic governance skeleton of the parent Act. It inserted Section 6A on delivery of services by service providers, Section 7A on the audit of documents maintained in electronic form, and Section 10A, which provides that a contract formed through electronic means is not unenforceable solely because electronic form was used in its formation. It recast Section 43, the civil compensation provision, widening the catalogue of unauthorised acts and removing the ceiling of one crore rupees that the 2000 text had placed on damages, and it set the adjudicating officer’s pecuniary remit at claims up to five crore rupees, with larger claims going to the competent court. It omitted Sections 91 to 94 of the parent Act, the provisions through which the 2000 Act had itself amended the older codes, which were spent once their work was done. And it rewrote Section 66, to which the next section turns, replacing the freestanding offence of hacking with a provision that criminalises the acts catalogued in Section 43 when they are done dishonestly or fraudulently. A reader comparing the parent Act as enacted with the Act as it stands amended is handling two materially different statutes, and keeping the two texts open side by side, for instance in an office file viewer that opens Word, Excel and PowerPoint documents in the browser, is the quickest way to see how much of the difference is the work of this one instrument.

One further feature of the trail belongs to this point in the narrative, the amendment’s two waves of commencement. The amending Act’s own first section allowed different dates to be appointed for different provisions, a standard device that in the event was used sparingly: the Act was brought into force on a single appointed day, 27 October 2009, and the rules for the three State powers, on interception, on blocking and on monitoring and collecting traffic data, were notified with it, so that the surveillance and blocking settlement began operating as a complete scheme on one morning. The obligations that ran against private parties took longer to acquire their content. The intermediary guidelines and the sensitive personal data rules, which gave Sections 79 and 43A their operational meaning, arrived only in April 2011, eighteen months after the sections themselves commenced, and the emergency response team’s operating rules followed in 2013. For the interval, the statute book contained an immunity whose due diligence condition had no prescribed content and a data obligation whose key terms had no definitions, and practitioners advised within that gap on the strength of the sections’ words alone. The pattern is worth recording because it recurs across this series: commencement by a single notification gives an amendment a clean birthday, but the law in action commences in instalments, on the dates of the rules that make its open textured provisions administrable, and the trail that stops at the appointed day understates the distance between the Act as enacted and the Act as lived under.

The new content offences

Section 66 as substituted took the acts listed in Section 43, which include unauthorised access, downloading or copying data, introducing a computer contaminant or virus, damaging a system or data, disrupting a system, denying access to an authorised person, facilitating unauthorised access, charging services to another person’s account, and destroying, deleting or altering information or diminishing its value, and made them criminal when done dishonestly or fraudulently, punishable with imprisonment that may extend to three years, or a fine that may extend to five lakh rupees, or both. The old offence of hacking, which had required proof of intent or knowledge of wrongful loss or damage tied to a narrow definition, disappeared into this broader construction. Around the rewritten Section 66 the amendment built a row of specific offences, Sections 66A to 66F, each addressed to a form of conduct the parent Act had not named.

Section 66B punishes dishonestly receiving or retaining a stolen computer resource or communication device, with imprisonment that may extend to three years, or a fine that may extend to one lakh rupees, or both. Section 66C punishes identity theft, the fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature, with imprisonment that may extend to three years and a fine that may extend to one lakh rupees. Section 66D punishes cheating by personation by means of a computer resource or communication device, the statutory home of phishing in its classic form, on the same scale. Section 66E punishes the violation of privacy constituted by intentionally or knowingly capturing, publishing or transmitting the image of a private area of a person without consent, under circumstances violating that person’s privacy, with imprisonment that may extend to three years, or a fine not exceeding two lakh rupees, or both. Section 66F, the cyber terrorism provision, stands on a different scale altogether: it reaches acts done with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror, including unauthorised access to restricted data and the introduction of contaminants likely to cause death, injury or damage to property or to disruption of supplies and services essential to the life of the community, and it is punishable with imprisonment which may extend to imprisonment for life.

The two track design of Sections 43 and 66 is the analytical key to the group, and it was the amendment’s own construction. The acts are the same acts in both sections: the unauthorised access, the copying, the contamination, the damage, the disruption, the denial of access, the facilitation, the charging of services to another’s account and the destruction or alteration of information that Section 43 lists. Section 43 treats them as civil wrongs sounding in compensation, and it does so without any requirement of dishonest intent, because a person whose system has been damaged should not have to prove the intruder’s state of mind to be made whole. Section 66 treats the same acts as crimes, and it gates the criminal track on the mental element the civil track omits: the act must be done dishonestly or fraudulently, in the senses those words carry in the Penal Code. The specific offences in Sections 66B to 66F then lift out of that general field the forms of conduct that Parliament wanted named and graded separately, and their drafting shows a legislature working, for once, with a taxonomy. Receiving a stolen resource is the fence’s offence, set beside the thief’s. Identity theft isolates the misuse of the credentials themselves, the signature, the password, the unique identification feature, whether or not a completed cheating follows. Cheating by personation keeps the deception offence tied to its medium. Violation of privacy is drafted around three elements that must coincide, the image of a private area of a person, the absence of that person’s consent, and circumstances violating the privacy of the person, a definition that confines it to the voyeuristic and the non consensual rather than to publication at large. Cyber terrorism stands apart in both intent and scale, the amendment’s one offence of life imprisonment, placed in the technology statute in the same legislative season that produced the post Mumbai amendments to the anti-terror law. Whatever is said about Section 66A, the sections around it were not carelessly graded, and their survival without serious constitutional challenge is part of the evidence.

The obscenity provisions were rebuilt at the same time. Section 67 was recalibrated: on a first conviction, the maximum imprisonment fell from five years to three and the maximum fine rose from one lakh rupees to five lakh rupees, with a second or subsequent conviction carrying up to five years and ten lakh rupees. Two new offences were graded above it. Section 67A punishes publishing or transmitting material containing a sexually explicit act or conduct, on a first conviction with up to five years and a fine of up to ten lakh rupees, and on a subsequent conviction with up to seven years and the same fine. Section 67B, the child protection provision, punishes publishing or transmitting material depicting children in a sexually explicit act, and goes further into the conduct around such material: creating text or digital images, collecting, seeking, browsing, downloading, advertising, promoting, exchanging or distributing material depicting children in an obscene, indecent or sexually explicit manner, cultivating or enticing children into an online relationship for a sexually explicit act, facilitating the abuse of children online, and recording abuse in electronic form, all on the same five and seven year scale, subject to the exception the three sections share for material justified in the interest of science, literature, art or learning or kept for bona fide heritage or religious purposes. Section 67B repays a closer look at its own drafting, because it shows the amendment legislating ahead of the conduct’s technology in a way Section 66A conspicuously did not. Its verbs run beyond publication and transmission to creating text or digital images, collecting, seeking, browsing, downloading, advertising, promoting, exchanging and distributing, and beyond the material itself to cultivating or enticing children into online relationships and facilitating abuse. A provision that punishes seeking and browsing is criminalising the consumption side of the market and the preparatory conduct around it, not merely its supply, and in 2008 that was an early statutory recognition, in any Indian enactment, that the harm of child sexual abuse material is reproduced at each act of access. The drafting is not beyond argument: a browsing offence places weight on proof of knowledge and deliberateness that the section’s structure has to bear, and researchers and journalists have had to rely on the section’s intent requirements and the shared public good exception to do work the text does not do expressly. But the comparison with the speech provision is the trail’s own. In Section 67B the drafters enumerated conduct with precision because the committee process had taken evidence on the subject, the CBI’s among it. In Section 66A they adopted adjectives. The difference in outcome, one provision operating without constitutional incident and the other struck down in its entirety, was written into that difference in method from the start.

Section 67C completed the group from the enforcement side, obliging intermediaries to preserve and retain information in the manner and for the duration the Central Government prescribes, and punishing an intermediary that intentionally or knowingly contravenes that obligation with imprisonment that may extend to three years and a fine.

