Sections 68 to 69B IT Act: Government Directions, Interception and Blocking

Sections 68 to 69B gather the Act's command powers: the Controller directing Certifying Authorities, and the Government reading communications (s.69), silencing content (s.69A) and watching the flow of traffic (s.69B). Each power comes with its own grounds, its own 2009 rules and its own constitutional questions, sharpened since privacy became a fundamental right. Topics 17 and 18 examined the free speech and privacy dimensions; this note is the statutory machine room: the provisions, the procedures, the safeguards and the comparisons.

1. The Ear, the Gag and the Meter

A State dealing with dangerous communication has three tools: an ear that listens to what is said (interception), a gag that stops others from hearing it (blocking), and a meter that records who talked to whom, when and how much, without hearing a word (traffic data). Sections 69, 69A and 69B are those three tools, each with a different intrusiveness and therefore a different set of grounds and safeguards, and Section 68 stands slightly apart as the Controller's whip over Certifying Authorities.

Figure 1: The four powers in one line

2. Section 68: The Controller's Directions

• The power. The Controller may, by order, direct a Certifying Authority or any employee of such Authority to take such measures or cease carrying on such activities as specified, if necessary to ensure compliance with the Act, rules or regulations.
• Failure to comply. Intentional or knowing failure was an offence (up to two years or ₹1 lakh or both after 2008); since 30 November 2023 it is a civil penalty of up to ₹25 lakh, adjudicated under s.46 (see Topic 40)
• Place in the scheme. The provision completes the Controller's supervisory kit of Chapter VI (Topics 49 and 50); it has nothing to do with surveillance, and confusing s.68 with s.69 is a marked error.

3. Section 69: Interception, Monitoring and Decryption

Figure 2: The grounds, and where Section 69A differs

• The grounds. Sovereignty or integrity of India; defence of India; security of the State; friendly relations with foreign States; public order; preventing incitement to a cognizable offence relating to these; and investigation of any offence, the widest ground, added in 2008 and absent from both the Telegraph regime and s.69A.
• Decryption assistance. The subscriber, intermediary or person in charge of the resource must, when called upon, extend all facilities and technical assistance to provide access, intercept, monitor or decrypt the information (s.69(3)). Encryption is thus met with a legal duty of assistance rather than a ban; failure is punishable with up to seven years and fine (s.69(4)), the harshest intermediary sanction in the Act.
• Section 69 vs telephone interception. Telephone tapping ran on s.5(2) Telegraph Act with Rule 419A, framed after PUCL (1997), and now runs on s.20(2) of the Telecommunications Act, 2023 and its 2024 rules; those need a public emergency or public safety. Section 69 has no such threshold and adds the investigation ground, which is why commentators call it the wider power; its safeguards were consciously copied from Rule 419A.

Figure 3: The Interception Rules, 2009 in sequence

• The 2009 Rules. The Information Technology (Procedure and Safeguards for Interception, Monitoring and Decryption of Information) Rules, 2009 supply the machinery: the competent authority is the Union Home Secretary (the Home Secretary in a State); in unavoidable circumstances an authorised officer not below Joint Secretary may order, subject to confirmation within seven working days; alternative means must be considered; directions run 60 days, renewable to a maximum of 180; a Review Committee headed at Cabinet Secretary level (Chief Secretary in States) examines every direction at least once in two months; and records are destroyed every six months when no longer needed, intermediaries destroying theirs in two.
• Safeguards against surveillance. Reasons in writing, named authority, limited duration, review, destruction and confidentiality are the checks; ten agencies were notified in 2018 as authorised to intercept under these rules, an order under challenge in the Internet Freedom Foundation litigation.
• Section 69 and the right to privacy. After Puttaswamy, every order must satisfy legality, legitimate aim, necessity and proportionality; Vinit Kumar (Bombay HC, 2019) quashed interception that failed the tests and ordered the material destroyed, and the Pegasus proceedings rejected a national security free pass (see Topic 18)

Figure 4: Assistance, refusal and the constitutional check

4. Section 69A: Blocking Public Access

• The power. Where satisfied that it is necessary, the Central Government may, for reasons recorded in writing, direct any agency or intermediary to block public access to any information generated, transmitted, received, stored or hosted in any computer resource.
• The grounds. Sovereignty and integrity of India, defence of India, security of the State, friendly relations with foreign States, public order, or preventing incitement to a cognizable offence relating to these: six grounds aligned to Article 19(2), with no investigation ground.
• Website, app and social media blocking. The power covers URLs, whole websites, mobile apps (the 2020 app bans rested on it) and accounts or posts on social platforms; intermediary failure to comply is punishable with up to seven years and fine (s.69A(3))

