 bill no 96-c of 2006 the information technology (amendment) bill, 2008 a billfurther to amend the information technology act, 2000be  it enacted by parliament in the fifty-ninth year of the republic of india as follows:— part  i preliminaryshort title and commencement1 (1) this act may be called the information technology (amendment) act,2008(2) it shall come into force on such date as the central government may, by notification in the official gazette, appoint:provided that different dates may be appointed for different provisions of this act and any reference in any such provision to the commencement of this act shall be construed as a reference to the coming into force of that provision part ii amendments to the information technology act, 200021 of 20002 in the information technology act, 2000 (hereinafter in this part referred to as the principal act), for the words "digital signature" occurring in the chapter, section, subsection and clause referred to in the table below, the words "electronic signature" shall be substitutedsubstitution of words "digital signature" by words "electronic signature"tablesnochapter/section/sub-section/clause(1)clauses (d), (g), (h) and (zg) of section 2;(2)section 5 and its marginal heading;(3)marginal heading of section 6;(4)clauses (a), (b), (c) and (e) of section 10 and its marginal heading;(5)heading of chapter v;(6)clauses (f) and (g) of section 18;(7)sub-section (2) of section 19;(8)sub-sections (1) and (2) of section 21 and its marginal heading;(9)sub-section (3) of section 25;(10)clause (c) of section 30;(11)clauses (a) and (d) of sub-section (1) and sub-section (2) of section 34;(12)heading of chapter vii;(13)section 35 and its marginal heading;(14)section 64;(15)section 71;(16)sub-section (1) of section 73 and its marginal heading;(17)section 74; and(18)clauses (d), (n) and (o) of sub-section (2) of section 87amendment of section 13 in section 1 of the principal act, for sub-section (4), the following sub-sections shall be substituted, namely:—"(4) nothing in this act shall apply to documents or transactions specified in the first schedule:provided that the central government may, by notification in the official gazette, amend the first schedule by way of addition or deletion of entries thereto(5) every notification issued under sub-section (4) shall be laid before each house of parliament" 4 in section 2 of the principal act,—amendment of section 2(a) after clause (h), the following clause shall be inserted, namely:—'(ha) "communication device" means cell phones, personal digital assistance or combination of both or any otehr device used to communicate, send or transmit any text, video, audio or image;'; (b) for clause (j), the following clause shall be substituted, namely:—'(j) "computer network" means the inter-connection of one or more computers or computer systems or communication device through—(i) the use of satellite, microwave, terrestrial line, wire, wireless or other communication media; and(ii) terminals or a complex consisting of two or more inter-connected computers or communication device whether or not the inter-connection is continuously maintained;';(c) in clause (n), the word "regulations" shall be omitted;(d) after clause (n), the following clauses shall be inserted, namely:—'(na) "cyber cafe" means any facility from where access to the internet is offered by any person in the ordinary course of business to the members of the public;(nb) "cyber security" means protecting information, equipment, devices computer, computer resource, communication device and information stroed therein from unauthorised access, use, disclosure, disruption, modification or destruction;' (e) after clause (t), the following clauses shall be inserted, namely:—'(ta) "electronic signature" means authentication of any electronic record by a subscriber by means of the electronic technique specified in the second schedule and includes digital signature;(tb) "electronic signature certificate" means an electronic signature certificate issued under section 35 and includes digital signature certificate;'; (f) after clause (u), the following clause shall be inserted, namely:—'(ua) "indian computer emergency response team" means an agency established under sub-section (1) of section 70b;';(g) in clause (v), for the words "data, text", the words "data, message, text" shall be substituted;(h) for clause (w), the following clause shall be substituted, namely:—'(w) "intermediary", with respect to any particular electronic records, means any person who on behalf of another person receives, stores or transmits that record or provides any service with respect to that record and includes telecom service providers, network service providers, internet service providers, webhosting service providers, search engines, online payment sites, online-auction sites, online-market places and cyber cafes;'5 in chapter ii of the principal act, for the heading, the heading "digital signatureand electronic signature'' shall be substitutedamendment of heading of chapter ii6 after section 3 of the principal act, the following section shall be inserted, namely:—insertion of new section3a electronic signature"3a (1) notwithstanding anything contained in section 3, but subject to the provisions of sub-section (2), a subscriber may authenticate any electronic record by such electronic signature or electronic authentication technique which—(a) is considered reliable; and (b) may be specified in the second schedule(2) for the purposes of this section any electronic signature or electronic authentication technique shall be considered reliable if—(a) the signature creation data or the authentication data are, within the context in which they are used, linked to the signatory or, as the case may be, the authenticator and to no other person;(b) the signature creation data or the authentication data were, at the time of signing, under the control of the signatory or, as the case may be, the authenticator and of no other person;(c) any alteration to the electronic signature made after affixing such signature is detectable;(d) any alteration to the information made after its authentication by electronic signature is detectable; and(e) it fulfils such other conditions which may be prescribed(3) the central government may prescribe the procedure for the purpose of ascertaining whether electronic signature is that of the person by whom it is purported to have been affixed or authenticated(4) the central government may, by notification in the official gazette, add to or omit any electronic signature or electronic authentication technique and the procedure for affixing such signature from the second schedule:provided that no electronic signature or authentication technique shall be specified in the second schedule unless such signature or technique is reliable(5) every notification issued under sub-section (4) shall be laid before each house of parliament" 7 after section 6 of the principal act, the following section shall be inserted, namely:—insertion of new section 6a delivery of services by service provider'6a (1) the appropriate government may, for the purposes of this chapter and for efficient delivery of services to the public through electronic means authorise, by order, any service provider to set up, maintain and upgrade the computerised facilities and perform such other services as it may specify, by notification in the official gazetteexplanation—for the purposes of this section, service provider so authorised includes any individual, private agency, private company, partnership firm, sole proprietor firm or any such other body or agency which has been granted permission by the appropriate government to offer services through electronic means in accordance with the policy