Cybercrime is any criminal offence committed using a computer, computer system, or communication network as a tool, target, or medium, encompassing offences such as hacking, data theft, identity fraud, and online harassment. Under Indian law, cybercrimes are primarily governed by the Information Technology Act, 2000, with specific offences defined under Sections 43, 65, 66, 66B-66E, 67, 67A-67B, and 72, supplemented by applicable provisions of the Bharatiya Nyaya Sanhita, 2023.
Legal definition
The Information Technology Act, 2000 does not provide a single consolidated definition of "cybercrime" but rather enumerates specific computer-related offences across multiple provisions:
Section 43 — Penalty and compensation for damage to computer, computer system, etc.: "If any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network — (a) accesses or secures access to such computer... (b) downloads, copies or extracts any data... (c) introduces or causes to be introduced any computer contaminant or computer virus... he shall be liable to pay damages by way of compensation to the person so affected."
Section 66 — Computer related offences: "If any person, dishonestly or fraudulently, does any act referred to in section 43, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both."
Key offence-specific provisions include:
- Section 65: Tampering with computer source documents (imprisonment up to 3 years / fine up to Rs 2 lakh)
- Section 66B: Receiving stolen computer resources (imprisonment up to 3 years / fine up to Rs 1 lakh)
- Section 66C: Identity theft using electronic signature, password, or unique identification (imprisonment up to 3 years / fine up to Rs 1 lakh)
- Section 66D: Cheating by personation using computer resources (imprisonment up to 3 years / fine up to Rs 1 lakh)
- Section 66E: Violation of privacy by capturing or publishing private images (imprisonment up to 3 years / fine up to Rs 2 lakh)
- Section 67: Publishing or transmitting obscene material electronically (first conviction: imprisonment up to 3 years / fine up to Rs 5 lakh)
- Section 72: Breach of confidentiality and privacy by a person with access to electronic records (imprisonment up to 2 years / fine up to Rs 1 lakh)
The 2008 Amendment to the IT Act significantly expanded the scope of cybercrime provisions, inserting Sections 66A through 66F and strengthening penalties. Notably, Section 66A (punishment for sending offensive messages through communication services) was struck down by the Supreme Court in 2015.
How courts have interpreted this term
Shreya Singhal v. Union of India [(2015) 5 SCC 1]
In a landmark constitutional ruling, the Supreme Court struck down Section 66A of the IT Act, 2000 as unconstitutional for violating Article 19(1)(a) — the right to freedom of speech and expression. The Court held that Section 66A was vague, overbroad, and not saved by the reasonable restrictions under Article 19(2), as it penalised speech based on subjective terms such as "annoying," "inconvenient," and "grossly offensive." The bench of Justices J. Chelameswar and R.F. Nariman clarified that while the state can regulate genuine cybercrimes, the criminalization of online speech must meet the tests of clarity, proportionality, and necessity.
Shamsher Singh Verma v. State of Haryana [(2015) 15 SCC 651]
The Supreme Court recognised that electronic records, including call detail records and computer-generated evidence, are admissible under Section 65B of the Indian Evidence Act, 1872 (now Section 63 of the Bharatiya Sakshya Adhiniyam, 2023). The Court emphasised that for cybercrime prosecutions, electronic evidence must be accompanied by a certificate under Section 65B(4) to establish its authenticity and integrity.
State of Tamil Nadu v. Suhas Katti (2004, Additional CMM, Chennai)
One of the first successful cybercrime convictions in India, where the accused was convicted under Sections 67 of the IT Act and Section 469/509 of the IPC for posting obscene content about a woman on a Yahoo group. This trial court decision established early judicial precedent on the applicability of IT Act provisions to online harassment.
Types of cybercrime
Indian law recognises several categories of cybercrime:
- Offences against computer systems: Hacking (Section 66), tampering with source code (Section 65), introducing viruses or contaminants (Section 43)
- Data and identity offences: Identity theft (Section 66C), cheating by personation (Section 66D), breach of confidentiality (Section 72)
- Content-related offences: Publishing obscene material (Section 67), child sexual abuse material (Section 67B), violation of privacy (Section 66E)
- Cyber terrorism: Section 66F — attacking critical information infrastructure with intent to threaten the unity, integrity, security, or sovereignty of India (imprisonment which may extend to life imprisonment)
- Economic cybercrimes: Online fraud, phishing, and financial data theft, prosecuted under the IT Act read with provisions of the BNS relating to cheating and fraud
Why this matters
Cybercrime has emerged as one of the fastest-growing categories of criminal activity in India. According to the National Crime Records Bureau, reported cybercrime cases increased from approximately 12,300 in 2018 to over 65,000 in 2022, though the actual incidence is estimated to be significantly higher due to underreporting.
For citizens, understanding cybercrime law is essential because digital transactions, social media activity, and online communications are all subject to legal regulation. Filing a cybercrime complaint in India can be done through the National Cyber Crime Reporting Portal (cybercrime.gov.in) or at the nearest police station, as cyber offences are cognizable and the police are obligated to register an FIR. Financial frauds involving amounts above Rs 1 lakh can also be reported directly through the portal's financial fraud module.
For practitioners, cybercrime defence and prosecution require familiarity with both the IT Act and the rules of electronic evidence. The admissibility of digital evidence under Section 65B of the Evidence Act (now Section 63 BSA) remains a critical procedural issue. The Supreme Court's ruling in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) 7 SCC 1 clarified that the Section 65B certificate requirement is mandatory and cannot be dispensed with.
Related terms
Parent framework:
Related concepts:
Related procedures:
Frequently asked questions
How do I report a cybercrime in India?
Cybercrimes can be reported through the National Cyber Crime Reporting Portal at cybercrime.gov.in, through the helpline number 1930, or by filing an FIR at the nearest police station. For financial frauds, immediate reporting through the portal's financial fraud module is recommended, as it triggers an automated hold on the suspected accounts. Jurisdiction for cybercrime FIRs lies where the offence was committed or where the victim resides, and a Zero FIR can be filed at any police station.
Is hacking a criminal offence in India?
Yes. Unauthorised access to a computer system is punishable under Section 66 of the IT Act, 2000 with imprisonment up to three years and a fine up to Rs 5 lakh, or both. If the hacking causes damage to a computer system, additional civil liability for compensation arises under Section 43. Where the hacking targets critical information infrastructure or is motivated by terrorism, Section 66F applies with punishment extending to life imprisonment.
What is the punishment for online fraud in India?
Online fraud is prosecuted under multiple provisions depending on its nature. Cheating by personation using a computer resource attracts Section 66D of the IT Act (up to 3 years imprisonment and Rs 1 lakh fine) and Section 318 of the BNS (formerly Section 420 IPC — up to 7 years imprisonment). Identity theft under Section 66C carries up to 3 years imprisonment. Organised cyber fraud may also attract provisions under the Prevention of Money Laundering Act, 2002.
Is Section 66A still in force?
No. The Supreme Court struck down Section 66A of the IT Act in Shreya Singhal v. Union of India (2015) 5 SCC 1, holding it unconstitutional for violating the right to freedom of speech under Article 19(1)(a). Despite the judgment, some police stations continued to register cases under Section 66A until the Supreme Court in 2019 directed all states to ensure compliance with the Shreya Singhal ruling. Any prosecution under Section 66A is legally void.
This entry is part of the Veritect Indian Legal Glossary, a comprehensive reference of Indian legal terminology grounded in statutory text and judicial interpretation.
Last updated: 2026-03-27. Veritect provides this content for informational purposes and does not constitute legal advice.