Practice with national-level exam (FACT, FACT Plus, NET, CUET, etc.) mocks, learn from structured notes, and get your doubts solved in one place.
The Indian cyber crime taxonomy a digital forensic examiner must know, mapped onto the IT Act 2000 sections, the ITAA 2008 amendment, and the post Shreya Singhal frame.
A cyber crime is any offence where a computer, network, mobile device or data resource is the target of the act, the instrument of the act, or the storage medium for the evidence of the act. The Indian statute that gives this category its working definition is the Information Technology Act 2000, amended substantively by the Information Technology (Amendment) Act 2008 (often called ITAA 2008 or ITAA 2009 by the year of notification). The 2008 amendment is what created Sections 66A through 66F, broadened Section 67 to cover sexually explicit and child sexual material, gave statutory force to electronic signatures, and turned the original Section 79 into the modern intermediary safe harbour. Most cyber FIRs you will read in India sit on a combination of IT Act sections plus BNS 2023 provisions, and the Indian Cyber Crime Coordination Centre (I4C) at cybercrime.gov.in is the single window where most victim complaints originate.
The thing most candidates miss is that "cyber crime" is not one offence with one section number. It is a forensic taxonomy that police, prosecutors and FSL examiners use to decide which provisions to charge, which artifacts to seize, and which CERT-In or I4C workflow to invoke. Two cases with the same harm (your money is gone, your photographs are leaked) can sit under completely different sections depending on whether the offender accessed your account, impersonated you, or coerced you into transferring funds. Knowing the taxonomy is how you read a chargesheet and know what evidence the IO will need to produce.
Three target classes, one statute, one coordination centre.
The working Indian classification splits cyber offences into three target classes by who the harm falls on. Crimes against persons cover offences where the human victim is the primary target: cyberstalking, online grooming, harassment, identity theft, online financial fraud aimed at a retail account holder, sextortion, and romance scams. Crimes against property cover offences where the asset is the target: hacking of corporate systems, website defacement, IPR violations, ATM and UPI fraud, ransomware against businesses. Crimes against government and society cover cyber terrorism, espionage, and large-scale malware deployment that threatens public infrastructure. This three-way split is the one used in NCRB's annual Crime in India volumes and in the cybercrime.gov.in complaint categories.
| Target class | Common offences | Lead IT Act sections | Primary investigating agency |
|---|---|---|---|
| Against persons | Stalking, grooming, identity theft, sextortion, romance scams, OTP fraud | 66C, 66D, 66E, 67, 67A | State cyber cell, district cyber unit, I4C intake |
| Against property | Hacking, defacement, ransomware, ATM and UPI fraud, IPR theft | 43, 65, 66, 66B | State cyber cell, CBI in cross-border, CERT-In for incident response |
| Against government and society |
One line per section, one artifact per section.
The IT Act has been built up in layers. The 2000 original gave India its first computer-offence statute. The 2008 amendment, notified in October 2009, did the real work: it created the modern catalogue of offences from Sections 66A through 66F and 67A through 67B, broadened interception and blocking powers under Sections 69 and 69A, and rewrote Section 79 as the modern intermediary safe harbour with conditional immunity. The 2021 IT Rules added grievance officer, traceability and content takedown obligations on top.
One judgment reshaped how cyber speech is policed in India.
Shreya Singhal v Union of India (2015) is the most important Indian cyber law judgment a forensic candidate will be asked to summarise. A two-judge bench of the Supreme Court struck down Section 66A in entirety as violative of Article 19(1)(a). The reasoning was that the section's "grossly offensive" and "menacing" language was vague to the point of arbitrariness, and that the chilling effect on lawful speech was disproportionate. The bench upheld Section 69A and the Blocking Rules with a reading-down, and read into Section 79 a requirement that takedown be on the basis of a court order or a government notification rather than private complaints alone.
The practical consequence for an examiner is that any FIR that still cites Section 66A is procedurally infirm. State cyber cells have been directed to stop using the section; the data still surfaces in some district FIR forms because legacy templates have not been updated. When a chargesheet relies on Section 66A, the standard defence move is to seek quashing under Section 528 BNSS (formerly Section 482 CrPC) on the Shreya Singhal authority.
| Provision | Status post Shreya Singhal | What survived |
|---|---|---|
| Section 66A | Struck down in entirety | Nothing. FIRs citing 66A are liable to quashing. |
The same techniques, repackaged by quarter.
If you read state cyber cell dashboards across 2024 to 2026, a small set of typologies dominates the complaint volume. Phishing (deceptive email or SMS), vishing (voice call impersonating bank, courier, customs or police), and smishing (SMS link to a credential-harvesting page) are the entry typologies. SIM swap is the escalation where the offender ports the victim's mobile number to a new SIM to intercept OTPs. OTP fraud is the broad bucket of any social-engineering attack that results in the victim disclosing or approving an OTP. Mule accounts are bank accounts opened with stolen or rented KYC and used as the first hop in laundering. Fake job scams collect fees, training payments or KYC data from job seekers. Pig-butchering (also called fake-investment scam or romance-investment scam) is a long-running confidence script that pairs a romantic or social pretext with a fake investment platform.
