Original Research Article

The International Journal of

Evidence & Proof
Search and seizure of electronic 1–14
© The Author(s) 2024

devices in India: time for a change? Article reuse guidelines:

sagepub.com/journals-permissions
DOI: 10.1177/13657127241230694
journals.sagepub.com/home/epj

Malika Galib Shah

O.P. Jindal Global University, Sonipat, Haryana, India

Akash Gupta
O.P. Jindal Global University, Sonipat, Haryana, India

Arushi Bajpai
O.P. Jindal Global University, Sonipat, Haryana, India

Abstract
In the past two decades, there has been an exponential rise in the use of technology for com-
mission of crimes. In certain scenarios, investigation of such crimes call for inspections of an
accused’s personal electronic devices. In India, there is no law regulating the field of search and
seizure of electronic devices in a criminal investigation. Only recently, Virendra Khanna v State
of Karnataka laid down certain guidelines in this regard. Furthermore, on multiple occasions,
the Indian Courts have relied on the US jurisprudence on the matter. Due to a well-developed
jurisprudence in the USA on this subject, the authors have chosen to do a comparative study
between the two countries. This paper seeks to examine how these two major democracies
balance the right to privacy against the need to unearth information for better investigation.
While analysing the lack of a well-rounded law on the matter, this paper also analyses the pro-
visions in the Digital Personal Data Protection Act 2023 and the Bharatiya Nagarik Suraksha
Sanhita Bill 2023 and highlights the missed opportunities to frame guidelines on the issue of
search and seizure of electronic device. Section II of the paper introduces the readers to
the law on electronic search and seizure in the USA. Section III examines the Indian position.
It discusses the law as it was pre-Virendra Khanna, then goes into the law laid down by the
Karnataka High Court in Virendra Khanna and critically analyses the same. It also looks at the
progress made in the field through other legislation. Section IV deals with a comparative analysis
of the USA and Indian law on the subject and section V provides mechanisms and ways in which
the current law can be modified to deal with some of the inadequacies of the matter.

Keywords
Code of Criminal Procedure 1973, digital records, electronic evidence, reasonable expectation
of privacy, search, seizure

Corresponding author:
Malika Galib Shah, Assistant Professor, Jindal Global Law School, O.P. Jindal Global University, Sonipat, Haryana.
Email: mgshah@jgu.edu.in
2 The International Journal of Evidence & Proof 0(0)

I. Introduction
In the past two decades, there has been an exponential rise in the use of technology for commission of crimes.
In certain scenarios, investigation of such crimes call for inspections of an accused’s personal electronic
devices. In India, there is no law regulating the field of search and seizure of electronic devices in a criminal
investigation. Only recently, Virendra Khanna v State of Karnataka1 laid down certain guidelines in this
regard. Therefore, it is pertinent to look at some other jurisdictions which have a developed jurisprudence
on this subject matter. As the subject of electronic search and seizure in criminal investigations is a well-
discussed issue in the USA, the authors have chosen to do a comparative study in this paper. India and
USA have varying laws with respect to the search of digital evidence. A digital search is fundamentally dif-
ferent from a physical document. For example, if access is granted for search of a smartphone, then police can
easily gain personal information through the chats present in the social media accounts such as WhatsApp,
Instagram, Facebook etc. This is not only breach of privacy of the individual who is being searched but also of
the people who were communicating with the individual through social media. It is a multi-layer infringe-
ment on privacy of individuals who do not consent to give away their information or have any role to
play in the ongoing investigation (Chander, 2021). The dire need of information for investigation purposes
needs to be balanced with the right to privacy of an individual (Mukhopadhyay, 2020). This paper seeks to
examine how major democracies such as India and the USA balance these rights of their citizens. India and
the USA follow the common law system and yet, unlike the Indian System, the USA has developed jurispru-
dence on matters of search and seizures of electronic records. Furthermore, Indian Courts have on various
occasions relied upon the decisions of the USA Courts when the law in India has been silent on a subject.
This paper also analyses the provisions in the Digital Personal Data Protection Act 2023 and the
Bharatiya Nagarik Suraksha Sanhita Bill 2023 and highlights the missed opportunities to frame guidelines
on the issue of search and seizure of electronic device while protecting the fundamental right to privacy.
Section II of the paper introduces the readers to the law on electronic search and seizure in the USA.
Section III examines the Indian position. It discusses the law as it was in pre-Virendra Khanna judgment,
then goes into the law laid down by the Karnataka High Court in Virendra Khanna and critically analyses
the same. It also looks at the progress made in the field through other legislation. Section IV deals with a
comparative analysis of the USA and Indian law on the subject and section V provides mechanisms and
ways in which the current law can be modified to deal with some of the inadequacies of the matter.

