ELECTRONIC EVIDENCE

i
 LIST OF ABBREVIATIONS

1. ACPO: Association of Chief Police Officers

2. ADGP: Additional Director General of Police
3. ANN: Artificial Neural Networks
4. ANSI: American National Standards Institute
5. ARC: Administrative Reforms Commission
6. ATM: Automated Teller Machine
7. BSI: British Standards Institution
8. CART: Computer Analysis and Response Team
9. CBI: Central Bureau of Investigation
10. CCIC: Cyber Crime Investigation Cell
11. CCRDU: Cyber Crimes Research and Development Unit
12. CCTV: Closed-circuit television
13. CD: Compact Disc
14. CDAC: Centre for Development of Advanced Computing
15. CD-ROM: Comact Disc Read-Only Memory
16. CERT: Computer Emergency Response Team
17. CFSL: Central Forensic Science Laboratory
18. CFTT: Computer Forensics Tools Testing Program
19. CPR: Criminal Procedure Rules (UK)
20. CPU: Central Processing Unit
21. CrPC: Code of Criminal Procedure
22. DEFR: Digital Evidence First Responders

ii
23. DES: Digital Evidence Specialists
24. DNA: Deoxyribonucleic Acid
25. DSCI: Data Security Council of India
26. DVD: Digital Versatile Disc
27. ECPA: Electronic Communications Privacy Act
28. EEE: Examiner of Electronic Evidence
29. FBI: Federal Bureau of Investigation
30. FIR: First Information Report
31. FRE: Federal Rules of Evidence
32. FSL: Forensic Science Laboratory
33. FTK: Forensic Tool Kit
34. GPS: Global positioning system
35. HC: High Court
36. ICT: Information and Communication Technology
37. IEC: International Electro-technical Commission
38. IG: Inspector General
39. IO: Investigating Officer
40. IOCE: International Organization on Computer Evidence
41. IP: Internet Protocol
42. ISO: International Organization for Standardization
43. IT: Information Technology
44. JPEG: Joint Photographic Experts Group
45. MD5: Message Digest 5
46. MHA: Ministry of Home Affairs
47. MS: Microsoft

iii
48. NABL: National Accreditation Board for Testing and Calibration
Laboratories
49. NASSCOM: The National Association of Software and Services
Companies
50. NCRB: National Crimes Record Bureau
51. NFSTC: National Forensic Science Technology Center
52. NICFS: National Institute of Criminology and Forensic Science
53. NIST: National Institute of Standards and Technology
54. NOC: No Objection Certificate
55. PDA: Personal Digital Assistant
56. PIL: Public Litigation Interest
57. RAM: Random Access Memory
58. RTI: Right to Information
59. SC: Supreme Court
60. SHA: Secure Hash Algorithm
61. SMART: Self-Monitoring, Analysis, and Reporting Technology
62. SMART: Self-Monitoring, Analysis, and Reporting Technology
63. SOP: Standard Operating Procedure
64. SWDGE: Scientific Working Group on Digital Evidence
65. SWGDNA: Scientific Working Groups on DNA
66. U.K.: United Kingdom
67. U.S.: United States
68. USA PATRIOT: Uniting and Strengthening America Act by Providing
Appropriate Tools Required to Intercept and Obstruct Terrorism
69. USB: Universal Serial Bus
70. USDOJ: US Department of Justice

iv
71. SD: Secure Digital
72. MMS: Multimedia Messaging Service
73. UNCITRAL: United Nations Commission on International Trade Law
74. VCD: Video Compact Disc
75. CAG: Comptroller and Auditor General
76. DFSL: Delhi Forensic Science Laboratory
77. MPF: Modernization of Police Force
78. RFSL: Regional Forensic Science Laboratory
79.

v
 Index

CHAPTER-1

INTRODUCTION

CHAPTER-2

ELECTRONIC DOCUMENT

CHAPTER-3

IMPORTANCE OF ELECTRONIC EVIDENCE AND APPLICATION OF

FORENSIC SCIENCE IN CRIMINAL INVESTIGATION

CHAPTER-4

HANDLING OF ELECTRONIC EVIDENCE IN CRIMINAL

INVESTIGATION: THE ROLE OF LAW ENFORCEMENT AGENCIES IN
INDIA

CHAPTER 5

ADMISSIBILITY OF ELECTRONIC EVIDENCE AND CHALLENGES

BEFORE THE JUDICIARY

CHAPTER-6

CONCLUSION AND SUGESSTION

vi
 CHAPTER-1

INTRODUCTION

The 21st century saw a technological revolution which enthralled not only India but the whole
world. The use of computers is not limited to established organizations or institutions but
available to every individual at swipe of a finger. Information Technology has eased out almost
every humanized action. In this age of cyber world as the application of computers became more
popular, there was expansion in the growth of technology. The evolution of Information
Technology (IT) gave birth to the cyber space wherein internet provides equal opportunities to
all the people to access any information, data storage, analyse etc. with the use of high
technology. This increasing reliance on electronic means of communications, e-commerce and
storage of information in digital form has most certainly caused a need to transform the law
relating to information technology and rules of admissibility of electronic evidence both in civil
and criminal matters in India. The proliferation of computers and the influence of information
technology on society as whole, coupled with the ability to store and amass information in digital
form have all necessitated amendments in Indian law to incorporate the provisions on the
appreciation of digital evidence. The Information Technology Act, 2000 and its amendment are
based on the United Nations Commission on International Trade Law (UNCITRAL) model Law
on Electronic Commerce. The Information Technology (IT) Act 2000 was amended to allow for
the admissibility of digital evidence. An amendment to the Indian Evidence Act 1872, the Indian
Penal Code 1860 and the Banker's Book Evidence Act 1891 provides the legislative framework
for transactions in electronic world.1

With the change in law, Indian courts have developed case law regarding reliance on electronic
evidence. Judges have also demonstrated perceptiveness towards the intrinsic ‘electronic’ nature
of evidence, which includes insight regarding the admissibility of such evidence, and the
interpretation of the law in relation to the manner in which electronic evidence can be brought
and filed before the court.2 Digital evidence or electronic evidence is any probative information
stored or transmitted in digital form that a party to a court case may use at trial. Before accepting
1
Available at, https://www.linkedin.com/pulse/electronic-evidence-digital-cyber-law-india-adv-prashant-mali-, last
accessed on 15 feb 2017.
2
The Supreme Court of India re-defines admissibility of electronic evidence in India by Tejas Karia, Akhil Anand and
Bahaar Dhawan.

vii
digital evidence it is vital that the determination of its relevance, veracity and authenticity be
ascertained by the court and to establish if the fact is hearsay or a copy is preferred to the
original. Digital Evidence is “information of probative value that is stored or transmitted in
binary form”. Evidence is not only limited to that found on computers but may also extend to
include evidence on digital devices such as telecommunication or electronic multimedia devices.
The e-EVIDENCE can be found in e-mails, digital photographs, ATM transaction logs, word
processing, documents, instant message histories, files saved from accounting programs,
spreadsheets, internet browser histories databases, Contents of computer memory, Computer
backups, Computer printouts, Global Positioning System tracks, Logs from a hotel’s electronic
door locks, Digital video or audio files. Digital Evidence tends to be more voluminous, more
difficult to destroy, easily modified, easily duplicated, potentially more expressive and more
readily available.3In this tech-savvy world, the utilization of computers is not just restricted to
established organizations or institutions but also to every individual at the swipe of a finger.
However, the virtual world unlike the real world creates several opportunities for the commission
of cyber offences which includes phishing, child pornography, identity theft, hacking, etc. As
there is a constant rise in the dependency on electronic means of communications, e-business and
storing of information in digital form, the need for transformation to the law relating to the
information technology as well as rules of admissibility of electronic evidence both in civil and
criminal matters has emanated.3

The term ‘Electronic Evidence’ signifies a piece of evidence generated by some mechanical or
electronic processes which is often relevant in proving or disproving a fact or fact at issue, the
information that constitutes evidence before the court. Electronic Evidence is commonly known
as Digital evidence. The forensics experts or the Examiner of Electronic Evidence have the
ability to recover the data which is stored in electronic devices or systems and after their
examination it can be made admissible before the Court proceedings.

As the electronic records are more vulnerable to alteration, transposition, tampering, excision
etc., without the presence of any such safety measures, it can lead to distortion of justice if the
entire proceeding is based on electronic evidence. The legitimacy of the e-documents being
arguable for the reason that they are susceptible to be tampered with, the agencies which
3
Available at https://www.linkedin.com/pulse/electronic-evidence-digital-cyber-law-india-adv-prashant-mali-, last
accessed on 10 feb 2017.

viii
conducts investigation of such e-documents are struggling with the problem of admissibility of
such electronic evidence.

Accordingly, the Information Technology Act, 2000 which is formulated on the basis of United
Nations Commissions on International Trade (UNCITRAL) Model Law on Electronic
Commerce was amended to allow the admissibility of digital evidence and also brought
amendments to Indian Evidence Act, 1872, the Indian Penal Code, 1860 and the Banker’s Book
Evidence Act, 1891. The amendments carried out in these acts provides the legislative structure
for transactions which take place in the electronic world. In this article, examiner of electronic
evidence in nexus with the other statutory provisions with respect to the admissibility of
electronic evidence has been analyzed.

Examiner of electronic evidence

Section 79A of the Information Technology Act, 2000 has been embodied to deal with the
Examiner of Electronic Evidence. Chapter XIIA of the IT Act enshrines the provision for
highlighting the role of Examiner of Electronic Evidence, as the legislators felt that there is a
necessity for a specialized department, body or agency of the Central Government to provide
expert opinion on electronic form of evidence before any court or other authority.

The Central Government is empowered under Section 79A of the IT Act to notify any
Department, body or agency of the Central Government or a State Government as an Examiner
of Electronic Evidence for the purposes of providing expert opinion on electronic form evidence
before any court or other authority stipulated by notification in the Official Gazette.

Further, the Explanation clause defines the term “Electronic Form Evidence” which means any
information of probative value that is either stored or transmitted in electronic form and includes
computer evidence, digital audio, digital video, cell phones, digital fax machines. This definition
is to be read only for the purpose of this section which is specifically mentioned by the
explanation clause.

In view of the above definition provided to “Electronic Form Evidence”, the Courts can give
permission to use digital evidence such as WhatsApp chats, Social Media chats, browser data,
browser history, digital images, e-mails, word processing documents, contents of hard disk,

ix
databases, Global Positioning System tracks, etc., during the course of civil proceedings or
criminal trials.

Pilot scheme for notifying examiner of electronic evidence u/s 79A of IT Act, 2000

The Ministry of Electronics and Information Technology (MeitY) has developed a scheme for
notifying the Examiner of Electronic Evidence and was launched in January 2017. As per the
Ministry, the objective of the scheme is to ascertain the competence of all the desiring Central
Government or State Government agencies and to qualify them to act as Examiner of Electronic
evidence as per their scope of approval through a formal accreditation process. Once notified,
such Central, State Government agencies can act as the “Examiner of Electronic Evidences”, and
provide expert opinion of digital evidences before any court.

In order to be qualified the Central or State Government agencies have to go through the process
that is used to evaluate whether they are eligible to be appointed as Examiner of Electronic
Evidence. The scheme is formulated in such a way as to assess these agencies, the test of which
includes examination of the technical, skilled professional manpower in digital forensics,
licensed tools and equipment, availability of suitable environment to carry out such evaluation as
also the availability of a proper quality management system and reasonable experience to
demonstrate their overall competency in this area. No individual will be certified as an examiner.

Meaning of electronic evidence

The type of evidence that we are dealing with has been variously described as 'electronic
evidence', 'digital evidence' or 'computer evidence'. The word digital is commonly used in
computing and electronics, especially where physical-world information is converted to binary
numeric form as in digital audio and digital photography.4 Definitions of digital evidence include
'Information of probative value stored or transmitted in binary form; and 'Information stored or
transmitted in binary form that may be relied on in court. While the term 'digital' is too wide, as
we have seen the use of 'binary' is too restrictive, because it only describes one form of data.
Electronic evidence : data (comprising the output of analogue devices or data in digital format)
that is manipulated, stored or communicated by any man-made device, computer or computer
system or transmitted over a communication system, that has the potential to make the factual
4
Electronic Evidence and its Challenges by Dr. Swaroopa Dholam.

x
account of either party more probable or less probable than it would be without the evidence. 5
This definition has three elements. First, it is intended to include all forms of evidence that is
created, manipulated or stored in a product that can, in its widest meaning, be considered a
computer, excluding for the time being the human brain. Second, it aims to include the various
forms of devices by which data can be stored or transmitted, including analogue devices that
produce an output. Ideally, this definition will include any form of device, whether it is a
computer as we presently understand the meaning of a computer; telephone systems, wireless
telecommunications systems and networks, such as the Internet; and computer systems that are
embedded into a device, such as mobile telephones, smart cards and navigation systems. The
third element restricts the data to information that is relevant to the process by which a dispute,
whatever the nature of the disagreement, is decided by an adjudicator, whatever the form and
level the adjudication takes. This part of the definition includes one aspect of admissibility -
relevance only - but does not use 'admissibility' in itself as a defining criteria, because some
evidence will be admissible but excluded by the adjudicator within the remit of their authority, or
inadmissible for reasons that have nothing to do with the nature of the evidence - for instance
because of the way it was collected. The last criteria, however, restricts the definition of
electronic evidence to those items offered by the parties as part of the fact finding process.6

Due to enormous growth in e-governance throughout the Public & Private Sector and
ecommerce activities Electronic Evidence have involved into a fundamental pillar of
communication, processing and documentation. The government agencies are opening up to
introduce various governance policies electronically and periodical filings to regulate and control
the industries are done through electronic means. These various forms of Electronic Evidence/
Digital Evidence are increasingly being used in the judicial proceedings. At the stage of trial,
Judges are often asked to rule on the admissibility of electronic evidence and it substantially
impacts the outcome of civil law suit or conviction/acquittal of the accused. The Court continue
to grapple with this new electronic frontier as the unique nature of evidence, as well as the ease
with which it can be fabricated or falsified, creates hurdle to admissibility not faced with the
other evidences. The various categories of electronic evidence such as CD, DVD, hard disk/
memory card data, website data, social network communication, email, instant chat messages,
5
Ibid
6
Burkhard Schafer and Stephen Mason, The characteristics of electronic evidence in digital format, in Electronic
Evidence, Edited by Stephen Mason, LexisNexis, 2013.

xi
SMS/MMS and computer generated documents poses unique problem and challenges for proper
authentication and subject to a different set of views.7

Electronic evidence and the indian evidence act 1872

The definition of evidence as given in the Indian Evidence Act, 1872 covers a) the evidence of
witness i.e. oral evidence, and b) documentary evidence which includes electronic record
produced for the inspection of the court.8 Section 3 of the Act was amended and the phrase “All
documents produced for the inspection of the Court” was substituted by “All documents
including electronic records produced for the inspection of the Court”. 9 Regarding the
documentary evidence, in Section 59, for the words “Content of documents” the words “Content
of documents or electronic records” have been substituted and Section 65A & 65B were inserted
to incorporate the admissibility of electronic evidence. Traditionally, the fundamental rule of
evidence is that direct oral evidence may be adduced to prove all facts, except documents. The
hearsay rule suggests that any oral evidence that is not direct cannot be relied upon unless it is
saved by one of the exceptions as outlined in sections 59 and 60 of the Evidence Act dealing
with the hearsay rule. However, the hearsay rule is not as restrictive or as straightforward in the
case of documents as it is in the case of oral evidence. This is because it is settled law that oral
evidence cannot prove the contents of a document, and the document speaks for itself. Therefore,
where a document is absent, oral evidence cannot be given as to the accuracy of the document,
and it cannot be compared with the contents of the document. This is because it would disturb
the hearsay rule (since the document is absent, the truth or accuracy of the oral evidence cannot
be compared to the document). In order to prove the contents of a document, either primary or
secondary evidence must be offered.10

While primary evidence of the document is the document itself, it was realized that there would
be situations in which primary evidence may not be available. Thus secondary evidence in the
form of certified copies of the document, copies made by mechanical processes and oral
accounts of someone who has seen the document, was permitted under section 63 of the
7
Infra note 18.
8
Section 3 of the Indian Evidence Act, 1872.
9
The Indian Evidence Act has been amended by virtue of Section 92 of Information Technology Act, 2000.
10
nvar v. Basheer and the New (Old) Law of Electronic Evidence - The Centre for Internet and Society, available at
http://cisindia.org/internetgovernance/blog/anvarvbasheernewoldlawofelectronicevidence last accessed on
10/02/2017.

xii
Evidence Act for the purposes of proving the contents of a document. Therefore, the provision
for allowing secondary evidence in a way dilutes the principles of the hearsay rule and is an
attempt to reconcile the difficulties of securing the production of documentary primary evidence
where the original is not available. Section 65 of the Evidence Act sets out the situations in
which primary evidence of the document need not be produced, and secondary evidence - as
listed in section 63 of the Evidence Act - can be offered. This includes situations when the
original document

 Is in hostile possession.
 Or has been proved by the prejudiced party itself or any of its representatives.
 Is lost or destroyed.
 Cannot be easily moved, i.e. physically brought to the court.
 Is a public document of the state.
 Can be proved by certified copies when the law narrowly permits; and
 Is a collection of several documents.11

Primary and secondary evidence

Primary evidence: Primary evidence means Production of the original electronic record means
the production of the document itself.

Secondary evidence: Production of computer-output of the contents of the electronic record;

Secondary evidence is a certified copy or counterparts of documents which the party is unable to
produce in the court and statement of an expert or person who has himself seen that document.

It is a recognized principle of law that if Primary Evidence is available, it has to be given priority
over Secondary Evidence. Many of the times it is practically impossible to produce primary
evidence in the court because of their storage on hard disks, cloud, big servers and other
electronic data storages, hence, the apex court has permitted secondary evidence.

11
Manisha T. Karia and Tejas D. Karia, ‘India’ (Chapter 13) in Stephen Mason, ed, Electronic Evidence (3rd
edn, LexisNexis Butterworths, 2012).

xiii
That secondary evidence can be taken to the court through print out on paper, copying or storing
on any magnetic or optical media produced by an electric device. But, secondary evidence is
only admissible if it satisfies the conditions preceded u/s 65B Indian Evidence Act.

Electronic records as evidence

The Indian Evidence Act Section 65 specifies the admissibility of secondary evidence in
particular cases. Section 65B specifies the procedure of proving the contents of electronic
records which have been laid down under Section 65B.

Admissibility of electronic records mentioned as per Section 65B of Indian Evidence Act
specifies that the printed any information of electronic records on a paper, or created a copy of
that record on any optical or magnetic media shall also be deemed to be secondary evidence
document if it satisfies the conditions mentioned under section 65B and original source of that
information i.e. electronic device shall also be admissible without any further proof in any
proceeding of the court of law.

Essentially elements of the electronic evidence as per the Indian Evidence Act are as
follows:

Such produced information of electronic records should be produced by the person having
legally authorized to have control over that electronic device.

That storage of information must take place during the day to day general course of the act of
that person.

That stored information has been stored on that electronic device during the day to day general
course of action of that person.

While storing or copying of that material information, the said electronic device must be in a
functioning state, to avoid any possible negative impact on its operation or distort the accuracy &
authenticity of its material contents.

Any kind of storage or copying or making counterpart of the information required for the
production in the court of law as electronic evidence should be free from any kind of distortion

xiv
or manual edit or manipulation, it must be the authentic and trustworthy information, which may
get admitted as evidence in the court of law.

Different types of electronic records

Information Technology Act, 2008 defines electronic records; it covers a wide range of formats
in which data can be produced. DVD, CD, pen drives, telephonic recordings, hard drives, e-
mails, pictures, video recordings, sound recordings, etc. are a few of them. Each of the above
electronic records formats deals with a variety of different conditions relating to their evidentiary
value and admissibility in a court of law.

Evidence in the form of as DVD, CD, Hard-Drive, chip, Memory Chip, Pen Drive:

Above electronic records are admissible as primary as well as secondary evidence. The value
evidence depends on how and in what manner the electronic records have been submitted to the
court i.e. if these electronic records are submitted as it is then those have more value without any
doubt but if you want to submit their copied version on other similar or different device then you
have to comply with the conditions precedent under Sec. 65b of the Indian Evidence Act and get
the certificate for its admission in the court.

Audio and Video Recordings:

These electronic records are admissible if they are submitted in original i.e. original audio or
video recordings are the valid and authentic source of electronic evidence and not the copied
version. Their copied version records on other similar or different device have to comply with
the conditions precedent under Sec 65B of the Indian Evidence Act and get the certificate for its
admission in the court.

Evidence generated through mobile phone in the form of media, calls and email:

Email: It is recognized as a valid and authentic source of evidence. Generally, e-mails are
submitted through print outs attached with the certification of u/s 65B of the Indian Evidence
Act.

Media and calls generated through mobile phone: Nowadays, Mobile phones are very useful
electronic device and very resourceful. It helps from tracing location, capturing videos &

xv
pictures, recording calls to many other electronic resources which aids the judicial and
investigating system to get valuable evidence. Mobile phone’s electronic records are admissible
if they are submitted in original i.e. mobile itself which contains the primary source of media and
calls. Their copied version records on other similar or different device have to comply with the
conditions precedent under sec. 65B of Indian Evidence Act and get the certificate for its
admission in the court.

Leading case laws

Arjun Pandit Rao v. Kailash Kushanrao (July 2020)

Apex court, in a recent judgment, ruled that u/s 65B Indian Evidence Act’s compliance is
essential to admit the electronic record as evidence. The certificate submitted under this
provision constitutes particulars of that electronic records and identity inclusive of authorized
signature of a person having official responsibility in relation to the management and operation
of the relevant device.

Anvar P.V. v. P.K. Basheer And Others (2014)

The Apex Court has given a landmark judgment in this case. It had ruled and helped to resolve
the conflicts judgements of various High Courts on the manner of the admissibility of the
Electronic (record) evidence.

The Supreme Court ruled that secondary data in CD/DVD/Pen Drive are admissible only with
certificate U/s 65B (4) of the Indian Evidence Act. Oral evidence cannot prove the electronic
evidence, certificate U/s 65B is essential to prove that. Also, the opinion of the expert U/s 45A
Indian Evidence Act is not an escaping gate to bypass the procedure of u/s 65b.

Producing the original or its copy or counterpart attached with certificate u/s 65B are the only
optional to prove the electronic evidence as primary or secondary evidence respectively.

Scope of the scheme

When any department, body or agency of the Central Government or a State Government seeks
to be notified as an Examiner of Electronic Evidence, they have to apply by way of submitting an
application as prescribed to the Ministry of Electronics & Information Technology (MeitY),

xvi
Ministry of Communications and Information Technology, Government of India. The scope of
approval will be one or more of disciplines/ areas of activity in the applicant Forensic Science
Laboratories:

 Computer (Media) Forensics;

 Network (Cyber) Forensics;
 Mobile Devices Forensics;
 Digital Video / Image & CCTV Forensics;
 Digital Audio Forensics;
 Device Specific Forensics;
 Digital Equipment / Machines (having embedded firmware);
 Any other.

Moreover, the Pilot Scheme for notifying Examiner of Electronic Evidence issued by the
Ministry of Electronics & Information Technology (MeitY) also consists of the Criteria for
Accreditation, Eligibility Criteria, Procedure for Application, Evaluation and Recommendation,
Notification and validity, Appeals, Fee for application, assessment, certification. For the proper
perusal of the scheme visit the website.

