Cyber Terrorism in India: Section 66F IT Act and Punishment

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law

Cyber terrorism is the gravest offence in the Information Technology Act, 2000. Section 66F punishes conduct carried out with the intent to threaten the unity, integrity, security or sovereignty of India, or with the intent to strike terror in the people of India or in any section of them. The sentence on conviction is imprisonment which may extend to imprisonment for life. Because the section is aimed at the security of the State, the offence is cognizable and non-bailable: the police can register a first information report and arrest a suspect without a warrant, and an accused person must apply for bail instead of claiming it as a right.

That distinction matters in a country where almost every cyber complaint is about money or reputation. A case under Section 66, Section 66C, Section 66D, Section 67 or Section 66E is serious, but it is a different kind of case. Section 66F is reserved for conduct said to be aimed at the country itself — the payment systems of a bank, the network of a hospital, the control systems of a power utility, a government portal, or a telecom backbone. What separates a Section 66F case from an ordinary hacking case is the mental element. The prosecution must prove that the accused acted with the intent the section describes. Proving that a system was accessed is not enough, and litigation under this section is almost always a fight about evidence of intention rather than evidence of access.

What Section 66F of the IT Act 2000 covers

The section describes several kinds of conduct, each of which must be committed with the intent in the opening words. They include denying, or causing the denial of, access to a computer resource to a person who is authorised to access it; attempting to penetrate or access a computer resource without authorisation, or while exceeding the authorisation granted; introducing, or causing the introduction of, a computer contaminant or a computer virus into a computer resource; and accessing a computer resource without authorisation in order to obtain information, data or a database that is restricted for reasons connected with the security of the State or India's foreign relations.

The phrase "computer contaminant" is defined broadly in Section 2 of the Act. It includes any set of computer instructions designed to modify, destroy, record or transmit information within a computer resource, or to deceive or mislead the person in charge of it. Ransomware locked into a government hospital's records system, a flood of traffic directed at a treasury server, or malicious code planted in a utility's control network can all be described in the language of the section, provided the intent element is established.

The Act's other provisions are not displaced, and investigators routinely charge them together. Section 43 creates civil liability for unauthorised access, downloading, copying, damage and disruption, and allows the affected person to claim compensation. Section 66 makes it a criminal offence to do a Section 43 act dishonestly or fraudulently. Section 66C covers identity theft, Section 66D covers cheating by personation using a computer resource, and Section 66E covers violation of privacy. Section 67 and Section 67B deal with obscene material and material depicting children in sexually explicit acts. Where the conduct also amounts to cheating, forgery or intimidation, the Bharatiya Nyaya Sanhita, 2023 applies to acts on or after 1 July 2024 — Section 318 for cheating, Section 319 for cheating by personation, Section 336 for forgery and Section 351 for criminal intimidation. Conduct before that date is governed by the Indian Penal Code.

How the penalties compare

Authorised access, and why the phrase matters

The section turns on authorisation. An employee who uses a login that was given to him has not accessed a system without authorisation, even if he used it for a purpose his employer dislikes; that may be a breach of trust or a disciplinary matter, but it is not Section 66F. An employee who keeps a login after leaving, or who uses another person's credentials, is on very different ground. Whether access was authorised, exceeded, or obtained by deception is often the whole case, and it is the question a court will return to again and again.

How a case reaches the court

The route from a complaint to a charge sheet follows the Bharatiya Nagarik Suraksha Sanhita, 2023 and the Information Technology Act. The sequence below is the ordinary one.

1. Report the incident. Call the national cyber-crime helpline 1930 or file a complaint on cybercrime.gov.in. Where a system is facing a live attack, the first priority is containment and preserving logs, not rebooting servers.
2. Preserve electronic evidence. Log files, server registrations, IP history, email headers, screen captures and the chain of custody of every device matter more than the wording of the written complaint. Electronic records are admissible under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023, which requires a certificate in the prescribed form when the original is not produced.
3. Register the FIR. A cognizable offence is reported at the jurisdictional police station, or to the cyber-crime cell, and an FIR is recorded under Section 173 of the BNSS. In Kolkata this usually means the police station with territorial jurisdiction over where the complainant resides or where the affected system or office is located.
4. If the police refuse. Where a station declines to register a cognizable offence, the complainant may apply to the Magistrate under Section 175(3) of the BNSS for a direction to investigate.
5. Search and seizure. Investigators may search premises and seize devices. Section 105 of the BNSS requires the search and seizure to be recorded through audio-video electronic means, and failure to follow it is a common ground of challenge.
6. Arrest and production. For a cognizable offence the police may arrest without a warrant under Section 35 of the BNSS, and an arrested person must be produced before a Magistrate within twenty-four hours.
7. Forum. Trials in Kolkata are generally conducted by the Chief Metropolitan Magistrate at Bankshall Court, with sessions-triable matters before the City Sessions Court and bail or appeals reaching the Calcutta High Court.