The amendment also settled the procedural character of the new criminal law. It inserted Section 77A, permitting the compounding of offences under the Act, with exceptions including offences punishable with life imprisonment or death and offences whose impact extends to the socio economic conditions of the country. It inserted Section 77B, under which offences under the Act punishable with imprisonment of three years or less are bailable, a provision that quietly placed most of the new offences, Section 66A among them, on the bailable side of the line whatever the arrest practice around them later became. It lowered the rank of the investigating officer under Section 78 from an officer not below the rank of Deputy Superintendent of Police to a police officer not below the rank of Inspector, widening the pool of officers who could set the offences chapter in motion. And it inserted Sections 84A, 84B and 84C, dealing respectively with the modes and methods of encryption the Central Government may prescribe, punishment for abetment of offences, and punishment for attempt, which it set at one half of the longest term of imprisonment provided for the offence attempted. The power in Section 84A was not, in the event, used to prescribe a general encryption regime for the public, and it survives as an unused authority in the text, a reminder that an amendment trail includes the powers a legislature grants and the executive declines to exercise. What the amendment did not touch is also part of its record. Section 65, the source code offence of the original chapter, stood unamended in text while everything around it was rebuilt, and the facilitative chapters on records, signatures and electronic governance were adjusted in vocabulary rather than redesigned. The amendment’s energy was concentrated where the decade’s pressure was: crime, content, surveillance, platforms and data. A reader who wants the measure of the instrument should note that concentration, because it explains both the amendment’s coherence and its blind spots; it was a statute about the internet’s dangers and liabilities laid over a statute about its validity, and the parts of the original design that faced neither danger nor liability were left, sensibly and revealingly, alone.

How did the amendment change the investigation of offences?

It widened the gate at three points. Section 78 was amended so that a police officer not below the rank of Inspector, rather than a Deputy Superintendent of Police, could investigate offences under the Act. Section 77B made offences punishable with three years or less bailable, and Section 77A allowed most offences to be compounded.

Taken together, the offences the amendment created were a mixed instrument. Most of them answered conduct that plainly called for a statutory home: receiving stolen computer resources, stealing an identity, cheating by personation, publishing images of a private area without consent, and the cluster of offences around children in Section 67B were gaps in the parent Act that prosecutors had been working around with the Penal Code. Their punishments were graded in a recognisable pattern, three years for the run of computer related dishonesty, rising through the five and seven year grades for sexual content to life imprisonment for cyber terrorism. The provision that did not fit this pattern of gap filling, because the parent Act’s silence on it was not a gap of the same kind, was the first of the new sections, and it requires a section to itself.

Section 66A, in its own words

Section 66A, headed “Punishment for sending offensive messages through communication service, etc.”, provided that any person who sends, by means of a computer resource or a communication device, any information that is grossly offensive or has menacing character; or any information which he knows to be false, but for the purpose of causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred or ill will, persistently by making use of such computer resource or a communication device; or any electronic mail or electronic mail message for the purpose of causing annoyance or inconvenience or to deceive or to mislead the addressee or recipient about the origin of such messages, shall be punishable with imprisonment for a term which may extend to three years and with fine. An Explanation defined electronic mail and electronic mail message in terms wide enough to cover a message or information created, transmitted or received on a computer, computer system, computer resource or communication device, including attachments in text, images, audio, video and any other electronic record which may be transmitted with the message.

The brief for this article directs that the provision be addressed through its terms rather than through characterisation, and the terms repay the instruction. The operative words of the first limb are grossly offensive and menacing. The operative words of the second are annoyance and inconvenience, sitting in a list that runs from those two mild states through obstruction and insult to injury, criminal intimidation, enmity and hatred, as though the causing of inconvenience and the causing of enmity were points on one scale of the same gravity. The operative test of the third limb is again annoyance or inconvenience, this time without even the second limb’s requirements that the information be known to be false and sent persistently. None of these words is defined anywhere in the Act. None of them corresponds to a head of Article 19(2) of the Constitution, the clause that enumerates the grounds on which speech may reasonably be restricted: the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality, contempt of court, defamation and incitement to an offence. A restriction framed around annoyance and inconvenience is not a slightly loose version of a restriction framed around public order or incitement; it is a restriction framed around a different and far larger subject, the whole field of speech that a recipient, or a police officer reading over the recipient’s shoulder, finds unwelcome.

Read limb by limb, the structure deteriorates as it goes. The first limb requires no purpose at all beyond the sending: information that is grossly offensive or has menacing character is punishable in the sending, whoever it is sent to and whatever the sender meant beyond the character the information is found to have. Character, in the drafting, is a property a message can simply possess, judged after the event by whoever complains and whoever investigates. The second limb adds a knowledge requirement and a purpose requirement, and then destroys the discipline those requirements might have imposed by writing the purposes as a disjunctive catalogue of eleven states running from annoyance to hatred, so that the prosecution need only fit the facts to the mildest word in the list; and it attaches the word persistently to the whole, leaving it grammatically uncertain whether persistence qualifies the sending, the use of the device, or the purpose. The third limb drops both the falsity requirement and the persistence requirement: an electronic mail or message sent for the purpose of causing annoyance or inconvenience is punishable, full stop, as is one sent to deceive or mislead about its origin, the two purposes yoked by a conjunction that Pranesh Prakash’s analysis showed to be the difference between an anti-spam provision and a general speech offence, since genuine spam is characterised by being unsolicited and sent in bulk, neither of which the limb requires, while a single unwelcome message from a known sender, sent once, falls squarely within it. A definition that covers the single message from a known sender and does not require the bulk unsolicited message is not a defective anti-spam provision by accident of one word; it is a provision whose centre of gravity was never in spam at all. The Explanation then widened the delivery mechanism until it matched the breadth of the purposes: electronic mail means a message or information created or transmitted or received on any computer, system, resource or communication device, with attachments of any kind, so the third limb’s apparently narrow subject, mail, was defined back into the whole of electronic communication. Set beside the constitutional enumeration, the provision’s difficulty was not emphasis or tone. Article 19(2) permits restrictions in the interests of public order and for incitement to an offence; Section 66A permitted imprisonment for causing inconvenience. Between those two standards there was never a reading down available that would not have required the Court to rewrite the section, which is why the trail records a striking down in entirety rather than a surgical rescue, and why the provision’s defenders were driven to argue from administration rather than from text. The overlap argument pressed the same point from the direction of necessity. The Penal Code already policed the serious end of the field the section claimed: defamation, obscenity, statements conducing to public mischief, criminal intimidation including intimidation by anonymous communication, and intentional insult with intent to provoke a breach of the peace each carried their own thresholds, defences and procedure, developed over a century and a half of application. Section 66A did not fill a vacuum at that end; it duplicated the coverage at lower thresholds, without the Penal Code’s defences, and in a form that began with arrest by an officer of Inspector rank under the amended Section 78. The critics’ charge, made by the provision’s challengers and by commentators including the Centre for Internet and Society’s analysts, was that the section’s real function in the legal order was not to reach conduct the general law missed but to reach speakers the general law would have protected, at a price in procedure the general law would not have charged. The enforcement record set out below, in which the recurring complainant is a political formation and the recurring subject political speech, is the evidence that charge rests on, and the government never answered it at the level of the text, because at the level of the text it was unanswerable.

Where did the wording of Section 66A come from?

Its clauses track a British offence drafted for the telephone age. Pranesh Prakash of the Centre for Internet and Society traced the text to Section 10(2) of the United Kingdom’s Post Office (Amendment) Act, 1935, which punished a telephone message that was grossly offensive or menacing, a false message sent to cause annoyance or inconvenience, and persistent calls without cause.

The template’s later career in its home jurisdiction completes the comparison, and it is not a career that flatters the borrowing. The British offence descended from the 1935 provision into the telecommunications legislation of the following decades and, in the internet period, into Section 127 of the Communications Act 2003, which punishes sending through a public electronic communications network a message that is grossly offensive or of an indecent, obscene or menacing character. That provision generated its own line of controversial prosecutions for jokes, insults and intemperate posts, and the Law Commission for England and Wales, in its 2021 report on modernising communications offences, recommended that the grossly offensive communications offences be replaced by a harm based offence built around likely psychological harm, precisely because the character based test swept in speech whose offensiveness was its only vice. India had reached the same conclusion six years earlier by the constitutional route, in a judgment that struck the borrowed words down rather than awaiting a legislature’s revision. The parallel matters to the amendment trail for one reason: the defect in Section 66A was not an Indian drafting misfortune but a property of the template itself, visible in both jurisdictions, and a Parliament examining the antecedent in 2008 with any care would have found a provision already attracting, at home, the criticism that it criminalised giving offence. The words were not merely old. They were known to be troublesome in the system that coined them, and they were enacted in India, in an expanded form reaching all electronic publication, without a recorded sentence of consideration.

