PANIMALAR ENGINEERING COLLEGE

DEPARTMENT OF CSBS

21IT1915 -CYBER SECURITY

UNIT I INTRODUCTION
Cyber Security – History of Internet – Impact of Internet – CIA Triad; Reason for Cyber Crime –
Need for Cyber Security – History of Cyber Crime; Cybercriminals – Classification of Cybercrimes
– A Global Perspective on Cyber Crimes; Cyber Laws – The Indian IT Act – Cybercrime and
Punishment.

What is Cyber Security?

The technique of protecting internet-connected systems such as computers, servers, mobile devices,
electronic systems, networks, and data from malicious attacks is known as cybersecurity. We can
divide cybersecurity into two parts one is cyber, and the other is security. Cyber refers to the
technology that includes systems, networks, programs, and data. And security is concerned with the
protection of systems, networks, applications, and information. In some cases, it is also
called electronic information security or information technology security.
Types of Cyber Security
Every organization's assets are the combinations of a variety of different systems. These systems have
a strong cybersecurity posture that requires coordinated efforts across all of its systems. Therefore,
we can categorize cybersecurity in the following sub-domains:
o Network Security: It involves implementing the hardware and software to secure a
computer network from unauthorized access, intruders, attacks, disruption, and misuse. This
security helps an organization to protect its assets against external and internal threats.
o Application Security: It involves protecting the software and devices from unwanted
threats. This protection can be done by constantly updating the apps to ensure they are secure
from attacks. Successful security begins in the design stage, writing source code, validation,
threat modeling, etc., before a program or device is deployed.
o Information or Data Security: It involves implementing a strong data storage mechanism
to maintain the integrity and privacy of data, both in storage and in transit.
o Identity management: It deals with the procedure for determining the level of access
that each individual has within an organization.
o Operational Security: It involves processing and making decisions on handling and
securing data assets.
o Mobile Security: It involves securing the organizational and personal data stored on
mobile devices such as cell phones, computers, tablets, and other similar devices against
various malicious threats. These threats are unauthorized access, device loss or theft,
malware, etc.
o Cloud Security: It involves in protecting the information stored in the digital environment
or cloud architectures for the organization. It uses various cloud service providers such as
AWS, Azure, Google, etc., to ensure security against multiple threats.
1
o Disaster Recovery and Business Continuity Planning: It deals with the processes,
monitoring, alerts, and plans to how an organization responds when any malicious activity
is

2
 causing the loss of operations or data. Its policies dictate resuming the lost operations after
any disaster happens to the same operating capacity as before the event.
o User Education: It deals with the processes, monitoring, alerts, and plans to how an
organization responds when any malicious activity is causing the loss of operations or
data. Its policies dictate resuming the lost operations after any disaster happens to the same
operating capacity as before the event.

What was the start of cybersecurity?

Cybersecurity history is interesting indeed. It is thought to have started in 1971 when Bob Thomas, a
computer programmer with BBN, created and deployed a virus that served as a security test. It was
not malicious but did highlight areas of vulnerability and security flaws in what would become “the
internet.”

The virus, named after a Scooby Doo villain, “Creeper,” was designed to move across
ARPANET (Advanced Research Projects Agency Network) – the forerunner to what we now call
the internet. ARPANET was established by the U.S. Department of Defense.

Thomas created the computer worm to be a non-harmful self-replicating experimental program. It was
intended to illustrate how mobile applications work, but instead, it corrupted the DEC PDP-10
mainframe computers at the Digital Equipment Corporation, interfering with the teletype computer
screens which were connected. All the users could see on the screen were the words “I’m the creeper,
catch me if you can!”

In response, Ray Tomlinson, Thomas’ colleague created the Reaper Program. It was similar to the
Creeper. It moves through the internet, replicating itself, and finds copies of the Creeper. When it
locates the copies, it logs them out, so they are rendered impotent. The Reaper was the first attempt at
cybersecurity – the first antivirus software program.

