Section 66 IT Act: Computer Related Offences

Section 66 is one sentence long and carries most of Indian cybercrime on its back. It creates no conduct of its own: it borrows the ten acts of Section 43 and adds two words, dishonestly and fraudulently, that turn a compensable contravention into a punishable crime. Understand those two words and the borrowed list, and the section decodes every headline, from data theft and ransomware to website defacement and the rogue employee. Topics 7 and 53 set the context; this note is the full criminal treatment: the text, the mental elements, the attack patterns, proof, and the boundary with the BNS.

1. One Sentence, Ten Crimes

Think of Section 43 as a list of ten trespasses against computers, each priced in compensation. Section 66 is the magistrate standing beside the list saying: do any of these to cheat or to cause wrongful loss, and you answer to me as well. The trespass supplies the act; the intent supplies the crime. That is why the first question in any Section 66 problem is never 'was it hacking?' but 'which clause of Section 43, and was it done dishonestly or fraudulently?'

Figure 1: The bridge from Section 43 to Section 66

2. The Section

• Structure. Actus reus by reference (any act in s.43(a) to (j)) plus a mental element (dishonestly or fraudulently). Both must be proved; either mental state suffices.
• Punishment and classification. Up to three years, or fine up to ₹5 lakh, or both; cognizable and bailable (s.77B); compoundable under s.77A subject to its exceptions; investigated by an officer not below Inspector (s.78)
• The IPC to BNS shift. The Explanation still names IPC ss.24 and 25; by Section 358(2) BNS read with the General Clauses Act, those references are now read as ss.2(7) and 2(9) of the BNS, which repeat the definitions.
• Hacking under the current Act. The pre-2008 Section 66 defined an offence called 'hacking'. The 2008 substitution deleted the word; the conduct survives as dishonest unauthorised access under s.66 read with s.43(a). Writing 'Section 66: hacking' describes the repealed law.

3. Dishonestly and Fraudulently

Figure 2: The two mental elements

• Dishonestly. Doing anything with the intention of causing wrongful gain to one person or wrongful loss to another (s.2(7) BNS). Wrongful gain is gain by unlawful means of property one is not legally entitled to; wrongful loss is the mirror. The focus is property.
• Fraudulently. Doing a thing with intent to defraud but not otherwise (s.2(9) BNS). Courts read 'defraud' as deception coupled with actual or possible injury, which need not be economic, so the fraudulent limb reaches deceit that dishonesty's property focus might miss.
• Why the words matter. They mark the civil-criminal line. Copying a file without permission is a s.43(b) contravention whoever does it; copying it to sell to a rival is s.66. The mischief-maker who deletes files for amusement causes wrongful loss and is caught; the researcher who strays without any intended gain or loss generally is not, though he still pays under s.43.

4. The Offence in Action

Figure 3: Modern attack patterns under Section 66

• Unauthorised access and intrusion. Breaking into servers, accounts or networks: s.43(a) with dishonest or fraudulent intent. Password cracking, session hijacking and exploiting vulnerabilities all fit.
• Data theft. Copying or extracting data or databases (s.43(b)) to sell, use or leak: the commonest charge, and after Gagan Harsh Sharma v. State of Maharashtra (Bombay HC, 2018) it travels under the IT Act, not as IPC theft, where the facts are wholly covered.
• Malware and ransomware. Introducing the contaminant (s.43(c)), the damage and disruption it causes (s.43(d), (e)) and the lost utility of encrypted files (s.43(i)), each with obvious dishonest intent; the ransom demand adds extortion under the BNS.
• Denial-of-service. s.43(e) and (f) done to injure a competitor or extort; against critical information infrastructure with terror intent, the same facts escalate to s.66F.
• Website defacement. Altering the site's content and diminishing its value (s.43(d), (i)); political or reputational motives still satisfy 'fraudulently' where deception and injury combine, and wrongful loss to the owner usually makes out dishonesty.
• Account takeover. s.43(a) plus the identity theft offence (s.66C) for using the victim's password, and s.66D where the taken-over account is used to cheat others by personation.
• Insider cybercrime. The employee or contractor who exceeds or outlives his authorisation: s.43(a), (b) and (i) with dishonest intent, often alongside criminal breach of trust; consent to access for one purpose is no consent for another.

5. Section 43 vs Section 66, and Proof

• Civil liability vs criminal liability. Same acts, different questions: s.43 asks only 'without permission?', decided on probabilities and answered in compensation; s.66 adds 'dishonestly or fraudulently?', proved beyond reasonable doubt and answered in punishment. Both tracks can run together (s.77; see Topic 12)
• Proof of dishonesty or fraud. Intent is inferred: from concealment of identity and trails, sale or monetisation of the data, ransom notes, timing around a resignation or dispute, and the implausibility of innocent explanations. Forensic evidence, logs, IP traces, imaged devices, comes in under s.63 BSA with hash values, and no presumption relieves the prosecution of the mental element.

Figure 4: Proving a Section 66 case

6. Section 66 and the BNS Property and Fraud Offences

Figure 5: Where the BNS stands beside Section 66

• The special law principle. Where the IT Act specially and fully covers the conduct, the general penal provision cannot be invoked for the same act: Sharat Babu Digumarti for electronic obscenity, applied to data theft in Gagan Harsh Sharma, quashing IPC theft and mischief charges that duplicated ss.43 and 66.
• Where both survive. Offences with distinct ingredients still run alongside: cheating by personation (s.66D itself, or s.318 BNS for the non-computer elements), criminal breach of trust by the entrusted employee, extortion for the ransom demand, and forgery where a false electronic record is made.
• Drafting an answer. Fix the s.43 clause; establish the mental element; add the special offences (ss.65, 66B to 66F) the facts attract; then test any BNS charge against the special-law principle.

7. Quick Revision and Memory Aids

• 'One sentence, ten crimes'. s.66 borrows the whole of s.43.
• 'Act from 43, intent from the code'. The two ingredients.
• 'Dishonest eyes the property, fraud plays the deceit'. The two mental elements.
• 'Three years or five lakh'. The punishment.
• 'No intent, no crime, still the compensation'. The civil floor beneath the offence.
• 'Special law holds the field'. Sharat Babu and Gagan Harsh Sharma.

8. Frequently Asked Questions

What must the prosecution prove under Section 66?

Two things beyond reasonable doubt: that the accused did an act referred to in Section 43, such as unauthorised access, copying, introducing a contaminant or deleting information, and that he did it dishonestly or fraudulently within the meanings in Sections 2(7) and 2(9) of the BNS. Punishment is up to three years, or fine up to ₹5 lakh, or both.

Is hacking an offence under the IT Act?

The named offence of 'hacking' was removed by the 2008 Amendment. The conduct remains criminal as dishonest or fraudulent unauthorised access under Section 66 read with Section 43(a), with Sections 66C and 66D adding identity theft and personation where credentials are misused.

9. Related Topics

• Topic 53: Section 43. The ten acts the offence borrows.
• Topic 26: IT Act and the BNS, BNSS, BSA. The general criminal law alongside.