ADMISSIBILITY OF ELECTRONIC EVIDENCE IN INDIA
4.1 ELECTRONIC EVIDENCE
Whether law follows the society or the society follows the law is always a
moot point; sometimes law follows the society and sometimes the society
follows the law. Information technology forces the law to follow the society.
Law is struggling to make itself suitable to face the new challenges posed
by ICE (Information, Communication and Entertainment) age, as it keeps
on changing with the changing needs of the society being a part of social
reality. Internet is not bi or tri-functional but is multifunctional. This
multifunctional nature of Internet has in fact added fuel to the fire. The swift
growth of multifunctional nature of Internet has made mockery of the
effective functioning of many legal regimes. The need for the rethinking and
reorientation of various existing legal regimes has already been felt and
earnest attempts are being currently made to accommodate the new
developments with legal framework.
The proliferation of computers, the social influence of information
technology and the ability to store information in digital form have all
required Indian law to be amended to include provisions on the appreciation
of digital evidence. In 2000 Parliament enacted the Information Technology
(IT) Act 2000, which amended the existing Indian statutes to allow for the
admissibility of digital evidence. The IT Act is based on the United Nations
Commission on International Trade Law Model Law on Electronic
Commerce and, together with providing amendments to the Indian Evidence
Act 1872, the Indian Penal Code 1860 and the Banker's Book Evidence Act
1891; it recognizes transactions that are carried out through electronic data
interchange and other means of electronic communication.
4.2 LAW OF EVIDENCE IN INDIA
India has responded to the challenges posed by the virtual world by
amending the Indian Evidence Act to recognize the electronic records but
before dealing with the amendments we should have a look at the basic
principles of the Indian Evidence Act regarding evidence. The challenges of
electronic evidence are:
• Invisible:- These kind of evidences are invisible which means that
they are not available physically like other documents, weapons etc.
as these are stored in storage devices which can be seen and touched
physically but this does not leads to appearance of the evidence as a
• Alteration or Destroyed:- These evidences cannot be easily altered
or destroyed by any person trying to destroy the evidences as
compared to the traditional evidences.
• Requires precautions to prevent alteration:- A special care and
proper protection is required to prevent the alteration of electronic
• Requires special tools and equipment:- In order to check the
authenticity and validity of the evidences special tools and equipment
are required to prevent the alteration or damage and even for checking
the authenticity of the evidence.
• Requires specialized training:- A special training is required to
check the authenticity of the Electronic Evidence.
• Requires expert testimony:- A proper testimony is required for
accessibility and admissibility of Electronic Evidence.
• Admissibility and Certificate:- It is difficult to get the certificate
from the labs established by the government to check the authenticity
of the evidence as these labs are overburdened these days.
Section 3 of the Indian Evidence Act defines evidence and says that the term
‘evidence’ means and includes:
All statement which court permits or requires to be made before it by
witness, in relation to matters of fact under inquiry, such statements are
called oral evidence;
All documents including electronic records for the inspection of the court,
such documents are called documentary evidence.
4.3 TYPES OF EVIDENCE
4.3.1 Oral And Documentary Evidence
• “Oral evidence” means a statement, which the court permits or
requires to be made before it by witnesses in relation to matter of fact
• “Documentary evidence” is evidence produced in the form of
documents. A document, for that purpose, means any matter
expressed or described upon any substance by means of letter, figures
or marks or by more than one of those means intended to be used or
which may be used for the purpose of recording of matter.
4.3.2 Direct And Indirect Evidence
• “Direct Evidence” is that which proves the fact in dispute directly,
without any interference or presumption, and which itself is a true and
conclusively established fact. Oral Evidence must be direct evidence.
• “Indirect Evidence” is that which tends to establish the fact in dispute
by proving another and which, though true, is not of itself conclusive.
4.3.3 Primary And Secondary Evidence
• ”Primary evidence” is called as the best evidence or that kind of
proof, which, under any possible circumstances, affords the greatest
certainty of the facts in question. The primary evidence means the
document itself produced for the inspection of the court.1
• “Secondary Evidence” is the evidence, which is admitted in case
where the primary evidence i.e. the original is lost, destroyed or
detained by an opponent or third person who does not produce it after
notice, or it is physically irremovable2.
4.3.4 Hearsay Evidence
“Hearsay Evidence” is the evidence which is given by a person who has not
perceived the events described themselves, but who has gleaned the
information from some other source. Hearsay literally means information
gathered by the first person from a second person concerning some event,
condition, or thing of which the first person had no direct experience. When
submitted as evidence, such statements are called hearsay evidence.
4.3.5 Circumstantial Evidence
This evidence is another indirect type of evidence that accrues out of the
peculiar facts or circumstances of a particular situation or case and is
relevant in proving a fact in dispute. Circumstantial evidence is a collection
of facts that, when considered together, can be used to infer a conclusion
about something unknown. Circumstantial evidence is usually a theory,
supported by a significant quantity of corroborating evidence.
1 Section 62 of the Indian Evidence Act
2 Section 63 of the Indian Evidence Act
4.3.6 Scientific And Expert Evidence
Section 45 of the Indian Evidence Act defines an expert as one who has
acquired special knowledge, skill or experience in any science, art, trade or
profession; such knowledge may have been acquired by practice or careful
studies. Thus, evidence given by an expert is called expert evidence.
An expert witness or professional witness is a witness, who by virtue
of education, training, skill, or experience, is believed to have knowledge in
a particular subject beyond that of the average person, sufficient that others
may officially (and legally) rely upon the witness's specialized (scientific,
technical or other) opinion about an evidence or fact issue within the scope
of their expertise, referred to as the expert opinion, as an assistance to
the fact-finder. Expert witnesses may also deliver expert evidence about
facts from the domain of their expertise.
4.3.7 Real And Digital Evidence
Real evidence is any material evidence which is objectively or externally
demonstrable and is perceivable in nature. The proliferation of computers
and the influence of information technology in human lives have raised the
need for the admission of digital evidence in judicial proceedings. Real
evidence related to digital transactions is not available, and the only
alternative is the admissibility of digital evidence in Indian courts.