REVIEW OF LITERATURE

Since computer forensics is an emerging and challenging area being a key component in criminal
justice system as far as admissibility of electronic evidence is concerned, researchers from
diverse fields have pondered over the issues and challenges relating to this area. There is no
dearth of literature on issues involving computer forensics. In the absence of a specific
legislation on computer forensics, various research studies have been carried out to address the
legal and technical challenges involving admissibility of electronic evidence in India and other
countries. Few of them are already cited in this research work. Many of the research works have
been able to identify the challenges of computer forensics through analysis of tools and
techniques used to extract evidence to be used in the court. Some of the research studies focus on
the analysis of the traditional rules of evidence without considering the technical challenges
involved in the forensic investigation process, which ultimately justify the inadmissibility of

xvii
such evidence. There are countries like the USA, which have introduced specific laws to handle
electronic evidence and the same has been the subject matter of various research studies.

The focus of some of the research works has been on providing orientation on laws with
reference to cyber-crime and cyber security. Besides, some of them are on purely technical issues
authored by experts from the field of computer science and technology. However, it is hard to
come by any comprehensive research on computer forensic procedure involving law
enforcement agencies, forensic experts and the judiciary from law and policy perspective. A few
examples of the research papers in the area of computer forensics are provided in the following
paragraphs:

Admissibility of electronic evidence:

A Comparative Study Mr. Johanne Gauthier, in his work titled Admissibility of Computer-
generated Evidence: An Overview26, has given a brief overview of existing rules dealing with
the admissibility of computer-generated evidence in Canada as well as in the U.K., Australia and
the United States of America in the light of initiatives taken to foster electronic commerce and
the resulting increased use of electronic data interchanges as well as computer records. Citing
laws and judicial decisions of various countries and highlighting the importance of admissibility
of electronic records in Canada, which is a leader in the field of software and high technology,
the author insists that there should be as little legal impediment as possible to the use and
evolution of electronic commerce in Canada. The existing laws should be able to accommodate
the changing scenario in nature of evidence.

Challenges of Digital Forensic procedures in Cloud Computing

George Grispos, William Bradley Glisson & Tim Storer in Calm before the Storm: The
Emerging Challenges of Cloud Computing12 in Digital Forensics, focus on the challenges in
forensic investigation procedures in cloud computing, a rapidly evolving technological
phenomenon. The paper summarizes the key aspects of cloud computing and analyses how
established digital forensic procedures would be invalidated in this new environment. Several
immediate research agendas are also proposed to begin addressing these new challenges.

12
George grispos et al., calm before the storm: the emerging challenges of cloud computing (2011)

xvii
Denis Reilly, Chris Wren, Tom Berry in Cloud Computing: Pros and Cons for Computer
Forensic Investigations, have considered cloud computing as a notable step change which would
affect future practices in computing and IT. The paper recognizes computer forensics as a
process used largely by law enforcement agencies to acquire digital evidence associated with
some alleged crime or incident. It has also addressed how cloud computing would impact on
computer forensics investigations considering both sides of the argument in terms of pros and
cons associated with cloud computing in relation to computer forensics. The paper concludes that
this impact is yet to be taken up by either party. In other words cloud providers have not yet fully
addressed how they will implement forensic readiness. Similarly, forensic investigators have not
yet put forward procedures for dealing with cloud investigations.

Challenges of admissibility of Scientific Evidence in the US Court System

In Computer Forensics: Meeting the Challenges of Scientific Evidence13, the authors Matthew
Meyers and Marc Rogers explore the three main criteria for admissibility of scientific evidence
in the U.S. Court Systems: reliability, peer review, and acceptability. The current tools used in
the field of computer forensics were compared against these criteria. If the tools do not meet the
requirements, the expert may be restricted from presenting materials from those tools and casting
doubt on the scientific credibility of computer forensics. The ability to determine the reliability
and validity of the tools derived from scientific theory are posited as possible first steps to
increase the likelihood of digital evidence being admissible in the U.S. Court System. A trusted
third party certification model was discussed as one possible approach in addressing some of the
issues raised regarding the current state of computer forensic tools.

According to a paper titled “Computer Forensics”, from a government organization, US-CERT 14,
emphasis must be laid on practice of computer forensics in an effective and legal way. It
promotes the idea that the competent practice of computer forensics and awareness of applicable
laws is essential for today’s networked organizations. Like many other research studies, this
paper also highlights the fact that if system administrators possess the technical skills and ability
to preserve critical information related to a suspected security incident in a forensically sound
manner and are aware of the legal issues related to forensics, they will be a great asset to their
13
Matthew Meyers & Marc Rogers, Computer Forensics: Meeting the Challenges of Scientific Evidence, CERIAS
Tech Report 2005-18, available at https://link.springer.com/chapter/10.1007/0-387-31163-7_4
14
US-CERT, Computer Forensics, available at https://www.us-cert.gov/sites/default/files/publications/forensics.pdf

xix
organization. In a way, it also refers to striking a balance between legal and technical aspects of
computer forensics for better admissibility of evidence before the court.

Sonia Bui, Michelle Enyeart and Jenghuei Luong in their paper titled Issues in Computer
Forensics, have analyzed different perspectives of computer forensics including general steps
(acquisition, authentication and analysis) in forensic investigation, such as forensic analysis on
windows systems, different methods to look for evidence in system files, conducting forensic
investigation on Unix systems, a comparison between the systems, how to enable the investigator
to retrieve data from deleted files that have been overwritten, how to ensure that a record of the
state of the system, which has been compromised, is accurately recorded before it is accidentally
modified, how to look for evidence in system’s logs, repairing the system after being hacked,
compliance of these methods with the Fourth Amendment, reference to USA PATRIOT Act and
relevant cases, where the exception to search warrant requirements applies etc. The authors have
emphasized on the need for the computer forensic investigators to be technically sound when
collecting evidence to ensure that they are not violating any privacy rights. The paper concluded
with a note that the Government agents investigating criminal activities are required to stay
within the law, particularly the regulations of the United States Constitution and all of its
amendments. At the same time, it highlights that as time changes, technology advances, and
criminals find new ways to perpetrate crimes, new developments and statutes are required to
clarify the boundaries of legal investigation. The paper has analyzed in detail various procedures
for locating evidence in a system. However, it falls short of the legal analysis in the context of
admissibility.

Use of Computer Forensics & legal implications: Advantages and Disadvantages

Emily Virtue in the article titled Computer Forensics: Implications for Litigation and Dispute
Resolution15, has provided a brief overview of the legal issues as well as an outline of situations
where the use of computer forensics may be beneficial. The paper has also identified some of the
advantages and disadvantages associated with computer forensics.

Chris Reed and John Angel in their book titled Computer Law32 have dealt with the forensic
issues as a part of the discussion on computer crime. Articles from a few foreign authors have

15
Emily Virtue, Computer Forensics: Implications For Litigation And Dispute Resolution (2003)

xx
contributed a great deal in understanding the approach of the Judiciary and identifying the
loopholes in the legal provisions relating to admissibility of electronic evidence. This also calls
for revisiting the existing legal provisions for addressing the challenges.

Mr. Erin Murphy in his article titled The New Forensics: Criminal Justice, False Certainty and
the Second Generation of Scientific Evidence , discusses about the unprecedented degree of
certainty and reliability in new forensic sciences. At the same time, he does not deny that these
characteristics do not render them less susceptible to misuse. In fact, these new forms of forensic
evidence may actually exacerbate the conditions that first caused traditional forensic sciences to
fall into disrepute. The article challenges the new orthodoxy of forensic science. It explains the
role of forensic evidence in the criminal justice system distinguishing first from the second
generation of forensic sciences.

Research Problem

A majority of cyber-crimes in India remain unreported or evidence found in electronic or digital

devices is overlooked due to sheer ignorance on the part of the complainant and the investigating
agencies. In the absence of scientific evidence and knowledge and proper cyber-crime
investigation, the rate of conviction of cyber-crime has been very low. According to the data on
state-wise disposal of cyber-crime by courts in India (2016) as provided by Indiastat, 92.3%
cases are pending before the courts in India, whereas the rate of conviction as of 2016 was only
27.1%16.

Considering this, the collection and preservation of evidence during investigation has really been
a challenging factor as far as electronic evidence is concerned. On the one hand, there is
advancement of technology, and on the other, crimes are also becoming highly technical in
nature. Computer forensics integrates the fields of computer science and law to investigate
crime. For digital evidence to be legally admissible in court, investigators must follow proper
legal procedures when recovering and analyzing data from computer systems.37 However, it is
also to be kept in mind that even though rigorous and systematic procedures are employed to
have a thorough examination of the computer or other devices in question, computer forensics

16
State-wise Disposal of Cyber-Crime Cases by Courts in India (2016),
INDIASTAT, https://www.indiastat.com/table/crime-and-law-data/6/disposal-of-cyber-crime-cases-by-
court-2002 2016/1123524/1123528/data.aspx (Last visited Feb. 10, 2019)

xxi
requires flexibility and innovative skills on the part of the investigator for handling unusual
situations.

Following are some of the primary obstacles as far as electronic evidence is concerned:

 There is a fundamental difference between the physical world and the digital world as far
as handling of evidence is concerned.
 In a physical world, time, space, identity or physical location cannot be controlled or
amended by agents (human beings) within the environment. On the other hand, the digital
world is one where any single action is virtually independent of time and physical
location. The source of an action is obfuscated. In the digital world, with the appropriate
knowledge, properties such as time, identity and location can be amended.
 Existing forensic tools are inadequate to examine digital evidence contained within some
new technological devices.
 General lack of standardization within the forensics field.
 Lack of evidential integrity due to volatility of digital evidence etc.

Role of investigating agencies

The fundamental principle of admissibility ensures that evidence must be relevant and competent
in order to be admissible before the court. Besides, it must also have a probative value. As far as
relevancy is concerned the rules of relevancy laid down in the Indian Evidence Act, 1872 or any
other traditional rules of evidence. However, with regard to competency of electronic evidence, it
is very often subject to duplication and modification resulting in challenging the integrity of the
evidence itself.40 Hence, special measures should be taken while conducting a forensic
investigation if it is desired for the results to be used in a court of law. Here comes the crucial
role to be played by the investigating agency. One of the most important measures is to ensure
that there is accurate collection of evidence from the scene of crime and therefrom, a clear chain
of custody must be established till the evidence is presented before the court. In other words, the
entire process of collection, preservation, analysis and presentation of evidence must be

xxii
maintained for a chain of custody, which enhances the reliability of the evidence. This is a
safeguard against any possible alteration of electronic evidence during the process.17

In the absence of a concrete computer forensic procedure, the investigating agencies end up
seizing or collecting electronic information inadequately. The forensic experts create images or
cloning of the original electronic record (keeping the original intact), preserve, analyze and
present them. There is no policy or guideline to regulate this process. The experts follow their
internal manual/ guidelines to carry out such procedure. Following may be some of the
challenges involved:

 Lack of uniform forensic procedural rules

 Difficulty in creating forensic images/ cloning
 Possibility of tampering of information
 Handling of various gazettes for forensic procedure
 Problems in decoding encrypted data
 Ignorance among the forensic technical experts about the rules of evidence to be
complied with.
 Failure of the judiciary to appreciate the outcomes of the computer forensic analysis.
Besides, there are a number of tools for collection/ seizure of electronic records available
in the market. Some of these tools are acquired and used by a few law enforcement
agencies. The problem lies in the fact that investigating agency is not sure whether these
are standard tools. Police or investigating agencies are also not aware of their source
codes, making them challengeable in court. Due to lack of technical knowledge, they fail
to counter them before the court. Thus, law relating to electronic evidence is hampered by
the lack of procedures governing the collection, storage and presentation of electronic
evidence for the purposes of criminal proceedings.

Challenges before the Judiciary

It is important to see how the judiciary approaches the question of tampering and alteration. In
the controversial Aarushi Talwar’s murder case, the defense counsel challenged the prosecution
17
See Franklin Witter, Legal Aspects of Collecting and Preserving Computer Forensic Evidence, available at
http://www.giac.org/paper/gsec/636/legal-aspects-collecting-preserving-computer-forensic-evidence/101482
(Last visited Jun. 29, 2018)

xxii
version of CBI that Rajesh Talwar (father and primary accused) was awake on the night of the
crime and had used Internet connection at regular intervals. The defense counsel alleged that CBI
did not provide technical details to the expert who was inconclusive about the use of router,
which could not be substantiated before the court.

On the other hand, in a recent development, in Anvar P.v. P.K. Basheer and others, the Supreme
Court settled the controversies arising from the various conflicting judgments as well as the
practices being followed in the various High Courts and the Trial Courts as to the admissibility
of the Electronic Evidences. The Court has interpreted the Section 22A, 45A, 59, 65A & 65B of
the Indian Evidence Act, 1872 and held that secondary data in CD/DVD/Pen Drive are not
admissible without a certificate under Section 65 B(4) of the Indian Evidence Act. It has been
elucidated that electronic evidence without certificate under Section 65B cannot be proved by
oral evidence and also the opinion of the expert under Section 45A Evidence Act cannot be
resorted to make such electronic evidence admissible.

RESEARCH SCOPE AND OBJECTIVES

There is no doubt about the fact that computer forensic procedure in India is yet to gain visibility
and get streamlined. The country is yet to have cyber-crime investigation best practices. Further,
cyber-crimes investigation capabilities in India are also in a poor state. There is no adequate
infrastructure for dealing with crimes involving technology. This research has been carried out
with the following objectives:

Need to address the challenges faced by the law enforcement agencies in handling electronic
records

One of the primary objectives of the research is to comprehend the procedure followed by the
law enforcement agencies and the challenges encountered by them while handling electronic
evidence. On many occasions, the police do not know how to conduct a proper search in a
computerized environment, particularly in a networked ecosystem. As a result, they lose out on
vital evidence and clues. This leads to acquittal of criminals. The research has focused on some
of these challenges, by incorporating an empirical study of police stations/ cyber cells and
officials equipped with technical expertise and processes adopted by them, to formalize the
procedure relating to handling of electronic records. Another aspect which needs a special and

xxi
urgent attention is the training imparted to the implementing authorities so that the provisions are
adequately enforced.

Understanding of the computer forensic procedure adopted by forensic investigators.

An understanding of the computer forensic procedure adopted by the computer forensic

investigators and experts during handling of electronic evidence is another objective of this
research. Since, there is no policy or guidelines in this regard, it is highly important to assess the
procedure and the challenges involved therein.

Assessment of the preparedness of computer forensic labs

Keeping in mind the alarming rise in the number of computer related crimes in the country, it is
equally important to assess the infrastructure of the computer forensic labs and their
preparedness for handling highly technical electronic records and ensuring admissibility of the
same before the courts.

Identification of the legal requirements for admitting electronic evidence at a criminal trial

The researcher aims to look into the various legal provisions facilitating admissibility of
electronic evidence and evaluate the procedure adopted by the computer forensic experts to
ensure compliance of the forensic procedure with the rules of evidence. Once the evidence
collected, preserved, analyzed and presented before the Court, the judiciary scrutinizes such
evidence based on the rules of evidence. Hence, it is important not only to look into the manuals
used by the police and computer forensic experts, but also to explore the possibility of
streamlining them in the light of the rules of evidence. This may enhance the admissibility of
electronic evidence.

Challenges before the Court – prosecutors and judges

The legality and reliability of evidence are some of the essential requirements that are considered
by the judiciary when deciding on the admissibility of evidence. One of the objectives of the
research was to identify the challenges before the prosecutors and the judges when the electronic
evidence is presented before the court. It is highly unexpected of them to comprehend the

xxv
technicalities of such evidence. Under such circumstances, it is crucial to analyze the trend of the
court in applying the rules of evidence in the cases involving electronic evidence.

Recommending a framework for law enforcement agencies to extract evidence through

computer forensic process

While addressing some of the crucial issues addressed above, the researcher has intended to
make a recommendation of a framework for law enforcement agencies to extract evidence
through a uniform computer forensic process.

HYPOTHESES

After preliminary research through literature review, the researcher holds the following
hypotheses:

 Maintaining the integrity of electronic evidence throughout the process of criminal

investigation is difficult. The law enforcement agencies lack in proper training on
technical and legal issues which further result in failure to handle electronic evidence.
 There is no uniform standard procedure followed by the forensic science laboratories
throughout the country, as a result of which the analysis of electronic evidence varies
from laboratory to laboratory.
 The Judiciary has significantly shaped the law relating to admissibility of electronic
evidence in India.

RESEARCH QUESTIONS

To verify the hypotheses, the researcher lays down certain research questions which she purports
her research to center around. Those questions are as follows:

 To what extent do the requirements of scientific evidence apply to electronic

records/data?
 How does computer forensics facilitate admissibility of electronic evidence?
 How do the Indian Information Technology Act, 2000 and the Evidence Act, 1872 handle
electronic evidence? Are there gaps in the laws in terms of admitting electronic evidence?

xxv
  Do the Indian law enforcement agencies have processes and training in place for
collecting, handling, analyzing electronic evidence? To what extent are they in
compliance with the existing rules governing electronic evidence?
 What are the challenges before the Indian Judiciary in dealing with the question of
tampering and alteration of electronic evidence?
 What is the impact of the developments in computer forensics on court decision and
ruling regarding computer records?
 Is there any need of formulating a uniform and comprehensive computer forensic
procedure to enhance admissibility of electronic evidence?

RESEARCH METHODOLOGY

The researcher has adopted a combination of doctrinal and empirical research to address the
problem identified through an analysis of existing literature. The method of data collection is
through review of literature, both primary and secondary. Emphasis has been placed on various
primary sources – statutes, manuals, guidelines, policies and similar legal documents and court
judgments – national and international have been taken into consideration. Various books,
articles, newspapers and other reports have proved to be invaluable secondary sources of
information. A great deal of reliance has been placed on the Internet materials in acquiring
information. Access to non-open source journals was possible through the medium of various
electronic databases like Manupatra, LexisNexis, Jstor, West Law and Hein Online etc. In
addition to a doctrinal approach, the researcher has also carried out an empirical study to
understand the various stages involving handling of electronic evidence by law enforcement
agencies, forensic laboratories, certifying agencies verifying electronic records and the courts.

Before going ahead with the main study, the researcher had conducted a pilot study on the
functioning of the cyber cell located in Gurugram through an interview with the Officer-in-
Charge of the cell for understanding a crucial aspect of the research i.e. the process of handling
of electronic records by the law enforcement agencies. The study was helpful in drawing a
conclusion as to the feasibility of the research and also addressing the challenges encountered by
the law enforcement agencies in handling electronic records. In continuation to this, the
researcher conducted an empirical study on functioning of cyber cells in Delhi-NCR and Assam.
Apart from the fact that the researcher is based in Delhi-NCR, the primary reason for conducting

xxv
the study in Police Commissionerate, Guwahati, Assam is that during a report on ‘Crimes in
India’ published by National Crimes Records Bureau (NCRB) in 2016, Assam stood top in terms
of cybercrime in the year 2016.49

The researcher also made a visit to the Computer Forensic Unit of Delhi Forensic Science
Laboratory (DFSL) under the Government of Delhi in order to make an assessment of the
organization structure, staff selection process, training and functioning of the unit including the
challenges involved in the computer forensic process right from collection till presentation of
electronic evidence including their preparedness. The visit included interviews with the Deputy
Director, DFSL, Deputy Director, Documents Division, SSO – Documents Division and the
computer forensic experts. In this regard, the researcher has dealt with the functioning of the
Central Forensic Science Laboratory, (CFSL), New Delhi to understand the regulatory
framework/ working procedure/ manual for conducting computer forensic investigation in
computer related crimes. This is worth mentioning that the researcher failed to have an access to
the CFSL situated in New Delhi under Central Bureau of Investigation (CBI) for an empirical
study even though she had visited the laboratory and interacted with some of the staff of
computer forensic unit giving a brief on the objectives of the research in the laboratory.

Therefore, the researcher confined her efforts to understand the functioning of the “Computer
Forensic Unit” at CFSL, New Delhi only to available secondary sources such as the Cyber Crime
Investigation Manual, data available on the website of CFSL and data provided by NCRB etc.

The study also includes interviews with the competent authorities issuing certificate of
admissibility of evidence under Section 65B (4) of the Indian Evidence Act, 1872, prosecutors
and judges dealing with cyber-crime cases. The objective of the study was to facilitate
understanding of the coordination among the three variables i.e. computer forensic procedure,
admissibility of electronic evidence and law enforcement agency. The cyber cells of various
police stations located in Delhi-NCR have been the subject matter of the study. The researcher
has employed a combination of probability and non-probability sampling process in the form of
purposive and random sampling techniques. The reason for adopting a purposive sampling
method to interview experts is that it gives the researcher the opportunity to make use of her own
judgement and to handpick participants that are suitable for this particular research.

xxv
The researcher has also taken recourse to a few case studies through secondary sources to have a
better understanding of the computer forensic techniques followed by various agencies in
specific situations. The objective behind analyzing these case studies is to explore the emerging
area of computer forensics with a techno-legal background and assess the challenging aspects as
far as admissibility of electronic evidence in criminal investigations is concerned.

LIMITATIONS OF THE STUDY

First, the scope of the present study is confined to electronic evidence with regard to criminal
prosecutions. Second, the term ‘criminal investigation’ as incorporated in the title of this thesis
has, undoubtedly, a wide connotation and may be interpreted to include all other investigations
conducted under various special laws relating to criminal offences. Some of the special laws
provide separate investigation procedure for prosecuting criminal offences recognized under
these laws, whereas, in the case of other special laws including Indian Penal Code, 1860, the
investigation procedure laid down in Code of Criminal Procedure, 1973, (hereinafter referred to
as the Code) is followed for investigation of such offences. However, the researcher has confined
the scope of the research to investigation procedure under the Code. Hence, investigation
procedure laid down in the Code is the focus of the present study and the investigating agencies
under other laws do not fall within the purview of the research study.

Thirdly, the researcher has adhered to the provisions of the Code and the Indian Evidence Act,
1872 for considering the reports of scientific experts as evidence in any inquiry, trial or other
proceedings under the Code.

Fourth, the present study is confined to the computer forensic procedure right from identification
of evidence, through collection, preservation analysis and presentation of the same before the
court. Apart from critically analyzing the process, the researcher has also made an effort to look
into the role of various agencies involved in this process.

Since the research is based on technical aspects, and the intersection between law and technology
has been very minimal, or just emerging, it was very essential to consider the technicalities
involved in the digital forensic procedure, which need to comply with the legal standards.

xxi
The researcher intended to confine the study to the Delhi-NCR region as far as understanding the
structure and functioning of cyber cells and forensic science laboratories are concerned.
However, due to lack of access to a few institutions, the researcher failed to conduct the study in
those institutions. The primary reasons for conducting the study in the States of Assam and
Karnataka were that Assam was ranked at the top in the list of States having the highest rate of
cybercrime, and the State of Karnataka being ranked third by the NCRB.

