Don’t fall into the trap of falsification of evidence while producing Section 65B certificate

Section 65B of Indian Evidence Act requires a certificate to be produced with any Electronic Document submitted as evidence in a Court of law, at the admission stage.

The mandatory requirement of Section 65B certificate came into effect on 17th October 2000 when ITA 2000 (Information Technology Act 2000) was notified. However it was the undersigned who produced first such certificate in a Court. It was  in 2004 in the State of Tamil Nadu Vs Suhaskatti case for criminal prosecution under Section 67, in the Egmore AMM Court, Chennai. Based on the certified evidence the Court went on to proceed with the trial and convict the accused. The conviction sustained even in the appeal at the Session Court upholding the validity of the evidence. Since then the Section 65B certificates produced by the undersigned have been produced in other courts from time to time.

However it was not until the Supreme Court judgement in the P A Anvar Vs P.K Basheer that the litigation market players realized that electronic evidence without Section 65B certificate would not be admissible in the Courts. Even the Police have started adding in their CrPc notices calling for information which may be in electronic form to be provided with Section 65B certificate.

Naturally, there is a scramble now on understanding how the certificate has to be given. Though Naavi.org and ceac.in have put out clear information on how Section 65B certificate is to be produced, there are a few legal practitioners who may hold some different viewpoints on some of the finer points of certification. Such differences will persist for some time and will be resolved over a period of time as long as we try to understand the purpose of the section and its use case scenarios.

What is however necessary for Companies in particular from the ITA 2008 compliance angle and ordinary citizens relying on such evidences to fight cases in the Courts is to understand that if the evidence is not properly produced, they may be rejected by the Court at the admission stage itself.

On the other hand, we also need to warn companies and individuals that some times there is a tendency to produce evidence which is deliberately falsified with the hope that no body would find out.

I recently came across such an incident where a large Telecom company had filed an apparently falsified electronic evidence to support its case against one of their employees. The electronic documents were supported by Section 65B certificate and also an affidavit in the Court.

It is possible that the defense may submit suitable arguments to throw this evidence out but what we need to remember is that production of falsified evidence is clearly an offence under Section 193 of IPC which is a cognizable offence carrying 7 years of imprisonment.

The person who produced a falsified Section 65B certificate and an affidavit in respect of the certificate would be liable for punishment under Section 193.

Such an Act will also be an offence under Section 43/66 of ITA 2000/8. Some of these incidents would also be offences under Section 65 and Section 67C of the Act as well.

When such person is an employee of a company and the interest of the Company is involved, the Company would also be guilty of the offence and it would extend to the “Officers in charge of Business” and “Directors” under acts such as the Companies Act  and ITA 2000/8.

While the offence under Section 193 of IPC carries 7 years imprisonment the ITA 2000/8 offences carry 3 years imprisonment.

I therefore advise those who donot know how to produce Section 65B evidence should not take the risk of producing falsified evidence as it may boomerang on them during the course of the trial when it is proved to have been falsified.

In Civil cases when such falsification comes to the knowledge of the Court it would be possible for the Judge to order that criminal action should be initiated by the prosecution separately either under IPC or ITA 2000/8. Perhaps it may be possible for the Court to initiate Contempt of Court proceedings for misleading the Court through falsified evidence.

Even in cases where an electronic evidence was present at one point of time but the litigant has failed to get Section 65B certificate for an evidence and subsequently it is no longer available, instead of trying to falsify the evidence with a compromised Section 65B certificate, it is better to forego the presentation of the documentary evidence in the form of electronic documents and try to proceed with other evidence on hand including oral evidence and witnesses.

Naavi

Posted in Uncategorized | Leave a comment

Forum Owners when you get a request to remove content… Comply with Section 65

Recently, I had raised an objection about a comment posted by MCX of India limited on the Discussion forum of MyGov.in regarding Bitcoin regulation. The Government had asked for public opinion on the forum which was expected to be used by the Committee formed for the purpose to arrive at a decision.

Obviously there were different stake holders with different vested interests. Some wanted Bitcoins to be legalized and some did not. The undersigned was one who held that Bitcoins is detrimental to the interests of the country and needs to be banned.

(Details are available in a series of articles at present ending with this article on naavi.org: Fight Against Corruption now has a new Slogan: Say No to Bitcoins).

Multi Commodity Exchange of India (MCX) is a licensed Commodity Exchange that allows trading of derivatives related to different commodities including Gold and Silver as well as Foreign Exchange under the regulations formed by SEBI and RBI. It is like BSE and NSE and is a quasi regulator of commodity derivatives.

In the event Bitcoin or any other Crypto Currency is recognized by India as a commodity, it would be naturally a “Commodity or a Derivative” which would come under the trading list of MCX. Hence MCX is a direct stake holder of the Government decision to legalize Bitcoins or otherwise.

Just as RBI or SEBI itself was not expected to participate in the forum discussions and give its views since they were the decision makers themselves, MCX was also considered as part of the regulator and not part of the public.

However, some  executive who did not understand the nuances of propriety posted an opinion using the official logo of MCX stating that MCX recommends legalization of Bitcoins. This was posted on the forum a few hours before the end of May 31 when the collection of opinion was to end.

The undersigned raised an objection and called it as an attempt of an “Insider” in “Fixing” the decision of the committee and demanded action. Since MCX is a Board managed company and the opinion expressed was a policy decision, it should have been taken only under the directions of the Board. Also since MCX is a listed company itself, major Policy decisions that are considered “Price Sensitive” need to be notified to the BSE/NSE before being released to the public.

What MCX did was therefore a failure of Corporate Governance and fit for penal action from SEBI.

When the objection was raised by the undersigned, the Board naturally moved in and perhaps wanted to take its own corrective action. The first thought that came to their mind was “Removing the Comment” which was perhaps not authorized. Perhaps most managers would come to the same conclusion. They would have therefore contacted My Gov forum administrator and requested for removal of the content. MyGOv.in admin obliged by removing the content.

However this raises one issue of “Electronic Evidence” being tampered with. MyGov.in in this context is an “Intermediary” and when a notice of objectionable content is given to them by a suitable authority, under Section 79 of ITA 2000/8 they could remove the content. But this was a forum where the persons posting the comments were not authorized to remove the content once posted and hence it was expected that content once posted was an “Evidence” that could be acted upon by others who could view the content and be influenced by it.

According to Section 79 rules, it is necessary that content removed needs to be preserved for evidentiary purpose for atleast 90 days ass “Provisional Evidence” . If however he becomes aware that actually there is a dispute related to the content and it is “Actual Evidence” then he needs to preserve it for a reasonable longer time.

In the current incident, anticipating the removal of content, CEAC had already captured the evidence as it existed on May 31 2017 and also captured the forum content on June 1, 2017 showing clearly the absence of the original content or more appropriately, the “Tampered Page” .

Now the My Gov.in administrator can be accused of allowing of tampering of the electronic evidence when it was required to be maintained under law. (Section 65 of ITA 2000/8).

The correct procedure for removal of content was one of the following two methods.

  1. A rejoinder could have been posted along with the original content indicating prominently that the content has been reportedly been posted without the authority of MCX (which is an offence under say Trade Mark Act, Impersonation under Section 66C/66D of ITA 2000/8 etc) and the management has disclaimed the opinion made there in and should be ignored. Then the viewers would see both the original content and the correction. (This method was suggested by Naavi way back in December 2000 in the context of dalistan.org website in our article How To control Rogue Sites)
  2. The administrator of MyGov.in could have masked the earlier message with his note that the content has been masked because it had been reportedly been posted without authority of the organization in whose name it was posted.

If therefore BSE or NSE now wants to take action as mandated by the SEBI regulations on MCX for violating the listing guidelines, they will have to contend with a situation that the offending evidence is no longer available on the web and has been tampered with by none other than MyGov.in administrator. He can plead ignorance and escape criminal prosecution but the evidence is lost at his end.

However, CEAC is maintaining the evidence and has also posted it on www.naavi.org The article posted in naavi.org itself can be used as an evidence with Section 65B certification of the naavi.org webpage.

This article is being published to explain the Compliance requirements under Section 65 of ITA 2000/8 by public discussion forum owners.

It also explains the context in which Section 65 B certificates can be of use in public interest litigations as well as specific litigation involving tamperable electronic documents. (Provided one is alert to capture the before and after instances of the electronic documents through a trusted third party like CEAC).

Other aspects of Section 65B certification on who has to give such certification and how are discussed elsewhere.

Naavi

 

Posted in Uncategorized | Leave a comment

A Case of Misreporting creates confusion…in Section 65B

Today livelaw.in flashed a report stating that the  Madurai Bench of the High Court of Madras has reportedly observed that “Primary Evidence of electronic record under Section 62 of Indian Evidence Act would be admissible without compliance of Section 65”.

This was directly in contradiction with the Supreme Court judgement in the case of P.V.Anvar Vs P.K.Basheer and raised an eyebrow as to how the High Court could have blatantly ignored.