4.4 PARAMETERS FOR EVIDENCE TO BE ADMISSIBLE
Evidence is admissible in a court of law only when it meets certain
established criteria. There is certain established principle which has to be
followed by a court of law while admitting evidence. These are:
4.4.1 Best Evidence Rule
Best evidence means, "The best and topmost form of evidence which can be
produced for verification”3. The Best Evidence Rule requires that the
content of writing be proven by introducing the original4. The rationale
behind this rule is that the original of the document, recording, or
photograph "is the most reliable proof of what the document really said, as
opposed to a copy which can be more easily altered". It is a cardinal rule in
the law of evidence that the best available evidence should be brought before
the court5. Sections 60, 64 and 91 of the Evidence Act are based on this rule.
Section 136 of the Evidence Act empowers a judge to decide as to the
admissibility of evidence, and section 3 deals with admissibility of evidence.
Admissible evidence is the evidence which the trial judge finds is useful in
helping establish fact and which cannot be objected to on the basis that it is
irrelevant, immaterial, or violates the rules against hearsay and other
5 Sk. Siraj v. State of Orissa, (1994) 100 CrLJ 2410 Ori.
objections6. It is the duty of the judge to ensure that the evidence or proof is
confined to the relevant facts and does not exceed beyond the limits of the
issue at trial. The judge is empowered to see that evidence brought on the
record is relevant or not because in a suit, evidence can be given only
regarding those facts which are either facts in issue or are relevant, and of
no others. In order for evidence to be admissible, it must be relevant, without
being prejudicial, and it must have some indicia of reliability.
A fact which is relevant and admissible does not necessarily have to be
construed as a proven fact. The process by which a judge concludes whether
or not a fact is proved is called appreciation of evidence. It is a duty of the
court to appreciate evidence minutely, carefully and to analyze it7. Courts
and tribunals have to judge the evidence before them by applying the test of
4.4.4 Authentication And Presumption
Section 4 and Section’s 79-90A of the Evidence Act deal with provision of
presumptions. Authentication under the Evidence Act is not merely
attestation, but requires that the person authenticating a document
demonstrates the identity of the person who has signed the instrument as
well as the fact of execution. It is useful to set out the presumptions in
relation to electronic documents, as introduced into the Evidence Act by the
provisions of Sch 2 to the IT Act. Section 85 A provides ‘the Court shall
7 Kajal Sen v. State of Assam, AIR 2002 SC 617
8 Commissioner of Income Tax, West Bengal v. Durga Prasad More, AIR 1971 SC 2439
presume that every electronic record purporting to be an agreement
containing the digital signatures of the parties was so concluded by affixing
the digital signatures of the parties’. Section 85 B provides further
presumptions in relation to the use of secure electronic records.
In any proceedings involving a secure electronic record, the Court shall
presume unless contrary is proved, that the secure electronic record has not
been altered since the specific point in time to which the secure status
In any proceedings, involving secure digital signature, the court shall
presume unless the contrary is proved that:
• The secure digital signature is affixed by the subscriber with the
intention of signing or approving the electronic record;
• Except in the case of a secure electronic record or a secure digital
signature, nothing in this section shall create any presumption relating
to authenticity and integrity of the electronic record or any digital
In addition, s 85C provides that the ‘court shall presume, unless contrary is
proved that the information listed in a digital signature certificate is correct,
except for information specified as subscriber information which has not
been verified, if the certificate was accepted by the subscriber,’ and a
presumption of the genuineness of official electronic records is governed by
Provision are made with reference to electronic messages in s 88A of the
Evidence Act, which enables a court to presume that where a sender sends
an electronic message the content of the message is that contained in the
message recorded in the sender’s computer; but there is no corresponding
presumption as to the person by whom such message was sent. Further, s
90A provides presumption as to electronic records that are five years old.
We have dealt with the basic concepts of evidence under the Indian
Evidence Act. Now, let us have an elaboration on the amendments done in
various statutes because of the problems posed by the virtual world.
4.5 CHANGES TO EVIDENCE ACT
Although the Evidence Act has been in force for many years, it has often
been amended to acknowledge important developments. Amendments have
been made to the Evidence Act to introduce the admissibility of both
electronic records and paper-based documents.
The definition of 'evidence' has been amended to include electronic records
(Section 3(a) of the Evidence Act). Evidence can be in oral or documentary
form. The definition of 'documentary evidence' has been amended to include
all documents, including electronic records produced for inspection by the
court. The term 'electronic records' has been given the same meaning as that
assigned to it under the IT Act, which provides for "data, record or data
generated, image or sound stored, received or sent in an electronic form or
microfilm or computer-generated microfiche".
The definition of 'admission' (Section 17 of the Evidence Act) has been
changed to include a statement in oral, documentary or electronic form
which suggests an inference to any fact at issue or of relevance. New Section
22A has been inserted into the Evidence Act to provide for the relevancy of
oral evidence regarding the contents of electronic records. It provides that
oral admissions regarding the contents of electronic records are not relevant
unless the genuineness of the electronic records produced is in question.
4.5.3 Amended Provisions Of The Indian Evidence Act
• S. 17. Admission defined - An admission is a statement, oral or
documentary or contained in electronic form which suggests any
inference as to any fact in issue or relevant fact.
• S. 27. How much of information received from accused may be
proved - When any fact is discovered in consequence of information
received from a person accused of any offence, in the custody of a
police officer, so much of such information, as relates distinctly to the
fact thereby discovered, may be proved.
4.5.4 When Oral Admission As To Contents Of Electronic Records Are
• S. 22A. Oral admissions as to the contents of electronic records are
not relevant, unless the genuineness of the electronic record produced
is in question.
• S. 59. Proof of facts by oral electronic - All facts, except the contents
of documents or electronic records, may be proved by oral evidence.
• S. 39. How much evidence to be given when statement forms part
of electronic record:
• When any statement of which evidence is given forms part of
an electronic record, thenEvidence shall be given of so much and no
more of the electronic record, as the Court considers necessary in
that particular case to the full understanding of the nature and effect
of the statement, and of the circumstances under which it was made.
