Cyber Crime Taxonomy and the IT Act 2000

A useful general distinction is computer-dependent conduct, such as unauthorised system interference, versus computer-enabled conduct, such as fraud conducted online. A device can also hold evidence of an offence unrelated to the computer itself.

Persons, property and public interests are overlapping teaching categories. They do not prescribe an exclusive lead section or responsible agency, and should not be presented as a universal official three-part charging code.

A single incident can involve several victims, systems and alleged acts. Build a chronology and identify the conduct, intent, authority and harm that each proposed provision requires.

Distinguish a suspect’s account, a compromised intermediary and a victim’s system. Hosting an IP address or receiving a payment is not automatically proof of the operator or intent.

Retain relevant communications, access/security records, transaction references and collection provenance. Missing artefacts and alternative explanations belong in the report, not only incriminating observations.

Complaint statistics and regional procurement claims are unnecessary to explain these categories. Use separately sourced, dated statistics only when the numbers answer a genuine reader question.

The following is an orientation, not the complete statutory text or a penalty calculator. Check the current consolidated law, commencement and facts before applying a provision.

A section number does not prove its elements. Record why a technical observation is relevant and where the evidence is insufficient. Do not convert a common incident label such as “hacking” into a concluded charge.

Electronic-signature recognition and certificate issuance are distinct matters: section 5 concerns legal recognition, while section 35 concerns issuance. Neither makes every signed file true or every certificate equivalent.

Older statutory PDFs can retain superseded penalties. Jan Vishwas amendments changed provisions including sections 72 and 72A; avoid repeating obsolete imprisonment/fine tables as current law.

The Supreme Court’s Shreya Singhal judgment of 24 March 2015 struck down section 66A. Its continuing presence in a historical template or unannotated statute copy does not revive it.

The Court upheld section 69A and the Blocking Rules and read down the section 79(3)(b) actual-knowledge trigger in relation to court orders or appropriate-government notification. These holdings have different purposes.

An ordinary private complaint is not identical to the trigger considered for loss of protection under that holding. Grievance handling, specified removal duties and legal orders still need their own current-law analysis.

If a record cites section 66A, identify the problem accurately. Do not assert that every other allegation in the same case automatically disappears or prescribe one inevitable court outcome.

Other offences require their own elements and constitutional assessment. The BNS did not replace section 66A with a universal offence of offensive online speech.

Phishing, vishing, smishing, account takeover and relationship-investment fraud describe methods or patterns. Similar financial losses can arise through different conduct; preserve what was actually said, accessed, transferred and authorised.

A SIM replacement and a port to another network are different processes. Neither proves account compromise alone. Relevant telecom and account records may help explain the sequence.

Hypothetical Indian example: a person reports an impersonation message and transfer to a purported investment. Preserve the message context, account identifiers, payment references and available device records; do not assume the named account holder operated the scam.

For applicable Indian reporting, the National Cyber Crime Reporting Portal and 1930 financial-fraud mechanism can be relevant. Reporting promptly can help response, but it does not guarantee a freeze, recovery, FIR or prosecution.

Law-enforcement, financial-institution and provider requests have different purposes and authority. Cross-border records may require an applicable international route; provider preservation is separate from disclosure.

This worked example stays Indian because the lesson teaches Indian law. General technical lessons use country-neutral methods and US-first examples where legal comparison is useful.

Data protection, cybercrime investigation and incident response are separate tracks. An incident may require several assessments, but ransomware is not automatically cyber terrorism or a breach triggering every statutory duty.

The DPDP Act and Rules have staggered commencement. The Gazette dated 13 November 2025 places major substantive duties, data-principal rights and the IT Act section 43A omission in an eighteen-month phase. As at this lesson’s 10 November 2026 review, do not describe those future provisions as already fully operative.

Other provisions began earlier, and a one-year phase also exists. Consult G.S.R. 843(E) for the Act and rule 1 of G.S.R. 846(E) for the Rules. An announcement that the framework was notified is not the same as every duty commencing.

Assess territorial scope, covered data, processing role, exceptions and the law applicable on the relevant date. Do not infer that every organisation holding any record has identical obligations.

CERT-In’s 28 April 2022 directions require specified entities to report listed incidents within six hours of noticing or being notified of them. The directions and official FAQs define the scope; this is not a worldwide notification clock.

The directions also address clock synchronisation and ICT log retention for a rolling 180-day period within Indian jurisdiction. That is not a universal rule that every consumer must retain every file for 180 days.

Initial reporting may use available information with appropriate follow-up under the official guidance. Preserve awareness and reporting times separately from the incident’s estimated start time.

An insider event, deceptive email, traffic interception and spoofed identifier can require different technical questions. Do not prescribe a complete legal charge from one artefact or tool name.

For access allegations, correlate identity/account records, authorisation, endpoint events and affected resources. Legitimate credentials do not decide whether every action was authorised or who used them.

For email deception, preserve the message, trusted-receiver authentication results, account audit context and payments. A spoofed display name differs from a compromised mailbox.

For interception, assess network position, capture coverage and actual content visibility. The existence of Wireshark or a packet file does not independently establish unlawful interception.

Cross-border collection and evidentiary qualification require their own assessment. Section 69 is not a generic private investigator’s password-compulsion power, and a certificate does not cure unlawful collection or missing provenance.

For India’s general criminal/evidence framework, continue to BNS 2023 and BSA 2023 Electronic Evidence. Technical acquisition steps remain in the main teaching modules.