The court made the said observation while granting bail to Sanket Bhadresh Modi, the director of a business that is accused of scamming US citizens out of $20 million by placing millions of fraudulent phone calls to the USA from fraud call centres in India. Even as the bench acknowledged that Modi and all other accused parties are expected to exhibit a high level of sensitivity, thoroughness, and understanding throughout this kind of probe, the court also emphasised on the constitutional safeguards provided to the accused.

As per a report in the LiveLaw, the bench stated “At the same time, the concerned Investigating Agency cannot expect anyone who is an accused, like the applicant herein, to sing in a tune which is music to their ears, more so, whence such an accused, like the applicant herein is well and truly protected under Article 20(3) of The Constitution of India.”

Brief about the case:

The Central Bureau of Investigation (CBI) had registered an FIR wherein it was alleged that a company, called E-Sampark Softech Pvt. Ltd, along with its directors, had made millions of scam phone calls to the US from fraud call centres located in India and had defrauded and cheated US citizens to the tune of about 20 million USD. The accused had been booked under Sections 120B, 170, 384, 420 and 503 of the Indian Penal Code, 1860 and under Sections 66C, 66D, 75 and 85 of the Information Technology Act, 2000 against the accused. As per the LiveLaw report, at least 12 persons were named as an accused in the FIR. Notably, Modi was in custody since July 19, 2023, and the charge sheet was filed on September 16, 2023.

Observations of the court:

The CBI had opposed the bail plea stating that the man is the “real kingpin behind the entire racket” since he is the director of the company alleged to be involved in the FIR. On the contention raised by the investigative agency that Modi was not being cooperative with the investigation as the agency was still awaiting for Modi to provide the passwords needed to open the gadgets or digital devices that were taken during the probe, the Court noted that the Indian Constitution guarantees Modi protection from doing so. As per the report, it was held by the bench that since trial in the case was ongoing, Modi cannot be coerced to reveal or disclose the password(s) or any other like details in view of the protection guaranteed to him.

Justice Banerjee further said that since the complainants and those allegedly cheated or defrauded were overseas and were far beyond the reach of the accused, there were miniscule chances of him influencing the witnesses. The court also observed that the CBI had not said that while the man was out on interim bail for 203 days, he had misused his liberty; it further said it does not find the applicant to be a flight risk or a case wherein he would shun away from participating in the investigation, as and when called for.

“Furthermore, it is not the case of the CBI that while the applicant was out on interim bail for the period of 203 days, he has misused the liberty or has actually (tried to) indulge in any such kind of activities. In view thereof, this Court does not find the applicant to be a flight risk or a case wherein he would shun away from participating in the investigation, as and when called for,” the court said, as per the LiveLaw report.

It added that though Modi was named in the FIR as an accused, however, till the final outcome of the proceedings, his status was merely that of a suspect and is innocent till proven guilty. In view of this, the court held that the accused cannot be coerced to self-incriminate and can also not be kept behind bars.

“Lastly and most specifically, this court cannot forget that though the applicant has been named in the FIR as an accused, however, till the final outcome of the proceedings emanating therefrom, the status of the applicant is merely that of a suspect. The applicant is innocent till proven guilty,” a report of the Indian Express stated.

The HC further observed that the case primarily revolves around electronic evidence on laptops, mobile phones and other sophisticated gadgets which have already been seized by the CBI. Thus, if granted bail, there are hardly any chances of the man tampering with the devices, the court said.

As per the report of IE, Justice Banerjee further observed that the complainants who have been allegedly cheated or defrauded are overseas and are far beyond the reach of the man, and so there are “miniscule chances of the applicant influencing the witnesses”.

“In view thereof, keeping the applicant behind bars will lead to violation of Article 21 of the Constitution of India,” Justice Banerjee underscored, as per the LiveLaw report.

The HC thereafter granted the man bail on him furnishing a personal bond of Rs. 2 lakh along with one surety of the like amount by a family member/ friend having no criminal case pending against them, subject to certain conditions.

Related:

Unjust detention: Gautam Navlakha’s bail victory highlights insufficient evidence
India’s constitutional courts navigate challenges in upholding personal freedom over incarceration

India’s Prisons: 95.84% male population, highest number of convicts and under trials languishing in UP prisons

The post Delhi HC: “Accused cannot be coerced to reveal or disclose the password(s) in view of Article 20 (3) of Indian Constitution” appeared first on SabrangIndia.