A copy of the report is available here:  report in Livelaw.in,

However when the order was perused in detail it was found that it was the report which was blatantly wrong and misleading and the order had not said what the report stated.

The Court had before it a petition from the accused of a Dowry harassment case in which the complainant had adduced a CD as evidence while the argument was in progress in the trial Court. The CD was said to contain some conversations but it appears that there was no certification under Section 65B. It also appears that the IO nor the prosecutor had not signed the revision petition. The magistrate had ignored the irregularity and proceeded to admit the evidence.

Naturally the accused objected and brought this petition to challenge the trial court order to accept the evidence.

It appears that this is a case of incorrect reporting by the blog which is regrettable.

Copy of the Judgement is here.

The Court has actually allowed the petition and set aside the trial court’s order to accept the CD as evidence. It has asked the trial court to proceed with the trial based on the existing documents and closed the miscellaneous petition under which the complainant sought to bring in new evidence.

It is interesting to note that the honourable judge in this case was Justice A.M. Basheer Ahamed and it would have been a Basheer overriding the Basheer Judgement if the report had been true!. It would have made an interesting headline for the media but fortunately the report was untrue.

Naavi

 

Posted in Uncategorized | Leave a comment

What to do if your computer is locked by a ransomware

Leaving the technicalities aside, I have posted a detailed Advisory on what a Common man has to do if his computer is affected by WannaCry or other similar ransomware. This advisory is available at Naavi.org 

I am not repeating it here.

I am only highlighting some steps to be taken by professionals who may find themselves in a situation where they cannot recover their computer.

I recently came across a situation where one of the customers lost the data hosted on a foreign server due to the foreign server getting affected and there was no back up. Such situations may also arise for other professionals.

In such cases the data loss may be later on interpreted as a “Deliberate Data Erasure” by the tax authorities or other regulatory authorities and the computer owner has to provide a proper confirmation about  the fact that his computer was in deed infected and the data was lost due to reasons beyond his control. Remember that deliberate data erasure may invite penalties under Section 65 and 67C of ITA 2000/8.

Such persons should therefore first keep a record of the fact that they were victims of this ransomware attack. This is suggested to be done by taking a CEAC certified copy of the locked screen showing the attack.

For more details you may contact Naavi.

Next, (After certification), I suggest that the hard disk with encrypted files may be removed from the system and preserved for some time. In case a decryption key is reverse engineered in due course, it may be possible to extract the data. It would also be an evidence to the law enforcement authorities that your claim of being a victim is not an alibi but a real fact.

If you want to prove that you were a victim despite using a licensed OS and reasonably updated along with a reasonably updated anti virus system, there is need to preserve the evidence. If you simply reformat the hard disk and continue your work, you may later have to answer that you did not take enough efforts to restore the data.

Naavi

Posted in Uncategorized | Leave a comment

Evidence Obtained Illegally is also admissible if relevant…

Recently, a question was posed to the undersigned about the acceptability of evidence when there is a challenge that the evidence was obtained through illegal means. Following is my reaction to the query.

There have been many occasions in which an Indian Court had to debate whether an evidence can be admitted when it is brought to its notice that the evidence was obtained illegally. Most of these cases in the past have arisen on account of the Government tapping the telephone conversations and it has been challenged either as “Improper” or “Illegal”.

Illegality arises when the person has obtained an evidence by deceit, stealing or in the case of Cyber Evidence, by “hacking”. Impropriety may arise when there was a legal means and a procedure for collection of evidence which was not followed.

Obviously, it is easy to assume that “Procedural Irregularities” can be condoned but human rights activists often raise objection when evidence has been obtained through illegal means.

The opposition to the Courts accepting an illegally obtained evidence stems from the fact that it may violate the “Constitution of India”, the “Right to Privacy” and such other principles which are dear to some activists and even some Judges.

In many cases of matrimonial disputes, the spouses often plant spyware in the other spouse’s phone or computer and gather incriminating evidence. We had recently reported a West Bengal Adjudication verdict  in which a husband was fined for violating the privacy of his wife when he extracted evidence supportive of his matrimonial dispute case by means which were held violative of the privacy of his wife.

There are also instances when some resort to hacking of face book or gmail accounts to extract evidence.

In all such cases the counter party has a case against the party which has obtained evidence that it was obtained illegally and hence should not be admitted.

However, a series of Indian judicial decisions have held that an evidence is admitted if it is “relevant” though it was obtained improperly or illegally.

Hopefully the matter is considered a settled view since according to this Business Standard Report, the Bench headed by Justice B.S. Chauhan has stated,

“It is a settled legal proposition that even if a document is procured by improper or illegal means, there is no bar to its admissibility if it is relevant and its genuineness is proved. If the evidence is admissible, it does not matter how it has been obtained,”

It must however be noted that once a person adduces some evidence, it is an admitted evidence  against him and  can be used against him if required.

Hence when an evidence is presented which has been obtained illegally, it is open to the Court to accept it and proceed with the trial in the subject case where it was presented as evidence. At the same time  a separate action may lie against the person who obtained the evidence in violation of some law.

Hence parties should weigh the pros and cons of presenting an evidence obtained illegally before a Court. Police may however use the evidence during the preliminary investigation and for interrogation so that they may be able to unearth further evidence through legal means which can be used in the Court.

Considering the inconsistency that prevails in the Judicial system and the views of different judges, it cannot however be ruled out that Judges may selectively accept or reject evidence based on whether it was obtained improperly or illegally and the degree of illegality involved.

In some of the matrimonial cases as was referrred to earlier (West Bengal Adjudication) the illegality was only restricted to using of a shared password between husband and wife or “access to a system exceeding the authority provided by the owner” (Section 43). Such contraventions may be considered as “Technical Overreach” by one party and is unlikely to be strong enough a reason for rejecting the evidence (if it is relevant).

However, an operation like a “Sting Operation” where inducements are thrown out to tempt a party to transgress law (eg: corruption cases) which are similar to operating “Honey Pots” or policemen trapping sex predators on the chat rooms, could be falling in the grey area of whether the evidence should be accepted or not since these could be “evidence that is created by the person when it did not exist in the first place”.

Again, when an evidence which is present some where (say a Computer or Mobile or Private page of a Facebook, Encrypted Message etc) is extracted for presentation in a Court  as defense in a case brought on the person who is presenting the evidence, it should be considered as a legitimate reason where the evidence should be admitted even if the manner in which it was obtained was not entirely above board.

In the case of offensive action based on such evidence, Court may exercise its discretion whether the evidence was collected as it was present and not created out of an inducement and therefore there was a duty to bring out truth before the Court of an offence already committed by the accused for which the evidence was collected.

Comments welcome

Naavi

Also Read :

A Research report  on 2013 Law Commission report 

1983 Law Commission report

Reference Article-1

Reference Article-2

Reference Article-3

Delhi High Court Judgement-2012 (Digambar Khattar Vs Union of India)

Posted in Uncategorized | Leave a comment

More Clarification on Section 65B Certification… For Forensic Labs

Section 65B Certification of electronic evidence produced in a Court proceeding in India has been a matter of intense discussion in the circle of Forensic experts, Law Enforcement and of course the Legal fraternity.

Historically, the undersigned was the first person to produce a report under Section 65B of Indian Evidence Act in a Court in India. (Suhas Katti Case in 2004). Subsequently, it has been followed by many other Certificates issued under the banner of Cyber Evidence Archival Center (CEAC)  in the last 12 or more years.

During this time, the undersigned has handled many interesting CEAC certifications including  Web site pages, E Mails, Mobile data, Corporate Computer data, Personal Computer data, YouTube Videos, CCTV Videos, Extracts from Forensic software, Remote Desktop views etc. Some certifications are straight forward web pages as they appear, some are extracted with the use of some forensic software etc. Some electronic documents are text documents that can be easily printed out and some are audio and video files which have to be rendered only in soft copy format.

Every one of these different types of documents,  have been a challenge in terms of meeting the Section 65B requirements. Some times it has been necessary to structure solutions  to extract the electronic documents as per the best understanding of the requirements of Section 65B as perceived by the undersigned .

As a result of such long experience over the past 12 plus years, the undersigned has developed  specific procedures  to present the “Computer Output” as required under Section 65B of Indian Evidence Act.

I am aware that there are legal luminaries who have special expertise in Indian Evidence Act and some of them may hold views different from mine on some aspects of how the section 65B  has to be interpreted.  It is possible that for various reasons, many of them had not focussed on the issue of Section 65B until recently when Supreme Court drew its attention to the mandatory need for Section 65B certification for all electronic evidences presented to the Court. (Refer Basheer Case).

I was however drawn into it right from 2002 when CEAC was formed as a service and has therefore the procedures developed must be considered as an evolution of the system over a long period.  (It is not out of place to mention that I had proposed CEAC to be public private partnership with the the Ministry of IT at that time through the then CCA though it could not be implemented while it continued as a private service.)

At this point of time, Naavi’s approach to Section 65B certification used by CEAC should perhaps be considered as one of the approaches that needs to be accepted as a major school of thought  even if other experts have a different view point. However, we can  say that Jurisprudence on this aspect is still under development and different experts arguing differently and different Courts interpreting differently could be common. Some time in the future, I suppose the honourable Supreme Court will look into many of my articles including this one and give its own interpretation which itself may undergo many iterations over time.

