Tampering with Computer Source Documents: Section 65 IT Act

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law

Tampering with computer source documents is a specific and deliberately narrow offence under section 65 of the Information Technology Act, 2000. The section is punishable with imprisonment of up to three years, or a fine of up to two lakh rupees, or both. It is not a general protection for software: it bites only when a person knowingly or intentionally conceals, destroys or alters source code that the law requires to be kept or maintained, or knowingly causes another person to do so.

If your company's source code, build scripts or configuration were deleted, altered or held to ransom, the practical sequence is the same as for most cyber offences. Preserve the technical evidence before it is overwritten, report the incident to the jurisdictional police station or through the National Cyber Crime Reporting Portal at cybercrime.gov.in, and keep the acknowledgement. Where money moved out of an account as part of the same event, call the 1930 helpline and your bank's nodal officer at once. Logs and access trails age badly, so the first day matters more than the first month.

What section 65 of the IT Act actually covers

The provision has two parts, and both must be satisfied. The first is the act itself: concealing, destroying or altering any computer source code used for a computer, computer programme, computer system or computer network. The second, which decides most real cases, is the qualifying clause: the source code must be one that is "required to be kept or maintained by law for the time being in force".

The Explanation to the section defines "computer source code" very widely. It means the listing of programmes, computer commands, design and layout, and programme analysis of a computer resource in any form. That definition is not confined to a text file of programming instructions. Deployment scripts, configuration files, architecture and design documents, and even analytical notes about how a system is built can fall inside it.

So a complainant has to establish two things: that what was altered was source code within this definition, and that a legal obligation existed to keep or maintain it. A defence will attack the second limb just as often as the first.

In practice, tampering is discovered in one of a few ways: a backup or snapshot that no longer matches the live repository; a build pipeline that suddenly fails; an integrity check or checksum mismatch; or the person responsible announcing the act, often as leverage in a dispute. Each route leaves a different evidentiary signature, and the strength of the complaint usually follows the strength of that record rather than the size of the loss.

Who can complain matters less than people assume. Section 65 protects source code as a thing, not authorship, so a company that owns or operates the affected system may be the complainant even if it did not write the code. Where the software is licensed from a third party, the licence terms often decide who leads the complaint and who is bound to cooperate with the investigation.

Why the words are read strictly

Practitioners read "required to be kept or maintained by law" narrowly. Code maintained only under a private contract, with no statutory retention obligation, may not answer section 65 even where deleting it is plainly wrongful. In such cases the prosecution more usually relies on section 66 of the IT Act, which punishes the acts described in section 43 when done dishonestly or fraudulently, with imprisonment up to three years or a fine up to five lakh rupees, or both; on the damages remedy in section 43 itself; or on the general provisions of the Bharatiya Nyaya Sanhita, 2023, such as section 316 on criminal breach of trust and section 336 on forgery of a document or electronic record. Whether a particular code base is one the law required to be kept is a question of fact, and the position continues to develop.

Punishment and the provisions usually charged together

Section 65 is tried by a Magistrate and is usually charged alongside other sections, because the facts that establish source-code tampering rarely stand alone. The table below sets out the provisions a complainant or an accused is most likely to see on the same file.

The overlap matters. If an employee with administrative credentials wipes a repository, the complainant may allege unauthorised access under section 66, misuse of credentials under section 66C, breach of trust under section 316 BNS, and tampering under section 65 IT Act on the same set of facts. Which of those survives scrutiny depends on evidence, not on how many sections are pressed into service.

