4.1 The Jurisdiction Challenge in Cyberspace
Cyberspace defies traditional territorial boundaries. An attacker in Romania can target a victim in Mumbai through servers in Singapore, with money routed via Dubai. Which court has jurisdiction? Which police station files the FIR? These questions can make or break your case.
"In cyberspace, the traditional concept of territorial sovereignty is fundamentally challenged. The law must evolve to address crimes that transcend physical boundaries while respecting the principles of comity and due process." Adapted from international cyber law jurisprudence
🌐 The Multi-Jurisdictional Reality
A single cyber offence can involve multiple jurisdictions simultaneously
Key Jurisdictional Concepts
| Principle | Description | Application in Cyber Cases |
|---|---|---|
| Territorial Principle | Jurisdiction where the offence occurs | Where the computer system is accessed or harm suffered |
| Nationality Principle | Jurisdiction over nationals regardless of location | Indian citizen committing cybercrime abroad |
| Effects Doctrine | Jurisdiction where effects are felt | ⭐ Primary basis for Section 75 IT Act |
| Protective Principle | Jurisdiction to protect state interests | Cyber terrorism, critical infrastructure attacks |
| Universal Principle | Jurisdiction for crimes against humanity | CSAM (child sexual abuse material) |
4.2 Section 75: Extraterritorial Application
Section 75 of the IT Act is your primary tool for asserting Indian jurisdiction over cyber offences committed outside India. It extends India's cyber law arm across borders — but with important conditions.
"Subject to the provisions of sub-section (2), the provisions of this Act shall apply also to any offence or contravention committed outside India by any person irrespective of his nationality, if the act or conduct constituting the offence or contravention involves a computer, computer system or computer network located in India."
Breaking Down Section 75
- "Outside India": The physical location of the accused when committing the offence is irrelevant — jurisdiction attaches regardless
- "Irrespective of nationality": Applies to foreigners — a Nigerian, Russian, or American hacker targeting Indian systems falls under Indian jurisdiction
- "Computer located in India": The nexus requirement — there must be a computer, system, or network in India that is involved in the offence
┌─────────────────────────────────────────────────────────────────────┐
│ SECTION 75 EXTRATERRITORIAL JURISDICTION │
└─────────────────────────────────────────────────────────────────────┘
│
▼
┌─────────────────────────────────────┐
│ Was the offence committed OUTSIDE │
│ India (physically)? │
└─────────────────────────────────────┘
│ │
YES NO
│ │
▼ ▼
┌────────────────────┐ ┌────────────────────┐
│ Does the offence │ │ Normal territorial │
│ INVOLVE a computer │ │ jurisdiction under │
│ located IN INDIA? │ │ BNS/BNSS applies │
└────────────────────┘ └────────────────────┘
│ │
YES NO
│ │
▼ ▼
┌──────────────┐ ┌──────────────────────┐
│ SECTION 75 │ │ NO INDIAN │
│ APPLIES │ │ JURISDICTION │
│ │ │ (unless victim is │
│ IT Act │ │ Indian national — │
│ jurisdiction │ │ use BNS nationality │
│ extends to │ │ principle) │
│ offence │ └──────────────────────┘
└──────────────┘
"Computer located in India" includes:
• Victim's device in India
• Indian company's server (even if hosted abroad)
• Indian intermediary's infrastructure
• Cloud services with Indian data center nodes
Key Case: Section 75 in Action
Scenario: A hacker in Eastern Europe targets an Indian bank's server, which is physically located in Mumbai. The hacker extracts customer data.
Analysis: Section 75 applies because: (1) Offence committed outside India; (2) Bank's server (computer system) is located in India; (3) Nationality of hacker irrelevant. Indian police can register FIR and investigate. Extradition may be sought if bilateral treaty exists.