governing such service sector(2) the appropriate government may also authorise any service provider authorised under sub-section (1) to collect, retain and appropriate such service charges, as may be prescribed by the appropriate government for the purpose of providing such services, from the person availing such service(3) subject to the provisions of sub-section (2), the appropriate government may authorise the service providers to collect, retain and appropriate service charges under this section notwithstanding the fact that there is no express provision under the act, rule, regulation or notification under which the service is provided to collect, retain and appropriate e-service charges by the service providers(4) the appropriate government shall, by notification in the official gazette, specify the scale of service charges which may be charged and collected by the service providers under this section:provided that the appropriate government may specify different scale of service charges for different types of services'8 after section 7 of the principal act, the following section shall be inserted, namely:—insertion of new section 7a"7a where in any law for the time being in force, there is a provision for audit of documents, records or information, that provision shall also be applicable for audit of documents, records or information processed and maintanined in the electronic form"audit or documents, etc, maintained in electronic form9 after section 10 of the principal act, the following section shall be inserted, namely:—insertion of new section 10avalidity of contracts formed through electronic means"10a where in a contract formation, the communication of proposals, the acceptance of proposals, the revocation of proposals and acceptances, as the case may be, are expressed in electronic form or by means of an electronic record, such contract shall not be deemed to be unenforceable solely on the ground that such electronic form or means was used for that purpose"amendment of section 1210 in section 12 of the principal act, in sub-section (1), for the words "agreed with the addressee", the word "stipulated" shall be substituted11 for sections 15 and 16 of the principal act, the following sections shall be substituted, namely:—substitution of new sections for sections15 and 16'15 an electronic signature shall be deemed to be a secure electronic signature if—secure electronic signature(i) the signature creation data, at the time of affixing signature, was under the exclusive control of signatory and no other person; and(ii) the signature creation data was stored and affixed in such exclusive manner as may be prescribed explanation—in case of digital signature, the "signature creation data" means the private key of the subscriber16 the central government may, for the purposes of sections 14 and 15, prescribe the security procedures and practices:security procedures and practicesprovided that in prescribing such security procedures and practices, the central government shall have regard to the commercial circumstances, nature of transactions and such other related factors as it may consider appropriate' 12 in section 17 of the principal act,—amendment of section 17(a) in sub-section (1), for the words "and assistant controllers", the words",assistant controllers, other officers and employees" shall be substiuted; and(b) in sub-section (4), for the words "and assistant controllers", the words",assistant controllers, other officers and employees" shall be substituted" 13 section 20 of the principal act shall be omittedomission of section 20amendment of section 2914 in section 29 of the principal act, in sub-section (1), for the words "any contravention of the provisions of this act, rules or regulations made thereunder", the words "any contravention of the provisions of this chapter" shall be substitutedamendment of section 3015 in section 30 of the principal act,—(i) in clause (c), after the word "assured", the word "and" shall be omitted;(ii) after clause (c), the following clauses shall be inserted, namely:—"(ca) be the repository of all electronic signature certificates issued under this act;(cb) publish information regarding its practices, electronic signature certificates and current status of such certificates; and"amendment of section 3416 in section 34 of the principal act, in sub-section (1), in clause (a), the words "which contains the public key corresponding to the private key used by that certifying authority to digitally sign another digital signature certificate" shall be omitted17 in section 35 of the principal act, in sub-section (4), —amendment of section 35(a) the first proviso shall be omitted; (b) in the second proviso, for the words "provided further", the word "provided"shall be substitutedamendment of section 3618 in section 36 of the principal act, after clause (c), the following clauses shall be inserted, namely:—"(ca) the subscriber holds a private key which is capable of creating a digital signature;(cb) the public key to be listed in the certificate can be used to verify a digital signature affixed by the private key held by the subscriber;"19 after section 40 of the principal act, the following section shall be inserted, namely:—insertion of new section 40a"40a in respect of electronic signature certificate the subscriber shall perform such duties as may be prescribed''duties of subscriber of electronic signature certificate20 in chapter ix of the principal act, in the heading, for the words "penalties andadjudication ", the words "penalties, compensation and adjudication" shall be substitutedamendment of heading of chapter ix 21 in section 43 of the principal act,—amendment of section 43(a)  in the marginal heading, for the word "penalty", the  words "penalty and compensation" shall be substituted;(b) in clause (a), after the words "computer network", the words "or computer resoruce" shall be inserted;(c) after clause (h), the following clauses shall be inserted, namely:—"(i) destroys, deletes or alters any information residing in a computer resource or diminishes its value or utility or affects it injuriously by any means;(j) steel, conceals, destroys or alters or causes any person to steal, conceal, destroy or alter any computer source code used for a computer resource with an intention to cause damage;"; (d) for the portion begining with the words "he shall be liable to pay damages"and ending with the words "persons so affected" the following shall be substituted, namely:—"he shall be liable to pay damages by way of compensation to the person so affected"; (e) in the explanation, after clause (iv), the following clause shall be inserted, namely:—'(v) "computer source code" means the listing of programmes, computer commands, design and layout and programme analysis of computer resource in any form"22  after section 43 of the principal act, the following section shall be inserted, namely:—insertion of new section 43acompensation for failure to protect data'43a where a body corporate, possessing, dealing or handling any sensitive personal data or information in a computer resource which it owns, controls or operates, is negligent in implementing and maintaining reasonable security practices and procedures and thereby causes wrongful loss or wrongful gain to any person, such body corporate shall be liable to pay damages by way of compensation to the person so affectedexplanation—for the purposes of this section,—(i) "body corporate" means any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities;(ii) "reasonable security practices and procedures" means security practices and procedures designed to protect such information from unauthorised access, damage, use, modification, disclosure or impairment, as may be specified in an agreement between the