II. The US legal framework

The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches
and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or
affirmation, and particularly describing the place to be searched, and the persons or things to be seized. (United
States Constitution)

In the United States, the field of electronic search and seizure is governed by two laws, namely the
Fourth Amendment to the USA Constitution and the statutory privacy laws at 18 U.S.C. §§ 2510-22,
18 U.S.C. §§ 2701-12 and 18 U.S.C. §§ 3121-27. The Fourth Amendment provides for limitation of
powers of governmental agencies to search for electronic evidence without a warrant.
For a search to be constitutional, it should not be in violation of a person’s reasonable or legitimate
expectation of privacy.2 This doctrine was first developed in Katz v United States, where the police,
in order to impede a gambling ring, wiretapped a public phone booth (Katz at 361). Here, a two-prong
test was established to determine a reasonable expectation of privacy. The court held that firstly, the
person must establish that their activities would be private and secondly, that such a subjective expect-
ation is one that the society or a layperson would consider ‘reasonable’. The court held that there existed a
reasonable expectation of privacy, even if the phone call took place via a public phone booth (Katz at
Shah et al. 3

361). Subsequently, the Supreme Court of the USA, when upholding the rights of privacy of a citizen, has
held that a person has a ‘reasonable expectation of privacy’ in their personal property and during a phone
call conversation3 (Katz at 361). On the contrary, when there exits any activity in the public forum, there
can be no reasonable or legitimate expectation of privacy4 (Payton at 143). In Rakas v Illinois,5 the peti-
tioners were charged with armed robbery and the sawed-off rifle and rifle shells that were recovered from
a search of a car were presented as evidence in court (Rakas at 143). The Supreme Court held that the
petitioners had no property or interest in the automobile searched, nor did they have an interest in the
property seized, and hence they could not have a legitimate expectation of privacy, and their Fourth
Amendment rights were not violated despite the absence of a warrant for the search.
With respect to search of electronic devices, the question is whether individuals have a reasonable
expectation of privacy in the contents of their personal electronic devices. The courts answered this ques-
tion by making a parallel analogy of the data stored in electronic devices with things stored in closed con-
tainers such as suitcases and went on to hold that individuals do have a reasonable expectation of privacy
in the data contained within their electronic devices.6
Courts in the United States have been successful in drawing a distinction of data stored in personal
devices and in a closed storage unit with respect to search and seizure law. The court in United States
v Walser held that:

Analogies to other physical objects, such as dressers or flea cabinets, do not often inform the situations we now
face as judges when applying search and seizure law.7

The court focused on the right to privacy of an individual and observed that a computer holds an enor-
mous amount of data covering too many areas of an individual’s personal life. Hence, there exists a threat
of evading the privacy of the individual when the police execute a search for an electronic device as evi-
dence (Walser at 986). The Tenth Circuit has refused the search of a computer’s hard drive without a
warrant or an exception to the warrant requirement.8
As for procedure, there are various types of warrants in USA such as a ‘geofence warrant’ and
‘keyword warrant’. In the former category, information pertaining to all the electronic devices are gath-
ered for a particular area and the suspects are identified from that mass data. In the latter, suspects are
identified from a large mass of IP addresses that had searched some term on a browser (Morrison,
2021). In both kinds of warrants, data belonging to people who do not consent for collection of their per-
sonal data is obtained in the USA. In some instances, a person may not be aware of the fact that their
personal data was collected without their consent (Geofence Warrants and the Fourth Amendment,
2021). This is a pertinent issue with respect to collection of electronic evidence.
Individuals have a reasonable expectation of privacy relating to their electronic devices, but these
expectations are subject to be displaced under some exceptions. For instance, if an individual has
stored a private data on a computer in public library, it is not subject to the Fourth Amendment.9
Individuals lose their Fourth Amendment protections when they provide control of their data to a third
party.10 The Supreme Court has held that there is no Fourth Amendment violation when information
revealed to a third party discloses the data to the government agencies, even if there is an expectation
that the third party will keep the data confidential.11
The reason behind this model is that the third parties are not bound to keep the confidential intact even
if there exists a non-disclosure agreement between the parties. For instance, the bank account information
of the customers are not covered by the Fourth Amendment protection.12
Along with the reasonable expectation doctrine as envisioned in the Fourth Amendment, the United
States has well-developed jurisprudence with respect to the requirement of greater privacy rights for the
use of electronic devices as evidence.
4 The International Journal of Evidence & Proof 0(0)

Plain view doctrine

Investigators may seize incriminating evidence without a warrant if they encounter the evidence in ‘plain
view’ during a lawful observation of the area. It is imperative that the incriminating nature must be ‘prima
facie and instantly apparent’ (plain view doctrine, n.d.). This is problematic in digital investigation as it
becomes extremely difficult to restrict the search in order to draw a balance between privacy and a just
investigation. Unlike searches of physical property like a house, where it is relatively easy to draw the
boundaries of a search, in a digital ecosystem it becomes imperative to conduct a system-wide search
that has no ex-ante restrictions to abide to. This is because it is regular practice to hide incriminating
material by changing file types or storing files within files and hence such investigation requires a disk-
wide search for it to be effective. Even if the plain view doctrine was not in action, on stumbling upon
incriminating evidence, law authorities can take note of it and use it against the defendant in any alter-
native hearing (Trepel, 2007–2008).
As for India, all of the above practices result in grave deprivation of privacy as guaranteed under
Article 21 of the Indian Constitution and as stressed in the Puttaswamy judgement.13