The antecedent explains the drafting and condemns it at once. The British provision was built for directed communication: one caller, one recipient, a message aimed at a person who had not invited it, in a medium with no audience. Section 66A took that template and applied it to a medium whose characteristic act is publication, a post addressed to whoever reads it. Words that in a telephone offence mark out harassment of an identifiable recipient became, in the Indian provision, a test for the legality of public speech. The mismatch was not a subtle one, and it was compounded by the provision’s reach: it applied to any person who sends any information by any computer resource or communication device, it required no relationship between sender and recipient, and under its Explanation its concept of electronic mail extended to more or less any information communicated electronically. The provision’s career in force followed from its text with a predictability that its drafters appear not to have anticipated and its critics described from the beginning.

The arrests that made Section 66A a public question came in 2012. In April of that year, Ambikesh Mahapatra, a professor at Jadavpur University, was arrested in West Bengal after forwarding a cartoon that mocked the Chief Minister of the State. In November 2012, two young women, Shaheen Dhada and Rinu Srinivasan, were arrested in Palghar in Maharashtra after one of them posted a comment questioning the shutdown of Mumbai that followed the death of the politician Bal Thackeray, and the other indicated approval of the comment. The Palghar arrests, of a poster and of a person whose act was to endorse the post, converted an argument among lawyers about drafting breadth into a national argument about whether the provision could coexist with ordinary use of a social platform, and it was in their immediate aftermath that the law student Shreya Singhal petitioned the Supreme Court. The Union Government’s own response to the enforcement pattern, short of amendment, was an advisory issued in January 2013 directing that arrests under Section 66A not be made without approval at a senior level of the police hierarchy, an administrative patch on a statutory breadth that only the legislature or the Court could remove. The description in this article of the offences the amendment created is a statement of the statute’s general position; it is not advice on any individual case, and a person facing a charge under a surviving provision needs advice on the facts of that case, because the charge sheet and not any commentary decides what has to be met.

The two 2012 episodes were the famous ones, not the only ones, and the pattern across the provision’s working life is part of the trail. In September 2012 the cartoonist Aseem Trivedi was arrested in Mumbai on charges that included Section 66A, over cartoons exhibited and published online that mocked Parliament and national symbols. In October 2012 a businessman in Puducherry, Ravi Srinivasan, was arrested under the section for a message on a social platform alleging corruption against the son of a Union minister. The common structure of the cases is the point the critics seized on: in each, the information complained of was political speech about public persons, the complainant was connected to the subject of the speech or offended by its symbolism, and the statutory words that did the work were not injury or intimidation but the low threshold terms of annoyance, insult and gross offence. The Union Government defended the provision through this period rather than amending it. Kapil Sibal, the Minister for Communications and Information Technology, stated in November 2012 that there was nothing unconstitutional about the section, and the government’s position in the litigation that followed was that the provision was sound and its administration at fault. That division, a defensible text badly administered against an indefensible text faithfully administered, was the question the Supreme Court eventually answered against the government, and it is a question the drafting history already answers: a provision whose operative words are annoyance and inconvenience will produce arrests for annoying and inconvenient speech as a matter of ordinary police work, not of aberration, and the advisory of January 2013, which sought to filter arrests through senior approval, was an admission by the executive that the text as written could not be trusted to the ordinary machinery the Act itself had widened in Section 78.

The Court removed it. On 24 March 2015, in Shreya Singhal v. Union of India, the Supreme Court struck down Section 66A in its entirety as unconstitutional. The reasoning by which it did so, and the distinctions it drew between discussion, advocacy and incitement, belong to the judgment and are owned by the Shreya Singhal judgment article, which also owns the Court’s treatment of Sections 69A and 79 in the same case; at the level of the amendment trail, what matters is the outcome and its date, and the fact that the same judgment left the remainder of the 2008 settlement standing. The striking down did not end the provision’s administrative life at once. Research by Abhinav Sekhri and Apar Gupta, published in 2018 under the description of Section 66A and other legal zombies, documented cases continuing to be registered and prosecuted under the section after its invalidation, and the Supreme Court in later proceedings directed that the judgment be circulated to courts and police leadership across the country. A provision inserted without debate proved, in the end, difficult to remove even by a judgment.

The State powers: interception, blocking and traffic data

Section 69 as enacted in 2000 had been a decryption assistance power wearing an interception label: the Controller could direct a government agency to intercept information transmitted through a computer resource on a closed list of grounds, and the subscriber’s duty was to extend facilities and technical assistance to decrypt. The amendment substituted the section wholesale. As substituted, Section 69 empowers the Central Government or a State Government, or an officer specially authorised by either, if satisfied that it is necessary or expedient in the interest of the sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign States or public order, or for preventing incitement to the commission of any cognizable offence relating to those heads, or for investigation of any offence, to direct any agency of the appropriate government to intercept, monitor or decrypt, or cause to be intercepted, monitored or decrypted, any information generated, transmitted, received or stored in any computer resource. The subscriber, intermediary or person in charge of the resource must extend all facilities and technical assistance, and failure to assist remains punishable with imprisonment that may extend to seven years. The procedure and safeguards for the exercise of the power were left to be prescribed by rules, which followed in 2009 as the Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules.

Three features of the substitution deserve separate emphasis, because each enlarged the power in a different dimension. The first is the move from transmission to information in any state: the old text reached information transmitted through a computer resource, while the substituted text reaches information generated, transmitted, received or stored, which brings stored data, the content of a device or an account at rest, within the direction. The second is the addition of monitoring as a freestanding object alongside interception and decryption, which accommodates continuing observation rather than the capture of a communication in passage. The third is the ground. The 2000 list had run to sovereignty and integrity, security of the State, friendly relations, public order and preventing incitement to a cognizable offence. The substituted list added defence of India, which might be thought implicit in security of the State, and then added a ground of a different character from all the others: for investigation of any offence. Investigation of any offence is not a head of national security or public order; it is the ordinary business of policing, and its inclusion converted Section 69 from an exceptional power tethered to enumerated state interests into an instrument available, on its face, in the investigation of crime generally. That single phrase is, on the argument of the amendment’s critics, the most consequential change the 2008 Act made to the parent statute, more consequential in the long run than the provision that became famous, because Section 66A was struck down and Section 69 was not. The substitution also has a federal dimension that the trail should not pass over. The 2000 power had belonged to the Controller, a single central officer regulating signatures, and its exercise was in practice a Union function. The substituted section confers the power on the Central Government or a State Government, or on an officer specially authorised by either, so that interception, monitoring and decryption directions may issue from state capitals as well as from Delhi, each government acting through its own authorised officers and its own agencies under a central statute. In a constitutional order that treats public order and police as state subjects and communications as a Union subject, that conferral was a considered piece of design rather than an accident: the amendment federalised the operation of the surveillance power while keeping its charter unitary, and the accountability questions that follow state level directions, which secretary authorises, which committee reviews, have been asked at both levels ever since, usually without a public answer. The 2009 interception rules reproduce the same two level structure, with the competent authority at the Centre and in the States and review committees in both places, so that the federal pattern of the section is carried into its safeguards as faithfully as into its power.

The contrast inside the same instrument sharpens the point. When the drafters came to the blocking power in Section 69A, enacted in the same week by the same Houses, they did not include the investigation of any offence among its grounds, and they confined it to a list that tracks the security and public order heads. The amendment therefore contains, side by side, proof that its drafters could discriminate between a power meant for exceptional state interests and a power meant for general policing, and proof that in Section 69 they chose not to. No argument from drafting haste fully explains the choice, since the narrower list was available to the same hands at the same sitting; the more plausible reading of the trail is that the breadth of the interception ground was a policy preference, taken in a season in which the investigative claims of the security state faced no effective counterweight in the chamber, and recorded in the statute without the debate that might have priced it. That is the form the series’ crisis legislation pattern takes in this cluster: not the insertion of an emergency power with a sunset, but the permanent widening of an ordinary power in emergency conditions, after which the emergency passes and the widening remains.