parties or as may be specified in any law for the time being in force and in the absence of such agreement or any law, such reasonable security practices and procedures, as may be prescribed by the central government in consultation with such professional bodies or associations as it may deem fit;(iii) "sensitive personal data or information" means such personal information as may be prescribed by the central government in consultation with such professional bodies or associations as it may deem fit'23  in section 46 of the principal act,—amendment of section 46(a) in sub-section (1), for the words "direction or order made thereunder", the words "direction or order made thereunder which renders him liable to pay penalty or compensation," shall be substituted;(b) after sub-section (1), the following sub-section shall be inserted, nanmely:—"(1a) the adjudicating officer appointed under sub-section (1) shall exercise jurisdiction to adjudicate matters in which the claim for injury or damage does not exceed rupees five crore:provided that the jurisdiction in respect of the claim for injury or damage exceeding rupees five crore shall vest with the competent court"; (c) in sub-section (5), after clause (b) the following clause shall be inserted, namely:—5 of 1908"(c) shall be deemed to be a civil court for purposes of order xxi of the civil procedure code, 1908"24 in chapter x of the principal act, in the heading, the word "regulations" shall be omittedamendment of heading of chapter x amendment of section 4825 in section 48 of the principal act, in sub-section (1), the word "regulations" shall be omitted26 for sections 49 to 52 of the principal act, the following sections shall be substituted, namely:—substitution of new sections for sections 49 to 52"49 (1) the cyber appellate tribunal shall consist of a chairperson and such number of other members, as the central government may, by notification in the official gazette, appoint:composition of cyber appellate tribunalprovided that the person appointed as the presiding officer of the cyber appellate tribunal under the provisions of this act immediately before the commencement of the information  technology (amendment) act, 2008 shall be deemed to have been appointed as the chairperson of the said cyber appellate tribunal under the provisions of this act as amended by the information technology (amendment) act, 2008(2) the selection of chairperson and members of the cyber appellate tribunal shall be made by the central government in consultation with the chief justice of india(3) subject to the provisions of this act—(a) the jurisdiction, powers and authority of the cyber appellate tribunal may be exercised by the benches thereof;(b) a bench may be constituted by the chairperson of the cyber appellate tribunal with one or two members of such tribunal as the chairperson may deem fit:(c) the benches of the cyber appellate tribunal shall sit at new delhi and at such other places as the central government may, in consultation with the chairperson of the cyber appellate tribunal, by notification in the official gazette, specify;(d) the central government shall, by notification in the official gazette, specify the areas in relation to which each bench of the cyber appellate tribunal may exercise its jurisdiction (4) notwithstanding anything contained in sub-section (3), the chairperson of the cyber appellate tribunal may transfer a member of such tribunal from one bench to another bench(5) if at any stage of the hearing of any case or matter it appears to the chairperson or a member of the cyber appellate tribunal that the case or matter is of such a nature that it ought to be heard by a bench consisting of more members, the case or matter may be transferred by the chairperson to such bench as the chairperson may deem fit50 (1) a person shall not be qualified for appointment as a chairperson of the cyber appellate tribunal unless he is, or has been, or is qualified to be, a judge of a high courtqualifications for appointment as chairperson and members of cyber appellate tribunal(2) the members of the cyber appellate tribunal, except the judicial member to be appointed under sub-section (3), shall be appointed by the central government from amongst persons, having special knowledge of, and professional experience in, information technology, telecommunication, industry, management or consumer affairs:provided that a person shall not be appointed as a member, unless he is, or has been, in the service of the central government or a state government, and has held the post of additional secretary to the government of india or any equivalent post in the central government or state government for a period of not less than one years or joint secretary to the government of india or any equivalent post in the central government or state government for a period of not less than seven years(3) the judicial members of the cyber appellate tribunal shall be appointed by the central government from amongst persons who is or has been a member of the indian legal service and has held the post of additional secretary for a period of not less than one year or grade i post of that service for a period of not less than five years51 (1) the chairperson or member of the cyber appellate tribunal shall hold office for a term of five years from the date on which he enters upon his office or until he attains the age of sixty-five years, whichever is earlierterm of office, conditions of service, etc, of chairperson and members(2) before appointing any person as the chairperson or member of the cyber appellate tribunal, the central government shall satisfy itself that the person does not have any such financial or other interest as is likely to affect prejudicially his functions as such chairperson or member(3) an officer of the central government or state government on his selection as the chairperson or member of the cyber appellate tribunal, as the case may be, shall have to retire from service before joining as such chairperson or member52 the salary and allowances payable to, and the other terms and conditions of service including pension, gratuity and other retirement benefits of, the chairperson or a member of the cyber appellate tribunal shall be such as may be prescribedsalary, allowances and other terms and conditions of service of chairperson and memberspowers of superintendence, direction, etc52a the chairperson of the cyber appellate tribunal shall have powers of general superintendence and directions in the conduct of the affairs of that tribunal and he shall, in addition to presiding over the meetings of the tribunal, exercise and discharge such powers and functions of the tribunal as may be prescribed52b where benches are constituted, the chairperson of the cyber appellate tribunal may, by order, distribute the business of that tribunal amongst the benches and also the matters to be dealt with by each benchdistribution of business among benchespower of chairperson to transfer cases52c on the application of any of the parties and after notice to the parties, and after hearing such of them as he may deem proper to be heard, or suo motu without such notice, the chairperson of the cyber appellate tribunal may transfer any case pending before one bench, for disposal to any other benchdecision by majority52d if the members of a bench consisting of two members differ in opinion on any point, they shall state the point or points on which they differ, and make a reference to the chairperson of the cyber appellate tribunal who shall hear the point or points himself and such point or points shall be decided according to the opinion of the majority of the members who have heard the case, including those who first heard it"amendment of section 5327 in section 53 of