Theme-Logo
  • This Product is Licensed to ,

    • Notifications
    • Generic placeholder image

  • User-Profile-Image
    • Profile
    • Change Password
    • Logout
Cdj Law Journal
  • D Home
  • Judgments
    • Latest Cases
    • Publication Date
    • Keyword Method 1
    • Keyword Method II
    • Intellectual Search
    • Advanced & Citation
    • Nominal Index
    • Year / Month Search
    • CDJ Chat GPT
    • CDJ AI Search
  • FC E-Books
  • FC Conveyance
  • FC E-Law Dictionary
  • FC Acts
  • FC Law Commision Reports
  • FC WEBINAR MEETINGS
  • FC Articles / Journals
  • FC Office Management
  • FC Legal News
  • FC Legal Chat
  • FC Bookmarked Judgments
  • FC Publisher's Note
Articles

Articles

Article Title: DIGITAL EVIDENCE AND INDIAN LAW
Date of Article: January 1, 1970

Article Image

DIGITAL EVIDENCE AND INDIAN LAW

Dr. Nagarathna A.

Associate Professor of Law,

Chief Co-ordinator, Advanced Centre on Research, Development and Training in Cyber Law & Forensics [ACRDTCLF],

Co-ordinator, PG Diploma in Cyber Law & Cyber Forensics [CLCF]

National Law School of India University, Bangalore

 

Today investigation, inquiry and trial of a large number of crime and cybercrimes involves large number of digital evidence. A conventional crime also is not different. It is in this context that the law and legal principles relating to digital evidence becomes important to be understood. But on the other hand, digital evidence being a techno-legal raises challenges affecting effective utilisation of such evidence in a criminal trial. This article aims to look at the legal provisions that needs to be complied with in presenting and appreciating digital evidence during a judicial proceeding.

 

CONCEPTUAL ANALYSIS:

Digital evidence includes “any information that is created or stored in digital form and is relevant to a case.” It includes evidences from sms or mms, or messages, emails, text documents, spreadsheets, excel documents, images and graphics, database files, deleted files, data back-ups, etc.  Such evidences may be located in a hard disk, floppy disks, zip disks, CD-ROMs or DVDs, cloud, mobile phones, sim cards, memory card or a chip, etc.

 

ADMISSIBILITY OF DIGITAL EVIDENCE:

Digital evidence may be admitted as an evidence in an adjudication process including in a criminal trial. However this requires compliance to few legal provisions, principles and fulfillment of certain conditions. As digital evidence are the ones that can be easily manipulated or tampered with it is essential to ensure that through these legal provisions, legal principle and legal conditions, its authenticity is established in order to ensure its reliability.

The foundations for digital evidence are based on established principles of authentication and admissibility that originated with the use of “paper” evidence and the five separate foundations are [Lucy L. Thomson, Mobile Devices, New Challenges for Admissibility of Electronic Evidence, The SciTech Lawyer, Vol. 9., No. 3., Winter/Spring 2013, available on  https://www.americanbar.org/content/dam/aba/events/science_technology/mobiledevices_new_challenges_admissibility_of_electronic_device.authcheckdam.pdf., last accessed on 23rd January 2019.]:

i.                     Relevance—the evidence must be relevant to the claims asserted, i.e., it must have “any tendency” to prove or disprove a consequential fact in the litigation.

ii.                   Authenticity—a process for establishing that digital data or a document is what it is represented to be.

iii.                  Hearsay—an out-of-court statement introduced for the truth of the matter asserted; it applies if the proponent plans to use the record’s contents as substantive evidence. The evidence must not be hearsay, or it must be admissible under a hearsay exception.

iv.                 Best Evidence—this standard applies if the document’s terms are at issue; there are no “originals” of digital evidence.

v.                   Probative Value Must Outweigh Any Prejudicial Effect—a court may exclude relevant evidence if its probative value is substantially outweighed by the danger of unfair prejudice, or by considerations of undue delay, waste of time, or needless presentation of cumulative evidence

 

Considering the nature of digital evidence it is important to always establish the authenticity and integrity of digital evidence which can be established by following few procedures such as the below:

 

i.              CYBER FORENSIC PROCEDURE: Cyber forensic procedure to be adopted while collecting and analysing digital evidence. Such forensic method must be transparent and freely testable by a third party expert, if required.

 

ii.             DOCUMENTATION: Proper documentation of digital evidence collected is very crucial to prove its authenticity and reliability. Legally also its important comply with requirements of section 100 and section 165 of Criminal Procedure Code whenever search and  seizure of evidence is done in the course of investigation of a crime. Such procedure also includes preparation of the list of articles seized and the signature of a minimum of 2 witnesses on such seizure memo. Additionally it is also important to annex such document with the chain of custody.

a) CHAIN OF CUSTODY:  An investigating officer of a digital forensic examiner must document the details of what digital evidence was searched for and seized, when, by whom and also transferred to whom in detail. Each person’s hands it passes through must be documented in detail. 