Section 69A was wholly new. It empowers the Central Government or an officer specially authorised by it, if satisfied that it is necessary or expedient in the interest of the sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign States or public order, or for preventing incitement to the commission of any cognizable offence relating to those heads, to direct any agency of the government or any intermediary to block for access by the public any information generated, transmitted, received, stored or hosted in any computer resource. The grounds deliberately track the state interest list and do not include investigation of any offence. The machinery was supplied by the Information Technology (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009, which route requests through a designated officer to a committee, provide for emergency blocking subject to later committee examination, and impose strict confidentiality on blocking requests and complaints. Blocking under Section 69A is the legal basis on which websites, applications and individual items of content have been made inaccessible in India since 2009, and its procedure has been litigated and defended on the footing that the rules’ committee structure and reasoned order requirements are the safeguard the parent section does not itself spell out.

The blocking power’s early career showed both its reach and the uses to which an access control instrument is put in a crisis. Its first large scale exercise came in August 2012, when, during communal violence in Assam and a panic driven movement of people from the north east out of cities including Bengaluru, the government directed the blocking of web pages, accounts and messages said to carry inflammatory and morphed material, an episode in which the power operated at the level of hundreds of individual items of content rather than of publications. The episode is recorded here at the level of the amendment trail rather than of the merits, which are contested: what it established institutionally was that Section 69A had given the Union an instrument for item level control of online content exercisable through intermediaries, that the instrument would be used in conditions of public disorder, and that its confidentiality rule meant the persons whose content was blocked would ordinarily learn of the order, if at all, from its effect. The comparison with the older interception regime for telephones is instructive on the safeguards question. Telephone interception under the Telegraph Act had been disciplined, after the Supreme Court’s judgment in the PUCL case in 1997, by procedural safeguards that a later rule making exercise codified, including a review committee at the level of senior government. The 2009 interception rules under the substituted Section 69 borrowed that architecture, with authorisation at secretary level and a review committee, for a power far wider in object than the telephone power whose safeguards were being copied. The borrowing is the 2008 settlement in miniature: the procedures were designed for a narrower instrument, and they were transplanted, by rules the executive wrote for itself, to govern interception, monitoring and decryption of any information in any computer resource on grounds that include the investigation of any offence.

The relationship between the blocking power and the intermediary settlement needs stating, because the amendment created two distinct channels by which online content disappears, and later argument often confuses them. Section 69A is a direction of the state: the Central Government, for stated reasons of sovereignty, security, friendly relations, public order or incitement connected with those heads, orders that public access to specified information be blocked, and the intermediary’s role is obedience. Section 79, by contrast, withdraws an immunity: it issues no direction and states no ground, and the intermediary that receives actual knowledge of unlawful use of its resource and fails to act loses its protection against liability for what remains. The first channel is censorship by order, with the state as actor and the committee procedure as its stated discipline. The second is removal by incentive, with the intermediary as actor and the loss of immunity as the spur. The 2008 amendment built both, and the architecture explains much of the later politics of Indian content regulation: governments prefer the second channel for volume, because it requires no order, no committee and no reasons, and they reserve the first for cases where an order is precisely what they want to be seen to issue. A reader who keeps the two channels apart can parse most takedown controversies of the following decade without difficulty, and a reader who merges them will misread nearly all of them. It is one of the amendment’s least remarked achievements, and one of its most consequential, that it institutionalised the distinction and left later lawmakers to choose, case by case, which side of it to work.

Section 69B, also new, empowers the Central Government to authorise an agency to monitor and collect traffic data or information generated, transmitted, received or stored in any computer resource, in order to enhance cyber security and for identification, analysis and prevention of intrusion or spread of computer contaminants. Traffic data, as the section defines it, is data that indicates a communication’s origin, destination, route, time, date, size, duration or type of underlying service, which is to say the envelope rather than the contents. An intermediary or person in charge who is directed to provide technical assistance and facilities for online access must comply, and intentional or knowing contravention is punishable with imprisonment that may extend to three years and a fine. The three sections together, 69, 69A and 69B, made the parent Act the general statute of Indian communications surveillance and access control, a function that in 2000 it had performed only at the margins through the Controller’s decryption power. The safeguards for each of the three sit substantially in subordinate legislation rather than in the sections themselves, and that distribution, the power in the Act and the protection in the rules, is the structural feature of the 2008 settlement that its critics return to most often.

One amendment, four regimes

The cumulative shape of the amendment is easiest to hold in a single view. The table below groups what it inserted and rewrote into the four regimes the brief for this article identifies, and records for each what stood in the parent Act, what the amendment created, and whether the creation survives.

Regime	What existed before 2008	What the amendment created	Whether it survives
Content offences	Sections 65, 66 and 67 only: source code tampering, a narrow offence of hacking, and obscenity	Sections 66A to 66F (offensive messages, receiving stolen resources, identity theft, cheating by personation, violation of privacy, cyber terrorism), a rewritten Section 66, recalibrated Section 67, new Sections 67A and 67B, and the preservation duty in Section 67C	All survive except Section 66A, struck down in its entirety on 24 March 2015
State powers of interception and blocking	Section 69 as a Controller issued interception and decryption assistance power on a closed list of grounds; no blocking power; no traffic data power	A substituted Section 69 reaching interception, monitoring and decryption of information in any state, with investigation of any offence added as a ground; Section 69A blocking of public access; Section 69B monitoring and collection of traffic data	All three survive; Section 69A was upheld in the same 2015 judgment that struck down Section 66A
Corporate data obligations	No data protection provision of any kind; Section 43 compensation capped at one crore rupees	Section 43A compensation liability for a body corporate negligent with sensitive personal data, resting on reasonable security practices; Section 72A punishment for disclosure of information in breach of a lawful contract	Both survive; Section 43A carried the 2011 sensitive personal data rules and was the statutory anchor of Indian data protection until the 2023 data statute
Intermediary liability	Section 79 as a narrow exemption for network service providers, answering only for liability under the parent Act and turning on the provider’s own proof	A substituted Section 79 extending conditional immunity to intermediaries generally, for third party information under any law, on conditions of non initiation, non selection, non modification, due diligence and compliance with government guidelines	Survives; its actual knowledge condition was read down by the Supreme Court in 2015, and its due diligence content has since been expanded by rules

The survival column is the table’s argument, and it should be read as one. Of the four regimes, three stand entire and the fourth stands with a single section removed. The provision that fell was not the most powerful the amendment created, nor the most used against ordinary citizens in volume, since blocking and interception touch more communications in a month than Section 66A touched speakers in its life. It fell because it was the one provision whose defect was in its enacted words rather than in its exercise, and whose words could be quoted in a courtroom without commentary until the conclusion stated itself. The regimes that survived share the opposite property: their texts state powers, duties and immunities in terms a court can administer, and their controversies concern how they are used, by whom, with what procedure, questions that litigation can discipline incrementally without removing the provision. That asymmetry is the deepest lesson the amendment trail offers about crisis drafting. Haste does not damage all provisions equally. It damages the provisions whose operative concepts must be carried by adjectives, because adjectives cannot be repaired by procedure; and it leaves standing, for decades, provisions whose breadth lies in their grounds and thresholds, because breadth of that kind can always be defended as policy. The December 2008 text contains both kinds, enacted in the same half hour, and the seventeen years since have sorted them with an accuracy no debate could have improved upon and no drafter intended.

Institutions the amendment wrote into the statute

The Indian Computer Emergency Response Team had been functioning since January 2004 as an executive body within the government’s information technology administration. The amendment gave it a statutory charter by inserting Section 70B, under which the Central Government appoints the agency to serve as the national agency for incident response, charged with the collection, analysis and dissemination of information on cyber security incidents, forecasts and alerts of such incidents, emergency measures for handling them, coordination of response activities, and the issue of guidelines, advisories, vulnerability notes and white papers on information security practices. The section arms the agency to call for information from, and give directions to, service providers, intermediaries, data centres, body corporates and other persons, and a failure to provide information called for is punishable with imprisonment that may extend to one year, or a fine that may extend to one lakh rupees, or both. Operating rules for the agency’s functions followed in 2013 as the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, which among other things obliged service providers, intermediaries, data centres and body corporates to report specified categories of cyber security incident to the agency, converting the section’s call for information power into a standing reporting relationship between the state and the operators of the network; but the statutory personality dates from the amendment, and the reporting regime is one more instance of the 2008 pattern, a section in the Act and a machinery in the rules.