On October 29, a Delhi CBI Court held that the CBI cannot force the accused to reveal the password of his computer as it would amount to self-incrimination. Since there is always an apprehension that the data accessed could be evidence that could eventually be used to prove the accused guilty in court. The court also considered a 2021 Karnataka High Court’s judgement which had held to the contrary, allowing the investigating agency to seek the password from the accused while stating that the High Court had not considered an important Supreme Court precedent.

Background

In this case, the CBI sought the password of the computer as well as some software used by the accused, which he opposed. Hence the CBI filed an application before the District Court. The investigating agency relied upon Karnataka High Court judgment in Virendra Khanna vs. State of Karnataka, (decided on 12.03.2021 in W.P. No. 11759 of 2020) where the court had held that investigating agency has a right to seek password and biometrics from an accused for accessing/opening his computer system and mobile phone which was/were seized during investigation and no constitutional right of the accused is violated.

The accused opposed the CBI’s application stating that he has the right to remain silent under Article 20(3) [No person accused of any offence shall be compelled to be a witness against himself] of the Constitution of India as well as Section 161 (2) Cr.P.C [Such person shall be bound to answer truly all questions, other than questions the answers to which would have a tendency to expose him to a criminal charge or to a penalty or forfeiture], also adding that the CBI demand interferes with his right to privacy. He also refuted the application of the Virendra Khanna judgement due to territorial limitation and also on grounds that it was a judgment per incuriam i.e. a judgement applied without due application; wherein a judgement of a court has been decided without reference to a statutory provision or an earlier judgement which may or would have been relevant.

Right against self-incrimination

The right against self-incrimination finds its origins in Latin maxim nemo tenetur seipsum prodere (i.e. no one is bound to accuse himself) and the evolution of the concept of “due process of law” enumerated in the Magna Carta.

In Selvi v. State of Karnataka, (2010) 7 SCC 263, the Supreme Court held thus, “the right against self-incrimination” is a vital safeguard against torture and other “third-degree methods” that could be used to elicit information. It serves as a check on police behaviour during the course of investigation. The exclusion of compelled testimony is important otherwise the investigators will be more inclined to extract information through such compulsion as a matter of course.

The major crux of this right lies in the principle that during the trial stage, the onus is on the prosecution to prove the charges levelled against the defendant and hence, this right is a vital protection to ensure that the prosecution discharges the said onus.

The US Constitution incorporates the “privilege against self-incrimination” in the text of its Fifth Amendment.

Article 14(3) (g) of the International Covenant on Civil and Political Rights (ICCPR) enumerates the minimum guarantees that are to be accorded during a trial and states that everyone has a right not to be compelled to testify against himself or to confess guilt.

The European Convention for the Protection of Human Rights and Fundamental Freedoms, 1950, Article 6(1) states that every person charged with an offence has a right to a fair trial and Article 6(2) provides that “everybody charged with a criminal offence shall be presumed innocent until proved guilty according to law”.

With the right against self-incrimination also comes the provision that a person’s right to remain silent cannot be adversely used against him to prove his guilt. Section 161(2) CrPC enables a person to choose silence in response to questioning by a police officer during the stage of investigation, and as per the scheme of Section 313(3) and proviso (b) to Section 315(1) of the Code, adverse inferences cannot be drawn on account of the accused person’s silence during the trial stage.

Jurisprudence

In Selvi, the Supreme Court held that although certain provisions of CrPC such as section 39 (places a duty on citizens to inform the nearest Magistrate or police officer if they are aware of the commission of, or of the intention of any other person to commit the crimes) are intended to ensure the citizens’ cooperation during the course of investigation, they cannot override the constitutional protections given to the accused persons.

The person being interrogated can resort to Section 161(2) CrPC which prescribes that when a person is being examined by a police officer, he is not bound to answer such questions, the answers of which would have a tendency to expose him to a criminal charge or a penalty or forfeiture.

In Nandini Satpathy case [(1978) 2 SCC 424 : 1978 SCC (Cri) 236], Justice VR Krishna Iyer held, “Article 20(3) is a human article, a guarantee of dignity and integrity and of inviolability of the person and refusal to convert an adversary system into an inquisitorial scheme in the antagonistic ante-chamber of a police station.”

 What does not count as self-incrimination?

There are other instances where issue of self-incrimination has been argued before courts and the courts have liberally allowed investigations holding certain investigations to be compatible with Article 20(3) which means that not all investigations or seeking of evidence from an accused can amount to self-incrimination. While interpreting Article 20(3), the Supreme Court in Selvi held that Constitution-makers could not have intended to put obstacles in the way of efficient and effective investigation into crime and of bringing criminals to justice.  The giving of finger impression or of specimen signature or of handwriting, does not amount to self-incriminating evidence.