Collection ->

Examination ->

Analysis ->

Reporting ->

    

 

                          

 

                                     

            Media ---------> Data  --------->   Information --------> Evidence

 

Source: Kent, 2006.

This should also include details of procedure of collection, examination, analysis and reporting of digital evidence, the name, designation of officers handling such digital evidence, the reason for such possession or transport or handling, date of transfer, etc. It should also include identification description of such device including its label or serial number, model details, etc.

b) Statements which exhibits that contains statements – like the email copy, database, e-record, etc., must also be documented and it should show accuracy of contents as well as the procedure adopted in collecting such material. [In such cases, it is preferable to also have such document’s originator later available for cross examination during trial.]

 

PROVISIONS FROM UNCITRAL MODEL LAW ON E-COMMERCE:

The Model law on Electronic Commerce adopted by the UN Commission on International Trade Law adopted vide General Assembly’s resolution provides a model law which aims to facilitating e-commerce. According to Article 9 of the model law:

“(1) In any legal proceedings, nothing in the application of the rules of evidence shall apply so as to deny the admissibility of a data message in evidence:

(a) on the sole ground that it is a data message; or,

(b) if it is the best evidence that the person adducing it could reasonably be expected to obtain, on the grounds that it is not in its original form.

(2) Information in the form of a data message shall be given due evidential weight. In assessing the evidential weight of a data message regard shall be had to the reliability of the manner in which the data message was generated, stored or communicated, to the reliability of the manner in which the integrity of the information was maintained, to the manner in which its originator was identified, and to any other relevant factor.”

 

RELEVANT ROVISIONS FROM INDIAN EVIDENCE ACT, 1872:

The Information Technology Act 2000 in its statement of object and reasons states “It is proposed to make consequential amendments in the IPC and the Indian Evidence Act, 1872 [IEA] to provide necessary changes in the various provisions which deal with offences relating to documents and paper based documents.” Thus documentary evidence today also includes electronic documents produced as evidence.

For the purpose of legally assigning evidentiary value to a digital evidence we can classify digital evidence into 2 types, namely:

i.              primary [digital] evidence

ii.             secondary [digital] evidence

 

A secondary electronic evidence receives secondary evidentiary values as per section 65B of IEA. According Section 65A of the IEA “The contents of electronic records may be proved in accordance with the provisions of section 65B.”

Section 65B prescribes conditions to provide “admissibility of electronic records”. According to Section 65B of the IEA, a computer output includes an electronic record which is printed on a paper, stored, recorded or copied in optical or magnetic media produced by a computer. A computer output will be deemed to be a document and secondary evidentiary value may be assigned to it if the conditions prescribed under the section is complied with. The conditions includes:

·         The computer output was produced by a computer which was used regularly to store or process such information for the purposes of any activities regularly carried on over that period.

·         That the computer output was taken by a person having lawful control over the use of the computer

·         During the said period, the information of the kind was regularly fed into such computer in the ordinary course of business

·         Throughout such period the computer was operating properly – or - if not then such non-working [or not operating properly] was not of such a nature that it affect the electronic record or the accuracy of contents of such electronic record.

·         In case of use of multiple computers – like in a network situation – or when multiple computers are used to store or process information or to perform any other activity by using (a) a combination of computers operating over that period or (b) by different computers operating in succession over that period or (c) by different combinations of computers operating in succession over that period or (d) in any other manner involving the successive operation over that period …. Then all such computers shall be deemed to be a ‘single computer’ for the purpose of this provision. 

The manner of presenting such evidence: according to section (4) a certificate popularly known as “65B Certificate” must be prepared and submitted along with the computer output to the court. Such certificate is supposed to be the proof of compliance to the conditions prescribed by the provision. The certificate must state or explain the following:

-          Identification of the electronic record along with a statement with details of the manner in which such output is produced [for example if it’s through print out mode or through a soft copy in a USB/ etc.]

-          Details of the device used to take the output so as to show the manner of taking of such electronic record

-          Compliance of earlier stated conditions in the provision.