the principal act, for the words "presiding officer", the words"chairperson or member, as the case may be," shall be substitutedamendment of section 5428 in section 54 of the principal act, for the words "presiding officer" wherever they occur, the words "chairperson or the member" shall be substitutedamendment of section 5529 in section 55 of the principal act, for the words "presiding officer", the words"chairperson or the member" shall be substitutedamendment of section 5630 in section 56 of the principal act, for the words "presiding officer", the word"chairperson" shall be substituted31 in section 64 of the principal act,—amendment of section 64(i) for the words "penalty imposed", the words "penalty imposed or compensation awarded" shall be substituted;(ii) in the marginal heading, for the word "penalty", the words "penalty or compensation" shall be substituted 32 for sections 66 and 67 of the principal act, the following sections shall be substituted, namely:—substitution of new sections for sections 66 and 67computer related offences '66 if any person, dishonestly or fraudulently, does any act referred to in section43, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with bothexplanation—for the purposes of this section,—45 of 1860(a) the word "dishonestly" shall have the meaning assigned to it in section24 of the indian penal code;45 of 1860(b) the word "fraudulently" shall have the meaning assigned to it in section25 of the indian penal code66a any person who sends, by means of a computer resource or a communication device,—| (                                                                                      | a   | ) any information that is grossly offensive or has menacing character; or   ||----------------------------------------------------------------------------------------|-----|-----------------------------------------------------------------------------|| punishment                                                                             |     |                                                                             || for sending                                                                            |     |                                                                             || offensive                                                                              |     |                                                                             || messages                                                                               |     |                                                                             || through                                                                                |     |                                                                             || communication                                                                          |     |                                                                             || service, etc                                                                          |     |                                                                             || (                                                                                      | b   | ) any information which he knows to be false, but for the purpose of        || causing annoyance, inconvenience, danger, obstruction, insult, injury, criminal        |     |                                                                             || intimidation, enmity, hatred or ill will, persistently by making  use of such computer |     |                                                                             || resource or a communication device,                                                    |     |                                                                             |(c) any electronic mail or electronic mail message for the purpose of causing annoyance or inconvenience or to deceive or to mislead the addressee or recipient about the origin of such messages, shall be punishable with imprisonment for a term which may extend to three years and with fine'explanation— for the purpose of this section, terms "electronic mail" and"electronic mail message" means a message or information created or transmitted or received on a computer, computer system, computer resource or communication device including  attachments in text, images, audio, video and any other electronic record, which may be transmitted with the message 66b whoever dishonestly received or retains any stolen computer resource or communication device knowing or having reason to believe the same to be stolen computer resource or communication device, shall be punished with imprisonment of either description for a term which may extend to three years or with fine which may extend to rupees one lakh or with bothpunishment for dishonestly receiving stolen computer resource or communication device p u n i s h m e n t for identity theft66c whoever, fraudulently or dishonestly make use of the electronic signature, password or any other unique identification feature of any other person, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine with may extend to rupees one lakh66d whoever, by means for any communication device or computer resource cheats by personating, shall be punished with imprisonment of either description for a term which may extend to three years and shall also be liable to fine which may extend to one lakh rupeepunishment for cheating by personation by using computer resourcep u n i s h m e n t for violation of privacy66e whoever, intentionally or knowingly captures, publishes or transmits the image of a private area of any person without his or her consent, under circumstances violating the privacy of that person, shall be punished with imprisonment which may extend to three years or with fine not exceeding two lakh rupees, or with bothexplanation— for the purposes of this section—(a) "transmit" means to electronically send a visual image with the intent that it be viewed by a person or persons;(b) "capture", with respect to an image, means to videotape, photograph, film or record by any means;(c) "private area" means the naked or undergarment clad genitals, public area, buttocks or female breast:(d) "publishes" means reproduction in the printed or electronic form and making it available for public;(e) "under circumstances violating privacy" means circumstances in which a person can have a reasonable expectation that—(i) he or she could disrobe in privacy, without being concerned that an image of his private area was being captured; or(ii) any part of his or her private area would not be visible to the public, regardless of whether that person is in a public or private place66f (1) whoever,—punishment for cyber terrorism(a) with intent to threaten the unity, integrity, security or sovereignty of india orto strike terror in the people or any section of the people by—(i) denying or cause the denial of access to any person authorized toaccess computer resource; or(ii) attempting to penetrate or access a computer resource without authorisation or exceeding authorised access; or(iii) introducing or causing to introduce any computer contaminant;and by means of such conduct causes or is likely to cause death or injuries to persons or damage to or destruction of property or disrupts or knowing that it is likely to cause damage or discruption of supplies or services essential to the life of the community or adversely affect the critical information infrastructure specified under section 70, or(b) knowingly or intentionally penetrates or accesses a computer resource without authorisation or exceeding authorised access, and by means of such conduct btains access to information, data or computer database that is restriced for reasons