Definition
The unauthorised or fraudulent access to a computer system, network, or data — whether by bypassing security measures, exploiting vulnerabilities, or using stolen credentials — a criminal offence under Section 66 of the Information Technology Act, 2000.
Hacking in the legal sense covers any act of dishonestly or fraudulently accessing a computer system without authorisation — as penalised under Section 66 IT Act (read with Section 43 IT Act). Section 43 IT Act defines the base civil offences: (a) accessing or securing access without permission (Section 43(a)); (b) downloading, copying, or extracting data without permission (Section 43(b)); (c) introducing viruses or computer contaminants (Section 43(c)); (d) damaging or disrupting computer systems (Section 43(d)). When done dishonestly or fraudulently, these become criminal under Section 66 IT Act. More severe hacking against protected government/critical infrastructure systems is punishable under Section 70 IT Act (up to 10 years imprisonment).
Statutory Definition
Section 43(a), Information Technology Act, 2000: 'If any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network — (a) accesses or secures access to such computer, computer system or computer network or computer resource; he shall be liable to pay damages by way of compensation to the person so affected.' Section 66 IT Act: when the above is done dishonestly or fraudulently — criminal liability (imprisonment up to 3 years/fine up to Rs. 5 lakh).
Etymology & Origin
From 'hack' (originally: to cut with rough, irregular strokes; later adopted by computer programmers to mean clever, irregular problem-solving; eventually 'hacker' came to mean both skilled programmers and those who break into systems). The legal sense focuses on the latter — unauthorised intrusion into computer systems.
Full Legal Analysis
Hacking: Unauthorised Entry into Digital Property
Hacking is trespass in the digital world — entering someone’s computer system without authorisation. The consequences range from data theft and financial fraud to espionage, infrastructure disruption, and national security threats. India’s IT Act punishes hacking as a criminal offence — but the rapidly evolving nature of cyber attacks means the law is constantly challenged by new attack methods.
Civil and Criminal Liability for Hacking
(a) Civil liability (Section 43 IT Act): Compensation to affected persons — without requirement of criminal intent (strict liability for civil remedy). Any unauthorised access is actionable civilly regardless of intent. (b) Criminal liability (Section 66 IT Act): Requires dishonesty or fraud — the hacker must have acted with the intent to gain or cause wrongful loss. The distinction from civil Section 43: in criminal prosecution, intention matters; in civil Section 43, the act itself is sufficient. (c) Critical infrastructure (Section 70 IT Act): Unauthorised access to 'protected systems' (critical information infrastructure — power grids, banking systems, defence networks, government databases) carries up to 10 years imprisonment — reflecting the severity of attacks on national critical infrastructure.
Ethical Hacking: The Legal Exception
Ethical hacking (penetration testing) — where a company authorises security professionals to test their systems for vulnerabilities — is not a criminal offence because it is done with the owner's permission. Section 43 IT Act's entire premise is 'without permission' — authorised security testing falls outside this. Companies engaging ethical hackers must ensure proper written authorisation to avoid accidental criminal liability for the tester.
“Digital trespass is as harmful as physical trespass — often more so. A hacker who enters your computer system without permission has crossed the same legal line as someone who enters your home without permission. The law criminalises both; the IT Act ensures that cyber trespass does not go unpunished merely because it leaves no physical evidence.”
This Term in Indian Statutes
Information Technology Act, 2000, 2000
"If any person, dishonestly or fraudulently, does any act referred to in section 43, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both."
Hacking: Section 43 (civil — unauthorised access) + Section 66 (criminal — dishonest/fraudulent access); Section 70 for critical infrastructure attacks (10 years)
