CYBER LAW AND

EVIDENCE ACT
 WHAT IS DIGITAL EVIDENCE?
• Digital evidence is defined as information and data of
value to an investigation that is stored on, received or
transmitted by an electronic device.
• This evidence can be acquired when electronic devices
are seized and secured for examination.
• Is latent (hidden), like fingerprints or DNA evidence
• Crosses jurisdictional borders quickly and easily
• Can be altered, damaged or destroyed with little effort
• Can be time sensitive
 Internet
• Emails, message boards, chat rooms, file sharing
networks, and intercepted communications.
Computers
Digital • Though information may overlap with internet
sources, computers provide many unique and notable
Evidence: pieces of evidence including time stamps, IP
addresses, information about VPNs, and MAC
Sources addresses.
Portable Devices
• These include information sourced from
smartphones, tablets, and other handheld devices or
gadgets.
 • The first rule of admissibility is the legality of
acquisition of the evidence. This involves
establishing whether the evidence was obtained with
the appropriate authorization.
• A search warrant, which gives legal permission for
investigators to search a vicinity, property, or
personal effects
Legality of • Consent, which is given willingly by the person or
Acquisition party concerned to the investigators, to access an
area, property, or personal effects to help with their
investigations
• Exigency, which entails that the situation presents a
level of urgency requiring investigators to carry out a
search
 • Computer forensics is a branch of digital forensic science pertaining to
evidence found in computers and digital storage media. Eg: Biometrics

CYBER • There are two types of data, that can be collected in a computer
forensics investigation:
• Persistent data: It is the data that is stored on a non-volatile memory
FORENSIC type storage device such as a local hard drive, external storage
devices like SSDs, HDDs, pen drives, CDs, etc. the data on these

S
devices is preserved even when the computer is turned off.
• Volatile data: It is the data that is stored on a volatile memory type
storage such as memory, registers, cache, RAM, or it exists in transit,
that will be lost once the computer is turned off or it loses power. Since
volatile data is evanescent, it is crucial that an investigator knows
how to reliably capture it.
 Section 3 : “Evidence”-of the Act was
amended and the phrase “All documents
produced for the inspection of the Court”
Indian was substituted by “All documents
including electronic records produced for
Evidence the inspection of the Court”.

Act 1872 The term ‘electronic records’ has been

given the same meaning as assigned to it
in the IT Act, which provides, ‘data, record
or data generated, image or sound stored,
received or sent in an electronic form or
micro film or computer generated
 • The definition of 'admission' (Section 17
of the Evidence Act) has been changed to
include a statement in oral, documentary or
Section 17 electronic form which suggests an
inference to any fact at issue or of relevance.
 The definition of Admission (section
17, Evidence Act) is changed to
include a statement, oral or
documentary, or contained in
electronic form (NEW FACT
THROUGH E-RECORD)
Sec 22A It provides that oral admissions
regarding the contents of electronic
records are not relevant unless the
genuineness of the electronic
records produced is in question.
 Evidence to be given when the statement
forms part of electronic record.

Sec 39A Evidence must be given so much and no

more of the electronic record as the court
considers necessary in that particular case
to the full understanding of the nature
and effect of the statement and of the
circumstances under which it was made.
 • 65 A: Any information contained in an
electronic, is deemed to be a document
and is admissible in evidence without
65-A further proof of the original's production,
provided that the conditions set out in
Section 65-B are satisfied.
 The computer output containing the information was
produced by the computer during the period over which
the computer was used regularly to store or process
informationfor the purposes of any activities regularly
carried on over that period by the person having lawful
control over the use of the computer;
Conditions (b) during the said period, information of the kind

for the contained in the electronic record or of the kind from

which the information so contained is derived was
regularly fed into the computer in the ordinary

admissibilit course of the said activities;

y of digital (c) throughout the material part of the said period, the
computer was operating properly or, if not, then in
respect of any period in which it was not operating

evidence properly or was out of operation during that part of the

period, was not such as to affect the electronic record or
the accuracy of its contents; and

Sec 65B
(d) the information contained in the electronic record
reproduces or is derived from such information fed into
the computer in the ordinary course of the said activities.
• Section 65B (4) provides for the requirement of a
certificate of authenticity in order to satisfy the
conditions set out, signed by a person occupying a
responsible official position.
• Such a certificate will be evidence of any matter stated in
the certificate. The certificate must identify the electronic
record containing the statement, describe the manner in
which it was produced, and also give such particulars of
any device involved in the production of the electronic
record as may be appropriate for the purpose of showing
that the electronic record was produced by a computer.
 • A fact which is relevant and admissible may
not have to be construed as a proved fact.
Presumptions The judge has to appreciate the fact to come
regarding to conclusion that it is proved fact.

digital • The Evidence Act has been amended to

introduce various presumptions regarding
evidence digital evidence
 • Section 84A provides a
presumption that a contract is
Electronic concluded where the digital
agreements signatures of the parties are
affixed to an electronic record
that purports to be an agreement
 • Section 85B provides that where a security procedure has been
applied to an electronic record at a specific point of time, then
the record is deemed to be a secure electronic record from
such point of time to the time of verification. Unless the contrary
is proved.
• the court is to presume that a secure electronic record has not
been altered since the specific point of time to which the secure
Secure status relates.
• Section 15 of the IT Act: Security procedure agreed by the
electronic parties concerned, at the time it was Digital Signature was
affixed

records and • (a) unique to the subscriber affixing it;

