The court made the said observation while granting bail to Sanket Bhadresh Modi, the director of a business that is accused of scamming US citizens out of $20 million by placing millions of fraudulent phone calls to the USA from fraud call centres in India. Even as the bench acknowledged that Modi and all other accused parties are expected to exhibit a high level of sensitivity, thoroughness, and understanding throughout this kind of probe, the court also emphasised on the constitutional safeguards provided to the accused.

As per a report in the LiveLaw, the bench stated “At the same time, the concerned Investigating Agency cannot expect anyone who is an accused, like the applicant herein, to sing in a tune which is music to their ears, more so, whence such an accused, like the applicant herein is well and truly protected under Article 20(3) of The Constitution of India.”

Brief about the case:

The Central Bureau of Investigation (CBI) had registered an FIR wherein it was alleged that a company, called E-Sampark Softech Pvt. Ltd, along with its directors, had made millions of scam phone calls to the US from fraud call centres located in India and had defrauded and cheated US citizens to the tune of about 20 million USD. The accused had been booked under Sections 120B, 170, 384, 420 and 503 of the Indian Penal Code, 1860 and under Sections 66C, 66D, 75 and 85 of the Information Technology Act, 2000 against the accused. As per the LiveLaw report, at least 12 persons were named as an accused in the FIR. Notably, Modi was in custody since July 19, 2023, and the charge sheet was filed on September 16, 2023.

Observations of the court:

The CBI had opposed the bail plea stating that the man is the “real kingpin behind the entire racket” since he is the director of the company alleged to be involved in the FIR. On the contention raised by the investigative agency that Modi was not being cooperative with the investigation as the agency was still awaiting for Modi to provide the passwords needed to open the gadgets or digital devices that were taken during the probe, the Court noted that the Indian Constitution guarantees Modi protection from doing so. As per the report, it was held by the bench that since trial in the case was ongoing, Modi cannot be coerced to reveal or disclose the password(s) or any other like details in view of the protection guaranteed to him.

Justice Banerjee further said that since the complainants and those allegedly cheated or defrauded were overseas and were far beyond the reach of the accused, there were miniscule chances of him influencing the witnesses. The court also observed that the CBI had not said that while the man was out on interim bail for 203 days, he had misused his liberty; it further said it does not find the applicant to be a flight risk or a case wherein he would shun away from participating in the investigation, as and when called for.

“Furthermore, it is not the case of the CBI that while the applicant was out on interim bail for the period of 203 days, he has misused the liberty or has actually (tried to) indulge in any such kind of activities. In view thereof, this Court does not find the applicant to be a flight risk or a case wherein he would shun away from participating in the investigation, as and when called for,” the court said, as per the LiveLaw report.

It added that though Modi was named in the FIR as an accused, however, till the final outcome of the proceedings, his status was merely that of a suspect and is innocent till proven guilty. In view of this, the court held that the accused cannot be coerced to self-incriminate and can also not be kept behind bars.

“Lastly and most specifically, this court cannot forget that though the applicant has been named in the FIR as an accused, however, till the final outcome of the proceedings emanating therefrom, the status of the applicant is merely that of a suspect. The applicant is innocent till proven guilty,” a report of the Indian Express stated.

The HC further observed that the case primarily revolves around electronic evidence on laptops, mobile phones and other sophisticated gadgets which have already been seized by the CBI. Thus, if granted bail, there are hardly any chances of the man tampering with the devices, the court said.

As per the report of IE, Justice Banerjee further observed that the complainants who have been allegedly cheated or defrauded are overseas and are far beyond the reach of the man, and so there are “miniscule chances of the applicant influencing the witnesses”.

“In view thereof, keeping the applicant behind bars will lead to violation of Article 21 of the Constitution of India,” Justice Banerjee underscored, as per the LiveLaw report.

The HC thereafter granted the man bail on him furnishing a personal bond of Rs. 2 lakh along with one surety of the like amount by a family member/ friend having no criminal case pending against them, subject to certain conditions.

