Ms. Pulkit Tomar is a practising advocate at the Supreme Court. She has expressed her views on the Information Technology Act and the Cyber Laws, and the regulatory framework in India, on the following abstract:-

The rapid expansion of India’s digital ecosystem has resulted in a proportional rise in sophisticated cybercrimes, ranging from online financial frauds and ransomware attacks to deepfake-based extortion and cyberterrorism. Although the Information Technology Act, 2000, remains the cornerstone of cyber legislation, it now operates in conjunction with evolving criminal laws and data protection norms, including the Bharatiya Nyaya Sanhita, 2023 and the Digital Personal Data Protection Act, 2023. This paper critically examines statutory provisions, judicial developments, forensic challenges, emerging technological threats, and cross-border legal complexities surrounding cybercrime in India. Through an analytical study of landmark judgments, comparative international standards, and enforcement obstacles, the paper proposes structured reforms aimed at strengthening digital governance and ensuring cybersecurity resilience in the emerging “Techade.”

I. Introduction

India is undergoing an unprecedented digital transformation — driven by initiatives like Digital India, rapid smartphone penetration, UPI adoption, and large-scale data processing. However, this growing digital dependency has simultaneously increased the nation’s vulnerability to cyber threats. According to CERT-In, over 13 lakh cyber incidents were reported in 2022, and financial cyber frauds have increased by over 250% in the last five years. With cyberattacks evolving from individual-centric frauds to sophisticated, state-sponsored operations, the legal ecosystem struggles to adapt.

Cybercrimes transcend territorial borders, complicating jurisdiction, investigation, and prosecution. The biggest concern is that cybercriminals exploit not only technological loopholes but also legislative gaps. The need for a strong, adaptable and comprehensive legal and enforcement mechanism has, therefore, become imperative for India’s digital sovereignty.

II. Defining Cybercrime

Cybercrime encompasses unlawful acts wherein a computer system, network, or digital device functions as:

1.     A tool of offence, or

2.     A target of criminal activity

Major cyber offences in India include:

Cybercrimes increasingly employ AI, deepfake manipulation, dark-web platforms, and cryptocurrency, making detection and attribution extremely challenging.

III. Statutory Framework in India

(A) The Information Technology Act, 2000

The IT Act remains India’s primary cyber-law framework:

Section                                     Offence Covered

S. 43                    Unauthorized access, data theft

S. 66                   Computer-related offences (criminal liability)

S. 66C                 Identity theft

S. 66D                 Cheating by personation using digital means

S. 67, 67A, 67B Obscenity and child sexual abuse content

However, the Act is reactive, not preventive, leading to interpretational challenges.

Notable rulings:

• Anvar P.V. v. P.K. Basheer (2014) — clarified admissibility of electronic evidence; Section 65B certificate mandatory
• Arjun Panditrao v. Kailash Kushanrao (2020) — reiterated strict 65B compliance under the Indian Evidence Act

(B) Indian Penal Code (now Bharatiya Nyaya Sanhita, 2023)

Earlier traditional offences such as:

• Cheating (S. 420 IPC)
• Criminal Intimidation (S. 503 IPC)
• Defamation (S. 499 IPC) now apply digitally.

2023 update:

Cyber-enabled offences, such as organised cyber fraud, are now more stringently recognised under BNS provisions.

(C) Special Laws & Rules

• DPDP Act, 2023 — Data fiduciary obligations, rights of individuals
• CERT-In Directions 2022 — Mandatory reporting within 6 hours
• Digital India Act (Upcoming) — AI regulation & platform accountability

IV. Key Judicial Pronouncements

Judiciary has been proactive — yet unpredictable in technology-driven matters.

V. Challenges in Enforcement

Despite having a statutory and judicial framework, cybercrime enforcement in India faces numerous operational and legal hurdles:

1.     Jurisdictional Ambiguity

Cyber offences are borderless. Servers may be in one State or country while the offender and victim are elsewhere. This raises:

• Territorial jurisdiction issues under CrPC
• Delayed evidence requests from foreign platforms
• Conflict of data-sovereignty

The Budapest Convention model (transnational cooperation) is still not adopted by India.