• (b) capable of identifying such subscriber;
digital • (c) created in a manner or using a means under the exclusive
control of the subscriber and is linked to the electronic record
signatures to which it relates in such a manner that if the electronic record
was altered the digital signature would be invalidated
• In the case of a secure digital signature, there is a
presumption that the secure digital signature was affixed by
the subscriber with the intention of signing or approving the
electronic record
 • Section 88A, there is a presumption that an
electronic message forwarded by the
sender through an electronic mail server to
the addressee to whom the message purports
to be addressed, corresponds with the
message fed into his computer for
Electronic transmission.
messages • However, there is no presumption as to the
person by whom such message was sent.
This provision only presumes the
authenticity of the electronic message,
and not the sender of the message.
 • The provisions of section 90A make it clear that where an
electronic record is produced from any custody which the court
in a particular case considers proper, and it purports to be or

Electronic
is proved to be five years old, it may be presumed that the
digital signature affixed to the document was affixed by the
person whose signature it or any person authorized by

records five them on their behalf.

• An electronic record can be said to be in proper custody if it is
in the place in which, and under the care of the person with
years old whom, they naturally be.
• The custody is not improper if it is proved to have had a
legitimate origin, or the circumstances of the particular case
are such as to render the origin probable.
 • Sec 175 IPC: intentionally omitting to
produce or deliver up the document or
electronic record to any public servant.
• Sev 192 IPC: fabricating false evidence by
making a false entry in an electronic record
or making any electronic record containing a
false statement, intending the false entry or
Changes in statement to appear in evidence in judicial
Indian Penal proceedings.
• Sec 204 IPC: the destruction of an
Code, 1860 electronic record, where a person secrets or
destroys an electronic record, or obliterates
or renders illegible the whole or part of
electronic record with an intention of
preventing the record from being produced
or used as evidence
• Sec 436 and 465 IPC: making any
false electronic record.
• Sec 173 IPC: intentionally preventing
the service of summons, notice or
proclamation to produce a document
or electronic record in a court.
• Sec 172 IPC: absconding to avoid the
production of a document or
electronic record in a court
 Cyber world challenges
• The standard of proof in the form of electronic evidence “should be
more accurate and stringent” compared to other documentary evidence,
tested with the touchstone of relevance and admissibility before it is
admitted in the court.
• This timely alterations and amendments will make it an efficacious tool of
combat for cyber world challenges.
 Recent rulings of Indian courts on digital
evidence Search and seizure
• State of Punjab v. Amritsar Beverages Ltd.2006
• search by the Sales Tax Department and the seizure of computer hard disks and
documents from the dealer’s premises.
• the authorities must return the seized documents within the stipulated period
provided the dealer or the person concerned is given a receipt for the property.
• (a) in the case of book, account, register or document which was being used at
the time of seizing, within a period of ten days from the date of seizure; and (b)
in any other case, within a period of sixty days from the date of seizure;
Admissibility of intercepted telephone calls
• State (NCT of Delhi) v. Navjot Sandhu, (2005)
• Indian Parliament on 13 December 2001, in which five heavily armed persons entered the
Parliament House Complex and killed nine people, including eight security personnel and one
gardener, and 16 people, including 13 security men, received injuries. This case also dealt with
the proof and admissibility of the records of mobile telephone calls. While considering the
appeal against the accused for attacking the Indian Parliament, a submission was made on
behalf of the accused that no reliance could be placed on the mobile telephone call records,
because the prosecution failed to produce the relevant certificate under section 65B (4) of the
Evidence Act.
• Court concluded that a cross-examination of the competent witness acquainted with the
functioning of the computer during the relevant time and the manner in which the printouts of
the call records were taken was sufficient to prove the call records.
 Dharambir v. CBI 2008
• Certain data ( call records) were copied from Hard disk to a CD
• Cyber Forensics Lab in Hyderabad confirmed that the recorded data on CD were true
copies of the originals and that the Hard Disk was in working condition
• A question came: difference b/w. Electronic Device and Record
• If the Electronic device has ever recorded any data which is relevant for a case, such
electronic device shall be treated as electronic record for the purpose of the evidence.
• Scope of definition of the word Data was contended and was held that data would
include active memory as well as subcutaneous memory.
 Amitabh Bagchi v. Ena Bagchi 2005
• Section 65 A and 65 B of the IEA, 1872 were analyzed.
• Physical presence not required for purpose of adducing evidence and the
same can be done through medium like video conferencing.
• Definition of Electronic records includes Video Conferencing per se.
 • The State of Maharashtra v. Dr. Praful B
Desai (2003)
• The question as to whether a witness can be
examined by means of a video conference.
Examination The Supreme Court observed that video
conferencing is an advancement of science
of a witness and technology, which permits one to see,
by video hear and talk with someone far away with
the same facility and ease as if they are
conference physically present. The requirement of law
for the presence of the witness does not
mean actual physical presence.
THANK YOU