Forgone conclusion doctrine

If the government can demonstrate that they already know of the existence, authenticity and the posses-
sion of the evidence sought, a court may be inclined towards providing access to the governmental
agency for investigative purposes. The court may compel a person to provide such access or decrypt
the information, and such an action does not violate a person’s Fifth Amendment rights against self-
incrimination. The doctrine has been applied in cases where the government can establish with reasonable
particularity that the individual in question possesses specific documents, files or information and that
these materials are authentic and not subject to dispute (Hobbie, 2021). In such situations, the court
may require the individual to comply with a subpoena or court order to provide access to the requested
digital information (Kerr, 2019). This can help in reducing general searches through warrants.
These well-developed principles of law in the USA make the legal distinction between search and
seizure of regular evidence and that of digital evidence abundantly clear.

III. Legal framework in India

In India, the law enforcement agencies can require an individual to produce material for searches under
the provisions of Companies Act 2013, Income Tax Act 1961, Competition Act 2002, Customs Act 1962
and Code of Criminal Procedure 1973 (hereinafter CrPC) (Biju, 2022). However, the material sought to
be collected is physical in nature.
Detailed provisions regarding search and seizure for the purposes of investigation are found in Chapter
VII of the Code of Criminal Procedure. These provisions are more or less a replication of the erstwhile
Code of 1861, 1872, 1882 and 1898, which existed at a time when citizens were treated as subjects, bereft
of any real right to dignity and autonomy, and the code was merely a tool to establish the will of the sov-
ereign (Sekri, 2020). These provisions allow wide discretion to the investigating agencies to search with
or without warrant, and seize any material that may be even remotely connected to the case (Sekri, 2020).
It existed at a time when digital/electronic data was unknown and the law predominantly served as a
guideline on the search and seizure of physical documents/ evidence. Some sort of a safeguard is provided
for search without warrant where there must be a reasonable ground that the search is necessary for an
investigation and a warrant cannot be obtained without undue delay (Code of Criminal Procedure,
1898). It further requires the police officer to record his reasons in writing before the search.14
Despite the advent of digital revolution, the provisions remained largely unchanged, barring a few
alterations to include electronic evidence within its ambit. Section 3 of the Indian Evidence Act was
Shah et al. 5

amended to include electronic evidence as evidence within the meaning of the Act. The Information
Technology Act, 2000 (IT Act) was enacted to provide for this gap on electronic devices and evidence.
Section 69(1) of the IT Act also empowers specified officers to decrypt any information transmitted/
received/stored in any computer resource. The Reasonable Security Practices Rules, 2011, which are
framed under Section 43A of the Information Technology Act, give power to any government agency
to acquire personal data from an intermediary for the purpose of detecting, investigating, preventing,
prosecuting and punishing offences (Joshi, 2014).

Virendra Khanna v State of Karnataka

There were no express guidelines or set principles for the search and seizure of electronic devices in India.
The case of Virendra Khanna v State of Karnataka was the first case in this direction that set to establish
some clear principles on the law of search and seizure of electronic devices in India. Due to lack of any
other law/judgment on the matter, the Karnataka High Court judgment has become a guiding precedent
which is followed throughout the country.
Briefly stating the facts of the case, a case under the Narcotics Drug and Psychotropic Substance Act
1985 and Foreigners Act, 1946 was registered against the petitioner, in pursuance of which several elec-
tronic devices including the petitioner’s laptop and mobile phone were seized and the petitioner was
asked to disclose the password of these devices and his email account, which was refused by the peti-
tioner. As a result, two applications were filed by the police before the trial court, of which we are
only concerned with the second one, wherein the police sought an order to the petitioner to disclose
the passwords for the devices and the email account. The same was ordered by the trail court and the
petitioner made an appeal before the Karnataka HC against the same. While denying the appeal and
noting the distinction between testimonial and non-testimonial evidence with respect to Art 20(3) of
the Indian Constitution, the HC laid down certain guidelines on the search and seizure of electronic
devices. The HC laid down 12 questions and the answers to these questions have become the law on
the matter.15 The court equated the search and seizure of electronic devices to those of physical docu-
ments and held that all the provisions of CrPC applicable to search and seizure would equally apply
to digital devices as well, and such search may be made with or without warrant to gain full access to
the concerned device.16 During investigation, the investigating officer can request the disclosure of pass-
word, to which the accused can choose to accede.17 In case of refusal to provide the password, passcode
or biometrics, the investigating officer can approach the court to issue a direction to provide the same.18
The court, relying on the precedent, mentioned that even an illegal search would not make the item so
seized inadmissible, but only require more caution by the courts to deal with such illegally seized
devices.19 The court further held that the data gathered from a smartphone/email account has to be
treated like any other document/object gathered during investigation (like, for example, a murder
weapon), therefore the same does not itself prove the guilt of the accused and hence is not self-
incriminatory.20 Access to the seized electronic device would not only mean access to all the data on
the said device but also on the cloud service connected with the said device, including financial trans-
actions, privileged communication, personal details and the use of such data during the course of the
investigation will not infringe on the right to privacy but would fall within the exceptions culled out
in the Puttaswamy judgment.21 The duty to safeguard such sensitive and private data has solely been
left to the investigating officer (IO) who may be proceeded against in case of such non-compliance.22
In case the accused fails to comply with the directions to disclose the password, an adverse inference
may be drawn against him.23 A specialised agency’s assistance may also be used to crack the
password, and the accused cannot contest the method used for the same.24 The investigating
agency is also at liberty to clone the electronic device and cloud data and use it during the course
of investigation.25
6 The International Journal of Evidence & Proof 0(0)

