18. Ethics, the Law and a Safe Kali Lab
18.2 Indian Cyber Law: The IT Act, 2000 (Verify Every Number)
India madhe cyber gunhyansathi mukhya kayda mhanje Information Technology Act, 2000 (2008 madhe motha amendment zala). Khali mukhya sections dile aahet. He aakde swatah verify kara – official srot indiacode.gov.in aani indiacode.ecourtsindia.com. Kayde badalu shaktat, mhanun kontyahi interview kiwa report aadhi taje text bagha.
| Section | What it covers | Consequence (verify current text) |
|---|---|---|
| 43 | Unauthorised access, downloading/copying data, introducing a virus, damage, denial of access, etc. – civil | Liable to pay damages by way of compensation to the affected person (adjudicated under s. 46) |
| 43A | A company being negligent with sensitive personal data | Civil compensation to affected persons |
| 65 | Tampering with computer source documents required to be kept by law | Up to 3 years, or fine up to ₹2 lakh, or both |
| 66 | Doing any s. 43 act dishonestly or fraudulently (the "hacking" offence) | Up to 3 years, or fine up to ₹5 lakh, or both |
| 66B | Dishonestly receiving a stolen computer resource or device | Up to 3 years, or fine up to ₹1 lakh, or both |
| 66C | Identity theft – misusing someone's password, e-signature or unique ID | Up to 3 years and fine up to ₹1 lakh |
| 66D | Cheating by personation using a computer resource | Up to 3 years and fine up to ₹1 lakh |
| 66E | Violation of privacy (capturing/publishing private images) | Up to 3 years, or fine up to ₹2 lakh, or both |
| 66F | Cyber terrorism | Up to life imprisonment (non-bailable) |
| 70 | Securing/attempting access to a "protected system" | Up to 10 years, and fine |
| 72 | Breach of confidentiality and privacy | Up to 2 years, or fine up to ₹1 lakh, or both |
The two you will meet most as an ethical hacker are s. 43 (civil liability for unauthorised access and damage) and s. 66 (the same act done dishonestly/fraudulently becomes a criminal offence). Notice the pattern: s. 43 lists the acts; s. 66 adds dishonest/fraudulent intent and makes it a crime. Courts have also held (Gagan Harsh Sharma v. State of Maharashtra, 2018) that ss. 43/66 must not be used to dress up a private civil dispute as a crime – intent matters.
Why this matters for security
The law does not care that a tool is "educational". Running Nmap or sqlmap against a system you do not own can already be "securing access" or "disruption" under s. 43, and with dishonest intent it becomes s. 66. Written permission is exactly what turns the same technical action from a crime into a paid profession.
Ravindra Bagale's Tip
When quoting section numbers in an interview or in notes, many students state an old or wrong fine. Rather than memorising numbers, understand them: s. 43 = civil (compensation), s. 66 = criminal (dishonest intent). And always honestly add "as per the current IT Act, please verify the latest text" – the law changes.
Ravindra Bagale's Tip – मराठी
Interview किंवा notes मध्ये section number सांगताना बरेच students जुना किंवा चुकीचा fine सांगतात. Numbers पाठ करण्यापेक्षा समजून घ्या: s. 43 = civil (compensation), s. 66 = criminal (dishonest intent). आणि नेहमी "as per the current IT Act, please verify the latest text" असं प्रामाणिकपणे जोडा – कायदा बदलतो.
Ravindra Bagale's Tip – हिंदी
Interview या notes में section number बताते समय बहुत से students पुराना या गलत fine बता देते हैं. Numbers रटने से बेहतर है समझ लो: s. 43 = civil (compensation), s. 66 = criminal (dishonest intent). और हमेशा ईमानदारी से "as per the current IT Act, please verify the latest text" जोड़ो – क़ानून बदलता है.
Practice task
Open indiacode.gov.in, find the live text of sections 43 and 66, and write in your own words the one difference that turns a section 43 act into a section 66 offence. Note the date the text was last updated.