Electronic evidence digital evidence in india

Digital or Electronic Evidencein Indian Law or in Indian Courts

Adv. Prashant Mali

Masters in Computer Science(MSc), Masters in Law(LLM),Certified Computer Forensics Professional(CCFP)High Court Lawyer – Mumbai, IndiaSpeaker, Author & Expert in Cyber Law & Cyber SecurityPresident – Cyber Law Consulting(Advocates & Attorneys)

Adv Prashant Mali - Cyber Law Expert ([email protected])

Definition of Evidence..

• The Act amends the definition of ‘Evidence’in Section 3, the interpretation clause of the Indian Evidence Act 1872, to state:

‘Evidence’ means and includes

1) ..

2) All documents including electronic records produced for the inspection of the Court


What is an Electronic Record ?

• According to section 2(t) of the Information Technology Act, 2000 “electronic record” means data, record or data generated, image or sound stored, received or sent in an electronic form or micro film or computer generated micro fiche.


Legal Recognition of electronic records

Section 4 of The IT Act,2000

Where any law provides that information or any other matter shall be in writing or in the typewritten or printed form, then, notwithstanding anything contained in such law, such requirement shall be deemed to have been satisfied if such information or matter is-•a) rendered made available in an electronic form; and•b) accessible so as to be usable for a subsequent reference.


Electronic Evidence(Recent Case Law)

• Mohinder Sharma, a resident of Budhpur in northwest Delhi was Sent to 20 years of Imprisonment and 1.02 Lakhs Penalty was charged.”Electronic Evidence was Relied upon”

• Mohinder Sharma V/S State , Delhi HC

• Surveillance with the help of its unique international mobile equipment identity (IMEI) number and was found being used by Sharma with a different SIM. He had destroyed the original SIM.


Admissibility of Electronic Records• Section 65-B (Admissibility of Electronic Records) –any information contained in an electronic record which is printed on a paper,

stored, recorded or copies in optical or magnetic media produced by a computer (hereinafter referred to as the computer output) shall be deemed to be also a document

– Conditions for admissibility• the computer output containing the information was produced by the

computer during the period over which the computer was used regularly to store or process information for the purposes of any activities regularly carried on over that periodby the person having lawful control over the use of the computer;

• during the said period, information of the kind contained in the electronic record or of the kind from which the information so contained is derived was regularly fed into the computer in the ordinary course of the said activities;

• throughout the material part of the said period, the computer was operating properly or, if not; then in respect of any period in which it was not operating properly or was out of operation during that part of the period, was not such as to affect the electronic record or the accuracy of its contents;

• the information contained in the electronic record reproduces oris derived from such information fed into the computer in the ordinary course of the said activities.

Admissibility of Electronic Records

• Section 65-B (Admissibility of Electronic Records)–Making statements:

In any proceedings where it is desired to give a statement in evidence by virtue of this section, a certificate doing any of the following things, that is to say-

(a)identifying the electronic record containing the statement and describing the manner in which it was produced;

(b)giving such particulars of any device involved in the productionof that electronic record as may be appropriate for the purpose of showing that the electronic record was produced by a computer;

(c)dealing with any of the matters to which the conditions mentioned in sub-section (2) relate,

and purporting to be signed by a person occupying a responsible official position in relation to the operation of the relevant device or the management of the relevant activities (whichever is appropriate)

shall be evidence of any matter sufficient for a matter to be stated to the best of knowledge and belief of the person stating it.


Forensics Labs

• Cyber Forensics Labs where electronic records can be taken for obtaining certificate:

• –3 Labs at Hyderabad including CFSL• –1 Lab at Trivandrum• –1 Lab at CBI, Delhi• –1 Lab at CBI, Navi Mumbai• –1 Lab at Himachal • –1 Lab at Ahemdabad • –1 Lab at Mumbai


Computer Printouts Admissible

• State (NCT of Delhi) v. NavjotSandhu, SAR Gilani& Ors. (AIR 2005 SUPREME COURT 3820)

• It is not in dispute that the information contained in the call records is stored in huge servers which cannot be easily moved and produced in the Court. That is what the High Court has also observed at para 276. Hence, printouts taken from the computers/servers by mechanical process and certified by a responsible official of the service providing Company can be led into evidence through a witness who can identify the signatures of the certifying officer or otherwise speak to the facts based on his personal knowledge. Irrespective of the compliance of the requirements of Section 65B which is a provision dealing with admissibility of electronic records, there is no bar to adducing secondary evidence under the other provisions of the Evidence Act, namely Sections 63 and 65.

• Above all, the printouts pertaining to the call details exhibited by the prosecution are of such regularity and continuity that it would be legitimate to draw a presumption that the system was functional and the output was produced by the computer in regular use, whether this fact was specifically deposed to by the witness or not.

