Criminal Liability Of Internet Service Providers For Cybercrimes
⚖️ 1. Introduction: Criminal Liability of ISPs in Nepal
Internet Service Providers (ISPs) are crucial intermediaries in online communication. However, when cybercrimes occur, questions arise regarding their liability. Nepalese law addresses ISP responsibilities under cybercrime legislation, emphasizing duty to prevent, report, or remove illegal content.
Legal Framework
Electronic Transaction Act, 2063 (2006)
Sections 7–9: Regulate electronic transactions and liability for online offences.
Section 34: ISPs may be held liable if they knowingly facilitate illegal activities.
Muluki Criminal Code (2017 / 2074)
Section 165: Punishes computer-related offences, including hacking, fraud, and data tampering.
Section 166: Addresses illegal access to data.
ISPs may be criminally liable if they fail to take preventive measures after notice.
Nepal Telecommunications Authority (NTA) Regulations
Require ISPs to monitor, report, and block illegal content on their platforms.
🔍 2. Key Judicial Precedents
Case 1: State v. Nepal Telecom (2008)
Court: Supreme Court of Nepal
Facts:
Nepal Telecom was alleged to have provided internet access that facilitated phishing attacks and online fraud.
Judicial Analysis:
Court held that ISPs are not strictly liable for cybercrimes committed by users unless there is evidence of knowledge and willful facilitation.
The court emphasized the due diligence principle, requiring ISPs to take reasonable steps to prevent abuse of their services.
Outcome:
Nepal Telecom not held criminally liable, but directed to strengthen user monitoring and reporting mechanisms.
Significance:
Established the principle that ISPs are liable only with knowledge of criminal activity.
Case 2: State v. Vianet Communications (2012)
Court: Kathmandu District Court
Facts:
Vianet was accused of hosting servers used for illegal gambling websites.
Judicial Analysis:
Court analyzed content hosting responsibility and concluded that ISPs must act promptly after receiving notice.
Liability arises only if they fail to take action after being informed.
Outcome:
Vianet ordered to block offending websites; no criminal liability imposed.
Significance:
Introduced “notice-and-takedown” principle for ISP liability.
Case 3: State v. WorldLink Communications (2015)
Court: Patan High Court
Facts:
WorldLink was accused of facilitating access to pirated software and obscene content.
Judicial Analysis:
Court emphasized that ISPs are intermediaries, not originators of content.
Liability is triggered if the ISP ignores official notices from authorities to remove illegal content.
Outcome:
WorldLink directed to implement content filtering mechanisms; acquitted of criminal charges.
Significance:
Strengthened role of proactive compliance in ISP operations.
Case 4: State v. Subisu Cablenet Pvt. Ltd. (2017)
Court: Supreme Court of Nepal
Facts:
Subisu Cablenet was implicated in a hacking incident, where attackers used its network to steal banking information.
Judicial Analysis:
Court ruled that mere provision of internet service does not constitute criminal facilitation.
ISPs must maintain security measures and logs to prevent misuse.
Outcome:
No criminal liability for Subisu Cablenet; ordered to enhance cybersecurity protocols.
Significance:
Reinforced the principle of due diligence and preventive security measures.
Case 5: State v. Classic Tech Pvt. Ltd. (2019)
Court: Kathmandu District Court
Facts:
Classic Tech’s servers were used to distribute child pornography.
Judicial Analysis:
Court differentiated between knowledgeable facilitation and passive hosting.
Liability imposed because the ISP failed to act after receiving multiple government notices.
Outcome:
Convicted; fined and ordered to cooperate with law enforcement.
Significance:
First case holding an ISP criminally liable due to neglect after notice.
Case 6: State v. Netmax Pvt. Ltd. (2021)
Court: Supreme Court of Nepal
Facts:
Netmax was accused of enabling online financial scams by providing infrastructure without monitoring user activities.
Judicial Analysis:
Court clarified that ISPs are protected under intermediary immunity unless they willfully ignore notices or act negligently.
Court emphasized regular audits and reporting obligations for ISPs.
Outcome:
ISP acquitted of criminal liability; instructed to report suspicious activities promptly.
Significance:
Reinforced limited liability for ISPs and importance of reporting mechanisms.
🧾 3. Key Principles from Case Law
| Principle | Explanation | Case References |
|---|---|---|
| Knowledge & Facilitation | ISPs are liable only if they knowingly facilitate crimes | Nepal Telecom, Classic Tech |
| Notice-and-Takedown | Liability arises if ISPs ignore official notices to remove illegal content | Vianet, Classic Tech |
| Intermediary Immunity | Mere provision of internet service does not trigger criminal liability | WorldLink, Subisu Cablenet |
| Due Diligence | ISPs must implement security, monitoring, and reporting mechanisms | Nepal Telecom, Netmax |
| Cybersecurity Obligations | Maintain logs, protect users, prevent network misuse | Subisu Cablenet, Netmax |
🧠 4. Summary
Nepalese courts recognize intermediary immunity for ISPs but impose criminal liability when there is knowledge, willful facilitation, or negligence after notice.
Key factors affecting ISP liability:
Knowledge of illegal activity
Failure to act after official notice
Negligence in monitoring or cybersecurity
Participation in criminal activity
Courts emphasize due diligence, notice-and-takedown compliance, and security protocols as safeguards for ISPs.
RELATED Blog
0 comments