Investigation involving digital devices- safeguarding gigabytes

Digital devices potentially contain gigabytes of personal and non-personal data. This may include information necessary for carrying out professional activities and on the other hand, sensitive personal data of users, both of which are prone to potential misuse.

The existing criminal procedure statute in India viz, the Code of Criminal Procedure 1973 (“CrPC”) as well as the newly introduced Bhartiya Nagarik Suraksha Sanhita 2023, which aims to supersede the CrPC, subject to a notification from the Ministry of Home Affairs are silent on the manner and method of seizure of digital devices during the course of investigation.

Incorrect seizures may lead to tampering of digital devices and a consequent waste of judicial time in prosecuting cases. Moreover, lack of any regulation also poses the risk of law enforcement entering into a roving a fishing enquiry over the contents of digital devices. There is presently no law or regulation which prescribes any Standard Operating Procedure for law enforcement agencies regarding the seizure of digital devices.

In October 2022, the Foundation for Media Professionals instituted a Writ Petition [WP(Crl)No(s). 395/2022] seeking regulations to govern the search and seizure of digital devices by investigative agencies. There are other similar petitions which are also pending before the Supreme Court of India on including Ram Ramaswamy v Union of India [WP(Crl)No.138/2021] and Amazon Seller Services Private v Directorate of Enforcement[WP(Civil)No(s).1081/2022]. The latter of which has been tagged with Foundation for Media Professional’s petition.

On 7 November 2023, in the Foundation for Media Professionals’ petition, the Supreme Court of India after hearing arguments observed that numerous journalists had their devices seized arbitrarily and a need for guidelines was asserted, highlighting that investigative agencies must not possess overly broad powers.

Parallelly, in the Ram Ramaswamy petition, the Petitioners suggested a set of guidelines proposed to be issued as directions by the Court. On November 9, 2023, the Supreme Court directed that the suggested guidelines be circulated to Central Government and States. A few important guidelines shared by the Petitioners in this matter have been extracted as under:

• Seizure of electronic devices must take place only after a judicial warrant; emergency seizure must be an exception, with reasons recorded for not obtaining a judicial warrant. However, in either case, it is also required to be “expressly” set out as to why and in what capacity the device is required to be seized.
• In either case, whether in the application for a judicial warrant, or in the memorandum recording reasons for an emergency seizure, it must be expressly set out why and in what capacity the device is required to be seized.
• A general roving inquiry or ground that evidence relevant to the case is sought and may be found should never be a ground for seizure or search and such a seizure must be declared impermissible even by a judicial warrant. In other words, seizure on the conjecture that evidence may be found will not be permissible in any circumstance especially where the device does not belong to an accused person.
• The investigating agency shall be barred from accessing and disclosing the nature of irrelevant, privileged, or personal material contained in any electronic device, to the extent the same comes to its notice accidentally or otherwise
• The person whose electronic devices are sought to be searched/seized shall not be compelled to divulge any credentials or passwords or information, including any cloud-stored information except as statutorily prescribed for e.g. Section 69 Information Technology Act, 2000 if and when applicable. Additionally the laws enabling information from service providers/intermediaries may apply, in the circumstances warranted in those laws.
• Where after observing all the aforesaid preconditions, a device is retained by the investigating authority, the same shall be returned to the owner/and or deposited in the concerned court within 30 days of the seizure, with the seizure memo itself specifying the date, time and location where they shall be returned to the owner.

These guidelines have been circulated to the Central Government which has assured the Supreme Court that they will be releasing their own guidelines on the issue shortly.

Seizure of digital devices raises an important issue of whether an accused is mandated to provide their password/ biometrics to an Investigating officer for unlocking seized digital devices.

In this regard, a 11 Judge Bench of the Supreme Court of India[1] has already adjudicated whether production of specimen handwritings and biometrics by way of fingerprints amounts to an accused becoming a witness against himself within the meaning of Article 20(3) of the Constitution of India.

Article 20(3) has been extracted as under for ease of reference:

“No person accused of any offence shall be compelled to be a witness against himself”.

The Supreme Court in this case observed that the mere fact that specimen handwritings and fingerprints had been given in police custody could not by itself amount to compulsion, apart from any other circumstances which could be urged as vitiating the consent of the accused in giving those specimen handwritings. Reverting to M.P. Sharma v Satish Chandra [[1954]1SCR1077], the Court observed that the guarantee stated in Article 20(3) is against “testimonial compulsion”.

It suggested that every positive volitional act which furnished evidence is testimony and testimonial compulsion connotes coercion which procures positive volitional evidentiary acts of the person, as opposed to the negative attitude of silence of submission on his part. It was also observed that if self-incriminatory information is given by an accused person without any threat, that will be admissible in evidence and not hit by Article 20(3) of the Constitution of India.

