Foundations of Cyber Law, Offences, Forensics, and Governance

Flashcards providing comprehensive vocabulary coverage of cyber law principles, legislative frameworks, cyber offences, electronic evidence handling, data protection standards, and cyber governance.

Cyber Law

The body of legal principles and rules that govern activities conducted through computers, digital networks, and the internet, regulating behaviour in virtual environments.

Statute

A formal written law enacted by a legislative body, such as a Parliament, that defines rights, obligations, and penalties with binding legal force.

Regulation

Detailed rules or directives issued by administrative or governmental agencies under statutory authority to operationalise and implement statutory provisions.

Information Technology (IT) Act, 2000

The primary legislation in India that provides legal recognition to electronic records, digital signatures, and online transactions, while defining cyber offences and penalties.

Bharatiya Nyaya Sanhita (BNS), 2023

The Indian penal statute that replaced the Indian Penal Code, 1860, effective 1 July 2024, which addresses traditional offences like fraud, cheating, and intimidation when committed via digital means.

Bharatiya Sakshya Adhiniyam (BSA), 2023

The Indian law of evidence that replaced the Indian Evidence Act, 1872, effective 1 July 2024, providing the legal framework for the admissibility and evaluation of electronic records in court.

Section 63 of BSA, 2023

The statutory provision (corresponding to former Section 65B of the Indian Evidence Act, 1872) governing the admissibility of electronic records in court, which mandates certificate requirements as clarified in Arjun Panditrao Khotkar vs Kailash Kushanrao Gorantyal (2020).

Section 43A of the IT Act, 2000

A provision introduced by the 2008 amendments providing compensation for failure by a body corporate to protect sensitive personal data.

Section 66A of the IT Act, 2000

A provision penalising online speech that was struck down as unconstitutional by the Supreme Court of India in Shreya Singhal vs Union of India (2015) and is no longer valid law.

Section 66C of the IT Act, 2000

A statutory provision of the Information Technology Act that specifically defines and penalises identity theft using computer resources.

Section 66D of the IT Act, 2000

A statutory provision of the Information Technology Act that penalises cheating by impersonation using computer resources.

Section 66F of the IT Act, 2000

A provision introduced in the 2008 amendments that defines and prescribes punishment for cyber terrorism.

Digital Signature

A secure technological method used to verify the identity of the signer and ensure that the content of an electronic document has not been altered after signing.

Certifying Authority

An entity licensed and regulated under the IT Act, 2000 to issue digital signature certificates that link a signature to a specific individual or entity.

Intermediary

An entity that facilitates digital communication and content sharing, such as an internet service provider or online platform, which may receive conditional liability protections.

Jurisdiction in Cyber Law

The legal authority of a court to hear and decide a case, which in cyberspace requires flexible assessment of virtual actions, server locations, party residences, and where harmful effects are felt.

Territorial Principle

A foundational legal principle stating that a country has the authority to regulate and control events occurring within its geographical boundaries.

Cross-Border Cyber Offence

A cybercrime in which elements such as perpetrators, data, transmission infrastructure, or victims span across multiple nations or jurisdictions.

Hacking

The act of gaining unauthorized access to a computer system, network, or digital device to view, alter, disrupt, or steal data without the owner's permission.

Ethical Hacking

Authorized activities carried out with permission to test, identify, and correct system security weaknesses as a preventive cybersecurity measure.

Phishing

A deceptive technique where an offender poses as a trusted entity to manipulate victims into voluntarily revealing sensitive details such as login credentials and financial information.

Identity Theft

The unauthorized use of another individual's personal information or digital credentials without consent to carry out transactions or actions in their name.

Cyberstalking

The repeated, persistent, and unwanted monitoring, tracking, or harassment of an individual through digital communication platforms that causes emotional distress or fear.

Denial of Service (DoS) Attack

A cyber offence that attempts to make a computer system, network, or online service unavailable to legitimate users by overwhelming it with excessive requests.

Distributed Denial of Service (DDoS) Attack

An advanced DoS attack launched from multiple remotely controlled systems simultaneously to flood a single target system with traffic and disrupt operations.

Malware

Software specifically designed with harmful intent to damage, disrupt, or gain unauthorized access to computer systems and data.

Virus

A type of malware that attaches itself to a legitimate file or program and requires user action (such as opening the file) to execute, replicate, and spread.

