Cyber Terrorism: Section 66F

In one line

The only offence in the Act punishable with imprisonment for life, and it has two limbs that have almost nothing in common: one is about causing harm, and the other is about obtaining information.

In the wording a student can write in an exam: section 66F of the Information Technology Act 2000 defines the offence of cyber terrorism in two limbs. Under limb (A) a person commits it who, with intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people or any section of the people, denies access, penetrates or exceeds authorised access, or introduces a computer contaminant, and by means of such conduct causes or is likely to cause death or injuries to persons or damage to or destruction of property or disrupts or knowing that it is likely to cause damage or disruption of supplies or services essential to the life of the community or adversely affect the critical information infrastructure specified under section 70. Under limb (B) a person commits it who knowingly or intentionally penetrates or accesses a computer resource without authorisation or exceeding authorized access and thereby obtains access to information, data or computer database that is restricted for reasons of the security of the State or foreign relations, or any restricted information with reasons to believe that it may be used to cause or likely to cause injury to specified interests. Whoever commits or conspires to commit cyber terrorism shall be punishable with imprisonment which may extend to imprisonment for life.

Limb (A): the harm limb

Break it into its three requirements, because the section is unreadable until it is broken up.

First, the intent. With intent to threaten the unity, integrity, security or sovereignty of India or to strike terror in the people or any section of the people. This is a specific intent, and it is the element that separates this offence from ordinary hacking. Note that the second alternative, striking terror in any section of the people, does not require any threat to the State.

Second, the conduct. One of three:

• (i) denying or cause the denial of access to any person authorized to access computer resource;
• (ii) attempting to penetrate or access a computer resource without authorisation or exceeding authorized access;
• (iii) introducing or causing to introduce any Computer Contaminant.

Note that (ii) is satisfied by an attempt, so the conduct element does not require success.

Third, the consequence. By means of such conduct, the person:

• causes or is likely to cause death or injuries to persons; or
• causes or is likely to cause damage to or destruction of property; or
• disrupts, or knowing that it is likely to cause damage or disruption of, supplies or services essential to the life of the community; or
• adversely affects the critical information infrastructure specified under section 70.