The functions the section assigns repay a moment’s attention, because they define a kind of state body the parent Act had not contained. The emergency response team is not a regulator with licences to grant or withhold, and it is not an investigating agency with offences to pursue. Its statutory work is epistemic and coordinative: to know what is happening to the country’s networks, through the information it collects and the incidents reported to it; to warn, through forecasts and alerts; to coordinate the response of others when an incident is live; and to publish the guidance by which operators are expected to govern themselves. Section 70B’s teeth, the power to call for information and to give directions to service providers, intermediaries, data centres, body corporates and other persons, exist to feed that epistemic function, and the modest punishment for failure to provide information, a year at the outside, is scaled to a reporting duty rather than to a prohibition. The amendment was, in this corner of the Act, doing institutional design of a modern kind: it recognised that the state’s scarcest resource in a network incident is not force but timely knowledge, and it built the knowledge collecting body into the statute, five years after the body had been improvised into existence by executive decision when the need first became undeniable. That sequence, improvisation in 2004 and statutory recognition in 2008, is the normal biography of Indian cyber institutions, and the trail records it here in its first instance.

Alongside it, the amendment recast the protected system provision and inserted Section 70A, under which the Central Government may designate an agency of the government to be the national nodal agency in respect of critical information infrastructure protection, charged with research and development and with the protection of the computer resources whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety. The agency designated under that power, the National Critical Information Infrastructure Protection Centre, became the institutional home of that function. The amendment also inserted Section 79A, empowering the Central Government to notify an Examiner of Electronic Evidence, whose expert opinion on electronic form evidence the courts may take into account, a quiet provision that connects the amendment to the law of proof and that has mattered in litigation out of proportion to the attention it receives. The pattern across these provisions is the same as in the offences chapter: bodies and functions that had grown up administratively in the decade after 2000 were given their first footing in the statute by the 2008 instrument, and the statute’s character shifted accordingly, from a charter for electronic commerce to the general operating law of the Indian internet.

The corporate data obligation

Section 43A is the provision of the amendment whose importance is most often dated too late in accounts of Indian data law. Before 2008, the parent Act contained no data protection provision in any recognisable sense: it protected computer systems against unauthorised access and damage, and it punished certain disclosures by persons who had secured access in pursuance of powers under the Act, but it imposed no obligation on a company that collected and held personal information to handle it carefully. Section 43A created that obligation in a deliberately narrow form. Where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures, and such negligence causes wrongful loss or wrongful gain to any person, the body corporate is liable to pay damages by way of compensation to the person affected. The obligation is one of compensation for negligent security, not a charter of data subject rights, and sensitive personal data and reasonable security practices were left to be defined and specified by rules.

The rules came in April 2011 as the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, which defined sensitive personal data to include passwords, financial information such as bank account and payment instrument details, physical, physiological and mental health conditions, sexual orientation, medical records and history, and biometric information, and which tied reasonable security practices to a documented information security programme implementing the international standard IS/ISO/IEC 27001 or an approved code of best practice, audited at stated intervals. The same rules built a small operational code around the obligation: a body corporate was to publish a privacy policy for handling personal information, to obtain consent in writing from the provider of sensitive information regarding its purpose, to collect only what was necessary for a lawful purpose connected with its function, not to retain it longer than required, to disclose it to third parties only within the rules’ conditions, and to attend to grievances through a designated grievance officer. Read against the section that authorised them, the rules show both the reach and the ceiling of the 2008 design. The reach was real: for the outsourcing and services economy, the Section 43A and rules package became the compliance baseline that contracts cited and audits tested, and it accustomed Indian law to the grammar of consent, purpose and security safeguards a decade before a general statute adopted that grammar at scale. The ceiling was structural. The duty ran only to body corporates, only to the defined sensitive categories, only in respect of security practices rather than the fairness of the processing itself, and its sanction was a compensation claim by a person who could prove negligent security, wrongful loss or gain and the causal path between them, which is a claim few individuals were placed to litigate. A data protection regime whose enforcement depends on the victim proving the inadequacy of the defendant’s security programme is a regime designed, in effect, for commercial counterparties rather than for citizens, and the criticism that Section 43A protected the industry’s clients more reliably than the public’s data was made throughout the provision’s working life. For more than a decade, this single inserted section and its rules were the nearest thing India had to a data protection statute for the private sector, invoked in diligence exercises, outsourcing contracts and breach disputes, and criticised for its limits: it reaches only body corporates, only sensitive categories, only negligence in security practices, and it sounds only in compensation. The subject has since been taken up by a dedicated statute, the trajectory of which is traced in the article on the Digital Personal Data Protection Act 2023, but the lineage runs through Section 43A, and the first data protection obligation in Indian law is a 2008 insertion into a commerce statute.

A claim under Section 43A travels the parent Act’s own road: it is a claim for compensation, presented within the adjudication scheme the Act maintains for its compensation provisions, before the adjudicating officer for claims up to the five crore rupee remit the amendment fixed, and before the competent court above it, rather than a prosecution or a regulator’s penalty. That remedial design is of a piece with the obligation’s narrowness. The amendment’s authors built Indian data protection’s first provision as a private law remedy bolted onto a security duty, at a moment when no data protection authority existed or was proposed in the Bill, and the consequence was a right that depended for its life on individual litigation by persons able to prove another party’s security failures. The dedicated data statute of 2023, with its Board and its penalty architecture, is unintelligible except as a judgment on that design; but the design was the amendment’s, and its fifteen year working life is the baseline against which the later statute’s choices were made.

The companion provision is Section 72A, which the amendment inserted to punish disclosure of information in breach of a lawful contract. A person, including an intermediary, who while providing services under a lawful contract has secured access to material containing personal information about another person, and who discloses that material with intent to cause, or knowing he is likely to cause, wrongful loss or wrongful gain, without the consent of the person concerned or in breach of the contract, is punishable with imprisonment that may extend to three years, or a fine that may extend to five lakh rupees, or both. Together the two sections reflect the amendment’s characteristic method on data: a civil liability for negligent security in Section 43A and a criminal liability for faithless disclosure in Section 72A, each attached to the handling of personal information by those who hold it for others, and neither amounting to a general privacy code. That a general code took a further fifteen years to arrive, and arrived as a separate statute rather than as an amendment to this one, is part of the trail this article records. The later statute’s own text acknowledges the succession expressly: the Digital Personal Data Protection Act, 2023 provides, in the part of it that amends other enactments, for the omission of Section 43A from the Information Technology Act as its own corresponding provisions take effect, so that the first data protection obligation in Indian law is scheduled to leave the statute book by the hand of its replacement rather than by repeal in disgrace. Section 72A, the disclosure offence, is not carried into that succession and remains in the parent Act, a surviving fragment of the 2008 data settlement inside a statute whose data chapter has otherwise moved out. Few provisions in this series illustrate the amendment trail’s long perspective better: an insertion made almost without comment in 2008 founded a field, governed it alone for fifteen years, and was then retired by name in the statute that replaced it.

The intermediary settlement rewritten

Section 79 as substituted is the provision through which the amendment most directly governs the daily operation of the internet in India, and its contrast with the 2000 text is the measure of the amendment. The 2000 exemption had protected a network service provider, against liability under the parent Act alone, where it proved absence of knowledge or the exercise of due diligence. The substituted Section 79 provides that an intermediary shall not be liable for any third party information, data or communication link made available or hosted by it, and the exemption is not confined to liability under the parent Act: it speaks to liability under any law for the time being in force. The exemption is conditional. It holds where the intermediary’s function is limited to providing access to a communication system over which information is transmitted, stored or hosted by third parties; where the intermediary does not initiate the transmission, select the receiver, or select or modify the information; and where the intermediary observes due diligence while discharging its duties under the Act and observes the guidelines the Central Government prescribes. It is withdrawn where the intermediary has conspired in, abetted, aided or induced the unlawful act, and where, on receiving actual knowledge or a notification that information within its control is being used to commit an unlawful act, it fails expeditiously to remove or disable access to that information.