With this humble submission, I would like to present below my view on one hypothetical case based on a reference received by me regarding submission of forensic reports by Forensic Labs and Government owned establishments such as CFSL or other equivalent organizations.

In the reference, there were the following aspects.

  1. The evidence consists of a Call Data Record (CDR) extracted from a Mobile Service Provider (MSP). (Perhaps this includes  Tower data record along with the billing and usage records)
  2. Mobiles seized from the accused sent to the lab for analysis
  3. Hard disks seized from the accused sent to the lab for analysis.

For the sake of discussion, I consider the following hypothetical requirement of the law enforcement.

The accused has used the mobile phone/s to make calls to say other co-accused or to the victim to further commit an offence which may be a Cyber Crime or a Physical Crime. . The CDR was collected from the MSP and handed over to the lab for further analysis. Mobiles and Hard disks were seized from the accused by the Police and sent to the lab. The CDR evidence is to be used along with the forensic analysis of the mobile where there may be contact details, some SMS/WhatsApp messages. It is possible that some of this data might have been deleted and has to be recovered using appropriate recovery software. Some of the recovered data may be fragments needing further interpretation. The Computer hard disk will also have many items related to the mobile and CDR either in active files or deleted and recovered. There could also be a back up of phone data in the computer of the accused whose hard disks have been seized.

The question that was posed in a reference was

a) Who will provide Sec 65B certificate for the CDR

b) Will the Lab provide Section 65B certificate for its report?

I will try to provide my views on these queries to the best of my knowledge and experience.

Though the final report is provided by the Lab, the CDR is handed over to them as an input along with other seized hard disks.

The CDR is an extract from the systems of the MSP and has to be therefore certified under Section 65B by the MSP’s person in charge.

If the MSP admin allows the files to be viewed by an independent expert, then the independent expert may take on record what he has seen, the circumstances under which he saw the documents, record it and add it under his Section 65B certification.

The CDR as presented by the MSP may be in say an excel form which the lab may use as an input and analyze through a CDR analysis software. This may display many results that appear in the screen of the analyst’s computer which he may record and use in his report.

Similarly, the mobile data or hard disk data may be analysed by the analyst using forensic software of different descriptions. The software may discover deleted files and show on the analyst’s screen. Some of these electronic documents as it appears on the analysts’ screen may be captured and used as a part of the analyst’s report.

At the end of this exercise, the analyst will come to some conclusion in his report and answer the queries raised by the investigating officer.

In such a scenario, the question of how Section 65B certification has to be used by the Lab expert is a matter of discussion.

Now in the above case, the report could be considered as a combination of

a) Matter of fact observation when some content is displayed on the screen of the analyst under certain standard conditions.

b) Certain content displayed which may require an “Expert Knowledge” to draw a meaning.

Section 65B is mainly concerned with the presentation of an electronic document lying inside a computer as a “Computer Output” that can be experienced (Read, heard, seen) by the observer, for the purpose of admissibility by a Court.

“Interpretation” and drawing conclusions which are not obvious from the visible computer outputs (presented either as a print out or soft copy) is a subject matter of an expert in the domain. The matter of fact part of the report also requires certain expertise but the level of expertise required for interpreting the data may be higher or it may be completely an expertise outside the computer domain.

For better clarity, let us take an illustration where a lab analyst extracts an image of a wounded person from the computer and renders it as a computer output in his Section 65B Certified report. Another expert say a doctor views the photograph and opines that this wound appears to have been caused by such and such a weapon etc…

Here there are clearly,  two experts … First, the computer expert who discovered the image from a pile of deleted images and the second expert who had nothing to do with Sec 65B Certified report but is an expert in another domain.

Some times, the division of roles of the “Observer” who extracts the information and the “expert” who interprets the document may not be so clear. It may be the same person who uses a forensic tool to extract fragments of a file containing log records and uses his computer expertise to interpret that the log record extracts mean certain things.

The Forensic lab analyst  has such dual role and hence his report has this dual characteristic of being a report both as an observer of a “matter of fact” and as an expert “Who interprets the fact”.

Another illustration that explains this situation is as follows.

Let us say there is a photographer who takes photographs. If it is a digital photograph, he can give a “matter of fact section 65B certification” stating this is a faithful reproduction of a photograph which I took using such and such camera on such and such date and time at such and such place. This  is the typical certificate  where the certifier does not express any opinion on who is there in the photograph, what is happening, Is it a marriage? or Is it a quarrel? etc.

Let us now say that the photograph is a video in which two persons are speaking in French. Let’s say the photographer fortunately knows French language and can interpret what the two are talking. He therefore produces a report in which the video is enclosed and states that the two persons were planning a terrorist attack. His certificate is now more than a Matter of fact certificate and includes his own expert view based on his language expertise.

The report that normally a Forensic lab person gives has this dual element of expertise, where in the first place, there is a simple expertise of using some tool and making some electronic documents appear on the screen which is then printed with a CTRL+P command and in the second place, involving  a “Forensic Expertise” where he adds his “Opinion” into the report.

A Good lab report has to be structured in such a manner that these two aspects are clearly brought out in the report itself so that the Court can use the “Matter of Fact” report and discard the expert report if it deems fit. Alternatively Court may accept the matter of fact part of the report but approach another expert for interpretation to substitute the expert opinion part of the report.  This means that the report may be taken as evidence in part and rejected in part. It may also be possible that the defense may accept the report of the “matter of fact part” but challenge only the “Expert opinion” part.

It is a moot point at this point of time if the reports provided by CFSL or other organizations which normally provide such forensic certificates have a system of structuring their reports as described above. It is possible that they simply enclose the evidentiary objects examined and directly go to give its point by point reply to the investigating officers, queries on the evidence.

Once we understand this nature of the Lab report, we can address the issue of whether Section 65B certificate is required for the lab report or not.

If the Analyst has reproduced any extracts of electronic documents as part of his report and relied on such extracts, then Section 65B certificate is required.

If the Analyst does not use any electronic document as part of his report and only gives out his views in isolation, then he need not provide Section 65B certificate.

In such a case he can be cross examined as a witness and further information can be sought.

In the case of a self evident/self sufficient “Matter of Fact Certificate”, the parties/Court may decide not to put the analyst as a witness and examine him, since there is no dispute on the matter of fact part of the report.

In most of the practical cases, a forensic lab will have electronic documents discovered by them based on which they provide their opinion. Hence their reports will have elements of both a “Matter of Fact Certification” and a “Forensic Expert Opinion”.  Hence Section 65B certification as well as presentation as a witness may be required.

Where there is a case when there is a web page which has been certified by an independent observer like CEAC as it appears to the public on the web with only simple tools such as a standard computer, running on  a standard operating system and a standard browser application, the Section 65B certificate may be accepted without the need for cross examination of the certifier (unless the defense wants to challenge the witness and probably allege fabrication of evidence).

In such cases, the parties may accept the computer output for admissibility and argue on the content as they require. Eg: One may say that the words used are defamatory and obscene and the other may say it is not. The judge has to take the call.

In the Suhas Katti case, I had produced an extract from a web page which the advocates argued whether it was obscene or not. I had no role in deciding whether it was obscene content. Similarly, I had recorded the IP address visible in the header information of the message and given my limited expert view with the use of a “Whois query tool” to say this IP address appears to belong to BSNL, Mumbai. This was a low level forensic expertise. I was however examined in this case as an “Expert” and cross examined but there was no disagreement on the evidence produced. The only objection raised by the defense was that I was not a Government employee and the Court felt that expert can be a private person.

I have presented the detailed view point above to indicate that the Section 65B certificate is meant for replacing the need for the Judge to interpret the “Original Binary Content of an electronic document” and enable him/her take a view on the electronic document on the basis of a print out or soft copy of what the binary content means when rendered on the screen of a computer  as a “Computer Output”. This is with the limited objective that the electronic evidence can be admitted and trial can proceed. (Readers may kindly read my earlier articles on the subject also links to which is provided below)

The Forensic labs therefore learn to structure their reports appropriately to indicate that part of the report is simply to render the “electronic document” as a computer output as is visible to a low level expert while in some cases, the report continues with an expert view where the “Opinion” of the observer is added as an “Expert”.

What I have presented here as a requirement for Forensic labs should also apply to a “Digital Evidence Examiner” accredited under Section 79A of the ITA 2008 and summoned by the Court for its assistance.

Comments are welcome.

Naavi

Posted in Uncategorized | Leave a comment

The Role of “Notified Digital Evidence Examiners”

 On 2nd January 2017, the Government of India came out with a notification under Section 79A of ITA 2008 on a pilot scheme for notification of organizations under Section 79A as “Digital Evidence Examiners”. Since then some news papers are putting out reports which are not completely correct. We need to understand the notification and its purpose correctly and not be mislead by ignorant statements printed even by reputed news papers.