Figure 5: The Blocking Rules, 2009 from request to review

• The Blocking Rules, 2009. Requests travel from Nodal Officers (or courts) to the Designated Officer, not below Joint Secretary; a committee with representatives of Law, Home, Information and Broadcasting and CERT-In examines each request, with an effort to identify the originator or intermediary and give 48 hours' notice to be heard; the Secretary, MeitY approves; and the Designated Officer directs the blocking.
• Emergency blocking. In emergencies the Designated Officer may recommend interim blocking, approved by the Secretary, with the committee examining the matter within 48 hours; the interim order is then confirmed or revoked.
• Review and confidentiality. A Review Committee meets at least once in two months to check that directions conform to the Act; Rule 16 requires strict confidentiality of complaints, requests and actions, the most criticised feature, because the affected speaker often never sees the order.
• Shreya Singhal on Section 69A. The section was upheld: unlike s.66A, its grounds are narrow and relatable to Article 19(2), reasons must be recorded so orders can be tested in writ proceedings, and the rules build in a hearing (see Topic 59)
• Procedural safeguards and challenges. The recorded reasons, committee scrutiny, hearing attempt and review are the safeguards; challenges lie in writ jurisdiction, and the Tanul Thakur line required the blocking order to be supplied to the originator with a post-decisional hearing. In X Corp v. Union of India the Karnataka High Court (2023) dismissed the platform's challenge to account-level blocking with costs, and its 2025 decision rejected the challenge to the Sahyog portal built on Rule 3(1)(d) intimations, holding s.79(3)(b) a distinct route from s.69A. Confidentiality and account-wide blocking remain the live constitutional questions.

Figure 6: Section 69A and free speech: the checkpoints

5. Section 69B: Traffic Data Monitoring

Figure 7: Purpose, object and default under Section 69B

• The power. The Central Government may, to enhance cyber security and to identify, analyse and prevent intrusion or spread of computer contaminants, by notification authorise any agency to monitor and collect traffic data or information generated, transmitted, received or stored in any computer resource, and intermediaries must extend technical assistance.
• Traffic data: meaning. Any data identifying or purporting to identify any person, computer system, computer network or location to or from which a communication is or may be transmitted, including its origin, destination, route, time, date, size, duration or type of underlying service: the envelope and the postmark, never the letter.
• The 2009 Rules and the default. The Information Technology (Procedure and Safeguard for Monitoring and Collecting Traffic Data or Information) Rules, 2009 mirror the interception safeguards, competent authority, review, confidentiality; intentional or knowing contravention by an intermediary now draws up to one year, or fine up to ₹1 crore, or both (s.69B(4), as recast in 2023)
• Why it still matters for privacy. Metadata maps lives, who spoke to whom, when, from where, so proportionality applies to s.69B too, and the CERT-In log mandates feed the same debate (Topics 18 and 19)

6. The Three Powers Compared

Figure 8: Sections 69, 69A and 69B side by side

7. Quick Revision and Memory Aids

• 'The ear, the gag and the meter'. ss.69, 69A, 69B.
• 'Eight grounds to listen, six to block, one purpose to meter'. The grounds compared.
• 'Home Secretary taps, MeitY blocks'. The competent authorities.
• '60 renewable to 180; review every two months; destroy in six'. The interception clocks.
• '48 hours to be heard, 48 hours after an emergency'. The blocking clocks.
• 'Seven years to refuse the ear or the gag; a crore for the meter'. The defaults.
• 'Upheld, but read with Puttaswamy'. The constitutional position.

8. Frequently Asked Questions

What safeguards govern interception under Section 69?

Under the 2009 Rules: a written, reasoned direction of the competent authority (the Union or State Home Secretary, with an emergent route confirmed within seven working days), consideration of alternative means, a life of 60 days renewable to a maximum of 180, scrutiny by a Review Committee at least once in two months, confidentiality, and destruction of records every six months when no longer required. After Puttaswamy, every order must also be necessary and proportionate.

Why was Section 69A upheld when Section 66A was struck down?

Because Section 69A is confined to grounds that mirror Article 19(2), requires reasons to be recorded in writing so that orders can be challenged, and operates through rules that provide committee examination and a hearing to the originator or intermediary. Section 66A had none of these: undefined terms, no 19(2) anchor and no procedure (Shreya Singhal, 2015).

9. Related Topics

• Topic 18: IT Act and Right to Privacy. The constitutional testing of these powers.
• Topic 17: IT Act and Free Speech. Blocking and the Article 19 framework.