CHAPTER-2

ELECTRONIC DOCUMENT

As documents came to be digitized, the hearsay rule faced several new challenges. While the law
had mostly anticipated primary evidence (i.e. the original document itself) and had created
special conditions for secondary evidence, increasing digitisation meant that more and more
documents were electronically stored. As a result, the abduction of secondary evidence of
documents increased.18 In the Anvar case, the Supreme Court noted that “there is a revolution in
the way that evidence is produced before the court. In India before 2000, electronically stored
information was treated as a document and secondary evidence of these electronic ‘documents’
was adduced through printed reproductions or transcripts, the authenticity of which was certified
by a competent signatory. The signatory would identify her signature in court and be open to
cross examination. This simple procedure met the conditions of both sections 63 and 65 of the

18
Supra note 12.

xxx
Evidence Act. In this manner, Indian courts simply adapted a law drafted over one century
earlier in Victorian England. However, as the pace and proliferation of technology expanded, and
as the creation and storage of electronic information grew more complex, the law had to change
more substantially. Under the provisions of Section 61 to 65 of the Indian Evidence Act, 1872,
the word “Document or content of documents” have not been replaced by the word “Electronic
documents or content of electronic documents”. Thus, the intention of the legislature is explicitly
clear i.e. not to extend the applicability of section 61 to 65 to the electronic record. It is the
cardinal principle of interpretation that if the legislature has omitted to use any word, the
presumption is that the omission is intentional. It is well settled that the Legislature does not use
any word unnecessarily.19 In this regard, the Apex Court in Utkal Contractors & Joinery Pvt. Ltd.
v. State of Orissa18 held that “...Parliament is also not expected to express itself unnecessarily.
Even as Parliament does not use any word without meaning something, Parliament does not
legislate where no legislation is called for. Parliament cannot be assumed to legislate for the sake
of legislation; nor indulge in legislation merely to state what it is unnecessary to state or to do
what is already validly done. Parliament may not be assumed to legislate unnecessarily.”

The IT Act amended section 59 of the Evidence Act, 1872 to exclude electronic records from the
probative force of oral evidence in the same manner as it excluded documents. This is the re-
application of the documentary hearsay rule to electronic records. But, instead of submitting
electronic records to the test of secondary evidence - which, for documents, is contained in
sections 63 and 65, it inserted two new evidentiary rules for electronic records in the Evidence
Act: section 65A and section 65B. The intention of the legislature is to introduce the specific
provisions which has its origin to the technical nature of the evidence particularly as the evidence
in the electronic form cannot be produced in the court of law owing to the size of
computer/server, residing in the machine language and thus, requiring the interpreter to read the
same.20 Section 65A of the Evidence Act creates special law for electronic evidence - The
contents of electronic records may be proved in accordance with the provisions of section
65B.20 This section performs the same function for electronic records that section 61 does for
documentary evidence: it creates a separate procedure, distinct from the simple procedure for
19
E-Evidence in India by Prashanti, available at www.legalservicesindia.com, last accessed on 09/02/2017.
20
Supra note 18.

xxx
oral evidence, to ensure that the adduction of electronic records obeys the hearsay rule. It also
secures other interests, such as the authenticity of the technology and the sanctity of the
information retrieval procedure. But section 65A is further distinguished because it is a special
law that stands apart from the documentary evidence procedure in sections 63 and 65.

Section 65B of the Evidence Act details this special procedure for adducing electronic records in
evidence. Sub-section (2) lists the technological conditions upon which a duplicate copy
(including a print-out) of an original electronic record may be used:

At the time of the creation of the electronic record, the computer that produced it must have been
in regular use,

The kind of information contained in the electronic record must have been regularly and
ordinarily fed in to the computer,

The computer was operating properly; and,

The duplicate copy must be a reproduction of the original electronic record.

The Section 65B of the Evidence Act makes the secondary copy in the form of computer output
comprising of printout or the data copied on electronic/magnetic media admissible. It provides:21
Notwithstanding anything contained in this Act, any information contained in an electronic
record which is printed on a paper, stored, recorded or copied in optical or magnetic media,
produced by a computer shall be deemed to be also a document, if the conditions mentioned in
this section are satisfied in relation to the information and computer in question and shall be
admissible in any proceedings, without further proof or production of the original, as evidence of
any contents of the original or of any fact stated therein of which direct evidence would be
admissible.
Sec. 65B (2)

The computer from which the record is generated was regularly used to store or process
information in respect of activity regularly carried on by a person having lawful control over the
period, and relates to the period over which the computer was regularly used; Information was
fed in computer in the ordinary course of the activities of the person having lawful control over
21
Section 65B provides for ‘Admissibility of Electronic Records’.

xxx
the computer; The computer was operating properly, and if not, was not such as to affect the
electronic record or its accuracy; Information reproduced is such as is fed into computer in the
ordinary course of activity.22

Sec.65 B (3)

The following computers shall constitute as single computer

By a combination of computers operating over that period; or

By different computers operating in succession over that period; or

By different combinations of computers operating in succession over that period; or

In any other manner involving the successive operation over that period, in whatever order, of
one or more

In any other manner involving the successive operation over that period, in whatever order, of
one or more computers and one or more combinations of computers.

Sec. 65B (4)

Regarding the person who can issue the certificate and contents of certificate, it provides the
certificate doing any of the following things: identifying the electronic record containing the
statement and describing the manner in which it was produced; giving the particulars of device,
dealing with any of the matters to which the conditions mentioned in subsection ﴾ 2 ﴿ relate and
purporting to be signed by a person occupying a responsible official position in relation to the
operation of the relevant device or the management of the relevant activities ﴾whichever is
appropriate ﴿ shall be evidence of any matter stated in the certificate and for the purposes of this
subsection it shall be sufficient for a matter to be stated to the best of the knowledge and belief of
the person stating it.23 This contention is further strengthened by the insertion words

22
Section 65 B (2) of the Indian Evidence Act, 1872 lists the technological conditions upon which a duplicate copy
(including a print-out) of an original electronic record may be used.
23
Section 65B (4) of the Evidence Act lists additional non-technical qualifying conditions to establish the
authenticity of electronic evidence. This provision requires the production of a certificate by a senior person who
was responsible for the computer on which the electronic record was created, or is stored. The certificate must
uniquely identify the original electronic record, describe the manner of its creation, describe the device that
created it, and certify compliance with the technological conditions of sub-section (2) of section 65B.

xxx
“Notwithstanding anything contained in this Act” to Section 65A & 65B, which is a non obstante
clause, further fortifies the fact that the legislature has intended the production or exhibition of
the electronic records by Section 65A & 65B only. A non obstante clause is generally appended
to a Section with a view to give the enacting part of the Section, in case of conflict, an overriding
effect over the provision in the same or other act mentioned in the non obstante clause. It is
equivalent to saying that despite the provisions or act mentioned in the non obstante clause, the
provision following it will have its full operation or the provisions embraced in the non obstante
clause will not be an impediment for the operation of the enactment or the provision in which the
non obstante clause occurs. The aforesaid principles of interpretation with respect to the non
obstante clause in form of “Notwithstanding anything contained in this Act” is further supported
by the Hon’ble Apex Court in Union of India and Anr., v. G.M. Kokil and Ors. 24 observed “It is
well known that a non obstante clause is a legislative device which is usually employed to give
overriding effect to certain provisions over some contrary provisions that may be found either in
the same enactment or some other enactment, that is to say, to avoid the operation and effect of
all contrary provisions.” Further, the Hon’ble Apex Court in the case cited as Chandavarkar Sita
Ratna Rao v. Ashalata S. Guram,25 explained the scope of non obstante clause as “It is equivalent
to saying that in spite of the provision of the Act or any other Act mentioned in the non obstante
clause or any contract or document mentioned the enactment following it will have its full
operation".

Non application the special legal provisions

The special law and procedure created by sections 65A and 65B of the Evidence Act for
electronic evidence were not used. Disappointingly, the cause of this non-use does not involve
the law at all.26 India’s lower judiciary - the third tier of courts, where trials are undertaken - is
vastly inept and technologically unsound. With exceptions, trial judges simply do not know the
technology the IT Act comprehends. It is easier to carry on treating electronically stored
information as documentary evidence. The reasons for this are systemic in India and, I suspect,
endemic to poor developing countries. India’s justice system is decrepit and poorly funded. As
long as the judicial system is not modernized, India’s trial judges will remain clueless about
24
Union of India and Anr., v. G.M. Kokil and Ors. [ (1984)SCR196].
25
Chandavarkar Sita Ratna Rao v. Ashalata S. Guram [ (1986) 3SCR866].
26
Prior to 2000 in India, electronically stored information was dealt with as a document, and secondary evidence of
electronic records were adduced as ‘documents’ in accordance with section 63 of the Evidence Act.

xxx
electronic evidence and the means of ensuring its authenticity.27 By bypassing the special law on
electronic records, Indian courts have continued to apply the provisions of sections 63 and 65 of
the Evidence Act, which pertain to documents, to electronically stored information. Simply put,
the courts have basically ignored sections 65A and 65B of the Evidence Act. Curiously, this state
of affairs was blessed by the Supreme Court in Navjot Sandhu (the Parliament Attacks case), 28
which was a particularly high-profile appeal from an emotive terrorism trial. On the question of
the defence’s challenge to the authenticity and accuracy of certain call data records (CDRs) that
the prosecution relied on, which were purported to be reproductions of the original electronically
stored records, a Division Bench of Justice P. Venkatarama Reddi and Justice P. P. Naolekar
held.

According to Section 63, secondary evidence means and includes, among other things, “copies
made from the original by mechanical processes which in themselves ensure the accuracy of the
copy, and copies compared with such copies”. Section 65 enables secondary evidence of the
contents of a document to be adduced if the original is of such a nature as not to be easily
movable. It is not in dispute that the information contained in the call records is stored in huge
servers which cannot be easily moved and produced in the court. That is what the High Court has
also observed at para 276. Hence, printouts taken from the computers/servers by mechanical
process and certified by a responsible official of the service-providing company can be led into
evidence through a witness who can identify the signatures of the certifying officer or otherwise
speak to the facts based on his personal knowledge.2926 Prior to 2000 in India, electronically
stored information was dealt with as a document, and secondary evidence of electronic records
were adduced as ‘documents’ in accordance with section 63 of the Evidence Act.

Electronic evidence and the indian supreme court

In Som Prakash vs. State Of Delhi, 30 the Supreme Court has rightly observed that “in our
technological age nothing more primitive can be conceived of than denying discoveries and
nothing cruder can retard forensic efficiency than swearing by traditional oral evidence only

27
Supra note 12.
28
State (NCT of Delhi) v. Navjot Sandhu (2005) 11 SCC 600.
29
Available at www.cidap.gov.in/.../State_(N.C.T._Of_Delhi)_vs_Navjot_Sandhu@_Afsan_Guru_o., Last accessed
on 11/02/2017.
30
Som Prakash vs. State Of Delhi AIR 1974 SC 989, 1974 Cri. LJ 784, MANU/SC/0213/1974.

xxx
thereby discouraging the liberal use of scientific aids to prove guilt.” Statutory changes are
needed to develop more fully a problem solving approach to criminal trials and to deal with
heavy workload on the investigators and judges. In SIL Import, USA v vs. Exim Aides
Exporters, Bangalore, the Supreme Court held that “Technological advancement like fascimile,
Internet, e-mail, etc. were in swift progress even before the Bill for the Amendment Act was
discussed by Parliament. So when Parliament contemplated notice in writing to be given we
cannot overlook the fact that Parliament was aware of modern devices and equipment already in
vogue.” In State vs. Mohd. Afzal And Ors, the court held that Computer generated electronic
records is evidence, admissible at a trial if proved in the manner specified by Section 65B of the
Evidence Act. In State vs. Navjyot Sandhu the court held that merely because a certificate
containing the details in sub-Section (4) of Section 65B is not filed in the instant case, does not
mean that secondary evidence cannot be given even if the law permits such evidence to be given
in the circumstances mentioned in the relevant provisions, namely Sections 63 & 65. The
Supreme Court’s finding in Navjot Sandhu case raised uncomfortable questions about the
integrity of prosecution evidence, especially in trials related to national security or in high-profile
cases of political importance. The state’s investigation of the Parliament Attacks was shoddy
with respect to the interception of telephone calls. The Supreme Court’s judgment notes in prs.
148, 153, and 154 that the law and procedure of wiretaps was violated in several ways.31

The Evidence Act mandates a special procedure for electronic records precisely because printed
copies of such information are vulnerable to manipulation and abuse. This is what the veteran
defence counsel, Mr. Shanti Bhushan, pointed out in Navjot Sandhu where there were
discrepancies in the CDRs led in evidence by the prosecution. Despite these infirmities, which
should have disqualified the evidence until the state demonstrated the absence of mala fide
conduct, the Supreme Court stepped in to certify the secondary evidence itself, even though it is
not competent to do so. The court did not compare the printed CDRs to the original electronic
record. Essentially, the court allowed hearsay evidence. This is exactly the sort of situation that
section 65B of the Evidence Act intended to avoid by requiring an impartial certificate under
sub-section (4) that also speaks to compliance with the technical requirements of sub-section (2).
When the lack of a proper certificate regarding the authenticity and integrity of the evidence was
pointed out, this is what the Supreme Court said in pr. 150: Irrespective of the compliance of the
31
Supra note 30.

xxx
requirements of Section 65B, which is a provision dealing with admissibility of electronic
records, there is no bar to adducing secondary evidence under the other provisions of the
Evidence Act, namely, Sections 63 and 65. It may be that the certificate containing the details in
sub-section (4) of Section 65B is not filed in the instant case, but that does not mean that
secondary evidence cannot be given even if the law permits such evidence to be given in the
circumstances mentioned in the relevant provisions, namely, Sections 63 and 65.32

In the years that followed, printed versions of CDRs were admitted in evidence if they were
certified by an officer of the telephone company under sections 63 and 65 of the Evidence Act.
The special procedure of section 65B was ignored. This has led to confusion and counter-claims.
For instance, the 2011 case of Amar Singh v. Union of India38 saw all the parties, including the
state and the telephone company, dispute the authenticity of the printed transcripts of the CDRs,
as well as the authorisation itself. Currently, in the case of Ratan Tata v. Union of India, 33 a
compact disc (CD) containing intercepted telephone calls was introduced in the Supreme Court
without following any of the procedure contained in the Evidence Act. In Avnish Bajaj vs.
State,34 the question as to what kind of distinction do we draw between Internet Service Provider
and Content Provider was raised. The burden rests on the accused that he was the Service
Provider and not the Content Provider. It also raises a lot of issues regarding how the police
should handle the cyber crime cases and a lot of education is required.

The trend of ignoring the special procedure prescribed for adducing electronic records as
evidence was seen even in subsequent cases. For example the case of Ratan Tata v. Union of
India was another case where a CD containing intercepted telephone calls was introduced in the
Supreme Court without following the procedure laid down under section 65B of the Evidence
Act. In Anvar vs. Basheer, the court held that Section 65B of the Evidence Act has been inserted
by way of an amendment by the Information Technology Act, 2000. In as much it is a special
provision which governs digital evidence and will override the general provisions with respect to
adducing secondary evidence under the Evidence Act. In 2007, the United States District Court
for Maryland handed down a landmark decision in Lorraine v. Markel American Insurance
Company 241 FRD 534 (D. Md. 2007) that clarified the rules regarding the discovery of

32
Ibid.
33
Ratan Tata v. Union of India Writ Petition (Civil) 398 of 2010.
34
Avnish Bajaj vs. State (Bazee.com case) 2008(105)DRJ 721 MANU/DE/0851/2008.

xxx
electronically stored information. In American federal courts, the law of evidence is set out in the
Federal Rules of Evidence. Lorraine held when electronically stored information is offered as
evidence, the following tests need to be affirmed for it to be admissible:

 Is the information relevant.

 Is it authentic.
 Is it hearsay.
 Is it original or, if it is a duplicate, is there admissible secondary evidence to support it;
and
 Does its probative value survive the test of unfair prejudice?

In a small way, Anvar does for India what Lorraine did for US federal courts. In Anvar, the
Supreme Court unequivocally returned Indian electronic evidence law to the special procedure
created under section 65B of the Evidence Act. It did this by applying the maxim generalia
specialibus non derogant (“the general does not detract from the specific”), which is a
restatement of the principle lex specialis derogat legi generali (“special law repeals general
law”). The Supreme Court held that the provisions of sections 65A and 65B of the Evidence Act
created special law that overrides the general law of documentary evidence. Proof of electronic
record is a special provision introduced by the IT Act amending various provisions under the
Evidence Act. The very caption of Section 65Aof the Evidence Act, read with Sections 59 and
65B is sufficient to hold that the special provisions on evidence relating to electronic record shall
be governed by the procedure prescribed under Section 65B of the Evidence Act. That is a
complete code in itself. Being a special law, the general law under Sections 63 and 65 has to
yield. By doing so, it disqualified oral evidence offered to attest secondary documentary
evidence. The Evidence Act does not contemplate or permit the proof of an electronic record by
oral evidence if requirements under Section 65B of the Evidence Act are not complied with, as
the law now stands in India.35

The scope for oral evidence is offered later. Once electronic evidence is properly adduced
according to section 65B of the Evidence Act, along with the certificate of sub-section (4), the
other party may challenge the genuineness of the original electronic record. If the original

35
Supra note 43.

xxx
electronic record is challenged, section 22A of the Evidence Act permits oral evidence as to its
genuineness only. Note that section 22A disqualifies oral evidence as to the contents of the
electronic record, only the genuineness of the record may be discussed. In this regard, relevant
oral evidence as to the genuineness of the record can be offered by the Examiner of Electronic
Evidence, an expert witness under section 45A of the Evidence Act who is appointed under
section 79A of the IT Act. In Sanjaysinh Ramrao Chavan vs. Dattatray Gulabrao Phalke. 36 The
court relying upon the judgment of Anvar case while considering the admissibility of
transcription of recorded conversation in a case where the recording has been translated, it was
held that as the voice recorder had itself not subjected to analysis, there is no point in placing
reliance on the translated version. Without source, there is no authenticity for the translation.
Source and authenticity are the two key factors for electronic evidence.

In the recent judgment, Jagdeo Singh vs. The State and Ors 37 pronounced by Hon’ble High Court
of Delhi, while dealing with the admissibility of intercepted telephone call in a CD and CDR
which were without a certificate u/s 65B Evidence Act, the court observed that the secondary
electronic evidence without certificate u/s 65B Evidence Act is inadmissible and cannot be
looked into by the court for any purpose whatsoever.

36
Sanjaysinh Ramrao Chavan vs. Dattatray Gulabrao Phalke MANU/SC/0040/2015.
37
Jagdeo Singh vs. The State and Ors. MANU/DE/0376/2015.

xxx
 CHAPTER-3

IMPORTANCE OF ELECTRONIC EVIDENCE AND APPLICATION OF

FORENSIC SCIENCE IN CRIMINAL INVESTIGATION

IMPORTANCE OF EVIDENCE IN CRIMINAL PROSECUTION

Evidence plays a decisive role in the prosecution of a criminal case. In any criminal litigation,
proving or disproving a fact in issue depends upon the evidence produced by the prosecution or
defence. According to Sir Blackstone, ‘Evidence’ signifies that which demonstrates, makes clear
or ascertain the truth of the facts or points in issue either on one side or the other. 38 Whenever a
crime is committed, it is the primary objective of every criminal justice system to deliver justice
to the victim. This may be achieved by taking recourse to the best evidence rule i.e. by producing
the best available evidence without doubting its integrity. Due to lack of evidence or lack of
proper evidence, hard-core criminals are often acquitted or let scot free on the basis of slightest
of doubt. It is the key element in determining the guilt or innocence of a person accused of an
offence. Hence, it is very crucial that the process through which such evidence is collected,
analysed and presented before the court must be established beyond reasonable doubt. Among
the various agencies of criminal justice system, the law enforcement agencies are involved in the
identification, collection, preservation and analysis of evidence relating to criminal cases. When
such evidence is presented before the court, it becomes the responsibility of the court to arrive at
a conclusion as to whether such evidence may be made admissible after applying the rules of
evidence. A judge trying a criminal case has a sacred duty to appreciate the evidence in a
seemingly manner and is not to be governed by any kind of individual philosophy, abstract
concepts, conjectures and surmises and should never be influenced by some observation or
speeches made in certain quarters of the society but not in binding precedents. He should entirely
ostracize prejudice and bias. The bias need not be personal but may be opinionated bias. It is an
obligation to understand the case of the prosecution and the plea of the defence in proper
perspective, address to the points involved for determination and considers the material and
evidence brought on record to substantiate the allegations and record his reasons with sobriety
sans emotion.39
38
WILLIAM MACK & HARVARD P. NASH, CYCLOPEDIA OF LAW AND PROCEDURE 847 (1905
39
Justice Deepak Misra in Omprakash vs. State of Tamil Nadu, 2013 CriLJ 997 (SC)

xl
The judiciary, on many occasions, has highlighted the importance of producing the best
evidence, also known as the ‘best evidence rule’ in any criminal prosecution. The Courts which
decide the question of fact have no personal knowledge about the fact to be decided by them.
They arrive at the findings on the basis of direct evidence of those who have personal knowledge
about the fact in issue or on expert evidence or on documentary evidence if the document is
admissible and duly proved, or on the circumstantial evidence or they decide an issue by drawing
the presumption under a mandatory provision of law and by using the principles as to burden of
proof. Among these several courses available to the Court for giving a finding on the question of
fact, the documentary evidence appears to be the best evidence if the document is admissible and
is duly proved and is capable of proving the fact in question beyond doubt.

Similarly, in another judicial intervention4, the production of best evidence rule was highlighted
by the Court laying down that the party on whom the burden to prove the fact lies, must produce
the best evidence available to it. Therefore, if, in a given case, the testimony of a material
witness may be described as the best evidence in the case, the Courts may insist that such best
evidence must be produced. If for any reason production of the best evidence is not possible. The
only remedy would be to produce next best evidence and in these cases, if the party produces
next best evidence, the Court has to take such next best evidence in consideration and find out
whether the alleged fact has or has not been proved.

In criminal cases, every fact which is used for the purpose of establishing the guilt of the accused
by the prosecution, must be proved beyond reasonable doubt, whatever be the nature of
evidence, be it documentary evidence, oral evidence, circumstantial evidence or by drawing
presumptions according to any mandatory provisions of law.

It is important to note that the outcome of criminal proceedings primarily depends upon the
strength and admissibility of evidence, which include real evidence, scientific evidence, witness
testimony etc.

It is a well-established principle that criminal prosecutions are based on proof beyond reasonable
doubt. Hence, it becomes a challenge for the agencies of criminal justice administration to ensure
the same. The question that often arises is how the judges who were not present at a scene of
crime, and were not eyewitnesses themselves to the event and do not know the credibility or the

xli
accuracy of the witnesses called before them trust that they would make the right decisions on
the liberty of another?6

Thus, it has been observed that the courts have relied upon different types of evidence to finally
conclude any criminal prosecution. Depending upon the type of evidence used, different rules of
evidence have been interpreted by the court from time to time based on law of evidence to arrive
at a conclusion.

NATURE OF LEGAL EVIDENCE

Laws may broadly be classified into two types: substantive and adjective. Substantive law
determines the rights and liabilities of the parties in dispute, whereas, adjective laws deal with
the method of presenting cases to court proving them or enforcing the rights and duties enshrined
under the substantive laws. Law of evidence is categorized under adjective law together with
procedural laws, both criminal and civil. According to Merriam-Webster Dictionary, adjective
law means “the portion of the law that deals with the rules of procedure governing evidence,
pleading, and practice”. According to some scholars, it doesn’t make a lot of difference if the law
of evidence is brought under the category of procedural law. However, there has been a
consensus on categorizing law of evidence as one part of adjective law for the establishing more
effective system of adjudication of cases before the court of law. Although one can see grains of
evidence law in procedural laws, their main dealing is with how pleadings can be framed,
investigation conducted, evidence collected etc. This does not necessarily make the law of
evidence to be part of procedural law.40

As mentioned earlier, evidence and laws regulating it is one of the most significant factors in the
criminal justice system. Every conclusion of the judgment, whatever may be its subject, is the
result of evidence – a word which (derived from words in the dead languages signifying to see,
to know) by a natural transition is applied to denote the means by which any alleged matter of
fact, the truth of which is submitted to investigation, is established or disproved.