Related:

Unjust detention: Gautam Navlakha’s bail victory highlights insufficient evidence
India’s constitutional courts navigate challenges in upholding personal freedom over incarceration

India’s Prisons: 95.84% male population, highest number of convicts and under trials languishing in UP prisons

The post Delhi HC: “Accused cannot be coerced to reveal or disclose the password(s) in view of Article 20 (3) of Indian Constitution” appeared first on SabrangIndia.

Notably, on November 9, the Supreme Court had directed senior advocate Nitya Ramakrishnan for the circulation of the above-mentioned suggested set of guidelines to the Union government as well as the state governments. This move had come after the Supreme Court had asked the Union government to lay down guidelines on the seizure of electronic devices. On November 7, while hearing a separate PIL (Public Interest Litigation) filed by the Foundation for Media Professionals, the Supreme Court had deemed it to be “unacceptable” that there are no rules governing the seizure of such devices and there seems to be “uncontrolled power to access devices of journalists”.

The Supreme Court bench had observed: “It is dangerous all powers are with the agencies … it is very, very dangerous.”

The bench of Justices Sanjay Kishan Kaul and Sudhanshu Dhulia had also observed that proper guidelines are needed in this regard to prevent any misuse by the investigating agencies. As per the report of The Wire, the union government is expected to take into account the circulated draft of guidelines and submit a response in court.

What are the guidelines suggested in the draft?

As reported in The Wire, the guidelines suggested by the academics comprise 18 points which have been extensively footnoted with references to the law in overseas jurisdictions. The guidelines had been submitted through advocate S Prasanna. These are as follows:

Method of seizure of electronic devices: The draft guidelines provided that seizure of electronic devices can only be conducted after a judicial warrant. Though emergency seizure must be an exception, reasons for not obtaining a judicial warrant must be recorded.

Express reason of seizure: In both the cases of seizure, with warrant or emergency seizure, it must be “expressly” mentioned why and in what capacity the device is required to be seized. Electronic items shouldn’t be seized on the ground that evidence may be found. “In other words, seizure on the conjecture that evidence may be found will not be permissible in any circumstance especially where the device does not belong to an accused person,” the draft guidelines states, according to another report in the NewsClick.

The guidelines provide that privileged, professional, journalistic or academic materials can’t be seized without a judicial warrant and only if the material is directly linked with the crime.  “If the intention is to search such privileged, professional, journalistic or academic material, then it must only be by a judicial warrant and upon the ground that the said material is directly part of the crime under investigation and not merely evidence of the same,” the draft guidelines states as per the report of NewsClick.

Production and retention of materials seized: The seized device shall be produced before an independent agency and all irrelevant, personal and privileged material shall be identified.  The device shall be returned immediately after separating relevant material and a copy taken. “At initial examination by an independent agency, in the presence of the owner of the device (or their agent), all irrelevant, personal and privileged material is separately identified, the material relevant to investigation is demarcated and only a copy of such relevant material is taken,” the draft guidelines read, as per NewsClick.

Besides this, the guidelines specified that excluded material must not be retained. “The irrelevant, privileged or personal material so excluded must not be retained, and the device itself should be returned immediately after taking a copy of only the relevant material for the investigation or suspect material.”

Addition safeguards were also placed by the draft guidelines which detailed that the investigating officer need to be bound by law to ensure that only relevant information is extracted and then the devices are timely returned to the owner. The guidelines read that “the investigation officer is bound to ensure the extraction of relevant information and timely return to the owner or handing over safe custody to a court or other authority (where the owner cannot be found) to ensure copies are not accessed by any unauthorised person”.

In case these safeguards are not duly followed, the material obtained will not be used against the accused. The guidelines state “Where these basic precautions have not been maintained, such material will not be used in any court or against any person accused of an offence or in any manner whatsoever,” as per the Newsclick report.

