The Information Technology (Amendment) Act, 2008

What the amendment substituted or rewrote

Section 66 was rewritten completely. It had been headed "Hacking with computer system" and had contained its own definition of the conduct. It now reads: if any person, dishonestly or fraudulently, does any act referred to in section 43, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both. The word hacking left the statute. Chapter 1180 works the consequences, and the point worth noticing here is that a criminal provision now borrows its conduct from a civil one.

Section 43 was widened. The one crore rupee cap on compensation was removed, so compensation is now at large, and the list grew from eight entries to ten: clause (i), destroying, deleting or altering information or diminishing its value or utility, and clause (j), stealing, concealing, destroying or altering computer source code with intent to cause damage, were both inserted.

Section 46 gained sub-section (1A), giving the adjudicating officer jurisdiction where the claim for damage does not exceed five crore rupees and vesting jurisdiction above that in the competent court. Chapter 1120 works it.

Section 69 was substituted. The original section 69 was a decryption power in narrow terms. The new one is a full interception, monitoring and decryption power with five stated grounds, and chapter 800 works it with the 2009 Rules.

Section 79 was substituted whole, and Chapter XII was rewritten around it. The original section 79 gave a network service provider a defence of proving that the contravention was committed without its knowledge or that it had exercised all due diligence. The new section confers an exemption subject to three conditions, and chapter 1360 works it.

Section 2 gained six definitions: communication device, cyber cafe, cyber security, electronic signature, Electronic Signature Certificate and Indian Computer Emergency Response Team; and two were substituted, computer network and intermediary. Chapters 150 and 160 own them.

Section 67 was rewritten, and the sentence structure changed: the maximum on first conviction became three years and five lakh rupees, and on second or subsequent conviction five years and ten lakh rupees.

The First and Second Schedules were substituted.

What the amendment omitted

Sections 91 to 94 were omitted as spent, having carried the amendments to the Indian Penal Code, the Indian Evidence Act 1872, the Bankers' Books Evidence Act 1891 and the Reserve Bank of India Act 1934.

Section 20 was omitted, which had made the Controller a repository of all Digital Signature Certificates.

The five things the amendment changed in kind

One: from one technology to many. Sections 3A and 15, with the Second Schedule, replaced a statute that recognised only the asymmetric crypto system with one that can recognise any technique the Central Government specifies. Chapter 290 works it. This is the 2001 Model Law's philosophy arriving eight years late.

Two: from one offence to a graded set. The original Act had section 65 and section 66, and the second was headed hacking. The amendment produced sections 66 and 66A to 66F, each with its own conduct and its own sentence, running from three years for computer-related offences to imprisonment for life for cyber terrorism. Chapter 1090 shows the resulting scheme.

Three: from silence to a surveillance code. Sections 69, 69A and 69B, with the three sets of Rules of 2009, are the Indian State's principal powers over the network, and none existed in this form before. Chapters 800 to 820 work them.

Four: from no institutions to three. Section 70A creates the national nodal agency for critical information infrastructure protection, section 70B creates CERT-In as the national agency for incident response, and section 79A provides for notified Examiners of Electronic Evidence. Chapters 780, 760 and 1270.

Five: from a defence to a conditional immunity. The new section 79 is the difference between an intermediary having to prove absence of knowledge and diligence in every case, and having an exemption it keeps by observing due diligence and acting on actual knowledge. Chapter 1360 works it.

A worked example

The same facts under the two versions of the Act.

In 2007, a user of an online marketplace lists an obscene video clip for sale. Another user buys it. The clip is transmitted.

Under the Act as it then stood. The seller has published obscene material in electronic form and is caught by section 67. The marketplace has published nothing and has no exemption designed for it: section 79 as it then read gave a network service provider a defence on proof of no knowledge and all due diligence, and it was arguable whether a marketplace was a network service provider at all. The chief executive was prosecuted. There was no provision at all reaching the buyer's onward transmission by phone.

