Part I — Foundations and Principles

Foundations of Cyberethics

Cyberspace is not a single technology but a living mesh of networks, devices, software, and control systems that now underpin everything from public health and payments to education, energy, and critical national infrastructure. Within this environment, routine choices about identity, logging, encryption, telemetry, and disclosure can profoundly shape privacy, safety, markets, and democratic participation, often affecting people who never had a realistic opportunity to understand or negotiate the risks. This playbook starts from that reality and sets out a disciplined way to align what should be done (ethics), what must be done (law), and what is usually done in practice (policy), so day‑to‑day engineering and governance protect people by design and not by accident.

At its core, the analysis uses three anchors. First, the triad of ethics–law–policy is positioned as a practical architecture: ethics supplies direction, law provides enforceable guardrails and remedies, and policy operationalises both through roles, processes, and technical controls. Second, the relationship between privacy and security is presented as overlapping but not identical aims: privacy centres on individual control over information life‑cycles; security centres on keeping systems and data protected against unauthorised access, alteration, disclosure, and disruption; and the overlap is where trust is either made or lost. Third, established norms—the Internet Architecture Board’s unacceptable activities[i] and the Ten Commandments of Computer Ethics[ii]—are treated as design‑time guidance, not wall art, and are woven into concrete choices about least privilege, patching, logging, key management, vulnerability disclosure, and breach notification.

Two U.S. anchors—the Morris Worm prosecution[iii] and the Lori Drew case[iv] are retained to show, respectively, how small acts can propagate into large harms at Internet scale, and how platform deception that foreseeably causes severe harm raises limits‑of‑law questions that cannot be answered by terms of service alone. Indian scenarios are incorporated to situate the same ethical problems within the Information Technology Act’s offence and enforcement framework, the Supreme Court’s speech (Shreya Singhal[v]) and privacy (Puttaswamy[vi]) guardrails, CERT‑In’s incident‑response role and reporting expectations, the Digital Personal Data Protection Act[vii]’s consent‑centric baseline, and the intermediary‑due‑diligence regime, alongside practical case studies (for example, Suhas Katti[viii], “Sulli Deals,” and “Bulli Bai[ix]”) that demonstrate gendered online harms and the operational importance of platform cooperation and timely takedowns.

The audience is deliberately broad. Legal counsel will find a translation of doctrine into artefacts of proof and remedy. Policy owners and risk managers will find decision rubrics that are short enough to use and strong enough to defend. Engineers and operators will find patterns for secure‑by‑design and privacy‑by‑default implementation that do not break under load. Executives and board members will find a strategic vocabulary for resilience that treats transparency as a capability, not a liability. Students and educators will find accessible scaffolding—the IAB list [i] and the Ten Commandments[ii]—tied to concrete practices rather than abstract ideals. Across all roles, the aim is one habit: to treat ethics, policy, and law as a single system that makes responsible behaviour the path of least resistance.

Practically, the introduction also previews how the document should be read. Foundations present the ethics–policy–law triad and the privacy–security relationship; cross‑cutting issues frame recurring dilemmas and role conflicts; domain chapters show how those dilemmas appear in networks, embedded systems, health care, finance, cloud, blockchain, IoT, AI, intelligence, biometrics, and enterprise life; and the legal section converts the “should” into “must” by mapping offences, procedures, sector statutes, and institutional roles to controls, evidence, and remedies. The case anchors and Indian scenarios are not detours; they are the proof points that keep the guidance honest. The result is a playbook designed to travel—from classroom to control room, from board pack to breach call—without losing coherence or moral clarity.

Ethics, policy, and law: should, usually, must

Ethics articulates what should be done, law codifies a subset of those expectations into duties that must be followed, and policy translates both into rules and controls that are usually followed in day‑to‑day operations, aligning aspiration, enforcement, and routine practice in one governance system.

In practice, ethics provides direction, law supplies enforceable limits and remedies, and policy operationalises both through roles, processes, and technical measures—authentication, least privilege, logging, encryption, disclosure—so ordinary engineering choices reflect shared obligations rather than convenience.