I refer to one such report in Economic Times under the title “India to finally get electronic evidence authenticators”which inter-alia made a statement

“In a move that will aid investigators and prosecutors, the Centre has finally decided to appoint “Examiners of Electronic Evidence“ who will be the only ones authorized to tell courts if an e-evidence is authentic “

This statement is incorrect and misleading and needs to be clarified.

In the same article, a senior IPS officer is quoted which reflects  a correct understanding. He says

“The first line of argument from the defence is that the footage or voice is doctored. Presently, material is sent to forensic labs based on court direction on a case-to-case basis. But we need one or more authenticators to who we can straight away go even before taking it to the court.Their seal and sign must qualify as concrete attestation before any court.”

Digital Evidence is presently part of almost all Court proceedings. In the past they have been used successfully to prosecute the offenders in cases both under ITA 2000/8 or IPC. The first case in which conviction was obtained with the use of electronic evidence being the main evidence to prove the crime was the “Suhaskatti Case” (Details available in two part judgement reproduced)  way back in 2004. Subsequently several Courts have taken cognizance of electronic evidence. The latest important judgement is the judgement of the Supreme Court in what is called the “Basheer Case”.

Other than these, several Courts have used electronic evidence to prove facts in a litigation both civil and criminal.

It is not as if the Courts have not admitted and appreciated any electronic evidence so far. In the past whenever an electronic evidence is presented in the Court, the evidence is first admitted on the basis of Section 65B certification. Later during trial, if any of the defendants have an objection, they may produce their own expert opinion to counter the evidence. The Court if it needs may then call a Forensic Expert acceptable to it to give his opinion in the matter.

This process will continue.

Presently Police often were requesting the Court for permission to send a seized hard disk or mobile to a Government Forensic Lab (There are a few private labs whose services have been used by the Police from time to time) and then the Government lab gives its analysis which is presented by the prosecution in the Court. If the Police proceeds with analysis without such a Court permission, there is fear that the evidence may be considered as having been unauthorizedly tampered with and the findings rejected. Hence Police will now be happy to get the notified labs to whom they can send the evidence. Obviously, such labs will be the CFSL and State level forensic labs.

By this notification, the Police may be able to speed up their investigation so that they can take the assistance of these accredited labs at the investigation stage itself.

If the defendant disputes the evidence he may request for a fresh independent analysis by requesting for a Cloned copy of the hard disk. The two experts may be cross examined in the Court to satisfy the Court one way or the other.

Section 79A is an enabling provision which states as under.

79A Central Government to notify Examiner of Electronic Evidence

The Central Government may, for the purposes of providing expert opinion on electronic form evidence before any court or other authority specify, by notification in the official Gazette, any department, body or agency of the Central Government or a State Government as an Examiner of Electronic Evidence.

Explanation:- For the purpose of this section, “Electronic Form Evidence” means any information of probative value that is either stored or transmitted in electronic form and includes computer evidence,digital audio,digital video,cell phones,digital fax machines”.

This section was introduced with the Information Technology Amendment Act 2008 and became effective from 27th October 2009. Under this provision the Central Government was empowered (Note the word “may”) to appoint any “agency of the Central or State Government” as an “Examiner of Electronic Evidence”. This is not meant for individual experts but only for an organization.

It is expected that the organization would follow certain standard practices which make their process reliable enough for the Court to consider the evidence certified by it as authentic enough to proceed with the trial.

It will be a standard process in all such forensic investigations that the lab will on receipt of a material (container of electronic document such as a hard disk, mobile, CD, pen drive etc”) create cloned copies so that any request for production of the evidence in the form in which it was presented to them is fulfilled.

We need to note that this would require money to be invested in buying additional hard disks and devices similar to the evidentiary objects. For example, if 10 hard disks are presented as evidence by the Police, the lab has to buy 10 similar hard disks to keep a cloned version of the hard disks. The Police would also perhaps have a cloned copy of their own created at the time of seizure. Thus there will be a proliferation of digital evidence storage devices and the labs will have to ensure that budgets for such expenses are provided for.

Why Digital Evidence Examiner’s Certification should be discretionary not mandatory?

Electronic evidence is admitted as evidence based on its Section 65B certification. This will be prima facie evidence for trial purpose.  Then the trial begins when one of the parties presents its findings of the evidence.  At this point of time, the interpretation of the evidence as presented by the presenter of the evidence will be admitted  as long as the evidence is  not challenged by the defendant.

This situation will be similar to say a signed letter presented in evidence on which the signature of the defendant is not challenged. If the signature is challenged in such cases,  the Court may invite a signature or handwriting expert to give his views.

Similarly, any electronic evidence admitted in a Court can be proceeded with without a further certification from the “Digital Evidence Examiner”. Where the Court on its own decision or when the evidence is disputed, it may be mandatory to seek the opinion of the examiner notified under Section 79A. However, the opinion of the examiner may still be challenged by the defense.

It will be the discretion of the Court to decide how much value they would place on the evidence before the certificate of the Digital Evidence Examiner and after such certification.

Meeting “Admissibility” criteria under Section 65B of IEA is mandatory but requiring the Certificate of a Digital Evidence Examiner need not be considered as “Mandatory”. It is discretionary.

Police may still consider it as a Best Practice

However, practically, Police may not like to present evidence in their hands without this certification so that they are not accused of shoddy investigation. So, in practice Police may adopt a practice of sending every electronic evidence for “Digital Evidence Examination” in an accredited lab.

The certification may improve the “Probative Value” of the evidence and make it more difficult for the defendant to get it termed “unreliable” by the Court.

But just because an evidence is certified by a “Digital Evidence Examiner”, Court cannot refuse to allow the defendant to question the evidence. This would amount to trampling of the rights of the defendant. 

In future Courts and the Police  need to dispassionately consider whether it is practical to send all digital evidence to such labs as a mandatory process and if so whether it is feasible to close any case in which Cyber evidence is involved (Which is almost hundred percent of all investigations) within reasonable time.

Imagine that in the case of every civil and criminal case involving written document, every such document has to be sent to a handwriting expert for certification. Such a demand would be impractical. However, in the interest of justice whenever there is a slight doubt about the authenticity of a written document, it is prudent to send it for the views of a handwriting expert.

Imagine the investigation of the molestation case which Bangalore police cracked recently from CCTV footage and Mobile Tower data. There will be hundreds of such cases in which truck loads of evidence in digital devices would be used and if all these are to be certified in the accredited labs, we are looking at a practical impossibility.

Hence, we should accept that the use of Digital Evidence Examiner should be considered as “discretionary” and not “mandatory”.  Whenever there is a “reasonable” (standard of reasonableness can be low to begin with) doubt as to the authenticity of an electronic document presented as evidence, then Courts may adopt a mandatory requirement of examination by an “accredited digital evidence examiner” (Which is an organization and not an individual) while the Police will continue to have the discretion to adopt it as a “Best Practice”.

I however state that if it is considered mandatory and all digital evidence is dumped on such labs, there will be a serious hit on the trials and the cyber criminals will be happy with the delays.

Despite what I have stated above, the notification was long overdue and is welcome. It was a necessary follow up of the ITA 2008 which was left unattended. Hence we welcome the move with caution.

Naavi

Posted in Uncategorized | 3 Comments

Basheer Case Judgement and Section 65B of Indian Evidence Act…Cyber Jurisprudence develops

 Information Technology Act 2000 (ITA 2000) came into effect on 17th October 2000. Subsequently, the substantially amended version of the Act viz ITA 2008 came into effect on 27th October 2009. Despite the long elapse of time since these versions have been in practice, certain key aspects of the Act continue to be under debate as the related Jurisprudence is slowly building up.

In a domain of special knowledge such as “Cyber Laws” (Laws applicable to Electronic Documents), Jurisprudence develops first through the interpretation and opinion of experts and later gets polished with Judicial pronouncements creating a precedences.

The Judicial pronouncements also gets reviewed and modified over a period of time when the counsels participating in cases bring forth essential points for discussion before an erudite and open minded judge.

We are presently in this state of development of Cyber Jurisprudence where every judgement may be disagreed with and debated. In such a state of development, it is not uncommon for  one Court to disagree with another Court. It is also not uncommon for a lower Court to disregard an earlier judgement of another higher Court if the facts and circumstances brought before it appear to be different from the facts and circumstances underwhich the earlier higher Court had pronounced its views.

It is fascinating to observe how such jurisprudence develops over a period of time.

Naavi has been in the forefront of contributing to the building the Cyber Jurisprudence in India through his incessant contributions since 1998 and the mission continues now onto certain aspects of interpretation of Section 65B of Indian Evidence Act.

At present, the Judgement delivered on September 18, 2014 in the case of Anvar P.V. Vs P.K.Basheer and others (Supreme Court of India Appeal No 4228 of 2012) in which a three member bench consisting of Justices R.M.Lodha, Kurian Joseph and Rohinton Fali Nariman delivered its Judgement, has become a subject of hot debates on how digital evidence has to be produced in a Court of law.