Critical analysis of the law in India

Criminal justice system exists on the desire and the need to finely balance Herbert Packer’s ‘crime-control
model’ and ‘due-process model’ (Packer, 1964).
The affirmative ‘crime-control model’ mainly focuses and accepts the heavy reliance of the legislature
on the criminal sanctions as a means of maintaining public order by ‘emphasising the existence and exer-
cise of official power’ (Packer, 1964: 22). This model focuses on the ‘factual guilt’ revealed by the police
in the police station and during its investigation, rather than the ‘legal guilt’ which is established in the
courtrooms through admission of evidence beyond reasonable doubt (Roach, 1999: 678). Trial is not a
key process of this model and wide powers of arrest have been bestowed upon the police to question
and readily establish the ‘factual guilt’ of the accused (Packer, 1968: 162–177).
On the contrary, the negative ‘due-process model’ neither relies on, nor believes in, the utility of the
criminal sanction (Packer, 1968: 170), basing itself on the liberal ideas of ‘the primacy of the individual
and the contemporary concept of limitation on official power’ (Packer, 1968: 165). Under the ‘due-
process’ model, the validation and reliance is heavily placed on the power and authority of the judiciary
(Packer, 1964: 22). There is curtailment of police power under this model, restricting the exercise of pre-
trial detention by the police to establish their case unless absolutely necessary since it hampers with the
preparation of a defence (Roach, 1999: 681–82). Under the ‘due-process’ model the accused has to be
well informed of his right to counsel and silence and the criminal trial should be looked at as a logical
end to the entire process rather than an unwanted burden (Roach, 1999: 682).
It is this fine balance between the two models which forms the foundation of the criminal justice
system. A balance between the police’s power to investigate and the court’s power to establish the
guilt beyond reasonable doubt is what ensures the sound basis of a well-established criminal
justice system. This fine balance is what the Indian criminal justice system also seeks to achieve
through its various statues and provisions, including CrPC. The courts have also played this balan-
cing role in interpreting several technological advances within the ambit and scope of the already
existing provisions that do not expressly provide for such developments. The law laid down by
the Karnataka HC in Virendra Khanna on the power of search and seizure of electronic devices is
one such creation of the court.
There is no legislation in place to specifically govern the law relating to search and seizure of elec-
tronic devices and this judgment by the Karnataka HC is the only law that exists on the matter. While
the Karnataka HC should be appreciated for laying down a law on this point which was earlier non-
existent, the suitability and perfection of the law on this matter may be debatable. On the reading of
the law as laid down in Virendra Khanna, one would realise how the judgment disrupts the attempt to
achieve balance and instead leans towards the ‘crime-control’ model.
Through the guidelines laid down in this cases, the police have been given extensive powers of search
and seizure of electronic devices. In the current times, electronic devices are all-pervasive and an exten-
sion of the self, blurring the boundaries between personal and professional, social and private. This judg-
ment allows police the power to direct/request the accused or other concerned person to furnish
passwords (this includes passcodes and biometrics) of electronic devices. The court further states that
the accused person can accede to the request and once that is done, it is open to the police officer to
gain access to the device.26 More often than not, the accused person is unaware of his right to deny
search and even in cases where he may be aware of it, exerting his wish over the will of the police
officer in the absence of a legal counsel may prove extremely difficult. The power balance at play in
such a scenario tilts unfavourably towards the police authorities raising questions on the voluntariness
of consent obtained in such cases. Further, the judgment goes on to provide a remedy in case the con-
cerned person refuses to furnish the password. The investigating officer is authorised to get an order
for search of an electronic devise from the court. The court will authorise the same under two considera-
tions, one of which includes authorisation ‘during the regular ordinary course of the investigation’.27 The
Shah et al. 7