The three‑circle Venn below captures “Ethics (should), Policy (usually), Law (must),” with overlaps labelled for codified moral duties, operational mandates, organisational values, and a central, aligned governance zone.

As the Part I Venn illustrates, privacy and security overlap without becoming identical, which is why proportionality and purpose limitation matter whenever telemetry expands.

FIGURE 1.1 The relationship between ethics, policy, and law.

This alignment matters because ethics without policy does not scale, policy without law can falter under pressure, and law without ethical support can yield formal compliance without substantive protection for people and systems. (see Figure 1.1 above) In Part II the same design discipline is applied to cross‑cutting dilemmas and domain contexts where the privacy–security tension is most acute.

Privacy versus security: difference and common ground

Privacy centres on a person’s authority to control the collection, use, disclosure, retention, and downstream flow of information about them, while security protects information and systems against unauthorised access, alteration, disclosure, or disruption to preserve confidentiality, integrity, and availability.

These aims reinforce each other but can diverge when added monitoring, logging, or retention enhances protection while intruding on autonomy, which is why proportionality, data minimisation, purpose limitation, and transparency are critical to reconcile protection with control in live operations.

The Venn below presents distinctions and shared aims: privacy foregrounds control and ethics of handling personal data, security foregrounds defence against misuse or disruption, and the overlap emphasises that both sustain trust and that failures in either undermine the other.

FIGURE 1.2 Differences between privacy and security.

A simple way to remember the split is that privacy asks who decides and why, and security asks how to keep agreed decisions effective under benign and hostile conditions. (see Figure 1.2 above)

Principles into practice: accepted norms that guide decisions

Normative touchstones only matter when they shape concrete choices about identity, privilege, logging, patching cadence, encryption, key lifecycles, vulnerability disclosure processes, and breach notification timing, documentation, and scope.

Ethically mature teams anticipate harm, choose safer alternatives, document reasons, and remediate with transparency that protects stakeholders while building organisational memory, thereby aligning engineering quality with moral responsibility.

Internet Architecture Board activities deemed unethical[x]

1. Activities that seek unauthorised access to Internet resources.
2. Activities that disrupt intended use of the Internet.
3. Activities that waste resources, whether people, capacity, or computing.
4. Activities that destroy the integrity of computer‑based information.
5. Activities that compromise the privacy of users.

Ten Commandments of Computer Ethics[xi]

1. A computer shall not be used to harm other people.
2. One must not interfere with other people’s computer work.
3. It is unethical to snoop around in other people’s computer files.
4. A computer must not be used for stealing.
5. A computer must not be used for bearing false witness.
6. It is unethical to copy or use proprietary software without permission or paying for it.
7. It is unethical to access an individual’s computer resources without authorisation.
8. It is unethical to appropriate other people’s intellectual output.
9. When writing a programme or designing a system, one must think about the social consequences.
10. A computer shall always be used in ways that ensure consideration and respect for fellow humans.

The next part applies these foundations to recurring dilemmas and to sector contexts where stakes, constraints, and trade‑offs are clearest.

Part II — Practice and Domains

Case anchor 1 (U.S.): the Morris Worm prosecution[xii]

The Morris Worm prosecution under the Computer Fraud and Abuse Act (CFAA) is widely treated as a turning point that demonstrated how a single code defect and ill‑judged experiment could propagate quickly and impose real operational and economic harms, catalysing the growth of network security as a serious engineering discipline.

Its enduring lesson is that “benign intent” does not neutralise foreseeable harm at Internet scale and that secure‑by‑design and test discipline are ethical as well as technical duties when third parties bear the risk of failure.

Case anchor 2 (U.S.): United States v. Lori Drew[xiii]

United States v. Lori Drew arose from the creation of a fictitious social‑media profile used to manipulate and humiliate a minor who later died by suicide, raising difficult questions about the fit between platform terms, intent, and federal anti‑hacking statutes and ultimately prompting sharper debate over proportionality and the limits of criminal law for platform‑rule violations.