“Self-incrimination must mean conveying information based upon the personal knowledge of the person giving the information and cannot include merely the mechanical process of producing documents in court which may throw a light on any of the points in controversy, but which do not contain any statement of the accused based on his personal knowledge,” the court held.

in Jamshed v. State of U.P. [1976 Cri LJ 1680 (All)], the Allahabad High Court held that the phrase “examination of a person” under Section 53 CrPC should be read liberally so as to include an examination of what is externally visible on a body as well as the examination of an organ inside the body and thus held that a blood sample can be compulsorily extracted during a “medical examination”.

In Mahipal Maderna v. State of Rajasthan [1971 Cri LJ 1405 (Raj)], the Rajasthan High Court held that an order requiring the production of a hair sample comes within the ordinary understanding of “investigation”

Revealing password is self-incriminating?

The court, relied upon the Selvi judgment where the apex court laid out a test to identify whether a particular fact/information/testimony/evidence comes within the category of “testimonial fact” as protected by Article 20(3) of the Constitution of India which an accused is not bound to give. The oral or written statement which convey the personal knowledge of a person in respect of relevant facts amount to “personal testimony” and may be based on oral or written statement of an accused but they can still be compelled for the purpose of identification or comparison with facts and materials which are already in the possession of the investigating agency.

The court held that Article 20(3) can be invoked when the statements are likely to lead to incrimination by themselves or “furnish a link in the chain of evidence” needed to do so but not for comparison/identification with other evidence.

“…a testimony in oral (like voice sample) or written form (like specimen hand writing or signature) though may be personal yet they can be taken under compulsion from an accused if it is to be used for the purpose of identification or comparison with already available voice recording or signature/handwriting which is/are obtained from other sources like seizure of document or chance print, finger prints of the scene of crime, etc,” the court said.

Since the CBI was seeking password of the computer from the accused for accessing his data and not for comparison or identification, the court held that narco-analysis of an accused cannot be done without his consent since such procedure involves personal knowledge of the accused. On the same principle, the court held that similar logic applies to a password as it involves the import of personal knowledge.

When statements are likely to lead to incrimination by themselves or “furnish a link in the chain of evidence”, then bar of Article 20(3) of the Constitution would apply.

Password vs Biometrics

Computer sources or mobile phones these days can also be unlocked by use of biometrics such as thumb print or face scan. In the Virender Khanna judgment, password and biometrics have been treated as one and the same thing. However, the district court in this order observed that as per the Criminal Procedure (Identification) Act, 2022 (w.e.f. 18.04.2022) a different approach is required to be taken.

The court observed that biometrics such as finger-impressions, palm-print impressions, foot-print impressions, photographs, iris and retina scan are included in the definition of “measurements” as are physical, biological samples and their analysis, behavioural attributes including signatures, handwriting. Thus, during investigation such “measurements” can be taken by the police and the Magistrate can also given directions to the accused to provide such measurements. However, the Act does not mention words like password or user id in the definition of “measurements”. “Therefore, it is clear that the aforesaid Act does not apply to the password/User ID of an electronic record (which may be contained in a computer system, mobile phone, hard-disk, memory card, email etc.) or any other documentary evidence (like a suit-case locked with some number code),” the court held.

The court has thus inferred that an accused can be asked or directed to give his biometrics (in the form of his finger impressions, face or iris recognition) for the purpose of opening of his electronic device.

At the same time, the Criminal Procedure (Identification) Act, 2022 under section 3 has an exception that “any person arrested for an offence committed under any law for the time being in force may not be obliged to allow taking of his biological samples under the provisions of this Section” unless the offence is against a woman or a child or when the offence is punishable for more than 7 years. Which means if a person is charged with minor offences he/she can refuse to provide such “measurements”.

“…said biometrics can be taken from an accused and used for opening of mobile phone/computer system/email/software applications, etc. by the police agency, wherever such need arises for a fair investigation,” the court opined.

Further, if password is required by police not for accessing data but for comparison of the said password (as a physical evidence) with the other available evidence, then the same is permissible.

Password is a testimonial fact

The court was of the opinion that when an accused is asked to disclose his password to the investigating agency, he is required to apply his mental faculty and/or memory to recall said password and it is purely based on his personal mental effort or knowledge, therefore, said information comes within the category of “testimonial fact” which the accused cannot be forced to give.