Legal evidence may be divided into two broad areas: first, substantive facts that have been
accepted by a court of law for the jury’s consideration (that is, the actual legal evidence); and,
40
Physical evidence is often the most important evidence, THE TRUTH ABOUT FORENSIC SCIENCE,
https://www.thetruthaboutforensicscience.com/physical-evidence-is-often-the-most-important-evidence/ (Last
visited Jan. 16, 2018)

xlii
second, procedural rules, usually termed the law of evidence, that constitute a set of exclusionary
legal requirements or hurdles.41

The nature of proof facilitated by the court may be interpreted in the following two ways: No
inference procedure is laid down by the law for the court to follow. The term evidence is defined
as “any matter of fact, the effect, tendency, or design of which is to produce a persuasion in the
mind of existence or non-existence of some other matter of fact.” Thus, the court is expected to
conclude or infer based on its general perceptions. The advantage of this analysis is that all sorts
of evidence can be considered by the court. On the other hand, the disadvantage is that the way
evidence is presented has an impact on the inferences drawn from the piece evidence. Secondly,
since the court has limited time and resources while dealing with any conflict, the court ends up
accepting the best possible and available evidence, which may not always result in truth. Thus,
each of the parties in dispute develops its strategy in such a way that the discovery and
interpretation of evidence is only aimed at proving its own position, or disproves the other
party’s position, or both.42

STANDARDS OF PROOF

A criminal trial is not a fairy tale wherein one is free to give flight to one’s imagination and
fantasy. Crime is an event in real life and is the product of interplay between different human
emotions. In arriving at a conclusion about the guilt of the accused charged with the commission
of a crime, the court has to judge the evidence by the yardstick of probabilities, its intrinsic worth
and the animus of witnesses. It has been a universally accepted principle in any criminal justice
system that the occurrence of a crime is established by producing relevant evidence for
identifying the perpetrator/s of such crime. To prove something is to minimise uncertainty
involving the facts, circumstances and logical conclusion, or to eliminate some degree of
uncertainty, regarding the truthfulness of the conclusion. Proof is not a uni-dimensional
phenomenon; there are various levels, or standards of proof. The degree of certainty that must be
achieved by the Court in order to accept the truth of a fact is termed the standard of proof. The
two major standards are the criminal standard and civil standard. As far as the criminal matters
are concerned, the standard of proof is ‘beyond reasonable doubt’. Proof beyond a reasonable
41
Morris D. Forkosch, The Nature of Legal Evidence, CALIF. L. REV. 1356 (1971)
42
Legal View of Digital Evidence, FORMAL FORENSICS, available at
http://formalforensics.org/publications/thesis/chapter2.pdf

xlii
doubt is needed in a criminal trial to conclude that the accused is guilty of the crime. With this
level of proof, a judge may have doubt about the guilt of the accused, but that is considered to be
insignificant. Proving a fact beyond reasonable doubt may lead the prosecution to make a strong
pleading for conviction. On the other hand, ‘preponderance of probability’ is the degree of
certainty needed to prove a fact in a civil case. The fact is considered to be true if the evidence
for the fact outweighs evidence against the fact.43

BURDEN OF PROOF

Burden of proof signifies the obligation to prove a fact. It means the duty of establishing the
entire case and it rests all the time on the person who alleges the affirmative i.e. plaintiff in a
civil case and prosecution in a criminal case. In criminal cases, there is a presumption in favour
of innocence of the accused and the burden rests on the prosecution to establish the guilt beyond
reasonable doubt. In other words, which party carries the burden of proof depends on the type of
dispute and on the legislation applied in the case.15 It is only when the accused relies upon some
independent matters of defence or general exceptions that he has to offer evidence in support of
such defence or exception.

CHARACTERISTICS OF EVIDENCE

In an adversarial system, the ultimate aim of adducing evidence is to facilitate the judge arrive at
a rational conclusion regarding a fact in dispute. Therefore, it becomes very important to
determine the evidence to be produced before the judge for him/her to arrive at a conclusion.
There are certain characteristics which are attributed to any evidence to be eligible for production
before the court, such as relevance and admissibility, evidential integrity etc.

The term ‘relevance’ refers to the relationship between evidence and the fact being proved. A
piece of evidence is relevant when it makes the fact in question more or less probable. If the
evidence does not change probability of the fact, the evidence is irrelevant. The weight of
evidence is the measure of how much the evidence changes the probability of the fact. The
relevance and weight of a piece of evidence are determined by the court on the basis of general
knowledge.

43
Ibid

xliv
It has been said that relevance depends on logical considerations and that admissibility depends
on the law. In contrast to civil law, the common law has developed a large number of rules
governing the admissibility of evidence. Relevant evidence is not admissible, for example, if the
witnesses are excluded from testifying because of incompetency, or if they are protected by
privileges against self-incrimination, or in instances in which they would have to divulge
confidential or professional communications that have a privileged status or government secrets,
or, again, when the evidence is excluded by the rules against hearsay.44

Evidential Integrity

The weight of a piece of evidence depends on how probable the evidence is if the fact is true and
on how less probable it is if the fact is false. A piece of evidence that is equally likely to
originate from tampering as from existence of the fact being proved, has no weight in proving
the fact. To preserve the weight of evidence, the possibility of tampering with it must be
minimised. This is called preserving evidential integrity. Evidential integrity is preserved by
handling and examining evidence in ways that do not change it. All handling and examination
must be performed or witnessed by individuals to whom the finder of fact trusts to be objective
and competent to do so. Proving evidence integrity is usually a part of admissibility test. To
prove that no tampering occurred, the history of each piece of evidence is recorded from the
moment it is seized to the moment it is presented in court. This record is called the chain of
custody.

CLASSIFICATION OF EVIDENCE

The main function of rule of evidence is to narrow down the scope of dispute before the court to
the facts relating to that matter which have logical probative value in determining a fact and to
prevent giving judgments based on illogical conclusions or prejudices and as an aid to the
administration of justice. Evidence may be classified in several categories:

44
Evidence, ENCYCLOPEDIA BRITANNICA, https://www.britannica.com/topic/evidence-law (last visited Aug. 12,
2018)

xlv
(a) Direct and indirect evidence or circumstantial evidence

(b) Primary and secondary evidence

(c) Oral and documentary evidence

(d) Real evidence

(e) Expert Evidence

Direct and Indirect Evidence or Circumstantial Evidence

Direct evidence means that the existence of a given thing or fact is proved either by its actual
production or by testimony of someone who has himself perceived it. It proves the existence of
facts in issue without any inference or presumption. Direct evidence is evidence which if
believed establishes a fact in issue. It requires no mental process on the part of the Tribunal of
fact or to draw conclusion sought by proponent of evidence other thank acceptance of evidence
etc.17 Direct evidence consists of either testimony of witnesses who perceived the facts or the
production of documents which constitutes fact which is in question. On the other hand indirect
evidence is that which gives rise to a logical inference that such fact exists. The circumstances of
circumstantial evidence are the evidentiary facts from which the principal fact, with all its details
or components, or some one or more of these details (which are themselves minor principal
facts), are inferred or deduced.45

The Indian courts have also appreciated circumstantial evidence on many occasions. It is a well
settled law that where there is no direct evidence against the accused and the prosecution rests its
case on circumstantial evidence; the inference of guilt can be justified only when all the
incriminating facts and circumstances are found to be incompatible with the innocence of the
accused. In other words, there must be a chain of evidence so complete as not to leave any
reasonable ground for a conclusion consistent with the innocence of the accused and it must be
such as to show that within all human probability, the act must have been done by the accused.
All the links in the chain of circumstances must be complete and should be proved through
cogent evidence.1

45
John Reynolds Gulson, Philosophy Of Proof In Its Relation To The English Law Of Judicial Evidence 171-172 (2012)

xlvi
Primary and Secondary Evidence

Primary evidence, more commonly known as the best evidence or original evidence, is the best
available substantiation of the existence of an object because of its originality. It differs from
secondary evidence, which is a copy of, or substitute for, the original document. If primary
evidence is available to a party, the preference is always given to such evidence. When, however,
primary evidence is unavailable—for example, due to loss or destruction of the original evidence
—through no fault of the party, he or she may present a reliable substitute for it, once its
unavailability is sufficiently established.

Oral and Documentary Evidence

The words which fall from the lips of living witnesses in open Court are oral evidence, whereas,
words written, printed, or carved on any permanent substance, at or before the trial are
documentary evidence.21 When any judgment of any court or any other judicial or official
proceeding, or any contract or grant, or any other disposition of property, has been reduced to the
form of a document or series of documents, no evidence may be given of such judgment or
proceeding, or of the terms of such contract, grant, or other disposition of property, except the
document itself, or secondary evidence of its contents in cases in which secondary evidence is
admissible under the provisions hereinbefore contained.22 Section 60 of the Indian Evidence
Act, 1872 explains oral evidence. Oral evidences are those evidences which are personally seen
or heard by the witness giving them and not heard or told by someone else. All the statements
which are permitted by the court or the court expects the witness to make uch statements in his
presence regarding the truth of the facts, are called as Oral Evidences. On the other hand,
documentary evidence is defined under section 3 of the Act. All those documents which are
presented in the court for inspection regarding a case, such documents are known as
documentary evidences.

Real Evidence

Real evidences are those evidences which are real or material evidences. Real evidence or proof
of a fact is brought to the knowledge of the court by an inspection of a physical object rather than
by deriving information by a witness or a document. Thus, this type of evidence is introduced in
the form of a physical object, either whole or in part. In criminal proceedings, such evidence may

xlvi
consist of blood stains found at the scene of crime, fingerprints, a weapon, DNA samples, marks
of footprints or car tyres at the scene of the crime etc. Such evidence provides leading clues with
regard to any criminal investigation. Many a time, real evidence corroborated with eye witness’s
testimony make the evidence more substantive and credible.

Expert Evidence

It has been an established principle that direct evidence is always considered to be the preferred
and best available evidence in proving a fact before the court of law. The classes of evidence
referred to in the previous paragraphs may, in most of the cases, be readily comprehensible to the
court through the interpretation of laws of evidence. However, with the advancement of science
and technology, new forms of evidence are being produced. Most of them are types of evidence
involving a criminal investigation, which may require expertise and tools to interpret the same.
Expert evidence is used to assist the court when the case before it involves matters on which it
does not have the requisite technical or specialized knowledge about the evidence in hand. In
such cases, opinion of an expert plays a crucial role in admitting evidence before the court.

An expert is a person who has special knowledge related to some specific field, where he has
devoted his time and has experience of the same.23 The Courts in India in plethora of cases,
have described that an expert is someone who has such special knowledge which need not be
imparted by any university. He/she is a person having skill or experience in any science, art,
trade or profession, which has been acquired by practice, observation or careful study and which
is beyond the range of common knowledge. As per the Indian Evidence Act, 1872, the Court has
to form an opinion on the following: foreign law, science, art and identity of handwriting (or
finger impressions). The opinions given on the aforesaid aspects are all relevant and persons who
give these opinions are known as experts. In a nutshell, an expert is someone who is skilled in
any particular field and having special knowledge.46

Justice Cresswell, an English former High Court judge, had laid down the following guidelines
in National Justice Compagnia Naviera SA v. Prudential Assurance Co Ltd [1993] 2 Lloyd’s Rep
68 on expert evidence in terms of its nature, contents and presentation:

46
Himanshu Setia, Evidentiary Value of Forensic Reports in Indian Courts, RES. J. FORENSIC SCI., Vol. 4(6), 1- 7, June
(2016)

xlvi
1) Expert evidence presented to the court is required to be the independent outcome of the
expert uninfluenced as to form or content by the exigencies of litigation.

2) An expert witness should provide independent assistance to the court by way of objective
unbiased opinion in relation to matters within his expertise. An expert witness ... should never
assume the role of advocate.

3) An expert witness should state the facts or assumptions on which his opinion is based. He
should not omit to consider material facts which detract from his concluded opinions.

4) An expert should make it clear when a particular question or issue falls outside his
expertise.

5) If an expert’s opinion is not properly researched because he considers that insufficient

data is available, then this must be stated with an indication that the opinion is no more than a
provisional one.

6) If after exchange of reports, an expert witness changes his view on material matters, such
change of view should be communicated to the other side without delay and when appropriate to
the court.25

Since expert evidence is crucial in matters relating to art, science and any other specialised
knowledge, it is equally important that such evidence is based on authentic sources and methods.
Forensic science, the application of scientific knowledge in legal disputes, is an integral part of
criminal justice system, and has a key role to play in extracting or analysing scientific evidence
before the court. The Indian Judiciary has also relied upon forensic science

ADMISSIBILITY OF SCIENTIFIC EVIDENCE: JUDICIAL APPROACH

On the one hand, use of scientific evidence and application of various scientific methods to
extract evidence in criminal prosecution have, undoubtedly, been facilitating an effective
criminal investigation process; on the other hand, the reliability and admissibility of such
evidence in the court have been a challenge. The development of scientific and technical expert
testimony in the complex and technical issues has flooded the judicial system in the recent times.
At the same time, the question of its reliability and admissibility has also plagued the courts and

xlix
engendered much debate. The issue of admissibility has attracted the attention of countless
commentators. Several articles have explored the subject and offered arguments supporting
greater or lesser barriers to the admissibility of scientific expert evidence. It has been seen in the
past that the expert opinions have only been limited to medical opinions. But now with the
development of forensic science and technology, it has certainly reached to such heights that the
expert evidence is not limited to the medical opinions but also Explanation:- For the purpose of
this section, “Electronic Form of Evidence” means any information of probative value that is
either stored or transmitted in electronic form and includes computer evidence, digital audio,
digital video, cell phones, digital fax machines".

As far as law of evidence is concerned, “opinion” means any inference from observed facts, and
the law on the subject derives from the general rule that witnesses must speak only to that which
was directly observed by them.47 The inferences to any fact or set of facts are drawn by the
judge, whereas, the witness’ role is to state the facts. However, it has been acknowledged by law
that in the matters requiring special knowledge or skill, judges are not necessarily properly
equipped to draw the right inferences from facts stated by witnesses. A witness is, therefore,
allowed to state his opinion with regard to such matters, provided he is expert in them. When it
comes to formulation of an opinion based on special knowledge or skill, forensic science is
exclusively relied upon by the court to arrive at a conclusion. However, the most challenging
part of such expert evidence is the credibility and acceptability of various scientific techniques
on which these opinions are based.

Recent advancements in science and technology have simultaneously led to significant increase
in their actual or potential forensic application in any criminal proceeding. These emerging
principles and techniques are very often taken to the courtroom for verification of facts in issue
or relevant facts. In the process, a trial judge is usually confronted with the question of whether
evidence produced by the new scientific development is admissible. The task of the judge is to
apply an admissibility standard to the proffered evidence in making the admissibility decision.
The admissibility standard functions as the device through which the values of the legal system
are imposed on scientific knowledge and determines the rapidity and readiness with which
scientific information becomes evidence. Thus, the standard has vital evidentiary ramifications.48
47
See Winston McCalla, Expert Evidence, 3 ADVOC. Q. 74 (1981)
48
Mark McCormick, Scientific Evidence: Defining a new Approach to Admissibility 67 IOWA L. REV. 879 (1982)

l
LEGAL STATUS OF SCIENTIFIC EVIDENCE IN INDIA

As mentioned earlier, Section 45 to 51 of the Indian Evidence Act, 1872 provide for relevancy of
opinion of third persons, which is commonly known as expert’s opinion. These provisions are
exceptions to the general rule that evidence is to be given of the facts only which are within the
knowledge of a witness or experienced by the witness himself or herself. The exception is based
on the principle that the court cannot form opinion on the matters, which require technical inputs
from persons having acquired special knowledge and skill on those matters.

As far as legal status of scientific evidence in India is concerned, it revolves around three
questions –

 What is the constitutional validity of the techniques used in extracting scientific

evidence?
 To what extent does the law allow the use of forensic techniques in criminal
investigation?
 What is the evidentiary value of the forensic information analysed by the experts?43

One of the most controversial issues relating to scientific evidence in India is the access to the
person or device that contains the relevant piece of information which may be used as evidence.
One major question raised in many legal disputes before the court is whether any statement of a
witness or the process of collection of any scientific evidence from the possession of a person is
subject to the safeguards under Article 20(3) of the Constitution of India. Clause (3) of Article 20
provides for right against self-incrimination. It provides “No person accused of any offence shall
be compelled to be a witness against himself”. That is, compelling someone to make any
statement which has the tendency to incriminate or expose the person towards any accusation of
an offence, is prohibited under the Constitution. This provision was influenced by the 5th
Amendment of the Constitution of United States that prohibits the state from forcing any person
to produce any sort of evidence that would incriminate that person. This immunity is available to
every person against whom formal accusation has been framed.44 Besides, the provisions
relating to search and seizure with regard to collection of evidence from computer related
devices also have significant implications in upholding the acceptability of such evidence in the
court.

li
Admissibility of scientific evidence has been a debatable issue in India since long especially post
Selvi v. State of Karnataka45, where the Supreme Court expressed the dilemma of admissibility
of scientific evidence in the following words:

“In the context of criminal cases, the reliability of scientific evidence bears a causal link with
several dimensions of the right to a fair trial such as the requisite standard of proving guilt
beyond reasonable doubt and the right of the accused to present a defence. We must be mindful
of the fact that these requirements have long been recognised as components of ‘personal liberty’
under Article 21 of the Constitution. Hence it will be instructive to gather some insights about
the admissibility of scientific evidence.”

ELECTRONIC EVIDENCE IN COMPUTER RELATED CRIMES

With the rapid growth of information and technology all over the world, the nature of criminal
activities has also undergone radical change in the past few decades. Most of the crimes in India
are being committed on the cyberspace using computers as the tool or the target. The term
‘cyberspace’ refers to the virtual world of computer, an electronic medium used to form a global
computer network to facilitate electronic communication. It includes computer, networks, data
storage, software, mobile phones, ATMs etc. In other words, they include anything and
everything which has its roots in technology or is somewhere related to the generic term
‘computer’ and its offshoots.50

In the present scenario, cyberspace is a frequently used term not only by the information
technology experts, but also by the legal fraternity, especially, when it comes to use of
technology in committing crimes. There is no denying the fact that internet has become an
integral part of our daily life.51 However, at the same time, the crime statistics in India reveals
an alarming rise in the rate of computer related crime in India in the recent times. A total number
of 9,622 cybercrime cases were registered in 2014, which went up to 12317 in 2016.49

TYPES OF ELECTRONIC RECORDS AS EVIDENCE

As mentioned earlier, the electronic evidence can be found in different forms, such as e-mails,
digital photographs, ATM transaction logs, documents, instant message histories, files saved
49
NCRB, MIN. OF HOME AFFAIRS,GOV’T OF INDIA, Crime in India 2016,
http://ncrb.nic.in/StatPublications/CII/CII2016/pdfs/Table%209A.1.pdf (last visited Dec. 10, 2017)

lii
from accounting programs, spreadsheets, internet browser histories databases, contents of
computer memory, computer backups, computer printouts, Global Positioning System (GPS)
tracks, digital video or audio files etc. The term ‘electronic record’ has been defined under
section 2(1)(t) of Information Technology Act, 2000 (hereinafter referred to as IT Act) as “data,
record or data generated, image, or sound stored, received or sent in an electronic form or micro
film or computer generated micro fiche.66” Therefore most important factor to be taken into
account to term a thing as electronic record is that it has to be stored, received or sent in an
electronic form or micro film or computer generated micro fiche. The term “electronic form” is
defined under section 2(1) (r) of the IT Act, 2000. Electronic form with reference to information
means “any information generated, sent, received or stored in media, magnetic, optical, computer
memory, micro film, computer generated micro fiche or similar device.”67 Thus, any
information which is stored, sent or received in electronic form is considered to be electronic
record.

With the increasing reliance on computer information, the courts are also under an obligation to
establish a precise definition as to the type of electronic records to be admitted. Computer
records containing text may be divided into two categories: computer-generated records, and
records that are merely computer-stored. The two types of records differ in the fact that the
contents of one are created by a person and that of the other by a machine. Computer-stored
records refer to documents that contain the writings of some person or persons in electronic form
e.g. email messages, word processing files, and Internet chat room messages etc. As applicable
to any other testimony or documentary evidence containing human statements, computer-stored
records must comply with the hearsay rule. If the records are admitted to prove the truth of the
matter they assert, the person presenting the records must show circumstances indicating that the
human statements contained in the record are authentic and trustworthy. On the other hand,
computer-generated records contain the output of computer programs without any human
interventions. Log-in records from Internet service providers, telephone records, and ATM
receipts tend to be computer-generated records. Unlike computer-stored records, computer-
generated records do not contain human “statements”, but only the output of a computer program
designed to process input following a defined algorithm. Finally, a third category of computer
records also exists, which are both computer- generated and computer-stored.50
50
See Cornell Walker, Computer Forensics: Bringing the Evidence to Court 1, 3, INFOSECWRITERS.COM,

liii
LEGAL PROVISIONS RELATING TO ELECTRONIC EVIDENCE

The significant rise in use of computers, the social influence of information technology and the
ability to store information in electronic form have all facilitated Indian law to be amended to
include provisions on the appreciation of electronic evidence. It all started with the passing of the
Information Technology (IT) Act 2000 by the Indian Parliament. This legislation amended the
existing Indian statutes including the Indian Evidence Act, 1872 with regard to incorporation of
electronic records within the purview of ‘evidence’ and rules relating to admissibility of
electronic evidence. The IT Act, 2000 is based on the United Nations Commission on
International Trade Law (UNCITRAL) Model Law on Electronic Commerce and, together with
providing amendments to the Indian Evidence Act 1872, the Indian Penal Code 1860 and the
Banker’s Book Evidence Act 1891, it recognizes transactions that are carried out through
electronic data interchange and other means of electronic communication. The High Court of
Punjab and Haryana in the case of Laddi v. State of Haryana71 ruled the following:

CHAPTER-4

HANDLING OF ELECTRONIC EVIDENCE IN CRIMINAL

INVESTIGATION: THE ROLE OF LAW ENFORCEMENT AGENCIES IN
INDIA

THE CHANGING NATURE OF CRIME: THE PRESENT SCENARIO

In response to a question before Rajya Sabha (Upper House of the Parliament of India) on the
number of cases registered in Delhi in the last two years i.e. 2017 and 2018, and the number of
cases where investigation have been completed, the Minister of State in Ministry of Home
Affairs, Government of India stated that in the year 2018, a total number of 160 cases were

liv
registered by Cyber Crime Cell of Delhi Police out of which investigation was completed only
for 26 cases (up to 30.11.2018).51

With the advancement of science and technology, the application of the same in daily parlance
has also gone up significantly in the last few decades. Consequently, the nature of crimes has
become highly sophisticated and technical in nature. The rise of cyber-crimes and other
traditional crimes involving use of computer and other electronic devices have added to the many
challenges of the law enforcement agencies in India who are the key role players in the entire
criminal investigation process right from collection of evidence till they are produced before the
court. Their role becomes more crucial when the evidence to be collected is intangible in nature
and requires technical knowledge to investigate further, such as dealing with electronic records.
There have been instances in India where the law enforcement agencies have not handled the
collection of electronic evidence in a legally sound environment, which is a crucial component of
cyber forensic exercise. On many occasions, the investigating officials in cyber-crime cells have
expressed their helplessness while dealing with cases requiring highly sophisticated investigation
process. In varieties of cases requiring computer expertise, the officials are forced to rely on
forensic laboratories or private investigators. In most of such cases involving computers, there is
an urgent need for retrieving evidences, which are electronic in nature, from sources like e-mails,
websites, chatrooms, and databases etc. including information stored in laptops, desktops and
mobile phones for immediate intervention.52

In 2015, the conviction rate for offences under the Indian Penal Code, 1860 was only 47%. The
Law Commission of India in its 239th Report (2012) identified poor quality of investigation by
police as one of the primary reasons for low conviction rate of crime in India. As far as
investigations involving technology is concerned, the police has significantly lacked in training
and expertise to meet the demands of the contemporary time. The knowledge of law among these
agencies is very poor due to which they fail to conduct the investigation effectively. In view of
these deficiencies, the Second Administrative Reforms Commission (2007) recommended that
states should have specialised investigation units within the police force for better investigation
of crimes.5
51
Rajya Sabha, Unstarred Question No. 229, https://mha.gov.in/MHA1/Par2017/pdfs/par2018-pdfs/rs- 12122018-
ENG/229.pdf (last visited on Mar. 12, 2019)
52
Delhi cops shop for ‘USB sticks’ to beat porn, Times available at https://www.timesnownews.com (last visited
Nov. 13, 2018)

lv
In December 2015, in the capital city of Delhi, Turkey-based hackers suspected to be working
for the terror outfit Islamic State siphoned off ₹ 6 Crore in Indian currency by sending their own
account numbers to a UK-based firm from the email id of its Delhi-based contractor. Delhi
Police found themselves in a fix during the investigation because they had to examine emails,
email accounts, source and origin of transactions etc. In varieties of criminal cases requiring
technical expertise, the investigating agencies rely on forensic science laboratories. In the cases
mentioned above, evidence was to be retrieved from emails, web pages, chat rooms as well as
from laptops, desktops, mobile phones etc. without any delay. There are numerous instances
where the law enforcement agencies are not well- equipped to handle critical situations relating
to electronic evidence. Such anomalies at the stage of collection of digital evidence ultimately
result in poor admissibility of evidence in the courts and decline in rate of conviction. In the
absence of a concrete computer forensic procedure, the investigating agencies end up seizing or
collecting electronic information inadequately.