History of the Internet

Initially in the 1960s, the Internet was started as a medium for sharing information with
government researchers. During the time computers were larger in size and were immovable. In case
anyone had to access the information stored in any computer, they had to travel to the location of the
computer or the other way to have magnetic computer tapes that could be transported through the
postal system of that time.
Alongside, Escalated Cold War played a major role in the creation of the internet. The Soviet Union
had deployed the Sputnik satellite which led the Defense Department of the United States to examine
the possibilities of communicating information despite nuclear. The situation resulted in the
development of ARPANET (Advanced Research Projects Agency Network), which, later on, evolved
into the Internet. In the initial days, ARPANET became a huge success with restricted participation
where it was accessible to academic and research institutions that had contracts with the US Defense

3
Department. The scenario led to the formation of new networks in order to facilitate the need for
information sharing with other people.
Earlier there wasn’t any standard mechanism for the computer networks that would enable them to
communicate with each other. Transfer Control Protocol (TCP/IP) which was developed in 1970, was
adopted as a new communication protocol for ARPANET in 1983. The technology enabled various
computers on different networks to communicate with each other and this is how the Internet was
officially born on January 1, 1983.
An Overview From 1985 to 1995
The invention of DNS, the widespread usage of TCP/IP, and the popularity of email all contributed
to an increase in internet activity. Between 1986 and 1987, the network expanded from 2,000 to
30,000 hosts. People were increasingly using the internet to send messages, read news, and
exchange files. However, sophisticated computing knowledge was still required to dial into the
system and use it efficiently, and there was still no agreement on how documents on the network
should be formatted.
The internet needed to be more user-friendly. In 1989, Tim Berners-Lee, a British computer
scientist, proposed a solution to his employer, CERN, the international particle-research facility in
Geneva, Switzerland. He proposed a new method for organizing and connecting all of the information
available on CERN’s computer network, making it quick and easy to access. His idea for a “network
of information” evolved into the World Wide Web.
The release of the Mosaic browser in 1993 introduced the web to a new non-academic audience,
and people began to learn how simple it was to make their own HTML websites. As a result, the
number of websites increased from 130 in 1993 to over 100,000 at the beginning of 1996.
By 1995, the internet and the World Wide Web had become an established phenomenon, with over
10 million global users using the Netscape Navigator. The Netscape Navigator was the most popular
browser at that point in time.
What is DNS?
DNS is short for Domain Name System. It functions as the internet’s version of a phone book,
converting difficult-to-remember IP addresses into simple names. Cheaper technology and the
introduction of desktop computers in the early 1980s facilitated the rapid development of local area
networks (LANs). As the number of machines on the network grew, it became impossible to keep
track of all the different IP addresses.
The development of the Domain Name System (DNS) in 1983 solved this problem. DNS was
invented at the University of Southern California by Paul Mockapetris and Jon Postel. It was one of
the breakthrough inventions that helped in paving the way for the World Wide Web.
TCP/IP or Transmission Control Protocol / Internet Protocol
TCP/IP is an acronym that stands for Transmission Control Protocol / Internet Protocol. The terms
refer to a set of protocols that regulate how data flows via a network.
Following the development of ARPANET, new computer networks began to join the network,
prompting the need for an agreed-upon set of data-handling standards. Bob Kahn and Vint Cerf, two
American computer scientists, in the year 1974 invented a new way of transmitting data packets in a
digital envelope known as ‘Datagram’. Any computer can read the datagram’s address, but only the
ultimate host system can open the envelope and read the message within.
This technology was dubbed the transmission-control protocol by Kahn and Cerf. TCP enabled
computers to communicate in the same language, allowing the ARPANET to evolve into a global
4
interconnected network of networks, an example of ‘internetworking’—written as the “internet”
in short.
IP stands for Internet Protocol and when paired with TCP, aids in the routing of internet data.
Every internet-connected device is assigned a unique IP address. The number, known as an IP
address, can be used to find out the location of any internet-connected device.

