Section 70 IT Act: Protected system

Information Technology Act, 2000

Section 70 IT Act at a Glance

Section 70 IT Act lets the appropriate Government notify a computer resource affecting Critical Information Infrastructure as a protected system and authorise access in writing. Securing or attempting unauthorised access carries up to 10 years simple or rigorous imprisonment and liability to fine.

Punishment

Up to 10 years, simple or rigorous, under sub-section (3)

Non-Bailable ⓘCognizable ⓘNon-Compoundable ⓘ🏛️ Court of Session ⓘ

Section 70 IT Act Bare Act Text

70. Protected system.

(1) The appropriate Government may, by notification in the Official Gazette, declare any computer resource which directly or indirectly affects the facility of Critical Information Infrastructure, to be a protected system.

Explanation.—For the purposes of this section, “Critical Information Infrastructure” means the computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety.

(2) The appropriate Government may, by order in writing, authorise the persons who are authorised to access protected systems notified under sub-section (1).

(3) Any person who secures access or attempts to secure access to a protected system in contravention of the provisions of this section shall be punished with imprisonment of either description for a term which may extend to ten years and shall also be liable to fine.

(4) The Central Government shall prescribe the information security practices and procedures for such protected system.

Amendments to this section
  • Subs. by Act 10 of 2009, s. 35, for sub-section (1) (w.e.f. 27-10-2009).
  • Ins. by s. 35, ibid. (w.e.f. 27-10-2009).

Section 70 IT Act in Simple Words

Section 70 IT Act allows the government to designate computer resources tied to Critical Information Infrastructure as protected systems and severely punishes unauthorised access or attempted access to them. Under Section 70(1) IT Act, the appropriate Government may, by notification in the Official Gazette, declare any computer resource (a term defined in Section 2 IT Act) that directly or indirectly affects the facility of Critical Information Infrastructure to be a protected system. The Explanation to Section 70 IT Act defines 'Critical Information Infrastructure' for Section 70 IT Act as a computer resource whose incapacitation or destruction has a debilitating impact on national security, the economy, public health or safety.

Under Section 70(2) IT Act, the appropriate Government may issue an order in writing naming the persons authorised to access protected systems notified under Section 70(1) IT Act. Under Section 70(3) IT Act, any person who secures access, or attempts to secure access, to a protected system in contravention of Section 70 IT Act faces simple or rigorous imprisonment for up to 10 years and is also liable to fine. Unlike general unauthorised computer access covered by Section 43 IT Act and Section 66 IT Act, Section 70(3) IT Act applies specifically to notified protected systems and punishes both completed access and an attempt with up to 10 years imprisonment. Under Section 70(4) IT Act, the Central Government must prescribe the information security practices and procedures for such protected systems.

Under Section 77B IT Act, an offence under Section 70(3) IT Act is cognizable (the police can register an FIR and arrest without a warrant). Because the punishment can exceed 7 years, Part II of the First Schedule to the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS) makes the offence non-bailable (bail is decided by the court and cannot be claimed as of right) and triable by a Court of Session, while Section 77A IT Act bars compounding (a court cannot close the case through a settlement) since the maximum imprisonment exceeds 3 years. Act 10 of 2009 substituted Section 70(1) IT Act and made a further insertion in Section 70 IT Act with effect from 27 October 2009.

Ingredients of Section 70 IT Act

  • The computer resource directly or indirectly affects the facility of Critical Information Infrastructure (a computer resource whose incapacitation or destruction has a debilitating impact on national security, the economy, public health or safety).
  • The appropriate Government has declared that computer resource to be a protected system by notification in the Official Gazette under Section 70(1) IT Act.
  • Under Section 70(2) IT Act, access to the protected system is restricted to persons authorised by an order in writing from the appropriate Government.
  • For the offence under Section 70(3) IT Act, a person secures access, or attempts to secure access, to the notified protected system in contravention of Section 70 IT Act.