4.5.5 Opinion As To Digital Signature Where Relevant
• S. 47A. When the Court has to form an opinion as to the digital
signature of any person, the opinion of the Certifying Authority which
has issued the Digital Signature Certificate is a relevant fact.
4.5.6 Proof As To Digital Signature
• S. 67A. Except in the case of a secure digital signature, if the digital
signature of any subscriber is alleged to have been affixed to
an electronic record, the fact that such digital signature is the digital
signature of the subscriber must be proved.
4.5.7 Proof As To Verification Of Digital Signature.
• S. 73A. In order to ascertain whether a digital signature is that of the
person by whom it purports to have been affixed, the Court may
(a) that person or the Controller or the Certifying Authority to produce
the Digital Signature Certificate;
(b) any other person to apply the public key listed in the Digital
Signature Certificate and verify the digital signature purported to
have been affixed by that person.
4.5.8 Statement As Part Of Electronic Record
When any statement is part of an electronic record (Section 39 of the
Evidence Act), the evidence of the electronic record must be given as the
court considers it necessary in that particular case to understand fully the
nature and effect of the statement and the circumstances under which it was
made. This provision deals with statements that form part of a longer
statement, a conversation or part of an isolated document, or statements that
are contained in a document that forms part of a book or series of letters or
4.6 ADMISSIBILITY OF DIGITAL EVIDENCE
New Sections 65A and 65B are introduced to the Evidence Act under the
Second Schedule to the IT Act. Section 5 of the Evidence Act provides that
evidence can be given regarding only facts that are at issue or of relevance.
Section 136 empowers a judge to decide on the admissibility of the
evidence. New provision Section 65A provides that the contents of
electronic records may be proved in accordance with the provisions of
Section 65B. Section 65B provides that notwithstanding anything contained
in the Evidence Act, any information contained in an electronic record (i.e.,
the contents of a document or communication printed on paper that has been
stored, recorded and copied in optical or magnetic media produced by a
computer ('computer output')), is deemed to be a document and is admissible
in evidence without further proof of the original's production, provided that
the conditions set out in Section 65B(2) to (5) are satisfied.
4.6.1 Conditions For The Admissibility Of Digital Evidence
Before a computer output is admissible in evidence, the following
conditions as set out in Section 65(B) (2) must be fulfilled:
"(2) The conditions referred to in subsection (1) in respect of a computer
output shall be the following, namely:
(a) the computer output containing the information was produced by the
computer during the period over which the computer was used
regularly to store or process information for the purposes of any
activities regularly carried on over that period by the person having
lawful control over the use of the computer;
(b) during the said period, information of the kind contained in the
electronic record or of the kind from which the information so
contained is derived was regularly fed into the computer in the
ordinary course of the said activities;
(c) throughout the material part of the said period the computer was
operating properly or, if not, then in respect of any period in which it
was not operating properly or was out of operation during that part
of the period, was not such as to affect the electronic record or the
accuracy of its contents; and
(d) the information contained in the electronic record reproduces or is
derived from such information fed into the computer in the ordinary
course of the said activities.
(3) Where over any period the function of storing or processing
information for the purposes of any activities regularly carried on
over that period as mentioned in clause (a) of subsection (2) was
regularly performed by computers, whether:
(a) by a combination of computers operating over that period;
(b) by different computers operating in succession over that period;
(c) by different combinations of computers operating in succession over
that period; or
(d) in any other manner involving the successive operation over that
period, in whatever order, of one or more computers and one or more
combinations of computers,
all the computers used for that purpose during that period shall be
treated for the purposes of this section as constituting a single
computer and references in this section to a computer shall be
Section 65B (4) provides that in order to satisfy the conditions set out above,
a certificate of authenticity signed by a person occupying a responsible
official position is required. Such certificate will be evidence of any matter
stated in the certificate. The certificate must:
• identify the electronic record containing the statement;
• describe the manner in which it was produced; and
• give such particulars of any device involved in the production of the
electronic record as may be appropriate for the purpose of showing
that the electronic record was produced by a computer.
The certificate must also deal with any of the matters to which the conditions
for admissibility relate.
4.6.2 Societe Des Products Nestle Sa V/S Essar Industries
In this case, the High Court of Delhi has noted that the rapid rise in the field
of information and technology in the last decade of 20th century and the
increasing reliance placed upon electronic record by the world at large
necessitated the laying down of a law relating to admissibility and proof of
electronic record. The legislature responded to the crying need of the day by
inserting into the Evidence Act section 65A and 65B, relating to
admissibility of computer generated evidence in the only practical way it
could so as to eliminate the challenge to electronic evidence.
4.7 AMENDMENTS TO THE BANKER'S BOOK EVIDENCE ACT
The definition of 'banker's book' has been amended to include the printout
of data stored on a floppy disc or any other electro-magnetic device (Section
2(3)). Section 2A provides that the printout of an entry or a copy of a
printout must be accompanied by a certificate stating that it is a printout of
such entry or a copy of such printout by the principal accountant or branch
manager, together with a certificate from a person in charge of the computer
system, containing a brief description of the computer system and the
particulars of its safeguards.
4.8 AMENDMENTS TO THE [INDIAN] PENAL CODE, 1860
A number of offences were introduced under the provisions of the First
Schedule of the IT Act, which amended the Penal Code with respect to
offences for the production of documents that have been amended to include
electronic records. The range of additional offences includes:
• absconding to avoid the production of a document or electronic record
in a court (Section 172 of the Penal Code);
• intentionally preventing the service of summons, notice or
proclamation to produce a document or electronic record in a court
(Section 173 of the Penal Code);
• intentionally omitting to produce or deliver up the document or
electronic record to any public servant (Section 175 of the Penal
• fabricating false evidence by making a false entry in an electronic
record or making any electronic record containing a false statement,
and intending the false entry or statement to appear in evidence in
judicial proceedings (Sections 192 and 193 of the Penal Code);
• the destruction of an electronic record where a person hides or
destroys an electronic record or obliterates or renders illegible the
whole or part of an electronic record with the intention of preventing
the record from being produced or used as evidence (Section 204 of
the Penal Code); and making any false electronic record (Sections 463
and 465 of the Penal Code).
