CBI v. Mahesh Kumar Sharma and Anr.
In the Rouse Avenue District Courts
Case Number CBI-31/2021
Before Special Judge Naresh Kumar Laka
Decided on October 29, 2022

Relevancy of the Case: Power of an investigation agency to compel an accused to give his user ID and password

Statutes and Provisions Involved

• The Information Technology Act, 2000 (Section 79A)
• The Constitution of India, 1950 (Article 20(3), 21)
• The Indian Evidence Act, 1872 (Section 27)
• The Code of Criminal Procedure, 1973 (Section 91, 93, 102, 157, 161)
• The Criminal Procedure (Identification) Act, 2022 (Section 2(1)(b), 3)

Relevant Facts of the Case

• The Central Bureau of Investigation seized a computer system from the accused during the investigation.
• CFSL could not retrieve the system’s data as it did not have access to the user ID and password.

Prominent Arguments by the Advocates

• The public prosecutor argued that the court had granted bail to the accused on the condition that he would cooperate in the investigation whenever required. Access to credentials would not violate any rights, as access to this information would help conduct a fair investigation.
• The accused’s counsel raised multiple objections against the CBI’s request. He submitted that the application does not indicate any legal provision for a court to pass such a direction. Further, the computer system contains the private data of the accused, which would interfere with his right to privacy. Hence, an investigation agency or the court should not draw any adverse inference against the accused on his refusal.

Opinion of the Bench

• The Code of Criminal Procedure, 1973 provisions will be subject to the Constitution. Article 20(3) provides the right to remain silent against self-incriminating testimony.
• The investigation agency cannot compel the accused to disclose his computer’s credentials. When it is required to compare the said password with other evidence, such compelling evidence may be permissible under the law. This is subject to the accused stating that he has forgotten the password, which is well within his rights.
• The Investigating Officer is responsible for not disclosing the accused’s private information to any third party or making it public without lawful consent.

Final Decision

• The court dismissed the application to seek the user ID and password of the accused’s computer system. However, the Investigating Officer can access the computer’s data with the help of a specialised agency/expert at the risk of the accused for the loss of data, if any.