Case Law on Email as evidence

M/s. P. R. Transport Agency v. Union of India (AIR 2006 ALLAHABAD 23)

Thus, the acceptance of the tender, communicated by the respondents to the petitioner by e-mail, will be deemed to be received by the petitioner at Varanasi or Chandauli, which are the only two places where the petitioner has his place of business


IP Address as an Evidence• IP address alone I feel cannot be a conclusive evidence

and I have proved in many cases in lower courts .• Judge Gary Brown in the United States District Court of

the Eastern District of New York adjudged below :• "The assumption that the person who pays for Internet access at a

given location is the same individual who allegedly downloaded a single sexually explicit film is tenuous, and one that has grown more so over time," he writes. "An IP address provides only the location at which one of any number of computer devices may be deployed, much like a telephone number can be used for any number of telephones."

• "Thus, it is no more likely that the subscriber to an IP address carried out a particular computer function – here the purported illegal downloading of a single pornographic film – than to say an individual who pays the telephone bill made a specific telephone call," .


CDR(Call Data Records) as an Evidence• Today Investigation agencies gets paralyzed when a accused

doesn’t use Mobile phone.as the investigation starts majorly around CDR.

• Call Data Records do aid in preliminary investigation but cannot be taken as conclusive evidence because of following problems

1. The mobile handset or SIM could be on someone else name, as written in receipt/invoice.

2. Call Data Records are not certified

3. SIM card was cloned or IMEI number Spoofed(changed)

4. Mobile Number snooping had taken place using S/W

In Bombay Bomb Blast case Sanjay Dutt CDR were admitted and the same were in Parliament Attack case


Case Law on SMS,MMS as EvidenceIn State of Delhi v. Mohd. Afzal & ors,It was held that electronic records are admissible as evidence. If someone challenges the accuracy of a computer evidence or electronic record on the grounds of misuse of system or operating failure or interpolation, then the person challenging it must prove the same beyond reasonable doubt. The court observed that mere theoretical and general apprehensions cannot make clear evidence defective and in admissible. This case has well demonstrated the admissibility of electronic evidence in various forms in Indian courts.


Case Law – Electronic Record

Dharambir vs CBI (pronounced on 11thMarch 2008)• Certain data (i.e. call records) were copied from Hard Disk

to a CD.• Cyber Forensics Lab in Hyderabad confirmed that the

recorded data (i.e. call conversation) on CD were true copies of the originals and that the Hard Disk was in working condition.

• A question came: difference between “electronic device” and “electronic record”.. It was held that if the electronic device has ever recorded any data which is relevant for a case, such “electronic device” shall be treated as “electronic record” for the purpose of evidence.

• Scope of definition of the word “data” was contended and was held that “data” would include active memory as well as subcutaneous memory


Evidence –Bankers’ Books Evidence Act, 1891

• What is permissible as evidence?A “certified copy”of any entry in a banker's book shall in all legal proceedings be received as prima facie evidence of the original entry itself. {Section 4}

• What are banker’s book in electronic form?Any record stored in a micro film, magnetic tape or in any other form of mechanical or electronic data retrieval mechanism, either onsite or at any offsite location including a back-up or disaster recovery site of both. {Section 2(3)}

• How a certified copy of electronic record be obtained?{Section 2(8)}–A copy obtained through mechanical process can be certified if a certificate of the principal accountant or the manager of the bank. –A printout containing a certificate in accordance with Section 2A.


Evidence –Bankers’ Books Evidence Act, 1891

• Nature of certificate for a copy obtained through mechanical process:A certificate from principal accountant or manager of the branch that the mechanical or other process adopted to obtain the copy has ensured the accuracy of the copy.

• Nature of certificate for a copy obtained through mechanical process:Authenticity certificate from principal accountant or branch manager, ANDCertificate from person in-charge of computer system regarding•Details of computer system•Process of data storage•Safeguard to protect computer system and data

• A further certificate from the person in-charge of the computer system to the effect that to the best of his knowledge and behalf, such computer system operated properly at the material time, he was provided with all the relevant data and the printout in question represents correctly, or is appropriately derived from, the relevant data.


Bank Statement as Evidence When accepted

State Bank of India vs. Rizvi Exports Ltd (DRT, Allahabad)

• State Bank of India (SBI) had filed a case to recover money from some persons who had taken various loans from it.

• As part of the evidence, SBI submitted printouts of statement of accounts maintained in SBI’s computer systems.

• The relevant certificates as mandated by the Bankers Books of Evidence Act (as amended by Information Technology Act) had not been attached to these printouts.

• The Court held that these documents were not admissible as evidence.


THANKYOU

Adv. Prashant Mali [BSc.(Phy.), MSc.(Computer Sci.),CCFP,LLM]

President - Cyber Law Consulting

Author, Speaker & Expert

Mob: 09821763157

facebook.com/cyberlawconsultant

Web : www.prashantmali.com

www.cyberlawconsulting.com

[email protected]

http://www.cyberlawconsulting.com/

Education

Electronic evidence digital evidence in india