phrase ‘during the regular ordinary course of the investigation’ is wide enough to cover any situation
within its ambit. This phrase does not require the presence of a special circumstance to be present for
this kind of an invasion into ones privacy but the investigating officer will only have to prove before
the court that the search is generally required in ordinary course of an investigation.
While granting warrants for search of electronic evidence, the Magistrates do not look at the particular
facts of the case thoroughly due to paucity of time, as there is a humungous backlog of cases. Due to this,
the search warrants granted lack detail with respect to the scope of search. Without any detailed warrant,
the police officials can exercise their wide discretion, which may lead to breach of privacy (Chander,
2021).
The other condition is in ‘emergent situations’.28 The decision on what constitutes an emergent situ-
ation has also been left to the police officer. The only condition in such a case is that a detailed reason for
the existence of an emergent situation and the consequent search, without either the consent of the
accused or the authority of the court, has to be written down.29 If the search is made without stating
the reasons or following the procedure, even though it may be illegal, the seizure made subsequent to
this illegal search will not be held inadmissible, meaning the illegality of search has no great
significance.30
The judgment has also failed to recognise the true import of these all-pervasive devices into one’s life
and has compared it to an ‘identification mark’ like a handwriting or voice sample or a specimen signa-
ture.31 The comparison seems to be ill-founded, given the limited information that the accused is giving in
the latter case. Unlike the handwriting sample as an identification mark, electronic devices expose the
most private and personal information of the accused before the investigating authorities, allowing an
insight into information not even remotely associated with the case. Other identification marks such as
voice, handwriting and signature samples have a specific purpose to the object sought to be achieved
during investigation or trial, and the same can be clearly established before the court as well.
Once access has been attained, the investigating agency can freely access not only the data on the
device, which included financial transactions, privileged communication, personal details etc., but also
any material that may be available on cloud services.32 The onus to protect and safeguard this sensitive
and personal information has been left solely on the investigating officer, in the absence of any proper
mechanism to safeguard such information and any agency for the prosecution of the concerned officer
in case of any delinquency.33
The power of search is also to be carefully exercised in light of recognition of the right to privacy as a
fundamental right in the celebrated Puttaswamy judgment. In the Puttaswamy judgment, the right to
privacy has not only been considered as a derivative from Article 21 of the Indian Constitution, but
also as a ‘basic, irreducible condition’ that is ‘necessary and unavoidable entailment of rights guaranteed
in the text of the Constitution’.34 Informational control has been recognised as one of the many aspects of
this right to privacy, as it ‘empowers the individual to use privacy as a shield to retain personal control
over information pertaining to the person’.35 The power to search electronic devices has the possibility of
infringing upon a person’s right to life and person liberty, including the right to a dignified life postulated
in Article 21, among other fundamental rights enumerated in part III of the Indian Constitution. Like other
rights this right is also not unfettered but subject to reasonable restrictions.36 At a minimum, for a privacy
constraining measure to be lawful and legitimate, a three-fold test laid must be satisfied:

(i) legality, which necessitates the existence of law;

(ii) the existence of a legitimate state aim to infringe upon this right; and
(iii) proportionality, which ensures a nexus between the objects and the means adopted to achieve
them.37

For any restriction to be imposed on the right to privacy, all three conditions need to be fulfilled.
Proportionality is a general principle that has been used as a criterion to ensure fairness and justice to
8 The International Journal of Evidence & Proof 0(0)

all persons approaching the court against any state action. In this situation the action taken by the gov-
ernment has to be justified by a cause serious enough to be valid to breach the fundamental right guar-
anteed to the individual (Indian Evidence Act 1872). By equating the seizure of electronic devices with
physical documents, the court failed to recognise an essential difference between the two. During the
process of search and seizure involving physical documents, the person in question has to provide
only certain documents that are required of them, rather than all the documents on themselves, unlike
what it entails to search and seize an electronic device for reasons already stated. In the Virendra
Khanna judgment, the court did not consider such search as a breach of the fundamental right to
privacy, even though it failed to meet all of the conditions laid down in Puttaswamy.
Another reason to equate the search and seizure of physical documents with that of electronic docu-
ments has been the inclusion of electronic records in the definition of documentary evidence under the
Indian Evidence Act. The court has failed to recognise the different purposes the two legislations aim
to achieve. CrPC lays down the procedure for conducting search and seizure, among other things. The
Indian Evidence Act on the contrary deals with the admissibility and evidentiary value of the substance
already collected through the procedure laid down in CrPC. It handles the procedure and treatment of
such collected substances during trial as evidence, much different from the procedure detailed in CrPC.

