MODULE 1
MODULE 1
Interface of Technology and Law -Jurisdiction in Cyber Space and Jurisdiction in Traditional Sense
Need for Cyber Law – Cyber space and its challenges to legal fraternity
Jurisdictional issues
Jurisdictional and criminal regulation of Cyber space in the fundamental context of nation state's
sovereignty principle
NATURE OF CYBERSPACE
Cyberspace refers to the interconnected digital realm created by the global network of computers and the
Internet. It encompasses all aspects of the digital world, including the infrastructure (such as servers,
routers, and networks), the data transmitted and stored, and the virtual experiences and interactions that
occur within it. Cyberspace is intangible, yet it has a significant influence on the physical world by facilitating
communication, commerce, education, and entertainment.
CHARACTERISTICS OF CYBER SPACE
Intangible Space
Global Reach
No Central Authority
Interactive Environment
Anonymity and Hidden Identities
Ever-Expanding Network
Complex Layers
Fast and Accessible
Communication and Social Connections
Digital Economy and Commerce
Information Sharing.
SCOPE OF CYBERSPACE
The scope of cyberspace is vast, covering multiple dimensions that influence social, economic, political, and
technological aspects:
Social Interactions: Includes social media, online forums, virtual communities, and digital communications,
transforming how people connect and share ideas.
Economic Activities: Encompasses e-commerce, online banking, digital marketing, and blockchain
technology, reshaping global trade and finance.
Educational Resources: Provides access to online learning platforms, research databases, and digital
collaboration tools, democratizing knowledge.
Political Arena: Involves digital governance, online activism, and the impact of information technology on
political processes.
Security Challenges: Introduces issues such as cybercrime, data breaches, digital espionage, and the
necessity for robust cybersecurity measures.
EVOLUTION OF CYBERSPACE
The development of cyberspace has been a continuous and transformative process, marked by several
stages:
1. Early Foundations (1960s–1970s): The concept of networked communication began with research projects
like ARPANET, which laid the groundwork for the Internet. Packet-switching technology was developed,
allowing data to be transmitted efficiently.
2. Internet Growth (1980s–1990s): The Internet became widely accessible to the public. The invention of the
World Wide Web (by Tim Berners-Lee in 1989) revolutionized how information was shared. This period also
saw the development of early web browsers and the introduction of email as a communication tool.
3. Dot-Com Era (Late 1990s–Early 2000s): The commercialization of the Internet led to a boom in online
businesses, the proliferation of websites, and innovations in e-commerce. However, it was also a time of
significant financial speculation, leading to the dot-com bubble burst.
4. Web 2.0 and Social Media (2000s): This era saw the rise of user-generated content, social networking
platforms (like Facebook, Twitter, and YouTube), and interactive websites. The Internet evolved from being a
static information repository to a dynamic and participatory space.
5. Mobile Internet and the Cloud (2010s): The widespread adoption of smartphones and mobile applications
changed how people interacted with cyberspace. Cloud computing enabled scalable storage and processing
capabilities, giving rise to services like Google Drive and Amazon Web Services.
6. Present and Future Trends: The modern era is characterized by the Internet of Things (IoT), artificial
intelligence, augmented and virtual reality, blockchain technology, and the emergence of concepts like the
metaverse. The increasing reliance on cyberspace has amplified discussions around privacy, digital ethics,
and cybersecurity.
Digital Signature Certificates – Securing Electronic Records and Secure Digital Signatures
• Duties of Subscribers
JURISDICTION
The Information Technology Act, 2000 (IT Act) provides specific provisions for jurisdiction over cybercrimes,
electronic transactions, and other matters governed by the Act. Below are the relevant sections detailing
the jurisdiction under the IT Act:
1. Section 1(2) - Territorial Jurisdiction
The IT Act extends to the whole of India and applies to any offense or contravention committed outside
India by any person, if the act involves a computer, computer system, or computer network located in India.
This provision gives the IT Act extraterritorial jurisdiction, meaning it can apply to cybercrimes committed
outside of India if they involve resources within Indian territory.
2. Section 46 - Adjudicating Officer’s Jurisdiction
Under Section 46, an Adjudicating Officer is appointed to adjudicate cases involving contraventions of the
Act, particularly those related to unauthorized access, data theft, and privacy breaches.