Step by step: what to do when source code is tampered with

1. Stop the bleeding, do not wipe the machine. Isolate affected systems from the network, but do not reimage, reformat or "clean up" the repository. Volume snapshots, backup versions, commit history and shell history are the evidence.
2. Preserve the technical trail. Export access logs, audit trails, session records, commit histories, device and IP details, and any ransom note or message. Record who handled what and when. For electronic records relied on in court, the certificate requirement in section 63 of the Bharatiya Sakshya Adhiniyam, 2023 must be planned for from the beginning, not reconstructed later.
3. Document the loss. Prepare a short note on what was deleted or altered, when, and who could access it. Attach invoices, downtime records and client communications that show the practical impact.
4. Report to the police. File a written complaint at the jurisdictional police station. Under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 information can also be given by electronic communication, and a cognizable offence can be reported irrespective of the area where it was committed. Obtain a free copy of the FIR.
5. File on the portal. Register the complaint at cybercrime.gov.in and note the acknowledgement number. The portal is useful for tracking and centralised follow-up, but it does not replace a police complaint.
6. Follow the money, if any moved. Where the tampering was paired with a transfer of funds, dial 1930 and immediately notify the bank's nodal officer in writing, with transaction references. Bank liability for unauthorised electronic transactions is governed by the Reserve Bank of India's directions on limiting customer liability, and reporting speed is central to how that liability is fixed.
7. Notify the insurer and the counterparties. Cyber-insurance and professional-indemnity policies usually contain short notice windows. If third-party data was affected, statutory and contractual notification duties may also be triggered.
8. Escalate if the police do not act. If the officer in charge refuses to record the information, section 173 BNSS allows the aggrieved person to send the substance of the information to the Superintendent of Police, and thereafter to apply to the Magistrate; section 175(3) BNSS empowers the Magistrate to order an investigation.

What decides the outcome

Three questions decide how these cases end. The first is whether the code was one the law required to be kept or maintained, because section 65 depends on that. The second is attribution: whether the access trail identifies a person, or only a device, a shared login or a virtual private network. The third is authority: whether the person had lawful access, and whether there was knowledge or intent, which is the difference between a destructive act and a careless one.

The surrounding civil relationship also weighs heavily. Where the parties are an employer and an employee, or two companies in a commercial dispute, courts scrutinise whether the complaint is genuinely criminal or a contractual quarrel dressed as one. Absolute certainty about who did it is rare. What is achievable is a clean, dated, well-preserved evidentiary record, and that record is what a court or a settlement negotiation actually responds to.

Beyond the criminal case, the practical goal is usually twofold: a working record for the prosecution and an order or agreement that stops the other side from using or further damaging what remains. Injunctive relief restraining use or disclosure of the code, and orders for production of records, often move faster than an investigation. Under section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023 a court or an officer in charge of a police station can require production of documents and electronic communications, including communication devices likely to contain digital evidence; section 105 requires that searches and seizures be recorded through audio-video electronic means. Insisting on that recording protects both sides.

Common mistakes

• Reimaging or restoring systems before copying logs, discs and repository history.
• Relying on internal IT staff to produce evidence without recording who collected it and how.
• Waiting for the investigation to conclude before securing electronic evidence certificates under the Bharatiya Sakshya Adhiniyam, 2023.
• Sending the draft complaint and internal investigation notes to the suspected party, thereby disclosing the complainant's theory.
• Treating the police complaint as a substitute for a commercial or civil claim, or the reverse.
• Ignoring contractual notice periods and insurance deadlines while the dispute escalates.

When to involve a lawyer

Section 65 prosecutions turn on two technical questions that are usually argued early: what counts as source code required to be kept by law, and whether the access trail is good enough to attribute the act to a person. A lawyer can help frame the complaint so the evidence actually supports the sections cited, pursue a civil damages claim under section 43 of the IT Act or a commercial remedy in parallel, and, where a client is accused, test the prosecution's evidence before a charge sheet hardens the position.

Where the accused is an employee or a former contractor, the first interview is usually the moment when such cases are lost or won. A casual remark about cleaning up a branch or removing an old build is later read as an admission of intent. An accused person should have advice before that conversation, not after it. For an organisation facing this situation, see our work on cyber crime matters in Kolkata; for a person named as an accused, the relevant pages are criminal defence and bail. You can reach the office through contact.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Voyeurism in India: Section 77 BNS Punishment and Defences
• Violation of Privacy in India: Section 66E IT Act Explained
• Unauthorised Access in India: Section 66 IT Act Explained
• Stalking Online: Section 78 BNS Punishment and Defences
• Sexual Harassment Online: Section 75 BNS and Punishment
• Sending Offensive Messages in India: Section 66A Explained

Cyber crime lawyer in your city · Bank account freeze help · Contact