Compelling owners to reveal passwords: The draft guidelines suggest that unless owners of electronic devices find themselves to be bound under statutory provisions like Section 69 of the Information Technology Act, 2000, they should not be compelled to give away their passwords.

“The person whose electronic devices are sought to be searched/seized shall not be compelled to divulge any credentials or passwords or information, including any cloud-stored information except as statutorily prescribed for e.g. Section 69 of the Information Technology Act, 2000 if and when applicable,” the guidelines stated as provided by the report of NewsClick.

In addition to this, it was provided that the laws enabling information from service providers/intermediaries may apply in the circumstances warranted in those laws.

Summons issued: The draft guidelines also specify that no summons should be issued by the police to produce their electronic devices. It read “no person shall be summoned by the police to produce their electronic devices whether as witnesses or accused”, as per the Newsclick report.

Related:

Supreme Court to hear petition on arbitrary seizure of electronics this November

Rules for seizure of electronic devices by Police: A Need of the hour

Raids on Wire editors & seizure of electronic devices did not follow law & procedure: PUCL

Prosecution Cannot Force an Accused to Divulge Password of Electronic Device: CBI Court

Handling of electronic evidence by agencies a perversion of criminal justice: CCG

Revealing the password of your device to the police amounts to self-incrimination?

The post SC orders circulation of draft guidelines on modes for seizure of electronic devices by union & state governments appeared first on SabrangIndia.

The Supreme Court recently imposed costs on the Union Government for failing to file counter-affidavit in a writ petition seeking guidelines for the seizure of personal electronic devices by investigating agencies. The government had filed an affidavit earlier, however, the court was not happy with it and directed that new affidavit be filed as proper reply to the petition.

“We are not satisfied with the counter and we seek a new and proper reply”, bench of Justices SK Kaul and AS Oka had said. The bench said that the court will take on record the new affidavit only after the cost of Rs. 25,000 is deposited with the court. The bench had given the government two weeks’ time to file the new affidavit, which it had failed to file and hence the cost was imposed. The matter will now be heard on December 5.

The petition has been filed by academicians, namely, Ram Ramaswamy (retired JNU Professor), Sujata Patel (Distinguished Professor at Savitribai Phule Pune University), M Madhava Prasad (Professor of Cultural Studies at English and Foreign Languages University, Hyderabad),Mukul Kesavan (Delhi based writer) and Deepak Malghan (theoretical ecological economist).

The petition seeks clear guidelines from the Centre with regards to seizure, examination and preservation of personal digital and electronic devices and their contents thereof and also focuses on right to privacy, right against self-incrimination, protection of privileged communication, integrity of electronic material and the return of copies of seized material to the accused or person under the investigation.

The Supreme Court order may be read here:

Unlawful seizures

In August Delhi Deputy CM Manish Sisodia’s phone and laptop were seized by the CBI while conducting a raid at his residence. Early November, Delhi Police seized 16 electronic devices from the residences and office linked the to the staff of The Wire. In Delhi, searches were carried out on Monday at the portal’s office, and the homes of founding editors Siddharth Varadarajan and MK Venu and deputy editor Jahanvi Sen. In Mumbai, founding editor Siddarth Bhatia’s house was searched.

Hard disks from two computers used by the company’s accounts staff were also seized. The raiding teams reportedly sought, and took, passwords to official and personal email accounts belonging to one or more staffers, and asked some of those raided to disable passcodes from their devices.

In June, when journalist and activist Teesta Setalvad was forcibly taken into custody by the Gujarat ATS, they had also seized her mobile phones at her home and in absence of any legal procedure laid out for the same, these devices were seized by them officers as per their own whims. No panchnama was made for having seized her phones either. Worse, seizing the phones and or other devices without recording the hash value makes these prone to post facto tampering.

What is Hash Value?

While speaking to the media, The Wire editor Vardarajan had stated that the police had not shared the hash value of the devices seized despite insisting upon the same.