Section 75 Limitations
- Practical Enforcement: Even with jurisdiction, enforcing against foreign nationals requires international cooperation
- Evidence Collection: Data may be on foreign servers — MLAT process required
- Extradition: Dependent on bilateral treaties; many countries don't extradite for cyber offences
- Reciprocity: Other nations may assert similar extraterritorial jurisdiction over Indians
Challenge Section 75 application if prosecution cannot establish the "computer located in India" nexus. If the victim merely accessed a foreign website from India, the foreign server is NOT "located in India" — jurisdiction may not attach for offences against that server.
4.3 Zero FIR & Strategic Forum Selection
Where you file the FIR can determine the trajectory of your case. Zero FIR under BNSS S.173 combined with strategic forum selection is a powerful tool for both victims and counsel. Choose wisely.
Zero FIR: The Complete Framework
Any police station must register an FIR regardless of territorial jurisdiction. The FIR must be transferred to the police station having jurisdiction within 15 days. No police station can refuse to register citing "not our jurisdiction."
┌─────────────────────────────────────────────────────────────────────┐
│ ZERO FIR STRATEGIC FILING │
└─────────────────────────────────────────────────────────────────────┘
STEP 1: Identify ALL potential jurisdictions
─────────────────────────────────────────────
┌─────────────┐ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐
│ Victim's │ │ Accused's │ │ Server │ │ Where │
│ residence │ │ residence │ │ location │ │ money │
│ │ │ (if known) │ │ │ │ went │
└─────────────┘ └─────────────┘ └─────────────┘ └─────────────┘
│ │ │ │
└────────────────┴────────────────┴────────────────┘
│
▼
STEP 2: Evaluate each jurisdiction
───────────────────────────────────
Consider:
• Cyber cell expertise (Metro cities better equipped)
• Court efficiency (disposal rates, pendency)
• Accessibility for victim to attend proceedings
• Prosecution quality in that district
│
▼
STEP 3: File Zero FIR at PREFERRED jurisdiction
────────────────────────────────────────────────
┌──────────────────────────────────────────────────────────┐
│ PRO TIP: File at a CEN (Cyber Economic Narcotics) PS │
│ or dedicated Cyber Crime PS in a metro city even if │
│ your residence is in a smaller town. They have better │
│ technical capability and can transfer to appropriate │
│ jurisdiction if needed. │
└──────────────────────────────────────────────────────────┘
Forum Selection Strategy Matrix
- Advantage: Convenient for victim attendance
- Advantage: "Effects doctrine" — harm suffered here
- Risk: May lack cyber expertise in smaller towns
- Best for: Individual victims, harassment cases
- Advantage: Documentary evidence readily available
- Advantage: Often in metro with good cyber cells
- Risk: May be far from where offence occurred
- Best for: Data breaches, corporate fraud
- Advantage: Bank accounts can be frozen quickly
- Advantage: Easier to trace money trail locally
- Risk: Multiple accounts = multiple jurisdictions
- Best for: Financial fraud, UPI scams
- Advantage: Easier arrest and custody
- Advantage: Search and seizure more practical
- Risk: Often unknown in cyber cases
- Best for: When accused identity is confirmed
⚔️ Prosecution vs Defence: Forum Strategies
🟢 Prosecution Strategy
File in jurisdiction with best-equipped cyber cell (Mumbai, Bangalore, Hyderabad). Argue multiple jurisdictions are proper — effects doctrine allows filing where harm occurred. Use Zero FIR to get the case registered immediately, then let transfer happen to favorable jurisdiction.
🔵 Defence Strategy
Challenge jurisdiction if filed in inconvenient forum. Argue accused's right to fair trial includes accessible forum. File transfer petition to jurisdictionally appropriate court. If FIR filed in multiple places, seek quashing of duplicates citing abuse of process.
For immediate reporting, use the National Cyber Crime Reporting Portal (cybercrime.gov.in) or call 1930. Financial frauds reported within the "golden hour" have higher recovery rates. The portal automatically routes complaints to jurisdictionally appropriate cyber cells.