Impact of Internet
The internet has had an incredible impact on society since its inception. It has changed the way we
communicate, do business, learn, and even think. The internet has brought people from different parts
of the world together and has made information accessible to everyone with an internet connection.
One of the biggest impacts of the internet is on communication. Social media platforms like
Facebook, Twitter, and Instagram have made it easy for people to connect with others from
anywhere in the world. People can share their thoughts, ideas, and experiences instantly with their
friends and family. Video conferencing tools like Zoom have revolutionized remote communication,
making it possible for people to work and learn from anywhere in the world.
The internet has also had a significant impact on business. E-commerce websites like Amazon and
eBay have made it possible for people to shop from the comfort of their own homes. Small businesses
can now reach a global audience by creating an online presence. The internet has also made it easier
for people to work from home, which has become increasingly important during the COVID-19
pandemic.
Education is another area that has been greatly impacted by the internet. Online courses and tutorials
have made it possible for people to learn new skills from anywhere in the world. Massive open online
courses (MOOCs) like Coursera and edX have made higher education more accessible to people who
may not have the opportunity to attend a traditional university.
However, the internet has also had some negative impacts. Cyberbullying, online harassment, and
identity theft have become increasingly common. The internet has also made it easier for people to
access inappropriate content, which can have a negative impact on young children.
In conclusion, the internet has had a tremendous impact on society. It has changed the way we
communicate, do business, learn, and even think. While there are some negative impacts, the benefits
of the internet far outweigh the negatives. As the internet continues to evolve, it will be interesting to
see how it will shape our society in the future.

CIA Triad
When talking about network security, the CIA triad is one of the most important models which is
designed to guide policies for information security within an organization.
CIA stands for :
1. Confidentiality
2. Integrity
3. Availability

5
These are the objectives that should be kept in mind while securing a network.
Confidentiality
Confidentiality means that only authorized individuals/systems can view sensitive or classified
information. The data being sent over the network should not be accessed by unauthorized
individuals. The attacker may try to capture the data using different tools available on the Internet
and gain access to your information. A primary way to avoid this is to use encryption techniques to
safeguard your data so that even if the attacker gains access to your data, he/she will not be able to
decrypt it. Encryption standards include AES(Advanced Encryption Standard) and DES (Data
Encryption Standard). Another way to protect your data is through a VPN tunnel. VPN stands for
Virtual Private Network and helps the data to move securely over the network.

Integrity
The next thing to talk about is integrity. Well, the idea here is to make sure that data has not
been modified. Corruption of data is a failure to maintain data integrity. To check if our data has
been modified or not, we make use of a hash function.
We have two common types: SHA (Secure Hash Algorithm) and MD5(Message Direct 5). Now MD5

6
is a 128-bit hash and SHA is a 160-bit hash if we’re using SHA-1. There are also other SHA
methods that we could use like SHA-0, SHA-2, and SHA-3.
Let’s assume Host ‘A’ wants to send data to Host ‘B’ to maintain integrity. A hash function will run
over the data and produce an arbitrary hash value H1 which is then attached to the data. When Host
‘B’ receives the packet, it runs the same hash function over the data which gives a hash value of
H2. Now, if H1 = H2, this means that the data’s integrity has been maintained and the contents
were not modified.

Availability
This means that the network should be readily available to its users. This applies to systems and to
data. To ensure availability, the network administrator should maintain hardware, make regular
upgrades, have a plan for fail-over, and prevent bottlenecks in a network. Attacks such as DoS or
DDoS may render a network unavailable as the resources of the network get exhausted. The impact
may be significant to the companies and users who rely on the network as a business tool. Thus,
proper measures should be taken to prevent such attacks.

