Tampering with Computer Source Code: Legal Implications under Section 65 IT Act

In the evolving landscape of cyber law in India, few cases have shaped the interpretation of digital identifiers quite like the landmark judgment in Syed Asifuddin and Others v. State of Andhra Pradesh. Decided by the Andhra Pradesh High Court in 2005, this case became a defining moment for understanding how Section 65 of the Information Technology Act, 2000 applies to the manipulation of electronic identifiers in mobile devices. For students of disaster management and industrial safety studying cyber regulations, this case offers critical insights into how Indian courts interpret “computer source code” and the legal consequences of tampering with proprietary digital systems.

The Syed Asifuddin case: background and facts 🔗

The case arose from a complaint filed by Reliance Infocomm Ltd. (now Reliance Communications) against employees of TATA Indicom in Hyderabad. Reliance had launched an attractive scheme called the Dhirubhai Ambani Pioneer Scheme, offering third-generation digital handsets worth approximately Rs. 10,500 for an initial payment of Rs. 3,350, bundled with a three-year service plan. The handsets-specifically Samsung N191 and LG-2030 models-were technologically locked to work exclusively with Reliance’s CDMA network.

The accused employees allegedly contacted Reliance subscribers, offering them better tariff plans if they switched to TATA Indicom. When customers agreed, the TATA Indicom staff would reprogram the handsets by manipulating their Electronic Serial Number (ESN), effectively “unlocking” devices meant exclusively for Reliance’s network. Following a raid at TATA Indicom’s offices in Hyderabad, several employees including Syed Asifuddin were arrested, and reprogrammed handsets were seized as evidence.

Charges filed against the accused 🔗

The FIR registered against the accused invoked multiple legal provisions. These included Section 409 (criminal breach of trust), Section 420 (cheating), and Section 120B (criminal conspiracy) of the Indian Penal Code, 1860. Additionally, the complaint cited Section 65 of the IT Act for tampering with computer source documents and Section 63 of the Copyright Act for copyright infringement.

The accused filed petitions under Section 482 of the Code of Criminal Procedure seeking to quash the FIR, arguing that their actions did not constitute offences under the cited provisions.

Understanding ESN: the technical foundation 🔗

To appreciate the legal significance of this case, it is essential to understand what an Electronic Serial Number actually is. The ESN is a unique 32-bit identifier assigned to CDMA mobile devices during manufacturing. Originally created by the U.S. Federal Communications Commission (FCC) in the early 1980s, ESNs serve as permanent identifiers that authenticate devices on cellular networks.

How ESN works in mobile networks 🔗

Every CDMA handset carries two critical identifiers: the ESN programmed by the manufacturer, and the System Identification Code (SID) assigned by the telecom carrier when a service plan is activated. When a phone connects to the network, these numbers work together to authenticate the device and link it to a specific subscriber account. The ESN is hardcoded into the device and serves purposes including device identification, fraud prevention, and network access authentication.

In the Syed Asifuddin case, the accused manipulated these ESN numbers to make Reliance-exclusive handsets functional on TATA Indicom’s network-a clear case of circumventing technological locks designed to enforce exclusive franchise agreements.

Section 65 of the IT Act: the legal framework 🔗

Section 65 of the Information Technology Act, 2000 addresses tampering with computer source documents. The provision states that anyone who knowingly conceals, destroys, or alters computer source code-when such code is required to be maintained by law-faces imprisonment up to three years, a fine up to Rs. 2,00,000, or both.

Definition of computer source code 🔗

The explanation to Section 65 defines “computer source code” as the listing of programmes, computer commands, design and layout, and programme analysis of computer resources in any form. This broad definition became central to the court’s analysis in the Syed Asifuddin case.

Key elements of the offence 🔗

For an offence under Section 65 to be established, certain elements must be present. First, there must be intentional or knowing conduct-the alteration cannot be accidental. Second, the act must involve concealing, destroying, or altering computer source code. Third, the source code must be one that is required to be maintained by law. Finally, the code must be used for a computer, computer programme, computer system, or computer network.

Court’s interpretation: ESN as source code 🔗

The central question before Justice V.V.S. Rao was whether manipulating the 32-bit ESN in mobile handsets amounted to altering “source code” under Section 65. The court’s analysis proceeded on two fronts: first, whether a mobile phone qualifies as a “computer” under the IT Act, and second, whether the ESN constitutes “computer source code.”

Mobile phones as computers 🔗

The court examined Section 2(1)(i) of the IT Act, which defines a computer as any electronic device that performs logical, arithmetic, and memory functions through electronic impulses. Justice Rao observed that modern mobile handsets contain programmable microprocessors and circuit boards capable of data processing, storage, and communication functions. Based on this analysis, the court concluded that cell phones qualify as computers under the IT Act’s expansive definition.

ESN within the source code definition 🔗

The court then turned to whether the ESN falls within the definition of computer source code. Applying a purposive interpretation, Justice Rao held that the ESN and SID-unique identifiers essential for the phone’s network functionality-constitute computer source code as defined in Section 65. The reasoning was straightforward: these numbers form part of the programming that enables the device to communicate with specific networks and are integral to how the computer (phone) operates.

