Login
OR
Don't worry. We'll fix this for you!
The Information Technology Act 2000 (IT Act 2000) is a landmark legislation in India that provides legal recognition to electronic transactions and aims to curb cybercrimes. Among its many provisions, it defines and penalizes various computer offences, which are unlawful acts involving computers and digital data.
This chapter focuses on understanding hacking, one of the most common and serious computer offences under the IT Act. To fully grasp what hacking means legally, we first need to understand what the law considers a computer, what constitutes computer access, and how access can be authorized or unauthorized. This foundational knowledge helps us appreciate the legal boundaries and consequences of hacking.
By the end of this chapter, you will be able to identify hacking activities, understand their legal implications, and differentiate them from legitimate computer use.
Before we discuss hacking, it is essential to understand what the law means by a computer. The IT Act 2000 defines a computer broadly to include both hardware and software components.
Hardware refers to the physical parts of a computer system - the tangible devices you can touch. Examples include the Central Processing Unit (CPU), keyboard, mouse, monitor, printer, and storage devices like hard drives.
Software means the programs and operating systems that run on the hardware. This includes the operating system (like Windows or Linux), application software (like word processors or browsers), and any other programs that instruct the hardware what to do.
Thus, legally, a computer is not just the physical machine but also the software that enables it to function.
Once we know what a computer is, the next step is to understand what it means to access a computer. Access refers to the ability to use or interact with a computer system or its data.
Access can happen in two main ways:
Access can be either authorized or unauthorized. Authorized access means permission has been granted by the owner or administrator of the computer system. Unauthorized access means no such permission exists.
graph TD A[Computer Access] --> B[Physical Access] A --> C[Remote Access] B --> D[Authorized] B --> E[Unauthorized] C --> F[Authorized] C --> G[Unauthorized]
Unauthorized access occurs when a person accesses a computer or computer system without permission or exceeds the permission granted.
For example, if a student logs into their own college portal, that is authorized access. But if the same student tries to enter the principal's private records without permission, that is unauthorized access.
Unauthorized access is a key element in many cybercrimes, including hacking.
| Aspect | Authorized Access | Unauthorized Access |
|---|---|---|
| Permission | Explicit or implicit permission granted | No permission or exceeded granted rights |
| Example | Employee logging into company system | Hacker breaking into company system |
| Legal Status | Legal and permitted | Illegal under IT Act 2000 |
Now that we understand unauthorized access, we can define hacking under the IT Act 2000.
Hacking is the act of gaining unauthorized access to a computer system or network by bypassing security mechanisms, often with the intent to steal, modify, or destroy data, or disrupt services.
The key elements of hacking include:
Hacking is a criminal offence under sections 66 and 66F of the IT Act 2000, with severe penalties.
graph TD A[Start: Attempt to Access Computer] --> B{Is Access Authorized?} B -- No --> C[Bypass Security Measures] C --> D{Intent?} D -- Malicious --> E[Data Theft, Damage or Disruption] D -- No Malicious Intent --> F[Possible Minor Offence or No Offence] E --> G[Hacking Confirmed] B -- Yes --> H[Authorized Access - No Hacking]Two important concepts related to hacking are password cracking and access codes.
Password cracking refers to methods used to discover or bypass passwords protecting computer systems. Common techniques include:
Access codes are any secret codes, passwords, or digital keys that allow access to a computer system. Misusing or stealing access codes is illegal and considered part of hacking.
| Password Cracking Technique | Description | Legal Implication |
|---|---|---|
| Brute Force | Systematically trying all possible passwords | Illegal if done without permission; considered hacking |
| Dictionary Attack | Using a list of common words/passwords to guess | Illegal without authorization; hacking offence |
| Phishing | Deceptive methods to obtain passwords from users | Illegal; also punishable under IT Act and other laws |
Hacking can lead to system disruption, which means causing damage, denial of service, or malfunctioning of computer systems. This can affect businesses, government services, or individuals.
Under the IT Act 2000, system disruption caused by hacking is a serious offence, attracting heavy penalties including imprisonment and fines.
Criminal liability arises when a person knowingly and intentionally commits hacking or related offences such as unauthorized access, password cracking, or system disruption. The law holds such persons responsible for the damage caused.
Ravi, an employee, logs into his company's database using his assigned credentials. Later, he accesses a confidential folder meant only for managers without permission. Is this authorized or unauthorized access under the IT Act 2000?
Step 1: Ravi has permission to access the company database using his credentials - this is authorized access.
Step 2: However, accessing the confidential folder without managerial permission exceeds his authorized rights.
Step 3: Therefore, accessing the confidential folder is unauthorized access under the IT Act.
Answer: Ravi's access to the confidential folder is unauthorized and may be punishable under the IT Act 2000.
An attacker uses software to bypass the password protection of an online banking system and transfers money without the account holder's consent. Does this qualify as hacking under the IT Act 2000?
Step 1: The attacker gains access without permission by bypassing password protection - this is unauthorized access.
Step 2: The act of bypassing security measures (password) fits the hacking definition.
Step 3: The attacker's intent is malicious - to steal money.
Step 4: Therefore, this is a clear case of hacking under the IT Act 2000.
Answer: The attacker is guilty of hacking and liable for criminal prosecution.
Classify the following scenarios as authorized or unauthorized access:
Step 1: Scenario 1: Student uses own credentials - authorized access.
Step 2: Scenario 2: Employee accesses files without permission - unauthorized access.
Step 3: Scenario 3: Hacker guesses password and accesses system - unauthorized access and hacking.
Answer: 1) Authorized, 2) Unauthorized, 3) Unauthorized (Hacking).
A hacker injects malware into a hospital's computer system, causing it to crash and preventing doctors from accessing patient records for several hours. Which sections of the IT Act 2000 apply, and what are the consequences?
Step 1: Injecting malware and causing system crash is unauthorized access with intent to disrupt.
Step 2: This falls under system disruption offences under sections 43 and 66 of the IT Act.
Step 3: The hacker is liable for criminal prosecution, including imprisonment and fines.
Answer: Sections 43 and 66 apply; the hacker faces severe penalties for system disruption and hacking.
Rahul uses a software tool to crack the password of a competitor's website and steals confidential business data. Analyze Rahul's criminal liability under the IT Act 2000.
Step 1: Using software to crack password is unauthorized access and password cracking.
Step 2: Stealing confidential data shows malicious intent.
Step 3: Rahul's actions constitute hacking under section 66 and data theft under section 43.
Step 4: He is criminally liable with penalties including imprisonment and fines.
Answer: Rahul is guilty of hacking and data theft under IT Act 2000 and liable for criminal prosecution.
When to use: When distinguishing hacking from legitimate computer use.
When to use: While revising definitions and legal processes.
When to use: When preparing for scenario-based questions.
When to use: During conceptual understanding and exam questions.
When to use: While solving multiple-choice questions under time constraints.
Progress tracking is paywalled — subscribe to mark subtopics as understood and save your streak.
Go to practice →
Your Score
Your Rank
| Rank | Name | Score |
|---|