The practical lesson is that deception which foreseeably inflicts severe emotional harm can cross ethical and legal boundaries even when the immediate acts are framed as “rule breaking” rather than “hacking,” underscoring the need for calibrated rules, education, and early‑warning interventions around teen safety online.

Indian statutory baselines and institutions

India’s Information Technology Act, 2000[xiv] (IT Act) is the primary statute governing electronic records, digital signatures, cybercrime, and powers to investigate and remedy offences, and it applies nationwide with extraterritorial reach where Indian systems are implicated.

Significant 2008 amendments added new offences and powers, including Sections 66 series for unauthorised acts, Section 69 for interception and decryption powers, and provisions addressing obscenity, child sexual abuse material, and cyber‑terrorism.

The Spreme Court in Shreya Singhal v. Union of India (2015)^[v] struck down Section 66A (offensive messages) as unconstitutional for vagueness, overbreadth, and chilling effects on speech, while reading down intermediary liability under Section 79 and upholding targeted website‑blocking under Section 69A with safeguards, thereby recalibrating the Act’s free‑speech interface.

Organisationally, the Indian Computer Emergency Response Team (CERT‑In) is designated under Section 70B^[xiv] as the national nodal agency for incident response, advisories, coordination, and mandatory reporting directions, including 2022 requirements for rapid incident reporting and log retention to strengthen collective defence.

The Digital Personal Data Protection Act, 2023 (DPDP Act)^[vii] establishes consent‑centric duties for “data fiduciaries,” individual rights (access, correction, erasure, grievance), and a Data Protection Board for enforcement, with scope for specified exemptions and application to processing linked to the Indian market, moving the privacy baseline closer to a comprehensive data‑protection model.

In parallel, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended in 2023[xv], impose due‑diligence obligations on intermediaries, significant social‑media platforms, and online‑gaming intermediaries, with risks to safe‑harbour protection if obligations are not met, especially in relation to specified unlawful or State‑identified false content.

Indian case anchors: cyberstalking and gendered online harassment

In “State of Tamil Nadu v. Suhas Katti (2004)”, a Metropolitan Magistrate’s Court at Egmore delivered one of India’s earliest convictions for online harassment and obscene postings, applying Section 67 of the IT Act alongside Indian Penal Code provisions, which established an enforcement pathway for cyberstalking and reputational harm via online for a ^[viii].

The case demonstrated practical tracing, chargesheeting, and concurrent sentencing for digital harassment, and it has been cited repeatedly as a precedent for addressing misogynistic and defamatory campaigns online through combined statutory tools.

Gendered targeting escalated with “Sulli Deals” (2021) and “Bulli Bai” (2022)^[ix], where images of Muslim women were scraped and profiled for a fake “auction” via apps hosted on GitHub, triggering police investigations, arrests, and bail proceedings across multiple jurisdictions with charges under the IT Act and the Penal Code, and spotlighting platform responsibilities and due diligence under the 2021 Rules.

These incidents illustrate how cyberethics failures—dehumanisation, privacy invasion, and targeted intimidation—translate into criminal violations and due‑diligence breaches, requiring coordinated takedowns, evidence preservation, and victim support at speed.

Mapping the U.S. and India: shared aims, different instruments

Both legal systems criminalise unauthorised access and harmful content while building sectoral and cross‑cutting regimes for privacy and security, but the instruments differ in shape, with the United States relying on a patchwork of sector laws and cooperation statutes[xvi], and India combining an omnibus IT Act with rules for intermediaries and a new, horizontal data‑protection statute[xvii].

Institutionally, the United States leans on sector regulators and information‑sharing frameworks, while India vests incident‑coordination and advisories in CERT‑In with time‑bound reporting and logging directives, showing distinct but convergent approaches to operational governance and collective defence.

