Open Access Research Article
"RETHINKING SECTIONS 43 AND 66 OF THE INFORMATION TECHNOLOGY ACT: THE NEED FOR A STATUTORY SAFE HARBOUR FOR GOOD-FAITH SECURITY RESEARCH"
Abstract
The
Information Technology Act, 2000 criminalizes unauthorized access to computer
systems under Sections 43 and 66, yet neither provision distinguishes between
malicious intrusion and good-faith cybersecurity research. Section 43 imposes
civil liability for unauthorized access irrespective of intent, while Section
66 converts specified acts into criminal offences only where committed
dishonestly or fraudulently — a mens rea requirement that nonetheless leaves
the boundary between legitimate security testing and criminal conduct undefined
in statute. Although the Indian Computer Emergency Response Team (CERT-In)
operates a Responsible Vulnerability Disclosure and Coordination Policy
encouraging researchers to report security flaws, the policy expressly
disclaims providing any exemption from applicable law, leaving disclosers fully
exposed to civil and potential criminal liability for the very conduct the
policy solicits. This paper examines whether India's existing statutory and
policy framework adequately protects good-faith security researchers, and
argues that the absence of an express statutory safe harbour — despite civil
society advocacy, including representations by the Internet Freedom Foundation
— creates a chilling effect that may discourage responsible disclosure in
favour of non-disclosure or grey-market exploitation of vulnerabilities.
Section 79 of the IT Act already demonstrates that Parliament has legislatively
accepted the principle of conditional immunity, having extended it to
intermediaries; this paper argues that the same logic, subject to appropriately
tailored conditions, should be extended to good-faith security researchers
under Sections 43 and 66. Drawing on comparative approaches, including reform
debates surrounding the U.S. Computer Fraud and Abuse Act and coordinated
vulnerability disclosure obligations under the European Union's Cyber
Resilience Act, the paper proposes a conditional statutory safe harbour for
India — limited to good-faith purpose, minimal necessary testing, no data
exfiltration or persistence, and prompt, coordinated disclosure — as a
legislative amendment to the IT Act. In doing so, the paper contributes a
doctrinal analysis to an area largely unaddressed in Indian legal scholarship,
situating cybersecurity policy and criminal law within a coherent statutory
framework rather than leaving their present tension unresolved.
Keywords: Information Technology Act;
cybersecurity research; coordinated vulnerability disclosure; safe harbour;
Section 43; Section 66; Section 79; CERT-In; Computer Fraud and Abuse Act;
Cyber Resilience Act
Published Paper
Author Details
Authors: VEENAVARDHANI SRegistration ID: 1013660 | Published Paper ID: IJLRA13660Approved ISSN: 2582-6433 | Country: Delhi, India
Article Information
"RETHINKING SECTIONS 43 AND 66 OF THE INFORMATION TECHNOLOGY ACT: THE NEED FOR A STATUTORY SAFE HARBOUR FOR GOOD-FAITH SECURITY RESEARCH"
Authors: VEENAVARDHANI S
- Journal IJLRA
- ISSN 2582-6433
- Volume 3
- Issue 8
About Journal
International Journal for Legal Research and Analysis
- AbbreviationIJLRA
- ISSN2582-6433
- AccessOpen Access
- LicenseCC 4.0
All research articles published in International Journal for Legal Research and Analysis are open access and available to read, download and share, subject to proper citation of the original work.
Disclaimer: The opinions expressed in this publication are those of the authors and do not necessarily reflect the views of International Journal for Legal Research and Analysis.