Has the proposal created a divide between "Intermediaries" and "Other IT Companies" ?

The proposed amendments have created a divide between different types of sub-industries within the IT industry.

Portals, ISPs and Cyber Cafes have been classified as "Intermediaries" and have been given near immunity from  liability arising out of any cyber crimes committed through their network.

As a result, it is no longer possible for executives like Avnish Bajaj to be arrested.

However, other IT Companies who are affected by crimes seem to have lost some of the  protection that was earlier available.

IT industry (other) is more interested in protecting its own assets than the vicarious liabilities that may arise due to crimes occurring through the network.

On the other hand, the "Intermediaries" are interested in their immunity against third party information.

Any weakening of the provisions that protect inherent data injury is against the interest of the "non-intermediary" IT industry players. The change in Section 66 has exactly this kind of effect.

While the ideal situation is to protect both the Intermediaries and others, such an attempt may weaken the entire fabric of the IT industry where criminals will have the last laugh. 

Under ITA-2000, any adverse impact on an information residing inside a computer could be  tried under Section 66. Under ITA-2005, unless "Fraud" or "Dishonesty" is proved, Section 66 cannot be invoked.

Under ITA-2000, at the first instance of data injury, investigation could have been launched with the arrest of the suspect and search and seizure of incriminating evidences lying in different systems. Under ITA-2005, it is necessary to obtain a Court order for arrest as well as for search and seizure.

This could hamper the investigation and provide opportunities for the criminals to erase the evidences.

Additionally, in any crime, intermediaries hold all the incriminating evidences. Without their whole hearted support, Cyber crime investigation may face hurdles.

Under ITA-2000, the need for "Due Diligence" by the intermediaries to escape liability acted as a strong reason for them to cooperate with the investigating agencies. Under ITA-2005, there is no reason under which Intermediaries may cooperate with the investigating agencies.

The IT industry will therefore be more vulnerable to the ill effects of Cyber Crimes.

The cost of "Hackers Insurance" or "Information Asset Insurance" as and when it may be available will increase.

Hence the softening of the loss may be detrimental to the IT industry.

Has the offence of "Virus introduction" been sufficiently addressed?

Introduction of Virus and variants such as spywares, trojans etc has been a concern for the industry.

Under ITA-2000, introduction of virus was covered under Section 43 and could also be covered under Section 66. In the ITA-2005, Section 66 has been restricted and will apply only to cases of "Dishonest" and "Fraudulent" introduction of Virus.

Most Spywares will now be exempt from the operation of Section 66.

Since Section 66 is now not a serious offence, Police cannot effectively investigate virus crimes and possibility of convictions will become lower.

ITA 2000 had provided under Section 78 that only an officer of the rank of DySP can investigate offences under the Act. Under Section 80, it had prescribed that the power to search and arrest without warrant is restricted to public places. In all other matters CrPc was to prevail.

The proposed amendments suggest deletion of Section 80. Hence Police shall not have any powers to search or arrest without warrant even in public places. Though section 78 remains, there is no mention anywhere about powers to Police for search or arrest.

Section 81 makes this Act override every other law other than Copyright Act and Patent Act. Hence it could be  interpreted as over powering  IPC and CrPc.

If silence about the powers of search and arrest is seen along with the specific removal of the earlier section, it may be interpreted that the legislators have decided to specifically remove the Police from Cyber Crime management system.

This view is further corroborated by some related provisions of  Sections 69 and 72.

Under Section 69 which gives certain powers to the Controller for interception of messages in specified context, the words " for preventing incitement to the commission of any cognizable offence" is being deleted. This means that the assistance of interception and decryption will not be available in case of offences under IPC or other statutes.

Under Section 72, it is stated that the victim should lodge the complaint directly with the Magistrate.

This could be interpreted as a deliberate attempt by legislators to keep ITA-2005 as an independent legislation not overlapping with any of the current activities of the Police under other legislations.

Under ITA-2000 it was common for the Police to frame charges under multiple Acts such as IPC and ITA-2000. Under ITA-2005 it appears that Police shall keep themselves off the Cyber Space which will be regulated by the "Controller" and  "Adjudicator" along with the assistance of the Magistrate.

Under ITA-2000, compounding of contraventions were permitted by the adjudicator either before or after adjudication. Since adjudicator's powers were limited to civil cases, the compounding was also permitted to civil cases.

