Section 68

Section 68 gives the Controller of Certifying Authorities a powerful operational enforcement tool: the ability to issue binding directions to a CA or its employees requiring specific action or requiring them to cease specific activities. Unlike the licence-level enforcement under Section 25 (which goes to the CA's ability to operate at all), Section 68 directions address specific conduct without necessarily triggering the full licence enforcement machinery. The Controller can direct a CA to take positive measures — for example, to implement a specific security control, to revoke a category of certificates, to update its CRL within a specified period, or to comply with a particular regulation it has been breaching. The Controller can also direct a CA to stop doing something — to cease issuing a class of certificates, to stop a particular business practice, or to halt a specific operational activity. The criminal sanction in Section 68(2) is what gives the direction its teeth: wilful non-compliance with a Section 68 order is a criminal offence carrying up to two years imprisonment and a fine of up to Rs 1 lakh. The 'wilful' threshold is important — it protects CAs from criminal liability for technical or inadvertent non-compliance while ensuring that deliberate defiance of a Controller direction is treated seriously. Section 68 directions to employees as well as to the CA itself means individual officers cannot shield behind their organisation — the direction can be addressed to the specific person whose conduct needs to change.