4.9 AUTHENTICATION OF ELECTRONIC RECORDS-DIGITAL
The Indian Information Technology Act, 2000 recognizes electronic
transactions and digital signatures. According to section 3 of the IT Act,
digital signature is the only method9 for authentication of electronic records.
The Digital Signature means the use of asymmetric crypto system and hash
function which envelop and transform the initial record into another
electronic record, and according to section 47 A of the Evidence Act, the
opinion of a certifying authority which has issued a digital signature is a
relevant fact to form an opinion as to the digital signature of any person.
Section 5 of the IT Act provides that where any law requires any document
or information to be authenticated by affixing signature then such
requirement is deemed to have been satisfied if the document or information
has been authenticated by affixing a digital signature. Section 10 of the IT
Act gives power to the government to formulate rules prescribing the type
of digital signature and the manner and format in which the digital signature
shall be affixed.
4.10 RECOGNITION OF ELECTRONIC RECORDS
Section 4 of the IT Act provides for the acceptance of documents in
electronic format, and section 2(1) (r), in defining the term ‘electronic form’,
provides the record can be stored in any format. The IT Act also recognizes
under section 7 that if any law requires that any document, record or
information needs to be retained for a specific period such requirement
9 IT Act does not recognize other means of authentication such as scanned handwritten signatures or signing on a
computer screen using a special pen or the use of Personal Identification Number (PIN) etc.
would be met by retaining the material in electronic form. The attribution of
an electronic record is governed by section 11, which sets out the
presumption that a record will be attributed to the originator if it was sent
by them, under their authority, or if it was sent automatically, and the time
of dispatch is determined under the provisions of section 13. Unless the
mode of acknowledgement of receipt of the electronic record is agreed
between the originator and the addressee, section 12 provides that the
acknowledgement is deemed by any communication by the addressee either
automated or otherwise or by any conduct of the address that sufficiently
indicates to the originator that the addressee has received the electronic
4.11 JURISDICTION ISSUES IN INDIA
Internet transcends national boundaries. The user in cyberspace traverses a
sovereign less region that is not subject to any one state’s exclusive
jurisdiction. The user have only a virtual nexus with each other, so if any
dispute arises then the parties find it very difficult to get the issue resolved
as in Internet jurisdiction it is very tough to establish both the traditional
requirements for determination of jurisdiction which are- the place where
the defendant resides, and the place where the cause of action arose.
4.11.1 Jurisdiction Under The Information Technology Act
Section 61 of the IT Act provides that no court shall have jurisdiction to
entertain any suit or proceeding in respect of any matter which could be
decided by an adjudicating officer or the cyber appellate tribunal under the
IT Act, and that no court or authority shall grant any injunction in respect of
any action taken or to be taken in pursuance of any power conferred by or
under the IT Act.
The Act extends to the whole of India and except as otherwise provided in
the Act itself, it shall also apply to any offence or contravention committed
outside India by any person10. As regards the applicability of this Act to
offences and contraventions, the nationality of accused is irrelevant of the
act or conduct constituting the offence or contravention involves a
computer, computer system or computer network located in India11. Further,
the provisions of this Act have been empowered to have effect
notwithstanding anything inconsistent therewith contained in any other
4.11.2 Jurisdiction For Civil Proceedings
According to section 9 of the Code of Civil Procedure the court shall have
jurisdiction to try all suits of civil nature excepting suits of which their
cognizance is either expressly or impliedly barred.
4.11.3 Jurisdiction In Criminal Cases
Section 4 of the Indian Penal Code states that all offence under the Code,
without any exception, will be extraterritorial and s 188 of the Code of
10 Section 1(2) of the IT Act, 2000
11 Section 75 of the IT Act, 2000
12 Section 81 of the IT Act, 2000
Criminal Procedure confers jurisdiction on the court within whose locality
the accused is found.
An Investigation means a minute enquiry; a scrutiny; a strict examination
and it includes all proceedings for the collection of evidence conducted by
a police officer or by any person other than a Magistrate, who is authorized
by a Magistrate.
Section 78 of the IT Act provides powers to investigate offences.
Notwithstanding anything contained in CrPC, a police officer not below the
rank of Deputy Superintendent of Police is to investigate any offence under
the IT Act. Section 80 of the Act sets out the investigation procedures to be
followed by police officers for investigating offences under the IT Act.
Section 80(1) provides the authority to any police officer not below the rank
of DSP, or any other officer of the Central Government or a State
Government authorized by the Central Government in this behalf, to enter
any place and search and arrest without warrant any person who is
reasonably suspected of having committed, or of committing, or of being
about to commit, any offence under the Act.
Section 81 of the IT Act makes it clear that the provisions of the Act shall
have effect notwithstanding any inconsistency contained in any other law in
force. This implies that conflicting sections of CrPC are not applicable in
respect of the IT Act. Only those provisions of the CrPC that are not
expressly negated by, or contradict the provisions of, the IT Act are
The Central Bureau of Investigation (CBI) set up a special cell for
investigating cyber crimes in March 2000. It is called the Cyber Crime
Investigation Cell (CCIC) and is headed by a Superintendent of Police. This
cell has jurisdiction to investigate cyber crimes across India. Besides the
offences punishable under the IT Act it also has power to investigate other
high tech crimes.
To combat computer-related crimes, the CBI has the following specialized
(i) Cyber Crimes Research and Development Unit (CCRDU);
(ii) Cyber Crime Investigation Cell (CCIC);
(iii) Cyber Forensics Laboratory; and
(iv) Network Monitoring Centre.
The CCRDU is charged with the responsibility of keeping track of the
developments in this ever-growing area. The CCRDU is primarily involved
in the following tasks:-
(a) Liaison with the State Police Forces and collection of information on
cases of Cyber Crime reported to them for investigation and to find
out about the follow-up action in each case;
(b) Liaison with software experts to identity areas, which require
attention of State Police Forces for prevention and detection of such
crimes with a view to train them for the task;
(c) Collection of information on the latest cases reported in other
countries and the innovations employed by Police Forces in those
countries to handle such cases;
(d) Preparation of a monthly Cyber Crime Digest for the benefit of State
Police Forces; and
(e) Maintenance of close rapport with the Ministry of IT, Government of
India and other organizations/Institutions and Interpol Headquarters,.