Other legal provisions

The Digital Personal Data Protection Act 2023 seeks to establish a procedure for collection of personal
data from electronic evidence and ensure proper safeguards for the individual whose data is being col-
lected. However, it does not accurately fulfil the purpose for which it has been enacted. The act fails
to take into account the harm caused to the individual who is being subject to surveillance. For
example, Section 4 states that a person may process data only in accordance with the act and for
lawful purposes (1) for which the person whose data is being processed has given his/her consent or
(2) for certain legitimate purposes. The use of the vague phrase ‘legitimate purposes’ may imply that
the government can use these provisions to establish deemed consent arbitrarily and process personal
data. The Data Protection Board of India is to be appointed by the Central Government according to
Section 18, and therefore cannot be considered as an independent body. Section 17 of the Act grants arbi-
trary powers to the Union Government. The Act has a mechanism where it can easily evade safeguards
that are provided to an individual whose data is being processed.
As for search and seizure of electronic devices, previously there were no express guidelines or set prin-
ciples in India. In Virendra Khanna, the High Court of Karnataka came up with guidelines with respect to
digital evidence in India. The judgment is a beacon of light and is followed as a precedent throughout the
country. It lays down two instances where the police officer can search an electronic device, namely in
emergency situations and in the ordinary course of investigation. In the former situation, a police officer
has to be satisfied objectively that there is an emergency situation by recording detailed reasons for the
same. The court said that any search without recording reasons for doing so would not be legally valid.
However, in the ordinary course of investigation, a police officer is mandated to get a warrant. The court
clarified that if an accused refuses to unlock a smartphone, then the investigating agency can require a
specialised agency to grant access to the device by hacking it. Mere direction to the accused to unlock
a smartphone would not be akin to self-incrimination as per the court. The court placed the digital evi-
dence at the same pedestal with a physical document. It drew an analogy that mere production of docu-
ment does not lead to self-incrimination. In the same manner, merely granting access to a smartphone
would not cause testimonial compulsion, and the prosecution needs to prove its case based on the mate-
rials available. The data acquired by such access does not automatically prove the guilt of an individual.
While this judgment has set a precedent with regard to search and seizure of electronic devices, it also
seems to be in conflict with the protection against self-incrimination as guaranteed by Article 20(3) of the
Constitution of India.
Shah et al. 9

IV. Comparative analysis of the jurisprudence

in India and the United States
The Fourth Amendment to the USA Constitution safeguards its people from unreasonable government
interference. The jurisprudence in USA has evolved over time and considers any search without a
warrant as unreasonable unless it is under the exceptions (Katz). The search is only reasonable when
there is a probable cause that a search would give results of an unlawful activity (Joshi, 2014).38
In USA, giving a password or encryption key is regarded as self-incriminating testimony (Fakhoury
and Kayyali, 2014). The Indian position is not so clear on this aspect. There have been contrary judg-
ments by courts considering the fine differentiating line between a valid search and the right against self-
incrimination protected under Article 20(3). In Selvi v State of Karnataka39 the court recognised the
imbalance of power between the State and the accused criminal, necessitating the need to shift to the
due process model recognising the limits to the use of state powers even in cases of crime detection
(Bhatia, 2018). Similarly in State of Bombay v Kathi Kalu Oghad40 the court ruled that the person
can be a witness within the meaning of Article 20(3) when he furnishes evidence, not only orally but
also when he is compelled to produce a document or thing, and extends beyond the premises of the court-
room.41 However, in Virendra Khanna the court has categorically stated that unlocking the phone by
giving away the password does not amount to self-incrimination.
Although police officers in USA cannot search without a warrant generally, they can search the data in
a smartphone in exceptional circumstances such as when it is highly probable that the data would be
instantly destroyed as held in Riley v California.42
Unlike India, search warrants in USA define the particular items that need to be searched. There is an
exclusionary rule where evidence gathered from an unreasonable search cannot be presented in a court of
law.43 But in India, there is no such exclusionary rule, and any evidence illegally collected will just
amount to an irregularity. The Supreme Court of India in Dr Pratap Singh v Director of Enforcement
Foreign Exchange Regulation44 has stated that any evidence gathered via an illegal search will be admis-
sible.45 This default position primarily established in India by the three landmark judgments in MP
Sharma,46 RM Malkhani and Pooran Mal47 has, however, now been hollowed out by the Puttaswamy
judgment. Puttaswamy unanimously overruled the decision in MP Sharma,48 which in turn formed the
basis of the Pooran Mal judgment (Pooran Mal v. Director Of Inspection (Investigation) New Delhi
And Others [8 and 23], 1973). Further, Puttaswamy first describes Kharak Singh49 as the jurisprudential
basis of the RM Malkhani judgment50 and then in the same judgment overrules Kharak Singh to the
extent that it fails to recognise privacy as a right protected under the Indian Constitution.51 Thus the
Puttaswamy judgment has eroded the basis for this default rule, urging serious reconsideration on the
admissibility of illegally obtained evidence (Bhandari and Lahiri, 2020).
This is contrary to the USA Constitution from where India derived the concept of fundamental rights
(Chander, 2021). In USA, if the procedure is not duly followed then it leads to suppression of evidence.
The right to privacy, which is an inherent part of a democratic framework, is regarded as non-
interference in the lives of the citizens both in USA and India. With the lack of rule of exclusion in
India, the situation is of serious concern, as there are no set guidelines with respect to search of digital
evidence. While India does accept illegally gathered evidence, the trial stands vitiated when the search
is not in accordance with the due process in USA. There is a test of probable cause for search of electronic
evidence in USA; however, there is no mention of any such standard in India, not even in the Digital
Personal Data Protection Act. As a result, the authorities resort to Virendra Khanna for search of elec-
tronic evidence.
Such a stance with respect to searches of electronic evidence brings with it a plethora of issues with
respect to infringements of fundamental rights of the people by the State, which must be rectified with
immediate effect. In order to protect the privacy of individuals, there needs to be a change in legal dif-
ferentiation from directness of testimony to form and even the function of it. What this means is that,
10 The International Journal of Evidence & Proof 0(0)