Bridging the seams: coherence across sections and disciplines

To keep the manuscript coherent, each normative or legal section benefits from a backward‑link summarising the rationale just covered and a forward‑link signalling how the next measures operationalise that rationale, so the reader experiences a single staircase rather than adjacent essays.

For example, the privacy–security Venn should be referenced in the policy and law sections to show how proportionality and purpose limitation are embedded via consent, default safeguards, incident playbooks, and auditing tools that track real decisions rather than slogans.

Operationalising values: controls, playbooks, and evidence

Programmes translate values into secure‑by‑design architecture[xviii], privacy‑by‑default [xix]stewardship, role‑based access and multi‑factor authentication, encryption and key management, vulnerability disclosure and breach‑notification playbooks, third‑party risk contracts, and routine exercises so that protection does not depend on heroics.

A practical decision rubric—purpose, permission, people, protection, publicity, and patch‑through—helps decide if an action is necessary and proportionate, has a lawful basis, is adequately controlled, can be explained publicly, and will result in learning that alters future design and practice.

Educational scaffolding: sources of cyberethics

Teaching and enforcement both benefit from distinguishing seven sources of cyberethics—law, philosophy, societal norms, environmental ethics, political ethics, economic ethics, and religious ethics—because many disagreements are really cross‑source conflicts rather than factual disputes.

FIGURE 1.3 Sources of Cyberethics.

Explicitly tagging a rule or control to its source clarifies why it matters, which exceptions are legitimate, and how it should evolve as technologies and social expectations shift. (see Figure 1.3 above)

The final part turns to enforceable duties, case anchors, and Indian equivalents that translate “should” and “usually” into “must” and remedy.

Part III — Law, Cases, and India

 Legal timelines and institutional context

A historical view contextualises duties: anti‑hacking and communications‑privacy laws in the United States matured alongside sectoral privacy regimes, corporate‑records governance, federal security standards, and information‑sharing statutes, which together signal that accountability has expanded from access control to ecosystem collaboration over time.

India’s trajectory shows the consolidation of cybercrime and electronic records under the IT Act, judicial calibration of speech and intermediary liability, institutionalisation of incident response via CERT‑In, and a new comprehensive privacy baseline through the DPDP Act, accompanied by evolving intermediary due‑diligence obligations.

Applying the lessons: parallels between anchors

The Morris Worm’s^[iii] core lesson—foreseeable harm at scale from a “limited” act—parallels Indian experiences with fast‑moving online harassment cases, where code or content that seems bounded can inflict large‑scale reputational, psychological, and safety harms once replicated or amplified by platforms and media.

Lori Drew’s^[iv] case—testing the limits of criminal law in a platform‑rules context—parallels Indian difficulties in charging and adjudicating “auction apps,” where acts fall between harassment, unauthorised access, and content offences, demanding careful use of IT Act and Penal Code provisions alongside intermediary rules and platform enforcement.

Indian doctrinal guardrails that shape ethics in practice

Shreya Singhal^[v] clarifies that vague speech offences cannot be a catch‑all for cyber conduct, steering enforcement towards well‑defined offences and due‑process‑compliant blocking and takedown measures with safeguards and record‑keeping for accountability.

Puttaswamy^[vi] constitutionalises privacy as a fundamental right, implying that surveillance, data retention, and intrusive analytics must pass tests of legality, necessity, and proportionality, which should be reflected in design reviews, data minimisation policies, and audit trails within organisations.

Institutional pathways and compliance expectations in India

CERT‑In’s 2022 directions [xx]on six‑hour incident reporting, 180‑day log retention, and clock synchronisation push organisations to maintain evidence readiness and timing discipline, which are operational expressions of ethical transparency and shared defence.

Intermediary Rules 2021 (as amended)^[xv] push content moderation, grievance handling, and due diligence mechanisms upstream, with consequences for safe‑harbour if obligations are not met, aligning platform operations with public‑law expectations about safety and integrity online.

