The document provides an overview of the Information Technology Act of 2000 passed by the Indian Parliament. The key points are: 1. The Act aims to provide legal recognition to electronic transactions and commerce by facilitating electronic filing and use of digital signatures. 2. It defines cybercrimes like hacking and publishing obscene material and prescribes penalties like imprisonment and fines. 3. The Act recognizes digital signatures authenticated by Certifying Authorities as legally valid. It also defines terms like digital signatures, private/public keys, and encryption. 4. It provides for adjudication of cybercrimes and compensation up to Rs. 10 million for offenses like unauthorized access or tampering with computer systems.

1. INFORMATION TECHNOLOGYINFORMATION TECHNOLOGY
ACTACT

2.  Connectivity via the Internet has greatlyConnectivity via the Internet has greatly
abridged geographical distances and madeabridged geographical distances and made
communication even more rapid. Whilecommunication even more rapid. While
activities in this limitless new universe areactivities in this limitless new universe are
increasing incessantly, the need for laws to beincreasing incessantly, the need for laws to be
formulated to govern all spheres of this newformulated to govern all spheres of this new
revolution was felt. In order to keep pace withrevolution was felt. In order to keep pace with
the changing generation the Indianthe changing generation the Indian
Parliament passed Information TechnologyParliament passed Information Technology
(IT) Act, 2000. The IT Act has been(IT) Act, 2000. The IT Act has been
conceptualised on the United Nationsconceptualised on the United Nations
Commission on International Trade LawCommission on International Trade Law
(UNCITRAL) Model Law(UNCITRAL) Model Law

3.  The Act aims at providing legalThe Act aims at providing legal
recognition for transactions carried out byrecognition for transactions carried out by
means of electronic data interchange andmeans of electronic data interchange and
other means of electronicother means of electronic
communications commonly referred to ascommunications commonly referred to as
"electronic commerce" which involve the"electronic commerce" which involve the
use of alternative to paper baseduse of alternative to paper based
methods of communication and storagemethods of communication and storage
of information and aims at facilitatingof information and aims at facilitating
electronic filing of documents with theelectronic filing of documents with the
government agencies.government agencies.

4. Information Technology Act in aInformation Technology Act in a
capsulecapsule
 Called the Information TechnologyCalled the Information Technology
Act, 2000.Act, 2000.
 Came into force in June,2000Came into force in June,2000
 Extends to whole of India and also toExtends to whole of India and also to
people who contravene thepeople who contravene the
provisions of the act outside India.provisions of the act outside India.
 Shall come into force as perShall come into force as per
notification by the Central govt.notification by the Central govt.

5.  The Act applies to the whole of India.The Act applies to the whole of India.
It also applies to any offenceIt also applies to any offence
committed outside India by anycommitted outside India by any
person.person.
 It does not apply to the following.It does not apply to the following.
 a negotiable instrument as defined ina negotiable instrument as defined in
section 13 of the Negotiablesection 13 of the Negotiable
Instruments Act, 1881;Instruments Act, 1881;
 a power-of-attorney as defined ina power-of-attorney as defined in
section 1A of the Power-of-attorneysection 1A of the Power-of-attorney
Act, 1882;Act, 1882;

6.  a trust as defined in section 3 of thea trust as defined in section 3 of the
Indian Trusts Act, 1882;Indian Trusts Act, 1882;
 a will as defined in section 2 (h) of thea will as defined in section 2 (h) of the
Indian Succession Act, 1925 (39 ofIndian Succession Act, 1925 (39 of
1925) including any other1925) including any other
testamentary disposition by whatevertestamentary disposition by whatever
name called;name called;

7.  any contract for the sale or conveyanceany contract for the sale or conveyance
of immovable property or any interestof immovable property or any interest
in such property;in such property;
 any such class of documents orany such class of documents or
transactions as may be notified by thetransactions as may be notified by the
Central Government in the OfficialCentral Government in the Official
Gazette.Gazette.

