Cybercrime Legislation in India: Protecting Women in the Digital Age

When Ritu Kohli picked up the phone in 2001 and heard an obscene caller-one of dozens she would receive over three sleepless days-Indian law had no adequate answer for what was happening to her. A man named Manish Kathuria was impersonating her on an online chat platform, sharing her phone number with strangers and inviting them to call. The police registered the complaint under a general IPC provision that dealt with insulting a woman’s modesty through words or gestures-a law never designed for the internet. That moment exposed a massive gap in India’s legal framework, one that took years of legislative effort to begin addressing. Today, a layered web of laws-anchored by the Information Technology Act, 2000, its 2008 amendments, and provisions from the Indian Penal Code-works to protect women from cybercrime. Understanding how this framework evolved, and where it still falls short, is essential for anyone navigating the digital age in India.

The Ritu Kohli case: a legal wake-up call 🔗

India’s first recorded cyberstalking case unfolded in 2001, when Ritu Kohli reported that someone was using her identity on the chat platform mirc.com, sharing her residential phone number and encouraging strangers to contact her. She received roughly 40 harassing calls from across India and abroad within just three days. Delhi Police traced the IP addresses and arrested Manish Kathuria, charging him under Section 509 of the Indian Penal Code for outraging the modesty of a woman.

The problem was that Section 509 was written for physical, face-to-face interactions-words, gestures, or acts. As legal scholars noted at the time, when the same conduct occurs on the internet, Section 509 has no mention of it. The accused could have walked away with minimal legal consequence. The case sent a clear signal to Indian legislators: a dedicated cyber law framework was urgently needed, one that could account for harassment conducted through screens and servers rather than on street corners.

The IT Act, 2000: India’s foundational cyber law 🔗

The Information Technology Act, 2000, enacted on October 17, 2000, was India’s first comprehensive response to cybercrime and electronic commerce. Before its enactment, traditional laws were simply inadequate to prosecute hackers, protect digital data, or validate online contracts. The IT Act filled this gap by giving legal recognition to electronic records and digital signatures, and by establishing a chapter of offenses and penalties specifically for computer-related crimes.

Chapter XI of the original Act (Sections 65-74) laid out the foundational offense framework. Section 66 addressed hacking-defined as destroying, deleting, or altering information in a computer resource with dishonest intent-with penalties of up to three years’ imprisonment, a fine of up to five lakh rupees, or both. Section 67 criminalized the publication or transmission of obscene material in electronic form, with imprisonment up to five years and a fine of up to one lakh rupees on first conviction. These provisions gave prosecutors some tools to work with, but they were still broad and did not specifically address crimes targeting women.

The 2008 amendment: expanding the scope 🔗

The landmark Information Technology (Amendment) Act, 2008 significantly expanded the IT Act’s scope, largely in response to cases like Ritu Kohli’s and other emerging digital crimes. The amendment introduced six new subsections under Section 66 (66A through 66F), each targeting a specific type of cybercrime.

Section 66C made identity theft a punishable offense. Under this provision, whoever fraudulently or dishonestly uses another person’s electronic signature, password, or unique identification feature faces imprisonment of up to three years and a fine of up to one lakh rupees. This directly addressed impersonation crimes like what Kathuria perpetrated against Ritu Kohli.

Section 66D tackled cheating by personation using computer resources-covering phishing attacks and fraud schemes where someone poses as a trusted entity to extract sensitive information. In 2022, Delhi’s Cyber Crime Cell arrested a gang using this section alongside IPC provisions after they carried out phishing scams targeting individuals’ banking credentials.

Section 66E addressed privacy violations directly: capturing, publishing, or transmitting the image of a person’s private area without consent, under circumstances violating their privacy, became punishable with imprisonment of up to three years and a fine. This was a significant step toward combating non-consensual image sharing-though critics noted that the provision still did not explicitly cover recording of violent acts such as assault.

Section 67A introduced specific penalties for publishing or transmitting sexually explicit material through electronic means. Section 67B addressed child pornography with severe penalties-up to five years for first-time offenses and up to seven years for subsequent convictions.

Section 66A and its fall 🔗

The 2008 amendment also introduced Section 66A, which criminalized sending “grossly offensive” or “menacing” messages through computer resources. While it was intended to address online harassment, the provision was broadly worded and became highly controversial for its potential to suppress legitimate speech. The Supreme Court struck down Section 66A in the landmark Shreya Singhal v. Union of India case in 2015, ruling it unconstitutional for violating the right to freedom of expression. This left a renewed gap in the law’s coverage of online harassment, reinforcing the need for more precisely drafted provisions.

IPC provisions filling the gaps: Sections 354A, 354C, and 354D 🔗

The fall of Section 66A made the criminal law amendments of 2013 all the more critical. Prior to 2013, no law directly dealt with online harassment or cybercrimes specifically targeting women. The Criminal Law (Amendment) Act of 2013 introduced Sections 354A through 354D into the Indian Penal Code, creating a more targeted framework.

Section 354A: sexual harassment 🔗

Section 354A defines sexual harassment broadly. Any man who makes unwelcome physical advances, demands sexual favors, displays pornography against a woman’s will, or makes sexually colored remarks is guilty under this section. The punishment for the more serious categories-unwelcome physical contact and demands for sexual favors-can extend to rigorous imprisonment of up to three years. For sexually colored remarks, the punishment is up to one year. Crucially, courts have interpreted this section to apply even when there is no physical contact between accused and victim, making it applicable to online conduct.