4.4 MLAT & International Evidence Collection
When evidence or accused persons are located abroad, the Mutual Legal Assistance Treaty (MLAT) framework becomes essential. Understanding this process helps set realistic client expectations and plan investigation strategy.
What is MLAT?
MLATs are bilateral or multilateral treaties enabling countries to cooperate in criminal investigations. India has MLATs with 42+ countries including USA, UK, UAE, Singapore, and most EU nations. Requests flow through the Ministry of Home Affairs (Central Authority).
The MLAT Process
MLAT requests typically take 6-24 months for completion. For USA-based evidence (most Big Tech companies), expect 12-18 months. Set client expectations accordingly. Consider alternative approaches (direct platform cooperation, voluntary disclosure) where available.
Alternative: Direct Platform Cooperation
| Platform | Cooperation Mechanism | Typical Timeline |
|---|---|---|
| Law Enforcement Request System (LERS) | 2-4 weeks (emergency: 24-48 hrs) | |
| Meta (FB/Insta/WA) | Law Enforcement Online Requests | 2-4 weeks (emergency: 24-48 hrs) |
| Microsoft | Digital Crimes Unit portal | 2-4 weeks |
| Twitter/X | Law Enforcement Guidelines portal | 2-6 weeks |
| Indian Platforms | Direct notice under IT Rules 2021 | 72 hours (statutory) |
For emergency preservation (prevent evidence deletion), most platforms offer 90-day preservation requests without formal legal process. Indian law enforcement can request preservation while MLAT/LR is being processed. Always send preservation request immediately upon identifying foreign-hosted evidence.
4.5 Jurisdiction Scenarios & Solutions
Let's apply jurisdictional principles to real-world scenarios. These patterns repeat frequently in cyber practice — master them and you'll handle most jurisdictional challenges confidently.
Scenario 1: Cross-State Phishing Attack
Facts: Victim in Delhi receives phishing email, clicks link, enters bank credentials. Money debited from Delhi bank account, transferred to accounts in Jharkhand and West Bengal. Accused later traced to Jharkhand.
Jurisdictional Analysis:
- Delhi: ✅ Victim's location, where harm occurred, where deception took effect
- Jharkhand: ✅ Accused's location, where money received
- West Bengal: ✅ Where part of proceeds transferred
Recommended Strategy: File Zero FIR at Delhi Cyber Cell (well-equipped, victim accessible). Investigation can proceed in Delhi; accused can be summoned/arrested from Jharkhand. If accused challenges jurisdiction, Delhi courts will likely retain given "effects" are in Delhi.
Scenario 2: International Ransomware Attack
Facts: Indian hospital's servers (located in Mumbai) encrypted by ransomware. Demand for Bitcoin payment sent from email traced to Russian IP. No India-Russia MLAT exists for cyber crimes.
Jurisdictional Analysis:
- Section 75 IT Act: ✅ Applies — computer system (hospital server) located in India
- Indian Jurisdiction: ✅ FIR can be registered; investigation can proceed
- Accused in Russia: ⚠️ Practical enforcement difficult without treaty
Recommended Strategy: Register FIR under S.66 (hacking), S.66F (cyber terrorism if critical infrastructure), S.43 (damage), S.308 BNS (extortion). Focus investigation on: (1) Tracing Bitcoin wallet; (2) Identifying any India-based accomplices; (3) Preserving evidence for future prosecution if accused travels to treaty country.
Scenario 3: Defamatory Post — Foreign Platform
Facts: Defamatory content about Indian businessman posted on US-based social media platform by anonymous account. Platform refuses to disclose user identity without US court order.
Jurisdictional Analysis:
- India: ✅ S.356 BNS (defamation) — effects felt in India
- Takedown: IT Rules 2021 — platform must have India Grievance Officer
- Unmasking: Requires MLAT/LR to USA for subscriber info
Recommended Strategy: (1) File complaint with platform's India Grievance Officer for takedown (72-hr timeline under IT Rules); (2) Register FIR under S.356 BNS against "unknown persons"; (3) Initiate MLAT request for subscriber details; (4) Consider civil suit for injunction simultaneously.