The court noted that every service provider maintains its own SID code and assigns customer-specific numbers to each instrument. When someone manipulates the ESN, they effectively alter the fundamental programming that determines which network the device can access.

Franchise rights and technological manipulation 🔗

An important dimension of this case was the exclusive franchise agreement between handset manufacturers (Samsung and LG) and Reliance Infocomm. The Samsung N191 and LG-2030 models were designed and distributed exclusively for Reliance’s network under contractual arrangements that restricted their use to Reliance subscribers.

Business impact of ESN tampering 🔗

By reprogramming the ESN, the accused enabled devices meant exclusively for one carrier to function on a competing network. This violated not only technological safeguards but also the underlying business agreements. The court recognized that such tampering had broader implications for the telecommunications industry, where exclusive handset arrangements were common business practices.

Consumer implications 🔗

The Reliance scheme required subscribers to commit to a three-year service period in exchange for subsidized handset pricing. By facilitating early exits through ESN manipulation, the accused undermined the business model that made affordable handsets accessible to consumers. This highlights how source code tampering can have cascading effects on business relationships and consumer welfare.

Judgment and its implications 🔗

The Andhra Pradesh High Court dismissed the petitions seeking to quash the FIR. Justice Rao held that prima facie offences under Section 65 of the IT Act were made out against the accused. The court directed that the investigation report be submitted to the Metropolitan Magistrate within three months.

Key legal principles established 🔗

The judgment established several important principles. First, mobile phones fall within the definition of “computer” under the IT Act due to their data processing capabilities. Second, unique electronic identifiers like ESN and SID qualify as “computer source code” under Section 65. Third, tampering with these identifiers to circumvent technological locks constitutes an offence regardless of whether a specific law mandates their preservation.

On the last point, the court rejected the petitioners’ argument that Section 65 only applies when source code preservation is legally mandated. Justice Rao noted that the legislature used the disjunctive “or” between the phrases regarding code maintenance requirements, indicating that both situations-mandatory and voluntary maintenance-are covered.

Relevance to industrial safety and disaster management 🔗

While this case primarily concerns telecommunications, its principles have broader applications for industrial safety professionals. Modern industrial facilities rely extensively on computerized control systems, programmable logic controllers, and networked devices for safety-critical operations.

Protecting industrial control systems 🔗

The expansive interpretation of “computer” and “source code” in this case suggests that tampering with firmware or unique identifiers in industrial equipment could attract similar legal consequences. Safety managers must recognize that altering programming in safety-critical devices-whether intentionally or through unauthorized modifications-may constitute criminal conduct under the IT Act.

Implications for safety protocols 🔗

Organizations should implement robust access controls and audit trails for any systems that could be classified as computers under the IT Act. This includes not just traditional computers but also smart sensors, networked safety equipment, and industrial control systems with programmable components.

Criticisms and ongoing debates 🔗

The Syed Asifuddin judgment has not been without criticism. Some legal scholars have questioned whether the court’s interpretation stretches the concept of “source code” beyond its technical meaning. Critics argue that an ESN is more accurately described as a unique identifier rather than source code in the traditional programming sense.

The phone unlocking debate 🔗

The case also raises questions about consumer rights and the practice of “phone unlocking” more broadly. In many jurisdictions, consumers have the right to unlock devices they have purchased, particularly after fulfilling contractual obligations. The broad interpretation in this case could potentially criminalize legitimate consumer activities if applied without nuance.

However, it is important to note that the judgment was an interim ruling on whether the FIR should be quashed, not a final determination of guilt. The court specifically observed that whether the allegations could be proven remained a matter of evidence to be determined at trial.

Lessons for professionals 🔗

For students and professionals in disaster management and industrial safety, this case offers several practical takeaways. Understanding the broad scope of cyber law provisions is essential, as the IT Act’s definitions are expansive and can apply to devices and systems not traditionally considered “computers.”

Organizations must ensure that any modifications to electronic equipment-especially safety-critical systems-are properly authorized and documented. Unauthorized tampering with device identifiers or firmware could expose individuals and organizations to criminal liability under Section 65.

Finally, the case underscores the importance of integrating cyber security awareness into industrial safety training. As industrial systems become increasingly connected and computerized, the boundaries between physical safety and cyber security continue to blur.

What do you think? How should courts balance the protection of proprietary digital systems against consumer rights to modify devices they have purchased? As industrial systems become more computerized, what additional safeguards should organizations implement to prevent unauthorized modifications to safety-critical equipment?

References

1. https://legal-wires.com/case-study/case-study-syed-asifuddin-v-state-of-andhra-pradesh/
2. https://indiankanoon.org/doc/273571/
3. https://en.wikipedia.org/wiki/Electronic_serial_number
4. https://www.msab.com/glossary/esn-electronic-serial-number/
5. https://www.legalservicesindia.com/article/439/Offences-&-Penalties-under-the-IT-Act,-2000.html
6. https://cyberblogindia.in/syed-asifuddin-and-others-v-state-of-andhra-pradesh-and-another/