Section 43 IT Act: Unauthorised Access and Computer Damage

Section 43 is the trunk of the IT Act's liability tree. Its ten clauses list nearly every way a computer can be wronged, from quiet copying to a full denial-of-service attack, and make the wrongdoer pay compensation without any need to prove dishonesty. Section 66 then converts the same acts, done dishonestly or fraudulently, into crimes. Topic 7 placed the section in the enforcement scheme and Topic 12 contrasted the civil and criminal tracks; this is the close reading: every clause with its defined terms, the compensation machinery, the comparison with Section 66, and the modern scenarios, hacking, malware, ransomware, database theft and the insider, mapped onto the text.

1. Trespass in the Server Room

The old torts knew what to do with a man who walked into another's godown: entering was trespass, carrying goods away was conversion, smashing the stock was damage, and blocking the doorway so customers could not enter was nuisance. Section 43 rebuilds that ladder for the server room. Entering is clause (a), carrying copies away is clause (b), planting something harmful is clause (c), smashing is (d), jamming the doorway is (e) and (f), and helping the trespasser, free-riding on the meter, wiping the ledgers and stealing the blueprints fill out the rest. And as with trespass, the law asks only one question: did you have permission?

2. The Frame of Section 43

• Without permission: the heart. Liability turns on the absence of permission of the owner or the person in charge, not on intention. Authorisation and consent therefore define the wrong: what was permitted, to whom, for what purpose and for how long.
• No mental element. A cyber tort of near strict liability: negligence, curiosity or even good motives are no defence if the act was unpermitted. Dishonesty only matters when Section 66 is invoked.
• Exceeding authority. Permission has edges. Access granted for one purpose does not cover another, and access rights end when the engagement ends, which is what catches the departing employee.
• 2008 changes. The original cap of ₹1 crore was removed, and clauses (i) and (j) were added, so the section now runs from access to source code.

3. The Ten Clauses

Figure 1: The ten contraventions in Section 43

• (a) Access without permission. Accessing or securing access to a computer, computer system or network. 'Access' (s.2(1)(a)) means gaining entry into, instructing or communicating with the logical, arithmetical or memory function resources; merely reaching a login prompt is not access, getting past it is.
• (b) Downloading, copying, extracting. Taking any data, computer database or information, including information held in removable storage. This is the database theft clause: the owner keeps his copy, yet the law treats the copying itself as the wrong, so civil liability arises without proving dishonesty.
• (c) Introducing contaminant or virus. Planting any computer contaminant or virus into the resource, whether by infected attachment, USB drive or compromised update.
• (d) Damage. Damaging the computer, system, network, data, database or any other programs. 'Damage' means to destroy, alter, delete, add, modify or rearrange any computer resource by any means.
• (e) Disruption. Disrupting or causing disruption of a computer, system or network, covering attacks that leave hardware and data intact but stop the service.
• (f) Denial of access. Denying or causing denial of access to a person authorised to access the resource, the clause that squarely covers denial-of-service attacks and lockouts.
• (g) Assisting unauthorised access. Providing any assistance to any person to facilitate access in contravention of the Act, which reaches the insider who shares credentials and the vendor of access tools.
• (h) Charging to another's account. Charging the services availed of by one person to the account of another by tampering with or manipulating a computer, system or network, the free-rider clause for stolen internet time, cloned subscriptions and manipulated billing.
• (i) Destroying, deleting, altering, diminishing. Destroying, deleting or altering any information residing in a computer resource, or diminishing its value or utility, or affecting it injuriously by any means (added 2008). Encryption of files by an attacker diminishes their utility even though nothing is deleted.
• (j) Source code. Stealing, concealing, destroying or altering, or causing any person to do so, any computer source code with an intention to cause damage (added 2008). Note the exception in the section's scheme: this clause alone carries a mental element. Section 65 remains the offence for tampering with source code required to be kept by law.

The defined terms

Figure 2: Computer contaminant and computer virus

• Computer contaminant. Any set of instructions designed to modify, destroy, record or transmit data or programs, or to usurp the normal operation of the computer, system or network. It is the wider term, covering spyware, keyloggers, logic bombs, trojans and ransomware.
• Computer virus. Instructions, information, data or programs that destroy, damage, degrade or adversely affect performance, or attach themselves to another resource and operate when a program, data or instruction is executed or another event occurs. The self-attaching character is its mark; every virus is a contaminant, but not every contaminant is a virus.
• Computer database. A representation of information, knowledge, facts, concepts or instructions being prepared or produced in a formalised manner, intended for use in a computer resource.