M.P. Sharma (supra) was overruled in by the Supreme Court in K.S. Puttaswamy v. Union of India, [(2017)10SCC1], to the extent that it had observed that privacy is not a right guaranteed by the Indian Constitution. It was held in M.P. Sharma (supra) that in absence of a provision like the Fourth Amendment to the U.S. Constitution, a right to privacy could not be read into the Indian Constitution. What has been ruled in K.S. Puttaswamy (supra) in context of Article 21, is that an invasion of privacy must be fulfilled on the basis of a law which stipulates a procedure which is fair, just and reasonable. However, the position set out in MP Sharma that that the prohibition in Article 20(3) covers not only oral testimony given by a person accused of an offence but also his written statements still holds good.

The Supreme Court in Kathi Kaul (supra) observed that the term “to be a witness” in Article 20(3) may be equivalent to “furnishing evidence” in the sense of making oral or written statements, but not in the larger sense of the expression so as to include giving of thumb impression or impression of palm or foot or fingers or specimen writing or exposing a part of the body by an accused person for purpose of identification. Therefore, giving thumb impressions or impressions of foot or palm or fingers or specimen writings or showing parts of the body by way of identification were not found to be included in the expression 'to be a witness'.

'To be a witness' in its ordinary grammatical sense means giving oral testimony in Court. Case law has gone beyond this strict literal interpretation of the expression which may now bear a wider meaning, viz., bearing testimony in Court or out of Court by a person accused of an offence, orally or in writing.

In this context, does a mandate to provide passwords or biometrics for the purpose of unlocking digital devices amount to being a witness under Article 20(3) and consequently be considered “self-incriminating”? Is this a positive vocational act or would this amount to testimonial compulsion?

The mere questioning by a police officer investigating a crime may not be considered testimonial compulsion within the meaning of Article 20(3). This would be a question of fact in each case to be determined by the Court on weighing the facts and circumstances disclosed in the evidence before it.

In the context of a Test Identification Parade, the Supreme Court of India[2] has observed that an Accused may be said to be compelled to attend a Test Identification Parade, but this compulsion does not involve any positive volitional evidentiary act. Mere attendance or the exhibition of his body at a test identification parade even though compelled, does not result in any evidentiary act until he is identified by some other agency. The identification of him by a witness is not his act, even though his body is exhibited for the purpose. His compelled attendance at a test identification parade is comparatively remote to the final evidence and cannot be said by itself to furnish any positive volitional evidentiary act.

In another decision of the Supreme Court[3], a Bench of three judges dealt with a challenge to the validity of three investigative techniques: narco-analysis, polygraph test (lie-detector test) and Brain Electrical Activation Profile (BEAP) on the ground that they implicate the fundamental rights under Articles 20(3) and 21 of the Constitution. The Court held that the results obtained through an involuntary administration of these tests are within the scope of a testimonial, attracting the protective shield of Article 20(3) of the Constitution. The Supreme Court adverted to the earlier decisions rendered in the context of privacy and noted that thus far, judicial understanding had stressed mostly on the protection of the body and physical actions induced by the state. The Court emphasized that while the right against self-incrimination is a component of personal liberty under Article 21, privacy under the constitution has a meeting point with Article 20(3) as well.

The Court observed that the "rule against involuntary confessions" is embodied in certain provisions of the Evidence Act, 1872 which seeks to serve both the objectives of reliability as well as voluntariness of testimony given in a custodial setting. Upon reviewing Articles 20(3) and 21 of the Constitution along with the principles of evidence law, the Court recognized the importance of personal autonomy in aspects such as the choice between remaining silent and speaking. An individual's decision to make a statement is the product of a private choice and there should be no scope for any other individual to interfere with such autonomy, especially in circumstances where the person faces exposure to criminal charges or penalties.

Therefore, subjecting a person to techniques in an involuntary manner was found to violate the prescribed boundaries of privacy. Forcible interference with a person's mental processes is not provided for under any statute and it most certainly comes into conflict with the "right against self-incrimination".

From the above cases, it is evident that what is prohibited by Article 20(3) of the Constitution is procuring by compulsion positive evidentiary acts of an Accused.

In our view, a potential argument against the forceful disclosure of passwords and biometrics may be that it does not tantamount to mere attendance or the exhibition of an accused’s body, rather it involves a positive act which may tantamount to furnishing evidence. Consequently, such an accused may find protection under Article 20(3) of the Constitution. Based on this argument, an action or direction of the State mandating appearance of an accused to “join investigation” by furnishing biometrics and passwords may challenged.

Recently in a welcome order, while recognizing the right against self-incrimination, the Delhi High Court[4] while granting bail to an accused applicant, reflected that an accused cannot be coerced to reveal/ disclose the password on its digital devices or any other like details in view of the protection guaranteed under Article 20(3) of the Constitution of India.

In light of the existing jurisprudence on the matter, it will be interesting to see how the Central Government frames its guidelines on the seizure of digital devices. We will continue to monitor and provide updates on developments in this space.

Authors

	Sumeet Lall  Partner, CSL Chambers  Sumeet.Lall@cslchambers.com
	Sidhant Kapoor Legal Director, CSL Chambers Sidhant.Kapoor@cslchambers.com
	Nikhil Lal Senior Associate, CSL Chambers Nikhil.Lal@cslchambers.com

[1] The State of Bombay v Kathi Kalu Oghad and Ors [[1962]3SCR10]