Lyon for achieving its objective of giving the needed thrust to
collection and dissemination of information on Cyber Crimes.
The CCIC, established in September 1999, started functioning from March
2000. It is a part of the Economic Offences Division. The Cell has all-India
jurisdiction and investigates criminal offences under the Information
Technology Act, 2000, besides frauds committed with the help of
computers, credit card etc. It is also a round-the-clock Nodal Point of contact
for Interpol to report Cyber Crimes in India, and also a member of “Cyber
Crime Technology Information Network System” of Japan.
The Cyber Forensics Laboratory (CFL), established in November 2003,
functions under the Director, Central Forensic Science Laboratory. The
responsibilities of CFL are:
(i) Provide media analysis in support of criminal investigations by CBI
and other Law Enforcement Agencies.
(ii) Provide on-site assistance for computer search and seizure upon
(iii) Provide consultation on investigations or activities in which media
analysis is probable or occurring.
(iv) Provide expert testimony.
(v) Research and Development in Cyber Forensics.
The following principles are followed by the CFL:
(i) The purpose of the analysis shall be to use the evidence in the Court.
(ii) All legal formalities shall be followed.
(iii) The media should have been legally seized and chain of custody
(iv) The analysis shall be on an image of the media and not on the media
(v) The laboratory shall have the best imaging tools and software tools
The purpose of the Network Monitoring Centre is to police the Internet.
It has a Network Monitoring Tool (NMT) developed by I.I.T., Kanpur and
may use similar and other tools to achieve its purpose after following the
4.13 SEARCH AND SEIZURE OF DIGITAL EVIDENCE
In the conventional environment, items are stored in a tangible form that can
be stored physically like information written on paper, bills, receipts,
address, book, etc which are susceptible to damage by physical methods
such as theft, burglary, etc., but in the information age of electronic
environment, data is stored in an intangible form making it a virtual world
where these limitations of conventional methods no longer apply. It also has
no physical boundaries. Hence, criminals seeking information stored in
network computers with dial-in-access can access that information from
virtually anywhere in the world. The quantity of information that can be
stolen or the amount of damage that can be caused by malicious
programming code may be limited only by the speed of the network and the
4.14 RECENT COURT RULINGS
4.14.1 Search And Seizure
State of Punjab v Amritsar Beverages Ltd13 involved a search by the Sales
Tax Department and the seizure of computer hard disks and documents from
13 State of Punjab v Amritsar Beverages Ltd (2006) 7 SCC 607
the dealer's premises. The computer hard disk was seized under the
provisions set out in Section 14 of the Punjab General Sales Tax Act 1948,
which requires authorities to return seized documents within a stipulated
timeframe (Section 14 (3)), provided that the dealer or person concerned is
given a receipt for the property. Section 14 reads as follows:
"14. Production and inspection of books, documents and accounts
(1) The commissioner or any person appointed to assist him under
subsection (1) of section 3 not below the rank of an [Excise and
Taxation Officer], may, for the purpose of the act, require any dealer
referred to in section 10 to produce before him any book, document
or account relating to his business and may inspect, examine and copy
the same and make such enquiry from such dealer relating to his
business, as may be necessary.
Provided that books, documents and accounts of a period more than
five years prior to the year in which assessment is made shall not be
(2) Every registered dealer shall:
(a) maintain day-to-day accounts of his business;
(b) maintain a list of his account books, display it along with his
registration certificate and furnish a copy of such list to the
(c) produce, if so required, account books of his business before the
Assessing Authority for authentication in the prescribed
(d) retain his account books at the place of his business, unless
removed therefrom by an official for inspection, by any official
agency, or by auditors or for any other reason which may be
considered to be satisfactory by the assessing authority.
(3) If any officer referred to in subsection (1) has reasonable ground for
believing that any dealer is trying to evade liability for tax or other
dues under this act, and that anything necessary for the purpose of an
investigation into his liability may be found in any book, account,
register or document, he may seize such book, account, register or
document, as may be necessary. The officer seizing the book, account,
register or document shall forthwith grant a receipt for the same and
(a) in the case of a book, account, register or document which was
being used at the time of seizing, within a period of 10 days from
the date of seizure; and
(b) in any other case, within a period of 60 days from the date of
return it to the dealer or the person from whose custody it was
seized after the examination or after having such copies or
extracts taken therefrom as may be considered necessary,
provided that the dealer or the aforesaid person gives a receipt
in writing for the book, account, register or document returned
to him. The officer may, before returning the book, account,
register or document, affix his signature and his official seal at
one or more places thereon, and in such case the dealer or the
aforesaid person will be required to mention in the receipt given
by him the number of places where the signature and seal of
such officers have been affixed on each book, account, register
(4) For the purpose of subsection (2) or subsection (3), an officer referred
to in subsection (1) may enter and search any office, shop, godown,
vessel, vehicle or any other place of business of the dealer or any
building or place except residential houses where such officer has
reason to believe that the dealer keeps or is, for the time being,
keeping any book, account, register, document or goods relating to
(5) The power conferred by subsection (4) shall include the power to open
and search any box or receptacle in which any books, accounts,
register or other relevant document of the dealer may be contained.
(6) Any officer empowered to act under subsection (3) or subsection (4)
shall have power to seize any goods which are found in any office,
shop, godown, vessel, vehicle or any other place of business or any
building or place of the dealer, but not accounted for by the dealer in
his books, accounts, registers, records and other documents."
This section entitles the officer concerned to affix his or her signature and
seal at one or more places on the seized document and to include in the
receipt the number of places where the signature and seal have been affixed.
In the case at hand, the officers concerned called upon the dealer, but the
dealer ignored their requests.
