Penalties for Computer Crimes:
As per the Act, civil liability and stringent criminal penalties may be imposed on any person who causes damage to a computer or computer system. The offender would be liable to pay compensation not exceeding Rs. 1 Crore (10 million) for gaining unauthorised access to a computer or computer system, damaging it, introducing a virus in the system, denying access to an authorised person or assisting any person in any of the above activities.
Furthermore, the Act also defines specific penalties for violation of its provisions or of any rules or regulations made thereunder. However, if any person contravenes any rules or regulations framed under the Act for which no specific penalty is prescribed, he will be liable to pay compensation not exceeding Rs. 25,000.
Moreover, any person who intentionally or knowingly tampers with computer source documents would be penalised with imprisonment upto three years or a fine of upto Rs. 2 lakhs or both. In simpler terminology, hacking is made punishable.
The Act also disallows the publishing and dissemination of obscene information and material. The introduction of this provision should curtail pornography over the net. Any person who disobeys this provision will be punishable with imprisonment of two years and a fine of Rs. 25,000 for the first conviction. In the event of a subsequent conviction, the imprisonment is five years and the fine doubles to Rs. 50,000.
The Controller has the power to issue directions for complying with the provisions of the Act. Failure to comply with his directions is punishable. Moreover, the interference with 'protected systems' or the reluctance to assist a Government Agency to intercept information in order to protect state sovereignty and security is also made punishable.
The adjudicating court also has the powers to confiscate any computer, computer system, floppies, compact disks, tape drives or any accessories in relation to which any provisions of the Act are being violated. No penalty or confiscation made under this Act will affect the imposition of any other punishment under any other law in force.
If penalties that are imposed under the Act are not paid, they will be recovered as arrears of land revenue and the licence or DSC shall be suspended till the penalty is paid.
Adjudicating Officers:
The Central Government shall appoint an officer not below the rank of Director to the Government of India or equivalent officer of the State Government as an adjudicating officer to adjudicate upon any inquiry in connection with the contravention of the Act. Such officer must have the legal and judicial experience as may be prescribed by the Central Government in that behalf.
The Adjudicating Officer must give the accused person an opportunity to be heard and after being satisfied that he has violated the law, penalise him according to the provisions of the Act. While adjudicating, he shall have certain powers of a Civil Court.
Cyber Regulations Appellate Tribunal (CRAT):
A Cyber Regulations Appellate Tribunal (CRAT) is to be set up for appeals from the order of any adjudicating officer. Every appeal must be filed within a period of forty-five days from the date on which the person aggrieved receives a copy of the order made by the adjudicating officer. The appeal must be the appropriate form and accompanied by the prescribed fee. An appeal may be allowed after the expiry of forty-five days if 'sufficient cause' is shown.
The appeal filed before the Cyber Appellate Tribunal shall be dealt with by it as expeditiously as possible and endeavour shall be made by it to dispose of the appeal finally within six months from the date of receipt of the appeal. The CRAT shall also have certain powers of a civil court.
As per Section 61, no court shall have the jurisdiction to entertain any matter that can be decided by the adjudicating officer or the CRAT. However, a provision has been made to appeal from the decision of the CRAT to the High Court within sixty days of the date of communication of the order or decision of the CRAT. The stipulated period may be extended if sufficient cause is shown. The appeal may be made on either any question of law or question of fact arising from the order.
Police Powers:
A police officer not below the rank of deputy superintendent of police has the power to enter any public place and arrest any person without a warrant if he believes that a cyber crime has been or is about to be committed. This provision may not turn to be very effective for the simple reason that most of the cyber crimes are committed from private places such as one's own home or office. Cyber-cafés and public places are rarely used for cyber crimes. However, if the Act did give the police department powers to enter people's houses without search warrants, it would amount to an invasion of the right to privacy and create pandemonium. Keeping this in mind, the Legislature has tried to balance this provision so as to serve the ends of justice and at the same time, avoid any chaos.