Punishment Under Section 70 IT Act

Imprisonment

Up to 10 years, simple or rigorous, under sub-section (3)

Fine

Liable to fine, in addition to imprisonment

Non-Bailable ⓘCognizable ⓘNon-Compoundable ⓘ🏛️ Court of Session ⓘ

Section 77B IT Act makes the offence cognizable. Part II of the First Schedule to the BNSS decides the rest: an offence punishable with imprisonment for more than 7 years is non-bailable and is tried by a Court of Session. Section 77A IT Act does not allow it to be compounded, because the punishment exceeds 3 years.

Under Section 70(3) IT Act, securing access or attempting to secure access to a protected system in contravention of Section 70 IT Act is punishable with simple or rigorous imprisonment for up to 10 years, and the offender is also liable to fine in addition to imprisonment. Under Section 77B IT Act and Part II of the First Schedule to the BNSS, the offence is cognizable, non-bailable, and triable by a Court of Session. Under Section 77A IT Act, the offence cannot be compounded because the maximum imprisonment exceeds 3 years.

Example of Section 70 IT Act

The appropriate Government publishes a notification in the Official Gazette under Section 70(1) IT Act declaring a power-grid control computer system in Visakhapatnam to be a protected system, as its incapacitation would have a debilitating impact on the economy and public safety. By an order in writing under Section 70(2) IT Act, the appropriate Government authorises Mary and a named engineering team to access that protected system. Imtiaz, who holds no written authorisation, tries to bypass the login controls to gain entry into the protected system and is blocked before getting in. Even though Imtiaz did not succeed in entering the system, attempting to secure unauthorised access to a notified protected system contravenes Section 70(3) IT Act. Imtiaz faces a cognizable and non-bailable prosecution before a Court of Session, punishable with simple or rigorous imprisonment for up to 10 years and liability to fine.

When Section 70 IT Act Does Not Apply

  • Section 70(3) IT Act applies only to a computer resource that the appropriate Government has declared to be a protected system by notification in the Official Gazette under Section 70(1) IT Act.
  • Access to a notified protected system by a person whom the appropriate Government has authorised by an order in writing under Section 70(2) IT Act does not contravene Section 70 IT Act.

FAQs on Section 70 IT Act

What is Section 70 IT Act?▼

Section 70 IT Act empowers the appropriate Government, by notification in the Official Gazette, to declare any computer resource that directly or indirectly affects Critical Information Infrastructure to be a protected system, and to authorise in writing who may access it. Under Section 70(3) IT Act, any person who secures or attempts to secure unauthorised access to a protected system faces simple or rigorous imprisonment for up to 10 years and is also liable to fine.

What is Critical Information Infrastructure under Section 70 IT Act?▼

A computer resource whose incapacitation or destruction has a debilitating impact on national security, the economy, public health or safety. The Explanation to Section 70 IT Act sets out this definition for the purposes of Section 70 IT Act.

Is a failed attempt to access a protected system an offence under Section 70(3) IT Act?▼

Yes. Section 70(3) IT Act explicitly punishes both a person who secures access and a person who attempts to secure access to a protected system in contravention of Section 70 IT Act. Both attract the same maximum punishment of up to 10 years simple or rigorous imprisonment and liability to fine.

Which court tries an offence under Section 70(3) IT Act?▼

The Court of Session. Because Section 70(3) IT Act carries up to 10 years imprisonment, Part II of the First Schedule to the BNSS read with Section 77B IT Act makes the offence cognizable, non-bailable, and triable by a Court of Session.

Who prescribes security practices for a protected system under Section 70(4) IT Act?▼

The Central Government. While the appropriate Government notifies a protected system under Section 70(1) IT Act and authorises access in writing under Section 70(2) IT Act, Section 70(4) IT Act requires the Central Government to prescribe the information security practices and procedures for that protected system.

Have questions about Section 70 IT Act?

Ask NyayGuru about your situation and get an answer based on the Information Technology Act, 2000.

Ask NyayGuru →

Disclaimer: This is for informational purposes only. Always consult a qualified advocate for legal advice.

Sources: Bare Act Text, Information Technology Act, 2000 ·