LLM Group 5 Criminal Law and Criminal Administration Penal Laws Mar 2024 - ATKT Question Paper with Solutions

For full marks, cover: three limbs. Give the salient features as a numbered list of ten, which is quick to write and easy to mark. Then take digital signature in depth, because the examiner has asked for detail and because the technical mechanism is what separates a good answer. Then take the offences grouped by severity rather than by number, and end with the two provisions that are no longer there, which shows currency.

A note on the wording. The paper prints "Discuss III details", which is the setter's slip for "in details". Nothing turns on it.

The salient features

The Information Technology Act, 2000, Act 21 of 2000, received assent on 9 June 2000 and was brought into force on 17 October 2000. Its preamble traces it to United Nations General Assembly resolution A/RES/51/162 of 30 January 1997 adopting the UNCITRAL Model Law on Electronic Commerce.

Five, a regulator. Chapter VI, sections 17 to 34, appoints the Controller of Certifying Authorities, whose functions under section 18 include supervising Certifying Authorities, certifying their public keys, laying down standards and maintaining a public database of their disclosure records, and gives powers of investigation under section 28 and access to computers and data under section 29.

Six, certificates and subscribers. Chapter VII governs the issue, suspension and revocation of electronic signature certificates; Chapter VIII the duties of subscribers, including the duty in section 42 to keep the private key confidential.

Seven, civil liability and adjudication. Section 43 gives compensation for unauthorised access, damage, contamination, disruption or denial of service; section 43A compensation against a body corporate negligent with sensitive personal data; section 46 appoints an adjudicating officer with jurisdiction up to a claim of five crore rupees.

Digital signature, in detail

The definition. Section 2(1)(p) defines a digital signature as authentication of any electronic record by a subscriber by means of an electronic method or procedure in accordance with section 3. The definition is therefore empty until section 3 is read.

The requirement. Section 3(2) provides that the authentication shall be effected by the use of an asymmetric crypto system and hash function which envelop and transform the initial electronic record into another electronic record. The Explanation defines a hash function as an algorithm mapping or translating one sequence of bits into another, generally smaller, set known as the hash result, such that the same record always yields the same hash result, and such that it is computationally infeasible to reconstruct the original record from the hash result and computationally infeasible that two records should produce the same hash result.

Section 3(3) provides that any person may verify the record by use of the public key of the subscriber. Section 3(4) provides that the private key and the public key are unique to the subscriber and constitute a functioning key pair.

The certificate chain. The public key is meaningless unless a stranger can trust that it belongs to the person named. That is the function of Chapter VI and Chapter VII: the Controller licenses Certifying Authorities under section 21, and a licensed Certifying Authority issues an Electronic Signature Certificate under section 35 after satisfying itself of the applicant's identity and of his possession of the private key corresponding to the public key to be listed. Sections 36 to 39 govern the representations made on issue, and the suspension, revocation and notice of revocation of a certificate. Section 42 places the correlative duty on the subscriber to keep the private key confidential and to inform the Certifying Authority without delay if it is compromised.

The secure signature. Section 15 provides that an electronic signature is a secure electronic signature if the signature creation data, at the time of affixing the signature, was under the exclusive control of the signatory and of no other person, and was stored and affixed in such exclusive manner as may be prescribed. The Explanation provides that in the case of a digital signature the signature creation data means the private key of the subscriber. A secure signature is what attracts the evidentiary presumption, formerly section 85B of the Indian Evidence Act, 1872 and now section 86 of the Bharatiya Sakshya Adhiniyam, 2023.

Legal recognition in the courts. Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473, is the reminder that recognition of the signature does not answer the separate question of admissibility of the record. The Supreme Court held that an electronic record produced as secondary evidence is inadmissible without the certificate then required by section 65B(4) of the Evidence Act, that oral evidence cannot cure its absence, and it overruled the contrary observations in State (NCT of Delhi) v. Navjot Sandhu, (2005) 11 SCC 600. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1, confirmed that the certificate is a mandatory condition precedent, overruled Shafhi Mohammad v. State of Himachal Pradesh, (2018) 2 SCC 801, and held that a court may summon the certificate where the device is in the control of a person who will not produce it. The requirement now sits in section 63 of the Bharatiya Sakshya Adhiniyam, 2023.

Up to three years. Section 65, tampering with computer source code required by law to be kept, three years or fine up to two lakh. Section 66, any act referred to in section 43 done dishonestly or fraudulently, three years or fine up to five lakh. Section 66B, dishonestly receiving a stolen computer resource. Section 66C, identity theft by fraudulent use of the electronic signature, password or other unique identification feature of another, three years and fine up to one lakh. Section 66D, cheating by personation using a computer resource. Section 66E, capturing, publishing or transmitting the image of a private area without consent.

Up to two years. Section 71, misrepresentation to the Controller or a Certifying Authority; section 73, publishing an electronic signature certificate false in material particulars; section 74, creating or publishing such a certificate for a fraudulent purpose. These three protect the signature scheme described above and are the reason the two limbs of this question belong together.

Procedure. Section 77B makes offences punishable with three years imprisonment bailable; section 78 requires investigation by an officer not below Inspector; section 77A permits compounding except where the punishment is life or exceeds three years; section 84B and 84C punish abetment and attempt.

Conclusion. The salient features of the Act are legal recognition of electronic records and signatures, electronic governance, rules of attribution, a secure records regime, a Controller and licensed Certifying Authorities, civil compensation with an adjudicating officer up to five crore rupees, an appellate structure, a chapter of offences reaching imprisonment for life, extra-territorial reach under section 75 and an overriding effect under section 81.

The digital signature under section 3 is the device on which the first feature rests, delivering authentication and integrity together through an asymmetric key pair and a hash function, supported by the certificate chain in Chapters VI and VII and widened into a technology neutral electronic signature by section 3A in 2009. The offences in Chapter XI exist to protect that chain and the systems it runs on, and two of them, section 66A and the imprisonment limbs of sections 72 and 72A, have been removed from the statute book since this paper was set.