In ITA-2005 it has been proposed that the Controller or the Adjudicator shall compound both contraventions and offences. In cases where prosecution is pending, on a mere notification from  the adjudicator that compounding has been permitted, the prosecution shall be dropped and the person discharged.

Under these provisions, no prior permission of the court is required for launching the compounding process and the Court shall not have any power to reject the compounding on any grounds.

Industry or the Society benefits if the society has a good system where crimes are controlled. If Police and Judiciary become redundant or less effective, it is unlikely that the society can be free from crimes. An increase of Cyber Crimes with a corresponding adverse effect on the society is therefore possible.

Will Individuals Benefit from Data Protection Provisions?

 Section 43 and Section 66 of ITA-2000 already provided good security to individuals who could bring penal action and also seek compensation from any person including an intermediary if data had been negligently handled causing loss. The level of "Due Diligence" required was left to the discretion of the judicial authority reviewing the case and could be made relative to the circumstances of the case.

ITA-2005 raises an artificial distinction between "Data" and "Sensitive Personal Data" and proceeds to give protection for compromise of "Sensitive Personal Data" by a corporate body caused by negligence in implementing "reasonable security practice".

By taking on the responsibility for defining "reasonable security practice", the system has been weakened since the security practice cannot keep pace with change of times and will remain stagnant. As a result the level of protection expected to be available for the data security can only be less than under the moving benchmark of security envisaged under ITA-2000.

While companies may consider that there is now a "clarity" and appoint "Auditors" to "check and certify" against a standard checklist, the incentive for continuous improvements on security has been taken off. The Government has taken the responsibility for developing what industry bodies should have developed as internal security standards.

In future any online fraud by a website either in the form of selling spurious goods or backing out of auction commitments etc will be difficult to be punished since the intermediary will be immune to such crimes and the fraudster may be non traceable.

I am afraid that even consumer laws cannot be invoked on online market places if the amendments become a law.

Will BPO customers feel more reassured?

The BPO customers who are perturbed by the type of data leakage of the Karan Bahree type would like strong laws that act as a deterrent for such crimes.

In ITA-2005 the addition of subsection (2) to Section 43 provides some remedy to individuals whose sensitive personal data is mis-handled by a corporate data manager. This however is more relevant to Indians and may not add any assurance to BPO customers.

On the other hand, while such frauds could easily have been covered under Section 66 of ITA-2000, under ITA-2005 the accused can escape liability by feigning innocence. (say by stating that he was only making a presentation of his capabilities as  Mr Karan Bahree is supposed to have stated).

The new Act is therefore weaken the confidence of the BPO customers from the current level.

With the dilution of the section 66 and 67 offences, reduction of Police powers and need for the complainant to approach the magistrate for registration of complaint, women who are harassed with doctored pictures (eg: Trisha video case) will find it extremely inconvenient to pursue their cases.

The proposed act is therefore anti women and threaten many marriages and female lives.

The proposed amendments has replaced the term "Digital Signatures" with Electronic Signatures in the earlier version.  Digital Signature is now defined as one of the types of Electronic Signatures. There is no suggestions of any new systems. Introduction of "Electronic Signatures" is therefore likely to be only of academic interest at this point of time.

There was a crying need to address issues such as Spam, Cyber Terrorism, Cyber Stalking and Cyber Squatting. The Committee has chosen to ignore these requirements.

a) Was the Constitution of the "Expert Committee" ultra-vires the Act?

b) Was the constitution of the committee lacking in proper representation of the stakeholders?

ITA-2000 had provided an inbuilt mechanism for review through CRAC. Under section 88, CRAC is the body which has a duty to advise the Government on any matter relating to the Act.

The constitution of the "Expert Committee" and its submission of the report to the Ministry directly and its acceptance may therefore be improper.

The constitution of CRAC had wide representation including representatives from Home, Law, Commerce and Finance  Ministry, RBI, CBI, State IT Secretaries and industry bodies. In contrast, the Expert Committee consists of only representatives of the MCIT, along with two private lawyers and three representatives from the industry. The industry representation comes from Sify and Rediff which are Portals and HCL Infosystems. Sify also has a significant stake in Cyber Cafes.

The constitution of the committee therefore appears to lack balance.