There is no doubt about the fact that collection of evidences from the computers and devices
relating to information technology is a challenging job for the police and other investigating
agencies in India. Collection and investigation of evidence from computers requires technical
knowledge and it is unfortunate to note that technical skills are seriously lacking in many of
them.7 Computers and other devices relating to information technology are used as either target
of a criminal act or medium for committing an offense. In today’s world of Internet and
computer networks, a criminal activity may be carried out across national borders with a false
sense of anonymity. In a broader sense, two categories of computer related crimes may be
identified. One is using the computer as a device to commit a crime, and the other is a criminal
act aiming the computer itself resulting in cyber-crime. In both of the cases, the innocence or
guilt of the delinquent individuals is established by testimonies and evidence. In a crime
involving the use of technology, the evidence furnished is also in electronic or digital form.

The collection and preservation of evidence during investigation has really been a challenging
factor as far as electronic evidence is concerned. The most challenging aspect is that unlike any
other traditional or physical evidence, electronic evidence is not visible to the human eye.

lvi
Therefore, scientific techniques must be resorted to in order to interpret such evidence. At times,
the accuracy of such evidence may be determined only with the intervention of an expert.53

Growing Importance Of Electronic Evidence: The Role Of Computer Forensics

The twenty first century has witnessed a radical change in the field of Information Technology
resulting in increasing activities on cyber space wherein internet provides equal access to any
information. This increasing reliance on electronic means of communications

has led to misuse of information on cyber space in the form of cyber-crimes or any other
traditional crimes using computers. Today, almost every crime has an electronic component as a
result of which the importance of electronic evidence has also gone up significantly.

As mentioned in the previous chapter on electronic evidence, such experiences have clearly
pointed towards the fact that maintaining the integrity of electronic evidence throughout the
process of investigation and trial is difficult when it is compared to the handling of traditional,
physical or documentary evidence. Unlike other physical evidence, electronic evidence has
certain characteristics due to which unique challenges are being encountered during the process
of admitting such evidence before the court of law. First of all, electronic or digital evidence is
not visible to human eye; therefore, specific tools and technology need to be adopted to use such
evidence in any court. Secondly, such evidence, being fragile in nature, is easily subject to
alteration. Subsequently, it fails to meet the basic standards of admissibility as far as rules of
evidence are concerned. Thirdly, it requires specific tools and technology to collect, preserve and
analyse such evidence. In other words, expert testimony is relied upon to admit electronic
evidence in court of law.54

Electronic evidence is not only limited to that found on computers but may also extend to include
evidence on digital devices such as telecommunication or electronic multimedia devices. More
particularly, they may be found in the form of e-mails, digital photographs, ATM transaction
logs, documents, instant message histories, internet browser histories databases, compact discs,
53
See generally Deepak Bade, Cyber Forensics & Electronic Evidences: Challenges In Enforcement & Their
Admissibility, ACADEMIA.EDU, available at
https://www.academia.edu/3831495/Cyber_Forensics_and_Electronic_Evidences_Challenges_In_Enforcement_a
nd_Their_Admissibility
54
National Forensic Science Technology Center, Crime Scene Investigation, A Guide for Law Enforcement 114
(2013)

lvii
DVDs, Global Positioning System tracks, Digital cameras, memory sticks and memory/SIM
cards, PDAs, cell phones etc. They tend to be more voluminous, more difficult to destroy, easily
modified, easily duplicated, potentially more expressive and more readily available.11

Increasing reliance on evidence extracted from computer systems to bring about convictions has
led to emergence of a new means of scientific investigation i.e. computer forensics. Forensic
science facilitates the application of principles of physical sciences in legal matters to deliver
justice in the society. Computer forensics is an emerging area of forensic science dealing with
evidence located in computers and related electronic storage media. It is an integration of
computer science and law for effective investigation of crime. The forensic experts are
responsible for creating images or cloning of the original electronic data, preserve, analyse and
present the same before the court of law for the judiciary to come to a conclusion. Computer
forensics, also termed as ‘digital forensics’, has existed for as long as people have stored data
inside the computers.12 It is an area of study which is concerned with the identification,
extraction and analysis of digital data. As an emerging area of science, computer forensics has
become an integral part of scientific extraction of electronic evidence, which could not have been
recovered otherwise, such as e-mail communications, text messages and access to files
containing documents.

Fundamental Principles Of Electronic/ Digital Evidence

Handling of electronic or digital evidence at the crime scene is one of the most crucial aspects of
a criminal investigation involving computer-related crimes. The process usually includes the
recognition, identification, seizure, and securing of all electronic evidence at the scene, proper
documentation of the scene of crime, collection and preservation of evidence and finally,
packaging and transportation of the same for further forensic examination.55

The foundation of any case involving electronic or digital evidence lies in the principles
mentioned below:

55
Supra Note 10, at 115

lvii
Principle 1 – The law enforcement agencies must take utmost care in collecting evidence from
any electronic device and ensure that data contained therein remain unchanged, so that the same
may be relied upon by the court.

Principle 2 - In case of urgent need for accessing original data held on a computer or any storage
media, the person accessing the same must be competent to do so and explain the relevant
evidence and its implications.

Principle 3 – There is a need to create and preserve the audit trail or other processes relating to
the computer based evidence. An independent third party should be able to examine those
processes and arrive at the same result.

Principle 4 - The investigating officer has the overall responsibility to ensure that the rules of
evidence and these principles are adhered to.

Computer-based electronic evidence is subject to the same rules and laws that apply to
documentary evidence. While producing such evidence, it is essential to demonstrate the manner
in which the evidence has been recovered, showing each stage of obtaining such evidence.
Evidence should be preserved to such an extent that a third party is able to repeat the same
process and arrive at the same result as that presented to a court.

Investigation Of Computer-Related Crimes And Handling Of Electronic Evidence

Role of Investigation in Criminal Proceedings

Investigation has a vital role to play in the criminal justice delivery process. The primary
objective of a criminal trial is to provide justice for all i.e. the accused, the victim of the crime
and the society. The acquittal and conviction of an accused in a criminal proceeding to a very
large extent is dependent on the investigation process.18 The investigating team discharges a
very onerous public duty to carry out the investigation in every crime which they are expected to
perform with all sincerity, honesty, dedication, leaving no scope for loopholes or gaps, before
filing the charge sheet for the commencement of trial. The Supreme Court of India in Jamuna

lix
Chaudhary and others vs. State of Bihar56 held that the duty of the investigating team is not
merely to strengthen a prosecution case with such evidence as may enable the court to record the
conviction, but also to bring out the real unvarnished truth.

Under Section 2 (h) of the Code of Criminal Procedure, 1973, investigation has been defined as
“investigation includes all the proceedings under this Code for the collection of evidence
conducted by a police officer or by any person (other than a Magistrate) who is authorised by a
Magistrate in this behalf”. This definition given in the criminal procedure code is inclusive and
non-exhaustive.

In the matter of H.N. Rishbud and Inder Singh v. State of Delhi22, while laying down the
procedure of investigation, the Supreme Court of India exhaustively laid down as follows:

“……….under the Code investigation consists generally of the following steps:(1) Proceeding to
the spot, (2) Ascertainment of the facts and circumstances of the case, (3) Discovery and arrest of
the suspected offender, (4) Collection of evidence relating to the commission of the offence
which may consist of (a) the examination of various persons (including the accused) and the
reduction of their statements into writing, if the officer thinks fit, (b) the search of places of
seizure of things considered necessary for the investigation and to be produced at the trial, and
(5) Formation of the opinion as to whether on the material collected there is a case to place the
accused before a Magistrate for trial and if so taking the necessary steps for the same by the
filing of a charge- sheet under Section 173.”

The above mentioned observation was also made by the Madras High Court in Asst. Collector of
central Excise, Prevention v. Krishnamurthy23. Laying down the concept of fair investigation
and trial, the Supreme Court of India in the matter of Sidhartha Vashisht @ Manu Sharma vs.
State (NCT of Delhi)24, the Hon'ble Supreme Court has held that the investigation should be
“judicious, fair, transparent and expeditious” to ensure compliance to the basic rule of law.

On many occasions, the investigating agencies fail to conduct effective investigation due to lack
of modern equipment to carry out some of the technical aspects of the investigation process. The
number of forensic science laboratories are also very few, as a result of which, rendering timely
assistance to the investigating agency has not been possible, keeping in view the continuous
56
AIR 1974 SC 1822

lx
increase of technically challenging crimes being committed in the recent times. Further, it is also
an important fact to be noted that there is a dearth of forensic experts in police departments of
various States. As a consequence, the police end up relying more on oral evidence instead of
focusing on scientific and circumstantial evidence, which could have been more crucial in
arriving at a reasonable conclusion.

Investigation in Computer-related Crimes

It has been an accepted fact that there are three important ingredients required for the
commission of a crime: motivated perpetrators, the availability of appropriate opportunities and
the lack of an agency to monitor a situation. As far as cyber-crimes or any other computer-
related crimes are concerned, a digital environment facilitates all the three factors for
commission of a crime on cyberspace. Technology has both facilitated and impeded the
investigation of crime, particularly crimes involving computing of crime and communication
technologies or what is described as cybercrime. On the one hand, computers have brought a
revolutionary change in the field of information and communication technology by facilitating
speedier access and dissemination of data and analysis of the same. On the other hand, due to
interaction of huge amount of electronic data on cyberspace, the investigators are finding it
difficult to examine gigabytes of data and access encrypted files to extract the required
information. Needless to say that one of the most challenging aspects of such criminal activity is
the problem of jurisdiction for law enforcement agencies and the judiciary. The primary
objective of an investigation process involves the following: identification of crime, collection of
evidence, maintenance of the integrity of evidence and securing the attendance of the accused in
court.

In any legal system, the execution of law is dependent on the executive. The moment a case is
registered with the police, criminal law is said to be set in motion, which commences with the
investigation of a crime. Hence, for execution of criminal law, there is a need for effective
investigating machinery in place. In India, the primary legislation for regulating the investigation
of a crime is the Code of Criminal Procedure, 1973.

Handling of Electronic Evidence and Law Enforcement Agencies

lxi
Crime scene investigation is a process that involves forensic intelligence and skills. It is more
than the mere collection or packaging of physical evidence. It is considered to be the most
crucial step of any forensic investigation of a possible criminal act. The foundation of a forensic
investigation is based on the ability of the crime scene investigator to identify the potential and
importance of physical evidence available at the scene of crime. A proper investigation helps in
the reconstruction of the crime scene.57 In case of computer-related crimes, various electronic
devices such as computers, mobile phones etc. are considered to be an extension of the crime
scene, even when they may not be directly connected with the commission of crime, as they may
provide lead information with regard to use of digital devices in the said act of crime. Hence, it is
a basic requirement that both the physical and digital crime scenes are processed in a systematic
manner to ensure the integrity of potential evidence – physical as well as electronic. Effective
handling of computers and networks as evidence relating to a crime lays down the foundation of
a digital investigation which involves the phases of preparation, collection and preservation.
Lack of integrity in the initial crime handling process can significantly hamper a digital
investigation by overlooking crucial facts or failing to preserve digital evidence in a proper
manner, rendering it unusable for court process. At the same time, a well-established procedure
for handling evidence may not be able to cover all sorts of challenges and situations encountered
during the process. Hence, law enforcement agencies handling evidence must have adequate
training and experience to comply with procedures and handle those situations which are not
anticipated by any procedures. Besides, it is extremely important to note that the legal principles
relating to such investigation process vary across the jurisdictions, which need to be taken into
account while developing policies and procedures for handling computer-related crime scenes. It
is worth mentioning that there are international standards that have evolved over a period to
bring uniformity in the investigation of computer-related crimes. A standard is a published
document that lists established specifications and procedures to ensure that a material, product,
method or service is fit for its purpose and perform in the manner it was intended for. It is an
agreement which deals with matters relating to safety, reliability and efficiency (ISO 2009a) etc.
Formulation of International standards is a significant step towards bringing uniformity in
findings and mutual compliance across geographical and jurisdictional borders.58

57
Eoghan Casey, Digital Evidence And Computer Crime 227 (2011)
58
M. Grobler, Digital Forensic Standards: International Progress, Proceedings of the South African Information
Security Multi-Conference (SAISMC 2010) forensics has been published by The International Organization for

lxii
The International Organization for Standardization (ISO) is an independent, non- governmental
organization comprising of standards organizations of 164 member countries all over the world.
ISO creates documents that provide requirements, specifications, guidelines or characteristics
that can be used consistently to ensure that materials, products, processes and services are fit for
their purpose. It facilitates setting of international common standards among the nations. ISO has
formed two joint committees with the International Electro-technical Commission (IEC) to
develop standards and terminology in the field of electrical and electronic related technologies.

This International Standard ISO/IEC 27037:2012 provides guidelines with regard to

identification, collection, acquisition and preservation of potential digital evidence. These
processes are essential components which need to be strictly adhered to in order to maintain
integrity of electronic evidence, which ultimately could contribute to its admissibility before the
court of law.

The ACPO Good Practice Guide for Computer Based Evidence

There are a number of published guidelines that present fundamental principles for handling
digital evidence and that can help digital investigators develop crime scene handling protocols to
meet their specific needs. One of the most mature and practical guideline documents is the Good
Practice Guide for Computer Based Evidence (ACPO, 2009). This guide was originally
developed by the Association of Chief Police Officers (ACPO) in the United Kingdom and, in
later years, involved a digital forensic consultancy called 7safe. This was followed by ACPO
Good Practice Guide for Digital Evidence (March 2012, v5). The ACPO Guide sets out four
main phases for handling evidence - collection, examination, analysis, and reporting, with an
emphasis on the stage of collection.59

The following are some of the highlights of the Guide:

 The focus of these guidelines is to help the digital investigators handle the most common
forms of digital evidence, including desktops, laptops, and mobile devices. This
document also provides some guidance and template forms for the initial forensic
examination of a computer and discusses the process of making an exact copy of a disk,

Standardization (ISO) till date.45

59
Stephen Mason, 290-291 (2017)

lxii
 giving investigators a radical means of standardizing this important aspect of a digital
investigation.
 It should be borne in mind that digital evidence comes in many forms including audit
trails, application logs, biometric data, application metadata, Internet service provider
logs, intrusion detection system reports, firewall logs, network traffic, database contents
and transaction records etc. The ACPO Guide notes that there are an increasing number
of mobile devices, mini computers, portable media players, and gaming consoles that can
contain digital evidence. Such embedded systems present challenges from a forensic
standpoint and may require specialized processing that is beyond the scope of a single set
of guidelines.
 Digital devices and media should not be seized just because there are there. The person in
charge of the search must have reasonable grounds to remove property and there must be
justifiable reasons for doing so. Due regard must be given to the basic instruments for
protection of human rights.
 There are also cases involving proprietary systems, high-availability servers, large
storage systems, and evidence spread over a network that present unique challenges for
digital investigators, and will require specialized methods and tools. Given this variety,
finding and copying all of the available digital evidence are challenging tasks, and
situations that are not covered by any procedure will arise. This is why it is important to
develop a solid understanding of forensic science and to leam through experience how to
apply general principles creatively.

Guidelines on Cyber-Crime Investigation in India

With the significant increase in the criminal activities on cyber space, the laws in India have also
undergone changes in order to facilitate investigation of computer-related crimes in India. The
Code of Criminal Procedure, 1973 provides the foundation of investigation by police in a
crime.60 With the amendments brought through the Information Technology Act, 2000, it has
become an imperative for the law enforcement agencies to adapt itself to the changing scenario.
The unique feature of cybercrime has proved the traditional procedural laws to be unsuccessful
or ineffective leading to acquittal of persons involved in crime. The prosecution of such crimes

60
Section 154-176 of the Code of Criminal Procedure, 1973

lxiv
reflects the fact that the problems are not only related to trial process, but also the collection of
evidence. In addition to this, handling computer-related crimes requires a proper legal regime,
technical infrastructure for analysis of cyber forensic data, a trained police workforce,
prosecutors and judges having knowledge of cyber forensic tools for capturing evidence from the
scene of crime. Such evidence may be located anywhere in the country or outside the country.
The use of modern technology has converted traditional crime into a global phenomenon,
making investigation more difficult and complex. Therefore, there is an urgent focus on capacity
building for the investigating agencies in India to tackle this growing menace.

Over the years, the investigating agencies in India have experienced different situations with
regard to cybercrime investigation. Based on these experiences, various efforts have been made
from time to time to formulate specific guidelines to help the police officers handle such crime
situations more effectively. Following are some of these efforts discussed briefly:

CBI (Crime) Manual, 2005

The Central Bureau of Investigation (CBI), established in 1963 by the Ministry of Home Affairs,
Government of India as a prime investigating agency of the country dealing with investigation of
crimes in India, and assist the State Police Forces in carrying out investigation. As far as
cybercrime is concerned, the CBI has the following specialized structure to handle crimes:

 Cyber Crimes Research and Development Unit (CCRDU);

 Cyber Crime Investigation Cell (CCIC);
 Central Forensic Science Laboratory (CFSL); and
 Network Monitoring Centre.

Laws relating to International Investigations

Whenever a crime takes place on cyberspace, it doesn’t confine to any national boundary. On
many occasions, the victim may be residing in one jurisdiction, and the offender may be from a
different national boundary; whereas the crime is committed in a different country. Under such
circumstance, the investigation of crime turns out to be a challenging task. The investigators are
required to conduct investigation outside their national boundaries in compliance with the
criminal laws of the concerned country. Hence, it is essential that each investigator handling

lxv
computer-related crimes must have detailed knowledge about international investigations as
prescribed by law.

Legal procedure for collection of information from outside India – MLAT (Mutual Legal
Assistance Treaty) and Letter Rogatory

The legal procedure for collecting information from outside India was laid down in MLAT
(Mutual Legal Assistance Treaty) and Letter Rogatory issued by the Government of India.
Section 166-A and 166-B of the Code of Criminal Procedure, 1973 provide for the process of
making a request to a foreign country for help and assistance in investigation. Section 166A
provides as follows:

Section 166A - Letter of request to competent authority for investigation in a country or place
outside India.

Notwithstanding anything contained in this Code, if, in the course of an investigation into an
offence, an application is made by the investigating officer or any officer superior in rank to the
investigating officer that evidence may be available in a country or place outside India, any
Criminal Court may issue a letter of request to a Court or an authority in that country or place
competent to deal with such request to examine orally any person supposed to be acquainted
with the facts and circumstances of the case and to record his statement made in the course of
such examination and also to require such person or any other person to produce any document
or thing which may be in his possession pertaining to the case and to forward all the evidence so
taken or collected or the authenticated copies thereof or the thing so collected to the Court
issuing such letter.

The letter of request shall be transmitted in such manner as the Central Government may specify
in this behalf.

Every statement recorded or document or thing received under sub- section (1) shall be deemed
to be the evidence collected during the course of investigation under this Chapter.

Section 166-B - Letter of request from a country or place outside India to a Court or an authority
for investigation in India

lxvi
Upon receipt of a letter of request from a Court or an authority in a country or place outside India
competent to issue such letter in that country or place for the examination of any person or
production of any document or thing in relation to an offence under investigation in that country
or place, the Central Government may, if it thinks fit-

forward the same to the Chief Metropolitan Magistrate or Chief Judicial Magistrate or such
Metropolitan Magistrate or Judicial Magistrate as he may appoint in this behalf, who shall
thereupon summon the person before him and record his statement or cause the document or
thing to be produced, or

send the letter to any police officer for investigation, who shall thereupon investigate into the
offence in the same manner, as if the offence had been committed within India.

All the evidence taken or collected under Sub-Section (1), or authenticated copies thereof or the
thing so collected, shall be forwarded by the Magistrate or police officer, as the case may be, to
the Central Government for transmission to the Court or the authority issuing the letter of
request, in such manner as the Central Government may deem fit.

Procedure for sending Letter of Rogatory

For conducting formal investigation and to collect information from a foreign country regarding
any crime, the Code of Criminal Procedure lays down the procedure for sending ‘Letter of
Request’ through a competent court. This must be in concurrence with the Central Authority. In
general, the investigating officer should obtain the No Objection Certificate (NOC) from the
Director of Prosecution.

In addition to the above mentioned guidelines, the LNJN National Institute of Criminology and
Forensic Science (NICFS) formulated a Guide titled “A Forensic Guide for Crime Investigators
– Standard Operating Procedures” to strengthen the role of forensic science in criminal
investigations.58

Challenges In Handling Electronic Evidence

lxvi
In the process of handling electronic evidence, the investigators find it vague and burdensome to
identify the legal procedure, as it varies from state to state. Some states have been very rigid in
terms of formulating policy regarding searches without warrant. In United States v. Park64, the
court ruled:

“since cell phones can hold a greater quantity of data than pagers, its contents are less likely to
be lost; a warrantless cell phone search is thus unnecessary and unjustified.”

Similarly, in United States v. Wall 61, the court decided that “searching through information
stored on a cell phone is analogous to a search of a sealed letter”. On many occasions, the
investigators might get a search warrant issued by the court to carry out a search; however, the
evidence may not be worth presenting before the court due to failure in the forensic procedure to
comply with the legal procedure. For example, looking through unopened mail and unread texts
or not carefully documenting the chain of custody may constitute an improper search. With
jurisdictional limitations and inconsistencies in legal procedures, it has become very difficult for
investigators to carry out the investigation in an effective manner.