To ensure that data has not been tampered with, hashing is used as a mathematical function. It can be thought of as a digital fingerprint of an electronic record. For instance, if one runs a hashing function on “Report”, it could be hashed as R$c. Even a slightest change in the input – “rEport” instead of “Report” – would result in a change in hash. This is a standard technique used in digital forensics to ensure the integrity of digital evidence. Even the slightest activity on the storage device will lead to significant changes in the hash value, reported News Laundry.

Lack of sanctioned legal procedure

Without any clear guidelines in the Criminal procedure Code (CrPC) regarding seizing electronic devices,  the investigating agencies are taking such material from suspects or accused persons in a rather haphazard manner which, in most cases, amounts to violation of one’s right to privacy and most importantly, right against self-incrimination. This point was recently highlighted by a Sessions Court in Delhi which held that revealing password of computer amounted to self-incrimination.

In its July 2018 report, the Committee of Experts on a Data Protection Framework For India stressed on “informed consent” for processing of personal data and recommended, besides a high-powered statutory authority for enforcement, deterrent penalties for wrongful processing of data. Chairman of the committee, Supreme Court Justice (retired) B.N. Srikrishna, told Article 14 that the absence of a law on protecting data privacy opens the gates for police to interpret existing rules on search and seizure.

“Under the CrPC, the police need to obtain a warrant to enter your house or arrest you. The same principle should apply if they’re dealing with data, because data privacy is also a fundamental right under Article 21. It is as sacrosanct as one’s right to life and liberty, both of which are protected under Article 21,” said Justice Srikrishna while speaking to Article 14

As reported by LiveLaw, to aid the government in formulating these guidelines, the petitioners have provided some guidelines for consideration:

1. As far as possible, prior permission or order from a Judicial Magistrate should be attained before opening, examining and seizing digital/electronic devices .
2. In case the seizure is urgent, the reasons for not seeking prior permission or orders should be recorded in writing and served upon the owner of the device
3. In either case, the material or nature of the material sought to be examined or seized, its relevance and link with the offence anticipated or being investigated should be specified with as much clarity as possible
4. The owner of the device should not be compelled to reveal his passwords, and in case of biometric encryption, should not be forced to unlock his devices.
5. At the time of seizure, the hash value should be noted and ideally, a copy of the hard drive should be taken, and not the original, else copy of the hard-drive has to be given to the person whose device it is or to his representative
6. After seizure, the hard disk should be examined in the presence of the person whose device it is or from whom it was seized, as also a neutral computer professional.
7. Material, mails and other data, agreed to by all sides as irrelevant to the crime under investigation, should be removed from the investigator’s copy in the presence of the representative of the accused and the independent professional and a renewed hash value should be recorded in a memo drawing up such proceedings.

Password and self-incrimination

The Delhi district court had held that the accused cannot be compelled to provide any password to his computer as he is protected by Article 20(3) of the Constitution of India as well as Section 161(2) of Cr.P.C.

The court held that Even if there is apprehension that the data revealed after entering the password may be incriminating, the accused has the right to not give such password to the investigating agency as per section 161(2) of CrPC which uses the words “tendency to expose him to a criminal charge or to a penalty or forfeiture.”

Evidence obtained by illegal means can still be used in the court in certain circumstances, hence if after being forced to reveal password, incriminating data is revealed, it will amount to self-incrimination by the accused.

Karnataka High Court ruling

In March 2021, Justice Suraj Govindaraj of the Karnataka High Court while dealing with a petition (Writ Petition no. 11759/2020) laid out certain guidelines for seizure of electronic devices in much detail:

