How hacking is charged
The Information Technology Act 2000 does not use the word hacking as an offence heading. Cases that are described as hacking are brought under several sections, chosen according to what the offender did. Section 43 lists the acts: accessing a computer, computer system or network without the permission of the owner, copying or extracting data, introducing a virus or contaminant, damaging or disrupting a system, denying access to authorised users, tampering with another person's account, and destroying, deleting or altering information. The person is liable to pay compensation to the person affected. Section 66 makes the same acts a crime when done dishonestly or fraudulently, with imprisonment up to three years, or a fine up to Rs 5 lakh, or both.
Other sections apply to particular results. Section 65 punishes tampering with computer source documents. Section 66C and section 66D apply where the intrusion is used to take on another person's identity or to cheat. Section 66F applies to attacks intended to threaten the unity, integrity, security or sovereignty of India, and carries imprisonment which may extend to life. The offences are set out in the guide to the IT Act 2000.
Types of hacking case
Hacking cases in India fall into recognisable groups. The first is the intrusion into a business system to steal data or money, often through stolen credentials. The second is the defacement of a website, in which the page is altered to display a message; this is an alteration of data that section 43 covers. The third is the introduction of malicious software that locks or damages data. The fourth is the attack on a government or critical system, which can engage the provisions on protected systems in section 70 and the offence of cyber terrorism. The fifth is the misuse of access by an insider who is entitled to use a system but goes beyond what the permission covers.
The last group is a reminder that unauthorised access includes access that exceeds what was permitted. A person who has a password for one purpose and uses it for another has accessed the system without permission for that purpose. The page on black hat hackers sets out the offences and penalties in a table.
How such cases are investigated
A police officer not below the rank of Inspector investigates offences under the Act, under section 78. The case depends on digital evidence, such as the logs of the system that was entered, the records of the internet provider, and the devices of the suspect, and its handling is described in the page on computer forensics. Where the offender is abroad, section 75 allows the Act to apply to an offence committed outside India if the conduct involves a computer, computer system or computer network located in India, although obtaining evidence abroad remains difficult.
The statistics on cyber crime in India, including how many cases are registered each year, are in the page on cyber crime in India, and the cases that courts have decided are collected in the case reports.