2️.  Weak Cyber Forensics Ecosystem

Digital evidence must be collected with strict integrity and chain of custody. Current issues:

• Limited certified cyber forensic labs
• Shortage of trained digital forensic experts
• Evidence corruption during seizure or transmission

In many trials, lack of valid 65B certificate results in acquittal.

3️.  Low Conviction Rates

Cyber crimes reported vs punished are negligible due to:

• Delay in FIR registration
• Poor technical understanding among investigators
• Accused often traced to proxy networks / darknet

Conviction rate in cyber cases remains less than 1% in multiple States (as per NCRB trends).

4.    Lack of Public Awareness

• Victims often hesitate to report financial cyber frauds.
• Cyber hygiene and safe internet practices are still low in rural sectors.

5️. Technology Evolves Faster than Law

• Deepfakes, quantum cryptography, AI-enabled social engineering → Most offences not explicitly defined under IT Act.

VI. Recent Legislative Developments

A. Digital Personal Data Protection Act, 2023

A landmark shift — focused on:

• Data fiduciaries → stronger compliance
• Consent architecture → explicit & purpose-specific
• Penalties → up to ₹2️5️0 crore for major breaches
• Children’s data given high protection

It replaces Section 43A (IT Act) on compensation for data breach victims.

B. New Criminal Laws 2023

• Bharatiya Nyaya Sanhita (BNS)
• Bharatiya Nagarik Suraksha Sanhita (BNSS)
• Bharatiya Sakshya Adhiniyam (BSA)

These laws modernize treatment of cyber-enabled offences & digital evidence:

• Conspiracy and organized cyber-fraud covered more strictly
• BSA formally recognizes electronic records as primary evidence

C. Proposed Digital India Act (DIA)

A complete replacement of the 24-year-old IT Act:

Key pillars expected:

• AI/Deepfake regulation
• Online harm and platform accountability
• Children’s online safety compliance
• Strong cyber-security standards for MNCs & intermediaries

India aims to shift from safe-harbour era → responsible digital governance.

VII. Comparative Insight 

India’s challenge is to balance:

•  Data protection   

•  Digital economy growth   

•  National security  

VIII. Recommendations

To secure India’s digital future, the following reforms are crucial:

1.   Strengthen Enforcement & Forensics

• Establish cyber-police stations in every district
• Expand CERT-In authority for real-time response
• Mandatory cyber forensic labs accreditation

2.     Clear Cross-Border Mechanisms

• Bilateral treaties for faster digital evidence sharing
• Accession to global cybercrime convention frameworks

3.     AI-Driven Policing Tools

• Use of machine learning for threat prediction
• Automated dark-web intelligence monitoring

4.     Awareness & Digital Literacy

• Curriculum integration in schools / bar training
• National cyber-hygiene campaign

5.       Platform & Intermediary Accountability

• Faster takedown timelines
• Transparency audit of social media and fintech apps

6.        Victim-centric Approach

• Compensation fund for cyber-fraud victims
• Fast-track special cybercourts

Strengthening both legal architecture and operational capacity is essential.

Conclusion

India’s emergence as a global digital powerhouse has created new vulnerabilities that threaten its economy, privacy, and national security. While the Information Technology Act, 2000 laid a legal foundation, it is no longer adequate for today’s hyper-connected threats. With the DPDP Act, 2023, and the anticipated Digital India Act, India is moving towards a holistic, accountable, and citizen-protective digital framework.

However, technology alone cannot secure cyberspace.

The State, private sector, and citizens all share responsibility for cybersecurity. A future-ready cyber legal regime must be:

• Adaptive to rapid technological change
• Rights-protective
• Globally cooperative
• Enforcement-focused

Only then can India ensure trust, safety, and sovereignty in its digital revolution.

Share this News