 

JUDICIAL INTERPRETATIONS:

Currently according to the Supreme Court of India compliance to section 65B and production of a 65B certificate is a mandatory requirement necessary to be complied with whenever a secondary electronic evidence in produced. However earlier in the case of Parliament attack case the court had taken a different view. In this case of - State [NCT of Delhi v.  Navjot Sandhu Guru [CDJ 2000 SC 574, 2005 (11) SCC 600], the prosecution had heavily relied on computer output such as the CDR, etc., but had not produced a certificate as required under Section 65B of IEA. The CDR was produced before the court in form of print outs. 2 witnesses were examined to prove the printouts of the computerized record furnished by the cellular service providers. In addition a covering letter was provided by PW35 with a deposition that “all the call details are computerised sheets obtained from the computer”. The court held “the printouts pertaining to the call details exhibited by the prosecution are of such regularity and continuity that it would be legitimate to draw a presumption that the system was functional and the output was produced by the computer in regular use, whether this fact was specifically deposed to by the witness or not. We are therefore of the view that the call records are admissible and reliable and rightly made use of by the prosecution.” Thus the court here did not insist for mandatory filing of 65B certificate.

In Anvar P.V.  v. P.K Basheer & Others [CDJ 2014 SC 790, 2014 (10) SCC 473] the Supreme Court however insisted for production of 65B certificate and set aside the earlier decision and held the following:

-          “Any documentary evidence by way of an electronic record under the Evidence Act, in view of Sections 59 and 65A, can be proved only in accordance with the procedure prescribed under Section 65B.Section 65B deals with the admissibility of the electronic record. The purpose of these provisions is to sanctify secondary evidence in electronic form, generated by a computer. It may be noted that the Section starts with a non obstante clause. Thus, notwithstanding anything contained in the Evidence Act, any information contained in an electronic record which is printed on a paper, stored, recorded or copied in optical or magnetic media produced by a computer shall be deemed to be a document only if the conditions mentioned under sub- Section (2) are satisfied, without further proof or production of the original. The very admissibility of such a document, i.e., electronic record which is called as computer output, depends on the satisfaction of the four conditions under Section 65B (2).

-          It is further clarified that the person need only to state in the certificate that the same is to the best of his knowledge and belief. Most importantly, such a certificate must accompany the electronic record like computer printout, Compact Disc (CD), Video Compact Disc (VCD), pen drive, etc., pertaining to which a statement is sought to be given in evidence, when the same is produced in evidence. All these safeguards are taken to ensure the source and authenticity, which are the two hallmarks pertaining to electronic record sought to be used as evidence. Electronic records being more susceptible to tampering, alteration, transposition, excision, etc. without such safeguards, the whole trial based on proof of electronic records can lead to travesty of justice.

-          Generalia specialibus non derogant, special law will always prevail over the general law. 

-          An electronic record by way of secondary evidence shall not be admitted in evidence unless the requirements under Section 65B are satisfied. Thus, in the case of CD, VCD, chip, etc., the same shall be accompanied by the certificate in terms of Section 65B obtained at the time of taking the document, without which, the secondary evidence pertaining to that electronic record, is inadmissible.”

Thus the current law insists for compliance to section 65B and production of 65B certificate. However it is important to know that the SC in this case makes a clear distinction between the primary electronic evidence and secondary electronic evidence. While former does not come under 65B the later comes under it. According to SC: “The situation would have been different had the appellant adduced primary evidence, by making available in evidence, the CDs used for announcement and songs. Had those CDs used for objectionable songs or announcements been duly got seized through the police or Election Commission and had the same been used as primary evidence, the High Court could have played the same in court to see whether the allegations were true. That is not the situation in this case. The speeches, songs and announcements were recorded using other instruments and by feeding them into a computer, CDs were made therefrom which were produced in court, without due certification. Those CDs cannot be admitted in evidence since the mandatory requirements of Section 65B of the Evidence Act are not satisfied. It is clarified that notwithstanding what we have stated herein in the preceding paragraphs on the secondary evidence on electronic record with reference to Section 59, 65A and 65B of the Evidence Act, if an electronic record as such is used as primary evidence under Section 62 of the Evidence Act, the same is admissible in evidence, without compliance of the conditions in Section 65B of the Evidence Act.”

Recently the Supreme Court has to an extent relaxed this mandatory requirement in the case of Shafhi Mohammad v. The State Of Himachal Pradesh [Special Leave Petition (CRL.) No.2302 of 2017]. According to SC “Sections 65A and 65B of the Evidence Act, 1872 cannot be held to be a complete code on the subject. ……..The applicability of procedural requirement under Section 65B(4) of the Evidence Act of furnishing certificate is to be applied only when such electronic evidence is produced by a person who is in a position to produce such certificate being in control of the said device and not of the opposite party. In a case where electronic evidence is produced by a party who is not in possession of a device, applicability of Sections 63 and 65 of the Evidence Act cannot be held to be excluded. In such case, procedure under the said Sections can certainly be invoked. If this is not so permitted, it will be denial of justice to the person who is in possession of authentic evidence/witness but on account of manner of proving, such document is kept out of consideration by the court in absence of certificate under Section 65B(4) of the Evidence Act, which party producing cannot possibly secure. Thus, requirement of certificate under Section 65B (h) is not always mandatory. …… Accordingly, we clarify the legal position on the subject on the admissibility of the electronic evidence, especially by a party who is not in possession of device from which the document is produced. Such party cannot be required to produce certificate under Section 65B (4) of the Evidence Act. The applicability of requirement of certificate being procedural can be relaxed by Court wherever interest of justice so justifies……..”