for the security of the state or foreign relations, or any restrictued information, data or computer database, with reasons to believe that such information, data or computer database so obtained may be used to cause or likely to cause injury to the interests of the sovereignty and integrity of india, the secrity of the state, friendly relations with foreign states, public order, decency or morality, or in relation to contempt of court, defamation or incitement to an offence, or to the advantage of any foreign nation, group of individuals or otherwise, commits the offence of cyber terrorism(2) whoever commits or conspires to commit cyber terrorism shall be punishable with imprisonment which may extend to imprisonment for life'punishment for publishing or transmitting obscene material  in electronic form67 whoever publishes or transmits or causes to be published or transmitted in the electronic form, any material which is lascivious or appeals to the prurient interest or if its effect is such as to tend to deprave and corrupt persons who are likely, having regard to all relevant circumstances, to read, see or hear the matter contained or embodied in it, shall be punished on first conviction with imprisonment of either description for a term which may extend to three years and with fine which may extend to five lakh rupees and in the event of second or subsequent conviction with imprisonment of either description for a term which may extend to five years and also with fine which may extend to ten lakh rupees 67a whoever publishes or transmits or causes to be published or transmitted in the electronic form any material which contains sexually explicit act or conduct shall be punished on first conviction with imprisonment of either description for a term which may extend to five years and with fine which may extend to ten lakh rupees and in the event of second or subsequent conviction with imprisonment of either description for a term which may extend to seven years and also with fine which may extend to ten lakh rupeespunishment  for publishing or transmitting of material containing sexually explicit act, etc, in electronic  form67b whoever,—(a) publishes or transmites or causes to be published or transmitted material in any electronic form which depiets children engaged in sexually esplicit act or conduct; or(b) creates text or digital images, collects, seeks, browses, downloads, advertises, promotes, exchanges or distributes material in any electronic form depicting children in obscene or indecent or sexually explicit manner; orpunishment for publishing or transmitting of material depicting childern in sexually explicit act, etc, in electronic form(c) cultivates, entices or induces children to online relationship with one or more children for and on sexually explicit act or in a manner that may offend a reasonable adult on the computer resource; or(d) facilitates abusing children online, or (e) records in any electronic form own abuse or that of others pertaining to sexually explicit act with children, shall be punished on first conviction with imprisonment of either description for a term which may extend to five years and with fine which may extend to ten lakh rupees and in the event of second or subsequent conviction with imprisonment of either discription for a term which may extend to seven years and also with fine which may extend to ten lakh rupees:provided that provisions of section 67, section 67a and this section does not extend to any book, pamphlet, paper, writing, drawing, painting representation or figure in electronic form—(i) the publication of which is proved to be justified as being for the public good on the ground that such book, pamphlet, paper, writing drawing, painting representation or figure is the interest of science, literature, art or learning or other objects of general concern; or (ii) which is kept or used for bonafide hertiage or religious purposes explanation- for the purposes of this section "children" means a persons who has not completed the age of 18 years67c (1) intermediary shall preserve and retain such information as may be specified for such duration and in such manner and format as the central government may prescribepreservation and retention of information by intermediaries(2) any intermediary who intentionally or knowingly contravences the provisions of sub-section (1) shall be punished with an inprisonment for a term which may extend to three years and also be liable to fineamendment of section 68 33 in section 68 of the principal act, for sub-section (2), the following sub-section shall be substituted, namely:—"(2) any person who intentionally or knowingly fails to comply with any order under sub-section (1) shall be guilty of an offence and shall be liable on conviction to imprisonment for a term not exceeding two years or a fine not exceeding one lakh rupees or both" 34 for section 69 of the principal act, the following sections shall be substituted, namely:—substitution of new section for section 69 power to issue directions for interception or monitoring or decryption of any information through any computer resource"69 (1) where the central government or a state government or any of its officer specially authorised by the central government or the state government, as the case may be, in this behalf may, if satisfied that it is necessary or expedient so to do in the interest of the sovereignty or integrity of india, defence of india, security of the state, friendly relations with foreign states or public order or for preventing incitement to the commission of any cognizable offence relating to above or for investigation of any offence, it may subject to the provisions of sub-section (2), for reasons to be recorded in writing, by order, direct any agency of the appropriate government to intercept, monitor or decrypt or cause to be intercepted or monitored or decrypted any information generated, transmitted, received or stored in any computer resource(2) the procedure and safeguards subject to which such interception or monitoring or decryption may be carried out, shall be such as may be prescribed(3) the subscriber or intermediary or any person in-charge of the computer resource shall, when called upon by any agency referred to in sub-section (1),  extend all facilities and technical assistance to—(a) provide access to or secure access to the computer resource generating transmitting, receiving or storing such information; or(b) intercept, monitor, or decrypt the information, as the case may be; or (c) provide information stored in computer resource(4) the subscriber or intermediary or any person who fails to assist the agency referred to in sub-section (3) shall be punished with imprisonment for a term which may extend to seven years and shall also be liable to finepower to issue directions for blocking for public access of any information through any computer resource69a (1) where the central government or any of its officer specially authorised by it in this behalf is satisfied that it is necessary or expedient so to do in the interest of sovereignty and integrity of india, defence of india, security of the state, friendly relations with foreign states or public order or for preventing incitement to the commission of any cognizable offence relating to above, it may subject to the provisions of sub-section (2), for reasons to be recorded in writing, by order, direct any agency of the government or intermediary to block for access by the public or cause to be blocked for access by the public any information generated, transmitted, received, stored or hosted in any computer resource(2) the procedure and safeguards subject to which such blocking for access by the public may be carried out, shall be such as may be prescribed(3) the