The Adjudicating Officer has jurisdiction over cases where the claim for damage does not exceed ₹5 crore.
For claims above this amount, the matter falls within the jurisdiction of civil courts.
3. Section 48 - Cyber Appellate Tribunal
The Cyber Appellate Tribunal (CAT) is established under Section 48 to hear appeals against decisions made
by the Adjudicating Officer.
This Tribunal operates as an appellate body, offering a specialized forum for cyber-related disputes, thereby
bypassing traditional courts for these matters. Appeals from the Tribunal can be further taken to the High
Court.
4. Section 61 - Exclusion of Jurisdiction of Civil Courts
Section 61 states that no civil court shall have jurisdiction over matters that fall under the jurisdiction of the
Adjudicating Officer or the Cyber Appellate Tribunal.
This provision effectively limits traditional civil courts' involvement in IT Act matters, streamlining cases to
the Adjudicating Officer and the Cyber Appellate Tribunal.
5. Section 75 - Extraterritorial Jurisdiction
Section 75 provides for the extraterritorial application of the IT Act. It states that the provisions of the Act
apply to offenses or contraventions committed outside India by any person, regardless of nationality, if the
offense involves a computer, computer system, or network located in India.
This provision ensures that foreign nationals and organizations can be held accountable under Indian law for
cybercrimes affecting Indian interests.
6. Section 80 - Powers of Police to Investigate and Enter Premises
Section 80 grants police officers not below the rank of an Inspector the power to enter, search, and arrest
without a warrant any person found committing a cyber offense under the IT Act.
This section gives enforcement authorities the jurisdiction to conduct search and seizure operations in
cases of suspected cybercrimes and enhances the power of Indian law enforcement to respond promptly to
cyber offenses.
This section is pivotal as it establishes that electronic records have the same legal standing as paper
documents. It means that any information stored or processed digitally is considered valid and binding
under Indian law, provided it is accessible for future reference. This recognition is essential for transactions
and records in e-governance, allowing government and business entities to replace traditional paperwork
with digital records, which are easier to store, retrieve, and manage.
Section 5 - Legal Recognition of Digital Signatures:
Section 5 equates digital signatures with handwritten signatures, granting them the same validity. Digital
signatures authenticate the identity of the signer and confirm that the record has not been tampered with.
This legal backing allows individuals and businesses to sign documents electronically with confidence,
streamlining the process for online contracts, tax filings, and other official documents. These procedures
ensure the authenticity, integrity, and security of the electronic signature. Once these conditions are met,
an electronic signature is legally equivalent to a handwritten one, thus enabling secure, remote signing of
documents
Section 6 - Use of Electronic Records and Digital Signatures in Government Transactions:
This section allows government agencies to adopt electronic records and digital signatures for their official
processes. By legally accepting digital submissions and signatures, government departments can facilitate
faster and more efficient online services, such as applying for permits, licenses, or submitting compliance
documents.
Section 6A - Delivery of Services by Service Providers:
Section 6A empowers the government to specify certain services for online delivery through authorized
service providers. This enables the outsourcing of services like digital tax filing and online passport
applications, encouraging public-private partnerships for e-governance and expanding the range of
government services that can be accessed digitally.
Section 7 - Retention of Electronic Records:
Section 7 requires electronic records to be retained for the legally specified duration, similar to paper
documents. It establishes criteria for ensuring the accessibility, integrity, and retrievability of stored
electronic records. This provision allows businesses and government agencies to maintain legally compliant
records while reducing physical storage space.
Section 7A: Audit of Documents Maintained in Electronic Form
Purpose: This section applies audit requirements to electronic records, ensuring that they meet the same
legal standards as paper-based records. Audits are a key part of ensuring the accuracy and integrity of
records, especially for businesses and governmental entities.
Effect: Electronic records are subject to audits to verify their compliance with relevant laws. This ensures
that digital documents are reliable and can be inspected as part of legal or financial oversight.
Section 8: Publication of Rule, Regulation, etc., in Electronic Gazette
Purpose: This section allows government rules, regulations, notifications, and other official documents to be
published electronically in the Official Gazette. The Official Gazette is a public journal where the government
publishes legal notifications, ensuring transparency.
