Cyber crime cases in India: the landmark judgments, case studies and what they decided

Cyber crime cases in India: the case studies and judgments this page covers

Anyone searching for the latest cyber crime cases in India will find news reports of individual incidents, and those reports change daily, and most are decided by trial courts whose judgments are rarely published in full. This page takes a different approach to cyber crime cases in India. It sets out four judgments of the Supreme Court that fix the law that every trial court must apply: one that removed an offence from the Information Technology Act 2000, two that decide how electronic evidence is proved, and one that recognises privacy as a fundamental right. Each digest is taken from the text of the judgment itself, including the headnote and the operative paragraphs.

The judgments are cited by their Supreme Court Reports citation, the court, the date and the case number. A reader who wants to cite them in a document should read the full text, since a short digest cannot carry every qualification. The cyber law cases listed below are deliberately few, and the list does not claim to be a complete record of cyber crime cases or of cyber law decisions. For the latest cyber crime cases in India, the judgments of the Supreme Court and the High Courts are published on the websites of the courts themselves, and the official case statistics are in the page on cyber crime in India.

Landmark judgments on cyber law

The table lists the four landmark judgments, the cyber law cases that every court now applies, with the provision each concerns and the point that each decided.

Each judgment is explained in more detail in the page of cyber crime case studies, which treats each of them as one of four case studies and sets out the facts, the question and the reasoning. The sections of the Information Technology Act mentioned here are explained in the guide to the IT Act 2000.

Shreya Singhal: the end of section 66A

Section 66A was not part of the Information Technology Act as first enacted. It came into force through the Amendment Act of 2009 with effect from 27 October 2009. It punished a person who sent through a computer resource or a communication device information that was grossly offensive or of menacing character, or false information sent to cause annoyance, inconvenience, danger, insult, injury, criminal intimidation, enmity, hatred or ill will, or an electronic mail sent to cause annoyance or to deceive about its origin, with imprisonment up to three years and a fine.

In its judgment of 24 March 2015, a bench of J. Chelameswar and R.F. Nariman held that section 66A violates Article 19(1)(a) of the Constitution and is not saved by Article 19(2). The Court said that the section arbitrarily, excessively and disproportionately invades the right of free speech, that its expressions are open ended, vague and undefined, and that its reach has a chilling effect on free speech. It held that no part of the section is severable, so the section as a whole is unconstitutional. The Court rejected the argument that the section violates Article 14, because there is an intelligible differentia between speech on the internet and other media.

The same judgment dealt with two other provisions. It upheld section 69A and the blocking Rules of 2009, calling the section a narrowly drawn provision with several safeguards. And it upheld section 79, subject to section 79(3)(b) being read down: an intermediary loses its exemption only if it fails to remove or disable access to material after receiving actual knowledge that a court order has been passed asking it to do so, and the court order or the notification of the appropriate Government or its agency must strictly conform to the subject matters in Article 19(2). Section 118 of the Kerala Police Act, 1960 was struck down as vague and overbroad.

Anvar and Khotkar: proving electronic evidence

Two judgments settle how an electronic record is proved in court. In Anvar P.V. v. P.K. Basheer, decided on 18 September 2014 by a bench of three judges, the Supreme Court dealt with CDs of speeches and announcements produced in an election petition without any certificate. It held that an electronic record by way of secondary evidence cannot be admitted unless the requirements of section 65B of the Evidence Act are met, that the Evidence Act does not permit proof of an electronic record by oral evidence if section 65B is not satisfied, and that a CD, VCD or chip must be accompanied by the certificate obtained at the time the document is taken. The Court overruled the earlier decision in State (NCT of Delhi) v. Navjot Sandhu.

In Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, decided on 14 July 2020 by three judges, the Court was asked to reconsider the position after a two-judge decision, Shafhi Mohammad v. State of Himachal Pradesh, had taken a different view. It held that sections 65A and 65B are a complete code on the admissibility of information in electronic records, that a written certificate under section 65B(4) is a sine qua non, and that oral evidence cannot take its place. Two points soften the rule: the certificate is unnecessary if the original document itself is produced, and a party who has done everything possible to obtain the certificate may be relieved of the obligation. The Court held that Anvar P.V., as clarified, is the law, and overruled Shafhi Mohammad.

The Court also issued general directions to cellular companies and internet service providers, to be followed by courts dealing with electronic evidence until rules and directions under section 67C of the Information Technology Act are formulated. The Evidence Act has since been replaced by the Bharatiya Sakshya Adhiniyam, in force from 1 July 2024, and a reader should check how the provisions of the new Act correspond to section 65B before relying on these decisions for current proceedings.

What the section 65B certificate contained

The certificate that Anvar and Khotkar require is described in section 65B(4) of the Evidence Act, which the Anvar judgment quotes. It is a certificate identifying the electronic record containing the statement and describing the manner in which it was produced; giving the particulars of any device involved in producing the record, as appropriate to show that the record was produced by a computer; and dealing with the matters to which the conditions in sub-section (2) relate. It must purport to be signed by a person occupying a responsible official position in relation to the operation of the relevant device or the management of the relevant activities, and it is evidence of any matter stated in it, with a statement being sufficient if made to the best of the knowledge and belief of the person stating it.

For the practice of cyber crime cases in India, the lesson is practical. The certificate is a document that has to be obtained from the person who controls the device or the system, at the time the record is taken, and a prosecution or a claim that depends on a message, a log or a recording should secure it early. The way such evidence is collected and kept is explained in the page on computer forensics.

Puttaswamy: privacy as a fundamental right

In Justice K.S. Puttaswamy (Retd.) v. Union of India, decided on 24 August 2017 by a bench of nine judges, the Court held that privacy is a constitutionally protected right in India, protected as an intrinsic part of the right to life and personal liberty under Article 21 and as part of the freedoms guaranteed by Part III. It overruled M.P. Sharma, in so far as that decision said that privacy is not protected by the Constitution, and overruled Kharak Singh to the extent that it held the same.

The judgment lists several aspects of privacy, including informational privacy, which it describes as an interest in preventing information about the self from being disseminated and in controlling the extent of access to information. That aspect is the constitutional background to the law on personal data. The Digital Personal Data Protection Act 2023 describes its own purpose as recognising both the right of individuals to protect their personal data and the need to process such data for lawful purposes, and the guide to the DPDP Act 2023 explains how it does so. A separate decision of 2018 on the Aadhaar Act, by a five-judge bench, applied the 2017 judgment and should not be confused with it.

Cyber crime statistics behind the cases

The judgments above set the law, and the case statistics show why they matter. The National Crime Records Bureau recorded 27,248 cases registered under cyber crimes in 2018 and 86,420 in 2023, as the Ministry of Home Affairs told Parliament. The table gives the yearly numbers.

The figures count cases registered, not convictions, and they say nothing about how many of the cases involve the provisions discussed in the landmark judgments. The page on cyber crime in India explains the figures and what they leave out, and the page on online fraud covers the largest single category.

How to read a cyber law judgment

A judgment has layers. The headnote summarises the decision, the facts and the question come first in the body, and the operative part, which says what the Court ordered, is at the end. A holding applies to the facts and the question that were before the Court, and a later case may narrow it, as Khotkar clarified Anvar. When a judgment overrules another, the overruled case ceases to be good law on that point. Anyone relying on a decision should read the full text and check whether a later judgment has changed it.

Frequently asked questions