intermediary who fails to comply with the direction issued under sub-section(1) shall be punished with an imprisonment for a term which may extend to seven years and also be liable to fine69b (1) the central government may, to enhance cyber security and for identification, analysis and prevention of intrusion or spread of computer contaminant in the country, by notification in the official gazette, authorise any agency of the government to monitor and collect traffic data or information generated, transmitted, received or stored in any computer resourcepower to authorise  to monitor and collect traffic data or information through any computer resource for cyber security(2) the intermediary or any person in-charge or the computer resource shall, when called upon by the agency which has been authorised under sub-section (1), provide technical assistance and extend all facilities to such agency to enable online access or to secure and provide online access to the computer resource generating, transmitting, receiving or storing such traffic data or information(3) the procedure and safeguards for monitoring and collecting traffic data or information, shall be such as may be prescribed(4) any intermediary who intentionally or knowingly contravenes the provisions of sub-section (2) shall be punished with an imprisonment for a term which any extend to three years and shall also be liable to fine explanation—for the purposes of this section,—(i) "computer contaminant" shall have the meaning assigned to it in section 43; (ii) "traffic data" means any data identifying or purporting to identify any person, computer system or computer network or location to or from which the communication is or may be transmitted and includes communications origin, destination, route, time, data, size, duration or type of underlying service and any other information' 35 in section 70 of the principal act,—amendment of section 70(a) for sub-section (1), the following sub-section shall be substituted, namely:—'(1) the appropriate government may, by notification in the official gazette, declare any computer resource which directly or indirectly affects the facility of critical information infrastructure, to be a protected systemexplanation—for the purposes of this section, "critical information infrastructure" means the computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety';(b) after sub-section (3), the following sub-section shall be inserted, namely:—"(4) the central government shall prescribe the information security practices and procedures for such protected system"36  after section 70 of the principal act, the following section shall be inserted, namely:—insertion of new sections 70a and 70bnational nodal agency''70a (1) the central government may, by notification published in the official gazette, designae any organisation of the government as the national nodal agency in respect of critical information infrastructure protection(2) the national nodal agency designated under sub-section (1) shall be responsible for all measures including research and development relating to protection of critical information infrastructure(3) the manner of performing functions and duties of the agency referred to in sub-section (1) shall be such as may be prescribed70b (1) the central government shall, by notification in the official gazette, appoint an agency of the government to be called the indian computter emergency response team(2) the central government shall provide the agency referred to in sub-section(1) with a director general and such other officers and employees as may be prescribedindian computer emergency response team to serve as national agency for incident response(3) the salary and allowances and terms and conditions of the director general and other officers and employees shall be such as may be prescribed(4) the indian computer emergency response team shall serve as the national agency for performing the following functions in the area of cyber security,—(a) collection, analysis and dissemination of information on cyber incidents;(b) forecast and alerts of cyber security incidents; (c) emergency measures for handling cyber security incidents; (d) coordination of cyber incidents response activities; (e) issue guidelines, advisories, vulnerability notes and whitepapers relating to information security practices, procedures, preventation, response and reporting of cyber incidents;(f) such other functions relating to cyber security as may be prescribed(5) the manner of performing functions and duties of the agency referred to in sub-section (1) shall be such as may be prescribed(6) for carrying out the provisions of sub-section (4), the agency referred to in sub-section (1) may call for information and give direction to the service provides, intermediaries, data centres, body corporate and any other person(7) any service provider, intermediaries, data centres, body corporate or person who fails to provide the information called for or comply with the direction under subsection (6), shall be punishable with imprisonment for a term which may extend to one year or with fine which may extend to one lakh rupees or with both(8) no court shall take cognizance of any offence under this section, except on a complaint made by an officer authorised in this behalf by the agency referred to in sub-section (1)"37 after section 72 of the principal act, the following section shall be inserted, namely:—insertion of new section 72apunishment for disclosure of information in breach of lawful contract"72a save as otherwise provided in this act or any other law for the time being in force, any person including an intermediary who, while providing services under the terms of lawful contract, has secured access to any material containing personal information about another person, with the intent to cause or knowing that he is likely to cause wrongful loss or wrongful gain discloses, without the consent of the person concerned, or in breach of a lawful contract,  such material to any other person,  shall be punished with imprisonment for a term which may extend to three years, or with fine which may extend to five lakh rupees, or with both'' 38 for section 77 of the principal act, the following sections shall be substituted, namely:—substitution of new sections for section 77"77 no compensation awarded, penalty imposed or confiscation made under this act shall prevent the award of compensation or imposition of any other penalty or punishment under any other law for the time being in forcecompensation, penalties or confiscation not to interfere with other punishmentcompounding of offences77a a court of competent jurisdiction may compound offences, other than offences for which the punishment for life or imprisonment for a term exceeding three years has been provided, under this act:provided that the court shall not compound such offence where the accused is, by reason of his previous conviction, liable to either enhanced punishment or to a punishment of a different kind:provided further that the court shall not compound any offence where such offence affects the socio economic conditions of the country or has been committed against a child below the age of 18 years or a woman(2) the person accused of an offence under this act may file an application for compounding in the court in which offence is pending for trial and the provisions of sections 265b and 265c of the code of criminal procedure, 1973 shall apply2 of 197477b (l) notwithstanding anything contained in the code of  criminal procedure,1973, the offence punishable with imprisonment of three years and above shall be cognizable and the offence punishable with imprisonment of three years shall be bailableoffences with three yearsimprisonment to be bailableamendment