Protected Systems under the Information Technology Act

A protected system is a computer resource that the appropriate Government formally places under special legal protection because of its connection with critical information infrastructure. Under Section 70 of the Information Technology Act, 2000, designation requires a notification in the Official Gazette; critical importance alone does not automatically confer protected-system status.

Which computer resources qualify?

Section 70(1) permits designation of any computer resource that directly or indirectly affects the facility of Critical Information Infrastructure (CII).

• The explanation to Section 70 defines CII as a computer resource whose incapacitation or destruction would have a debilitating impact on national security, the economy, public health or safety.
• The statutory test therefore concerns the consequences of disruption, rather than merely whether the computer resource belongs to a government organisation.
• The provision can cover resources that indirectly affect critical infrastructure, not only the computer resource constituting that infrastructure itself.

Who designates a protected system, and how?

The appropriate Government, meaning the Central Government or a State Government as applicable under the Act, exercises the designation power. It must declare the qualifying computer resource to be a protected system through a notification in the Official Gazette.

• The notification is the legal instrument conferring protected-system status under Section 70(1).
• Under Section 70(2), the appropriate Government may separately authorise, by an order in writing, the persons permitted to access the notified protected system.
• Designation and access authorisation are distinct steps: the former identifies the protected resource, while the latter identifies those permitted to access it.

What legal protection follows designation?

Section 70(3) makes both securing access and attempting to secure access to a protected system punishable when done in contravention of the section.

• The punishment is imprisonment of either description for a term that may extend to ten years, along with liability to a fine.
• An attempt to obtain access can therefore attract punishment even without successful entry into the system.
• Under Section 70(4), the Central Government must prescribe information-security practices and procedures for protected systems.