8. DIGITAL SIGNATURES:DIGITAL SIGNATURES:
LEGITIMACY AND USELEGITIMACY AND USE
 The Act has adopted the Public KeyThe Act has adopted the Public Key
Infrastructure (PKI) for securingInfrastructure (PKI) for securing
electronic transactions. A digitalelectronic transactions. A digital
signature means an authentication ofsignature means an authentication of
any electronic record by a subscriberany electronic record by a subscriber
by means of an electronic method orby means of an electronic method or
procedure in accordance with theprocedure in accordance with the
other provisions of the Act.other provisions of the Act.

9.  Thus a subscriber can authenticate anThus a subscriber can authenticate an
electronic record by affixing his digitalelectronic record by affixing his digital
signature.signature.
 A private key is used to create a digitalA private key is used to create a digital
signature whereas a public key is usedsignature whereas a public key is used
to verify the digital signature andto verify the digital signature and
electronic record.electronic record.
 They both are unique for eachThey both are unique for each
subscriber and together form asubscriber and together form a
functioning key pair.functioning key pair.

10.  Further, the Act provides that when anyFurther, the Act provides that when any
information or other matter needs to beinformation or other matter needs to be
authenticated by the signature of aauthenticated by the signature of a
person, the same can be authenticatedperson, the same can be authenticated
by means of the digital signature affixedby means of the digital signature affixed
in a manner prescribed by the Centralin a manner prescribed by the Central
Government.Government.
 The Act also gives the CentralThe Act also gives the Central
Government powers:Government powers:
 a) to make rules prescribing the digitala) to make rules prescribing the digital
signaturesignature

11. b) the manner in which it shall beb) the manner in which it shall be
affixedaffixed
c) the procedure to identify thec) the procedure to identify the
person affixing the signatureperson affixing the signature
d) the maintenance of integrity,d) the maintenance of integrity,
security and confidentiality of recordssecurity and confidentiality of records
oror
e) payments and rules regarding anye) payments and rules regarding any
other appropriate mattersother appropriate matters

12.  These signatures are to beThese signatures are to be
authenticated by Certifying Authoritiesauthenticated by Certifying Authorities
(CAs) appointed under the Act. These(CAs) appointed under the Act. These
authorities would inter alia, have theauthorities would inter alia, have the
license to issue Digital Signaturelicense to issue Digital Signature
Certificates (DSCs). The applicant mustCertificates (DSCs). The applicant must
have a private key that can create ahave a private key that can create a
digital signature. This private key anddigital signature. This private key and
the public key listed on the DSC mustthe public key listed on the DSC must
form the functioning key pair.form the functioning key pair.

13.  Once the subscriber has accepted theOnce the subscriber has accepted the
DSC, he shall generate the key pairDSC, he shall generate the key pair
by applying the security procedure.by applying the security procedure.
Every subscriber is under anEvery subscriber is under an
obligation to exercise reasonableobligation to exercise reasonable
care and caution to retain control ofcare and caution to retain control of
the private key corresponding to thethe private key corresponding to the
public key listed in his DSC.public key listed in his DSC.

14.  The subscriber must take allThe subscriber must take all
precautions not to disclose theprecautions not to disclose the
private key to any third party. Ifprivate key to any third party. If
however, the private key ishowever, the private key is
compromised, he must communicatecompromised, he must communicate
the same to the Certifying Authoritythe same to the Certifying Authority
(CA) without any delay.(CA) without any delay.