of section 7839 in section 78 of the principal act, for the words "deputy superintendent of police" the word "inspector" shall be substituted40 for chapter xii of the principal act, the following chapters shall be substituted, namely:—substitution of new chapters for chapter xii 'chapter xii intermediaries not to be liable in certain casesexemption from liability of intermediary in certain cases79 (1) notwithstanding anything contained in any law for the time being in force but subject to the provisions of sub-sections (2) and (3), an intermediary shall not be liable for any third party information, data, or communication link made available or hasted by him(2) the provisions of sub-section (1) shall apply if—(a) the function of the intermediary is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored or hasted; or(b) the intermediary does not—(i) initiate the transmission, (ii) select the receiver of the transmission, and (iii) select or modify the information contained in the transmission;(c) the intermediary observes due diligence while discharging his duties under this act and also observes such other guidelines as the cetral government may prescribe in this behalf (3) the provisions of sub-section (1) shall not apply if—(a) the intermediary has conspired or abetted or aided or induced, whether by threats or promise or othorise in the commission of the unlawful act;(b) upon receiving actual knowledge, or on being notified by the appropriate government or its agency that any information, data or communication link residing in or connected to a computer resource controlled by the intermediary is being used to commit the unlawful act, the intermediary fails to expeditiously remove or disable access to that material on that resource without vitiating the evidence in any manner explanation—for the purposes of this section, the expression "third party information" means any information dealt with by an intermediary in his capacity as an intermediary chapter xiia examiner of electronic evidence79a the central government may, for the purposes of providing expert opinion on electronic form evidence before any court or other authority specify, by notification in the official gazette, any department, body or agency of the central government or a state government as an examiner of electronic evidencecentral government to notify examiner of electronic evidenceexplanation—for the purposes of this section, "electronic form evidence"means any information of probative value that is either stored or transmitted in electronic form and includes computer evidence, digital audio, digital video, cell phones, digital fax machines'a m e n t m e n t of section 8041 in section 80 of the principal act, in sub-section (l), for the words "deputy superintendent of police", the word "inspector" shall be substitutedamendment of section 8142 in section 81 of the principal act, the following proviso shall be inserted at the end, namely:—"provided that nothing contained in this act shall restrict any person from exercising any right conferred under the copyright act, 1957 or the patents act, 1970" 43 in section 82 of the principal act,—14 of 1957 39 of 1970amendment of section 82(a) for the marginal heading, the following marginal heading shall be substituted, namely:—"chairperson, members, officers and employees to be public servants";(b) for the words "presiding officer", the words "chairperson, members" shall be substitutedamendment of section 8444 in section 84 of the principal act, for the words "presiding officer", the words"chairperson, members" shall be substituted45 after section 84 of the principal act, the following sections shall be inserted, namely:—insertion of new sections 84a, 84b and 84c| modes       | or   ||-------------|------|| methods     | for  || encryption |      |"84a the central government may, for secure use of the electronic medium and for promotion of e-governance and e-commerce, prescribe the modes or methods for encryptionpunishment for abetment of offences84b whoever abets any offence shall, if the act abetted is committed in consequence of the abetment, and no express provision is made by this act for the punishment of such abetment, be punished with the punishment provided for the offence under this actexplanation—an act or offence is said to be committed in consequence of abetment, when it is committed in consequence of the instigation, or in pursuance of the conspiracy, or with the aid which constitutes the abetmentpunishment for attempt to commit offences84c whoever attempts to commit an offence punishable by this act or causes such an offence to be committed, and in such an attempt does any act towards the commission of the offence, shall, where no express provision is made for the punishment of such attempt, be punished with imprisonment of any description provided for the offence, for a term which may extend to one-half of the longest term of imprisonment provided for that offence, or with such fine as is provided for the offence, or with both"amendment of section 8746 in section 87 of the principal act,—(a) in sub-section (2),—(i) for clause (a), the following clauses shall be substituted, namely:—"(a) the conditions for considering reliability of electronic signature or electronic authentication technique under sub-section (2) of section3a;(aa) the procedure for ascertaining electronic signature or authentication under sub-section (3) of section 3a;(ab) the manner in which any information or matter may be authenticated by means of electronic signature under section 5;"; (ii) after clause (c), the following clause shall be inserted, namely:—"(ca) the manner in which the authorised service provider may collect, retain and appropriate service charges under sub-section (2) of section6a;"; (iii) for clause (e), the following clauses shall be substituted, namely:—"(e) the manner of storing and affixing  electronic signature creation data under section 15;(ea) the security procedures and practices under section 16;";(iv) in clause (f), for the words "and assistant controllers", the words", assistant controllers, other officers and employees" shall be substituted; (v) clause (g) shall be omitted; (vi) after clause (m), the following clause shall be inserted, namely:—"(ma) the form of application and fee for issue of electronic signature certificate  under section 35;"; (vii) after clause (o), the following clauses shall be inserted, namely:—"(oa) the duties of subscribers under section 40a; (ob) the reasonable security practices and procedures and sensitive personal data or information under section 43a;";(viii) in clause (r), for the words "presiding officer", the words "chairperson and members" shall be substituted;(viii) in clause (s), for the words "presiding officer", the words "chairperson and members" shall be substituted;(ix) for clause (w), the following clauses shall be substituted, namely:—"(w) the powers and functions of the chairperson of the cyber appellate tribunal under section 52a;(wa) the information, duration, manner and form of such informationto be retained and preserved under section 67 c;(x) the procedures and safeguards for interception, monitoring, or decryption under sub-section (2) of section 69;(xa) the procedure and safeguards for blocking for access by the public under sub-section (2) of section 69a;(xb) the procedure and safeguards for monitoring and collecting traffic data or information under sub-section (3) of section 69b;(y) the information security practices and procedures for protected system under section 70;(ya) manner of performing functions and duties of the agency under sub-section (3) of section 70a;(yb) the officers and employees under sub-section (2) of section70b;(yc) salaries and allowances and terms and conditions of