After examination, the Sales Tax Authority was required to return all
documents seized within 60 days. However, the authority failed to return
the hard disk, claiming that it was not a document. When the matter came
before the Supreme Court, a creative interpretation was adopted, taking into
account the fact that the Punjab General Sales Tax Act was enacted in 1948
when information technology was far from being developed. It was
determined that the Constitution of India is a document that must be
interpreted in light of contemporary life. This meant that a creative
interpretation was necessary to enable the judiciary to respond to
technological developments. The court was permitted to use its own
interpretative principles since Parliament had failed to amend the statute
with regard to developments in the field of science. The court stated that the
Evidence Act, which is part of the procedural laws, should be construed to
be an ongoing statute, similar to the Constitution, which meant that in
accordance with the circumstances, a creative interpretation was possible.
It was held that the proper course of action for officers in such circumstances
was to make copies of the hard disk or obtain a hard copy, affix their
signatures or official seal on the hard copy and furnish a copy to the dealer
or person concerned.
4.14.2 Evidence Recorded On CD
In Jagjit Singh v State of Haryana14 the speaker of the Legislative
Assembly of the State of Haryana disqualified a member for defection.
When hearing the matter, the Supreme Court considered the appreciation of
digital evidence in the form of interview transcripts from the Zee News
television channel, the Aaj Tak television channel and the Haryana News of
Punjab Today television channel. The Supreme Court of India indicated the
extent of the relevance of the digital materials in Paragraph 25 of his ruling:
"The original CDs received from Zee Telefilms, the true translation into
English of the transcript of the interview conducted by the said channel and
the original letter issued by Zee Telefilms and handed over to Ashwani
Kumar on his request were filed on June 23 2004. The original CDs received
from Haryana News channel along with the English translation as above
and the original proceedings of the Congress legislative party in respect of
proceedings dated June 16 2004 at 11.30am in the Committee room of
Haryana Vidhan Sabha containing the signatures of three out of four
independent members were also filed."
In Paragraphs 26 and 27 the court went on to indicate that an opportunity
had been given to the parties to review the materials, which was declined:
"26. It has to be noted that on June 24 2004 counsel representing the
petitioners were asked by the speaker to watch the interviews
conducted in New Delhi on June 14 2004 by Zee News and Haryana
News, which were available on the CD as part of the additional
evidence with the application dated June 23 2004 filed by the
14 Jagjit Singh v State of Haryana (2006) 11 SCC 1
complainant. The counsel, however, did not agree to watch the
recording which was shown on these two channels. The copies of the
application dated June 23 2004 were handed over to the counsel and
they were asked to file the reply by 10am on June 25 2004. In the
replies the petitioners merely denied the contents of the application
without stating how material by way of additional evidence that had
been placed on record was not genuine.
27. It is evident from the above facts that the petitioners declined to watch
the recording, failed to show how and what part of it, if any, was not
genuine, but merely made general denials and sought permission to
cross-examine Ashwani Kumar and the opportunity to lead evidence."
The speaker was required to rule on the authenticity of the digital
recordings, as indicated at Paragraph 30 of the ruling:
"Under these circumstances, the speaker concluded that 'there is no room
for doubting the authenticity and accuracy of the electronic evidence
produced by the petitioner'. The speaker held that:
"In this regard, it is to be noted that the petitioner has produced the original
CDs containing the interviews conducted by Zee News and Haryana News
of the six independent members of the Haryana Vidhan Sabha, including the
respondent, and the same have been duly certified by both television
channels as regards their contents, as well as having been recorded on June
14 2004 at New Delhi. It has also been certified by both television channels
through their original letters (P-9 and P-12) duly signed by their authorized
signatures that the original CDs were handed over to Ashwani Kumar, who
was authorized by the petitioner in this regard and whose affidavit is also
on record as Annexure P-8, wherein he states that he had handed over the
original CDs to the petitioner. The letters, Annexures P-9 and P-12, also
give out that the coverage of their interviews on June 14 2004 was also
telecast by both television channels. In fact, the certificate given by Haryana
News authenticates the place of the interview as the residence of Mr Ahmed
Patel at 23, Mother Teresa Crescent in Delhi, which interview as per the
certificate was conducted by the correspondent of the said television
channel, namely Shri Amit Mishra on June 14 2004. The same certificate,
P-12, also authenticates the coverage of the [Congress Legislative Party]
meeting held in Chandigarh on June 16 2004 conducted by their
correspondent Mr Rakesh Gupta.""
The court determined that the electronic evidence placed on record was
admissible and upheld the reliance placed by the speaker on the recorded
interview when reaching the conclusion that the voices recorded on the CD
were those of the persons taking action. The Supreme Court found no
infirmity in the speaker's reliance on the digital evidence and the
conclusions reached in Paragraph 31 bear repeating in full:
"Undoubtedly, the proceeding before the speaker, which is also a tribunal
albeit of a different nature, has to be conducted in a fair manner and by
complying with the principles of natural justice. However, the principles of
natural justice cannot be placed in a strait-jacket. These are flexible rules.
Their applicability is determined on the facts of each case. Here, we are
concerned with a case where the petitioners had declined to avail of the
opportunity to watch the recording on the compact disc. They had taken
vague pleas in their replies. Even in respect of signatures on the [Congress
Legislative Party] register their reply was utterly vague. It was not their
case that the said proceedings had been forged. The speaker, in law, was
the only authority to decide whether the petitioners incurred or not
disqualification under the Tenth Schedule to the Constitution in his capacity
as speaker. He had obvious opportunity to see the petitioners and hear them
and that is what has been stated by the speaker in his order. We are of the
view that the speaker has not committed any illegality by stating that he had
on various occasions seen and heard these [members of legislative
assembly]. It is not a case where the speaker could transfer the case to some
other tribunal. The doctrine of necessity under these circumstances would
also be applicable. No illegality can be inferred merely on the speaker
relying upon his personal knowledge of having seen and heard the
petitioners for coming to the conclusion that the persons in the electronic
evidence are the same as he has seen and so also are their voices. Thus,
even if the affidavit of Ashwani Kumar is ignored in substance, it would have
no effect on the questions involved."
The comments in this case indicate a trend emerging in Indian courts: judges
are beginning to recognize and appreciate the importance of digital evidence
in legal proceedings.
