Section 18 of IT Act 2000: Functions of Controller

The Controller may perform all or any of the following functions, namely:—

(a) exercising supervision over the activities of the Certifying Authorities;

(b) certifying public keys of the Certifying Authorities;

(c) laying down the standards to be maintained by the Certifying Authorities;

(d) specifying the qualifications and experience which employees of the Certifying Authority should possess;

(e) specifying the conditions subject to which the Certifying Authorities shall conduct their business;

(f) specifying the contents of written, printed or visual materials and advertisements that may be distributed or used in respect of an electronic signature Certificate and the public key;

(g) specifying the form and content of an electronic signature Certificate and the key;

(h) specifying the form and manner in which accounts shall be maintained by the Certifying Authorities;

(i) specifying the terms and conditions subject to which auditors may be appointed and the remuneration to be paid to them;

(j) facilitating the establishment of any electronic system by a Certifying Authority either solely or jointly with other Certifying Authorities and regulation of such systems;

(k) specifying the manner in which the Certifying Authorities shall conduct their dealings with the subscribers;

(l) resolving any conflict of interests between the Certifying Authorities and the subscribers;

(m) laying down the duties of the Certifying Authorities;

(n) maintaining a database containing the disclosure record of every Certifying Authority containing such particulars as may be specified by regulations, which shall be accessible to public.

Explained:

Clause (a): Supervision over Certifying Authorities

Clause (a) empowers the Controller to supervise the activities of Certifying Authorities. These authorities issue electronic signature certificates to individuals and organisations for electronic authentication.

The Controller monitors their activities to ensure that they operate according to the Information Technology Act, applicable rules and regulatory requirements.

For example, a Certifying Authority issuing digital signature certificates must follow the prescribed procedures for verifying applicants and maintaining security.

Clause (b): Certifying Public Keys of Certifying Authorities

Clause (b) authorises the Controller to certify the public keys of Certifying Authorities.

Public-key cryptography uses two mathematically related keys: a private key and a public key. The private key is used to create a digital signature, while the public key is used to verify it.

The Controller’s certification function helps establish trust in the public-key infrastructure. The Root Certifying Authority of India (RCAI), established by the CCA, supports this trust framework. CCA+1

Clause (c): Laying Down Standards

Clause (c) empowers the Controller to establish standards that Certifying Authorities must maintain.

These standards help ensure the reliability, security and technical quality of electronic signature services. They may concern information security, certificate management, infrastructure and operational procedures.

Clause (d): Qualifications and Experience of Employees

Clause (d) allows the Controller to specify the qualifications and experience required of employees working for Certifying Authorities.

This provision recognises that electronic authentication requires trained personnel with appropriate technical knowledge and professional competence.

Clause (e): Conditions for Conducting Business

Clause (e) empowers the Controller to prescribe conditions under which Certifying Authorities must conduct their business.

These conditions help maintain regulatory discipline and ensure that certificate-issuing organisations follow appropriate operational and security practices.

Clause (f): Regulation of Advertisements and Public Information

Clause (f) allows the Controller to specify the contents of written, printed or visual materials and advertisements relating to electronic signature certificates and public keys.

This provision helps prevent misleading representations about electronic signature services and promotes accurate information for subscribers and users.

Clause (g): Form and Content of Electronic Signature Certificates

Clause (g) empowers the Controller to prescribe the form and content of electronic signature certificates and keys.

A certificate contains information that helps establish the identity of its subscriber and associate the subscriber with the relevant public key. Prescribed formats support consistency and reliable verification.

Clause (h): Maintenance of Accounts

Clause (h) empowers the Controller to prescribe the form and manner in which Certifying Authorities must maintain their accounts.

Proper accounting records promote financial transparency and enable regulatory monitoring. They also help ensure that Certifying Authorities maintain appropriate financial and administrative discipline.

Clause (i): Appointment of Auditors

Clause (i) authorises the Controller to specify the terms and conditions for appointing auditors and the remuneration payable to them.

Audits help assess whether Certifying Authorities are following prescribed standards, maintaining proper records and complying with regulatory obligations.

Clause (j): Establishment of Electronic Systems

Clause (j) allows the Controller to facilitate the establishment of electronic systems by Certifying Authorities, either individually or jointly with other Certifying Authorities.

This provision supports the development of secure electronic infrastructure and coordination between different certification service providers.

For example, electronic systems may facilitate certificate verification, certificate management and secure communication between participating authorities.

Clause (k): Dealings with Subscribers

Clause (k) empowers the Controller to prescribe how Certifying Authorities must conduct their dealings with subscribers.

