Published on 23rd June 2025
Authored By: Ridam Sharma
VIPS IPU
Introduction
In an era where digital transformation is reshaping India’s economic and social landscape, cybercrime has emerged as a formidable threat to national security, economic stability, and individual privacy. Cybercrime—defined as criminal activities committed using computers, digital devices, or networks—has witnessed exponential growth across the subcontinent, manifesting in increasingly sophisticated forms of online fraud, data breaches, identity theft, and digital extortion. As India’s internet user base continues to expand at unprecedented rates, exceeding 800 million users, the country faces the dual challenge of fostering digital inclusion while simultaneously protecting its citizens from cyber threats. [1]This article examines India’s evolving response to cybercrime through the lens of its legal framework and enforcement mechanisms, exploring the effectiveness of current legislation, the operational challenges faced by law enforcement agencies, and the collaborative approaches necessary to create a more secure digital ecosystem for all Indians.
Evolution and Types of Cybercrime in India
The proliferation of cybercrime in India can be traced to the early 2000s, coinciding with the rapid expansion of information technology infrastructure and internet penetration across the nation. The typology of cyber offenses has since diversified considerably, presenting multifaceted challenges to legal frameworks originally designed for traditional crime. Unauthorized access and system intrusion, commonly referred to as hacking, constitute fundamental violations under Section 43 and 66 of the Information Technology Act, 2000 (as amended in 2008).[2] Financial malfeasance has evolved from rudimentary phishing attempts to sophisticated digital fraud operations, exemplified by the 2016-2018 surge in ATM skimming cases across metropolitan centers that resulted in estimated losses exceeding ₹200 crore. [3]Interpersonal victimization manifests through cyberstalking and technology-facilitated harassment, as evidenced in the 2022 “Bulli Bai” application case, wherein Muslim women were targeted through digital auction platforms.[4] Organizational vulnerabilities have been exposed through significant data breaches, such as the 2019 compromise of approximately 3.2 million debit cards across multiple banking institutions. The emergence of ransomware as an extortion mechanism became particularly pronounced during the COVID-19 pandemic, with the Indian Computer Emergency Response Team (CERT-In) reporting a 120% increase in ransomware incidents between 2020-2021. Perhaps most concerning from a human rights perspective is the digital facilitation of child sexual exploitation material, with the National Crime Records Bureau documenting a 400% increase in cases registered under the Protection of Children from Sexual Offences Act (POCSO) involving digital elements between 2014-2021. These evolving threat vectors necessitate continuous recalibration of India’s legislative and enforcement approaches to cybersecurity governance.
Legal Framework and Enforcement Challenges in Combating Cybercrime in India
India’s legislative response to digital malfeasance is principally anchored in the Information Technology Act, 2000 (as amended in 2008), which criminalizes a spectrum of cyber-enabled offenses through provisions such as Section 66 (computer-related offenses), Sections 66C and 66D (identity theft and personation), and Section 67 (publication of obscene material).[5] The Indian Computer Emergency Response Team (CERT-In), established under Section 70B of the IT Act, serves as the national nodal agency for cybersecurity incident response, with its authority significantly expanded through the April 2022 Directions requiring mandatory reporting of cybersecurity incidents within six hours and imposing stringent data retention requirements on service providers.[6] Complementing the IT Act, traditional provisions of the Indian Penal Code, 1860, are frequently invoked to prosecute technology-facilitated offenses, including Section 420 (cheating), Section 507 (criminal intimidation), and Section 499 (defamation).[7] The legal framework is further supplemented by the Indian Evidence Act, 1872, which was amended to accommodate electronic evidence under Sections 65A and 65B, though procedural complexities regarding certificate requirements for electronic evidence admissibility persist, as elucidated in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020).[8]While the forthcoming Digital Personal Data Protection Act represents a progressive step toward comprehensive data governance,[9] significant enforcement challenges remain intractable. The transnational character of cybercrime engenders complex jurisdictional conflicts, exemplified by the protracted legal proceedings in obtaining data from messaging platforms in cases involving national security.[10] Conviction rates in cybercrime cases remain disproportionately low—under 20% according to National Crime Records Bureau data—attributable to evidentiary difficulties, procedural delays, and technical complexities in establishing digital chains of custody.[11] This problem is exacerbated by substantial capacity deficits within law enforcement agencies, with only 46% of district police units housing dedicated cybercrime cells possessing requisite forensic capabilities. Furthermore, endemic under-reporting of cybercrime incidents, stemming from limited digital literacy and victim stigmatization,[12] coupled with inconsistent cooperation from intermediaries regarding data preservation and disclosure, continues to undermine enforcement efficacy.