15. DESPATCH & ACKNOWLEDGEMENT-DESPATCH & ACKNOWLEDGEMENT-
ELECTRONIC RECORDSELECTRONIC RECORDS
 All electronic records sent by anAll electronic records sent by an
originator, his agent or anoriginator, his agent or an
information system programmed byinformation system programmed by
or on his behalf are attributable toor on his behalf are attributable to
himhim

16.  Where the originator has not agreedWhere the originator has not agreed
with the addressee that thewith the addressee that the
acknowledgement of receipt ofacknowledgement of receipt of
electronic data shall be given in aelectronic data shall be given in a
manner, the acknowledgement maymanner, the acknowledgement may
be given bybe given by
 Any communication by theAny communication by the
addressee, automated or otherwise;addressee, automated or otherwise;
oror

17.  Any conduct of the addressee,Any conduct of the addressee,
sufficient to indicate to the originatorsufficient to indicate to the originator
that the electronic record has beenthat the electronic record has been
receivedreceived

18.  Where the originator had stipulatedWhere the originator had stipulated
that it shall be binding only onthat it shall be binding only on
receipt of acknowledgement, thenreceipt of acknowledgement, then
unless acknowledgement has beenunless acknowledgement has been
received, it shall mean that thereceived, it shall mean that the
electronic data was never sent.electronic data was never sent.

19.  Where no such stipulation was made,Where no such stipulation was made,
then the originator may give a noticethen the originator may give a notice
to the addressee stating that no suchto the addressee stating that no such
acknowledgement has been receivedacknowledgement has been received
and specifying a time by which theand specifying a time by which the
acknowledgement must be receivedacknowledgement must be received
by him, if still no acknowledgementby him, if still no acknowledgement
is received, he may after givingis received, he may after giving
notice to the addressee treat thenotice to the addressee treat the
electronic data as never sentelectronic data as never sent

20.  Unless otherwise agreed the dispatch ofUnless otherwise agreed the dispatch of
an electronic record occurs when itan electronic record occurs when it
enters a computer resource outside theenters a computer resource outside the
control of the originatorcontrol of the originator

21.  Unless otherwise agreed the timeUnless otherwise agreed the time
of receipt of electronic record shallof receipt of electronic record shall
be determined as follows:be determined as follows:
 if the addressee has designated aif the addressee has designated a
computer resource for the purposecomputer resource for the purpose
of receiving electronic records-of receiving electronic records-
• receipt occurs at the time when thereceipt occurs at the time when the
electronic record enters the designatedelectronic record enters the designated
computer resource; orcomputer resource; or

22.  if the electronic is sent to a resource thatif the electronic is sent to a resource that
is not designated, receipt occurs when itis not designated, receipt occurs when it
is retrieved by the addresseeis retrieved by the addressee

23. Penalty for damage to computer,Penalty for damage to computer,
computer system etc.computer system etc.

24. • “Damage" means to destroy, alter, delete,
add, modify or rearrange any computer
resource by any means

25.  Tampering with the computer sourceTampering with the computer source
documents. Whoever knowingly ordocuments. Whoever knowingly or
intentionally conceals, destroys, orintentionally conceals, destroys, or
alters or causes another to do thealters or causes another to do the
same any computer source codesame any computer source code
used for a computer, computerused for a computer, computer
programme, computer system orprogramme, computer system or
computer network, shall becomputer network, shall be
punishable with imprisonment up topunishable with imprisonment up to
three years, or with fine upto Rs. 2three years, or with fine upto Rs. 2
lakhs or with both.lakhs or with both.

26.  Whoever commits hacking of theWhoever commits hacking of the
computer system shall be punishedcomputer system shall be punished
with imprisonment up to three years,with imprisonment up to three years,
or with fine upto Rs. 2 lakhs or withor with fine upto Rs. 2 lakhs or with
both.both.