Though this case actually related to an election issue, it has become an important judgment that has laid down several cardinal principles related to Digital Evidence which will be considered as a significant contribution to the Cyber Jurisprudence in India.

Naavi has been providing his views on the interpretation of Section 65B from time to time and was the first person to provide Section 65B certified print outs of Web and CD documents to a Court way back in 2004 as part of his activities under Cyber Evidence Arhival Center (CEAC).  Now with his years of experience in this field it is time to record his views on this judgment.

The last article on this topic at Naavi.org did provide a detailed explanation on the section which is being further clarified in this article in comparison to what the Basheer Judgment says.

This post may require multiple readings and also a thoughtful, analytical reading. I suppose the time you spend on this article will be useful. Don’t forget to let me have your feedback.

Naavi


Problem of Oral Evidence

The first challenge in interpreting Section 65B is to unlearn our earlier concepts of how we looked at presentation of evidence all these days. For those who have  interpreted  evidence only from the point of view of “Oral” evidence and “Documentary” evidence for years, the advent of the new category of documents called “Electronic Documents” presents a new dimension not easy to interpret.

Is an electronic document consisting of a recording of spoken words (eg: an intercepted telephonic conversation) to be considered as an “Oral Evidence”?  or is it a “Documentary Evidence”?  What is a Web Page? Is it a documentary evidence? are dilemmas that confront us when we encounter electronic documents.

It is interesting to note that in the digital world, every Document is a binary expression and hence even a recording of an audio or video is actually a document written/expressed in “Zero”s and “Ones”. Hence the distinction of “Oral” and “Documentary” has no relevance when it comes to electronic documents. There is simply no”Oral Electronic Document”.

However there can be a discussion on “Oral Evidence as to the contents of an Electronic Document” which is different from an “Oral Electronic Evidence”.  In an Oral Evidence as to the contents of an Electronic Document, a person may orally state under oath that a certain electronic document contains or contained such and such things as different from presenting a print out to say “this is what the electronic document contains” and certifies it under Section 65B.

In the Afsan Guru Case [State (N.C.T. Of Delhi) vs Navjot Sandhu@ Afsan Guru on 4 August, 2005], oral evidence about the contents of an electronic document had been accepted without Section 65B certificate.

This decision to accept the electronic documents even though it was not certified under Section 65B has now been over-ruled in the Basheer case, where it was stated that Section 65B certificate would be mandatory when the contents of an electronic document are to be admitted in a Court.

However, it may be noted that if the genuineness of the Section 65B certified evidence statement is questioned, then it may be appropriate and necessary for examining oral evidence relevant to the objection.

First Principle enunciated by Basheer Judgment

The Basheer Judgment throws light on the fundamental principle of evidence presentation stating,

“Evidence is constructed by the Plaintiff and challenged by the defendant. Construction is through pleadings and proof is through evidence by relevant and admissible evidence. Genuineness, veracity or reliability of the evidence is seen by the Court only after the stage of relevancy and admissibility”.

Thus the judgment recognizes that there are two stages in which an evidence is seen by the Court one at the time of admission and then when  when its veracity is challenged.

This distinction provides clarification on when a “Oral Admission” may be relevant as well as the application of Section 45A the role of a Digital Evidence Examiner referred to under Section 79A of ITA 2000/8

The Judgment referred to Section 22A of IEA which stated “Oral admissions as to the contents of electronic records are not relevant, unless the genuineness of the electronic record produced is in question.”

Judgment also referred to Section 45A according to which the opinion of Digital Evidence Examiner (under Section 79A-When appointed)  is relevant only when the genuineness of an already admitted electronic evidence is in question.

Second Principle enunciated by Basheer Judgment

According to the amendment to Section 17 of Indian Evidence Act (IEA) introduced by ITA 2000, evidence consists of three types namely

a) Oral

b) Documentary

c) Electronic Document

This amendment has introduced the “Third Category of Evidentiary Statement” called “Electronic Documents” to the two other known type of documents and this was pointed out by the judgment.

The judgment did use the word “Documentary” in the following statement, namely,

“Electronic record produced for the inspection of the court is documentary evidence under Section 3 of The Indian Evidence Act, 1872.” (IEA),

This use of a seemingly contradictory term may need to be explained further to understand that there are two kinds of documents one which is equivalent to written documents and the other which is an “Electronic Record”, though both appear similar at first glance.

We shall now look back at Section 3 of IEA for more clarification.

This section as amended by ITA 2000  states:

“Evidence” means and includes…all document including electronic records produced for the inspection of the Court, ..such statements are called documentary evidence;”…(P.S: Here again the term documentary evidence for want of a better term but this is not the same as the category 2 document used in section 17)

Section 3 also states that “Documents” means any matter expressed or described upon any substance by means of letters, figures or marks, or by more than one of those means, intended to be used, or which may be used, for the purpose of recording that matter.”

Under Section 17 of the IEA, it states

An admission is a statement, oral or documentary or contained in electronic form, which suggests any inference as to any fact in issue or relevant fact, and which is made by any of the persons, and under the circumstances, hereinafter mentioned.

Section 17 clearly expands on Section 3 by listing a statement contained in electronic form as a third category of statements different from oral and documentary.

This aspect of Section 17 has been reiterated by the Court in its judgment.

When we recognize that “Contents of an Electronic Record” is a “Statement” which is neither “Oral” nor “Documentary” but is a separate class of “Document”, not withstanding the overlapping use of the words “Document” and “Documentary”, it is clear that the Law expects “Electronic Documents” to be considered as a different type of statement for the purpose of evidence act.

Hidden Principle under ITA 2000/8

We must also recognize the fact that the ITA 2000/8 defines “Electronic Document” and “Document in Electronic Form” which includes what is apparently a “Document” (as a term used in the paper world). Unless we look at things with discerning eyes, we may mis-interpret both ITA 2000 and IEA.

According to ITA 2000,

a document which is being prepared or having been prepared or have been prepared in a formalized manner and intended to be processed or being processed or has been processed in a computer system.. and in any form will be considered as an “Electronic Record/Document”.

In view of the above, a “Computer Print out” which for all ordinary eyes looks like a “Document” (category 2 of section 17 of IEA), is to the discerning eyes, actually a “Document in Electronic Form” (category 3 of Section 17 of IEA).

This fine distinction points to an important aspect of Section 65B  and relates to which of the computer print -outs require section 65B certification and which don’t.

My considered opinion is that

When the person signing the print out is the person who is the owner of the content of the print out, he may simply affix his signature to the document without a Section 65B certificate similar to a case where we use a Computer as a Type writer.

Hence, if a Bank Manager is signing a statement of account of a customer, he will simply sign without Section 65B certificate since he is authorized by the Bank to take responsibility for the transactions represented by the statement.

If however a document is viewed by a person other than the person who owns the content, and he has to provide a print out of the document, then he needs to provide a Section 65B certification.

Hence a kiosk operator of a e-Governance system who can view the land records in the computer can provide a certified copy as a print out though he is not the Tahasildar or the Village accountant provided he appends certificates as required under Section 65B.

The above distinction should clarify the existence of two types of computer print outs one which requires section 65B certification and the other which may not.

We may however state that Section 65B certification is more relevant when it is required to be admitted in a Court where as in other cases, it may only be considered as a “Standard”.

Naavi has adopted the Section 65B standard for all activities of Cyber Evidence Archival Center (www.ceac.in) as well as activities under odrglobal.in so that CEAC-certified of electronic documents can be used both for production to a Court in India or otherwise.

Third Principle Enunciated by Basheer Judgment

The next principle that the Basheer Judgment has enunciated is regarding the Oral Admission and the earlier decision in the Afsan Guru case.

The Basheer judgment referred to Section 59 (amended) of IEA which states

Proof of facts by oral evidence.—All facts, except the contents of documents or electronic records, may be proved by oral evidence.

Reference was also made to Section 65A of IEA which states

Special provisions as to evidence relating to electronic record: The contents of electronic records may be proved in accordance with the provisions of section 65B.

Reading the above two sections together, the Judgment held

“…in view of Sections 59 and 65A, an electronic document can be proved only in accordance with the procedure prescribed under Section 65B.”

(We shall discuss Section 65B separately below)

Fourth Principle enunciated by Basheer Judgment

The judgment clarified that

“Proof of electronic record is a special provision introduced by the IT Act amending various provisions under the Evidence Act. The very caption of Section 65A of the Evidence Act, read with Sections 59 and 65B is sufficient to hold that the special provisions on evidence relating to electronic record shall be governed by the procedure prescribed under Section 65B of the Evidence Act. That is a complete code in itself.”

It categorically mentioned that “Being a special law, the general law under Sections 63 and 65 has to yield.”

It was under this principle that the Afsan Guru judgment on Section 65B certification was overturned. It is the same thought process which should also clarify on the debate over Primary and Secondary documents with reference to the electronic documents.

The Primary vs Secondary Document debate

While we agree fully on the principles that the contents of an electronic document at the admission stage has to be presented only with Section 65B certification, (detailed procedure for which is discussed subsequently below) we have to point out that the Judgment was not able to fully keep itself free from the concept of “Primary” and “Secondary” Documents in respect of Electronic records though an apparently reasonable argument was used for describing the difference.