4. Denial-of-Service and Distributed Attacks

Figure 3: DoS and DDoS under the Act

• DoS. A single source floods a server or exhausts its resources so genuine users are shut out: clause (e) disruption and clause (f) denial of access.
• DDoS. The flood comes from a botnet of compromised machines. The attacker also answers for clause (c), because the contaminant that recruited each bot was his, and each bot owner is himself a victim under (a) and (c)
• Criminal overlay. Done dishonestly or fraudulently, the attack is an offence under Section 66; aimed at critical information infrastructure with intent to strike terror, it can amount to cyber terrorism under Section 66F.

5. Compensation and Adjudication

Figure 4: From contravention to compensation

• Compensation under Section 43. Damages by way of compensation to the person affected, uncapped since 2008. The measure follows Section 47: the gain or unfair advantage made, the loss caused, and the repetitive nature of the default.
• Forum. The adjudicating officer under Section 46 for claims up to ₹5 crore, with appeal to TDSAT and the High Court; the competent civil court above that (see Topic 12)
• Corporate liability. Section 85 extends liability to companies and their officers in charge; and a body corporate whose negligence in securing sensitive data enables the attack answers separately under Section 43A (Topic 54)
• Poona Auto Ancillaries v. Punjab National Bank (Adjudicating Officer, Maharashtra, 2013). A phishing-based transfer from a company account led to an award against the bank for failing to prevent unauthorised access, following the Umashankar approach: the civil track can reach the institution whose weak systems let the contravention happen.

6. Section 43 vs Section 66

Figure 5: Civil contravention and criminal offence compared

• The bridge. Section 66 provides that if any person, dishonestly or fraudulently, does any act referred to in Section 43, he is punishable with imprisonment up to three years or fine up to ₹5 lakh or both. The actus reus is identical; the mens rea makes the crime.
• Civil contravention vs criminal computer offence. Different aims (restoring the victim vs punishing the offender), different initiators (the affected person vs the State), different standards of proof, different outcomes, and both can run in parallel (s.77; M.S. Sheriff, see Topic 12)
• Drafting an answer. In a problem question, first fix the clause of Section 43, then ask whether dishonesty or fraud is shown for Section 66, then add any special offence (ss.65, 66C, 66D, 66E, 66F) the facts attract.

7. The Modern Scenarios

Figure 6: Mapping familiar wrongs onto Section 43

• Hacking. The word no longer appears in the Act (the old s.66 offence of 'hacking' went in 2008), but the conduct is clauses (a), (d) and (i), with Section 66 when dishonest.
• Malware. Clause (c) at the moment of introduction, with (d), (e) and (i) for what the malware then does.
• Ransomware. Clause (c) for the contaminant, (f) for the lockout, (i) for the encrypted files' lost utility; criminally, Section 66 and extortion provisions of the BNS.
• Unauthorised database access. Clauses (a) and (b); the customer list copied overnight is a Section 43(b) claim even if proving dishonesty for Section 66 is hard.
• Employee misuse and insider threats. The employee who exceeds his authorisation, retains access after exit, or walks out with the code repository engages (a), (b), (g), (i) and (j). Bombay's Gagan Harsh Sharma ruling routes such data theft through the IT Act rather than the general offences of theft (see Topic 7)

8. Quick Revision and Memory Aids

• 'Trespass in the server room'. The nature of s.43.
• 'Enter, take, plant, break, jam, block, help, bill, wipe, code'. Clauses (a) to (j) in order.
• 'Permission is the whole question'. No mental element, save clause (j)
• 'Virus attaches, contaminant commands'. The two defined terms.
• '43 compensates, 66 punishes'. The bridge.
• 'Gain, loss, repetition'. Section 47 quantum factors.

9. Frequently Asked Questions

Is intention required for liability under Section 43?

No, except under clause (j) on computer source code, which requires an intention to cause damage. For the other clauses, doing the act without the permission of the owner or person in charge is enough; dishonesty or fraud matters only for the offence under Section 66.

What is the maximum compensation under Section 43?

There is no ceiling. The 2008 Amendment removed the original ₹1 crore cap. Claims up to ₹5 crore go to the adjudicating officer under Section 46, assessed on the Section 47 factors; larger claims go to the competent civil court.

10. Related Topics

• Topic 54: Section 43A and the SPDI Rules. The companion data protection contravention.
• Topic 12: Civil and Criminal Legislation. The two tracks and parallel proceedings.