Section 354C: voyeurism 🔗

Section 354C criminalizes watching or capturing images of a woman engaged in a private act without her consent-what is often called voyeurism or, in its digital form, non-consensual intimate imagery. This provision recognizes the privacy rights of women and ensures legal consequences for those who violate them through recordings, screenshots, or hidden cameras. Courts have held that the offense is complete once the accused captures such an image without consent, regardless of whether they intended to outrage the victim’s modesty.

Section 354D: cyberstalking 🔗

Section 354D introduced the offense of stalking into Indian law, explicitly covering cyber activity. It defines stalking as following or contacting a woman, or monitoring her internet and electronic communications, despite clear indications of disinterest. A first-time offender faces imprisonment of up to three years with a fine; subsequent convictions carry up to five years with a fine. This was a landmark shift-for the first time, persistent online monitoring of a woman’s digital life was explicitly criminalized. Data from the National Crime Records Bureau shows a surge in reported stalking cases since the provision was enacted, with Maharashtra and Karnataka among the most affected states, though conviction rates remain concerningly low.

Image morphing: a persistent legal blind spot 🔗

One area where the legal framework continues to struggle is image morphing-the manipulation of a person’s photographs to create false or obscene images. This crime, which disproportionately targets women including public figures, has seen a sharp rise with advances in photo-editing and AI tools. Yet neither the IT Act nor the IPC explicitly defines or criminalizes morphing. Prosecutors must instead file charges under Section 66 or 66E of the IT Act and Sections 354 or 509 of the IPC-provisions designed for different kinds of offenses that can only be stretched so far. This legal ambiguity gives perpetrators room to escape with minimal accountability, and calls for a specific legislative definition and penalty have grown louder as deepfakes become increasingly realistic.

The new criminal laws: BNS 2023 🔗

In 2023, India replaced the colonial-era Indian Penal Code with the Bharatiya Nyaya Sanhita (BNS), which came into effect on July 1, 2024. The BNS retains and in some cases strengthens the protections for women against cybercrime. Section 75 of the BNS corresponds to the old Section 354A on sexual harassment, Section 77 addresses voyeurism, and Section 78 covers cyberstalking-the latter specifically targeting individuals who repeatedly monitor a woman’s online activities despite clear disinterest. The BNS also broadens definitions to more explicitly include digital harassment, and harsher penalties are prescribed for repeat offenders of stalking offenses.

The IT Act, 2000, continues to operate alongside the BNS, and the National Cyber Crime Reporting Portal launched by the Central Government allows citizens to report cybercrimes with a specific focus on crimes against women and children. The government also operates the Cyber Swachhta Kendra for malware detection, while CERT-In functions as the nodal cybersecurity response agency. Platforms are now obligated under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, to take down reported harmful content within 24 hours.

What the law still needs 🔗

Despite two decades of legislative effort, significant gaps remain. The absence of a dedicated provision for image morphing is one. The definition of cyberstalking in the IPC and BNS, while a step forward, still requires judicial interpretation to keep pace with new forms of digital surveillance. The Digital Personal Data Protection Act, 2023 adds a stronger framework for personal data protection, which will eventually supersede some IT Act provisions-but implementation and enforcement at the ground level remain the larger challenge. More than 75% of cyberstalking victims are women, yet a majority of cases go unreported due to social stigma and lack of awareness about legal remedies.

India’s legal framework for cybercrime against women has traveled a long distance from the inadequate response to Ritu Kohli’s 2001 complaint. The IT Act, its amendments, the IPC provisions introduced in 2013, and now the BNS together form a more robust-if still imperfect-shield. The challenge ahead is not just writing better laws, but ensuring that police are trained to apply them, that survivors feel safe enough to come forward, and that courts move fast enough to deliver justice before digital harm compounds into life-altering trauma.

What do you think? Given that image morphing remains undefined in Indian law despite being a rapidly growing crime, should there be a standalone offense for AI-generated or digitally manipulated intimate images? And with conviction rates for cyberstalking remaining low even where the law is clear, is the problem really about legislation-or about enforcement and institutional culture?

References

1. https://en.wikipedia.org/wiki/Information_Technology_Act,_2000
2. https://astrealegal.com/services/legal/civil-law/damages/internet-harassment-cyber-stalking-cyber-harassment-and-cyber/
3. https://www.legalserviceindia.com/legal/article-214-cyber-stalking-challenges-in-regulating-cyberstalking-at-the-cyber-space.html
4. https://thelaw.institute/privacy-and-data-protection/information-technology-act-2000-india-cyber-law/
5. https://www.upguard.com/blog/cybersecurity-regulations-india
6. https://www.infosecawareness.in/concept/cyber-laws-in-india/women
7. https://www.loc.gov/item/global-legal-monitor/2014-08-21/india-possible-amendment-of-it-law-to-address-cybercrimes-against-women/
8. https://www.geeksforgeeks.org/information-technology-act-2000-india/
9. https://lawrato.com/indian-kanoon/ipc/section-354a
10. https://thelawgist.org/sexual-harassment-section-354-abcd/
11. https://www.mondaq.com/india/social-media/1193320/cyberstalking-and-the-indian-jurisprudence
12. https://ijlmh.com/wp-content/uploads/Cyber-Crime-against-Women-in-India-Legal-Challenges-and-Solutions.pdf
13. https://www.mcolegals.in/kb/Cyber_Law-_Series_2-_Issue_3_-_Cybercrimes_under_the_Bhartiya_Nyaya_Sanhita,_2023.pdf
14. https://iclg.com/practice-areas/cybersecurity-laws-and-regulations/india