The judgment held that

“An electronic record by way of secondary evidence shall not be admitted in evidence unless the requirements under Section 65B are satisfied.”

It continued to state

“… in the case of CD, VCD, chip, etc., the same shall be accompanied by the certificate in terms of Section 65B obtained at the time of taking the document, without which, the secondary evidence pertaining to that electronic record, is inadmissible”

It also stated,

“The situation would have been different had the appellant adduced primary evidence, by making available in evidence, the CDs used for announcement and songs. Had those CDs used for objectionable songs or announcements been duly got seized through the police or Election Commission and had the same been used as primary evidence, the High Court could have played the same in court to see whether the allegations were true. That is not the situation in this case. The speeches, songs and announcements were recorded using other instruments and by feeding them into a computer, CDs were made therefrom which were produced in court, without due certification.

It is clarified that notwithstanding what we have stated herein in the preceding paragraphs on the secondary evidence on electronic record with reference to Section 59, 65A and 65B of the Evidence Act, if an electronic record as such is used as primary evidence under Section 62 of the Evidence Act, the same is admissible in evidence, without compliance of the conditions in Section 65B of the Evidence Act.”

The part of the judgemental statements made above are significant since it makes a distinction of “Primary” and “Secondary” documents holding CDs used in the commission of offence is “Primary” evidence and “CDs produced in copies” is “Secondary”. It also provided the option that Primary evidence could have been proved without Section 65B certification.

I would like to note a point of difference on the above though it may not alter the effect of the Basheer judgment on the Section 65B certification per-se.

In my opinion, it is not necessary and perhaps it is futile to make a distinction between “Primary Electronic Record” and “Secondary Electronic Record”. In practice electronic evidence presented in a Court is always “Secondary”.

When a CD played during an offence (Primary Evidence) is presented in a Court, what is presented is a “Container” of electronic document and not the “Electronic Document” itself.

The electronic document is present inside the container in the form of “Binary Expressions”.

These binary expressions contain both “Meta Data” and “Data”. The “Meta Data” is contained in the header information of the file which indicates what is the type of the file and what is its dependency on an application and operating system.

When this CD is inserted in a computer device, the device first reads the header information and understands say that “this is a mp3 file” and “I need to use an appropriate application” and “Send the instructions to the speaker”. Then the speaker will play the voice/music. If it is an mp4 file, the computer will understand ” I have to send the audio stream to the speakers and the video stream to the screen using appropriate applications”.

If the computer does not use the appropriate applications riding on appropriate operating systems, the output would not be intelligible and even if attempted, the Judges cannot hear or experience the electronic document. It would be similar to an encrypted text file which has no meaning until it is decrypted.

To make things more clear, I give below what is the original electronic file and what is the file which human beings can read after the multiple processing that it undergoes in the computer.

Primary Document in Binary form What a Judge can see after
processing
01010111 01101000 01100001 01110100 00100000 01100001 00100000 01001010 01110101 01100100 01100111 01100101 00100000 01100011 01100001 01101110 00100000 01110011
01100101 01100101
What the Judge can
see

What you see on the left is the original binary expression (P.S: We have added padding in between bytes just to make the stream look better without which it will run as a single steam) of a sentence that reads “What the Judge can see” .

What the Judge will see on a computer is on the right column which is a product of several processes that the computer has already completed before displaying it on the screen in a human readable form. Is this then a “Primary” document? or a “Secondary” document? is the question that arises.

The question of “Judge seeing” (or hearing) an electronic document as a “Original” document if they had been seized and played in the Court  therefore does not arise.

If a person who has heard the contents when it was originally played, can depose, it will be a oral evidence of the event. Similarly, if the Judge takes cognizance of what he hears then he himself becomes the witness as to the content if he can record it so.

The summary of this is that in the case of electronic documents, it is preferable if we donot discuss the “Primary” and “Secondary” versions of an electronic record. It may be possible to bring the container which has the “Primary Document” but it is like an “intangible” object which cannot be touched, or heard or seen except when rendered in secondary form.

Every electronic record is therefore to be considered as “Secondary” document only.

Hence when it is required to prove an electronic record, what is relevant is

a) Direct evidence when the owner of the content deposes orally in which case he can produce the computer output as a rendition from the computer used as a typrewriter

b) Indirect evidence when a third party produces a print out or a digital copy of another electronic record and certifies it under Section 65B.

If we accept this principle, there is no need to completely overrule the Afsan Guru judgment since (if my information is correct), in that case the persons who had produced the electronic documents without the Section 65B certificate had actually deposed as witnesses.

Having recorded our agreements and a minor disagreement with the Basheer judgment, to complete the record let’s go onto explain the process of Section 65B.

I have already discussed this in earlier articles but I would like to reiterate it here for the sake of completeness.

The Process of Certification under Section 65B

The section contains five subsections followed by an explanation.

The title of the section is “65B. Admissibility of electronic records”.

This indicates that this is a section independent of Section 65 and concerns with the “Admissibility”.

Section 65A confirms that what we are dealing here are “Special Provisions” as to evidence relating to electronic record and 65B represents the provisions according to which contents of electronic records may be proved.

Sub-section (1):

The subsection (1) states as follows:

(1) Notwithstanding anything contained in this Act,

-any information contained in an electronic record

which is printed on a paper,stored, recorded or copied in optical or magnetic media produced by a computer (hereinafter referred to as the computer output

shall be deemed to be also a document,

if the conditions mentioned in this section are satisfied in relation to the information and computer in question and

shall be admissible in any proceedings, without further proof or production of the original,

as evidence of any contents of the original or of any fact stated therein or which direct evidence would be admissible

This sub section explains the entire purpose of the section and refers to a “Computer Output” which shall be admissible in any proceedings without further proof or production of the original.

The “Computer Output” is the Print out of the contents of an electronic record or a copy rendered in a media such as a CD.

The sub-section  makes a reference to the “Conditions” under which the Computer output shall be admissible which is available later in the section.

It is critical to notice that the entire section refers to conversion of the contents of an electronic document into an admissible form of a computer output and nothing else.

If we fail to notice that the section is entirely on rendition of an electronic record into an admissible form of computer output, we are likely to make mistakes in interpreting further aspects of this section in the subsequent sub-sections. Read the sub section (1) again if necessary before going further.

Please note that Section 65B also makes a clear statement in this regard that a computer output produced with Section 65B certificate is to be considered as “also a document” and does not state it is a primary or secondary document. It only states that this computer output is also deemed to be a document acceptable without the production of the “original” and does not specifically state that it is a “acceptable secondary document”

Sub-Section (2)

Sub-section (2) states as under:

(2) The conditions referred to in sub-section (1) in respect of a computer output shall be the following, namely :-

(a) the computer output containing the information was produced by the computer during the period over which the computer was used regularly to store or process information for the purposes of any activities regularly carried on over that period by the person having lawful control over the use of the computer;

(b) during the said period, information of the kind contained in the electronic record or of the kind from which the information so contained is derived was regularly fed into the computer in the ordinary course of the said activities;

(c) throughout the material part of the said period, the computer was operating properly or, if not, then in respect of any period in which it was not operating properly or was out of operation during that part of the period, was not such as to affect the electronic record or the accuracy of its contents; and

(d) the information contained in the electronic record reproduces or is derived from such information fed into the computer in the ordinary course of the said activities

This sub-section introduces certain aspects of practical significance which require jurisprudential interpretation.

If we accept the interpretation of the Sub-Section (1), sub section (2) should be applied to the process of rendering the computer output for the purpose of admissibility. This “Printing Out” or “Copying” of the original content into the “Computer Output” is done mostly by one operator who controls the computer in which the electronic content is being seen and there is a printer (or a CD writer or a USb Drive) attached to such a computer.

When an electronic document which lies in a web server is seen by a user, the copy of the electronic document in the web server has already been transmitted into the user’s computer and the print out when taken  is from that computer.

In an earlier paragraph, we explained that when a computer plays a video file which we humans see and hear, it uses one or more applications and one or more output devices.

Similarly, when we see a web document on a computer, the “Original” binary file lies inside the web server and is broken into TCP/IP data packets and sent across multiple routers in multiple directions, some times multiple times and ultimately the browser in the user’s computer recognizes these packets with reference to the meta data contained in them and assembles them into a contiguous form and then pushes them onto the output devices connected to the computer to provide the experience of the web document. Some times a single page on a website may be constructed dynamically in the user’s computer with components coming from different web servers situated in different places.

Some people try to interpret the “Said period”, “Computer”, “Lawful controller” used in the sub-section as to

a) The period in which the content was compiled

b) The web server

c) Administrator of the web server

Such people expect the Section 65B certificate to be issued by the administrator of the web host.

In my opinion this interpretation is incorrect and infeasible.

If we are looking at a content which is compiled over a time such as a Bank account statement of an account for the period 1.4.2015 to 31.3.2016, the document is a compilation of activities over a one year period. The section 65B(2) does not refer to this period of one year.

