How the Internet Works
Chapter Three
Syllabus topic 1.1, "Introduction to Information Technology"
Pages 12 to 16 of 948
In one line
The internet is a network of networks that moves data by breaking it into numbered packets and letting independent machines forward each one towards its destination.
In the wording a student can write in an exam: the internet is a decentralised global system of interconnected computer networks that communicate using a common set of protocols, chiefly the Transmission Control Protocol and the Internet Protocol, under which information is divided into packets that are routed independently between numerically addressed machines and reassembled at the receiving end.
Why a lawyer must know how it works
Every jurisdictional problem in this subject is a consequence of the design. A message from Mumbai to Mumbai may cross three countries. The person who sent it, the machine that stored it and the machine that displayed it may be in three different jurisdictions. No single body owns the network or can switch it off. Those are not opinions; they are consequences of the architecture, and a student who does not know the architecture is reduced to repeating that the internet is borderless without being able to say why.
And the statutory categories track the architecture. The definition of an intermediary in section 2(1)(w) of the Act lists telecom service providers, network service providers, internet service providers, web-hosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes. That is a list of the different roles a machine can play in moving or holding a message, and it makes sense only if you know what those roles are.
Packet switching
The old telephone network worked by circuit switching. When you called somebody, the exchange built a physical path from your handset to theirs and reserved it for the whole call. It was dedicated, it was in order, and if any link in it failed the call dropped.
The internet works the other way. Your message is cut into small pieces called packets. Each packet carries the address it is going to, the address it came from, and a sequence number saying where it belongs in the message. Each packet is then handed to the next machine along, which decides for itself where to send it next. Different packets of the same message may take different routes and arrive out of order, and the receiving machine puts them back in order using the sequence numbers.
Three legal consequences follow immediately. First, there is no single path to intercept, which is why interception under section 69 is done at the service provider rather than on the wire. Second, a message routinely crosses jurisdictions that neither party chose or knows about. Third, the network is robust: designed to survive the loss of links, it cannot be switched off centrally, which is why blocking under section 69A operates on intermediaries rather than on the network.
How the Internet Works
Protocols and the layers
A protocol is an agreed set of rules for how machines talk. The internet works because everybody uses the same ones. Four matter for law.
The Internet Protocol, IP, does addressing and routing. It gives each machine an address and gets packets from one address to another. It makes no promise that they will arrive.
The Transmission Control Protocol, TCP, makes the connection reliable. It numbers the packets, notices which did not arrive, asks for them again, and puts them in order. Together these two are usually written TCP/IP.
The HyperText Transfer Protocol, HTTP, is what browsers and websites speak. Its secure form, HTTPS, wraps the conversation in encryption so that the intermediaries carrying it can see who is talking to whom but not what is said. That single fact is the reason a great deal of modern interception is about metadata rather than content.
The Domain Name System, DNS, translates names into addresses, and it is dealt with below.
IP addresses
Every machine on the internet has a numerical address. In the older and still dominant version, IPv4, it is four numbers from 0 to 255, written as 203.0.113.45. There are about four billion such addresses, which ran out, so a newer version, IPv6, provides a vastly larger space and is written as eight groups of hexadecimal digits.
An address usually identifies a connection, not a person, and often not even a device. Three mechanisms break the link that students assume.
Addresses are usually shared. A home or office router holds one public address and uses network address translation to let every device behind it share that address. So an address identifies the household, not the person at the keyboard.
Addresses are usually temporary. An internet service provider allocates an address to a subscriber for a period and reallocates it afterwards. To connect an address to a subscriber you need the address and the exact time, and you need the provider's logs, which is why the retention obligations in chapter 1230 matter and why a complaint made too late cannot be investigated.
Addresses can be deliberately hidden. A virtual private network, or VPN, routes the traffic through an intermediate server so that the destination sees the VPN's address; a proxy does the same; the Tor network chains several such hops with layered encryption so that no single machine knows both ends.
So an IP address is a starting point for an investigation and never a conclusion. Courts have had to be told this repeatedly, and it is the honest answer to an examination problem that supplies an address and asks who is liable.
How the Internet Works
The Domain Name System
People use names and machines use numbers, and the DNS is the translation. When a browser is given munotes.in it asks a DNS resolver for the corresponding address and then connects to that address.
The name space is hierarchical and it is administered. At the top are the root servers. Below them are the top level domains: generic ones such as .com and .org, and country code ones such as .in for India. Under each, a registry keeps the register and accredited registrars sell registrations to the public. The global coordination of names and numbers is done by the Internet Corporation for Assigned Names and Numbers, ICANN, and .in is administered by the National Internet Exchange of India, NIXI.
That administration is why domain names, alone among internet resources, have a working dispute resolution system. ICANN's Uniform Domain-Name Dispute-Resolution Policy and NIXI's .IN Domain Name Dispute Resolution Policy are contractual conditions of registration, and they allow a trade mark owner to have a name transferred without going to court. Chapter 1070 owns domain names and cybersquatting.