4.14.3 Admissibility Of Intercepted Telephone Calls
State (NCT of Delhi) v Navjot Sandhu15 was an appeal against conviction
following the attack on Parliament on December 13 2001, in which five
15 State (NCT of Delhi) v Navjot Sandhu, (2005) 11 SCC 600, AIR 2005 SC 3820, 2005 Cri LJ 3950, 122 (2005)
heavily armed persons entered the Parliament House Complex and killed
nine people, including eight security personnel and one gardener, and
injured 16 people, including 13 security men. This case dealt with the proof
and admissibility of mobile telephone call records. While considering the
appeal against the accused for attacking Parliament, a submission was made
on behalf of the accused that no reliance could be placed on the mobile
telephone call records, because the prosecution had failed to produce the
relevant certificate under Section 65B(4) of the Evidence Act. The Supreme
Court concluded that a cross-examination of the competent witness
acquainted with the functioning of the computer during the relevant time
and the manner in which the printouts of the call records were taken was
sufficient to prove the call records.
4.14.4 Examination Of A Witness By Video Conference
State of Maharashtra v Dr Praful B Desai16 involved the question of
whether a witness can be examined by means of a video conference. The
Supreme Court observed that video conferencing is an advancement of
science and technology which permits seeing, hearing and talking with
someone who is not physically present with the same facility and ease as if
they were physically present. The legal requirement for the presence of the
witness does not mean actual physical presence. The court allowed the
examination of a witness through video conferencing and concluded that
16 State of Maharashtra v Dr Praful B Desai (2003) 4 SCC 601.
there is no reason why the examination of a witness by video conferencing
should not be an essential part of electronic evidence.
This Supreme Court decision has been followed in other high court rulings
(e.g., Amitabh Bagchi v Ena Bagchi).17 Recently, the High Court of
Andhra Pradesh in Bodala Murali Krishna v Bodala Prathima18 held that
necessary precautions must be taken to identify the witness and ensure the
accuracy of the equipment being used. In addition, any party wishing to
avail itself of the facility of video conferencing must meet the entire
4.14.5 SMS As Admissible Evidence
One of the pieces of circumstantial evidence sought to be relied by the
prosecution in the Pramod Mahajan Murder Trial, was a threatening
SMS (Short Message Service) sent by Pravin Mahajan (the accused) to
Pramod Mahajan. It emerges from newspaper reports that the defense, (a)
gave a demonstration that a SMS could emanate from a particular
handset/mobile number and when received could display another mobile
number; (b) referred to certain provisions of the Indian Evidence Act, 1872
and stated that the SMS was inadmissible as evidence in Trials since, “only
secured electronic evidence (could) be accepted as valid evidence.”With
17Amitabh Bagchi v Ena Bagchi AIR 2005 Cal 11
18 Bodala Murali Krishna v Bodala Prathima 2007 (2) ALD 72.
regard to the submission that a SMS is inadmissible as valid evidence. In
my opinion that it is incorrect to state that only secured electronic evidence
can be accepted as valid evidence.
Reference here may be had to Section 65B (1) of the Indian Evidence Act,
1872. It states that, “Notwithstanding anything contained in this Act, any
information contained in an electronic record which is printed on a paper,
stored, recorded or copied in optical or magnetic media produced by a
computer (hereinafter referred to as the computer output) shall be deemed
to be also a document, if the conditions mentioned in this section are
satisfied in relation to the information and computer in question and shall
be admissible in any proceedings, without further proof or production of the
original, as evidence of any contents of the original or of any fact stated
therein of which direct evidence would be admissible.” Thus evidence in an
electronic form is admissible under the Indian Evidence Act, 1872. Certain
requirements need to be met under Section 65B (1) if computer outputs are
sought to be adduced as evidence.
Secured electronic evidence merely creates a presumption in favour of the
person adducing it, and shifts the onus of proof to the other party. Refer to
Section 85B which states that, “(1) In any proceedings involving a secure
electronic record, the Court shall presume unless contrary is proved, that the
secure electronic record has not been altered since the specific point of time
to which the secure status relates.”
On an interesting note, the Hon’ble Judge dismissed the defense contentions
on the grounds that (a) the practical demonstration was conducted by
defense witness, P Balakrishnan, on a Motorola handset similar to that of
Pramod, but not Pramod’s phone; and (b) Balakrishnan was “not an expert”
as per law as he doesn’t have the authorized qualifications.
4.14.6 Deleted Files On Hard Disk: Electronic Records
Dharambir v. Central Bureau of Investigation19 The case concerns
prosecution of several accused on the basis of intercepted telephone
conversations. These intercepted communications were stored on hard disks
out of which CD’s were made subsequently. These CD’s contained relevant
conversations out of the entire conversations contained on the hard disks.
The prosecution sought to rely upon these CD’s as evidence against the
accused. The judgment arises out of the accused's petition seeking a mirror
image of the hard disk. The judgment is quite a watershed as it is the first
Indian judgment which elaborately discusses the admissibility of electronic
records and the evidentiary requirements under the Indian Evidence Act.
The judgment significantly notes that, “once a blank hard disc is written
upon it is subject to a change and to that extent it becomes an electronic
record. Even if the hard disc is restored to its original position of a blank
hard disc by erasing what was recorded on it, it would still retain information
which indicates that some text or file in any form was recorded on it at one
time and subsequently removed. By use of software programmes it is
possible to find out the precise time when such changes occurred in the hard
disc. To that extent even a blank hard disc which has once been used in any
manner, for any purpose will contain some information and will therefore
be an electronic record.”
19 Dharambir v. Central Bureau of Investigation 148 (2008) DLT 289.
The Judgment is well reasoned and correctly appreciates the underlying
technology behind the statutory provisions. However, the aforementioned
obiter cannot be treated to be unlimited. It should be noted that data which
is once deleted though present in the hard disk and is retrievable is marked
as available for overwriting by other files. Hence, the original data which
has been deleted will certainly undergo corruption if new data is written on
the same sector in the Hard Disk. This will cause the original data to lose its
authenticity. Hence the observation made by the Hon’ble Judge needs to be
cautiously applied in the future in cases of appreciation of evidence.