Sector snapshots to ground abstract values

In healthcare, patient safety stakes elevate the duty of necessity and proportionality in access and monitoring, favouring pragmatic controls such as least-privilege access, multi-factor authentication, encryption, network segmentation, device management, continuous auditing, and rehearsed breach notification that are auditable and explainable to patients and regulators.

In finance, institutional trust relies on continuous monitoring, disciplined vulnerability management, phishing resilience, third‑party controls, and client education under a visible “tone from the top,” which together translate abstract duties into high‑signal practices that customers can recognise and reward.

Conclusion: alignment that earns trust

The argument of this playbook is simple to state and demanding to live: responsible digital governance is not a choice between ethics, policy, and law, but a disciplined alignment of all three, so that what should be done, what must be done, and what is usually done point in the same direction. Achieving that alignment begins with design. Secure‑by‑design and privacy‑by‑default are not slogans; they are specific architectural commitments—least privilege as the default, encryption in transit and at rest, key lifecycle hygiene, comprehensive logging with integrity, patch pipelines that privilege safety over novelty, and segregation controls that fail safely—expressed in code, configuration, and change control. The ethical burden of those choices is carried by everyday artefacts: access reviews, threat models, data‑flow diagrams, DPIAs[xxi], SBOMs[xxii], runbooks[xxiii], and post‑incident reviews that are honest enough to change behaviour next time.

The legal turn is equally practical. Duties are real only when mapped to controls and evidence that stand up to scrutiny. That means knowing which offences and procedures apply, what sectoral regimes demand, where institutional roles begin and end, and how to preserve evidence and privilege while being transparent enough to maintain trust with regulators, partners, and the public. In the United States, the path from anti‑hacking and communications privacy to sector privacy, corporate governance, federal standards, and information sharing shows a system learning to coordinate across silos at speed. In India, the consolidation under the IT Act, the free‑speech recalibration of Shreya Singhal, the privacy baseline of Puttaswamy and the DPDP Act, CERT‑In’s operational role, and intermediary due‑diligence expectations show a different but convergent trajectory: from isolated offences to ecosystem governance.

Culture binds the system. Transparency, proportionality, and reversibility are not abstract virtues; they are operational stances. Transparency means explaining decisions at a level that affected groups can understand, while protecting investigations and due process. Proportionality means matching controls and data use to risk and necessity, not to appetite or fashion. Reversibility means preferring decisions that can be undone when uncertainty is high, especially where harm would be intimate or irreversible. These stances turn values into speed, because teams that know how they decide, and why, decide faster and make fewer unforced errors.

The case anchors underline the stakes. The Morris Worm reminds engineers and leaders that benign intent does not neutralise foreseeable harm at scale; code that self‑propagates is not a prank but a system‑level risk multiplier. The Lori Drew case warns that deception which foreseeably inflicts severe emotional harm cannot be excused as mere “rule breaking”; platform terms cannot do the work of calibrated criminal law, and safety by design for minors is a duty, not a public‑relations initiative. Indian scenarios like Suhas Katti, “Sulli Deals,” and “Bulli Bai” demonstrate how gendered harassment exploits platform affordances to cause lasting harm, and how timely takedowns, evidence preservation, and due‑diligence by intermediaries are ethical as well as legal imperatives.

The closing commitments are concrete and measurable:

1. Build for necessity and proportionality: collect less, keep less, explain more, and be ready to delete and de‑identify by design rather than on demand.
2. Treat incidents as learning loops: rehearse, document, disclose responsibly, and change systems and incentives so the same mistake does not pay twice.

• Make third‑party risk first‑party work: contracts, technical verification, logging, and termination plans that are as real as the SLA.

1. Teach what is practised: use the IAB norms, the Ten Commandments, and the Venns in onboarding, reviews, and tabletop exercises, so every role shares the same mental models.

1. Measure what matters: time to revoke access, time to patch criticals, mean time to detect and contain, DPIA coverage, data minimisation in production, percentage of incidents with design changes implemented.