7
Reasons behind cyber attacks
Every business, regardless of its size, is a potential target of cyber attack. That is because every
business has key assets (financial or otherwise) that criminals may seek to exploit. By recognising the
common motives behind cyber attacks, you can build a better understanding of the risks you may
face, and understand how best to confront them.
Why do cyber attacks happen?
Most often, cyber attacks happen because criminals want your:

● business' financial details

● customers' financial details (eg credit card data)

● sensitive personal data

● customers' or staff email addresses and login credentials

● customer databases

● clients lists

● IT infrastructure

● IT services (eg the ability to accept online payments)

● intellectual property (eg trade secrets or product designs)

Cyber attacks against businesses are often deliberate and motivated by financial gain. However, other
motivations may include:
8
● making a social or political point - eg through hacktivism

● espionage - eg spying on competitors for unfair advantage

9
 ● intellectual challenge - eg 'white hat' hacking

The key point is that cyber security threats don't always come from anonymous hackers or online
criminal groups. Vulnerabilities can arise within your own business too.
How are cyber criminals motivated?
1. Financial Gain
The primary motivation of a hacker is money, and getting it can be done with a variety of methods.
They could directly gain entry to a bank or investment account; steal a password to your financial
sites and then transfer the assets over to one of their own; swindle an employee into completing a
money transfer through a complicated spear phishing technique, or conduct a ransomware attack on
your entire organization.
The possibilities are endless, but most hackers are out to make a profit.
2. Recognition & Achievement
Some hackers are motivated by the sense of achievement that comes with cracking open a major
system. Some may work in groups or independently, but, on some scale, they would like to be
recognized.
This also ties into the fact that cyber criminals are competitive by nature, and they love the challenge
their actions bring. In fact, they often drive one another to complete more complicated hacks.
3. Insider Threats
Individuals who have access to critical information or systems can easily choose to misuse that access
—to the detriment of their organization.
These threats can come from internal employees, vendors, a contractor or a partner—and are viewed
as some of the greatest cyber security threats to organizations.
However, not all insider threats are intentional, according to an Insider Threat Report from Crowd
Research Partners. Most (51%) are due to carelessness, negligence, or compromised credentials, but
the potential impact is still present even in an unintentional scenario.
4. Political Motivation – “Hacktivism”
Some cyber criminal groups use their hacking skills to go after large organizations. They are usually
motivated by a cause of some sort, such as highlighting human rights or alerting a large corporation to
their system vulnerabilities. Or, they may go up against groups whose ideologies do not align with
their own.
These groups can steal information and argue that they are practicing free speech, but more often than
not, these groups will employ a DDoS (Distributed Denial of Service) attack to overload a website
with too much traffic and cause it to crash.
5. State Actors
State-sponsored actors receive funding and assistance from a nation-state. They are specifically
engaged in cyber crime to further their nation’s own interests. Typically, they steal information,
including “intellectual property, personally identifying information, and money to fund or further
espionage and exploitation causes.”
However, some state-sponsored actors do conduct damaging cyberattacks and claim that their
cyberespionage actions are legitimate activity on behalf of the state.
10
6. Corporate Espionage
This is a form of cyber attack used to gain an advantage over a competing organization.
Conducted for commercial or financial purposes, corporate espionage involves:

● Acquiring property like processes or techniques, locations, customer data, pricing,

sales, research, bids, or strategies

● Theft of trade secrets, bribery, blackmail, or surveillance.

Importance of Cybersecurity (need of cybersecurity)

Protecting Sensitive Data:
With the increase in digitalization, data is becoming more and more valuable. Cybersecurity helps
protect sensitive data such as personal information, financial data, and intellectual property
from unauthorized access and theft.

Prevention of Cyber Attacks:

Cyber attacks, such as Malware infections, Ransomware, Phishing, and Distributed Denial of Service
(DDoS) attacks, can cause significant disruptions to businesses and individuals. Effective
cybersecurity measures help prevent these attacks, reducing the risk of data breaches, financial losses,
and operational disruptions.

Safeguarding Critical Infrastructure:

Critical infrastructure, including power grids, transportation systems, healthcare systems, and
communication networks, heavily relies on interconnected computer systems. Protecting these
systems from cyber threats is crucial to ensure the smooth functioning of essential services and
prevent potential disruptions that could impact public safety and national security.

Maintaining Business Continuity:

Cyber attacks can cause significant disruption to businesses, resulting in lost revenue, damage to
reputation, and in some cases, even shutting down the business. Cybersecurity helps ensure business
continuity by preventing or minimizing the impact of cyber attacks.