Effect: Documents published electronically are considered legally valid. The electronic publication date is
regarded as the official date of publication, modernizing the government’s communication and ensuring
wider access to official documents through digital channels.
Section 9: No Right to Insist on Electronic Form
Purpose: This section clarifies that while electronic records and signatures are legally valid, individuals or
organizations do not have the automatic right to insist that government agencies accept electronic
submissions. This means that although the law allows for digital records, agencies may still choose to
require paper submissions in certain cases.
Effect: Government agencies retain flexibility in accepting electronic records. They are not obligated to
process every transaction electronically, allowing them to accommodate situations where digital methods
are not feasible or appropriate. This flexibility is crucial during the transition period from paper to digital
processes.
Section 10: Power to Make Rules by Central Government for Electronic Signatures
Purpose: This section gives the Central Government the authority to create specific rules related to
electronic signatures. These rules ensure the secure use and implementation of electronic signatures.
Details of the Rules:
1. Types of Signatures: The government can define different types of electronic signatures that are permissible
for different types of transactions.
2. Affixing Signatures: The government can specify how electronic signatures must be affixed to electronic
records to ensure their validity.
3. Identification: The government can outline procedures to verify the identity of the signer, ensuring that
electronic signatures cannot be easily forged or misused.
4. Security Procedures: The government is responsible for ensuring that electronic signatures are protected by
appropriate security measures. This includes preventing tampering or unauthorized access.
Effect: These rules ensure that electronic signatures are implemented securely and uniformly across
different sectors. By establishing a clear framework for electronic signatures, the government ensures that
digital transactions are trustworthy.
Section 10A: Validity of Contracts Formed Through Electronic Means
Purpose: This section affirms the legal validity of contracts formed through electronic communication. It
ensures that contracts made via email, online platforms, or other electronic methods are legally binding.
Effect: Contracts formed electronically are just as valid as contracts made on paper. This provision is
essential for e-commerce and other digital interactions. It ensures that a contract cannot be challenged or
invalidated simply because it was created or signed electronically, thereby promoting confidence in online
transactions and digital commerce.
Section 65B provides those digital records, such as emails, images, and video files, can be used as
evidence in court, provided they are accompanied by a certificate confirming their authenticity (often
referred to as a 65B certificate). This certificate must confirm that the digital record has been produced
from a reliable source without alteration. This section was crucial for addressing the challenges posed by
digital evidence, as it sets standards for the admissibility and verification of electronic records in court
proceedings.
Section 92 of the IT Act:
This section amends the Evidence Act, giving electronic records the same evidentiary value as paper
records, provided they meet the legal criteria for authenticity and reliability. By establishing that digital
evidence is equivalent to paper evidence, the IT Act enables courts to handle cases involving digital data,
from emails to financial transactions, with a structured approach to verification and certification.
Section 35 requires that DSCs be issued by licensed Certifying Authorities (CAs) to verify the identity of the
signers in electronic transactions. CAs, authorized by the government, are responsible for issuing and
managing these certificates. The DSCs are based on Public Key Infrastructure (PKI) technology, which uses a
pair of cryptographic keys (public and private) to create a secure digital signature. PKI ensures that a
digitally signed document is not only linked to a specific individual but is also secure and tamper-proof.
Section 35: Issuance of Electronic Signature Certificates
o CAs issue electronic signature certificates to applicants who meet specified criteria.
o Applicants must provide a certification practice statement (detailing the CA’s policies for issuing certificates)
and pay an applicable fee.
The CA evaluates the application, and if approved, issues the certificate, certifying the authenticity of the
applicant’s digital signature
Section 36 - Duties of Subscribers:
This section specifies that subscribers (users of DSCs) must maintain the confidentiality of their digital
signature key and report any security compromise. Subscribers are accountable for the security of their
digital signatures and must ensure they are not misused or misrepresented. This provision prevents the
misuse of digital identities and mandates prompt action if any security breach occurs.
Section 37 - Penalty and Adjudication for Issues with DSCs:
Section 37 provides for penalties if CAs or users mishandle DSCs, such as through unauthorized access or
failure to report misuse. This section ensures accountability on both the issuer’s and subscriber’s ends,
encouraging responsible use of digital signatures.