“…a password does not itself constitute a ‘self-incriminating testimony’ against an accused who gives such password, but from practical point of view, the said password alone is not the sole objective of the IO and in fact he wants to use it for the purpose of accessing the data which is contained in a computer system or a mobile phone which is/are seized from the accused and, therefore, the said password is to be taken as integral part of the said computer system/mobile phone which is/are not severable from it. While considering the status of such information being incriminating or not, this Court cannot consider password alone in isolation.”

Even if there is apprehension that the data revealed after entering the password may be incriminating, the accused has the right to not give such password to the investigating agency as per section 161(2) of CrPC which uses the words “tendency to expose him to a criminal charge or to a penalty or forfeiture.”

Evidence obtained by illegal means can still be used in the court in certain circumstances, hence if after being forced to reveal password, incriminating data is revealed, it will amount to self-incrimination by the accused.

Conclusion

The court thus held that the accused cannot be compelled to provide any password to his computer as he is protected by Article 20(3) of the Constitution of India as well as Section 161(2) of Cr.P.C. However, at the same time the Investigating agency is at liberty to access the data in the computer with the help of specialised agency or person at the risk of accused for loss of data, if any.

This being an order of a district court, it will not have an impact on jurisprudence, unless affirmed or upheld by at least, a High Court. However, the order has decided upon an important aspect of investigation since electronic devices are often seized by investigating agencies in the course of investigation when those accused are not aware of their right against self-incrimination. Even if this order cannot have the force of law to be applicable in all cases, it can become matter of contention to be decided by higher courts eventually to protect an accused person’s right against self-incrimination.

Relevance to The Wire raids

This order also came at a time when multi-city raids were conducted by Delhi Police at the homes of editors of The Wire, an independent online news portal based on a criminal defamation complaint filed by BJP’s IT cell chief, Amit  Malviya. The FIR was lodged on charges of cheating, forgery defamation and criminal conspiracy; none of which are serious offences where the accused can be forced to give any biometric information. Now as per the CBI court’s order, none cannot be forced to even reveal passwords to their devices.

The Delhi  Police Crime Branch, however, arbitrarily conducted search and seizure operations at the homes of The Wire’s founding editors, Siddharth Varadarajan, M K Venu and Sidharth Bhatia as well as the deputy editor, Jahnavi Sen and product-cum-business head, Mithun Kidambi, relying on notice under Section 91 of the Criminal Procedure Code, 1973.

According to media reports, a total of 16 devices were seized from the office of The Wire. Two phones, a tablet and a laptop from Varadarajan, a phone and a laptop each from Venu, Bhatia, Sen and Kidambi, and two hard disks from the accounts department’s computers were among the devices seized. A reporter’s phone and the computer he worked on at the Wire’s office were also taken away in Delhi. In addition to these devices, the Delhi police also asked the four editors and Kidambi to remove passcodes from their phones and laptops, and to provide passwords to their official and personal email accounts. Three staffers were asked for passwords to their official email accounts while another staff member was told to give passwords to both official and personal email accounts.

Siddharth Vardarajan told Sabrangindia that they had opposed the seizure of these devices without providing (the safeguard of) any hash value (ie numeric value that uniquely identifies data lodged in any device at a particular point of time. The Wire has given objections of this violation of procedure in writing to the Delhi Police contingent and Investigating Officer (IO). They were all however compelled to surrender all devices and divulge the passwords without the requisite safeguards of protecting the integrity of the data seized.

Independent analysis and investigation of a cloned hard disc of one of the accused in the famed Bhima Koregaon case has revealed how data implants on computers are indeed a possibility. Arsenal Consulting, a Massachusetts-based digital forensics firm has analysed an electronic copy of activist Rona Wilson’s laptop and arrived at the conclusion that an attacker used malware to infiltrate the laptop and place incriminating evidence on it, reported The Washington Post. To date this has not been examined by the courts in this case.

Meanwhile the PUCL statement condemning the raids in The Wire noted that the Crime Branch did not follow the requisite procedure as it took away devices from the news portal’s New Delhi office and from the homes of those raided without providing any hash value, i.e., the numeric value that uniquely identifies data lodged in an electronic device at any given point in time.  There are legitimate concerns that absence of a hash value leaves the door open to planting material on the digital devices.

The order may be read here.

Related:

Raids on Wire editors & seizure of electronic devices did not follow law & procedure: PUCL

Raids on The Wire criminalising journalism: DIGIPUB India condemns Delhi police action

The post Revealing the password of your device to the police amounts to self-incrimination? appeared first on SabrangIndia.