Who does what: the roles in section 2(1)(w)
| Role | What the machine actually does | Where it appears in the Act |
|---|---|---|
| Internet service provider | Connects a subscriber to the network and allocates the address | Named in the section 2(1)(w) list; the entity served with a section 69A blocking direction |
| Telecom or network service provider | Carries traffic between networks | Named in the list; the licensee under the Telegraph Act whose licence carries interception conditions |
| Web hosting service provider | Keeps the files that make up a site and serves them on request | Named in the list; the typical defendant in a takedown |
| Search engine | Indexes what it finds and returns links | Named in the list; the respondent in Sabu Mathew George and in the right to be forgotten cases |
| Online market place or auction site | Lets third parties list and sell | Named in the list; the defendant in the Bazee.com prosecution and in Christian Louboutin |
| Cyber cafe | Offers public access; separately defined in section 2(1)(na) | Governed by its own rules, worked in chapter 1430 |
Nothing in that list is about ownership of content. Every one of them is a description of a service performed on somebody else's message, which is precisely why the safe harbour in section 79 is available to all of them and why chapter 1360 has to work out its conditions carefully.
Client, server and the cloud
A server is a machine that waits for requests and answers them; a client is the machine that asks. Your phone is the client, the machine holding the website is the server.
How the Internet Works
Cloud computing means renting somebody else's servers, so the data of an Indian business may sit on machines in Singapore owned by a company in the United States and operated by staff in Ireland. That single arrangement produces most of the hard questions in chapter 1030 and in chapter 880 on getting evidence from abroad.
A worked example: what happens when Priya opens a website
Priya, in Thane, types munotes.in into her browser.
Her computer asks a DNS resolver, usually run by her internet service provider, for the address matching that name. The resolver answers with an IP address.
Her computer opens a TCP connection to that address and sends an HTTPS request for the page. The request leaves her laptop, goes to her router, which replaces her private address with the household's public address, then to her internet service provider, then across one or more networks, possibly through a submarine cable and a different country, to the machine that hosts the site.
The server answers with the page, cut into packets, which return by whatever route is available and are reassembled by her machine.
Now ask the legal questions. Whose computer resource was used? Hers, her provider's, several carriers' and the host's. Where did the transaction happen? In at least two countries. Who is an intermediary here? Her internet service provider, every carrier in between, and the web host. What could each of them see? Her provider saw that she connected to that address at that time; because the connection was encrypted, it did not see what she read. Which of them could be ordered to block the page? Her provider, under section 69A, and the host, under the same power or under rule 3(1)(d) of the 2021 Rules.
Every one of those answers is worked in a later chapter. The point here is that all of them are questions about the mechanics.
What this does NOT mean
It does not mean nobody governs the internet. ICANN administers names and numbers, the Internet Engineering Task Force sets the protocols, the regional registries allocate addresses, and every national government regulates the providers within its territory. There is no single owner, which is a different thing.
It does not mean traffic between two Indian users stays in India. It often does not, because routing follows commercial and technical convenience, and because the service may be hosted abroad.
It does not mean an IP address identifies a person. It identifies a connection at a time, and only the provider's logs link that to a subscriber, who may not be the user.
It does not mean encryption defeats all investigation. Encryption of the content leaves the metadata visible: who connected to whom, when, and how much passed. Section 69B and the traffic data rules exist for exactly that layer, and chapter 820 owns them.
How the Internet Works
Quick revision
- Packet switching: the message is cut into numbered packets, routed independently and reassembled. Hence no single path, routine crossing of borders, and no central switch.
- TCP/IP: IP addresses and routes, TCP makes it reliable. HTTPS encrypts the content but not the fact of the connection. DNS turns names into numbers.
- An IP address is shared, temporary and maskable. It needs the provider's log plus the exact time to reach a subscriber, and the subscriber is not necessarily the user.
- DNS is administered, by ICANN globally and NIXI for .in, which is why domain names have the UDRP and INDRP.
- Section 2(1)(w) lists intermediaries by the role they play in moving or holding somebody else's message. Section 2(1)(na) separately defines a cyber cafe.
- Cloud computing means the data is on rented servers, often abroad, which produces the jurisdiction and evidence problems of Module III.
Test yourself
1. Explain packet switching and give two legal consequences. The message is divided into packets, each carrying source, destination and sequence number, and each routed independently to be reassembled at the far end. Consequences: there is no single path to intercept, so interception is done at the service provider under section 69 rather than on the wire; and packets routinely cross States neither party chose, which is the root of the jurisdiction problem in topic 3.4.
2. A complainant gives the police an IP address. What else does an investigator need before anybody can be identified? The exact date and time of the connection, because addresses are reallocated; the internet service provider's subscriber logs for that period, which are retained only for a limited time; and evidence connecting the subscriber's connection to the individual, because a household address is shared and may be behind a VPN or proxy.
3. What is DNS and why does it matter legally? It is the hierarchical system translating domain names into IP addresses. It matters because it is administered rather than anarchic, which is what makes the UDRP and INDRP dispute policies possible and what makes DNS-level blocking technically feasible.
4. Why does the definition of intermediary in section 2(1)(w) list so many different businesses? Because each is a different role performed on somebody else's electronic record: carrying it, storing it, indexing it, or providing a place for it. The safe harbour in section 79 turns on the service performed rather than on the kind of company, so the list describes functions.
5. If a page is served over HTTPS, what can the internet service provider see? That the subscriber's connection contacted a particular address at a particular time and how much data passed, which is traffic data. It cannot ordinarily read the content. This is why section 69B and the Monitoring and Collecting Traffic Data Rules 2009 address the metadata layer separately from section 69.
The rest of this subject
These notes are cut from the University's printed syllabus. Open the syllabus itself, or the past papers, for the same subject.