Acquisition of Electronic Evidence: Need for Standardization of Process

Taking into account the diverse challenges in the evidence collection process, the development
of an International Standard is an extended process that requires many resources. In many
instances, the need for specific topic standardisation is only identified long after a specific
technology has been introduced to industry. In addition to this late start of the standardisation
process, the average timeline for developing an international standard is about three years. It is
therefore recommended that members of specific industries proactively identify areas of concern
and channel this information at an early stage to the respective member bodies. This can speed
up the process and potentially have the International Standard in place when the technology is as
its peak and in need of international standardisation.

Every crime scene relating to computer based evidence presents unique challenges, and digital
investigators must be able to adapt forensic science principles creatively to new situations. At the

61
2008 WL 5381412

lxvi
same time, the investigating agencies have evolved standard operating procedures (SOPs) for
dealing with investigation of varieties of crime. Such procedures must be in conformity with the
fundamental principles of forensic science to ensure that evidence is collected, preserved and
analysed in a consistent manner. Such consistencies are necessary to avoid errors in the evidence
collection and preservation process leading to inadmissibility. This is also to ensure that the best
available methods of collection and preservation are applied, and thereby to increase the
probability that two forensic examiners would reach the same conclusions in examine the
evidence.

lxix
 CHAPTER 5

ADMISSIBILITY OF ELECTRONIC EVIDENCE AND CHALLENGES

BEFORE THE JUDICIARY

“While most of us have been focusing on the discovery of electronically stored information, the
ultimate use of that evidence at trial and its admissibility have often been overlooked.”

- Lorraine v. Markel62

The twenty first century has witnessed a revolution in the field of technology which has
captivated not only India but the entire world. The use of computers is not only confined to
established organizations or institutions but also available to every individual in a variety of
convenient ways. The application of Information Technology has simplified almost every
activity involving human beings. In this age of cyber world, with the increase in the application
of computers, the technology has also grown significantly. The evolution of Information
Technology has created the virtual world of cyber space wherein internet connects the whole
world and ensures equal opportunities to everyone to access any information with the use of high
technology. This increasing reliance on digital world of communications, e-commerce and
storage of information in digital form has certainly facilitated a transformation of the law relating
to information technology and rules of admissibility of electronic evidence both in civil and
criminal matters in India.63

Most of the documents, today, are either stored on or generated by computers, among which a
variety of electronic data have been admitted in the courtroom as evidence. This includes
contents of websites, e-mails, text messages, instant messages, digital photos, and enhanced
images etc. On many occasions, the judiciary has been sceptical in admitting such evidence,
expressing that there is a need of new standards to deal with the new evidence revolving such
evidence. Under such circumstances, it would be appropriate to address the commonly raised
issues by the courts with regard to electronic evidence, such as, authentication, hearsay, and rule
of best evidence etc.64
62
241 F.R.D. 534
63
Vivek Dubey, Admissibility of Electronic Evidence: An Indian Perspective, 4(2), FORENSIC RES. & CRIM. INT. J.
(2017)
64
Steven Goode, the Admissibility of Electronic Evidence, 29 REV. LITIG. 1 (2009)

lxx
The extensive use of computers and the impact of information technology and communication on
the society as a whole, along with the ability to store information in digital form have
undoubtedly led to necessary amendments in Indian law to incorporate the provisions on the
recognition and admissibility of electronic evidence. The Information Technology (IT) Act,
20004 and its amended provisions are based on UNCITRAL (the United Nations Commission on
International Trade Law) Model Law on Electronic Commerce. The IT Act 2000 was amended
to facilitate admissibility of electronic evidence. This Act provides for the treating of documents
produced electronically on a par with written, printed or typewritten records.5 The Act also
brought significant changes in the Indian Evidence Act 1872, the Indian Penal Code 1860 and
the Banker’s Book Evidence Act 1891 to provide the legislative framework for transactions in
electronic form or media.

With this changing scenario, the courts in India have also started relying on electronic evidence
by developing case laws. Judges have also interpreted the intrinsic ‘electronic’ nature of
evidence, which includes insight regarding the admissibility of such evidence, and the
interpretation of the law in relation to the manner in which electronic evidence can be brought
and produced before the court. It has been an established principle that the acceptability of any
digital or electronic evidence depends upon its relevance and authenticity. It is also required to
establish if the fact is hearsay or a copy is preferred to the original.

Digital Evidence is “information of probative value that is stored or transmitted in binary form”.
Unlike other physical evidence, locating the appropriate evidence is itself a challenge in the
process. It is to be noted that evidence is not only confined to computer systems, but also other
electronic devices, such as telecommunication or electronic multimedia devices.65

While referring to proving an electronic document in the court, a question often arises as to why
an electronic document is not printed on a paper so that the same can be produced as a paper
document for the purpose of examination during trial. Researchers have referred to at least three
primary reasons for not converting electronic document into a paper document:

First, every electronic document carries information attached to it, which may not be visible on
the face of the document, or may be lost when it is converted to a paper form. Such information
65
Dr. Swarupa Dholam, Electronic Evidence and its Challenges, https://mja.gov.in/Site/Upload/GR/Article%20on
%20Electonic%20evidence.pdf (last visited Jun. 18, 2018)

lxxi
is known as metadata i.e. basic information about data. In other words, the metadata of an
electronic document is not reflected in a simple printout.8 Metadata is variously defined as
“information regarding document creation and modification” or “information created by the
operating system or application about a file that allows the operating system or application to
store and retrieve the file at a later date”.66

Second, the issue of admissibility in the case of an electronic document involves different
challenges from any other document. An electronic document, like a paper document, can be
used as evidence to prove the truth of the contents of the document, or it can be used as real
evidence to show the existence of the data or who had possession of the data. The cardinal rule
of admissibility also applies to both paper and electronic documents: that is, when attempting to
enter evidence into the trial record, it must be proved that the document is relevant, authentic and
reliable. Moreover, electronic documents, like paper documents that are introduced, must
conform to the best evidence rule, and if it is being used to prove the truth of its contents, it must
not violate the rule against hearsay to be deemed admissible. One of the fundamental rules of
admissibility is that in order to be admissible, a document must be authenticated. The
authentication process seeks to determine the genuineness of a document. Regardless of whether
electronic evidence is used as real evidence or to prove the truth of its contents, the electronic
record must be proven to be authentic. The burden of proving the authenticity of the electronic
record lies on the person who wishes to introduce it. When considering the authenticity of a
document, the inherent possibility of alteration or tampering of electronic records becomes
crucial. An electronic document, that contains a statement that needs to be accepted as evidence
to prove the case of prosecution, becomes unacceptable if the defence convinces the court that
the contents of the document were altered, intentionally or unintentionally, such that the court
cannot accept its contents to be true.

Third, this also involves cost of production and trial. Keeping in view that most of the evidence
generated today is in electronic form, litigators have to learn to deal with it efficiently, cost-
effectively and with a mind to getting it admitted at trial.

66
Kelly Friedman, Electronic Evidence at Trial, 36 Advoc.Q. 215 (2009)

lxxi
CONCEPT OF ADMISSIBILITY

In an adversarial system of trial, the ultimate objective of presenting evidence is to assist the
judge to arrive at a rational conclusion regarding a fact in dispute. Therefore, it becomes very
crucial to determine the evidence to be produced before the judge for him/her to arrive at a
conclusion. There are certain characteristics which are attributed to any evidence to be eligible
for production before the court. Admissibility is one of the characteristics of evidence, which
determines the weightage to be given to a piece of evidence. According to the Oxford Advanced
Learner’s Dictionary, ‘admissibility’ can be defined as “worthy of being accepted or
considered”. Kanellis explains that any kind of evidence comprises of two components: firstly,
the legal requirements for admissibility under the existing law of evidence; and, secondly, the
material requirements, which is concerned with the credibility of evidence presented in a case.67

For any evidence to be admissible before the court of law, it must be relevant, material and
competent. A piece of evidence, which is relevant, must have a reasonable tendency to facilitate
proving or disproving a fact. It need not make the fact certain, but it must tend to increase or
decrease the likelihood of some fact. Once relevant evidence is admitted by the court after
ensuring compliance with the existing rules, the court will determine the appropriate weight to be
given to a particular piece of evidence. A given piece of evidence is considered material if it is
offered to prove a fact that is in dispute in a case. Evidence is considered “competent” if it
complies with certain traditional notions of reliability. Courts are gradually diminishing the
competency rules of evidence by making them issues related to the weight of evidence.68

Evidence is either admissible or inadmissible. Admissible evidence is the evidence that complies
with all regulatory and statutory requirements, and has been correctly obtained and handled.
Admissible evidence is any document, testimony, or tangible evidence used in a court of law.
The two quickest methods to ensure that evidence will not be admissible in court would be to
collect it in an illegal manner, or to modify the evidence after it has come into the possession of
the investigator/examiner.

67
See generally KANELLIS, P ET AL., DIGITAL CRIME AND FORENSIC SCIENCE IN CYBERSPACE (2006) as cited in
Amanda Refiloe Ngomane, The Use of Electronic Evidence in Forensic Investigation, available at
http://uir.unisa.ac.za/bitstream/handle/10500/4200/dissertation_ngomane_a.pdf.txt?sequence=3 (Jan. 12, 2019)
68
Evidence: The Concept of “Admissibility”, FIND LAW, https://criminal.findlaw.com/criminal- procedure/evidence-
the-concept-of-admissibility.html (last visited Jan. 23, 2019)

lxxi
Admissibility of a document is one thing and its probative value another – these two aspects
cannot be combined. A document may be admissible and may not carry any conviction and
weight, or its probative value may be nil.

A document may be admissible, but as to whether the entry contained therein has any probative
value may still be required to be examined in the facts and circumstances of a particular case.
The authenticity of the entries in the official record by an official or person authorized in
performance of official duties would depend on whose information such entries stood recorded
and what was his source of information. The entry in school register/ School Leaving Certificate
requires to be proved in accordance with law and the standard of proof required in such cases
remained the same as in any other civil or criminal cases.

Admissibility and relevancy are the two important terms in the Indian Evidence Act, 1872
(Hereinafter referred to as ‘the Act’). The word ‘admissibility’ is nowhere defined but
‘relevancy’ is defined in the Act. The rules of relevancy are laid down between Sections 5 – 55
of the Act. These rules provide the guidelines with regard to whether a fact is a relevant fact or
not. No matter what the evidence system is, the common method of discovering the truth plays
an important role as far as law of evidence is concerned. Thus, admissibility of facts helps in
deciding whether a particular piece of evidence would facilitate in coming to a conclusion with
regard to any dispute involving law. The admissibility of evidence is a question of law and it is
left to the discretion of the Judge as per Section 136 of the Act. Admissibility is based on law
and not logic. Facts which may have no logical relevance may 16 Section 136. Judge to decide as
to admissibility of evidence.—When either party proposes to give evidence of any fact, the Judge
may ask the party proposing to give the evidence in what manner the alleged fact, if proved,
would be relevant; and the Judge shall admit the evidence if he thinks that the fact, if proved,
would be relevant, and not otherwise. If the fact proposed to be proved is one of which evidence
is admissible only upon proof of some other fact, such last-mentioned fact must be proved before
evidence is given of the fact first mentioned, unless the party undertakes to give proof of such
fact, and the Court is satisfied with such undertaking. If the relevancy of one alleged fact
depends upon another alleged fact being first proved, the Judge may, in his discretion, either
permit evidence of the first fact to be given before the second fact is proved, or require evidence
to be given of the second fact before evidence is given of the first fact.

lxxi
 sometimes be admissible in courts.69 In other words, when a fact is connected with another fact,
they are considered to be logically relevant. Where a logically relevant fact is recognized by law,
it becomes legally relevant, and such facts are usually admissible before the court. The Supreme
Court of India in the case of Ram Bihari Yadav v. State of Bihar18 held that in most of the cases,
the two terms ‘admissibility’ and ‘relevancy’ are used interchangeably with each other, but their
legal implications vary from each other.

PRINCIPLES OF ADMISSIBILITY OF SCIENTIFIC EVIDENCE IN COURTS

Forensic science i.e. the application of scientific knowledge in criminal investigation, today, is
an integral part of criminal justice system, and has a key role to play in extracting or analysing
scientific evidence before the court. In the changing scenario, the Indian Judiciary has also relied
upon forensic science to a great extent in resolving legal disputes. Accordingly, the law of
evidence has also been amended from time to time to accommodate such evidence within the
purview of admissibility. On the one hand, use of scientific evidence and application of various
scientific methods to extract evidence in criminal prosecution have, undoubtedly, been
facilitating an effective criminal investigation process; on the other hand, the reliability and
admissibility of such evidence in the court have been a challenge. The development of scientific
and technical expert testimony in the complex and technical issues has flooded the judicial
system in the recent times. At the same time, the question of its reliability and admissibility has
also plagued the courts and stimulated much debate. The issue of admissibility has attracted the
attention of countless commentators. Several articles have explored the subject and offered
arguments supporting greater or lesser barriers to the admissibility of scientific expert evidence.

In the United States (US), different admissibility standards evolved from time to time to
authenticate scientific evidence. The judiciary has adopted special rules governing the
admissibility of scientific evidence. The most common special rule is the ‘general acceptance
standard.’ In addition to fulfilling the traditional requirements of relevancy, the proponent under
the general acceptance standard must show general acceptance of the principle or technique in
the scientific community.19 Historically, the concept of determining whether an expert’s
69
Paridhi Selvan et al., A Critical Study of Admissibility of Evidence, 120 (5) INT’L J. OF PURE AND APPLIED MATHS,
1169 (2018)

lxx
testimony is admissible or not dates back to a special rule originating in 1923 with the decision
of the Court of Appeals for the District of Columbia Circuit in Frye v. United States. 70 The Frye
test had two aspects - firstly, the principle or scientific technique and secondly, the acceptance.
Also known as general acceptance test, it is a test to determine the admissibility of scientific
evidence. It provides that an expert opinion based on a scientific technique is admissible before
the court only when the technique is generally accepted as reliable among the scientific
community. This test, however, was criticised on the following grounds - i) that there will have
to be a considerable time lag for the scientific method to be accepted by the community, ii) More
faith is reposed on the scientific community than in the Court of Law. Subsequent to this, Rule
702 of The Federal Rules of Evidence (1975) was introduced for admissibility of scientific
evidence.21 However, Rule 702 neither included the Frye standard nor made a mention of the
general acceptance standard. On June 28, 1993, the US Supreme Court offered its first
significant pronouncement in a landmark judgment in Daubert vs. Merrell Dow
Pharmaceutical22, where specific guidelines were issued to settle the admissibility issue of
scientific evidence to a great extent. The Court held that general acceptance was not a
precondition to admissibility of scientific evidence under the Federal Rules of Evidence.

The Court also affirmed that the trial judge had authority to insure that a given expert’s
testimony will be reliable and relevant. This, in fact, marks a shift towards more flexible
standards regarding the admissibility of scientific evidence.71

In Daubert, the Court laid down the following criteria for admissibility of scientific evidence:

• Whether the theory or technique employed by the expert can be (and has
been) tested.
• The known or potential rate of error associated with the theory or technique,
• The existence and maintenance of standards controlling the technique’s
operation.
• Whether the theory or technique have been subjected to peer review and
publication
70
293 F.1013 (D.C. Cir. 1923)
71
509 U.S. 579 (1993)

lxx
 • Whether the theory or technique enjoys widespread acceptance

The Supreme Court’s ruling on Daubert is crucial to the admissibility of expert testimony in that
it provides a detailed framework to assist the judge while determining the relevance and
reliability upon hearing evidence. In addition to Daubert, in Kumho Tire Co. v. Carmichael25,
the Supreme Court of the United States set the law of expert testimony on a quest for
“reliability.” These decisions, as well as the subsequent amendment of Federal Rule of Evidence
702, make it clear that trial judges are to perform a “gatekeeping” function, filtering out offered
testimony when the expertise on which it is based, whether scientific or otherwise, is not
reliable.26 Rule 702 now provides:

If scientific, technical, or other specialized knowledge will assist the trier of fact to understand
the evidence or to determine a fact in issue, a witness qualified as an expert by knowledge, skill,
experience, training, or education, may testify thereto in the form of an opinion or otherwise, if
(1) the testimony is based upon sufficient facts or data, (2) the testimony is the product of
reliable principles and methods, and (3) the witness has applied the principles and methods
reliably to the facts of the case.

In Rajli @ Rajjo v. Kapoor Singh & Others28 The Punjab & Haryana High Court held that the
reliability of the scientific evidence depends upon three factors; the validity of the underlying
scientific principle; the validity of the technique applying the principle ; and the proper
application of the technique on a particular occasion. Admissibility of scientific evidence has
been a debatable issue in India since long especially post Selvi v. State of Karnataka29, where
the Supreme Court expressed the dilemma of admissibility of scientific evidence in the following
words:

“In the context of criminal cases, the reliability of scientific evidence bears a causal link with
several dimensions of the right to a fair trial such as the requisite standard of proving guilt
beyond reasonable doubt and the right of the accused to present a defence. We must be mindful
of the fact that these requirements have long been recognised as components of ‘personal liberty’
under Article 21 of the Constitution. Hence it will be instructive to gather some insights about
the admissibility of scientific evidence.”72

72
AIR 2010 SC 1974 Para 5

lxx
ADMISSIBILITY OF ELECTRONIC EVIDENCE

Due to significant growth in e-governance in public as well as private domain, electronic

evidence has emerged as one of the fundamental bases for litigation, both civil and criminal.
During trial proceedings judges are often confronted with the question of interpreting rules on
admissibility of electronic evidence, which has an impact on the outcome of civil law suit or
conviction/ acquittal of the accused. The court has to confront with this new form of evidence, as
the ease with which such evidence can be manipulated, creates hurdle to admissibility unlike
other forms of evidence. The various forms of electronic evidence such as data from websites,
communications on social media, emails, instant messages, computer generated documents etc.
create unique problems and challenges for proper authentication.

Given the general terms in which rules of evidence articulate the standards for admissibility, it is
sometimes difficult to come to a conclusion as to how much proof is required to admit a
particular piece of electronic evidence.

STANDARDS OF ADMISSIBILITY: THE UNITED STATES

It has been a widely accepted fact that the principles laid down in Daubert 73 are considered to be
standard for admissibility of electronic evidence. However, electronic evidence still may have to
come across many obstacles concerning the collection, preservation, processing and presentation
of the evidence. Computers, today, have huge amount of data storage. The law enforcement
agencies face a peculiar problem of locating relevant information relating to criminal
investigation from a huge storage of data, which include photographs, videos, e- mails, chat logs
etc. as it could be extremely time-consuming. Proper handling and processing by a computer
forensics expert should eliminate problems that could affect admissibility of evidence. Since the
nature of electronic evidence is fragile and it can be easily modified, the admissibility of
electronic evidence has always remained a debatable issue.

As far as the United States is concerned, the US courts have been admitting computer records as
evidence since the 1970s when the use of computer systems was confined only to a few
businesses and some personal use.32 The basic tenets for admitting electronic evidence was on
the relationship between the information and the computer. Documents were admitted based on
73
See ngenerally Dauber, Supra Note 24

lxx
the assumption that any information produced by a computer has the maximum authenticity.
However, with the significant change in the nature of digital evidence in the contemporary times,
traditional principles for computer records may no longer be adequate to address the
complexities of modern electronic equipment from which electronic evidence is generated,
because it is much easier to create digital information which is subject to change without any
detection. To authenticate digital evidence in the contemporary time, focus must be more on the
key components of an information system: People— Process—Technology. (See Annexure XIII)
While establishing the integrity of electronic records, the following factors are to be considered:
who created the evidence, what technology was used to collect, preserve and analyse the data,
and what was the chain of custody throughout the entire digital evidence lifecycle.33 It is
unfortunate that the failure to understand the way to authenticate electronic evidence has resulted
in adverse rulings by the courts in the United States. For example, in Lorraine v. Markel
American Insurance Co., the court denied a motion for summary judgment due to failure in
providing admissible evidence and properly authenticating computer based evidence. In Vinhnee
v. American Express Travel Related Services Company, Inc., the court of appeals affirmed the
trial court’s decision not to admit computerized records because of the lack of authentication of
records to be admitted before the court.74

STANDARDS OF ADMISSIBILITY: THE INDIAN SCENARIO

In India, electronic evidence has been defined within the purview of ‘document’ and was treated
as secondary evidence. Electronic evidence was authenticated through certification by a
competent authority. In this process, the conditions laid down in Section 63 and Section 65 of the
Indian Evidence Act, 1872 were to be duly complied with. However, with the coming into force
of the amendments in Information Technology Act, 2000 as well as the Indian Evidence Act,
more emphasis was laid on electronic records as evidence. The law relating to admissibility of
electronic evidence was revisited and specific criteria were laid down to fulfil the conditions of
authenticity and reliability. Accordingly, the two legal provisions Sections 65A and 65B were
inserted in the Indian Evidence Act, 1872 to deal with the issue of admissibility of electronic
evidence.
74
Thomson, Supra Note 33

lxxi
Due to such changes in the nature and form of evidence, the Indian Evidence Act, 1872 was
amended by way of Section 92 of the Information Technology Act, 2000 (hereinafter referred to
as IT Act). Section 3 of the Indian Evidence Act, 1872 (hereinafter referred to as the Evidence
Act) was amended to include electronic records as a part of “documents” to be termed as
documentary evidence. Similarly, ‘electronic records’ was also inserted in Section 59 of Indian
Evidence Act to include electronic evidence as a part of ‘contents of documents’. The rules of
admissibility for electronic evidence were introduced through Section 65-A and 65-B of the
Evidence Act. Sections 61 to 65 of the Evidence Act deal with primary and secondary evidence.
It is worth mentioning that in the above mentioned provisions, the phrase ‘document or content
of documents’ have not been replaced by the phrase ‘electronic documents or content of
electronic documents’. This clearly indicates the fact that the intention of the legislature not to
extend the applicability of Sections 61 to 65 to the electronic record.75

The main objective of introducing specific provisions for admissibility of electronic evidence is
that all evidence in electronic form are highly technical in nature, and such evidence cannot be
produced in the court of law due to the difficulty in carrying the computers or servers. Besides, it
requires interpreters to read the machine language.

Section 65-B of the Evidence Act lays down he rules relating to admissibility of electronic
evidence as secondary evidence in the form of computer output comprising of print out or data
copied on electronic / magnetic media. Section 65-B may be divided into four components.

 stored, recorded or copied in optical or magnetic media produced by a computer, shall be

deemed to be a document as defined under Section 3 of the Indian Evidence Act, 1872,
subject to fulfilment of certain conditions. Once the conditions are fulfilled, it does not
require further proof or production of the original.
 The second component of Section 65-B refers to the conditions to be fulfilled for
admissibility of electronic evidence. Following are the conditions:
 The computer from which the record is generated must have been in regular use
to store or process information.

75
Neeraj Aarora, Admissibility of Electronic Evidence: Challenges for Legal Fraternity,
http://www.neerajaarora.com/admissibility-of-electronic-evidence-challenges-for-legal-fraternity/ (Last visited
Jun. 19, 2018)

lxx
  The activity must have been regularly carried on in the device by a person having
lawful control over the period.
 (c) The activity must relate to the period over which the computer was
regularly used.
 The information in question was fed in computer in the ordinary course of the
activities of the person having lawful control over the computer.
 The computer was operating properly during the specific period in question.