instead of differentiating evidence and testimony on the basis of how direct it is in incriminating
someone, emphasis must be placed on upholding the rights of the accused and treating digital searches
as different from general searches.

V. The way forward

The exponential rise in the use of electronic devices in our daily lives has necessitated courts to take cog-
nizance of electronic records as evidence in criminal cases. As seen, majority of the laws framed are done
in the context of ‘documents’ and other forms of paper or oral evidence which cannot be suitable for evi-
dence in the digital form. The Virendra Khanna case held that an accused being directed to reveal their
device’s password shall be non-violative of their right against self-incrimination. While this case took a
step in the right direction with respect to laying down the guidelines for ‘search and seizure’ of electronic
devices, it has also diluted the right against self-incrimination as protected by Article 20(3) of the
Constitution of India. This is due to the fact that most personal devices contain a large amount of sensitive
personal information and are virtually an extension of a person’s self.
The right to privacy is a fundamental right as enshrined in Article 21 of the Constitution by virtue of
the Puttaswamy case. Six years post this landmark judgment, the Parliament enacted the Digital Data
Protection Act 2023. The act aims to provide for ‘the processing of digital personal data in a manner
that recognises both the right of individuals to protect their personal data and the need to process such
personal data for lawful purposes’. While it is recognised that personal data is required for conducting
investigations in criminal cases, it is equally important to protect a person’s right to privacy. A
person’s right to privacy is infringed in a large number of cases where their personal devices are
seized and searched, resulting in sensitive personal information being revealed. This act missed an oppor-
tunity to provide a comprehensive framework to protect the rights of persons who are being surveilled.
Further, while the Bhartaiya Nagarik Suraksha Sanhita Bill (as introduced in the Parliament in 2023)
aims to safeguard the rights of persons being surveilled by mandating the procedure of searching a prem-
ises or taking possession of any property to be recorded through audio-video means, it fails to provide
comprehensive protection to persons whose digital devices are being searched. This bill has failed to
take into consideration the impact of digital records on investigations and trials in the context of the
right to privacy, and fails to provide substantial protection in cases where digital records are seized.
In stark contrast, the United States Supreme Court has recognised the fact that revealing the password
to one’s personal device amounts to self-incrimination, and courts on multiple occasions have distin-
guished data in devices from objects in closed containers.
Following the same principle, the authors suggest a comprehensive search and seizure procedure for
electronic devices. Following the standard procedure in ordinary course of investigation, the investigating
officer must obtain a warrant for search and seizure of the device in question. Subsequently, to gain access
to the device, the court must give an opportunity to be heard to the owner of the device, and on assessing
the prima facie case for such search and seizure, the court may direct the owner to grant access of the
device to the investigating officer. If any person fails to do so, the investigating officer may hack the
device to gain access to it.
In cases that are not in the ordinary course of investigation, where this procedure cannot be followed
due to the paucity of time or urgency in the investigating process, the investigating officer may seize the
device without a warrant. Thereafter, the investigating officer shall convince the judge of the prima facie
case for searching the seized device. An opportunity to be heard must be given to the other party, after
which the device may be allowed to be searched. In order to avoid inordinate delay, the process must be
time-bound and in case the person whose device is sought to be searched does not appear before the court,
the court must be allowed to pass an ex parte order without allowing any further time to the person
concerned.
Shah et al. 11

In exceptional circumstances or cases involving national interest, an investigating officer may

seize the device without warrant and hack the device in order to gain access. The officer must
record his reasons in writing for doing so. If it is seen that the nature and circumstances of the
case did not warrant such a search and seizure, a heavy penalty and punishment must be imposed
on the investigating officer for abuse of powers. A similar penalty must be imposed on the officer
concerned if the sensitive information collected through search gets into the hands of a third party
or is misused by the officer concerned.
It is the authors’ view that this multi-fold mechanism with respect to digital devices shall protect an
individual’s right to privacy and allow for an unhampered investigation. Such a mechanism also provides
for investigating officers to be accountable for their actions, to prevent unlawful and unnecessary searches
resulting in violations of a person’s rights. Further, it provides an accused person with an opportunity to
be heard and brings predictability and certainty to the procedure followed in investigations. Such a pro-
cedure, albeit lengthy, curtails the law enforcement agency’s investigating powers in the larger interest of
the public and upholds the constitutional mandate for a free and fair trial including pre-trial process.