Compliance with Regulations:

Many industries are subject to strict regulations that require organizations to protect sensitive data.
Failure to comply with these regulations can result in significant fines and legal action. Cybersecurity
helps ensure compliance with regulations such as HIPAA, GDPR, and PCI DSS.

Protecting National Security:

11
Cyber attacks can be used to compromise national security by targeting critical infrastructure,
government systems, and military installations. Cybersecurity is critical for protecting national
security and preventing cyber warfare.

Preserving Privacy:
In an era where personal information is increasingly collected, stored, and shared digitally,
cybersecurity is crucial for preserving privacy. Protecting personal data from unauthorized access,
surveillance, and misuse helps maintain individuals’ privacy rights and fosters trust in digital services.

History of cyber crimes

● 1940s: The time before crime

● 1950s: The phone phreaks

● 1960s: All quiet on the Western Front

● 1970s: Computer security is born

● 1980s: From ARPANET to internet

● 1990s: The world goes online

● 2000s: Threats diversify and multiply

● 2010s: The next generation

cybercriminals
A cybercriminal is a person who conducts some form of illegal activity using computers or other
digital technology such as the Internet. The criminal may use computer expertise, knowledge of
human behavior, and a variety of tools and services to achieve his or her goal.
Types of Cyber Criminals:
1. Hackers: The term hacker may refer to anyone with technical skills, however, it typically refers to
an individual who uses his or her skills to achieve unauthorized access to systems or networks so as
to commit crimes. The intent of the burglary determines the classification of those attackers as white,
grey, or black hats. White hat attackers burgled networks or PC systems to get weaknesses so as to
boost the protection of those systems. The owners of the system offer permission to perform the
burglary, and they receive the results of the take a look at. On the opposite hand, black hat attackers
make the most of any vulnerability for embezzled personal, monetary or political gain. Grey hat
attackers are somewhere between white and black hat attackers. Grey hat attackers could notice a
vulnerability and report it to the owners of the system if that action coincides with their agenda.

● (a). White Hat Hackers – These hackers utilize their programming aptitudes for a good
and lawful reason. These hackers may perform network penetration tests in an attempt to

12
compromise networks to discover network vulnerabilities. Security vulnerabilities are then
reported to developers to fix them and these hackers can also work together as a blue team.
They always use the limited amount of resources which are ethical and provided by the
company, they basically perform pentesting only to check the security of the company from
external sources.

13
 ● (b). Gray Hat Hackers – These hackers carry out violations and do seemingly deceptive
things however not for individual addition or to cause harm. These hackers may disclose a
vulnerability to the affected organization after having compromised their network and
they may exploit it .

● (c). Black Hat Hackers – These hackers are unethical criminals who violate network
security for personal gain. They misuse vulnerabilities to bargain PC frameworks. theses
hackers always exploit the information or any data they got from the unethical pentesting of
the network.
2. Organized Hackers: These criminals embody organizations of cyber criminals, hacktivists,
terrorists, and state-sponsored hackers. Cyber criminals are typically teams of skilled criminals
targeted on control, power, and wealth. These criminals are extremely subtle and organized,
and should even give crime as a service. These attackers are usually profoundly prepared and
well- funded.
3. Internet stalkers: Internet stalkers are people who maliciously monitor the web activity of their
victims to acquire personal data. This type of cyber crime is conducted through the use of social
networking platforms and malware, that are able to track an individual’s PC activity with little or
no detection.
4. Disgruntled Employees: Disgruntled employees become hackers with a particular motive and
also commit cyber crimes. It is hard to believe that dissatisfied employees can become such malicious
hackers. In the previous time, they had the only option of going on strike against employers. But with
the advancement of technology there is increased in work on computers and the automation of
processes, it is simple for disgruntled employees to do more damage to their employers and
organization by committing cyber crimes. The attacks by such employees brings the entire system
down.

