Lesson 14 — Beginner

Cyber Law & Ethics (IT Act)

Hacking seekhna zaroori hai, par uski boundary bhi jaanni zaroori hai. Is lesson mein hum India ke Information Technology Act ke key sections, common penalties, cyber complaint ka sahi raasta aur professional ethics samjhenge — ye interview aur roz dono kaam aata hai.

⏱ 13 min• Beginner• Incident Response

Cyber law kya hai

WHAT

Cyber law digital activity ko legal framework deta hai — crime ka definition, punishment, aur victim ke rights. India ka main law hai Information Technology Act, 2000 (2008 mein amended).

WHEN

Data breach, online fraud, hacking, defamation, privacy violation — jab bhi digital cheez par rights tootti hain, law applicable hai.

WHERE

IT Act, CERT-In directions, DPDP Act 2023, aur contracts/ToS — ye sab cyber law ke daayre mein aate hain.

Yaad rakho: Cyber law do taraf kaam karta hai — criminals ko saza deta hai, aur organisations ko compliance (rules follow karna) ka burden deta hai. Doosra point aksar reh jaata hai, exam mein poochha jaata hai.

IT Act 2000 — key sections

IT Act 2000 (amended 2008) — key sections:

Sec 43  : unauthorized access/damage to computer
          -> civil liability, compensation (up to Rs 1 crore)
Sec 43A : body corporate ki negligence (data breach)
          -> compensation (reasonable, up to Rs 5 crore)
Sec 66  : computer related OFFENCES
          -> up to 3 saal + Rs 5 lakh fine (ya dono)
Sec 66C : identity theft (password/signature nakli use)
          -> up to 3 saal + Rs 1 lakh
Sec 66D : cheating by impersonation (nakli identity se thagai)
          -> up to 3 saal + Rs 1 lakh

IMPORTANT TRAP: Sec 66A (offensive message) 2015 mein
Supreme Court ne STRUCK DOWN kar diya — ab valid NAHI

Exam trap: Har exam mein aata hai: "Section 66A abhi bhi valid hai?" — NAHI. Shreya Singhal vs Union of India (2015) case mein strike down ho gaya. Aur CERT-In = India ki nodal cyber agency (24x7, incident reporting ke liye).

Cyber ethics — professional boundary

White hat: permission + scope + disclosure — ethical, legal.
Grey hat: intent achha par permission nahi — risky, avoid karo.
Black hat: unauthorized + fayda/mischief — illegal.
Written consent: testing se pehle approval, scope define, timeline tay.
Responsible disclosure: vendor ko pehle mauka do fix karne ka, phir public.
Privacy: minimum data, sirf purpose ke liye — jo mila use bahar mat karo.
Honest reporting: findings chhodo mat — findings hide karna bhi ethical breach hai.

Ek line mein ethics: "Kya main ye wahi kar raha hoon jo written permission mein likha hai?" Haan toh white hat, nahi toh kitna bhi "sirf seekh raha tha" bolo — offence hai.

Complaint aur reporting ka sahi raasta

India mein fraud/report route:
1. Turant bank/UPI app ko BLOCK + 1930 cyber helpline
2. cybercrime.gov.in pe complaint file karo (financial fraud)
3. Evidence save rakho: screenshots, transaction IDs, numbers
   (delete mat karo — investigation ke liye chahiye)
4. Employee ho toh company ka SOC/IRT turant inform karo
5. Organisations: CERT-In directions ke under specified
   incidents report karne hoti hain (time limit ke saath)

DPDP Act 2023 : personal data ka consent + breach duties

TIME = MONEY : jaldi report = recovery ka chance zyada

Yaad rakho: Hacking SEEKHNA legal hai — lab, CTF, apne machines, sanctioned ranges. Unauthorized kisi ka system chhedna, chahe intent achha ho ya nahi — offence hai. Yahi line interview mein bhi poochhi jaati hai.

Exercise

Question: IT Act kis saal mein pass hua? (sirf number daalo)

Question: Section 66C kaunsa crime cover karta hai — identity theft ya copyright?

Question: India mein cyber fraud ki official complaint portal ka naam kya hai? (domain)

Common mistakes

Section 66A ko abhi bhi valid samajhna: 66A 2015 mein Supreme Court ne strike down kar diya. Ye sabse common exam trap hai — rat lo.
Sochna "seekhne ke liye hack karna chalta hai": Apne lab mein seekho. Kisi aur ka system bina permission = offence, intent chahe achha hi kyun na ho.
Complaint deri se karna: Financial fraud mein pehla ghanta golden hai — 1930 + bank block. Der se report karne par recovery chance girta hai.

Desi example: Fraud ke baad — sahi sequence

Dost ke UPI se 40,000 gaye fake call pe. Usne ye sequence follow kiya — isi ko bolte hain time-bound response:

Min 0  : UPI app block + bank ko call
Min 10 : 1930 pe report (fraud control)
Min 30 : cybercrime.gov.in pe complaint
Save   : SMS, call log, transaction ID (sab proof)
Office : SOC ko inform (agar company device tha)

Exam mapping (CUET / TCS / UGC)

CUET: IT Act ka year (2000) + nodal agency (CERT-In).
TCS NQT: "Section 66A status?" — struck down (classic trap).
UGC-NET: cyber law ke purpose + ethics ke types.
Trap: "Grey hat is legal" — galat, permission ke bina grey bhi offence ho sakti hai.

Lesson complete?

Law aur ethics clear! Ab last lesson — Top 50 Questions — poore course ka interview aur exam revision.