The third component focuses on what constitutes a single computer:

 A combination of computers operating over that period.

 Different computers operating in succession over that period.
 Different combinations of computers operating in succession over that period.

The provisions recognise the evidentiary value of any information printed on paper or stored in a
compact disc, or similar device subject to the fulfilment of the Sub-section (4) of section 65B of
the Evidence Act which provides additional non-technical qualifying conditions to establish the
authenticity of electronic evidence. This provision requires that a certificate shall be produced by
a senior person having responsibility of the computer which has created and stored the electronic
record. The certificate must uniquely identify the original electronic record, describe the manner
of its creation, describe the device that created it, and certify compliance with the technological
conditions of sub-section (2) of section 65B. In 2014, the Supreme Court of India came up with a
ruling38 defining the scope of section 65B, where the court has laid down that section 65B is a
special provision and is different from section 63 and 65 in respect of secondary evidence. 76 It is
worth mentioning that production of certificate is a challenge in those cases, where the computer
or any electronic device is in the possession of the adverse party. This matter has been brought
before the Judiciary, where efforts are being recognised to make the rules more flexible.

In addition to this, the widespread use of mobile devices has given rise to diverse challenges in
legal proceedings as the courts decide upon the issue of authentication of digital information in
the light of judicial pronouncements and legal provisions. In spite of the fact that the US has
already in place well-established legal principles for admissibility of evidence, their applicability
76
See Raveena Rai, Challenges to Cyber Crime Investigation: A Need for Statutory and Infrastructural Reforms,
CNLU LJ (5) [2015] 62

lxx
to various electronic records raises challenges in evidentiary issues. Subsequently, courts have
ended up applying different standards for similar types of evidence in case of production of
computer related evidence before the court.77

It is the primary responsibility of the court to ensure that the evidence to be produced before the
court would facilitate a strong foundation for making a decision in a case. Admissibility, a
fundamental rule of evidence, is a set of tests carried out by a judge to assess a piece of evidence.
Such process of assessment may become challenging to the court if the evidence was not handled
properly by the law enforcement agencies or the possibility of having such characteristics in the
evidence that make it less reliable or more prejudicial. It is to be noted that because of the
intangible character of such evidence, many cases do not even make it to court as such evidence
gets compromised. It is, therefore, essential to ensure that evidence stored or generated in a
computer was collected, preserved and transmitted in accordance with legal requirements
regarding the admissibility of the evidence.78

Admitting Electronic Evidence In Court: Challenges

Apart from the above, the other issues that may prevent electronic evidence from being admitted
by courts are improper handling of evidence and illegal search and seizure. Initially, courts were
more liberal in dealing with cases of improper handling of electronic evidence. However, with
increasing number of such evidence in every case, the courts have started raising more
challenges with handling and illegal search and seizure of evidence.

Search Warrants

In most of the cases relating to electronic evidence, the evidence is obtained without
authorization. In order to search and seize evidence a search warrant must be issued by the court.
Under the US Constitution, the Fourth Amendment provides the citizens the right to be secure
from arbitrary issue of search warrant in a their persons, houses, documents etc. for obtaining a
warrant, the law enforcement agencies must provide probable cause and other details of search

77
Thomson, Supra Note 33
78
See Kumar Askand Pandey, Appreciation of electronic Evidence: A Critique of Judicial Approach 6 RMLNUJ (2014)
24

lxx
and things to be seized. It is very important for the investigators to convince the court that an
offence has been committed and the evidence is likely to exist in the place of search.79

In cases of immediate intervention, it may not be possible to obtain a search warrant, as any
delay in the collection of evidence might result in alteration or destruction of evidence.48 Hence,
it may be necessary to seize the computing device immediately to reduce the possibility of
destruction of evidence. Once the digital evidence is preserved, it is required to obtain a warrant
to conduct a forensic examination.

Under the Indian Evidence Act, 1872, the provisions relating to search warrant in criminal
investigation is issued under Section 93 of the Code of Criminal Procedure, 1973 which lays
down that a judicial officer on reasonable grounds as laid down in the provision, issue search
warrant, specifying the place or document to be searched.80

Authentication of Digital Evidence

After the acquisition of hardware, the data recovered from storage devices must be authenticated
before they are analysed. Authentication is the process of comparing the original data with the
copy or imaged data in order to verify that both are identical data. One of the primary
requirements before the court is if the recovered evidence is the same as the originally seized
data while considering the admissibility of electronic evidence.81 In order to establish that digital
evidence is authentic, it is necessary to satisfy the court that it was collected from a specific
computer, and the same has remained unchanged since it was collected. Thus, the reliability of
electronic evidence plays a crucial role in the authentication process. It is also equally important
that a chain of custody is duly maintained during the collection and preservation of evidence till
the same is produced before the court.

Reliability of Digital Evidence

Reliability is another integral component to determine the authenticity of electronic evidence.

Two general approaches have been identified commonly to assess whether electronic evidence
can be relied upon in court. The first approach is to find out if the system generating the evidence

79
Raveena Rai, Supra Note 39
80
Raveena Rai, Supra Note 39
81
Supra Note 41, at 60

lxx
was functioning normally at the time of retrieving the same. The other approach is to examine
the actual evidence by experts to rule out any tampering or damage of the evidence collected.
The first approach was followed by majority of the legislation in the United States and United
Kingdom to evaluate the computer generated records on the basis of the reliability of the system
and also the process that generated the records.82

For instance, the section in the Federal Rules of Evidence 901 (b) (9) titled “Requirement of
Authentication or Identification includes “evidence describing a process or system used to
produce a result showing that the process or system produces an accurate result.” In the United
Kingdom, under Section 69 of Police and Criminal Evidence Act 1984 (PACE), there was a
formal requirement for a positive assertion that the computer systems involved were working
properly. The Rationale behind this approach lies in the fact that such records are not for this
approach is that because records of this are not complementary to a statement made by a human
declarant, they should not be treated as hearsay, but rather their admissibility should be
determined on the basis of the reliability and accuracy of the process involved. 83 It is worth
mentioning that it is difficult to assess the reliability of a computer system. Apart from this,
courts are also not well equipped to assess the reliability of computer systems and the processes.
This invokes a difficulty in certifying a computer or a specific process, as they may malfunction
under certain circumstances encounter unforeseen errors. Therefore, it is assumed that the
systems were functioning properly at the time of the commission of the offence. At the same
time, programmes running in computer systems are subject to upgradation, it is not safe to
assume that a particular process on a specific system functioned in the same way at the time of
the commission of the offence.

In an interesting development in 1997, the UK Law Commission recommended repeal of Section

69 of PACE as it was difficult to assess the reliability of computer systems. Besides, the
provision also required a certification of the system, and it also failed to address the major
factors responsible for inaccuracy in electronic evidence. In 2001, the provision was almost
abandoned except for using it to establish reliability of computer-generated business records.

Best Evidence

82
Dale A. Nance, See Supra Note 26
83
See generally J. STRONG, MCCORMICK ON EVIDENCE (1999)

lxx
Apart from establishing the contents of a writing, recording or photograph, there are occasions
when the reliance is also given the original evidence. The justification behind this rule was to
ensure that the court has decided the case based on best available evidence. The best evidence is
defined as the most complete copy, which includes all the parts of the evidence that are closely
related to the original evidence.84

With the coming into existence of diverse mechanical processes such as photocopiers, scanners,
computers etc., which is capable of creating identical copies as the original, such copies became
acceptable to the court instead of the original unless “a genuine question is raised as to the
authenticity of the original or the accuracy of the copy or under the circumstances, it would be
unfair to admit the copy in lieu of the original”.55 In fact, presenting a copy of the electronic
evidence is more desirable, as it avoids the risk of the original getting altered unintentionally.
Even a print out of an electronic record on a paper may be considered equivalent to the original
one, unless important portions of the original are not visible in printed form.

Hearsay

Hearsay evidence is considered to be a weak piece of evidence, because it does not give the
scope to the court to examine or cross-examine the person originally giving the evidence to
verify the truthfulness of the evidence. For example, the evidence that there was an email
communication sent by an individual may be proved by the production of the e-mail message.
However, the same cannot be used to prove the trustworthiness of the statements made in the e-
mail. According to the rule of appreciation of hearsay evidence, hearsay evidence is not taken
into account while admitting evidence by the court, because, the rules of evidence insist on the
presence of the person in the court, whose statement is relied upon, in the interest of justice. This
is to ensure that “many possible sources of inaccuracy and untrustworthiness can be brought to
light and exposed, if they exist, by the test of cross-examination. The phrase ―hearsay evidence

84
Nilakshi jain & dhananjay r. kalbande, digital forensic: the fascinating world of digital evidences 52 (2017)

lxx
is not used in the Indian Evidence Act, 1872 because it is inaccurate and vague. It is a
fundamental rule of evidence under the Indian law that hearsay evidence is inadmissible.”85

Electronic evidence and computer forensics have turned out to be one of the most frequently
used means of proof in legal proceedings. Unlike other branches of forensic science used for
criminal investigations, electronic evidence has invoked diverse debatable issues among the legal
professionals. The new challenges given by electronic evidence have been dealt with by different
legal systems in different ways. In some of the systems, such challenges involving electronic
evidence have been addressed by introducing specific laws; in some cases, the existing laws have
been interpreted to apply the principles in case of electronic evidence. For instance, the
admissibility of electronic evidence is dependent on whether it can be identified with proof by
document or by visual inspection. Many of the systems adopt a combination of the both. The
legal systems incorporating new legislation for admissibility of electronic evidence emphasizes
on differences between electronic and traditional forms of evidence, whereas, the others tend to
highlight the similarities between traditional and digital evidence. The term ‘trustworthiness’
refers to two fundamental aspects – reliability and authenticity. Reliability ensures that the record
is capable of standing for the facts to be determined. Authenticity refers to the genuineness of the
evidence. In other words, it means whether the document ‘matches the claims made about it’.

JUDICIAL INTERVENTIONS ON ADMISSIBILITY OF ELECTRONIC EVIDENCE: A

CRITICAL ANALYSIS

With significant amendments in the existing law on evidence to give recognition to electronic
evidence, it is also important to assess the role of the Judiciary in demonstrating its perception
towards intrinsic ‘electronic’ nature of evidence, which includes strategies on the admissibility of
such evidence, and recognize the manner of producing and filing electronic evidence before the
court by way of interpreting the laws.86

As far as computer-related crime is concerned, electronic or digital evidence plays a crucial role
in the delivery of justice. Right from identifying electronic evidence till they are produced before
the court, the law enforcement agencies such as investigating agencies, forensic experts in
forensic laboratories, persons granting certificate under Section 65-B of the Indian Evidence Act,
85
Anil Maheshwari and Ors. v. CBI and Ors. 2013(136) DRJ 249
86
See generally Supra Note 2

lxx
1872, and the judge admitting or not admitting the evidence based on the report submitted under
the said provision – all have a significant role to play in the disposal of such cases. The whole
process involves challenges at various stages to the authority of electronic/ digital evidence.
Some of these challenges include possibility of alteration, manipulation or damage of evidence,
reliability of the computer progamme that generated the record, dispute regarding identity of the
author of an electronic document, reliability of evidence from a social networking site,
authentication of information on social Media sites etc. These challenges may be addressed
through analysis of various judicial pronouncements.

Before going into various aspects of judicial interventions on electronic evidence, it is important
to note that the judiciary has been very active with regard to recognition of electronic records and
devices as evidence, and interpretation of the rules of admissibility of electronic evidence.

Amitabh Bagchi v. Ena Bagchi60 (Analysis of Section 65-A and 65-B)

The court held that the physical presence of person in Court may not be required for purpose of
adducing evidence and the same can be done through medium like video conferencing. Sections
65-A and 65-B lays down provisions for evidences relating to electronic records and
admissibility of electronic records, and that definition of electronic records includes video
conferencing.

State (NCT of Delhi) v. Navjot Sandhu87

While examining the provisions of newly added Sections 65B, the Apex Court held that in a
given case, it may be that the certificate containing the details in sub-section (4) of Section 65B
of Indian Evidence Act, 1872 is not filed, but that does not mean that secondary evidence cannot
be given. The Court held that the law permits such evidence to be given in the circumstances
mentioned in the relevant provisions, namely, Sections 63 and 65 of the Evidence Act. Paragraph
150 of the judgment provides as follows:

“150. According to Section 63, secondary evidence means and includes, among other things,
copies made from the original by mechanical processes which in themselves insure the accuracy
of the copy, and copies compared with such copies. Section 65 enables secondary evidence of

87
(2005) 11 SCC 600

lxx
the contents of a document to be adduced if the original is of such a nature as not to be easily
movable. It is not in dispute that the information contained in the call record is stored in huge
servers which cannot be easily moved and produced in the court…..Irrespective of the
compliance with the requirements of Section 65-B, which is a provision dealing with
admissibility of electronic records, there is no bar to adducing secondary evidence under the
other provisions of the Evidence Act, namely, Sections 63 and

65. It may be that the certificate containing the details in sub-section (4) of Section 65-B is not
filed in the instant case, but that does not mean that secondary evidence cannot be given in the
circumstances mentioned in the relevant provisions, namely, Sections 63 and 65”.

Thus, the Court made a liberal interpretation of rule of admissibility for electronic evidence as
secondary evidence through Section 63 and 65 of the Indian Evidence Act.

State of Punjab v Amritsar Beverages Ltd62 (interpreting hard disk within the definition
of ‘document’)

In this case, a writ petition was filed before the High Court for not returning the seized books,
accounts, documents and computer disk to the company even after stipulated time. While the
case was in appeal before the Supreme Court, the Court referred to the difficulties of
enforcement officers which may be faced by them who may not have any scientific expertise to
tackle the new digital evidence. The Court held:

“Internet and other information technologies brought with them the issues which were not
foreseen by law as for example, problems in determining statutory liabilities. It also did not
foresee the difficulties which may be faced by the officers who may not have any scientific
expertise or did not have the sufficient insight to tackle with the new situation. Various new
developments leading to various different kinds of crimes unforeseen by our legislature come to
immediate focus. Information Technology Act, 2000 although was amended to include various
kinds of cybercrimes and the punishments therefor, does not deal with all problems which are
faced by the officers enforcing the said Act.”

Bodala Murali Krishna v. Smt. Bodala Prathima63 (Recognition of Electronic Evidence)

lxx
Recognizing the electronic records, the court held that, “…the amendments carried to the
Evidence Act by introduction of Sections 65-A and 65-B are in relation to the electronic record.
Sections 67-A and 73-A were introduced as regards proof and verification of digital signatures.
As regards presumption to be drawn about such records, Sections 85-A, 85-B, 85- C, 88-A and
90-A were added. These provisions are referred only to demonstrate that the emphasis, at
present, is to recognize the electronic records and digital signatures, as admissible pieces of
evidence.”

Jagjit Singh v State of Haryana64 (Admissibility of CD containing interviews conducted by

a TV channel)

In this case, the speaker of the Legislative Assembly of the State of Haryana disqualified a
member for defection. While hearing the matter, the Supreme Court considered the appreciation
of digital evidence in the form of interview transcripts from the Zee News television channel and
other media sources. The court determined that the electronic evidence placed on record was
admissible and upheld the reliance placed by the speaker on the recorded interview when
reaching the conclusion that the voices recorded on the CD were those of the persons taking
action. The Supreme Court found no infirmity in the speaker’s reliance on the digital evidence.

Shamsher Singh Verma v. State of Haryana65 Recognition of Compact Disc (CD) as

‘document’

In the above mentioned case, the Supreme Court allowed compact discs (CDs) to be treated as a
document under the law and said that litigants should be allowed to prove or disprove such
electronic evidence in judicial proceedings. The apex court, without deciding on the authenticity
of a CD in a case, permitted the accused to bring on record the taped telephonic conversations to
prove his innocence in a child sexual abuse case. The Supreme Court held that “a compact disc
(CD) is to be treated as a document under the law and litigants should be allowed to prove the
authenticity of such electronic evidence in legal proceedings.” The court was passing a judgment
in a case of child sexual abuse in which the accused wanted to place on record a CD of taped
telephone conversations to prove his “innocence”. The Court set aside a Punjab and Haryana
High Court order agreeing with the trial court’s decision to deny the accused’s plea to produce

lxx
recorded telephonic conversation between his wife and son and the girl’s father to prove his
point that there was a property dispute between the two families.

The apex court did not go into the authenticity of the taped conversations or the CD, but asked
the trial court to allow the accused to place it on record.66

This is, undoubtedly, a positive approach towards reliance on electronic evidence by the
Judiciary.

Tukaram S. Dighole v. Manikrao Shivaji Kokate67 (Distinction between electronic

evidence and other forms of traditional evidence)

On many occasions, the judiciary has distinguished between electronic evidence and other forms
of traditional evidence. In the above mentioned case, the Supreme Court held:

“New techniques and devices are order of the day. Though such devices are susceptible to
tampering, no exhaustive rule could be laid down by which the admission of such evidence may
be judged… Standard of proof of its authenticity and accuracy has to be more stringent than
other documentary evidence.” (para 20)

Thus, on the one hand, the court has appreciated the fact that new techniques and electronic
devices are integral part of any criminal investigation; on the other hand, it also emphasised on
the fact that the standards of proving the authenticity of such evidence must be more stringent
than other documentary evidence.

Tomaso Bruno and Anr. v. State of Uttar Pradesh68 (Emphasis on importance of electronic
evidence)

In the above mentioned case, the Supreme Court focused on the importance of science and
technology in the investigation of cases relating to electronic evidence. The Court held:

“With the advancement of information technology, scientific temper in the individual and at the
institutional level is to pervade the methods of investigation. With the increasing impact of
technology in everyday life and as a result, the production of electronic evidence in cases has
become relevant to establish the guilt of the accused or the liability of the defendant. Electronic
documents strictu sensu are admitted as material evidence. With the amendment to the Indian

xc
Evidence Act, 2000, Sections 65A and 65B were introduced into Chapter V relating to
documentary evidence. Section 65A provides that contents of electronic records may be admitted
as evidence if the criteria provided in Section 65B is complied with.” (para 25)

Gajraj v. State (NCT) of Delhi69 (Reliance on electronic evidence)

In the above mentioned case, the Supreme Court of India strongly relied on electronic evidence
as far as the unique identification number of mobile handset is concerned. The Court highlighted:

“The evidence produced by the prosecution is based on one irrefutable fact, namely, every
mobile handset has an exclusive IEMI number. No two mobile handsets have the same IEMI
number and every time a mobile handset is used for making a call, besides recording the number
of the caller as well as the person called, the IEMI numbers of the handsets used are also
recorded by the service provider. The aforesaid factual position has to be kept in mind while
examining the prosecution evidence.” (para 10)

P.V.Anvar v. P.K. Basheer70 (Mandatory requirement of certificate under Section 65B)

In this landmark judgment passed by the Supreme Court, the issue of interpretation of Section
65A and 65B of the Indian Evidence Act came up for consideration and the Supreme Court held
that electronic evidence recorded in the CD, without a certification under Section 65B is
inadmissible in evidence. In para 24 of the said ruling it is held as follows,

“24. The situation would have been different had the appellant adduced primary evidence, by
making available in evidence, the CDs used for announcement and songs. Had those CDs used
for objectionable songs or announcements been duly got seized through the police or Election
Commission and had the same been used as primary evidence, the High Court could have played
the same in court to see whether the allegations were true. That is not the situation in this case.
The speeches, songs and announcements were recorded using other instruments and by feeding
them into a computer, CDs were made therefrom which were produced in court, without due
certification. Those CDs cannot be admitted in evidence since the mandatory requirements of
Section 65-B of the Evidence Act are not satisfied. It is clarified that notwithstanding what we
have stated herein in the preceding paragraphs on the secondary evidence of electronic record
with reference to Sections 59, 65-A and 65-B of the Evidence Act, if an electronic record as such

xci
is used as primary evidence under Section 62 of the Evidence Act, the same is admissible in
evidence, without compliance with the conditions in Section 65-B of the Evidence Act.” This
overruled the decision of the Court in State (NCT of Delhi) vs Navjot Sandhu71 (discussed
earlier).

Clarifying on the application of Section 65-B(4), the Supreme Court also held that, if an
electronic record as such is used as primary evidence under Section 62 of the Indian Evidence
Act, 1872 the same is admissible in evidence, without compliance with the conditions in Section
65B of the Evidence Act. There may be occasions when in large establishments like Railways,
Airports where large number of cameras are installed and the information is stored digitally in
huge servers, it may not be possible for the Police to seize the server and send them either to the
Forensic Science Department or produce them before the Court. Only to obviate this difficulty
and to satisfactorily meet the objections relating to admissibility of secondary evidence in
electronic form, the Parliament thought it fit to provide a certification under Section 65B. Even if
the certification is not obtained at the time of collection of evidence, yet, at the time of trial,
evidence aliunde can be given through the person who was in charge of the Server, in terms of
Section 65B of the Act, as held by a Division Bench of the Delhi High Court in Kundan Singh v.
State72. The Police can also requisition the services of Computer Experts and Experts from the
Forensic Sciences Department to retrieve data from a huge server through USB drive or CD
drive or any other gadget for the purpose of investigation and production of the same before the
Court without disturbing the integrity of the original source. If we fail to provide this facility to
the Police, the Criminal Justice Delivery System will become a lame duck.88

State v. Manoj Kumar (2017), 173/6 & 429118/16

This case of Delhi District Court was related to the death occurred in the court premises of the
Karkardooma district court, which was captured in the CCTV installed within the court premises,
and this was the most powerful evidence against the accused. In order to convince the court, the
DVD having the CCTV footage was played in the court. The main contention in this case was
that there is a difference in the hash value of the original hard disc and the DVD, which was
played in the court, therefore, no conviction can be based relying upon the same. The Court held
as follows:
88
See generally Supra Note 70

xcii
To prove the genuineness or authenticity of CCTV Footage, Prosecution has examined several
witnesses. The Forensic Investigator of Pyramid Cyber Security and Forensic Pvt. Ltd deposed
that he took out the Hard Disc from the CPU of the control room and prepared two mirror copies
of the hard disc with the help of a device called logicube Dossier. The two hard discs for
preparing the mirror image were given by the police. He generated the hash value of original
hard disc, which was taken out from the CPU with the help of Logicube Dossier. He deposed
that there was no tempering in the process of taking out the Hard Discs from the CPU and doing
the preparation of its mirror image. (Para 32) He further stated that it is probable that if the disc
is not provided the right protection while attaching it to some system or Network, the hash value
may change because of the viruses or any other executable programme.

It is important to note that the District Court of Delhi was open to such technicalities presented
by the forensic experts and facilitated the admissibility of the CCTV footage, which is a positive
indication towards the changing attitude of the Judiciary.

CBI v. Nirmal Singh (2017), DLCT01-004642-2015 – Delhi District Court

The issue revolved around the report of a forensic expert, whose credential as an expert was
questioned by the defence. According to defence, he is not an expert in voice recognition and
was not authorized to give any such opinion as he was not notified under Section 79-A of
Information Technology Act, 2000. It has also been argued that in order to ensure the
authenticity of the recording, no hash value was generated either by CBI or by CFSL and,
therefore, it is not clear whether recording in question are unedited or unaltered or not.

Another important aspect covered by this case was whether any accused can be compelled to
give voice sample or not. In Ritesh Sinha Vs. State of UP 89, the question whether Article 20(3) of
Constitution of India, which protects a person accused of an offence from being compelled to be
a witness against himself, extends to protecting such an accused from being compelled to give
his voice sample during the course of investigation into an offence or not.

