Centre for Police Technology (CPT) presents a 31-Day Cybersecurity Knowledge Series for police personnel, law enforcement agencies (LEAs), corporate investigators, digital forensics professionals and cybersecurity practitioners.
A hacked account, a fraudulent online transaction, identity theft or the circulation of intimate images without consent can leave victims facing serious consequences. Behind many such incidents lies a question that goes beyond technology: What laws apply, and how can investigators establish accountability?
In India, the Information Technology Act (IT Act) is a key legal framework addressing electronic records, digital transactions and specified offences involving computer resources. As cybercrime evolves through phishing, financial fraud, impersonation, data theft and AI-enabled deception, understanding this law is essential for investigators, cybersecurity professionals and ordinary citizens.
What Is the Information Technology Act?
The Information Technology Act, 2000, came into force on 17 October 2000. It provides legal recognition for electronic records and electronic transactions, supports electronic governance, and establishes provisions addressing specified offences and contraventions involving computer resources.
The Act was subsequently amended, including through the Information Technology (Amendment) Act, 2008, which introduced or revised several provisions relevant to modern cybercrime.
Its scope extends beyond hacking. Depending on the facts, its provisions may be relevant to identity theft, online impersonation, privacy violations, certain forms of unlawful online content, cyberterrorism and unauthorised access to computer resources.
The IT Act operates alongside other applicable Indian laws. Investigators must identify the provisions that fit the conduct and evidence in each case rather than assume that every online offence falls under a single section.
Key Sections of the IT Act Every Investigator Should Know
Section 43 — Unauthorised access and damage to computer resources
Section 43 addresses specified acts carried out without permission, including unauthorised access, copying or extracting data, introducing computer contaminants, damaging systems and disrupting computer resources. It provides for penalties and compensation, subject to the statutory conditions.
Section 66 — Computer-related offences
Section 66 applies where an act referred to in Section 43 is done dishonestly or fraudulently. It provides for imprisonment of up to three years, a fine of up to ₹5 lakh, or both.
The distinction matters: an act covered by Section 43 does not automatically establish the additional elements required for a criminal offence under Section 66.
Section 66C — Identity theft
Section 66C addresses the fraudulent or dishonest use of another person’s electronic signature, password or other unique identification feature. It may be relevant to certain cases involving stolen credentials or misuse of digital identifiers.
Section 66D — Cheating by personation using a computer resource
Section 66D addresses cheating by impersonation through a communication device or computer resource. It may be relevant to scams involving fake bank representatives, fraudulent customer-support agents or other online impersonation schemes, depending on the facts.
Section 66E — Violation of privacy
Section 66E addresses the intentional or knowing capture, publication or transmission of images of a person’s private area without consent under circumstances violating that person’s privacy, as defined by the provision.
Sections 67, 67A and 67B — Specified unlawful online content
These provisions address different categories of obscene material, sexually explicit material and material depicting children in sexually explicit acts, respectively. Their application depends on the statutory elements and circumstances of the case.
Section 66F — Cyberterrorism
Section 66F addresses conduct that meets the Act’s definition of cyberterrorism. It should not be treated as a general provision for every serious cyberattack; the specific statutory requirements must be established.
Section 70B — CERT-In
Section 70B provides for the Indian Computer Emergency Response Team (CERT-In) to serve as the national agency for incident response. CERT-In has functions and powers relating to cybersecurity incidents, including specified directions and reporting requirements under the applicable framework.
These provisions are among the important parts of the Act, but they are not an exhaustive list. The appropriate legal provisions depend on the conduct, available evidence and applicable law.
FCRF’s Chief AI Officer Certification Returns on November 14 to Prepare Future AI Leaders
How the IT Act Applies to Real-World Cybercrime
Consider a fraudster who creates a fake customer-support profile, contacts a victim and persuades them to reveal sensitive banking information.
The victim subsequently discovers unauthorised transactions. Investigators may examine the impersonation, the use of credentials, the transaction trail and the digital communications to determine which offences may apply.
Depending on the evidence, Section 66D may be relevant to cheating by personation, while Section 66C may be relevant if the facts establish fraudulent or dishonest use of another person’s qualifying identification feature. Other applicable criminal laws may also be relevant to the alleged fraud.
In another case, an individual may access a company’s computer system without permission and extract confidential files. Section 43 may be relevant to the unauthorised access or extraction, while Section 66 may apply if the additional requirements concerning dishonest or fraudulent conduct are established.
The lesson for investigators is that identifying a suspicious digital activity is not enough. The evidence must establish the elements of the particular offence being considered.
How Police Investigate Offences Under the IT Act
Effective cybercrime investigation combines legal knowledge, digital forensics, financial analysis and coordination with relevant institutions.