Personal computer/Laptop

1. When carrying out a search of the premises as regards any electronic equipment smart phone or e-mail account the search team to be accompanied by a qualified forensic examiner.
2. when carrying out a search of the premises the investigating officer should not use the computer or attempt to search a computer for evidence. The usage of the computer and/or search should be conducted by a properly authorized and qualified person like a properly qualified forensic examiner
3. At the time of search the place where the computer is stored or kept is to be photographed in such a manner that all the connections of wires including power network etc are captured in such photographs
4. The front and back of the computer and or the laptop while connected to all the peripherals to be taken.
5. A diagram should be prepared showing the manner in which the computer and her laptop is connected.
6. If the computer or laptop is in the power off mode, the same should not be powered on.
7. If the computer is powered on and the screen is blank the mouse could be moved and as and when the image appears on the screen the photograph of the screen to be taken.
8. If the computer is powered on the investigating officer should not power off the computer. As far as possible the investigating officer should secure the services of a computer forensic examiner to download the data available in the volatile memory i.e. RAM since the set data would be lost on the powering down of the computer or laptop.
9. If the computer is switched on and connected to a network the investigating officer to secure the services of a forensic examiner to capture the volatile network data like IP address, actual network connections, network logs etc.
10. The MAC address also to be identified and secured.
11. In the unlikely event of the forensic examiner not available then unplug the computer pack the computer and the wires in separate Faraday covers after labelling them.
12. In case of a laptop, if the removal of the power cord does not shut down the laptop, to locate and remove the battery.
13. If the laptop battery cannot be removed, then shut down the laptop and pack it in a Faraday bag so as to block any communication to the said laptop since most of the laptops nowadays have wireless communication enabled even when the laptop is in standby mode.

Seizure of networked devices

1. To ascertain as to whether the set equipment is connected to any remote storage devices or shared network devices, if so to seize the remote storage devices as also the shared network devices.
2. To seize the wireless access points, routers, modems and any equipment connected to such access points, routers, modems which may sometimes be hidden.
3. To ascertain if any unsecured wireless network can be accessed from the location. If so, identify the same and secure the unsecured wireless devices since the accused might have used the said unsecured wireless devices.
4. To ascertain who is maintaining the network and to identify who is running the network get all the details relating to the operations of the network and role of the equipment to be seized from such network manager.
5. To obtain from the network manager network logs of the machine to be searched and/or seized so as to a certain the access made by the said machine of the network.

Mobile devices (smart phone, tablets)

1. Prevent the device from communicating to network and or receiving any wireless communication either through Wi-Fi or mobile data by packing the same in a Faraday bag.
2. Keep the device charged throughout since if the battery drains out the data available in the volatile memory could be lost.
3. Look for slim slots; remove the SIM card so as to prevent any access to the mobile network back the SIM card separately in a Faraday bag. If the device is in power off mode, the battery could also be removed and kept separately.
4. If the device is powered on, then put it in an airplane mode.

General guidelines

1. In all the cases above the seized equipment should be kept as far as possible in a dust free environment and temperature controlled.
2. While conducting the search the investigating officer to seize any electronic storage devices like CD DVD pen drive hard drive USB etcetera located on the premises label and packed them separately in a Faraday bag.
3. The computer storage media laptop etcetera to be kept away from magnets radio transmitters police radios since they could have an adverse impact on the data and the set devices.
4. To carry out a search of the premises to obtain instruction manuals documentation as also to ascertain if a password is written down somewhere since many a time a person owning equipment would have written the password in a book writing pad or the like at the set location.
5. The entire process and procedure followed to be documented writing from the time of entry of the investigation or search team into the premises until they exit.

The complete judgement may be read here:

Conclusion

Thus, in absence of a set legal framework, electronic devices are being handled and seized haphazardly by investigating agencies, infringing the fundamental rights of an accused person. Further, the Centre’s lackadaisical approach towards the petition that seeks such legal framework show lack of political will and intent to safeguard such rights. The Supreme Court, in imposing a cost, has demonstrated how pertinent it has become for the Centre to file a proper response to the petition; a response that has been pending for over a year.

Related:

Revealing the password of your device to the police amounts to self-incrimination?

Varying Shades of Media Comment: Raids on Wire

Gautam Navlakha’s house arrest: Stringent Conditions Apply

The post Rules for seizure of electronic devices by Police: A Need of the hour appeared first on SabrangIndia.