4.14.7 Admissibility Of Video Conferencing
State of Maharashtra v. Praful Desai20 In this case, the Supreme Court of
India observed that:
“Section 273 of the Criminal Procedure Code provides for dispensation
from personal attendance. In such cases evidence can be recorded in the
presence of the pleader. The presence of the pleader is thus deemed to be
presence of the accused. Thus section 273 contemplates constructive
presence. This shows that actual physical presence is not a must. This
indicates that the terms ‘presence’ as used in this section, is not used in the
sense of actual physical presence. A plain reading of section 273 does not
support the restrictive meaning sought be placed by the respondent on the
word ’presence’. One must also take note of the definition of the term
‘evidence’ as defined in the Indian Evidence Act. Thus evidence can be both
20 AIR 2003 SC 2053
oral and documentary and electronic records can be produced as evidence.
This means that evidence, even in criminal matters, can also be by way of
electronic records. This would include video conferencing. Recording the
evidence by video conferencing also satisfies the object of providing, in
section 273, that evidence be recorded in the presence of the Accused. The
Accused and his pleader can see the witness as clearly as if the witness is
actually sitting before them. In fact the Accused may be able to see the
witness better than he may have been able to if he was sitting in the dock in
a crowded court room. They can observe his or her demeanor. In fact the
facility to play back would enable better observation of demeanor. They can
hear and rehear the deposition of the witness. The accused would be able to
instruct his pleader immediately and thus cross examination of the witness
is as effective if not better.”
It was observed by the High court of Calcutta in Amitabh Bagchi v. Ena
Bagchi21 that the rationale of the Supreme Court in the above case is that
‘presence’ does not necessarily mean actual physical presence in the court.
Thus, the physical presence of person in court may not be required for the
purpose of adducing evidence. Sections 65A and 65B of the Evidence Act
provide for evidence relating to electronic records and admissibility of
electronic records, and electronic records include video conferencing,
therefore there is no bar to the examination of witnesses by way of video
The potential for ensuring the safety of victims and witnesses through the
use of information technology was recognized by the Supreme Court of
21 AIR 2005 Cal 11
India in the case of Sakshi v.Union of India22 in which the Supreme Court
“The whole inquiry before a court being to elicit the truth, it is absolutely
necessary that the victim or the witnesses are able to depose about the entire
incident in a free atmosphere without any embarrassment. Section 273 of
CrPC merely requires the evidence to be taken in the presence of the
accused. The section, however, does not say that the evidence should be
recorded in such a manner that the accused should have full view of the
victim or the witnesses. Recording of evidence by video conferencing has
already been upheld. Moreover, there is a major difference between
substantive provisions defining crimes and providing punishment for the
same and procedural enactment laying down the procedure of trial of such
offences. Rules of procedure are the handmaiden of justice and are meant
to advance and not to obstruct the cause of justice. It is, therefore,
permissible for the court to expand or enlarge the meanings of such
provisions in order to elicit the truth and do justice with the parties. Thus,
in holding trial of a child sex abuse or rape a screen or some arrangements
may be made where the victim or witnesses (who may be equally vulnerable
like the victim) do not see the body or the face of the accused. Recording of
evidence by way of video conferencing vis-à-vis section 273 CrPC is
4.14.8 Tape Recordings
22 AIR 2004 SC 3566
The Supreme court of India in the case of Ziyauddin Burhanuddin Bukhari
v. brijmohan Ramdass Mehra23 has also observed that tape recorded
speeches constitute a document as defined by s 3 of the Evidence Act, which
stand on the same footing as photographs, and they are admissible in
evidence on satisfying the following conditions:
• the voice of the person alleged to be speaking must be duly identified
by the maker of the record or by others who knew it;
• accuracy of what was actually recorded had to be proved by the maker
of the record and satisfactory evidence, direct or circumstantial, to rule
out possibilities of tampering with the record had to be presented;
• the subject matter recorded had to be shown to be relevant according
to the rules of relevancy found in the Evidence Act.
4.15 G8 PROPOSED PRINCIPLES FOR THE PROCEDURES
RELATING TO DIGITAL EVIDENCE
In March 1998, International Organization on Computer Evidence was
appointed to draw international principles for the procedures relating to
digital evidence, to ensure the harmonization of methods and practices
among nations and guarantee the ability to use digital evidence collected by
one state in the courts of another state.
23 AIR 1975 SC 1788
In March 2000, the first report of IOCE was presented to the subgroup,
proposing a series of definitions and principles, following the International
high-tech crimes and forensics conference in London in October 1999.
After review by the experts of the subgroup, the following recommendations
1. Each member State is encouraged to consider the following principles
when establishing procedures for the collection, preservation and use
of digital evidence, according to its national law and standards bodies,
and to be aware of potential differences when collecting evidence at
the request of other States.
2. These principles should be submitted by IOCE to other national,
regional and international standards making bodies and organizations
responsible for the promotion of procedures relating to digital
evidence for review.
3. IOCE should develop in consultation with the above-mentioned
bodies, a generic good practice guide for the collection, preservation
and use of digital evidence, encompassing the range of existing
sources of digital evidence.
4. The high-tech crime subgroup should review regularly the work of
• When dealing with digital evidence, all of the general forensic and
procedural principles must be applied.
• Upon seizing digital evidence, actions taken should not change that
• When it is necessary for a person to access original digital evidence,
that person should be trained for the purpose.
• All activity relating to the seizure, access, storage or transfer of digital
evidence must be fully documented, preserved and available for
• An Individual is responsible for all actions taken with respect to
digital evidence whilst the digital evidence is in their possession.
• Any agency, which is responsible for seizing, accessing, storing or
transferring digital evidence is responsible for compliance with these
4.16 GENERAL DEFINITIONS RELATING TO DIGITAL
1. Digital Evidence: Information stored or transmitted in binary form
that may be relied upon in court.
2. Original Digital Evidence:- Physical items and those data objects,
which are associated with those items at the time of seizure.
3. Duplicate Digital Evidence :- A duplicate is an accurate digital
reproduction of all data objects contained on the original physical
Copy:- A copy is an accurate reproduction of information contained in the
data objects independent of the original physical item.