27.  Whoever publishes or transmits orWhoever publishes or transmits or
cause to be published any mattercause to be published any matter
which is obscene, shall be punishedwhich is obscene, shall be punished
on first conviction with imprisonmenton first conviction with imprisonment
may extend upped five years with amay extend upped five years with a
fine of upped RS. 1,00,000 (forfine of upped RS. 1,00,000 (for
second and subsequent convictions,second and subsequent convictions,
imprisonment of upped 10 years andimprisonment of upped 10 years and
a fine of upped RS. 2,00,000)a fine of upped RS. 2,00,000)

28.  The government may notify certainThe government may notify certain
computer systems or networks ascomputer systems or networks as
being "protected systems",being "protected systems",
unauthorized access to which may beunauthorized access to which may be
punishable with imprisonment uppedpunishable with imprisonment upped
10 years in addition to a fine.10 years in addition to a fine.

29.  Whoever makes a misrepresentationWhoever makes a misrepresentation
to, or suppresses any material factto, or suppresses any material fact
from the Controller of Certifyingfrom the Controller of Certifying
Authorities and whoever commitsAuthorities and whoever commits
breach of confidentiality and privacy,breach of confidentiality and privacy,
having access to electronic datahaving access to electronic data
under the Act shall be punished withunder the Act shall be punished with
imprisonment for a term which mayimprisonment for a term which may
extend to two years, or with fineextend to two years, or with fine
which may extend to RS. 1,00,000 orwhich may extend to RS. 1,00,000 or
with both.with both.

30.  Penalties have also been prescribedPenalties have also been prescribed
for publishing false digital signaturefor publishing false digital signature
certificates or for use of suchcertificates or for use of such
certificates for fraudulent andcertificates for fraudulent and
unlawful purposes, which isunlawful purposes, which is
imprisonment for a term which mayimprisonment for a term which may
extend to two years, or with fineextend to two years, or with fine
which may extend to Rs. 1,00,000 orwhich may extend to Rs. 1,00,000 or
with bothwith both

31. ADJUDICATION /ADJUDICATION /
COMPENSATIONCOMPENSATION
 The Act provides the following:The Act provides the following:
 a) Damages by way of compensationa) Damages by way of compensation
not exceeding Rs. 10 million may benot exceeding Rs. 10 million may be
imposed for unauthorized access,imposed for unauthorized access,
unauthorized downloading or copyingunauthorized downloading or copying
of data, introduction of computerof data, introduction of computer
viruses or contaminants, disruptionviruses or contaminants, disruption
of systems, denial of access orof systems, denial of access or
tampering with or manipulating anytampering with or manipulating any
computer/network.computer/network.

32.  ““Computer contaminant" means setComputer contaminant" means set
of computer instructions designed:of computer instructions designed:
 - to modify, destroy, record,- to modify, destroy, record,
transmit data or programe residingtransmit data or programe residing
within a computer, computer systemwithin a computer, computer system
or computer network; oror computer network; or
 - by any means to usurp the- by any means to usurp the
normal operation of the computer,normal operation of the computer,
computer system, or computercomputer system, or computer
network;network;

33.  Computer data base" means aComputer data base" means a
representation of information,representation of information,
knowledge, facts, concepts orknowledge, facts, concepts or
instructions in text, image, audio,instructions in text, image, audio,
video are prepared or beingvideo are prepared or being
prepared or produced by a computer,prepared or produced by a computer,
computer system or computercomputer system or computer
network and are intended for use innetwork and are intended for use in
a computer, computer system ora computer, computer system or
computer network;computer network;

34.  ““Computer virus" means any computerComputer virus" means any computer
instruction, information, data orinstruction, information, data or
programme that destroys, damages,programme that destroys, damages,
degrades or adversely affects thedegrades or adversely affects the
performance of a computer resource orperformance of a computer resource or
attaches itself to another computerattaches itself to another computer
resource and operates when aresource and operates when a
programme, data or instruction isprogramme, data or instruction is
executed or some other event takesexecuted or some other event takes
place in that computer resource;place in that computer resource;

35.  b) The Act does provide that nob) The Act does provide that no
penalty imposed under the Act shallpenalty imposed under the Act shall
prevent imposition of any otherprevent imposition of any other
punishments attracted under anypunishments attracted under any
other law for the time being in force.other law for the time being in force.

