Section 66 of the Information Technology Act 2000 defines computer hacking and unauthorized data alteration as criminal offences punishable by up to three years imprisonment or fines up to two lakh rupees. The statute penalizes any intentional or knowing act that destroys, alters, deletes, or diminishes the utility of digital data in a computer resource.
Statutory Elements of Section 66 IT Act
Section 66 acts as the primary penal provision for computer-related offences in Indian cyber law. It links directly with Section 43 of the Act, converting civil liabilities for unauthorized computer access into cognizable criminal penalties when committed dishonestly or fraudulently.
To establish an offence under Section 66, the prosecution must prove specific statutory elements:
- Intent or knowledge that the action is likely to cause wrongful loss or damage to the public or any person.
- Destruction, deletion, or alteration of information residing within a computer resource.
- Diminution of the value or utility of data, or injurious affection of computer systems by any electronic means.
Interplay Between Civil Liability and Penal Sanctions
Section 43 enumerates civil violations including unauthorized downloading, introduction of computer contaminants, database disruption, and denial of service attacks. When any of these acts are executed with dishonest intention under Section 66, the matter transitions from civil compensation into criminal prosecution.
Organisations handling sensitive digital assets must maintain systematic technical oversight. Engaging professional cyber law compliance audit services helps enterprises identify system vulnerabilities and prevent insider data tampering.
Evidentiary Standards and Digital Forensics
Successful prosecution under Section 66 requires strict compliance with digital evidence rules under Section 65B of the Indian Evidence Act. Investigators must secure electronic logs, hash values, server records, and chain of custody documentation to prove unauthorized alteration in court. Cross-border data security issues often intersect with international cyber law standards.
Legal Consequences and Victim Reporting Protocols
Conviction under Section 66 carries severe legal consequences, including custodial imprisonment for up to three years, monetary fines extending up to two lakh rupees, or both. Victims of hacking or data alteration should immediately isolate affected systems, preserve digital logs, and file a formal complaint with the Cyber Crime Police Cell or national reporting portal.
Regulatory frameworks and cybersecurity policies are published by the Ministry of Electronics and Information Technology.