VI. Conclusion
Electronic devices have become an integral part of our ecosystem and contain valuable information which
is all-pervasive. Offences involve the use of such digital devices, which has made it difficult for the inves-
tigating authorities to keep up with the advancements due to lack of any clear provision with respect to
electronic search and seizure. In light of the absence of any clear law on the matter, Karnataka High
Court’s judgment in Virendra Khanna is a welcome step that attempts to crystalise the law on this
point. However, with concerns around infringement of the right to privacy as well as the right against
self-incrimination, the law needs to be revisited and revised to look at the nuances on the matter.
Lessons can be learnt from the well-established principles in the USA, while devising a strategy
which is native to us and considers our peculiar position and situation as well.

Declaration of conflicting interests

The authors declared no potential conflicts of interest with respect to the research, authorship, and/or publication of
this article.

Funding
The authors received no financial support for the research, authorship, and/or publication of this article.

ORCID iD
Malika Galib Shah https://orcid.org/0000-0002-8829-4140

References
Bhandari V and Lahiri K (2020) The surveillance state, privacy and criminal investigation in India:
Possible futures in a post-Puttaswamy world. University of Oxford Human Rights Hub Journal
3(2): 15.
Bhatia G (2018) Privacy and the Criminal Process: Selvi v State of Karnataka, 22 April. SSRN.
Available at: https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3166849 (accessed February
2024).
Biju R (2022) Guidelines on Seizure of Digital Devices: Supreme Court Issues Notice on Foundation for
Media Professionals’ Petition, 19 October. Live Law. Available at: www-livelaw-in.opj.remotlog.
12 The International Journal of Evidence & Proof 0(0)

com/top-stories/supreme-court-search-and-seizure-of-digital-devices-guidelines-212018 (accessed
June 2023).
Chander M (2021) Laws Around Electronic Evidence Compromise India’s Criminal Justice System, 2
April. Article 14. Available at: https://article-14.com/post/laws-around-electronic-evidence-compromise-
india-s-criminal-justice-system (accessed June 2023).
Fakhoury H and Kayyali D (2014) Know Your Rights, October. Electronic Frontier Foundation.
Available at: www.eff.org/issues/know-your-rights#footnote8_uoa1i9w (accessed June 2023).
Geofence Warrants and the Fourth Amendment (2021, May) Harvard Law Review 134(7).
Hobbie N Jr (2021) Reconsidering the foregone conclusion doctrine: Compelled decryption and the
original meaning of self-incrimination. University of New Hampshire Law Review 20: 51.
Joshi D (2014) Search and Seizure and the Right to Privacy in the Digital Age: A Comparison of US and
India, 31 May. The Centre for Internet & Society. Available at: https://cis-india.org/internet-
governance/blog/search-and-seizure-and-right-to-privacy-in-digital-age (accessed June 2023).
Kerr OS (2019) Compelled decryption and the privilege against self-incrimination. Texas Law Review
97(4): 767.
Morrison S (2021) Here’s How Police Can Get Your Data — Even If You Aren’t Suspected of a Crime,
31 July. Vox. Available at: www.vox.com/recode/22565926/police-law-enforcement-data-warrant
(accessed July 2023).
Mukhopadhyay D (2020) Explainer: Law Enforcement Access to Personal Electronic Devices
#SaveOurPrivacy, 3 August. Internet Freedom Foundation. Available at: https://internetfreedom.in/
search-seizure-personal-electronic-device/ (accessed June 2023).
Packer HL (1964) Two models of the criminal process. University of Pennsylvania Law Review 113(1):
1–68.
Packer HL (1968) The Limits of Criminal Sanction. Stanford, CA: Stanford University Press.
plain view doctrine (n.d.) Legal Information Institute. Available at: www.law.cornell.edu/wex/plain_
view_doctrine_0 (accessed June 2023).
Roach K (1999) Four models of the criminal process. The Journal of Criminal Law and Criminology
(1973–) 89: 671.
Sekri A (2020) Mobile Phones and Criminal Investigations in India, 2 May. SSRN. Available at: https://
papers.ssrn.com/sol3/papers.cfm?abstract_id=3590996 (accessed May 2023).
Trepel S (2007–2008) Digital searches, general warrants, and the case for the courts. Yale Journal of Law
and Technology 10: 120.
Shah et al. 13
14 The International Journal of Evidence & Proof 0(0)