Cyberspace, and the Trouble with Territory

Everything happens through an intermediary. In the physical world most wrongs are done directly by the wrongdoer. Online, the message reaches its audience only because a series of businesses carried, stored, indexed or displayed it. That single fact is why a whole branch of this subject is about the liability of people who did not write the words.

The four answers legal systems have tried

The first answer was that cyberspace is a separate place that ordinary law should leave alone. This was argued seriously in the 1990s: that the network is a jurisdiction of its own, governed by its own norms, and that a State claiming to regulate it is over-reaching. It has not survived, for the reason that the people using the network live in territories, own property in territories, and can be reached there. It is worth knowing because examination questions still describe cyberspace as a borderless realm, and the honest answer is that it is borderless technically and thoroughly bordered legally.

The second answer is to extend the territory. A State says that its law reaches conduct abroad which affects it. Section 1(2) of the Act does this in terms: the Act applies also to any offence or contravention committed outside India by any person. Section 75 then supplies the limit, that the act must involve a computer, computer system or computer network located in India. Chapter 850 works both. The difficulty is that if every State does this, the same conduct is lawful and unlawful at once, and the person concerned cannot comply with everything.

The third answer is to regulate the intermediary. A State cannot reach a person abroad but can reach the business that serves its market, and can require that business to remove material, to block access, to retain records or to identify a user. This is the dominant answer everywhere, and it is what sections 69A and 79 of the Act, the 2021 Rules, the European Digital Services Act and section 230 of the American Communications Decency Act are all about. Its difficulty is that it makes private companies the decision makers about lawfulness.

The fourth answer is to co-operate. States agree on common offences and on procedures for helping each other, as in the Budapest Convention of 2001. Chapters 590 and 600 work it. Its difficulty is that co-operation is slow, and chapter 880 shows how slow.

The three questions that recur

Prescriptive jurisdiction: whose law applies? May India apply its law to a website hosted abroad which Indian users read?

Adjudicative jurisdiction: which court may decide? May a court in Mumbai entertain a suit against a company with no presence in Maharashtra whose site is accessible there?

Enforcement jurisdiction: can the order be given effect? A decree against a foreign defendant with no assets in India is a piece of paper unless a foreign court will enforce it or an intermediary will act on it.

Keep those three apart. Students routinely answer the first when asked the second. A court can have the power to apply Indian law and still lack territorial jurisdiction over the defendant, and it can have both and still be unable to enforce. Chapters 840 to 900 take them in turn.

A worked example

Karan, in Nashik, runs a blog. He writes that a Bengaluru company's product is dangerous. The blog is hosted on a platform incorporated in Delaware, whose servers for the region are in Singapore. A reader in Dubai forwards the post; a distributor in Nagpur cancels its order.

Ask the three questions.

Whose law? India's, because the writer, the company and the loss are in India, and because the material was published to readers in India. But Singapore's law applies to the copy on the machines there, and the platform's contract with Karan probably applies Californian law.

Which court? The company will sue in Bengaluru or Nagpur, where it carries on business and where the loss was felt. Whether the platform can be joined depends on whether it carries on business in India, which is the question chapter 860 works with Banyan Tree and World Wrestling Entertainment.

Enforcement? A decree against Karan is straightforward. An order against the platform is worth what the platform's willingness or its Indian presence makes it worth, which is why litigants now ask for orders against intermediaries under the 2021 Rules rather than only for damages.

Nothing in that example is unusual. It is the ordinary shape of an internet dispute, and the point is that the mismatch between law and network is not an exotic problem at the edge of the subject. It is the subject.

What this does NOT mean

It does not mean cyberspace is a legal vacuum. Every act done online is done by a person somewhere and touches property and reputation somewhere. The problem is an excess of applicable laws, not an absence.

It does not mean the location of a server settles anything. It is one connecting factor among several, and both Indian and foreign courts have refused to make it decisive, because it would let a party choose its law by choosing a data centre.

It does not mean that "the internet is borderless" is an answer to an examination question. It is the beginning of one. The marks are in showing which of the four responses the law has adopted for the particular problem and what the response costs.

Quick revision

• Cyberspace: the notional space constituted by interconnected networks, in which conduct is connected to many territories and located in none.
• Law is territorial; section 1(2) of the Act extends to the whole of India and then reaches conduct abroad, with section 75 supplying the limit.
• Four causes: no natural borders, contingent and unknown location, identity not fixed to a body, and everything mediated.
• Four responses: leave it alone (abandoned), extend the territory, regulate the intermediary (dominant), co-operate between States.
• Three questions, kept apart: whose law (prescriptive), which court (adjudicative), can it be enforced (enforcement).
• Regulating the intermediary is dominant because it is the only response a single State can make effective on its own, and its cost is that private companies decide what is lawful.

Test yourself

1. Why does the territorial basis of law fit the network badly? Because a State's authority comes from territory, while a single network transaction is simultaneously connected to several territories through the sender, the recipient, the servers and the carriers, and is not located in any of them in the way a physical act is. Neither the participants nor the network treat a border as an event.

2. Distinguish prescriptive, adjudicative and enforcement jurisdiction with one internet example each. Prescriptive: whether Indian law governs a foreign-hosted site read in India. Adjudicative: whether a court in Mumbai may entertain the suit against the foreign host. Enforcement: whether a decree obtained against that host can be given effect, which usually depends on its Indian presence or on a foreign court recognising the decree.

3. Name the four responses legal systems have made and give one instrument for each. Leave it alone, now abandoned. Extend the territory: section 1(2) with section 75 of the IT Act. Regulate the intermediary: section 79 and the Intermediary Guidelines Rules 2021, and the European Digital Services Act. Co-operate: the Budapest Convention on Cybercrime, 2001.

4. What is the cost of the intermediary-regulation response? It puts the decision whether material is unlawful into the hands of private companies acting on notice and under threat of losing an immunity, which produces over-removal, and it makes the extent of a State's reach depend on whether the company has assets or staff in that State.

5. Why is the physical location of a server not decisive? Because it is a commercial decision unknown to the parties, it may be split or changed at will, and making it decisive would let a service choose the law applying to it by choosing a data centre, which would defeat the regulation of every market it serves.