INFORMATION TECHNOLOGY ACT 2000 The United Nations General Assembly by a resolution (A/RES/51/162), passed on 30 January 1997 has

adopted the Model Law on Electronic Commerce adopted by the United Nations Commission on International Trade Law. This is referred to as the UNCITRAL Model Law on E-Commerce. The above resolution recommends inter alia that all States give favourable consideration to the Model Law when they enact or revise their laws, in view of the need for uniformity of the law applicable to alternatives to paper-cased methods of communication and storage of information; and it is considered necessary to give effect to the resolution and promote efficient delivery of Government services by means of reliable electronic records.

Following the UN Resolution India passed the Information Technology Act 2000 in May 2000. The Act received the assent of the President on the 9th June, 2000 and was notified effective on October 17, 2000. The Information Technology Act 2000 (NO. 21 of 2000) is An Act to provide legal recognition for transactions carried out by means of electronic data interchange and other means of electronic communication, commonly referred to as "electronic commerce", which involve the use of alternatives to paper-based methods of communication and storage of information, to facilitate electronic filing of documents with the Government agencies and further to amend the Indian Penal Code, the Indian Evidence Act, 1872, the Bankers' Books Evidence Act, 1891 and the Reserve Bank of India Act, 1934 and for matters connected therewith or incidental thereto. The Information Technology Act 2000 consists of 94 sections segregated into 13 chapters. Four schedules form part of the Act. The Information Technology Act 2000 addressed the following issues: Legal Recognition of Electronic Documents Legal Recognition of Digital Signatures Offenses and Contraventions Justice Dispensation Systems for Cybercrimes

ITAA 2008 (Information Technology Amendment Act 2008) as the new version of Information Technology Act 2000 is often referred has provided additional focus on Information Security. It has added several new sections on offences including Cyber Terrorism and Data Protection. It was passed by the two houses of the Indian Parliament on December 23, and 24, 2008 and got the Presidential assent on February 5, 2009. It was notified for effectiveness on October 27, 2009. There are 124 sections (excluding 5 sections that have been omitted from the earlier version) and 14 chapters. Schedule I and II have been replaced. Schedules III and IV are deleted.

Some of the Important Definition "Asymmetric crypto system" means a system of a secure key pair consisting of a private key for creating a digital signature and a public key to verify the digital signature; "Certifying Authority" means a person who has been granted a licence to issue a Digital Signature Certificate

under section 24;

"Digital signature" means authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with the provisions of section 3; the term digital signature has been replaced with electronic signature to make the Act more technology neutral as per the amendment in 2008. Electronic signature means that a subscriber may authenticate electronic records by electronic signature. The authentication was earlier possible only by digital signature. "Electronic form" with reference to information means any information generated, sent, received or stored in media, magnetic, optical, computer memory, micro film, computer generated micro fiche or similar device; "Secure system" means computer hardware, software, and procedure that (a) are reasonably secure from unauthorised access and misuse; (b) provide a reasonable level of reliability and correct operation; (c) are reasonably suited to performing the intended functions; and (d) adhere to generally accepted security procedures; "Cyber cafe" means any facility from where access to the internet is offered by any person in the ordinary course of business to the members of the public.

Cyber Security means protecting information, equipment, devices, computer, computer resources, communication devices and information stored therein from unauthorized access, use, disclosure, disruption, modification or destruction. Communication Device means, cell phones, PDA or combination of both or any other device used to communicate, used to send or transmit any other text, video, audio or image. Intermediary with respect to any particular electronic records, means any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record and includes telecom service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online-auction sites, online market places and cyber cafes, but does not include a body corporate referred to in Section 43A. Section 79 of the old Act which exempted intermediaries has been modified to the effect that an intermediary shall not be liable for any third party information data or communication link made available or hosted by him if; o (a) the function of the intermediary is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored or hosted; o (b) the intermediary does not initiate the transmission or select the receiver of the transmission and select or modify the information contained in the transmission; o (c) The intermediary observes due diligence while discharging his duties.

However, section 79 will not apply to an intermediary if the intermediary has conspired or abetted or aided or induced whether by threats or promise or otherwise in the commission of the unlawful act or upon receiving actual knowledge or on being notified that any information, data or communication link residing in or connected to a computer resource controlled by it is being used to commit an unlawful act, the intermediary fails to expeditiously remove or disable access to that material on that resource without vitiating the evidence in any manner.

New Sections: A new section 10A has been inserted to the effect that contracts concluded electronically shall not be deemed to be unenforceable solely on the ground that electronic form or means was used.

The damages of Rs. One Crore (approximately USD 200,000) prescribed under section 43 of the earlier Act for damage to computer, computer system etc has been deleted and the relevant parts of the section have been substituted by the words, he shall be liable to pay damages by way of compensation to the person so affected.

A new section 43A has been inserted to protect sensitive personal data or information possessed, dealt or handled by a body corporate in a computer resource which such body corporate owns, controls or operates. If such body corporate is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, it shall be liable to pay damages by way of compensation to the person so affected.