 

To summaries the current legal scenario:

-          A certificate under 65B is required only if it’s a secondary electronic evidence which is produced, legally referred to as ‘computer output’ and in a case where primary evidence [original electronic evidence] is produced it is not required.

-          Generally, when a secondary evidence in electronic form is produced, a certificate under section 65B IEA is required.

-          However this can only be insisted in a case where an evidence is produced by a person who is in a position to produce such certificate being in control of the said device and not of the opposite party, it should not be insisted and in the interest of justice this rule should be relaxed.”

 

EVIDENCE APPRECIATION THROUGH A SCIENTIFIC EXPERT - AN EXAMINER OF ELECTRONIC EVIDENCE:

According to the Supreme Court in Anvar case, “only if the electronic record is duly produced in terms of Section 65B of the Evidence Act, the question would arise as to the genuineness thereof and in that situation, resort can be made to Section 45A opinion of examiner of electronic evidence.” According to Section 45A of the IEA, “When in a proceeding the court has to form an opinion on any matter relating to any information transmitted or stored in any computer resource or any other electronic or digital form, the opinion of the examiner of e-evidence referred in s. 79A of IT Act is a relevant fact.”  

 

Section 79A of the Information Technology Act, 2000 provides: “The central government may, for the purposes of providing expert opinion on electronic form evidence before any court or other authority specify, by notification in the official gazette, any department, body or agency of the central government or a state government as an examiner of electronic evidence.”

 

The Ministry of Electronics and Information Technology through notifications has specified the following as examiner of electronic evidence [As on 24th January 2019. See for details: http://meity.gov.in/notification-forensic-labs-%E2%80%98examiner-electronic-evidence%E2%80%99-under-section-79a-information-technology.]:

Sl no

Date of notification

Agency declared as examiner

Examiner for [Nature of evidence]:

1.     

11th April, 2018

Forensic Science Laboratory, Sector 14, Rohini, New Delhi under Government of National Capital Territory of Delhi.

(a) Computer (Media) Forensics excluding Floppy Disk Drive;

(b) Mobile Devices Forensics

2.     

26th March, 2018

Computer Forensic and Data Mining Laboratory under Serious Fraud Investigation Office, Ministry of Corporate Affairs, New Delhi.

Computer (Media) Forensics excluding Floppy Disk Drive

3.     

26th March, 2018

Directorate of Forensic Science, Gandhi Nagar (Gujarat), in the State of Gujarat.

(a) Computer (Media) Forensics;

(b) Mobile Devices Forensics.

4.     

26th March, 2018

Central Forensic Science Laboratory, Hyderabad under Directorate of Forensic Science Services, Ministry of Home Affairs.

(a) Computer (Media) Forensics excluding Floppy Disk Drive;

(b) Mobile Devices Forensics.

5.     

4th September, 2018

State Forensic Science Laboratory, Madiwala, Bengaluru, under Directorate of Forensic Sciences, Karnataka, Police Department.

(a) Computer (Media) Forensics excluding Floppy Disk Drive; (b) Mobile Devices Forensics

6.     

4th September, 2018

Cyber Forensic Laboratory, under Army Cyber Group, Directorate General of Military Operations, Signals Enclave, Rao Tula Ram Marg, New Delhi.

(a) Computer (Media) Forensics excluding Floppy Disk Drive;

(b) Mobile Devices Forensics.

 

Thus according to the current law it’s only a notified examiner of an electronic evidence who can contribute to appreciation of electronic evidence by a court by playing the role of a ‘scientific expert’ for the purpose of such electronic evidence. Any other expert despite his expertise in the field cannot discharge this role.

 

CONCLUSION:

Indian law relating to digital evidence as of now is yet to jurisprudentially develop. However with regard to the compliance of section 65B and production of 65B certificate, the currently applicable precedent is the Apex court’s finding in Anvar case which to an extent was modified by the court recently in Shafhi Mhd case. Currently the issue is more complicated due to insistence for a notified examiner of electronic evidence which are the only institutions that have power to provide expert opinion on the matter. It is important further expand the list of such examiners so as to ensure larger ‘access to justice’ or larger number of people.

*** ***