A subscriber is a person in whose name an electronic signature certificate is issued. The relationship between a Certifying Authority and a subscriber involves applications, identity verification, certificate issuance, renewal and other related services.

The provision helps establish consistent procedures and promotes transparency in these dealings.

Clause (l): Resolution of Conflicts of Interest

Clause (l) authorises the Controller to resolve conflicts of interest between Certifying Authorities and subscribers.

Disputes may arise concerning certificate issuance, suspension, revocation, service conditions or other matters connected with certification services.

This function helps protect subscribers’ interests and supports fair regulatory practices.

Clause (m): Duties of Certifying Authorities

Clause (m) empowers the Controller to lay down the duties of Certifying Authorities.

These duties may involve maintaining secure systems, following prescribed procedures, protecting subscriber information and ensuring the reliability of electronic signature services.

The provision strengthens accountability by making clear that Certifying Authorities must comply with their statutory and regulatory responsibilities.

Clause (n): Maintenance of a Public Database

Clause (n) requires the Controller to maintain a database containing the disclosure records of every Certifying Authority.

The database must contain particulars specified by regulations and must be accessible to the public.

This provision promotes transparency by allowing interested persons to obtain relevant information about Certifying Authorities. It also helps subscribers and organisations identify and verify certification service providers.

Importance of Section 18 in India’s Digital Environment

Section 18 is important because electronic signatures are widely used in modern commercial and administrative activities. Its practical significance can be understood in the following areas:

• Digital signature certificates: It establishes regulatory oversight of organisations issuing electronic signature certificates.
• Online government services: It supports the trust infrastructure required for electronic filings and digital authentication.
• Business transactions: It promotes reliable electronic signing for permitted commercial and corporate transactions.
• Cybersecurity: It encourages appropriate technical standards and security practices.
• Consumer protection: It provides a regulatory framework for addressing conflicts between subscribers and Certifying Authorities.
• Transparency: It supports public access to disclosure information about Certifying Authorities.

The Controller of Certifying Authorities functions under the Ministry of Electronics and Information Technology (MeitY). The CCA’s regulatory role is an important part of India’s public-key infrastructure. CCA+1

Important Judgments

Section 18 primarily establishes regulatory and administrative functions rather than creating a criminal offence or an independent civil cause of action. There is a limited body of reported judicial interpretation directly addressing its individual clauses. The following decisions provide relevant background on electronic records, digital transactions and technology in legal proceedings.

1. State of Maharashtra v. Dr. Praful B. Desai (2003)

The Supreme Court considered whether evidence could be recorded through video conferencing under the applicable criminal procedure framework.

Relevance: The decision recognised the importance of technology in judicial proceedings. It illustrates the broader legal acceptance of technology-based processes, although it does not directly interpret Section 18.

2. Trimex International FZE Ltd. v. Vedanta Aluminium Ltd. (2010)

The Supreme Court examined whether contractual negotiations conducted through email communications could result in a binding agreement.

Relevance: The judgment demonstrates the legal importance of electronic communications in commercial transactions. It provides useful context for understanding the growing importance of reliable electronic authentication and certification systems.

3. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court examined the admissibility of electronic records under Section 65B of the Indian Evidence Act, 1872.

Relevance: The judgment highlights the importance of authenticity and proper handling of electronic records. Although it does not directly concern the regulatory powers under Section 18, it is relevant to the wider legal framework governing electronic documentation.

4. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the requirements concerning certification of electronic evidence under Section 65B of the Indian Evidence Act, 1872.

Relevance: The decision is important for understanding how electronic records are proved in court. It should be distinguished from Section 18, which deals with the functions of the Controller of Certifying Authorities.

The applicable evidentiary law must also be considered. The Bharatiya Sakshya Adhiniyam, 2023, came into force on 1 July 2024.

These decisions are contextual authorities, not judgments directly interpreting all fourteen clauses of Section 18.

Difference Between Section 17, Section 18 and Section 19

These provisions form part of Chapter VI of the Information Technology Act, 2000, and deal with the regulatory framework governing Certifying Authorities.

Section 17 provides for the appointment of the Controller, Section 18 explains the Controller’s functions, Section 19 deals with recognition of foreign Certifying Authorities, and Section 20 concerns the repository of certificates. India Code+2

Conclusion

Section 18 of the Information Technology Act, 2000, is an essential provision for regulating electronic signature certification in India. It gives the Controller of Certifying Authorities important responsibilities relating to supervision, technical standards, employee qualifications, certificate formats, auditing, subscriber protection and public disclosure.

The fourteen clauses under this section collectively establish a regulatory framework that promotes accountability, security and transparency among Certifying Authorities.