Why the substitution had to reach liability under any law, and not merely repeat the 2000 exemption in wider words, is shown by the prosecution that exposed the old section. The case that arose from the marketplace listing in 2004 was not run under the parent Act alone: the charges travelled between the obscenity provision of the technology statute and the obscenity provisions of the Penal Code, and the old Section 79, which answered only for liability under the Act, its rules and its regulations, had nothing to say to the Penal Code half of the case. A platform could therefore hold a complete answer under the technology statute and remain exposed, through its officers, under the general criminal law for the identical act of hosting. The substituted section’s opening words were drafted against exactly that defect: the intermediary is not liable for third party information under the parent Act or, in the section’s own reach, under any other law for the time being in force, and the conditions that follow are the price of that breadth. The point is worth dwelling on because commentary on Section 79 often treats the any law extension as drafting surplus. It was the operative repair, the clause that converted a single statute exemption into the general safe harbour on which the platform economy was then built, and its presence in the text is traceable to a specific prosecution’s demonstration that the narrower form did not work.

The design is a conditional immunity rather than an exemption for a class of company, and its pivot is the relationship between the intermediary’s passivity and its knowledge. A provider that merely carries and hosts, that does not originate or shape what it carries, is not treated as the publisher of what others say through it; a provider that steps out of that passivity, or that sits on knowledge of unlawful use, steps out of the immunity with it. The due diligence condition was given content by the Information Technology (Intermediaries Guidelines) Rules, 2011, which required intermediaries to publish rules and regulations and a user agreement prohibiting specified categories of content, to act on complaints within a stated period, to appoint a grievance officer, and to preserve information and records for a stated duration. The 2011 Rules also fixed the operational meaning of acting on knowledge: an intermediary that received a complaint from an affected person in writing, or through electronic means signed with an electronic signature, was required to act within thirty six hours and, where applicable, to work with the complainant to disable the information. That thirty six hour figure, which came from rules rather than from the section, became the number around which newsroom and platform practice organised itself for a decade, and it illustrates the settlement’s division of labour one more time. Parliament in 2008 wrote an immunity with an undefined due diligence condition; the executive in 2011 supplied the clocks, the officers and the complaint channels; and the courts, when the scheme was challenged, were left to judge a structure neither text could have revealed alone. Every later platform dispute in India, over takedown, traceability, grievance handling and the boundaries of the immunity, has been argued inside the frame the substituted Section 79 built and the rules made under it have filled, and the frame is a 2008 construction from beginning to end. It replaced an exemption drafted for access providers in the dial up era with the charter of the platform economy, and on any balanced account it was more protective of intermediaries than what it replaced: broader in the persons covered, broader in the liabilities answered, and clearer that the platform is not the speaker.

How to read the amendment: four operations on one text

The amendment is usually described as an expansion, and in aggregate it was one, but the trail is misread if its four distinct operations are collapsed into that single word. The first operation is insertion, the writing of provisions where the parent Act had silence: the offences in Sections 66A to 66F, 67A, 67B and 67C, the data obligation in Section 43A, the disclosure offence in Section 72A, the powers in Sections 69A and 69B, the institutions in Sections 70A and 70B, the evidence provision in Section 79A and the procedural provisions in Sections 77A, 77B, 84A, 84B and 84C. Insertion is the operation by which an amending Act changes what a statute is about. Before 2008 the parent Act was about electronic commerce and its facilitative machinery, with offences at the edge. After the insertions it was about those subjects and about online speech, child protection, surveillance, blocking, data security and incident response, and the insertions, not the substitutions, are what moved its centre of gravity.

The second operation is substitution, the replacement of an existing provision with a wider or differently aimed successor that occupies the same section number: Section 66, Section 69 and Section 79 were each substituted, and the definition of intermediary in Section 2 with them. Substitution is the operation most likely to deceive a reader of the amended text, because the section number’s continuity disguises the change of content. A lawyer who had learned the Act in 2005 and returned to it in 2010 would have found the same numbers doing different work: Section 66 no longer the hacking offence but a dishonesty gateway to the Section 43 catalogue, Section 69 no longer the Controller’s decryption direction but the general interception and monitoring power of two levels of government, Section 79 no longer a network provider’s exemption under one Act but the conditional immunity of every intermediary against liability under any law. The third operation is recalibration, the adjustment of numbers inside a provision whose structure survives: the punishment grades of Section 67 moved, the compensation ceiling of Section 43 was deleted and the adjudicating officer’s remit repriced at five crore rupees, the investigating officer’s rank in Section 78 was lowered from Deputy Superintendent to Inspector. Recalibration looks minor beside insertion and substitution and is routinely where the practical change lives, since the rank of the officer who may investigate determines how many hands can set a provision in motion. The fourth operation is omission, the removal of spent text: Sections 91 to 94 of the parent Act, through which the 2000 Act had amended the Penal Code, the Evidence Act, the Bankers’ Books Evidence Act and the Reserve Bank of India Act, were omitted with the Third and Fourth Schedules, the amending Act of 2008 having taken that consequential work into its own parts. Omission is housekeeping, but it completes the picture of an instrument that did not merely add a chapter to the parent Act. It audited the whole text, rewrote its three most consequential sections, priced its machinery again, and left a statute whose table of contents reads as a palimpsest of the decade’s anxieties, commerce first, then crime, surveillance and platforms laid over it in a darker ink.

Measured by its own table of contents, the amendment’s centre of mass sits in the offences chapter and the chapters around the Controller and the adjudication machinery, and almost none of it sits in the facilitative chapters with which the Act begins. That distribution is the quantitative form of the article’s claim. A statute’s identity, for the citizens and officers who live under it, is set by the provisions under which they are investigated, blocked, immunised or made liable, and by 2009 every one of those provisions in the technology statute was a 2008 provision: the offences that could be charged, the powers that could be directed, the immunity that could be claimed and the data duty that could be breached had all been written or rewritten in the one instrument. The 2000 text survived as the law of validity for electronic records and signatures, necessary, heavily used and almost never argued about. The argument, in courts, in newsrooms and in Parliament’s later committees, has been conducted entirely inside the 2008 layer, which is why an amendment trail, rather than a fresh reading of the parent Act, is the honest and accurate way to present this statute: the parent Act supplies the foundation and the title, and the amendment supplies the law that bites.

The defence and the criticism

The defence of the amendment, as its sponsors made it and as the record supports it, is a defence of necessity. The parent Act had almost no provisions on computer crime, and the conduct the new offences address, identity theft, personation, voyeurism, the sexual exploitation of children online, the dishonest handling of stolen computer resources, is conduct that has become commonplace and was already visible when the Bill was drafted. The corporate data obligation was the first data protection provision of any kind in Indian law, and it was better than the absence it replaced. The interception power, its defenders note, consolidated and regularised powers of a kind that security states exercise in any event, and the substitution at least gathered them into one section with stated grounds and a rule making power for safeguards, where before they had rested on the Controller’s narrower but still real authority. The intermediary provision, as set out above, liberalised the position of platforms. A legislature that had done nothing in 2008 would have left the Penal Code, a nineteenth century text, as India’s operative cybercrime law for another decade. The industry’s case ran in the same direction from a different starting point: the information technology and outsourcing sector, speaking through its association NASSCOM among other bodies, had pressed through the decade for a statutory data protection obligation and for certainty on intermediary liability, because its clients’ contracts demanded both and the parent Act supplied neither; Sections 43A and 79 as enacted were, in substantial part, the provisions that sector had asked for, and their subsequent careers as compliance instruments rather than as litigation weapons reflect the purpose for which they were sought.

The criticism, in its strongest form, is not of the amendment’s existence but of its drafting discipline and of where it stored its safeguards. Pranesh Prakash’s analysis for the Centre for Internet and Society, which traced Section 66A to its telephone era antecedent within days of the provision’s notoriety, made the drafting argument in its most concrete form: the provision’s words were lifted from an offence designed for one to one communication and applied to mass publication, its third limb was an anti-spam measure that did not require a message to be unsolicited or sent in bulk and so covered everything except what it aimed at, and none of its operative terms was defined. The passage argument is documented in the passage record itself: a Bill passed in under half an hour in one House amid an uproar and without discussion in the other, containing a clause inserted by official amendment eleven days before passage, is a Bill whose most sensitive words no legislator ever defended on the floor. The structural argument is the one recorded in the State powers section above: the amendment placed the powers in the statute and the procedures and safeguards in rules, where they can be altered by the executive without a vote, and it added to Section 69 a ground, investigation of any offence, whose breadth no safeguard in rules could narrow because the ground itself is the safeguard’s subject. Parliamentarian M. Rama Jois, who described Section 66A as passed in a hurry, was making in one phrase the point that the record of December 2008 sustains in detail.