89
(2013) 2 SCC 355

xcii
In view of the divergent views expressed by the Hon’ble Division Bench, the matter was directed
to be placed before a larger bench of Supreme Court. The Court held that in case of consent
given by the person (giving the voice sample), the question of conflict with Article 20(3) does
not arise in admitting such evidence.

K. Ramajayam @ Appu v. The Inspector of Police90

The Court, in this case, issued certain guidelines with regard to scientific and legal aspects of
CCTV recordings. The following were some of the crucial observations made by the court with
regard to scientific evidence:

“The law, it is said, walks a respectable distance behind science, but courts try to keep abreast.
The criminal is quick to use science to commit ingenious crimes, and so the police and the courts
should be no less innovative; and courts should always encourage the police to do so and admit
the evidence collected by any innovative method. The law courts can play an important role by
(1) taking expert evidence to see whether the best scientific methods have been used, (2) by the
Judge scrutinising the evidence carefully, and (3) encouraging the scientists, when the evidence
is reliable, by giving judicial recognition to his methods.”91

The capability of the human mind to give its own interpretation to what the eyes saw and what
the ears heard while narrating, cannot be discounted. Universally, Courts have recognized the
fact that there are bound to be exaggerations and embellishments in oral accounts. If five people
are asked to see an event and give an account of it individually, there will not be unanimity in
their versions……It is axiomatic that CCTV footage does not suffer such ills and human
frailities, and they are indubitably superior to human testimony of facts.

One has to understand the science of CCTV Recordings in the light of the Information and
Technology Act, 2000, for the purpose of its optimum usage as evidence in the Court of Law.
Gone are the days when Hindustan Photo Films produced film rolls for loading in the camera and
on the click of the button the image gets imprinted on the film. The imprint is called the negative,
which is the primary evidence, and the positive developed therefrom is considered as the
secondary evidence. That technique has now become defunct. Today, the physical images

90
2016 CriLJ 1542
91
See generally VEPA P.SARATHI, LAW OF EVIDENCE (2017)

xci
captured by the camera is converted by a computer software into information, capable of being
stored as data in electronic form and the stored data is electronic record. (Para 31)

The question of copy as it is normally understood in physical data may not be applicable for
electronic data. While retrieving the data from a huge Server it would suffice if certification
under Section 65B is obtained from the person, who is in-charge of the Server. After so obtaining
the information in a USB drive or CD or any other gadget, the expert can feed the data into his
computer and take printouts in tangible form with his certification stating as to how he had
collected the data from the Server and fed them into his computer and produced the outputs.
These two certifications, in our opinion, will satisfy the requirements of Section 65B of the
Indian Evidence Act, 1872. (Para 35)

Sidharth Jaitly v. State92(2015)

The petitioner, through the mechanism of RTI, has collected information from CFSL, Lodhi
Road, New Delhi; APFSL, Hyderabad and CFSL, Chandigarh, regarding the procedure for voice
sample collection. In all such reports, it has been communicated that hash value is not mandatory
for examination of authenticity or comparison of voice recording contained in two CDs, but is
only an additional parameter to verify whether the two audio/data files are same and that several
factors have to be considered with respect to the tape authentication examination. (Para 9)

Ram Kishan Fauji v. State of Haryana & Ors93

In this case, the CD was examined and the forensic image was authenticated by MD5 Hash (#)
value in CFSL Hyderabad. Hash value is stated to be a result of a calculation (hash algorithm)
that could be performed on a string of text, electronic file or entire hard drive’s contents. Each
hashing algorithm uses a specific number of bytes to store a thumbprint of the contents. The
most common hash value, it would appear to be MD5. # MD5 has a particular value which if
picked up from a CD, its authenticity is best illustrated by the fact that the memory chip also
contains the thumbprint, namely, the hash value MD5. …Another important aspect, which it has
noted, is that there was no link possible between the digital evidence storage media, namely, the

92
LNIND 2015 DEL 5103
93
(2017) 5 SCC 533

xcv
CD and the memory chip that was said to have been the source for the replication of data in the
CD.

The Court held that after securing the report from the CFSL, Hyderabad, there is hardly anything
left to assess the authenticity of the CD. If the CD cannot stand the test of authenticity by its
comparison with its hash value with the source, then the transcript of what has been obtained
through its audio footage or what it purports to capture cannot be taken as of any value.

State vs. Mohd. Afzal and others94

The issue before the Delhi High Court in this case was whether the computer print outs, for the
various telephones, stood proved as per Section 65B of the Indian Evidence Act, 1872 or not.
Recognizing the rules of evidence laid down in Section 65A and 65B of the Evidence Act, the
Court held as follows:

“The normal rule of leading documentary evidence is the production and proof of the original
document itself. Secondary evidence of the contents of a document can also be led under Section
65 of the Evidence Act. Secondary evidence of the contents of a document can be led when the
original is of such a nature as not to be easily movable. Computerised operating systems and
support systems in industry cannot be moved to the court. The information is stored in these
computers on magnetic tapes (hard disc). Electronic record produced there from has to be taken
in the form of a print out. Sub-section (1) of Section 65B makes admissible without further
proof, in evidence, print out of an electronic record contained on a magnetic media subject to the
satisfaction of the conditions mentioned in the section. The conditions are mentioned in Sub-
section (2). Thus compliance with Sub-section (1) and (2) of Section 65B is enough to make
admissible and prove electronic records. This conclusion flows out, even from the language of
Sub-section (4). Sub-section (4) allows the proof of the conditions set out in Sub-section (2) by
means of a certificate issued by the person described in Sub-section (4) and certifying contents in
the manner set out in the sub-section. The sub- section makes admissible an electronic record
when certified that the contents of a computer print out are generated by a computer satisfying
the conditions of Sub-section (1), the certificate being signed by the person described therein.

94
(2003) DCT 385

xcv
Thus, Sub-section (4) provides for an alternative method to prove electronic record and not the
only method to prove electronic record.” (Para 266)

CHALLENGES IN ADMISSIBILITY AND THE JUDICIARY

With the amendment of the Indian Evidence Act, 1872 by the Information Technology Act,
2000, new standards of admissibility of electronic evidence were laid down in Section 65-A and
Section 65-B of the Evidence Act. From the analysis of various cases referred to above, it has
been observed that in spite of the standards, there has been significant divergence in the approach
of the courts in India with regard to handling of electronic evidence. The intervention of the
Supreme Court of India in State (NCT of Delhi) v. Navjot Sandhu (2005), P.V.Anvar v. P.K.
Basheer (2014) and Shafhi Mohammad v. State of Himachal Pradesh (2018) has proved the
divergent approach of the Court. Prior to Navjot Sandhu (i.e.2005), the rules of admissibility laid
down in Section 65-A and Section 65-B were yet to be interpreted extensively, even though the
courts started recognizing the importance of scientific evidence and the crucial role of a scientific
expert. With Navjot Sandhu coming into force, a liberal approach could be seen among the
judiciary facilitating production of electronic evidence as secondary evidence. The Court held
that the law permits such evidence to be given in the circumstances mentioned in the relevant
provisions, namely, Sections 63 and 65 of the Evidence Act.

Several issues were raised before the Judiciary since the standards of admissibility have been laid
down in the law of evidence. Some of them may be highlighted as follows:

• Who is the certifying agency for giving certificate?

• How independent are the persons certifying under Section 65B? To what
extent are they free from influences? How do we ensure authenticity?
• No prescribed format for the certificate – lack of clarity in terms of contents
• There is no guideline followed by the judiciary to reject or accept the
certificate.
• The person giving the certificate provides a crucial link between the
investigating officer and the judge.
• It should be made mandatory to file a declaration by the person giving the
certificate that the same is provided independently without any influence.

xcv
If an electronic record as such is used as primary evidence under Section 62 of the Indian
Evidence Act, 1872 the same is admissible in evidence, without compliance with the conditions
laid down in Section 65B of the Evidence Act.

We are aware that in many public and private offices, though computers are operated by their
staff, yet the manning and maintenance of servers, where the data is actually stored, is
outsourced to private players like TCS, WIPRO, etc. Under those circumstances, it would suffice
if Section 65B certificate is obtained from the person who is in charge of the server albeit the fact
that he is not a staff of the parent organization. Section 65B does not require certification by a
public authority unlike cases of issuance of certified copy of public document under section 76
of the Indian Evidence Act, 1872. It is not necessary in every case to examine the person who
had given the 65B certificate as witness before the trial Court, unless the Court suspects the
integrity of the electronic record that is produced as evidence. One should bear in mind that a
digital image cannot be manipulated easily. Every digital image has a meta data stored in it. The
meta data are structured as coded data, which gives every image its own character. It should be
remembered that the certification under Section 65B is not for the truthfulness of the content of
the computer generated record, but is essentially related to the working condition of the
computer from where the stored record is produced in a tangible form for the Court to inspect.
Defence will always complain of manipulation, but Courts can reject fanciful objections bearing
in mind the principle underlined in Section 114 of the Indian Evidence Act, 1872. De omnibus
dubitandum (doubt everything) philosophy may be a road to scientific discoveries, but not for
judicial enquiries, where perfect proof is utopian.

Given that most of the evidence generated today is in electronic form, litigators have to learn to
deal with it efficiently, cost-effectively and with a mind to getting it admitted at trial. For several
years, litigators tried to wish away the problems of electronic evidence by simply printing out e-
mails and word processing documents. Since most of the criminal cases involve electronic
records, it has no more remained feasible to convert every electronic document to paper
document. The more challenging part is that when an electronic document is converted to paper,
valuable information found within its metadata is lost. In the process, we convert the evidence
from its “best evidence” original form into a version that might need secondary evidence to
justify its admission. Further, the metadata attached to electronic documents, besides being

xcv
potentially relevant to the case, is extremely useful for sorting and organizing electronic
evidence, which also saves time and money.

Unfortunately, there are still some litigators who have their clients print out all of their e- mails,
only to have the lawyers then pay to have the same e-mails scanned into litigation software to be
organized for an affidavit of documents and trial. Data that is already in electronic form can be
reviewed, organized, produced and admitted into evidence at trial without the need for any
printing or copying. The cost implications are significant. Technology is integral to litigation and
so litigators need to relate to it in a way that serves the ends of justice.91

CHAPTER-6

CONCLUSION AND SUGESSTION

Today, the biggest challenge the Courts have to deal with regard to electronic evidence is its
authenticity, veracity, genuineness and reliability for it to be admissible before the court of law.
However, with the legal recognition given by the Information Technology Act, 2000 to the
electronic or digital evidence, along with subsequent amendments in the Indian Evidence Act,
1872, the use of electronic form of evidence has come a long way. Yet, it cannot be said that the
statutory provisions introduced to assess the veracity of the electronic evidence are suffice to
face the issues which arise as a result of malpractices such as falsification of information in
relation to the legitimacy of information relied upon as piece of evidence during trials or
proceedings. In order to deal with the concerned issued, it may be sagacious to set up a special
team of experts who are well-versed with information technology and can assist the courts by
investigating the authenticity of electronic records presented as evidence.

xci
In an initiative taken by the Ministry of Electronics and Information Technology, it has finally
acknowledged the need for appointing an expert for Electronic evidence that will provide aid to
the investigators and prosecutors as per the changing requirements. In this article we have gone
through Section 79A of the Information Technology Act, which empowers the Central
Government to appoint “Examiners of Electronic Evidence” along with the pilot scheme for
notifying the Examiner of Electronic Evidence launched in the year 2017. It is pertinent to note
that under this scheme only Central or State Government agencies who are specialized in the
field of forensics can apply to be evaluated and certified.

After this, the applying agencies have to go through a three-stage assessment only then they shall
be appointed as examiners. The appointment of such examiners is a progressive step in making
the electronic evidence not just reliable but admissible before the court of law. But as far as the
success rate of the pilot scheme introduced by the MeitY is considered it cannot be said to have
achieved the purpose as we need more certified labs, putting their seal and sign which in itself
qualifies as a concrete attestation before any court.

With the technological advancement, the admissibility of the secondary electronic evidence has
to be adjudged within the parameters of Section 65B of Evidence Act and the proposition of the
law settled in the recent judgment of the Apex Court and various other High Courts as discussed
above. The proposition is clear and explicit that if the secondary electronic evidence is without a
certificate u/s 65B of Evidence Act, it is not admissible and any opinion of the forensic expert
and the deposition of the witness in the court of law cannot be looked into by the court.
However, there are few gaps which are still unresolved as what would be the fate of the
secondary electronic evidence seized from the accused wherein, the certificate u/s 65B of
Evidence Act cannot be taken and "No person accused of any offence shall be compelled to be a
witness against himself" as per Article 20(3) of the Constitution of India.

Strict compliance with section 65B is now mandatory for persons who intend to rely upon e-
mails, web sites or any electronic record in a civil or criminal trial before the courts in India. This
outlook of the Supreme Court of India is to ensure that the credibility and evidentiary value of
electronic evidence is provided for, since the electronic record is more susceptible to tampering
and alteration. In its judgment, Kurian J observed, that: ‘Electronic records being more
susceptible to tampering, alteration, transposition, excision, etc. without such safeguards, the

c
whole trial based on proof of electronic records can lead to travesty of justice.’ Therefore, the
computer generated electronic record cannot be solely relied upon, because there is a possibility
of it being hampered. The Indian Evidence Act could be further amended to rule out any
manipulation - at least for the purposes of presuming prima facie authenticity of the evidence of
the electronic record - by adding a condition that the record was created in the usual way by a
person who was not a party to the proceedings and the proponent of the record did not control the
making of the record. By ensuring that the record was created by a party who was adverse in
interest to the proponent of the record, and the record was being used against the adverse party,
the risk of the manipulation of the records would be reduced significantly. This is because, it is
argued, no disinterested party would want to certify the authenticity of the record which to his
knowledge had been tampered with. The law also needs to creatively address the requirement of
the burden being on the proponent to provide testimony as to the author of a document to
determine whether there was any manipulation or alteration after the records were created, the
reliability of the computer program that generated the records, 20 and whether the records are
complete or not. The courts also have to be mindful that data can be easily forged or altered, and
section 65B of the Evidence Act does not address these contingencies. For instance, when
forwarding an e-mail, the sender can edit the message. Such alterations are often not detectible
by the recipient, and therefore a certificate of a third party to the dispute may not always be a
reliable condition to provide for the authenticity of the document.

Serious issues have been raised in the digital world due to malpractices such as falsification of
information and impersonation, in relation to the authenticity of information relied upon as
evidence. It raises queries as to how it is possible to prove the creation and transmission of
electronic communication by one party when the party’s name as the author of the post could
have been inserted by anyone. Perhaps, it may be prudent for the courts or the government to set
up a special team of digital evidence specialists who would assist the courts and specifically
investigate the authenticity of the electronic records. The challenges with respect to the
admissibility and appreciation of electronic evidence, India still has a long way to go in keeping
pace with the developments globally. Although the amendments were introduced to reduce the
burden of the proponent of records, they cannot be said to be without limitations. It is clear that
India has yet to devise a mechanism for ensuring the veracity of contents of electronic records,

ci
which are open to manipulation by any party by obtaining access to the server or space where it
is stored.

The admission of electronic evidence along with advantages can also be complex at the same
time. It is upon the courts to see that the whether the evidence fulfils the three essential legal
requirements of authenticity, reliability and integrity. After Anvars case decision by the Supreme
Court laying down the rules for admissibility of electronic evidence it can be expected that the
Indian courts will adopt a consistent approach, and will execute all possible safeguards for
accepting and appreciating electronic evidence.

cii
ciii
 BIBLIOGRAPHY

Books

 ALAN M. GAHTAN, ELECTRONIC EVIDENCE (1999)

 ANDREW SANDERS ET AL., CRIMINAL JUSTICE (2010)
 ARTHUR PERCIVAL WILL, A TREATISE ON THE LAW OF CIRCUMSTANTIAL
EVIDENCE, (2012)
 BILL NELSON, AMELIA PHILLIPS & CHRISTOPHER STEUART, GUIDE TO
COMPUTER FORENSICS AND INVESTIGATION (2010)
 Bindu Jindal ed. Gurmanpreet Kaur, CYBER STALKING AND VICTIMIZATION OF
WOMEN: AN ANALYTICAL STUDY, IN LAW AS A CATALYST OF SOCIAL
CHANGE IN PRESENT SCENARIO (2016).
 BIVAS CHATTERJEE, ELECTRONIC EVIDENCE (2015)
 CHRIS L.T. BROWN, COMPUTER EVIDENCE COLLECTION AND
PRESERVATION (2006)
 CHRIS REED & JOHN ANGEL, COMPUTER LAW (2004)
 DARREN R. HAYES, A PRACTICAL GUIDE TO COMPUTER FORENSICS
INVESTIGATIONS (2014)
 DEJEY AND MURUGAN, CYBER FORENSICS (2018)
 DR. GUPTA & AGRAWAL, ELECTRONIC EVIDENCE (2018)
 DR. JEETENDRA PANDE & DR. AJAY PRASAD, DIGITAL FORENSICS (2016)
 DR. NAGARATHNA, CYBER CRIME LAWS – A HANDBOOK, VOL. I, NLSIU
(2016)
 14. EMILY VIRTUE, COMPUTER FORENSICS: IMPLICATIONS FOR
LITIGATION AND
 DISPUTE RESOLUTION (2003)
 EOGHAN CASEY, DIGITAL EVIDENCE AND COMPUTER CRIME (2011)
 GARIMA TIWARI, UNDERSTANDING LAWS – CYBER LAWS AND CYBER
CRIMES (2014)

civ
 GEORGE M. MOHAY, COMPUTER AND INTRUSION FORENSICS, (2003)
 GORDON PELTON, INTRODUCTION TO COMPUTER FORENSICS WITH 33
REAL LIFE CASES (2011)
 GURMANPREET KAUR, CYBER STALKING AND VICTIMIZATION OF WOMEN:
AN ANALYTICAL STUDY, in BINDU JINDAL ED. LAW AS A CATALYST OF
SOCIAL CHANGE IN PRESENT SCENARIO (2016).
 Hamda Bariki et al., DEFINING A STANDARD FOR REPORTING DIGITAL
EVIDENCE ITEMS IN COMPUTER FORENSIC TOOLS (2011)
 J. STRONG, MCCORMICK ON EVIDENCE (1999)
 JACK BALKIN et al. CYBERCRIME: DIGITAL COPS IN A NETWORKED
ENVIRONMENT (2007)
 23. JAMES FITZJAMES & WILLIAM REYNOLDS STEPHEN, DIGEST OF
THE LAW OF
 EVIDENCE AS ESTABLISHED IN THE UNITED STATES (1905)
 JOHN R. VACCA, COMPUTER FORENSICS: COMPUTER CRIME SCENE
INVESTIGATION (2004).
 JOHN REYNOLDS GULSON, PHILOSOPHY OF PROOF IN ITS RELATION
TO THE
 ENGLISH LAW OF JUDICIAL EVIDENCE (2012)
 JOHN VACCA & K RUDOLPH, SYSTEM FORENSICS, INVESTIGATION, AND
RESPONSE (2011)
 K.N.C PILLAI, R. V. KELKAR’S CRIMINAL PROCEDURE (2016)
 KANELLIS, P ET AL., DIGITAL CRIME AND FORENSIC SCIENCE IN
CYBERSPACE (2006)
 KARNIKA SETH, COMPUTERS, INTERNET AND NEW TECHNOLOGY LAWS
(2016)
 LARRY DANIEL, DIGITAL FORENSICS FOR LEGAL PROFESSIONALS (2012)

cv
ARTICLES

 Adam Wilson, Expert Evidence, 70 J. CRIM. L. 292 (2006)

 Amitai Etzioni, Implications of Select New Technologies for Individual Rights and
Public Safety, 15(2) HARV. J. OF L. & TECHN (2002)
 Anne Wallace, Using Video Link to Take Forensic Evidence: Lessons from an Australian
Case Study, 17(3) INT. J. OF EVIDENCE & PROOF 221 – 49 (2013)
 Arunima S Kumar, Cyber Forensics in Kerala, INT’L J. OF COMP. SCI. & MOBILE
COMPUTING 74 (2013)
 Ashwini Vaidialingam, Authenticating Electronic Evidence: S. 65B, Indian Evidence
Act, 1872, NUJS L. REV. 43 (2015)
 Asou Aminnezhad, A Survey on Privacy Issues in Digital Forensics, 1 (4), INT. J.OF
CYBER SEC. & DIG. FORENSICS (IJCSDF) 1(4): 311-323
 B. Carrier, DEFINING DIGITAL FORENSIC EXAMINATION AND ANALYSIS
TOOLS USING ABSTRACTION LAYERS, 1(4), INT. J. OF DIGITAL EVIDENCE,
(2003).
 Barry Chen, Computer Forensics in Criminal Investigations,
DARTMOUTH UNDERGRAD. J. OF SCI. (2013)
 Carrie Morgan Whitcomb, A Historical Perspective of Digital Evidence: A Forensic
Scientist’s View, 1 (1), INT’L J. OF DIGITAL EVIDENCE (2002)
 Christopher Wall & Jason Paroff, Cracking the Computer Forensics Mystery, 17 (7)
 UTAH BAR JOURNAL (2015)
 Confluence of Digital Evidence and the Law: On the Forensic Soundness of Live-
Remote Digital Evidence Collection, 2005 UCLA J.L. & Tech. 5
 Dale A. Nance, Reliability and the Admissibility of Experts, 34, SETON HALL LAW
REVIEW (2003)
 Daniel Capra, Authenticating Digital Evidence, FORDHAM LAW ARCHIVE OF
 SCHOLARSHIP & HISTORY (2017)

cvi
  David R. Johnson & David Post, Law and Borders—The Rise of Law in Cyberspace, 48
STANFORD L.REV. 1357(1996).
 Deepak Kumar Ganguly & Asoke Nath, Digital Forensics – A Deeper Look into Email
Analysis, 7(5D) INT’L J. OF CURRENT ADV. RES. 12494 (2018)
 Dr. Richard Bassett et al., Computer Forensics: An Essential Ingredient for Cyber
Security, 3(1), J. INF. SYST. & TELECOMM. (2006)
 E. Casey, Error, uncertainty and loss in digital evidence, 1(2), INT. J. OF DIGITAL
EVIDENCE, (2002).
 Erin E. Kenneally, Confluence of Digital Evidence and the Law: On the Forensic
Soundness of Live-Remote Digital Evidence Collection, 5 UCLA J. L. & TECH. 1 - 81
(2005)
 Erin E. Kenneally, Confluence of Digital Evidence and the Law: On the Forensic
Soundness of Live-‐Remote Digital Evidence Collection, UCLA J.L. & TECH. 5 (2005)
 Felix Freiling & Leonhard Hosch, Controlled experiments in digital evidence tampering,
DIGITAL INVESTIGATION, 24 (2018)
 Felix Freiling & Leonhard Hosch, Controlled experiments in digital evidence tampering,
DIGITAL INVESTIGATION 24 (2018)
 Gary C. Kessler, The Impact of MD5 File Hash Collisions on Digital Forensic Imaging,
11(4) J. OF DIG. FOR., SEC. & L. 129 (2016)
 Himanshu Setia, Evidentiary Value of Forensic Reports in Indian Courts, RES. J.
FORENSIC SCI., Vol. 4(6), 1-7, June (2016)

24. Inikpi O. Ademu et al., A New Approach of Digital Forensic Model for Digital Forensic

cvii