On being arrested, the accused person must, without any unnecessary delay, be taken or sent to the magistrate having jurisdiction or to the officer-in-charge of a police station. The provisions of the Code of Criminal Procedure, 1973 shall apply in relation to any entry, search or arrest made by the police officer.
Network Service Providers not liable in certain cases:
To quote Section 78, it states:
"For the removal of doubts, it is hereby declared that no person providing any service as a network service provider shall be liable under this Act, rules or regulations made thereunder for any third party information or data made available by him if he proves that the offence or contravention was committed without his knowledge or that he had exercised all due diligence to prevent the commission of such offence or contravention."
"Explanation.-For the purposes of this section,-
(a) 'network service provider' means an intermediary;
(b) 'third party information' means any information dealt with by a network service provider in his capacity as an intermediary."
Thus a plain reading of the section indicates that if the network service provider is unable to prove its innocence or ignorance, it will be held liable for the crime.
Cyber Regulations Advisory Committee (CRAC):
The Act also provides that as soon as it is enacted and it comes into force, the Central Government shall constitute the CRAC. The CRAC will assist the Central Government as well as the Controller of CAs to form rules and regulations consistent with the provisions of the Act. The Controller will notify these regulations in the Official Gazette after consultation with the CRAC and the Central Government.
Amendments:
With the introduction of the IT Act certain amendments are to be carried out in the Indian Penal Code, 1860, the Indian Evidence Act, 1872, the Banker's Book Evidence Act, 1891 and the Reserve Bank of India Act, 1934. These amendments will try and make these existing codes Internet compatible.
LACUNAE
After having discussed the important provisions of the Act, attention should also be drawn to some of its loopholes.
Inapplicability:
The first and foremost setback is that the provisions of the Act do not apply to the following:
It is envisaged that the efficacy of the Act may not be considerable owing to its restrictive applicability.
Digital Signatures:
Act deals only with PKI framework for authentication. It does not recognize any other authentication procedure though the ambit of 'legal record' is wide. This may cause problems for m-commerce transactions that may not necessarily use the PKI system for authentication and security purposes.
Qualifications and Powers of Adjudicating Officers Unclear:
The Act is unclear as to the qualifications of an adjudicating officer and the manner in which he shall adjudicate.
Moreover, though the statute is supposedly a 'long arm statute', it does not indicate the powers of the adjudicating officers when a person commits a cyber crime or violates any provisions of the law from outside India. Several practical difficulties may also arise in importing the cyber criminal to India. The Act does not lay down any provisions whereby extradition treaties can be formed with countries where the cyber criminal is located. Therefore, the extra-territorial scope of the Act may be difficult to achieve.
Furthermore, the powers to impose a penalty for a computer crime upto Rs. 1 crore offers a large discretion to adjudicating officers and may turn out to be harmful.
Possible Violation of Fundamental Rights:
The provision that no order of the Central Government appointing any person as the presiding officer of a CRAT shall be called into question in any manner and no act or procedure before a CRAT shall be called into question in any manner merely because there is a defect in the constitution of the CRAT may be violative of the fundamental rights of citizens under the Constitution of India. This provision could be misused by the Central Government in an unfair and arbitrary manner. It is recommended that is provision be modified so that the interests of the public at large are safeguarded.
Misuse of Police Powers:
The search and arrest powers given to police officers are without any definite guidelines and may be ill-used.
ISP Liability - Responsibility for Content Regulation not attributable:
While Section 78 absolves a network service provider of its liability if it can prove its ignorance and due diligence, it fails to specify as to who would be held liable for such contravention in such an event. This provision will certainly cause problems when an offence regarding third party information or provision of data is committed.
No Intellectual Property Rights Protection Guaranteed:
Regulation of intellectual property rights, particularly copyright on the Internet is an ever-growing problem. The Act does not discuss the implications of any copyright violations over the net. It has no provisions to penalise copyright infringers, commonly known as "pirates" for their activities over the net. Internet piracy is a major problem has not been tackled by this Act. No amendments have been proposed to the Copyright Act of India.