The trail also records the repair that was proposed and not made, which belongs to any amendment history. After the 2012 arrests made the provision a national controversy, the corrective route of a narrowing amendment was open and was attempted from the back benches: Baijayant Panda, a member of the Lok Sabha, brought a private member’s Bill proposing to amend Section 66A so that its reach would be confined and its terms tightened, and argued publicly that the section as enacted left too much to the discretion of the police officer on the spot. The government of the day did not take the proposal up, preferring the administrative advisory of January 2013 and the defence of the section in court. The episode completes the passage story in a way the article’s claim requires. The provision that no House had debated on the way in could not find a House willing to debate it on the way out either; its removal was left to a constitutional court, acting on a student’s petition, six years after enactment. Amendment trails in this series repeatedly show legislatures enacting in days what they will not revisit for years, and the technology cluster’s instance is unusually well documented at both ends.

Both positions are substantially correct, and the verdict this article defends follows from holding them together. The amendment was necessary in most of its substance and indefensible in the manner of its most sensitive drafting. Its offences against dishonesty, sexual exploitation and privacy answered real gaps and have stood. Its institutional provisions gave statutory form to functions the state was already performing. Its data obligation, for all its narrowness, began Indian data law. What failed was quality control at exactly the points where the passage record shows quality control was absent: in a speech offence assembled from a telephone statute, in an anti-spam limb attached to it in the session’s last days, and in an interception ground of unlimited generality that attracted no recorded debate because nothing in the Bill attracted recorded debate. The statute India argues about was written in December 2008, and the argument has been, ever since, an argument with the drafting conditions of that month.

What the trail predicts, and what survives

An amendment trail is read for direction as much as for content, and the direction of this trail is consistent. The parent Act’s centre of gravity moved, in a single instrument, from facilitating electronic commerce to policing content, enabling surveillance and structuring platforms; every subsequent development in Indian technology law has worked within that relocation rather than reversing it. The change since 2009 has come characteristically by delegated legislation and by new statutes at the edges rather than by a second general amendment: the due diligence expected of intermediaries has been expanded and re expanded by rules under Section 79, the data subject has been taken up by a dedicated data protection statute, and the blocking and interception powers have been operated, and litigated, inside the 2008 frame. The trail predicts, in other words, that the technology statute will continue to be rewritten in practice by the instruments beneath it, and that the 2008 text will remain the load bearing layer because the cost of reopening it in Parliament is one no government has yet chosen to pay.

Which parts of the 2008 amendment are still in force?

Nearly all of them. The content offences other than Section 66A, the substituted Sections 69 and 79, the new Sections 69A and 69B, the institutions in Sections 70A and 70B, the data duties in Sections 43A and 72A and the procedural provisions all operate. The single complete casualty is Section 66A, struck down in 2015.

The survival pattern is itself the final evidence for the article’s claim. Section 66A was the provision whose words could not be defended, and it is the one provision the courts removed. The rest of the December 2008 settlement, the offences that filled documented gaps, the blocking power with its committee procedure, the interception power with its unlimited investigative ground, the conditional immunity on which the platform economy runs, and the first data obligation, survived the same litigation that destroyed Section 66A and has survived everything since. The amendment’s defenders and its critics each hold half of that record. What the trail shows, read whole, is a statute transformed in three sitting days at the end of a crisis session, carrying one provision that its own words condemned, and a body of law that India has kept, used and argued inside ever since, because most of it answered needs that outlasted the month that produced it. The trail’s later entries confirm the prediction in detail. The due diligence content of Section 79 was rewritten wholesale in 2021, when the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules replaced the 2011 guidelines and attached fresh obligations, including for the class of significant social media intermediaries, to the retention of the immunity the 2008 text created; the section stood, the rules beneath it changed, and the immunity’s practical price changed with them. The emergency response team’s statutory powers under Section 70B were exercised in 2022 in directions that imposed incident reporting obligations measured in hours on service providers, intermediaries, data centres and body corporates, an intensity of regulation that the 2008 section’s spare text authorises without describing. And the data obligation that Section 43A began was carried into a dedicated statute rather than expanded in place, so that the parent Act’s role in data law contracted to its security and disclosure provisions while the subject it had pioneered moved out. None of these developments required Parliament to reopen the technology statute. All of them were executed inside the frame of December 2008, which is the strongest available evidence for this article’s claim: the amendment did not merely change the parent Act’s provisions, it settled the channels through which Indian technology law would thereafter be made, in rules notified by the executive and in judgments construing a text whose most sensitive clauses no legislature had ever debated.

For the reader who needs the amendment in one grip before the detail, its skeleton is this. The offences live in Sections 66 to 67C, rebuilt and extended in 2008. The powers live in Sections 69 to 69B, substituted and inserted in 2008. The institutions live in Sections 70A and 70B, inserted in 2008. The data duties live in Sections 43A and 72A, inserted in 2008. The immunity lives in Section 79, substituted in 2008. A statute whose operative skeleton can be dated to a single amending Act is a statute whose history is its explanation, and the history, in this case, is three sitting days in December of a year the country remembers for other reasons.

Frequently Asked Questions

Q: What did the IT Amendment Act 2008 add to the parent statute?

It added most of the operative modern statute. It inserted a row of content offences in Sections 66A to 66F, recalibrated Section 67 and added Sections 67A and 67B on sexually explicit material and material depicting children, and added the preservation duty in Section 67C. It substituted Section 69 on interception, added Section 69A on blocking public access and Section 69B on traffic data. It inserted the corporate data obligation in Section 43A and the disclosure offence in Section 72A, rewrote the intermediary exemption in Section 79, gave the emergency response team a statutory charter in Section 70B, widened Section 43 and removed its compensation ceiling, and made the signature regime technology neutral.

Q: Why was the 2008 amendment passed so quickly?

Its passage fell in the first full session of Parliament after the Mumbai attacks of November 2008, in which the government’s security legislation was being moved at speed in a disrupted chamber. The Bill itself had been pending since December 2006 and had been examined by a Standing Committee, so the text was not new. What the record shows is that the Lok Sabha passed it on 22 December 2008, in a sitting dominated by uproar over a minister’s remarks on the killing of a senior police officer in the attacks, together with three other Bills in under half an hour, and the Rajya Sabha passed it the following day without a discussion.

Q: What did Section 66A criminalise?

It criminalised sending, by means of a computer resource or a communication device, information that is grossly offensive or has menacing character; information the sender knows to be false, sent for the purpose of causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal intimidation, enmity, hatred or ill will, persistently through such a resource or device; and any electronic mail or message sent for the purpose of causing annoyance or inconvenience, or to deceive or mislead the recipient about the origin of the message. The punishment was imprisonment that could extend to three years and a fine. None of its operative expressions was defined in the Act.

Q: Which new offences did the 2008 amendment create?

It created the offences in Sections 66A to 66F: sending offensive messages through a communication service, dishonestly receiving a stolen computer resource or communication device, identity theft, cheating by personation by means of a computer resource, violation of privacy by capturing, publishing or transmitting an image of a private area without consent, and cyber terrorism, the last punishable with imprisonment up to life. It also created the offences of publishing or transmitting material containing a sexually explicit act in Section 67A and material depicting children in sexually explicit acts in Section 67B, and the offence of disclosure of information in breach of a lawful contract in Section 72A.

Q: How did the 2008 amendment change intermediary liability?

It replaced a narrow exemption for network service providers, which answered only for liability under the parent Act and required the provider to prove absence of knowledge or due diligence, with a general conditional immunity for intermediaries. Under the substituted Section 79, an intermediary is not liable for third party information, data or a communication link it makes available or hosts, under any law in force, provided its function is limited to providing access to a communication system, it does not initiate the transmission, select the receiver or select or modify the information, and it observes due diligence and the Central Government’s guidelines. The immunity is lost on participation in the unlawful act or on failure to act after knowledge.

Q: What blocking and monitoring powers were added in 2008?

