Digital evidence acquisition is a very complex task because of the nature of digital evidence. If we were speaking only one side of the coin, we would just end up there, the forensics, technology and woohoo’s of acquiring evidence by forensics. Won’t you believe that only half the battle is won?
The law about digital evidence varies from country to country. As no consensus about Cyber law is there in the world on a global level, so is the situation of the digital evidence law. Primarily, in India the legislation that introduced the Cyber space technology to law was the IT Act, 2000 (amend. 2008). And very minimal mention of digital evidence or even the type of crimes happening today is there. Digital evidence is also incorporated in the Indian Evidence Act, 1872.
- The interpretation clause of Section 3 of the Indian Evidence Act speaks about evidence as “all documents including electronic records produced for the inspection of the court, such statements are called documentary evidence”. The point of difference is that other statement evidence is called oral evidence.
- Good, we are getting there. Now what is this ‘electronic record?’
For this let us move to Section 2(t) of the IT Act, 2000. It means
‘data, record or data generated, image or sound stored, received or sent in an electronic film or computer generated micro fiche.’ The first couple of words are pretty clear about data, record, image, sound etc. microfiche is a photographic film containing microimages.
Digital Evidence can include anything from word documents to transaction logs, ftp logs of a server, GPS System tracks, computer memory, browser history and sorts of windows artifacts.(See here)
- Sec 4 of the same Act talks about legal recognition of this these records, it means that
* If there is any law that requires information to be in the written, typewritten or printed form then this requirement is deemed to be satisfied automatically if
a. it is rendered made available in an electric form
b. accessible so as to be usable for a subsequent reference.
- Talking about the Legal Prospects of Admission, Sec 17 of the Indian Evidence Act, 1872 defines admission of evidence and Sec 22A of the same act provides for relevance of any oral evidence regarding the electronic record to corroborate it. So remember until your evidence’s admissibility is in question, none of the corroboration that you provide about its genuineness along is going to be valid.
- Now the big player of this scene is Sec 65-A and 65-B of Indian Evidence Act,1872:
a. Sec 65-A is purely about how electronic records may be proved, It is to be in accordance with Sec 65-B and the conditions as laid out in it.
b. Sec 65 B(1) is a little confusing in the language but it simply means that any information (from the computer or device in question) which is printed on a paper, stored, recorded or copied in optical or magnetic media shall be also called a document. And this is admissible in any proceeding when a proof of the original or any fact stated of which direct evidence would be admissible, meaning that such a document can also act as an admissible evidence when it satisfies all the requisites under Sec. 65B. That is why for investigators, evidence retention and preservation important.
c. Sec 65 B(2) talks about the prerequisites that need to be satisfied for a piece of evidence to be admissible:
1. Firstly, the computer output containing the information should have been produced by the computer during the period over which the computer was used regularly to store or process information for the purpose of any activities regularly carried on over that period by the person having lawful control over the use of the computer.
2. The second requirement is that it must be shown that during the said period, the information of the kind contained in electronic record or of the kind from which the information contained is derived was ‘regularly fed into the computer in the ordinary course of the said activity’.
3. A third requirement is that during the material part of the said period, the computer should have been operating properly and that even if it was not operating properly for some time that break should not aff ect either the record or the accuracy of its contents.
4. The fourth requirement is that the information contained in the record should be a reproduction or derived from the information fed into the computer in the ordinary course of the said activity. (Originally here)
Under Section 65 B(4), a certificate to identify the electronic record is issued and it describes the manner in which it was produced giving the particulars of the device involved in the production of that record and deals with the conditions mentioned in Section 65 B(2) and is signed by a person occupying a responsible official position in relation to the operation of the relevant device shall be evidence of any matter stated in the certificate.
— The Cyber Blog India (@incyberblog) February 20, 2016
All you need to know about Anvar v Basheer, The recent landmark in digital evidence
* Electronically stored information was treated as a document and secondary evidence of these electronic ‘documents’ was adduced through printed reproductions or transcripts, the authenticity of which was certified by a competent signatory. The signatory would identify her signature in court and be open to cross examination. This simple procedure met the conditions of both sections 63 and 65 of the Evidence Act.
* To bridge this gap the IT Act amended section 59 of the Evidence Act to exclude electronic records from the probative force of oral evidence in the same manner as it excluded documents. This is the re-application of the documentary hearsay rule to electronic records. But, instead of submitting electronic records to the test of secondary evidence – which, for documents, is contained in sections 63 and 65, it inserted two new evidentiary rules for electronic records in the Evidence Act: section 65A and section 65B.
* However, the special law and procedure created by sections 65A and 65B of the Evidence Act for electronic evidence were not used. Disappointingly, the cause of this non-use does not involve the law at all. India’s lower judiciary – the third tier of courts, where trials are undertaken – is vastly inept and technologically unsound. With exceptions, trial judges simply do not know the technology the IT Act comprehends. It was easier to carry on treating electronically stored information as documentary evidence.
* This situation continued and was held high in the Parliament attacks case(State v Navjot Sandhu)by the Supreme Court where copies of Call detail records were admitted without following procedures of Sections 65A and 65B.
* Here, generalia specialibus non derogant (“the general does not detract from the specific”), lex specialis derogat legi generali (“special law repeals general law”) were reiterated.
* The Supreme Court held that Sec 65A and 65B create some special provisions that override the general law of documentary evidence. So now, all the conditions as listen under Sec 65B must be satisfied and a certificate be taken to make an evidence admissible.
* This disqualifies oral evidence to attest secondary documentary evidence. It is only restricted for later when oral evidence under Sec. 22A speaks about genuineness of the evidence and not content by an expert witness under Sec. 45A of the Act.
* Now the thumb rule to expect is verification of evidence by means of the specific laws of the Evidence Act, not the general ones.