Finally, the horizon is already here: foundation‑model AI integrated into core services[xxiv], ubiquitous IoT at the edge of safety and autonomy[xxv], bio‑digital interfaces moving from research to clinical and consumer life[xxvi]. Each raises familiar questions about intelligibility, consent, traceability, and control; each will produce new grey zones where statutes lag. The answer is not to wait for perfect law or perfect certainty. The answer is to build institutions that can act first to protect people—by design, by default, and by habit—and then explain those actions with enough clarity and evidence to maintain the trust that democratic life in a digital society requires.

The series concludes with concrete commitments—design defaults, evidence‑ready controls, measured transparency that convert values into speed and resilience.

[i] Internet Architecture Board. (1989). Ethics and the Internet (RFC 1087). https://datatracker.ietf.org/doc/html/rfc1087

[ii] Barquin, R. C. (1992). In Pursuit of a ‘Ten Commandments’ for Computer Ethics. Computer Ethics Institute. http://computerethicsinstitute.org/publications/tencommandments.html

[iii] https://www.fbi.gov/history/famous-cases/morris-worm

[iv] https://www.justice.gov/sites/default/files/oip/legacy/2014/07/23/11-17-2009-us-v-lori-drew.pdf

[v] https://www.thehindu.com/opinion/lead/The-judgment-that-silenced-Section-66A/article59870557.ece

[vi] https://www.scobserver.in/wp-content/uploads/2021/10/1-266Right_to_Privacy__Puttaswamy_Judgment-Chandrachud.pdf

[vii] https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf

[viii] https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3776961

[ix] https://www.thehindu.com/news/national/sulli-deals-bulli-bai-and-the-young-and-educated-hatemongers/article38305009.ece

[x] Internet Architecture Board. (1989). Ethics and the Internet (RFC 1087). https://datatracker.ietf.org/doc/html/rfc1087

[xi] Barquin, R. C. (1992). In Pursuit of a ‘Ten Commandments’ for Computer Ethics. Computer Ethics Institute. http://computerethicsinstitute.org/publications/tencommandments.html

[xii] https://www.fbi.gov/history/famous-cases/morris-worm

[xiii] https://www.justice.gov/sites/default/files/oip/legacy/2014/07/23/11-17-2009-us-v-lori-drew.pdf

[xiv] https://www.indiacode.nic.in/bitstream/123456789/13116/1/it_act_2000_updated.pdf

[xv] https://www.meity.gov.in/static/uploads/2024/02/Information-Technology-Intermediary-Guidelines-and-Digital-Media-Ethics-Code-Rules-2021-updated-06.04.2023-.pdf

[xvi] https://ogletree.com/insights-resources/blog-posts/u-s-continues-patchwork-of-comprehensive-data-privacy-requirements-new-laws-set-to-take-effect-over-next-2-years/

[xvii] https://nishithdesai.com/fileadmin/user_upload/pdfs/Research_Papers/Privacy_&_Data_in_India.pdf

[xviii] https://www.cisa.gov/securebydesign

[xix] https://commission.europa.eu/law/law-topic/data-protection/rules-business-and-organisations/obligations/what-does-data-protection-design-and-default-mean_en

[xx] https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf

[xxi] http://www.dataprotection.ie/en/organisations/know-your-obligations/data-protection-impact-assessments

[xxii] https://www.cisa.gov/sbom

[xxiii] https://wa.aws.amazon.com/wellarchitected/2020-07-02T19-33-23/wat.concept.runbook.en.html

[xxiv] https://www.sciencedirect.com/science/article/pii/S2950550X2500024X

[xxv] https://www.sciencedirect.com/science/article/pii/S2665917423003185

[xxvi] https://medium.com/@antonpalladin/the-biodigital-revolution-when-technology-becomes-biology-7f39f60e559d

(This article has been written by Tanmaya Nirmal, TAU, National e-Governance Division. For any comments or feedback, please write to tanmaya.nirmal@digitalindia.gov.in  and negdcb@digitalindia.gov.in)