Section 14 sets out the criteria for a record to be considered secure, including that it must be generated,
stored, and transmitted using reliable security measures that make it tamper-evident and traceable to a
specific user. A Secure Electronic Record is deemed legally reliable and trustworthy, ensuring its integrity
during legal or business transactions.
Section 15 - Secure Digital Signatures:
Section 15 defines the requirements for a Secure Digital Signature, including that it must be uniquely linked
to the user, verifiable, and created using a secure method that guarantees the signer’s identity and the
signature’s authenticity. A digital signature meeting these criteria is legally accepted as a secure form of
verification in official processes, ensuring the signature’s legal validity.
Section 16 - Security Procedures and Practices:
Section 16 authorizes the government to prescribe security guidelines and protocols for electronic records
and digital signatures. By enforcing specific security practices, this section enhances the reliability of digital
records, promoting trust in online transactions. Both government and private entities must follow these
guidelines to ensure their digital records and signatures meet the necessary legal and security standards.
Certifying Authorities (CAs) play a crucial role in the framework established by the Information Technology
Act, 2000 (IT Act) in India. They are responsible for issuing Digital Signature Certificates (DSCs) and ensuring
the integrity and security of electronic transactions. The role of CAs encompasses various responsibilities
and functions, which can be outlined as follows:
1. Issuance of Digital Signature Certificates (DSCs)
Verification of Identity: CAs are responsible for verifying the identity of individuals or entities applying for a
Digital Signature Certificate. This involves collecting and validating identification documents and other
necessary information to ensure that the certificate is issued to the rightful owner.
Generating Digital Certificates: Upon successful verification, CAs generate DSCs that link the subscriber’s
identity to their public key. This certificate serves as a digital identity proof in electronic transactions.
2. Maintenance of Security Standards
Public Key Infrastructure (PKI): CAs operate within a Public Key Infrastructure framework, which ensures
that digital signatures are created and verified securely. They maintain the cryptographic systems and
processes necessary for the functioning of DSCs.
Security Audits: CAs must conduct regular audits and assessments of their security measures to protect
their systems from breaches and ensure that they meet the regulatory standards set by the government.
3. Revocation of Certificates
Managing Revocation: CAs are responsible for revoking Digital Signature Certificates when necessary. This
can occur when a subscriber’s private key is compromised or when the subscriber requests the revocation
due to a change in their status or affiliation.
Publication of Revocation Lists: CAs must maintain and publish Certificate Revocation Lists (CRLs) to inform
users of certificates that have been revoked. This transparency helps prevent misuse of compromised
certificates.
4. Providing Trust and Assurance
Establishing Trust: By issuing DSCs and managing their validity, CAs help establish trust in electronic
transactions. They provide a level of assurance to parties involved in a transaction that the digital signature
is authentic and that the identity of the signer can be trusted.
Facilitating Secure Transactions: CAs enable secure online interactions by ensuring that digital signatures
are linked to verified identities, thereby reducing the risk of fraud and enhancing confidence in electronic
governance and commerce.
5. Compliance with Regulatory Framework
Adherence to IT Act: CAs must comply with the provisions of the Information Technology Act, 2000, and any
regulations set forth by the government. This includes following procedures for issuing, managing, and
revoking digital certificates.
Reporting Obligations: CAs are often required to report any security incidents or breaches to the relevant
authorities, ensuring accountability and promoting a secure digital environment.
6. User Education and Support
Educating Subscribers: CAs play a role in educating subscribers about the proper use of Digital Signature
Certificates, including best practices for security and the importance of protecting their private keys.
Technical Support: Many CAs provide technical support and resources to assist subscribers in
troubleshooting issues related to the use of digital signatures and certificates.
7. E-Governance Facilitation
Supporting E-Governance Initiatives: CAs contribute to the growth of e-governance by ensuring that
government services can be accessed securely through digital signatures. They help streamline processes
such as online applications, submissions, and approvals, which are crucial for efficient governance.