According to the court, the Supreme Court’s judgment in Selvi versus State of Karnataka (2010) which ruled against the validity of mandatory narco tests against the accused under Article 20(3), can be relied upon to extend similar protection to the accused from divulging passwords for electronic devices seized from him or her. The court’s decision comes as a breath of fresh air in the context of the ongoing investigation against The Wire’s editors.

AN accused cannot be forced to reveal the password of his electronic devices after they are seized by an investigative agency, held a Special CBI Court in Delhi.   The judge, Naresh Kumar Laka, stated that compelling an accused to do so goes against the protection from self-incrimination under Article 20(3).

In the present case, a computer was seized by the Central Bureau of Investigation (CBI) from the custody of the accused and sent to a Central Forensic Science Laboratory (CSFL). However, the data from his computer could not be obtained for want of a password.  

Thereafter, the agency filed an application seeking the court to direct the accused to disclose the required password.

The court accepted the accused’s plea that the CBI had not mentioned any specific provisions of Cr.P.C. in the present application, observing further that Criminal Courts at the District level do not have any inherent power to pass an order giving  relief to a party in the absence of application of any specific statutory provision.

However, it expressly allowed the Investigative Officer  “access to the data of the computer seized from the accused with the help of a specialized agency or person at the risk of accused for loss of data, if any.”

Right to maintain silence

The public prosecutor for the CBI submitted that such direction can be given to the accused as he is currently out on bail on the condition that he will cooperate in the investigation as and when required.

The court, however, held that the accused had a right to maintain silence as per Article 20(3) of the Constitution as well as Section 161 (2) of Cr.P.C. and, therefore, cannot be compelled to disclose his password which would tantamount giving of self-incriminating testimony.

The Article 20(3) states “no person accused of an offence shall be compelled to be a witness against himself“. Meanwhile, Section 161(1)&(2) prescribes that when a person is being examined by an Investigating Officer, they are bound to answer questions truly, except when it involves information “which may have a tendency to expose an accused to a criminal charge, penalty or forfeiture”.

Court cites Selvi, Puttaswamy judgments

The court also discussed what amounts to self-incriminatory testimony in light of the Supreme Court’s judgments in Selvi versus State of Karnataka (2010) and K.S. Puttaswamy versus Union of India (2017).

The Supreme Court in Selvi had ruled that compelling an accused to go through neuroscientific investigative techniques such as lie detector tests and narco-analysis constituted testimonial compulsion and violated their right against self-incrimination under Article 20(3), and their right to life and personal liberty under Article 21.

The Supreme Court had stated that for a testimony to be considered self-incriminatory, “it must be of such a character that by itself it should have the tendency of incriminating the accused, if not also of actually doing so.”

Citing the Selvi judgment, the CBI Court stated that considering that the forensic techniques dealt with in Selvi involved acquiring “personal knowledge” from an accused, the same logic applies to passwords sought in the present case.

The CBI Court had cited the Karnataka HC  in Virendra Khanna versus State of Karnataka (2021) that held that investigative agencies had the right to seek both passwords and biometrics, but noted that the High Court had either ignored or not kept in mind the observations in Selvi.

The court made a distinction between passwords and biometrics, keeping in view the provisions of the recent Criminal Procedure (Identification) Act, 2022. In the said Act, the word ‘measurement’ has been used for referring to various physical evidence which is generally required by the investigating agency from the accused, but it does not include passwords.

The accused had cited the Puttaswamy judgment to contend that the said computer system may contain private data of the accused and if revealed to the investigating agency, it may interfere with his privacy. The CBI Court did not, however, find the present application in complete violation of the judgment.

Relevance in the ongoing investigation against The Wire editors

The CBI court’s decision, though in a different case, is highly relevant in the context of the Delhi Police’s obtaining of the passwords of the electronic devices seized from The Wire’s editors, Siddharth Varadarajan, M.K.Venu, Siddharth Bhatia and deputy editor, Jahnavi Sen, apart from its product-cum-business head, Mithun Kidambi, pursuant to a Section 91 (under Cr.P.C) notice issued in relation to an FIR lodged against them by the BJP leader, Amit Malaviya.  

Although all the five cooperated and gave over the devices sought along with their passwords, they also placed on record their demand for the hash value of the phones, computers and iPads seized and for cloned copies of the devices seized to be kept at a neutral place.  The hash value is a unique numerical value used to ensure the integrity of a device and its data.

Read the order here.

Courtesy: newsclick.in

The post Prosecution Cannot Force an Accused to Divulge Password of Electronic Device: CBI Court appeared first on SabrangIndia.