Cybercrime Jurisprudence and International Enforcement Models
The Indian judiciary has played a pivotal role in defining the contours of cyber jurisprudence, with landmark judgments establishing critical precedents for digital rights and liabilities. The Supreme Court’s seminal decision in Shreya Singhal v. Union of India (2015) struck down Section 66A of the IT Act as unconstitutionally vague and overreaching, thereby affirming that restrictions on online speech must meet the constitutional threshold of “reasonable restrictions” under Article 19(2).[13]Similarly, in Manik Taneja v. State of Karnataka (2015), the Karnataka High Court circumscribed the state’s authority to criminalize social media commentary, establishing that criticism of public officials does not prima facie constitute criminal intimidation under Section 66A or Section 507 IPC.[14]The judiciary has also delineated standards for intermediary liability in Christian Louboutin SAS v. Nakul Bajaj (2018), where the Delhi High Court distinguished between active and passive intermediaries for determining safe harbor protections under Section 79 of the IT Act.[15] Enforcement challenges in India become particularly evident when contrasted with international frameworks; the European Union’s General Data Protection Regulation (GDPR) provides a comprehensive governance framework with substantial enforcement teeth, imposing penalties up to €20 million or 4% of global turnover for non-compliance, coupled with a well-resourced network of Data Protection Authorities.[16]The United States has addressed cross-border data access challenges through the Clarifying Lawful Overseas Use of Data (CLOUD) Act of 2018, which enables qualified foreign governments to request data directly from US service providers, bypassing the often protracted Mutual Legal Assistance Treaty processes. Singapore’s Cybersecurity Act 2018 presents another instructive model, establishing a Commissioner of Cybersecurity empowered to designate Critical Information Infrastructure (CII) and impose statutory obligations on CII owners, supported by a robust Singapore Computer Emergency Response Team (SingCERT). These international approaches suggest viable enhancements for India’s cybercrime enforcement architecture, particularly regarding institutional coordination mechanisms like the EU’s Computer Security Incident Response Teams network, public-private threat intelligence sharing frameworks akin to the US Cybersecurity and Infrastructure Security Agency’s Automated Indicator Sharing program,[17] and Singapore’s industry-specific security assessment protocols administered through sectoral regulators. India’s 2023 National Cyber Security Strategy draft acknowledges these global best practices, proposing a more integrated approach to cybercrime prevention, detection, and prosecution.[18]
Toward Cyber Resilience: Recommendations and Conclusion
Recommendations, Way Forward, and Conclusion
The escalating sophistication and prevalence of cybercrime in India necessitates a multifaceted response strategy encompassing legislative reform, institutional capacity building, and enhanced international cooperation. A primary imperative involves the enactment of comprehensive cybersecurity legislation that transcends the reactive paradigm of the IT Act, incorporating proactive security requirements for critical information infrastructure as recommended by the Committee of Experts on Data Protection chaired by Justice B.N. Srikrishna.[19] This legislation should establish sector-specific security standards, mandatory breach notification protocols, and graduated penalties aligned with harm severity.²Concurrently, significant investment in law enforcement capacity is essential, with the Bureau of Police Research and Development’s model cybercrime investigation units requiring implementation across all districts, supported by standardized forensic training curricula and certification mechanisms.[20] The judiciary similarly requires specialized knowledge enhancement, potentially through dedicated cybercrime benches within High Courts and mandatory technical training programs as advocated by the Law Commission of India in its 277th Report.[21] Public awareness represents a crucial preventive dimension, with the National Cyber Security Awareness Month initiative requiring expansion into a sustained, multi-lingual campaign leveraging diverse communication channels, particularly targeting vulnerable demographics. The establishment of fast-track cybercrime courts, similar to those piloted in Maharashtra and Karnataka, merits nationwide implementation to address the current case backlog and procedural delays.[22] Perhaps most critically, India must strengthen its international cooperation frameworks through bilateral agreements modeled on the Budapest Convention on Cybercrime, which India has thus far observed but not ratified. The G20 New Delhi Leaders’ Declaration commitment to enhanced information sharing mechanisms provides an opportune foundation for establishing formalized protocols for expedited electronic evidence transfer and coordinated enforcement actions.[23]
In conclusion, India stands at a critical juncture in its digital evolution, where the promise of technological advancement must be balanced against the proliferating threats in cyberspace. The existing legal and enforcement architecture, while foundational, exhibits substantial gaps particularly regarding jurisdictional limitations, technical capacity constraints, and procedural inefficiencies.⁹ As India’s digital economy expands—projected to reach $1 trillion by 2026—the associated cybersecurity risks necessitate institutional responses commensurate with both the scale and complexity of the threat landscape. The proposed Digital India Act represents an opportunity to recalibrate India’s cyber governance framework, provided it incorporates forward-looking provisions addressing emerging technologies including artificial intelligence, blockchain, and quantum computing. Ultimately, securing India’s digital ecosystem requires not merely legislative amendments or enhanced enforcement capabilities, but a paradigm shift toward proactive security governance integrating technological solutions, policy interventions, and international coordination mechanisms—all functioning within a rights-respecting framework that balances security imperatives with civil liberties and privacy considerations.