Classification of cybercrimes
It can be classified in to 4 major categories as
1. Cyber crime against Individual
2. Cyber crime Against Property
3. Cyber crime Against Organization
4. Cyber crime Against Society
1. Against Individuals
1. Email spoofing :
A spoofed email is one in which e-mail header is forged so that mail appears to
originate from one source but actually has been sent from another source
2. Spamming :
Spamming means sending multiple copies of unsolicited mails or mass e-mails such
as chain letters.
3. Cyber Defamation :
This occurs when defamation takes place with the help of computers and / or the
Internet. E.g. someone publishes defamatory matter about someone on a website or
sends e-mails containing defamatory information.
14
 4. Harassment & Cyber stalking :
Cyber Stalking Means following the moves of an individual’s activity over internet. It
can be done with the help of many protocols available such at e- mail, chat rooms,
user net groups.
2. Against Property:
1. Credit Card Fraud : As the name suggests, this is a fraud that happens by the use
of a credit card. This generally happens if someone gets to know the card number or
the card gets stolen.

2. Intellectual Property crimes : These include Software piracy: illegal copying

of programs, distribution of copies of software.
1. Copyright infringement:
2. Trademarks violations:
Theft of computer source code:
3. Internet time theft :
the usage of the Internet hours by an unauthorized person which is actually paid by
another person.
3. Against Organisation
1. Unauthorized Accessing of Computer:
Accessing the computer/network without permission from the owner.
it can be of 2 forms:
1. Changing/deleting data:
Unauthorized changing of data.
2. Computer voyeur:
The criminal reads or copies confidential or proprietary information, but the
data is neither deleted nor changed.
2. Denial Of Service:
When Internet server is flooded with continuous bogus requests so as to denying
legitimate users to use the server or to crash the server.
3. Computer contamination / Virus attack :
A computer virus is a computer program that can infect other computer programs by
modifying them in such a way as to include a (possibly evolved) copy of it.
Viruses can be file infecting or affecting boot sector of the computer.
Worms, unlike viruses do not need the host to attach themselves to.
4. Email Bombing :
Sending large numbers of mails to the individual or company or mail servers thereby
ultimately resulting into crashing.
5. Salami Attack :
When negligible amounts are removed & accumulated in to something larger. These
attacks are used for the commission of financial crimes.

15
 6. Logic Bomb :
Its an event dependent programme , as soon as the designated event occurs, it crashes
the computer, release a virus or any other harmful possibilities.
7. Trojan Horse :
an unauthorized program which functions from inside what seems to be an authorized
program, thereby concealing what it is actually doing.
8. Data diddling :
This kind of an attack involves altering raw data just before it is processed by a
computer and then changing it back after the processing is completed.
4. Against Society
1. Forgery: currency notes, revenue stamps, mark sheets etc can be forged
using computers and high quality scanners and printers.
2. Cyber Terrorism: Use of computer resources to intimidate or coerce others.
3. Web Jacking: Hackers gain access and control over the website of another, even
they change the content of website for fulfilling political objective or for money.

Cyber laws
Cyber law, also known as internet law or digital law, signifies the legal regulations and frameworks
governing digital activities. It covers a large range of issues, including online communication, e-
commerce, digital privacy, and the prevention and prosecution of cybercrimes.
Types of Cyber Law

● Privacy Laws:

Privacy laws focus on protecting individuals' personal information from unauthorized access and use.
They establish guidelines for the responsible handling of personal data by organizations, ensuring
individuals' privacy rights are upheld.

● Cybercrime Laws:

Cybercrime laws define and penalize various cybercrimes, ensuring legal consequences for offenders.
These laws play a crucial role in deterring individuals from engaging in illegal online activities and
provide a legal framework for prosecuting cybercriminals.

● Intellectual Property Laws:

Intellectual property laws in the digital domain protect patents, copyrights, and trademarks from
unauthorized use. They provide a legal foundation for creators and innovators to protect their digital
assets.

● E-commerce Laws:

E-commerce laws regulate online business transactions, defining rules for contracts, transactions, and
consumer protection. These laws contribute to the establishment of a secure and fair online
marketplace.

● Cyber Defamation Laws:

16
Cyber defamation laws address libel and slander in the digital space. They provide legal remedies for
individuals or entities whose reputations may be tarnished by false or damaging information
circulated online.