1. Establish the incident and applicable provisions
Investigators document the complaint, identify the alleged conduct and determine which legal provisions may apply. They should distinguish between a technical incident, a civil or regulatory issue, and conduct that may constitute a criminal offence.
2. Preserve digital evidence
Relevant devices, communications, files, logs, transaction details and other records should be identified and preserved using appropriate methods. Investigators must document how evidence was collected and handled.
3. Trace digital and financial activity
Depending on the case, investigators may analyse IP logs, account activity, phone numbers, payment references, beneficiary accounts and other relevant records. Such information can generate leads, but individual records may not conclusively identify the person responsible.
4. Obtain records through lawful procedures
Telecom, banking, platform and service-provider records may be important to reconstruct the incident. Investigators must follow the applicable legal procedures and account for jurisdictional requirements.
5. Correlate technical findings
Device evidence, transaction histories, communications, witness accounts and other independent records should be compared to test competing explanations and establish the relevant facts.
6. Document the investigation
Investigators should maintain appropriate records of evidence collection, forensic examination, legal requests and the reasoning supporting their findings. This helps ensure that technical conclusions can be properly assessed during legal proceedings.
What About Section 66A?
One important legal point deserves special attention.
Section 66A of the IT Act was struck down by the Supreme Court of India in Shreya Singhal v. Union of India in 2015. It cannot be treated as a valid provision for prosecuting people under its former wording.
The provision had addressed certain messages sent through communication services. Its invalidation is a reminder that investigators must verify the current legal status of a provision before invoking it.
Offensive or threatening online conduct may still engage other applicable laws, depending on the facts, but Section 66A itself is not a valid basis for prosecution.
The IT Act and AI-Enabled Cybercrime
Artificial intelligence has introduced new ways to impersonate individuals, fabricate evidence and manipulate victims. Deepfake videos, cloned voices and synthetic messages can be used in fraud, harassment and other harmful activities.
The IT Act may be relevant where the facts satisfy provisions dealing with identity theft, cheating by personation, privacy violations or specified unlawful content. However, not every AI-generated image, synthetic voice or deepfake automatically constitutes an offence under the IT Act. The content, intent, conduct and statutory requirements must be examined.
Investigators should preserve original files and available metadata, document the source of the material, examine relevant accounts and devices, and corroborate technical findings with independent evidence.
Where applicable, other laws and regulatory requirements may also need to be considered.
Responsibilities of Organisations and Digital Platforms
Organisations that operate digital systems should maintain appropriate security controls, access management, incident-response procedures and relevant system records.
The IT Act also contains provisions concerning intermediaries, including Section 79, which addresses conditional exemptions from liability subject to the statutory framework. Section 67C addresses the preservation and retention of information by intermediaries, subject to applicable requirements.
Businesses and platforms should assess their legal obligations based on their role, the applicable rules and the circumstances of an incident. They should not assume that every organisation has identical reporting, retention or disclosure obligations.
Timely incident handling, responsible evidence preservation and cooperation with lawful requests can support investigations and help reduce further harm.
What Ordinary People Should Know
Citizens can reduce their exposure to cybercrime by following basic digital-safety practices:
Use strong, unique passwords and enable multifactor authentication where available.
Never share OTPs, banking PINs or passwords with callers claiming to represent an institution.
Verify the identity of anyone requesting money or sensitive information.
Avoid installing unknown applications or opening suspicious links.
Preserve messages, transaction references and other relevant records if a cybercrime occurs.
Report incidents promptly through appropriate official channels.
For suspected financial cyber fraud in India, contact your bank or payment provider immediately and call 1930. Complaints can also be submitted through the official National Cyber Crime Reporting Portal.
Victims should preserve relevant evidence and avoid making public accusations against suspected individuals before the facts have been established.
Conclusion: Technology Changes, but Accountability Requires Evidence
The Information Technology Act, 2000, remains a central part of India’s legal framework for electronic transactions and specified cyber offences. Its provisions help address conduct ranging from unauthorised access and identity theft to online impersonation and certain forms of unlawful digital content.
For investigators, the challenge is to connect technical findings with the legal elements of an offence. For organisations, it is to maintain appropriate safeguards and respond responsibly to incidents. For citizens, it is to recognise risks, protect digital identities and report cybercrime quickly.
Cybersecurity identifies the threat. Digital investigation uncovers the facts. The law provides the framework for accountability.
Day 26 — Information Technology Act, 2000
31 Days | 31 Key Topics | October 2026
Follow Centre for Police Technology (CPT) for the complete 31-Day Cybersecurity Knowledge Series.
Follow for daily updates on cybercrime, corporate fraud, DFIR, hacking, investigations, and digital forensics
Click Here For The Original Source.
——————————————————–