Bail, custody and what the defence must address

Because a Section 66F offence is non-bailable, the first question an accused faces is custody. A bail application is heard by the Sessions Court and, where necessary, by the High Court. The court is not deciding guilt at that stage; it weighs the gravity of the allegation, the evidence linking the accused to the devices and infrastructure, the risk of tampering with electronic evidence, the accused's antecedents and the possibility of flight. Where the accused is a first-time offender and the alleged conduct can be described under Section 66 or Section 43, there is a real argument that the facts do not disclose the intent Section 66F requires at all. Defence work in these matters is heavily technical: whose device it was, whose IP address it was, who held administrative access, and what the forensic image actually shows.

For a person under investigation, the practical steps are to preserve everything rather than delete it, to avoid contacting witnesses or co-accused, to obtain the forensic reports through the investigation, and to engage counsel before giving any statement. Deleting logs or reinstalling an operating system after receiving a notice is the single most damaging thing an accused can do, both because it destroys evidence and because the prosecution will rely on it as conduct showing a guilty mind.

If critical infrastructure is attacked: what an organisation must do

An organisation running anything close to critical infrastructure should move in a fixed order when it suspects an attack. First, contain the intrusion without destroying evidence: isolate the affected segment, block the source traffic and change credentials from a clean machine, but take a forensic image of the affected systems before rebuilding anything. Second, secure the logs, because server logs, authentication records and firewall histories are what an investigator will ask for. Third, notify the authorities: the cyber-crime helpline 1930, the national portal at cybercrime.gov.in, and the jurisdictional police station. Fourth, put proper certificate discipline in place early, because the person who generates the electronic record, or the person in charge of the device, must sign the certificate that accompanies it. Fifth, decide who speaks for the organisation; public statements made before the logs are read are used in evidence, and an organisation should not be seen to be negotiating with the attacker in place of the police. A lawyer who has handled technology offences should be in the room during these first hours, because the decisions taken then are difficult to reverse.

What decides the outcome

Four things usually decide a cyber terrorism case.

• Intent. The prosecution must connect the alleged act to the intent in the section. Where the evidence shows mischief, profit or a private dispute, the offence collapses to a lesser provision.
• Forensic linkage. An IP address identifies a connection, not a person. Custody of the device, the chain of custody and the forensic image determine whether the accused is linked to the act.
• Certification of electronic evidence. A flawed Section 63 BSA certificate can shut crucial records out, and a properly drafted one can carry an otherwise weak case.
• Impact and scale. Disruption of critical infrastructure affects how seriously the case is treated at every stage, including bail.

Common mistakes

Complainants often delay reporting while trying to recover systems, and lose the logs that would have proved the intrusion. Some assume the National Cyber Crime Reporting Portal replaces the FIR; it does not, and a case that needs an investigation and an arrest must still be registered with the police. On the defence side, accused persons talk to investigators informally, surrender devices without any record, or wipe data. Organisations sometimes fail to preserve a proper Section 63 certificate alongside backups, leaving them unable to prove their own records.

When to involve a lawyer

Section 66F is not an offence to handle on instinct. If you are the victim of an attack on critical systems, a lawyer helps you register the case, ensure that electronic evidence is preserved and certified, and follow the investigation so that it does not stall. If you are accused or have received a notice, counsel experienced in technology offences is needed early, before statements, before device handovers and before the bail hearing. Our cyber crime lawyer in Kolkata handles Section 66F matters, and you can see how the local forums work in our West Bengal cyber crime practice.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Cyber Defamation in India: Section 356 BNS Explained
• Voyeurism in India: Section 77 BNS Punishment and Defences
• Violation of Privacy in India: Section 66E IT Act Explained
• Unauthorised Access in India: Section 66 IT Act Explained
• Tampering with Computer Source Documents: Section 65 IT Act
• Stalking Online: Section 78 BNS Punishment and Defences

Cyber crime lawyer in your city · Bank account freeze help · Contact