If we are looking at the computer of the bank where the statement of account is compiled, it may involve multiple computers from which different data base elements are dynamically drawn to compile a viewable document. Also there could be multiple owners of such computers including the owners of internet routers through which the data passes through.

It is therefore not possible to expect the administrators of all these computers to certify the document.

We therefore consider it necessary to apply this section entirely to the process of generating the computer output which is being produced to a Court for admission. This process starts when the user of a computer sees the fully compiled user viewable document on his computer and gives a CTRL+P command to print the page he is viewing or CTRL+C and CTRL+V to copy the contents into another device. It is also possible that he may use a mouse command to print or copy or even use other automated processes.

Forensic people may also use some special tools of their own to see what others without the tools may not see and print out or copy such content which can be seen only with the use of special tools.

It is therefore critical for us to accept that the Section 65B certification is like a photographer who takes a photograph and says that this is the photograph I have taken on such and such a day at such and such place and I have not tampered with it.

The expertise required by such a person is to the extent of using the tools required to view and print/copy the said computer output. Of course he should be contractually capable since he is providing a certification as part of Court documentation.

Subsection (3)

The subsection (3) states as follows:

(3) Where over any period, the functions of storing or processing information for the purposes of any activities of any regularly carried on over that period as mentioned in clause (a) of sub-section (2) was regularly performed by computer, whether-

(a) by a combination of computers operating over that period; or

(b) by different computers operating in succession over that period; or

(c) by different combinations of computers operating in succession over that period; or

(d) in any other manner involving the successive operation over that period, in whatever order, of one or more computers and one or more combinations of computers.

all the computers used for that purpose during that period shall be treated for the purposes of this section as constituting a single computer; and references in this section to a computer shall be construed accordingly.

This sub section is self-explanatory and does not require much elaboration. It however confirms that if the viewer has been using a networked device either to view or to print or to copy, all the connected devices will be considered as a single device for which he is providing the certification.

Sub Section (4)

(4) In any proceedings where it is desired to give a statement in evidence by virtue of this section, a certificate doing any of the following things, that is to say,-

(a) identifying the electronic record containing the statement and describing the manner in which it was produced;

(b) giving such particulars of any device involved in the production of that electronic record as may be appropriate for the purpose of showing that the electronic record was produced by a computer;

(c) dealing with any of the matters to which the conditions mentioned in sub-section (2) relate, and

purporting to be signed by a person occupying a responsible official position in relation to the operation of the relevant device or the management of the relevant activities (whichever is appropriate) shall be evidence of any matter stated in the certificate; and

for the purpose of this sub-section it shall be sufficient for a matter to be stated to the best of the knowledge and belief of the person stating it.

This sub section indicates the contents that are required to be included in the Section 65B certificate. The Section 65B certificate will be a statement which should identify the electronic record (Computer Output) which the subject matter of certification. It should also reasonably describe the devices involved in the production of the Computer Output and should be “Signed”. If it is a printed report, it should carry a physical signature and if it is another electronic copy, it should carry a digital signature.

“Occupying a responsible official position” may be relevant when the certificate is produced by an organization where multiple persons may be involved in operating the device or set of devices.

This also clarifies that in the case of an organization, the signature is provided in the name of a in the “Official capacity”. This could mean that when a subsequent deposition in a Court is required, it should be possible to depute an “Official substitute” without insisting on the same person who has signed to be present.

The sub section also provides that the certificate may state “to the best of the knowledge and belief” of the person providing the certificate. This also is extremely important since the certificate is being provided in good faith of what the person sees under specific circumstances which may change.

An example could be that a website might have configured certain content to be customized to the viewer say for example advertisements or language. When I view the page from Bangalore, I may view certain ads and content which another person who views from Mumbai may not view. Hence there could be a difference between what two different witnesses may say while viewing the content which is assembled on a dynamic rule and controlled on the basis of cookies or IP address or recorded behavioural analytics etc.

The “best of my knowledge and belief” is therefore a necessary disclaimer that the Court should accept rather than considering that the statement is vague because of this provision.

Sub Section (5)

(5) For the purposes of this section,-

(a) information shall be taken to be supplied to a computer if it is supplied thereto in any appropriate form and whether it is so supplied directly or (with or without human intervention) by means of any appropriate equipment;

(b) whether in the course of activities carried on by any official, information is supplied with a view to its being stored or processed for the purposes of those activities by a computer operated otherwise than in the course of those activities, that information, if duly supplied to that computer, shall be taken to be supplied to it in the course of those activities;

(c) a computer output shall be taken to have been produced by a computer whether it was produced by it directly or (with or without human intervention) by means of any appropriate equipment.

This sub-section provides accommodation for the activities of collection, processing and storing of information through automated devices and processes without human intervention.

Explanation

The explanation to the section states :

Explanation.- For the purposes of this section any reference to information being derived from other information shall be a reference to its being derived there from by calculation, comparison or any other process

The explanation is meant to remove any ambiguity as to the processes that may be involved in rendering the computer output which may include the reading of the header information, collation of different data packets etc.

Conclusion

The Basheer Judgment vindicates what Naavi has been holding out as the interpretation of Section 65B that any person who can view an electronic document, can provide a certified copy in the form of a print out.

It was under this principle that the first Section 65B certified copy of a document was presented in a Court in India. It was the CEAC certified copy of a document lying on yahoo group server presented by Naavi to the AMM court in Egmore, Chennai in 2004 in the case of State of Tamil Nadu Vs Suhas Katti. At that time while accepting the evidence and examining the undersigned as an expert witness, the defense in its plea raised an objection that Naavi was not a “Government Appointed Person”. The Court rejected the objection and said that no such condition is imposed under law.

P.S: This position has not changed even now after Section 45A was added to IEA, since the Digital Evidence Examiner (as and when appointed) will be assisting the Court in establishing the genuineness of the Section 65B certified evidence and not at the admission stage. If a 65B certified copy of an electronic document presented by say Naavi is questioned for genuineness, it is open to the Court to invite a Digital Evidence Examiner designated under Section 79 to examine and provide an opinion to the Court.

Subsequently, Naavi was also invited by the same AMM Court in Egmore, Chennai, to view some CDs captured from a scene of crime (termed as the Original evidence in the Basheer case) and asked to provide a certified print copy (termed as secondary evidence in the Basheer case) with Section 65B certificate. In this case the CDs were observed by Naavi and printouts were provided. Though the Judge himself could have viewed the documents, he rightly sought the assistance of an external person since he could not himself be a witness to the document. (As suggestively indicated by the Basheer judgement which I do not agree to).

After this, over the years, I have submitted several CEAC certified documents that involved web pages, e-mails mobile content, etc in some cases involving use of simple forensic tools. In all such cases the report has explained the process used in getting an electronic document on the computer screen of the observer (in this case, Naavi) and then printing it out either directly through an attached printer or copied onto other electronic devices and then printed out.

The Basheer judgment fully vindicates the procedure followed by Naavi in Cyber Evidence Archival Center (CEAC) though standardization of process has been difficult. There are cases involving documents on computer or mobile or CCTV captures or company’s internal servers etc. Each time it has become necessary to design a process to capture the documents and render the “Computer Output” in a manner in which it satisfies Section 65B of Indian Evidence Act.

Hopefully, after this detailed explanation of the section, whatever doubts were there in the minds of advocates and some trial judges would be cleared and they would be prepared to accept Section 65B certified evidences in proper form and reject those in improper form so that the evidentiary value of the digital evidence taken up for examination in Courts remain high.

I am open to questions being raised on what I have stated above and willing to provide my clarifications. Even if readers do not have any objections and accept what is written above, I will be glad to receive their views in positive confirmation.

So, Whether you agree or disagree, donot fail to send me an e-mail.

Naavi

Posted in Uncategorized | 2 Comments

Clarification on Section 65B… Who should sign the Certificate?

 Section 65B of Indian Evidence Act (IEA)is one of the hot topics discussed in Techno Legal Circles today. Though Naavi has clarified his view on the section many times on this site and in workshops and conferences, there are continued questions that linger on because some of the legal professionals hold some different point of view in respect of some of the finer points of the discussion.

One such doubt often raised is “Who should provide the Section 65B certification?”.

The supplementary questions that arise in this context is …

“Is it that the Admin of a server in which an electronic document is present the person who has to provide the certification?”

For example,

is it not the admin of Airtel who has to provide the Sec 65B certificate for the call data records?

Is it not the admin of flipkart who has to give certificate in respect of an electronic document pertaining to a sale on its site?.. “

“Now that Section 79A acrredited Digitl Evidence Examiners are being appointed, should all future Section 65B certificates signed by one fo them?”…. and so on

I wish to clarify my point of view once again in this respect so that there is clarity in all stake holders in this regard.

