Sharing friend’s password without their knowledge? Know the consequences

Author’s Note

Did you know that sharing your friend’s Netflix password without their permission is an offence?

Has is ever occurred to you that you are committing an offence when you share someone’e credentials without their consent?

This goes for all kind of passwords.

This post discusses how it is a crime to share passwords without the consent or permission of the owner or manager of a computer, computer network, or computer system.

Table of Content

1. Is it Theft to share passwords without permission?
2. Internet Theft under IT Act
3. Procedure to claim Compensation
4. Punishment for sharing passwords without permission

Is it Theft to share passwords without permission?

The problem conceptually is as old as time, lending something without the knowledge and/or consent of it’s original owner would mean “Theft”^[1]. But, when it comes to sharing passwords of account holders of any Internet Service Provider (ISP) or Netflix by another person it is called “internet theft” in the cyberspace terminology^[2].

The legislature has embodied Section 43 in the special Act of Information Technology Act, 2000 (IT Act) to protect such theft or hacking of computer systems or computer networks even though it doesn’t use words such as internet theft or hacking. This provision safeguards the rights of an account holder of an Internet Service Provider (ISP) or e-commerce sites by another person.

Due to the special jurisdiction of IT Act, provisions of IPC will not be adjudicated under general criminal laws.^[3]

Internet Theft under IT Act

Many of you might feel the situation is an extreme trivialization of a simple situation but the law upon this is quite direct.

Netflix and other online streaming platforms fall under the special jurisdiction of the IT Act. Though there is no terminology of “Internet theft” implemented under IT Act, Section 43 deals with the essence of it.

Netflix uses the internet to stream movies and TV shows from their servers to the World Wide Web to your ISP’s (Internet Service Provider) network and therefore it falls under the ambit of “computer network” as defined under Section 2 (j) of the IT Act.

Specifically in this situation, Sections 43 (g) and 43 (h) is directly applicable which reads as –

“Penalty and compensation for damage to computer, computer system, etc. -If any person without permission of the owner or any other person who is in charge of a computer, computer system or computer network,-

(g) provides any assistance to any person to facilitate access to a computer, computer system or computer network in contravention of the provisions of this Act, rules or regulations made thereunder;

(h) charges the services availed of by a person to the account of another person by tampering with or manipulating any computer, computer system, or computer network,

Shall be liable to pay damages by way of compensation to the person so affected.”

This provision of the law applies to sharing all kinds of passwords.

Section 43(g) lays down liability on your friend, i.e. any person without permission of owner of computer network or in charge of computer network (in our case Netflix) provides assistance to other person (the third party) to access the account of Netflix in order to contravene the provision of Section 43(h).

Section 43(h) basically protects your right from someone using your services without your permission which you have paid for.

Section 43 (h) provides for three major elements to prove an internet theft.

1. It must have been committed without the permission of the owner / account holder of Netflix.
2. The charges to stream Netflix must be paid by the person other than the offender, even if the person who has been charged has not availed any service.
3. The act must be committed by tampering or manipulating the internet service provider by falsely representing as the account holder of Netflix or using the service of Netflix subscribed by the owner by manipulating the computer network that he is the subscriber.

They shall be liable to pay damages by way of compensation to the person so affected.

Procedure To Claim Compensation

Section 47 of IT Act lays down the adjudication of the quantum of compensation of the above.

While adjudging the quantum of compensation, the adjudicating officer shall have due regard to the following factors, namely:–

(a) the amount of gain of unfair advantage, wherever quantifiable, made as a result of the default;

(b) the amount of loss caused to any person as a result of the default;

(c) the repetitive nature of the default.

Accordingly, the adjudicating officer shall order the compensation amount levied on the accused.

In such cases a complaint shall be made to the Adjudicating Officer instead of the police. To know the procedure on how to file a complaint, you can find here – Learn to file complaint before Adjudicating Officer

Here, you’ll also find out the when should you lodge an FIR and when should you approach the Adjudicating Officer.

Punishment for sharing passwords without permission

Section 43 provides for the remedy in the form of compensation to the victim. But that is not the only remedy under the IT Act for the victim.

According to Section 66 of the IT Act:

“If any person, dishonestly or fraudulently, does any act referred to in Section 43, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both.”

Section 66 has provided another form of remedy for the victims of the acts committed against them under Section 43. The major difference between Section 43 and Section 66 is that;

1. The prerequisite of Section 66 is the existence of mens rea, which could be reflected by the words used in Section 66, i.e., “dishonestly or fraudulently”.

In turn, this prerequisite is not the condition for Section 43. The prerequisite which applies in case of Section 43 has already been discussed above.

2. Section 43 provides for the remedy for the victim in the form of damages to be paid to the person affected by way of compensation by the person committing any contravention under Section 43 (a) to (j).

Whereas, Section 66 provides for the sanction on the person committing the act.

3. Therefore, Section 43 with dishonest and fraudulent intention would provide for punishment which may extend to three years or with fine which may extend to five lakh rupees.

Conclusion

Sharing any computer system’s password without the owner’s account is an offence under the Information Technology Act, 2000.

Edited by Siddhant Pandey

1. Indian Penal Code, 1860, Section 379. ↑
2. Gabrielle Hollingsworth, Internet Theft, Legal Match, https://www.legalmatch.com/law-library/article/internet-theft.html (01:35pm 11 May, 2020). ↑
3. Sharat Babu Digumarti v Government (NCT of Delhi) [(2017) 2 SCC 18]. ↑