Under the Act as amended. The seller is caught by section 67 and, if the material is sexually explicit, by section 67A. The marketplace is an intermediary within the substituted section 2(1)(w), which now names online-market places expressly, and section 79(1) exempts it from liability for third party information it did not initiate, select the receiver of, or select or modify, provided it observes due diligence and takes down on actual knowledge. Section 79(3)(b), as read down in 2015, makes actual knowledge mean a court order or a government notification. Section 85 governs when an officer of the company is liable. And the buyer's onward transmission by mobile phone is reached because section 67 covers transmitting, and a communication device is now defined.

The comparison is the answer to a question about what the amendment achieved, and it also shows what it cost: section 66A, drafted in the same amendment, was so wide that it was struck down.

What this does NOT mean

It does not mean the Act was renamed. The principal Act is still the Information Technology Act, 2000. The amending Act is Act 10 of 2009, commonly called ITAA 2008 after the year the Bill was passed.

It does not mean everything since 2009 is unchanged. The Finance Act 2017, the Digital Personal Data Protection Act 2023 and the rules of 2021 and 2026 have all changed the Act or the law around it, and chapter 190 works them.

It does not mean the amendment was well received. Section 66A was struck down as unconstitutional. Sections 69 and 69A are criticised as executive powers with no judicial oversight. The manner of passage, without effective debate in December 2008, is a standing complaint. A good answer says all three.

Quick revision

• Act 10 of 2009, in force 27 October 2009. Bill passed 23 December 2008; the Expert Committee had reported in 2005; the Mumbai attacks of November 2008 are the reason for the manner of passage.
• Every lettered section is a later insertion, and almost all are from this amendment: 3A, 6A, 7A, 10A, 40A, 43A, 52A to 52D, 66A to 66F, 67A to 67C, 69A, 69B, 70A, 70B, 72A, 77A, 77B, 79A, 84A to 84C.
• Rewritten: section 66, which now borrows its conduct from section 43 and drops the word hacking; section 43, cap removed and clauses (i) and (j) added; section 69, now a full interception power; section 79, now a conditional immunity; section 67; and section 2, with six new definitions and two substituted.
• Section 46(1A) gave the adjudicating officer the five crore rupee limit.
• Omitted: sections 91 to 94 as spent, and section 20.
• Five changes in kind: one technology to many; one offence to a graded set; silence to a surveillance code; no institutions to three; a defence to a conditional immunity.

Test yourself

1. Name six sections inserted by the 2008 amendment and say what each does. Section 43A, compensation for a body corporate's failure to protect sensitive personal data. Section 66C, identity theft. Section 66E, violation of privacy. Section 66F, cyber terrorism. Section 69A, blocking public access to information. Section 70B, CERT-In. Any six of the lettered sections listed above will do, provided the function is stated.

2. How did the amendment change section 66, and why does that matter? It replaced the offence of hacking with a provision punishing any act referred to in section 43 done dishonestly or fraudulently. It matters because a criminal offence now takes its conduct from a civil compensation provision, so the ten clauses of section 43 define the actus reus of section 66, and the entire criminal liability turns on the two mental elements, dishonestly and fraudulently, which the Act borrows from the general penal law.

3. What was the position of an intermediary before 2009 and what is it now? Before, section 79 gave a network service provider a defence if it proved that the contravention was committed without its knowledge or that it had exercised all due diligence, which put the burden on the provider in every case and left it unclear which businesses qualified. Now section 79(1) exempts an intermediary from liability for third party information provided it did not initiate the transmission, select the receiver or select or modify the information, and provided it observes due diligence and acts on actual knowledge under section 79(3)(b).

4. Give three criticisms of the amendment. It was passed on 23 December 2008 in the aftermath of the Mumbai attacks without effective debate. Section 66A was drafted so widely that it was struck down as unconstitutional in 2015. And the surveillance powers in sections 69, 69A and 69B were conferred on the executive with review by a committee of officials rather than any judicial oversight.

5. Why is a book or judgment dated before 27 October 2009 unsafe on this subject? Because the amendment inserted twenty-seven sections, substituted section 66, section 69, section 79 and both Schedules, added six definitions and substituted two more. Almost every provision a student meets in Modules III and IV came from it, and the pre-amendment Act has a different section 66, a different section 79 and no sections 43A, 66A to 66F, 67A to 67C, 69A, 69B, 70A, 70B or 72A at all.