Three. Section 69 was substituted so that the Central or a State Government may direct the interception, monitoring or decryption of any information generated, transmitted, received or stored in any computer resource, on grounds that came to include the investigation of any offence. Section 69A, wholly new, empowered the Central Government to direct that public access to information be blocked, on the state interest grounds stated in the section and under the committee procedure of the 2009 blocking rules. Section 69B, also new, empowered the Central Government to authorise an agency to monitor and collect traffic data or information through any computer resource for cyber security purposes.

Q: What data protection obligation did the amendment introduce?

It introduced Section 43A, the first data protection obligation in Indian law. A body corporate that possesses, deals in or handles sensitive personal data or information in a computer resource it owns, controls or operates, and is negligent in implementing and maintaining reasonable security practices and procedures, is liable to pay damages by way of compensation where the negligence causes wrongful loss or wrongful gain to any person. The categories of sensitive personal data and the content of reasonable security practices were left to rules, which followed in 2011 and covered passwords, financial information, health conditions and records, sexual orientation and biometric information, among others.

Q: Was Section 66A debated in Parliament?

No. The provision appeared in the amendment Bill introduced in 2006, whose first two limbs were examined by the Standing Committee on Information Technology, which recorded no concern about misuse. Its third limb, the electronic mail limb, was inserted by an official amendment moved on 16 December 2008, after the Committee had reported. At passage, the Lok Sabha took the Bill up clause by clause in a sitting disrupted by uproar over an unrelated matter and passed it with three other Bills in under half an hour, and the Rajya Sabha passed it the next day without a discussion. No speech in either House addressed the provision.

Q: When did the IT Amendment Act 2008 come into force?

It was brought into force on 27 October 2009, by notification of the Central Government. The Bill had been passed by the Lok Sabha on 22 December 2008 and by the Rajya Sabha on 23 December 2008, and received the assent of the President on 5 February 2009. Because the amending Act left its commencement to be appointed by notification, there was an interval of over eight months between assent and operation, during which the amended text was enacted law that did not yet govern. The principal rules made under the new interception and blocking powers were notified on the same October date.

Q: What is the Act number of the IT Amendment Act 2008?

It is Act 10 of 2009. The amending Act is named for 2008, the year in which Parliament passed the Bill, in the final days of December. It received the assent of the President on 5 February 2009 and was published in the Gazette on that date, so in the annual sequence of central Acts it carries the number of the year of assent rather than the year in its short title. The parent Act shows the same pattern in reverse form: the Information Technology Act, 2000 is Act 21 of 2000, while the amendment is cited as the Information Technology (Amendment) Act, 2008 (10 of 2009).

Q: How did the 2008 amendment change Section 69 on interception?

It substituted the section and enlarged it in three dimensions. The power moved from the Controller of Certifying Authorities to the Central Government, a State Government or an officer specially authorised by either. Its object widened from intercepting information transmitted through a computer resource to intercepting, monitoring or decrypting any information generated, transmitted, received or stored in any computer resource, which reaches stored data as well as communications in passage. And its grounds widened: to the original heads of sovereignty and integrity, security of the State, friendly relations and public order, it added defence of India and, most consequentially, the investigation of any offence. The duty to assist, and the seven year punishment for failing to assist, were retained.

Q: What is Section 43A of the IT Act?

Section 43A is the compensation provision the 2008 amendment inserted for failures of data security by companies. Where a body corporate possessing, dealing or handling sensitive personal data or information in a computer resource it owns, controls or operates is negligent in implementing and maintaining reasonable security practices and procedures, and that negligence causes wrongful loss or wrongful gain to a person, the body corporate must pay damages by way of compensation to the person affected. It is a civil liability for negligent security, not a set of rights for the individual whose data is held, and its key expressions were defined by the 2011 rules made under it.

Q: What is Section 69A and how does blocking of a website work under it?

Section 69A, inserted by the 2008 amendment, empowers the Central Government or an officer specially authorised by it to direct any government agency or intermediary to block public access to information generated, transmitted, received, stored or hosted in any computer resource, where satisfied that it is necessary or expedient on the grounds the section states, which are the sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign States, public order and preventing incitement to a cognizable offence relating to those heads. The 2009 blocking rules route a request through a designated officer to a committee that examines it, provide for emergency blocking subject to committee review, and require confidentiality of requests.

Q: What did Section 66F do about cyber terrorism?

Section 66F, inserted by the 2008 amendment, created the offence of cyber terrorism and made it the most heavily punished offence in the Act, carrying imprisonment which may extend to imprisonment for life. It covers whoever, with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people or a section of the people, denies access to an authorised person to a computer resource, penetrates or accesses a computer resource without authorisation in an attempt directed at restricted information, or introduces a computer contaminant likely to cause death or injury, damage to or destruction of property, or disruption of supplies or services essential to the life of the community.

Q: What happened to Section 66 of the IT Act in the 2008 amendment?

It was substituted, and the old offence disappeared. As enacted in 2000, Section 66 had punished hacking, defined as destroying, deleting or altering information residing in a computer resource, or diminishing its value or utility, with intent or knowledge that wrongful loss or damage was likely. The substituted Section 66 provides instead that if any person dishonestly or fraudulently does any act referred to in Section 43, the civil compensation provision whose catalogue covers unauthorised access, copying, contamination, damage, disruption, denial of access, facilitation of access and misuse of another’s account, he shall be punished with imprisonment that may extend to three years, or a fine that may extend to five lakh rupees, or both.

Q: What is Section 72A of the IT Act?

Section 72A, inserted by the 2008 amendment, punishes disclosure of information in breach of a lawful contract. It applies to a person, including an intermediary, who has secured access to material containing personal information about another person while providing services under a lawful contract, and who discloses that material, with intent to cause or knowing that disclosure is likely to cause wrongful loss or wrongful gain, without the consent of the person concerned or in breach of the contract. The punishment is imprisonment that may extend to three years, or a fine that may extend to five lakh rupees, or both. It is the criminal companion to the civil data obligation the amendment created in Section 43A.

Q: When was Section 66A struck down by the Supreme Court?

Section 66A was struck down on 24 March 2015, in the judgment in Shreya Singhal v. Union of India. The Supreme Court held the section unconstitutional in its entirety, so the provision inserted by the 2008 amendment ceased to be law a little over five years after it had been brought into force in October 2009. The petitions that produced the judgment had been filed after the provision’s enforcement against online posts in 2012 drew national attention. The reasoning of the judgment, and its treatment of Sections 69A and 79, which were before the same bench, are the subject of the separate article on the judgment; this article records the outcome and the date as part of the amendment’s trail.

Q: What is the statutory basis of CERT-In under the IT Act?

CERT-In, the Indian Computer Emergency Response Team, worked from January 2004 as an executive body and acquired its statutory basis when the 2008 amendment inserted Section 70B into the parent Act. That section provides for the appointment of the agency to serve as the national agency for incident response and lists its functions: collecting, analysing and disseminating information on cyber security incidents, issuing forecasts and alerts, taking emergency measures for handling incidents, coordinating response activities, and issuing guidelines, advisories, vulnerability notes and white papers on information security practices. The section also empowers it to call for information and give directions, with a punishment for failure to provide information called for.

Q: What did the 2008 amendment do to the compensation cap in Section 43?

It removed it. Section 43 of the parent Act, the civil provision under which a person who performs listed acts in relation to a computer, computer system or network without the permission of its owner or person in charge is liable to pay damages by way of compensation, had limited that liability, in the 2000 text, to damages not exceeding one crore rupees. The 2008 amendment recast the section, widened the catalogue of acts it covers, and deleted the ceiling, leaving compensation to be measured by the damage caused. At the same time it fixed the pecuniary remit of the adjudicating officer who decides such claims at five crore rupees, with claims above that figure going to the competent court.

Q: Which other statutes did the IT Amendment Act 2008 amend?

Besides the Information Technology Act itself, the amending Act carried parts amending four older statutes so that their treatment of electronic records aligned with the parent Act’s scheme. It amended the Indian Penal Code, including the provisions on evidence and forgery where electronic records are concerned. It amended the Indian Evidence Act, whose scheme for electronic evidence, including the special provisions on admissibility and the opinion of the Examiner of Electronic Evidence, belongs to this alignment. It amended the Bankers’ Books Evidence Act, in relation to bankers’ books maintained in electronic form. And it amended the Reserve Bank of India Act, inserting into the Reserve Bank’s rule making power an express head covering the regulation of fund transfers through electronic means between banks and financial institutions.