New Offences
The ITAA 2008 adds 8 offences, 5 of which are added to the ITA 2000 and 3 to IPC. The standing committee had proposed that ITA 2000 should be one comprehensive legislation with less dependence on other penal laws. The new offences are as follows: Section 66: As proposed in ITAA 2006, this section combines contraventions indicated in Section 43 with penal effect and reduces the punishment from 3 years to 2 years. It also introduces the pre-conditions of "Dishonesty" and "Fraud" to the current section 66. The provision ignores Standing committee recommendations. Section 66 A: As proposed in ITAA 2006, this section covers Sending of Offensive messages. Section 66B: It states: Whoever dishonestly receives or retains any stolen computer resource or communication device knowing or having reason to believe that the same to be a stolen computer resource or communication device, shall be punished with imprisonment of either description for a term which may extend to three years or with fine which may extend to rupees one lakh or with both. This section appears to cover theft of computer, laptop, mobile and also information. It can be extended to theft of digital signals of TV transmission as was once envisaged under the Convergence Bill (since discarded). Section 66 C: It states: Whoever, fraudulently or dishonestly make use of the electronic signature, password or any other unique identification feature of any other person, shall be punished with imprisonment of either description for a term that extends up to three years and shall also be liable to fine which may extend to rupees one lakh

This section covers password theft which was earlier being covered under Section 66. Section 66 D: It States: Whoever by means of any communication device or computer resource cheats by personation, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to one lakh rupees. This section covers Phishing which was earlier being covered under Section 66. It may also cover some kinds of e-mail related offences including harassment. Section 66 E: It States: Whoever, intentionally or knowingly captures, publishes or transmits the image of a private area of any person without his or her consent, under circumstances violating the privacy of that persons, shall be punished with imprisonment which may extend to three years or with fine not exceeding two lakh rupees or with both. Explanation: - For the purposes of this section, (a) "Transmit" means to electronically send a visual image with the intent that it be viewed by a person or persons: (b) "Capture" with respect to an image, means to video tape, photograph, film or record by any means (c) "Private area" means the naked or undergarment clad genitals, public area, buttocks or female breast (d) Publishes" means reproduction in the printed or electronic form and making it available to public (e) "Under circumstances violating privacy" means circumstances in which a person can have a reasonable expectation that (i) He or she could disrobe in privacy, without being concerned that an image of his private area was being captured or (ii) Any part of his or her private area would not be visible to the public, regardless of whether that person is in a public or private place. This clause is meant to address "Voyeurism". In ITAA 2006 this was to be included in IPC. This section covers non electronic documents also and may interfere with IPC Section 66F: (1) Whoever,(A) With intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people or any section of the people by(i) Denying or cause the denial of access to any person authorised to access computer resource; or

(ii) Attempting to penetrate or access a computer resource without authorisation or exceeding authorised access; or (iii) Introducing or causing to introduce any computer contaminant; and by means of such conduct causes or likely to cause death or injuries to persons or damage to or destruction of property or disrupts or knowing that it is likely to cause damage or disruption of supplies or services essential to the life of the community or adversely affect the critical infrastructure specified under Section 70, or (B) knowingly or intentionally penetrates or accesses a computer resource without authorization or exceeding authorised access, and by means of such conduct obtains access to information, data or computer database that is restricted for reasons of the security of the state or foreign relations or any restricted information data or computer data base with reasons to believe that such information, data or computer data base so obtained may be used to cause or likely to cause injury to the interests of the sovereignty and integrity of India, the security of the state, friendly relations with foreign states, public order, decency or morality or in relation to contempt of court, defamation or incitement to an offence or to the advantage of any foreign nation, group of individuals or otherwise, commits the offence of Cyber Terrorism (2) Whoever commits or conspires to commit cyber terrorism shall be punishable with imprisonment which may extend to imprisonment for life. This section covers the Cyber Terrorism offence which was one of the recommendations of the Standing committee. The definition however lacks imagination. (A more detailed analysis would be provided separately on this issue.) Section 67: The imprisonment term envisaged under the current ITA 2000 is reduced from 5 years to 3 years. However it is an increase from 2 years compared to ITAA 2006. Section 67A: This covers "Sexually Explicit Content" and was introduced in ITAA 2006. Section 67B: This is a new section added in the ITAA 2008 after the standing committee report. It States: Whoever,(a) Publishes or transmits or causes to be published or transmitted material in any electronic form which depicts children engaged in sexually explicit act or conduct or (b) creates text or digital images, collects, seeks, browses, downloads, advertises, promotes, exchanges or distributes material in any electronic form depicting children in obscene or indecent or sexually explicit manner or (c) Cultivates, entices or induces children to online relationship with one or more children for and on sexually explicit act or in a manner that may offend a reasonable adult on the computer resource or (d) Facilitates abusing children online or

(e) Records in any electronic form own abuse or that of others pertaining to sexually explicit act with children, shall be punished on first conviction with imprisonment of either description for a term which may extend to five years and with a fine which may extend to ten lakh rupees and in the event of second or subsequent conviction with imprisonment of either description for a term which may extend to seven years and also with fine which may extend to ten lakh rupees: Provided that the provisions of section 67, section 67A and this section does not extend to any book, pamphlet, paper, writing, drawing, painting, representation or figure in electronic form(i) The publication of which is proved to be justified as being for the public good on the ground that such book, pamphlet, paper writing, drawing, painting, representation or figure is in the interest of science, literature, art or learning or other objects of general concern; or (ii) which is kept or used for bonafide heritage or religious purposes Explanation: For the purposes of this section, "children" means a person who has not completed the age of 18 years. This section covers "Child Pornography" which was earlier covered under Section 66 and provides some clarifications regarding Kamasutra type of literature.