┌─────────────────────────────────────────────────────────────────────┐
│ JURISDICTION QUICK DECISION TREE │
└─────────────────────────────────────────────────────────────────────┘
CYBERCRIME OCCURS
│
┌──────────────────┴──────────────────┐
│ │
Accused in Accused outside
INDIA INDIA
│ │
▼ ▼
┌─────────────────┐ ┌─────────────────────┐
│ File FIR at: │ │ Is computer/system │
│ • Victim's PS │ │ located in INDIA? │
│ • Where money │ └─────────────────────┘
│ transferred │ │ │
│ • Accused's PS │ YES NO
│ • Cyber Cell │ │ │
└─────────────────┘ ▼ ▼
│ ┌──────────┐ ┌────────────┐
│ │ S.75 IT │ │ Limited │
│ │ Act │ │ options: │
│ │ applies │ │ • BNS │
│ │ │ │ nationality│
│ │ File FIR │ │ principle│
│ │ in India │ │ • Civil │
│ └──────────┘ │ remedies │
│ │ └────────────┘
│ │
└────────────────┬───────────────┘
│
▼
┌─────────────────────────────┐
│ ALWAYS: Use Zero FIR if PS │
│ refuses. File at Cyber Cell. │
│ Preserve evidence. Act fast. │
└─────────────────────────────┘
🎯 Key Takeaways
- Section 75 IT Act — extraterritorial jurisdiction if "computer located in India" is involved
- Zero FIR (BNSS S.173) — mandatory registration at any PS; 15-day transfer
- Forum selection is strategic — file where cyber cell is equipped, not just convenient
- Multiple jurisdictions are often valid — "effects doctrine" allows filing where harm occurred
- MLAT takes 6-24 months — use direct platform cooperation where possible
- Preservation requests — send immediately to prevent evidence deletion (90 days)
- Golden 1930 — for financial frauds, report within the "golden hour" for best recovery chances
📝 Part 4 Assessment Quiz
Test your understanding of cyber jurisdiction and territorial reach.
Section 75 IT Act's nexus requirement is that a computer, computer system, or computer network located in India must be involved in the offence. Nationality of accused or victim is not the determining factor.
BNSS Section 173 mandates that Zero FIR must be transferred to the police station having territorial jurisdiction within 15 days.
Section 75 IT Act applies "irrespective of nationality". Since the server (computer system) is located in India (Mumbai), Indian jurisdiction attaches. The Nigerian hacker can be prosecuted under Indian law; enforcement is a separate practical challenge.
The Ministry of Home Affairs (MHA) is India's Central Authority for processing MLAT requests. Requests from Indian agencies and foreign countries are channeled through MHA.
The effects doctrine establishes jurisdiction in the place where the effects (harm/consequences) of an offence are felt. This is the primary basis for Section 75 IT Act and allows victims to file cases where they suffered harm.
Under BNSS S.173, police must register Zero FIR at any police station. They cannot refuse citing territorial jurisdiction. The FIR can be transferred to appropriate jurisdiction within 15 days, but registration cannot be refused.
MLAT requests to the USA (where most Big Tech companies are headquartered) typically take 12-18 months for completion. This is why direct platform cooperation and emergency preservation requests are preferred alternatives where available.
1930 is the National Cyber Crime Helpline. For financial frauds, reporting within the "golden hour" via 1930 or cybercrime.gov.in significantly increases chances of freezing fraudulent accounts and recovering funds.
Most major platforms (Google, Meta, Microsoft) offer 90-day preservation upon law enforcement request. This preserves evidence while formal MLAT/legal process is initiated. Extensions are often possible.
While multiple jurisdictions may be technically valid (Mumbai where victim is, Kolkata where accused and post originated), defence can argue accused's right to fair trial includes access to a convenient forum. A transfer petition under BNSS can seek moving the case to Kolkata where accused resides and evidence (devices) are located.