● Cybersecurity Laws:

Cybersecurity laws establish standards for securing digital systems and data. These laws mandate
organizations to implement measures to protect against cyber threats, contributing to the overall
resilience of digital infrastructure.

● Social Media Laws:

Social media laws address legal issues related to social media platforms, including user rights and
content regulations. These laws aim to strike a balance between freedom of expression and the
prevention of online abuse or misinformation.

● Cyber Contracts and E-signature Laws:

Governing the validity and enforceability of contracts formed online, cyber contracts and e-
signature laws provide legal certainty for electronic transactions. They facilitate the growth of
online commerce by ensuring the legal recognition of digital agreements.

● International Cyber Laws:

With the increasing prevalence of cross-border cybercrimes, international cyber laws address the need
for cooperation between nations. These laws facilitate collaboration in investigating and prosecuting
cybercriminals operating across borders.

● Data Breach Notification Laws:

Mandating organizations to inform individuals and authorities in the event of a data breach of data
breach notification laws enhances transparency and accountability. They ensure prompt action in
response to security incidents, minimizing the potential impact on individuals and businesses.

The Indian IT Act

The Information Technology Act, 2000 also Known as an IT Act is an act proposed by the Indian
Parliament reported on 17th October 2000. This Information Technology Act is based on the United
Nations Model law on Electronic Commerce 1996 (UNCITRAL Model) which was suggested by the
General Assembly of United Nations by a resolution dated on 30th January, 1997. It is the most
important law in India dealing with Cybercrime and E-Commerce.
The main objective of this act is to carry lawful and trustworthy electronic, digital and online
transactions and alleviate or reduce cybercrimes. The IT Act has 13 chapters and 94 sections. The last
four sections that starts from ‘section 91 – section 94’, deals with the revisions to the Indian Penal
Code 1860. The IT Act, 2000 has two schedules:

● First Schedule –
Deals with documents to which the Act shall not apply.

● Second Schedule –
Deals with electronic signature or electronic authentication method.
17
The offences and the punishments in IT Act 2000 :
The offences and the punishments that falls under the IT Act, 2000 are as follows :-

18
1. Tampering with the computer source documents.
2. Directions of Controller to a subscriber to extend facilities to decrypt information.
3. Publishing of information which is obscene in electronic form.
4. Penalty for breach of confidentiality and privacy.
5. Hacking for malicious purposes.
6. Penalty for publishing Digital Signature Certificate false in certain particulars.
7. Penalty for misrepresentation.
8. Confiscation.
9. Power to investigate offences.
10. Protected System.
11. Penalties for confiscation not to interfere with other punishments.
12. Act to apply for offence or contravention committed outside India.
13. Publication for fraud purposes.
14. Power of Controller to give directions.
15. Sections and Punishments under Information Technology Act, 2000 are as follows :

19
SECTION PUNISHMENT

This section of IT Act, 2000 states that any act

of destroying, altering or stealing computer
system/network or deleting data with malicious
intentions without authorization from owner of
the computer is liable for the payment to be
Section 43 made to owner as compensation for damages.

This section of IT Act, 2000 states that any

corporate body dealing with sensitive
information that fails to implement reasonable
security practices causing loss of other person
will also liable as convict for compensation to
Section 43A the affected party.

Hacking of a Computer System with malicious

intentions like fraud will be punished with 3
Section 66 [Link] years imprisonment or the fine of Rs.5,00,000 or
studybeats25 both.

Fraud or dishonesty using or transmitting

information or identity theft is punishable with 3
Section 66 B, C, D years imprisonment or Rs. 1,00,000 fine or both.

This Section is for Violation of privacy by

transmitting image of private area is
punishable with 3 years imprisonment or
Section 66 E 2,00,000 fine or both.

This Section is on Cyber Terrorism affecting

unity, integrity, security, sovereignty of India
through digital medium is liable for life
Section 66 F imprisonment.

This section states publishing obscene

information or pornography or transmission of
obscene content in public is liable for
Section 67 imprisonment up to 5 years or fine of Rs.
10,00,000 or both.

20
21
22