service of the director general and other officers and employees under sub-section (3) of section 70b;(yd) the manner in whcih the functions and duties of agency shall be performed under sub-section (5) of section 70b;(z) the guidelines to be observed by the intermediaries under subsection (4) of section 79;(za) the modes or methods for encryption under section 84a;";(b) in sub-section (3),—(i) for the words, brackets, letter and figures "every notification made by the central government under clause (f) of sub-section (4) of section 1 and every rule made by it", the words "every notification made by the central government" under sub-section (1) of section 70a and every rule made by''it shall be substituted;(ii) the words "the notification or" wherever they occur, shall be omitted47 in section 90 of the principal act, in sub-section (2), clause (c) shall be omitted amendment of section 9048 sections 91, 92, 93 and 94 of the principal act shall be omittedomission of sections 91, 92, 93 and 9449 for the first schedule and the second schedule to the principal act, the following schedules shall be substituted, namely:—substitution of new schedules for first schedule and second schedule "first schedule [see sub-section (4) of section 1] documents or transactions to which the act shall not apply| sl no                                                               | description of documents or transactions                                                 ||-----------------------------------------------------------------------|------------------------------------------------------------------------------------------|| 26 of 1881                                                           |                                                                                          || 7 of 1882                                                            |                                                                                          || 2 of 1882                                                            |                                                                                          || 39 of 1925                                                           |                                                                                          || 1                                                                    | a negotiable instrument (other than a cheque) as defined in section 13 of the negotiable || instruments act, 1881                                                |                                                                                          || 2                                                                    | a power-of-attorney as defined in section 1a of the powers-of-attorney act, 1882        || 3                                                                    | a trust as defined in section 3 of the indian trusts act, 1882                          || 4                                                                    | a will as defined in clause (                                                            || including any other testamentary disposition by whatever name called |                                                                                          || 5                                                                    | any contract for the sale or conveyance of immovable property or any interest in         || such property                                                        |                                                                                          | the second schedule[see sub-section (1) of section 3a]electronic signature or electronic authentication technique and procedure| sl no   | description   | procedure   ||-----------|---------------|-------------|| (1)       | (2)           | (3)         |"50 the third schedule and the fourth schedule to the principal act shall be omittedomission of third schedule and fourth schedule part iii amendment of the indian penal code51 in the indian penal code—amendment of  indian penal code(a) in section 4,—amendment of section 4(i) after clause (2), the following clause shall be inserted, namely:—"(3) any person in any place without and beyond india committing offence targeting a computer resource located in india";21 of 2000(ii) for the explanation, the following explanation shall be substituted, namely:—'explanation—in this section—(a) the word "offence" includes every act committed outside india which, if committed in india, would be punishable under this code;(b) the expression "computer resource" shall have the meaning assigned to it in clause (k) of sub-section (1) of section 2 of the information technology act, 2000';amendment of section 40(b) in section 40, in clause (2), after the figure "117", the figures and word "118,119 and 120" shall be inserted;amendment of section 118(c) in section 118, for the words "voluntarily conceals, by any act or illegalomission, the existence of a design", the words "voluntarily conceals by any act or omission or by the use of encryption or any other information hiding tool, the existence of a design" shall be substituted;amendment of section 119(d) in section 119, for the words "voluntarily conceals, by any act or illegalomission, the existence of a design", the words "voluntarily conceals by any act or omission or by the use of encryption or any other information hiding tool, the existence of a design" shall be substituted;amendment of section 464(e) in section 464 , for the words "digital signature" wherever they occur, the words "electronic signature" shall be substituted; part iv amendment of the indian evidence act, 18721 of 187252 in the indian evidence act, 1872,—amendment of  indian evidence actamendment of section 3(a) in section 3 relating to interpretation clause, in the paragraph appearing at the end, for the words "digital signature" and "digital signature certificate", the words "electronic signature" and "electronic signature certificate" shall respectively be substituted;(b) after section 45, the following section shall be inserted, namely:—insertion of new section45aopinion of examiner of electronic evidence21 of 2000 "45a when in a proceeding, the court has to form an opinion on any matter relating to any information transmitted or stored in any computer resource or any other electronic or digital form,  the opinion of the examiner of electronic evidence referred to in section 79a of the information technology act, 2000, is a relevant factexplanation—for the purposes of this section, an examiner of electronic evidence shall be an expert"; (c) in section 47a,—amendment of section 47a(i) for the words "digital signature", the words "electronic signature" shall be substituted;(ii) for the words "digital signature certificate", the words "electronic signature certificate" shall be substituted;amendment of section 67a(d) in section 67a, for the words "digital signature" wherever they occur, thewords "electronic signature" shall be substituted;amendment of section 85a(e) in section 85a, for the words "digital signature" at both the places where they occur, the words "electronic signature" shall be substituted;amendment of section 85b(f) in section 85b, for the words "digital signature" wherever they occur, thewords "electronic signature" shall be substituted;amendment of section 85c(g) in section 85c, for the words "digital signature certificate", the words"electronic signature certificate" shall be substituted;amendment of section 90a(h) in section 90a, for the words "digital signature" at both the places where they occur, the words "electronic signature" shall be substituted; lok   sabha———— a billfurther to amend the information technology act, 2000————(as passed by the lok sabha)gmgipmrnd—4619ls(s5)—22-12-2008