Monitoring Traffic Data for Cyber Security

In one line

The Central Government may by notification authorise an agency to monitor and collect traffic data in any computer resource for cyber security, everyone in charge of a resource must give it online access, and an intermediary that intentionally refuses now faces one year or a fine up to one crore rupees.

In the wording a student can write in an exam: section 69B(1) of the Information Technology Act, 2000 empowers the Central Government, to enhance cyber security and for identification, analysis and prevention of intrusion or spread of computer contaminant in the country, by notification in the Official Gazette to authorise any agency of the Government to monitor and collect traffic data or information generated, transmitted, received or stored in any computer resource.

Why this section is different from the two before it

Section 69 and section 69A are about a particular target. An order names the information or the resource, and is made for reasons recorded in writing in a particular case.

Section 69B is about the network as a whole. It authorises an agency by notification, not by an order in a case, and the purpose is not investigation or public order but cyber security.

And it takes a different kind of material. Not the content of communications but traffic data, that is who spoke to whom, from where, when, for how long and by what service.

The provision itself

Sub-section (1), the authorisation. The Central Government may, to enhance cyber security and for the identification, analysis and prevention of intrusion or spread of computer contaminant in the country, by notification in the Official Gazette, authorise any agency of the Government to monitor and collect traffic data or information generated, transmitted, received or stored in any computer resource.

Sub-section (2), the duty. The intermediary or any person in charge of the computer resource shall, when called upon by the authorised agency, provide technical assistance and extend all facilities to enable online access, or to secure and provide online access, to the computer resource generating, transmitting, receiving or storing such traffic data or information.

Sub-section (3), the safeguards. The procedure and safeguards for monitoring and collecting traffic data or information shall be such as may be prescribed.

Sub-section (4), the penalty. Any intermediary who intentionally or knowingly contravenes sub-section (2) shall be punished with imprisonment which may extend to one year, or shall be liable to fine which may extend to one crore rupees, or with both.

What sub-section (4) used to say. Item (H) of the Jan Vishwas schedule replaced "three years and shall also be liable to fine" with the present words, with effect from 30 November 2023. So the term came down from three years to one, and the fine went up to one crore rupees, and imprisonment and fine became alternatives instead of cumulative.