Penalty and Compensation: Section 43

In one line

Section 43 lists ten things a person may not do to a computer without permission, makes each of them give rise to unlimited compensation without any mental element, and by doing so defines the conduct that section 66 turns into an offence.

The opening words

If any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network,--

Four points before the clauses.

"Without permission" is the whole mental element. There is no requirement of dishonesty, fraud, intention or knowledge. A person who exceeds an authorisation is within the section as much as one who had none.

Permission may come from the owner or from a person in charge, so a system administrator's permission suffices, and a person who has permission from neither is liable.

The section is civil. Its consequence is compensation, adjudicated by an adjudicating officer under section 46, and it is not an offence. Chapter 1120.

And it is the definition section for section 66, which reads "If any person, dishonestly or fraudulently, does any act referred to in section 43". Chapter 1180.

The ten clauses

(a) accesses or secures access to such computer, computer system or computer network or computer resource. The words "or computer resource" were added in 2008, which widened it to data, databases and software.

(b) downloads, copies or extracts any data, computer database or information, including information or data held or stored in any removable storage medium. So copying to a memory stick is within it, and this is the data theft clause.

(c) introduces or causes to be introduced any computer contaminant or computer virus. Both defined in the Explanation.

(d) damages or causes to be damaged the computer, system, network, data, database or any other programmes residing in it. "Damage" is defined as to destroy, alter, delete, add, modify or rearrange any computer resource by any means.

(e) disrupts or causes disruption. The denial of service clause.

(f) denies or causes the denial of access to any person authorised to access by any means. Ransomware fits (c), (d) and (f) at once.

(g) provides any assistance to any person to facilitate access in contravention of the Act, rules or regulations. The clause that reaches an insider who shares a password, and the only clause about helping rather than doing.

(h) charges the services availed of by a person to the account of another person by tampering with or manipulating a computer, system or network. Theft of service, which reaches the salami attack and unauthorised use of a paid account.

(i) destroys, deletes or alters any information residing in a computer resource, or diminishes its value or utility, or affects it injuriously by any means. Inserted in 2008 and the widest clause in the section. Note "diminishes its value or utility": economic harm without physical alteration is enough.