I must add here that I have been in the forefront of Cyber Laws since 1998 and has been encountering  Section 65B-IEA since a long time. The very first instance (2004) when a Section 65B-IEA was successfully invoked was the historically important case of The State of Tamil Nadu Vs Suhas Katti in which conviction happened for the first time in India under ITA 2000. In this case, I had presented the critical evidence of crime which was an electronic document present on the Yahoo server based on which the trial was conducted, offence recognized and accused convicted. I was also examined as an “Expert Witness” and cross examined in the case before the Court accepted the evidence. Since then, documents certified by me have been produced in many Court proceedings and must have been used in many civil proceedings. The service www.ceac.in specializes in this aspect of rendering electronic documents as evidences in an “Admissible” form in a Court. In a few cases, I have been asked to personally be present to identify the documents and in other cases, this has not been found necessary.

In the light of all the past experiences I would like to clarify on the point of “Who has to Certify under Section 65B”.

The first point we need to understand is that Section 65B indicates the manner in which electronic documents can be converted into “Computer Outputs” such that the “Computer Outputs” will be admissible as per the special provisions under Section 65A of IEA applicable to “Statement contained in Electronic Form”  defined in Section 17 of IEA.

The “Computer Output” referred to in the Section 65B can be in two forms namely “Printed on Paper” or “Copy on a Media”. If printed on paper it is to be signed. If rendered as an electronic copy, it has to be digitally signed.

To understand  “Who has to sign”? one needs to understand that what Section 65B refers to is to the process of creating the “Computer Output” and not the process of “Creating the Electronic Document which is the subject matter of the computer output”.

The “Original”  “Electronic Document” is a “Binary” document which human beings are unable to understand and can be seen or heard or seen with the assistance of a combination of tools such as the Application and the Operating System running on a hardware of a computer. Hence the “Electronic Document” needs to be appreciated by a Court only in a form which is the end result of many of the processes such as conversion of binary document to a humanly perceivable form on a computer device. However, such a “Humanly perceivable form” sits on a computer and cannot be always brought into the Court room. Even if it is brought, the Judge has to view it and form his opinion and if he incorporates his observation on the document, he will be a witness himself.  (The hard disk in which a binary document resides is only a container and not the electronic document itself and has to be connected to a computer device to know what it contains).

The presence of Section 65B enables the Judge to avoid being a witness himself by introducing a role to the Section 65B Certifier who brings the binary electronic document to an “Admissible” form by creating a “Computer Output” as envisaged in the Section. Even after this, if there is a dispute, then it is open to the Court to call a Section 79A recognized “Digital Evidence Examiner” to assist it in resolving the disputed electronic document.

If as some professionals suggest, it is necessary for the “Admin of a Server in which the document is contained” to provide the Section 65B certificate, then a situation would arise where if there are 1 lakh transactions that pass through Flipkart each day, any dispute arising out of these 1 lakh transactions involving multiple electronic documents will all have to be certified only by the admin if required for evidence. Obviously this is neither feasible nor is the intention of Section 65B.

While the admin who can view the electronic document on the server or any other hardware or software to which he has an access may provide the certified copies, it is not always necessary.

The purpose of Section 65B is to enable “Any Contractually Capable person who knows how to view (or hear) an electronic document to present a copy (printed or on an electronic media) which can be admitted in the Court as also a “document” “without further proof or production of the original”. It is that person who prepares the Section 65 statement in which he says “I viewed this document and converted it into a computer output and I certify …..”.

Hence  a “Third Party” can provide a “Section 65B Certified Copy” for admission.

In practice, the person who provides the certificate should be a “Trusted Third Party” who may be cross examined by the defense which may state that the person is unreliable, is either not capable of understanding what he is certifying and is dishonest and produced a false certificate etc.” The Section 65B certificate incorporates a declaration as to the “Procedure adopted for producing the computer output” which should indicate the manner in which any other person following similar process should be able to reproduce the same “Computer Output” except in circumstances where the original binary document has been removed.

The credentials of the person producing the Section 65B certificate becomes critical to the acceptance of the certified copy by the Court.

In the case of “Forensic Experts”, the experts use certain tools and are able to see information which are visible only on use of such tools. Hence their certificate needs to indicate the tools used which to the extent possible be “Standard Tools” capable of being used by other “Forensic Experts”. It is when there is a propritory  technique is used that the need for the Court to call in another expert who is accredited under Section 79A arises.

We need to reiterate in this context that it is not necessary that all Section 65B certificates are to be issued only by the Section 79A certified agencies. Section 65B certificate is issued for “Admissibility” while the Section 79A certified agency is called in by the Court on special circumstances only. It is like the case of a “Handwiring expert” who is called in from time to time to examine the signatures on documents presented in the Court but not mandatorily for all handwritten/signed documents.

I hope professionals in the field appreciate this point of view and if they agree should adopt it in their practice. In case they have any counter views, I welcome the feedback so that this view can be refined as required.

Naavi

Also Read: Other articles on Naavi.org

 

Posted in Uncategorized | 1 Comment

Section 65B of Indian Evidence Act on Electronic Evidence Explained


Of late, Section 65B of Indian Evidence Act is under focus in the Judicial and Law Enforcement circles. In this context, Naavi has put across his views on the section and how it needs to be understood in the above video available on You Tube.

The main points that Naavi makes here are

a) Section 65B (as well as 65A) of Indian Evidence Act refer to the special provisions of the Act in respect of Electronic Documents. Though Section 65 is referring to “Secondary” documents in paper form, there is no such distinction made as to the electronic document.

b) There is no need to distinguish Primary and Secondary and all documents need to be interpreted by a human being which takes the form of a Section 65B certificate.

c) A “Hard disk” which may contain an electronic document also cannot be considered the “Primary Document” since it is only a “Container” and the real Electronic document is an expression in binary language which cannot be read by a human being and needs to be interpreted with the assistance of a binary reading device (Computer + operating system +Application)

d) Section 65B explains the conditions under which an electronic document can be considered as “Admissible” in a Court as a “Document” and it needs to be suitably confirmed for the Court to accept the document, which is often termed as “Section 65B certificate or Statement”

e) Section 65B refers to a process of producing a “Computer Output” of the electronic document which is the evidence to be admitted and such computer output can be either in the form of a “Print Out” or a “Copy”.

f) There is a “Process” by which the electronic document becomes the “Computer output” and Section 65B identifies this as the subject activity which needs to be conducted by a person having lawful control over the computer producing such output and that during the period of such production, the Computer should be working properly etc.

g) The focus of Section 65B is the activity of conversion of the electronic document residing inside a system which can be seen by an observer into a “Computer Output”.

h) The other clarifications contained in the Section 65B such as that the the Computer Output could be produced by a combination of computers, acting in succession etc as relating to dynamic creation of an electronic document from a data base and routing it through multiple devices onto a final visible form in the computer of the observer and thereafter its porting into a Printer.

i) Considering these interpretations, the Section 65B certification is a “matter of fact” certification to the effect that “What I saw is what I reproduced as a computer output faithfully” and this can be done by any person who is observing an electronic document in his computer and wants it to be produced as an evidence. It is not necessary that a document from yahoo website has to be certified only by a Yahoo server administrator. Similarly, a statement of account downloaded from an ICICI bank website need not be certified only by the ICICI Bank manager but by any person who can lawfully access the document in electronic form.

j) There is also an important distinction that “Content Owner” is different from “Content Viewer” and Section 65B is meant to be produced by a content viewer. On the other hand the content owner in respect of say a Bank statement is the official Bank manager and he can provide a print out as the owner of the content who understands the content and is considered as an “Expert” in the domain. Any body else who views the document provides a Section 65B certificate that  the print out (or a soft copy) is a faithful reproduction.

It is very important that the legal fraternity and the Judiciary interprets the section properly. Any interpretation that only a “Server Administrator” can provide a certificate under Section 65B is considered incorrect. The server administrator can however provide the certificate but it is not mandatory. The Section 65B certifier is like a photographer who captures a photograph of an event and confirms the process of taking the photograph though he may not be aware of who is there in the picture and what they are doing. It is left to other “Experts” to interpret the “Content” and impute meaning as only a subject matter expert can do.

The undersigned has been running the Cyber Evidence Archival Center (www.ceac.in) since 2002 and has produced evidence under Section 65B certification in many legal proceedings. The first case in which an accused was convicted under the provisions of ITA2000 namely the State of Tamil Nadu Vs Suhas Katti happened in 2004 and in that case, the undersigned had produced a print copy of an electronic document which was then present in yahoo server with the appropriate certification. It was accepted and the accused was convicted.

In that case, the undersigned was also examined an “Expert” since as a part of the certification, he had also interpreted the IP address visible in the document as belonging to a specific ISP in Mumbai etc.

The current interest in the Section 65B has come because of the Supreme Court making a mention recently about the need for such certification whenever an electronic document is produced as evidence.

It is however felt that it is necessary for all the Courts to have proper understanding of the Section since otherwise mistakes can occur in acceptance or rejection of electronic documents in Courts.

The embedded video in YouTube contains the above discussion.

I welcome any counter views for debate.

Naavi

(For a Copy of Section 65B of Indian Evidence Act, s or Browse through Schedule 2 (in the left menu) of ITA 2000 available here: 

Posted in Uncategorized | Leave a comment