36.  OFFENCES OUTSIDE INDIAOFFENCES OUTSIDE INDIA
 The provisions of the Act shall alsoThe provisions of the Act shall also
apply to offences or contraventionapply to offences or contravention
outside India, if such offences oroutside India, if such offences or
contravention involves a computer,contravention involves a computer,
computer system or computercomputer system or computer
network located in India.network located in India.

37.  CYBER REGULATIONS APPELLATECYBER REGULATIONS APPELLATE
TRIBUNAL (CRAT)TRIBUNAL (CRAT)
 A Cyber Regulations AppellateA Cyber Regulations Appellate
Tribunal (CRAT) is to be set up forTribunal (CRAT) is to be set up for
appeals from the order of anyappeals from the order of any
adjudicating officer. It consists ofadjudicating officer. It consists of
one person only- the Presidingone person only- the Presiding
Officer.Officer.

38.  No appeal shall lie from an orderNo appeal shall lie from an order
made by an adjudicating officer withmade by an adjudicating officer with
the consent of the parties.the consent of the parties.
 Every appeal must be filed within aEvery appeal must be filed within a
period of forty-five days from theperiod of forty-five days from the
date on which the person aggrieveddate on which the person aggrieved
receives a copy of the order made byreceives a copy of the order made by
the adjudicating officerthe adjudicating officer

39.  As per the Act a provision has beenAs per the Act a provision has been
made to appeal from the decision ofmade to appeal from the decision of
the CRAT to the High Court withinthe CRAT to the High Court within
sixty days of the date ofsixty days of the date of
communication of the order orcommunication of the order or
decision of the CRAT .decision of the CRAT .

40. POWERS OF POLICE TOPOWERS OF POLICE TO
SEARCH, ARREST, ETC.SEARCH, ARREST, ETC.
 A police officer not below the rank ofA police officer not below the rank of
Deputy Superintendent of Police, orDeputy Superintendent of Police, or
any other officer authorised by theany other officer authorised by the
Central Government has the powerCentral Government has the power
to enter any public place and arrestto enter any public place and arrest
any person without a warrant if heany person without a warrant if he
believes that a cyber crime has beenbelieves that a cyber crime has been
or is about to be committed.or is about to be committed.

41.  Public place includes publicPublic place includes public
conveyance, any hotel, any shop orconveyance, any hotel, any shop or
any other place intended for use by,any other place intended for use by,
or accessible to the publicor accessible to the public

42. NETWORK SERVICESNETWORK SERVICES
PROVIDERS / ISPPROVIDERS / ISP
 Network services providers shall notNetwork services providers shall not
be liable under this Act for any thirdbe liable under this Act for any third
party information or data madeparty information or data made
available, if they prove that theavailable, if they prove that the
offence or contravention wasoffence or contravention was
committed without their knowledgecommitted without their knowledge
or that they had exercised all dueor that they had exercised all due
diligence to prevent such offence.diligence to prevent such offence.

43.  Network service provider means anNetwork service provider means an
intermediary:intermediary:
 Third party information means anyThird party information means any
information dealt with by networkinformation dealt with by network
service provider in his capacity asservice provider in his capacity as
intermediaryintermediary

44. OFFENCES BY COMPANIESOFFENCES BY COMPANIES
 In respect of offences by companies, inIn respect of offences by companies, in
addition to the company, every person,addition to the company, every person,
who at the time the contravention waswho at the time the contravention was
committed, was in charge of, and wascommitted, was in charge of, and was
responsible to the company for theresponsible to the company for the
conduct of the business of the company,conduct of the business of the company,
shall be guilty of the contravention, unlessshall be guilty of the contravention, unless
he proves that the contravention tookhe proves that the contravention took
place without his knowledge or that heplace without his knowledge or that he
exercised all due diligence to prevent suchexercised all due diligence to prevent such
contravention.contravention.