REGULATORS UNDER THIS ACT
The Information Technology Act, 2000 (IT Act) establishes a framework for electronic governance and
security in India. Within this framework, several regulatory authorities and bodies are empowered to
oversee the implementation of the Act and ensure compliance with its provisions. Here are the key
regulators under the IT Act along with their roles and associated sections:
1. Controller of Certifying Authorities (CCA)
Role: The CCA is the main regulatory authority responsible for overseeing the activities of Certifying
Authorities (CAs). The CCA ensures that CAs comply with the standards and regulations set forth in the IT
Act.
Associated Sections:
o Section 17 - Controller of Certifying Authorities: This section establishes the position of the Controller of
Certifying Authorities, outlining their powers and functions.
o Section 18 - Powers of the Controller: This section empowers the CCA to issue guidelines and regulations for
the functioning of Certifying Authorities, including the standards for the issuance and management of
Digital Signature Certificates.
2. Adjudicating Officer
Role: The Adjudicating Officer is appointed to handle cases related to contraventions of the provisions of
the IT Act. This includes resolving disputes, adjudicating complaints, and imposing penalties for non-
compliance.
Associated Sections:
o Section 46 - Appointment of Adjudicating Officers: This section outlines the appointment and qualifications
of the Adjudicating Officer, giving them the authority to adjudicate on matters related to offenses under the
IT Act.
o Section 47 - Powers of Adjudicating Officers: This section details the powers of the Adjudicating Officers,
including the authority to impose penalties and issue orders.
3. Cyber Appellate Tribunal
Role: The Cyber Appellate Tribunal serves as an appellate authority for cases decided by the Adjudicating
Officer. It hears appeals against orders made by the Adjudicating Officers and has the authority to confirm,
modify, or set aside their decisions.
Associated Sections:
o Section 48 - Cyber Appellate Tribunal: This section establishes the Cyber Appellate Tribunal, detailing its
composition, powers, and jurisdiction.
4. STATE Government
Role: The Central Government plays a pivotal role in the administration of the IT Act. It has the authority to
formulate rules, regulations, and policies concerning the implementation of the Act.
Associated Sections:
o Section 90 - Power to Make Rules: This section empowers the Central Government to make rules for
carrying out the provisions of the IT Act.
5. CENTER SECTION 87 TO Make rule
5. Law Enforcement Agencies
Role: Various law enforcement agencies are involved in investigating cybercrimes and enforcing the
provisions of the IT Act. They work in conjunction with the Cyber Crime Cells and the Ministry of Home
Affairs to address issues related to cybercrime and electronic offenses.
Associated Sections:
o Section 70 - Protected Systems: This section authorizes the Central Government to declare certain computer
systems as protected, ensuring that law enforcement can take necessary action against unauthorized access
or attacks on such systems.
o Section 71 - Misrepresentation: This section imposes penalties for misrepresentation and fraud related to
the use of computers, networks, and digital signatures.
7. National Cyber Security Coordinator
While not explicitly mentioned in the IT Act 2000, this role has emerged in subsequent amendments and
notifications regarding cybersecurity.
Constitution of advisory committee Under section 88
3. Obligations of ISPs
To maintain their immunity under Section 79, ISPs are required to comply with several obligations related to
data privacy, content management, and government cooperation. Here’s a closer look:
a. Privacy and Security Measures
Section 43A: ISPs must implement reasonable security practices and procedures to protect sensitive
personal data of users. If they fail to do so, they can be held liable for any damage resulting from a data
breach or unauthorized access.
ISPs must take measures to ensure that user data is not compromised and must maintain confidentiality
unless required to disclose data by law.
b. Compliance with Government Orders
Section 69 of the IT Act empowers the government to direct ISPs to intercept, monitor, or decrypt any
information in the interest of national security, sovereignty, or to prevent crimes.
ISPs must comply with these directions and have technical measures in place to assist law enforcement
agencies when necessary. Non-compliance can lead to severe penalties, including fines and imprisonment
for the officers responsible.
c. Content Management and Takedown Mechanisms
ISPs must have robust mechanisms to remove or disable access to illegal or harmful content upon receiving
a valid takedown notice.
They must appoint designated officers to handle grievances and ensure content removal within a stipulated
time frame, usually 36 hours as per the IT Rules, 2021.