Worm

A self-replicating malware program that operates independently and spreads automatically across networks by exploiting vulnerabilities without requiring user action.

Trojan

A malicious program disguised as legitimate, useful software that performs unauthorized actions and creates backdoors once installed, without replicating itself.

Ransomware

A specific type of malware that restricts access to a system or encrypts files and demands a financial payment in exchange for restoring access.

National Cyber Crime Helpline (1930)

A round-the-clock dedicated telephone helpline in India that provides immediate assistance to victims of financial cyber fraud and other cyber offences.

Personal Data

Any information that relates to an identified or identifiable individual, either directly or when combined with other data.

Sensitive Personal Data

A subcategory of personal data involving private aspects (such as financial or identity details) that requires higher safeguards due to its significant potential to cause harm if misused.

Data Minimisation

A core privacy principle requiring that organisations collect and process only the minimum amount of personal data necessary for a specific, lawful purpose.

Data Breach

A security incident where personal or sensitive information is accessed, disclosed, altered, or lost without proper authorization.

Digital Personal Data Protection Act, 2023 (DPDPA)

India's dedicated data protection legislation enacted on 11 August 2023, governing the processing, rights, and compliance requirements regarding digital personal data.

Data Principal

The term used under the DPDPA, 2023 to designate the individual to whom personal data relates.

Data Fiduciary

The entity or individual under the DPDPA, 2023 that determines the purpose and means of processing personal data and is responsible for statutory compliance.

Data Protection Board of India (DPBI)

The regulatory authority established under the DPDPA, 2023 to adjudicate non-compliance complaints, conduct inquiries, and impose monetary penalties.

Data Encryption

The technical process of converting readable information into an unreadable, coded format that can only be accessed using an authorized decryption key.

Access Control

The security mechanism of defining, regulating, and restricting permissions regarding who can view, modify, or use specific data and resources within a system.

Authentication

The process of verifying the claimed identity of an individual, system, or digital record before granting access permissions.

Data Portability

The right of a data subject to obtain their personal data in a format that can be easily transferred to another service provider or system.

Data Backup

The process of creating and maintaining duplicate copies of data in separate locations to safeguard against loss, corruption, or cyber threats.

Data Recovery

The process of restoring lost, corrupted, or compromised information from backup copies back to a usable operational state.

Electronic Evidence

Information of evidentiary value stored or transmitted in digital form (including emails, system logs, and files) used to establish facts in legal proceedings.

Volatile Data

Temporary digital evidence stored in system memory that can easily disappear or be altered when a device is powered off or transitions between states.

Non-Volatile Data

Digital data stored in secondary storage media that remains intact and accessible even when the computing system is powered off.

Chain of Custody

A continuous, documented chronological log recording every individual who collected, transferred, stored, and examined digital evidence to ensure its integrity and admissibility.

Digital Forensics

The scientific discipline of identifying, acquiring, preserving, analyzing, and presenting digital evidence from electronic sources in a legally admissible manner.

Data Acquisition

The forensic procedure of retrieving and duplicating data from storage media without altering the original evidence, often using bit-stream imaging.

Timeline Analysis

A forensic examination technique that reconstructs digital events into a chronological order to trace activity patterns and sequence of actions.

CERT-In

The Indian Computer Emergency Response Team, operating under the Ministry of Electronics and Information Technology as the national agency for cybersecurity incident response and guidance.

CERT-In Directions, 2022

Directives issued under Section 70B of the IT Act requiring organizations to report cyber incidents within 6 hours, retain ICT logs for 180 days within India, and synchronize system clocks to NTP servers.

Cyber Governance

The structured framework of rules, organizational policies, oversight, and practices through which an entity manages and protects digital systems, technology, and information.

Acceptable Use Policy (AUP)

A formal organizational policy that defines permitted and prohibited actions for users when accessing enterprise networks, computing devices, and digital systems.

Change Management

A structured governance process for planning, testing, authorizing, implementing, and reviewing modifications in digital infrastructure and software to prevent disruptions and security gaps.

Software Updates

Modifications applied to software applications and operating systems to correct errors, optimize performance, and patch security vulnerabilities.

Ethics in Cyberspace

The moral principles and behavioral standards regarding privacy, honesty, fairness, and accountability that govern human conduct in digital and virtual spaces.

Internet of Things (IoT)

A network of physical devices embedded with sensors, software, and network connectivity that collect, communicate, and exchange data over digital systems.