Section 34 of IT Act 2000: Disclosure

Section 34(1)

Every Certifying Authority shall disclose in the manner specified by regulations—

(a) its electronic signature Certificate;

(b) any certification practice statement relevant thereto;

(c) notice of the revocation or suspension of its Certifying Authority certificate, if any; and

(d) any other fact that materially and adversely affects either the reliability of an electronic signature Certificate, which that Authority has issued, or the Authority’s ability to perform its services.

Section 34(2)

Where in the opinion of the Certifying Authority any event has occurred or any situation has arisen which may materially and adversely affect the integrity of its computer system or the conditions subject to which an electronic signature Certificate was granted, then, the Certifying Authority shall—

(a) use reasonable efforts to notify any person who is likely to be affected by that occurrence; or

(b) act in accordance with the procedure specified in its certification practice statement to deal with such event or situation.

Explained:

Section 34 contains two subsections. The first establishes the information that Certifying Authorities must disclose, while the second deals with events or situations that may adversely affect their computer systems or electronic signature certificates.

Section 34(1): Mandatory disclosure by Certifying Authorities

Subsection (1) requires every Certifying Authority to disclose specified information in the manner prescribed by regulations. The objective is to ensure that subscribers and other interested persons can obtain important information about electronic signature certificates and the reliability of the issuing authority.

The subsection contains four important clauses.

Clause (a): Disclosure of electronic signature certificates

Every Certifying Authority must disclose its electronic signature certificate in the prescribed manner. Such certificates are important instruments for establishing trust in electronic authentication systems.

Clause (b): Certification Practice Statement

A Certification Practice Statement (CPS) explains the practices and procedures followed by a Certifying Authority while issuing, managing, suspending and revoking electronic signature certificates.

Disclosure of the relevant CPS allows users to understand the standards and procedures followed by the authority.

Clause (c): Notice of revocation or suspension

A Certifying Authority must disclose notice of the revocation or suspension of its certificate, where applicable.

Revocation or suspension can affect the reliability of electronic authentication. For example, if a certificate is suspended because of suspected compromise, persons relying on it need access to that information to avoid accepting an unreliable certificate.

Clause (d): Disclosure of materially adverse facts

This clause requires disclosure of other facts that materially and adversely affect the reliability of an electronic signature certificate or the Certifying Authority’s ability to perform its services.

Such circumstances may include serious security failures, compromised authentication systems or operational problems affecting certificate reliability.

Section 34(2): Disclosure of events affecting system integrity

Subsection (2) deals with situations in which a Certifying Authority becomes aware of an event or circumstance that may materially and adversely affect the integrity of its computer system or the conditions under which an electronic signature certificate was granted.

This provision is particularly important for cybersecurity and the protection of electronic authentication services.

It contains two clauses:

Clause (a): Reasonable efforts to notify affected persons

The Certifying Authority must make reasonable efforts to notify any person who is likely to be affected by the incident or situation.

For example, if a security breach compromises the reliability of certificates issued by an authority, users who may rely on those certificates should be informed through appropriate channels.

Clause (b): Action according to the Certification Practice Statement

Alternatively, the Certifying Authority must act according to the procedure specified in its Certification Practice Statement to address the event or situation.

This ensures that the authority follows its established security and incident-management procedures rather than ignoring a threat to its systems or certificates.

Importance of Section 34 in Cybersecurity and Digital Transactions

Section 34 plays an important role in maintaining confidence in India’s electronic signature infrastructure.

Its practical significance can be understood through the following situations:

1. Protection against certificate misuse: Disclosure of suspension and revocation information helps users avoid relying on compromised or invalid certificates.

2. Transparency: Certifying Authorities must disclose important information about their certificates and certification practices.

3. Cybersecurity: The provision encourages authorities to respond appropriately when security incidents threaten their computer systems.

4. Protection of subscribers: Individuals and organisations relying on electronic signature certificates can receive relevant information about circumstances affecting their reliability.

5. Accountability: Disclosure requirements make Certifying Authorities more accountable for the services they provide.

Important Judgments

Section 34 is a specialised provision dealing with disclosure obligations of Certifying Authorities. It is important not to confuse judgments concerning electronic evidence or electronic contracts with direct judicial interpretations of this particular section. The following decisions provide relevant background to the legal treatment of electronic records and authentication.

1. State of Tamil Nadu v. Suhas Katti (2004)

This is an important early Indian cybercrime case involving the publication of obscene and defamatory messages online. The accused was prosecuted under provisions of the Information Technology Act, 2000, and the Indian Penal Code.

Relevance: The case demonstrates the importance of accountability and reliable electronic records in cyber-related investigations. Although it did not directly interpret Section 34, it illustrates the broader need for trust and security in electronic systems.

2. Anvar P.V. v. P.K. Basheer (2014)

The Supreme Court examined the admissibility of electronic records under Section 65B of the Indian Evidence Act, 1872.

Relevance: The judgment established important principles concerning the production and admissibility of electronic evidence. It highlights why the authenticity and reliability of electronic information matter in legal proceedings.

3. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)

The Supreme Court clarified the requirements relating to certification of electronic evidence under Section 65B of the Indian Evidence Act, 1872.

Relevance: The judgment reinforces the importance of proper handling and authentication of electronic records. These principles provide useful background when understanding the broader objectives of transparency and reliability under Section 34.

Note: These decisions are relevant to the wider legal framework governing electronic records and cybersecurity; they should not be represented as direct rulings on the interpretation of Section 34.

The Bharatiya Sakshya Adhiniyam, 2023, replaced the Indian Evidence Act, 1872, with effect from 1 July 2024. Its provisions should be considered when dealing with current electronic evidence proceedings.

Difference Between Section 33 and Section 34

These provisions work together to regulate the functioning and responsibilities of Certifying Authorities under the Information Technology Act, 2000.

Responsibilities of Certifying Authorities Under Section 34

A Certifying Authority must maintain appropriate systems and procedures to fulfil its statutory responsibilities. Important responsibilities include:

• Maintaining accurate information about issued electronic signature certificates.
• Making relevant Certification Practice Statements available in the prescribed manner.
• Disclosing information about certificate suspension and revocation.
• Identifying incidents that may affect certificate reliability.
• Taking reasonable steps to notify affected persons.
• Following established procedures to protect the integrity of computer systems and electronic authentication services.

Failure to maintain proper disclosure and security procedures may create legal and regulatory consequences under the applicable provisions of the Information Technology Act and related regulations.

Conclusion

Section 34 of the Information Technology Act, 2000, is an important provision for ensuring transparency and reliability in India’s electronic signature framework. It places specific disclosure responsibilities on Certifying Authorities and requires them to respond appropriately when circumstances threaten the integrity of their computer systems or the reliability of electronic signature certificates.

The two subsections of this provision address different but interconnected responsibilities. Section 34(1) focuses on disclosure of certificates, certification practices, suspension, revocation and other materially adverse information. Section 34(2) deals with notifying affected persons or following established procedures when an incident threatens system integrity or certificate conditions.