Cyber Terrorism

In one line

Attacking a computer resource with intent to threaten India's unity, integrity, security or sovereignty or to strike terror, in one of three ways and with one of five consequences, or knowingly breaking into restricted data, is cyber terrorism, punishable with imprisonment for life.

In the wording a student can write in an exam: by section 66F(2) of the Information Technology Act, 2000 whoever commits or conspires to commit cyber terrorism shall be punishable with imprisonment which may extend to imprisonment for life.

Why the Act has a terrorism offence at all

Because a computer can do what a bomb does. Shutting a power grid, a hospital's records or an air traffic system causes death and disruption without any explosive, and none of the Act's other offences carries a punishment that reflects that.

And because the terrorism statutes were written for physical acts. The Prevention of Terrorism Act, 2002 spoke of bombs, weapons and hazardous substances. Section 66F, inserted by Act 10 of 2009 with effect from 27 October 2009, put the same idea into the language of computer resources.

The provision itself, sub-section (1)(A)

The intent. To threaten the unity, integrity, security or sovereignty of India, or to strike terror in the people or any section of the people.

By one of three means.

(i) denying or causing the denial of access to any person authorised to access a computer resource; or

(ii) attempting to penetrate or access a computer resource without authorisation or exceeding authorised access; or

(iii) introducing or causing to introduce any computer contaminant.

And by that conduct producing one of these results. Causing, or being likely to cause, death or injuries to persons; or damage to or destruction of property; or disrupting, or knowing it is likely to cause damage or disruption of, supplies or services essential to the life of the community; or adversely affecting the critical information infrastructure specified under section 70.

Note the reach of the means. Limb (ii) includes an attempt to penetrate, and includes exceeding authorised access, so an insider who goes beyond his permissions is within it.

The provision itself, sub-section (1)(B)

The conduct. Knowingly or intentionally penetrates or accesses a computer resource without authorisation or exceeding authorised access.

The result. By that conduct obtains access to information, data or a computer database that is restricted for reasons of the security of the State or foreign relations; or any restricted information, data or database, with reasons to believe that what is obtained may be used to cause or is likely to cause injury to:

the interests of the sovereignty and integrity of India, the security of the State, friendly relations with foreign States, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence, or to the advantage of any foreign nation, group of individuals or otherwise.