Personal data is now a regulated asset, not just collateral.
The Digital Personal Data Protection Act 2023 was notified on 11 August 2023 and is being rolled out in stages through the DPDP Rules. The Act applies to processing of digital personal data within India, and to processing outside India where it is connected to offering goods or services to data principals in India. For a digital forensic examiner, three operational consequences matter. First, every business that holds personal data is now a "data fiduciary" with statutory obligations on notice, consent, purpose limitation, security safeguards and breach notification. Second, the data principal (the individual whose data is processed) has enumerated rights including access, correction, erasure and grievance. Third, the Data Protection Board of India is the adjudicatory body for breach penalties, with monetary penalties up to Rs 250 crore per offence depending on category.
| Concept | DPDP Act 2023 reference | Operational meaning for a forensic examiner |
|---|---|---|
| Data fiduciary | Section 2(i) and Section 8 | The entity that determines purpose and means of processing; bears security and breach-notification obligations. |
| Data principal | Section 2(j) and Section 11 | The individual whose data is processed; can complain to the Board and exercise correction or erasure rights. |
| Personal data breach | Section 8(6) | Any unauthorised processing, accidental loss or alteration of personal data. Notification to the Board and to affected principals is mandatory. |
The threats behind the section numbers.
The IT Act sections are the legal handles; the underlying technical events are what the examiner actually investigates. Six classes recur often enough that a forensic candidate should be able to identify each from a fact pattern and name the artifact.
Which IT Act section is the workhorse provision for phishing and vishing cases in India?
| Cyber terrorism, critical infrastructure intrusion, espionage |
| 66F, 69, 69A, 70 |
| NIA, IB, state ATS, CERT-In, NCIIPC |
The I4C portal at cybercrime.gov.in routes complaints into one of these categories and then into a state's nodal cyber cell. Maharashtra, Telangana, Karnataka and Delhi have well-developed cyber cells with dedicated cyber police stations; smaller states route through the district SP's office. NCRB's Crime in India 2023 volume reported cyber crime cases rising by roughly a quarter year over year, dominated by online financial fraud and offences against women and children, a pattern that has held since the 2020 lockdown push to digital payments.
The artifact pattern an examiner should associate with each section is what makes the section list useful. Section 43 and 66 cases need access logs, authentication records and a forensic image of the target system. Section 66C needs the impersonating credential and the path it travelled (SIM swap records, phishing kit hosting). Section 66D needs the call recordings, payment trail and the IP-to-subscriber mapping for the deceptive resource. Section 66F needs network capture and command-and-control attribution. Section 67 family needs hash-matched content and a 65B/63 BSA certificate for every copy produced.
| Section 69A | Upheld with safeguards | Blocking is constitutional with procedural compliance under the 2009 Blocking Rules. |
| Section 79 | Upheld with read-down on takedown trigger | Takedown only on court order or government notification under Section 79(3)(b). |
The forensic implication of the ladder is that a single complaint often produces a chargesheet citing two or three IT Act sections plus BNS provisions. A pig-butchering case typically pulls in Section 66D (cheating by personation through computer resource), Section 66C if the offender used the victim's credentials anywhere in the chain, and BNS Section 318 for the general offence of cheating. The investigator's evidence list will include WhatsApp chat exports, screen recordings of the fake investment dashboard, UPI transaction history, mule account KYC, telecom CDR, and the I4C escalation acknowledgement.
| Significant data fiduciary | Section 10 | Designated higher-risk entities with extra obligations: DPO, audit, impact assessment. |
| Penalty cap | Schedule | Up to Rs 250 crore for failure to take reasonable security safeguards. |
For a cyber forensic case, the DPDP frame creates parallel duties on top of the IT Act and BNS charges. A ransomware incident at a hospital, for instance, is simultaneously a Section 66 IT Act offence, potentially a Section 66F cyber terrorism question if critical care systems are downed, a CERT-In reportable incident under the April 2022 directions, and a DPDP breach with notification to the Data Protection Board and the affected patients. The examiner's report needs to capture timestamps and IOCs with enough fidelity that all four workflows can be supported from the same artifact set.
The cross-link here is to BNS 2023 Cyber Provisions and BSA 2023 Electronic Evidence, which covers the BSA Section 63 certificate workflow that the same digital artifacts will need at trial, and to Digital First Responder: Volatility, Seizure, Imaging for the acquisition discipline that supports the chain of custody.
The standard forensic artifact map for these patterns is: authentication and access logs (insider, spoofing, MITM), email server logs and headers (email scam, social engineering), packet captures and NetFlow (sniffing, MITM, network reconnaissance), endpoint EDR telemetry (malware deployment), and mobile and SIM provisioning records (SIM swap, OTP fraud).