References
[1] Internet and Mobile Association of India (IAMAI) & Kantar, Internet in India Report 2023, p. 7
[2] The Information Technology Act, 2000, Sections 43 & 66, as amended by the Information Technology (Amendment) Act, 2008.
[3] Reserve Bank of India (RBI), Report on Trend and Progress of Banking in India 2018, p. 85; also see Business Standard, “ATM frauds on the rise: Skimming and cloning top methods,” Jan 10, 2019.
[4] The Hindu, “Three arrested in ‘Bulli Bai’ app case targeting Muslim women,” Jan 5, 2022.
[5] Information Technology (Amendment) Act, 2008, No. 10, Acts of Parliament, 2009 (India).
[6] Ministry of Electronics and Information Technology, “Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 relating to information security practices, procedure, prevention, response and reporting of cyber incidents for Safe & Trusted Internet,” Notification dated April 28, 2022.
[7] State of Tamil Nadu v. Suhas Katti, 2004 CriLJ 3917 (implementing both IT Act and IPC provisions in a cyberstalking case).
[8]Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1.
[9] Digital Personal Data Protection Bill, 2023 (pending enactment as of May 2025).
[10] Internet Freedom Foundation v. Union of India, Writ Petition (Civil) No. 44 of 2021 (addressing cross-border data access challenges).
[11] National Crime Records Bureau, “Crime in India 2023,” Ministry of Home Affairs, Government of India, pp. 417-425.
[12] Halder, D., & Jaishankar, K. (2022). “Cybercrime victimization in India: Pattern of non-reporting and under-reporting.” International Journal of Cyber Criminology, 16(1), 112-131.
[13] Shreya Singhal v. Union of India, (2015) 5 SCC 1.
[14] Manik Taneja v. State of Karnataka, 2015 SCC OnLine Kar 1692.
[15] Christian Louboutin SAS v. Nakul Bajaj, 2018 SCC OnLine Del 11189.
[16]Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, Articles 83 and 51-59.
[17] Cybersecurity and Infrastructure Security Agency, “Automated Indicator Sharing (AIS),” Technical Implementation Guide, Version 2.0 (2022).[17]
[18] Ministry of Electronics and Information Technology, National Cyber Security Strategy (Draft), Government of India, 2023, pp. 17–22.
[19] Committee of Experts under the Chairmanship of Justice B.N. Srikrishna, “A Free and Fair Digital Economy: Protecting Privacy, Empowering Indians,” (2018), pp. 93-98.
[20] Bureau of Police Research and Development, “Standard Operating Procedures for Investigation of Cybercrimes,” Ministry of Home Affairs, Government of India (2022), pp. 11-18.
[21] Law Commission of India, “277th Report on Cybercrime Investigation and Adjudication,” (2023), pp. 167-174.
[22] Maharashtra Cyber Digital Crime Unit, “Fast-Track Cybercrime Courts: Two-Year Assessment Report,” (2024), pp. 7-12.
[23] G20, “New Delhi Leaders’ Declaration,” September 9-10, 2023, paras. 31-35.
