“With the advancement of information technology, scientific temper in the individual and at the institutional level is to pervade the methods of investigation. With the increasing impact of technology in everyday life and as a result, the production of electronic evidence in cases has become relevant to establish the guilt of the accused or the liability of the defendant.”
– R. Banumathi, J. [Tomaso Bruno & Aanr v State of UP (2015 SC)]
EMERGENCE OF DIGITAL EVIDENCE IN INDIA
One might get the impression that the importance of digital evidence itself is overestimated and that digital evidence is just another type of evidence that police investigators, prosecutors, defence lawyers and judges have to deal with. But is it so? I have a strong belief that it is not. Digital evidence is substantially different than any other type of evidence that the courts and police are used to dealing with.
There are a few reasons for this statement. First, digital evidence is dependent on information and communication technology (ICT). If we look back not that many years into the past, maybe just 15-20 years, we have witnessed the enormous advance of ICT technology and its penetration in everyday life. Every technological advancement means a little bit of different digital evidence.
The proliferation of computers and the influence of information technology on society as a whole, coupled with the ability to store and amass information in digital form have all necessitated amendments in Indian law, to incorporate the provisions on the appreciation of digital evidence.
The Information Technology Act, 2000 and its amendment is based on the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Commerce. The Information Technology (IT) Act 2000, was amended to allow for the admissibility of digital evidence. An amendment to the Indian Evidence Act 1872, the Indian Penal Code 1860 and the Banker’s Book Evidence Act 1891 provides the legislative framework for transactions in the electronic world. Digital evidence or electronic evidence is any probative information stored or transmitted in digital form that a party to a court case may use at trial. Before accepting digital evidence.
It is vital that the determination of its relevance, veracity and authenticity be ascertained by the court and to establish if the fact is hearsay or a copy is preferred to the original. Digital Evidence is “information of probative value that is stored or transmitted in the binary form”. Evidence is not only limited to that found on computers but may also extend to include evidence on digital devices such as telecommunication or electronic multimedia devices.
E-EVIDENCE can be found in e-mails, digital photographs, ATM transaction logs, word processing, documents, instant message histories, files saved from accounting programs, spreadsheets, internet browser histories databases, Contents of computer memory, Computer backups, Computer printouts, Global Positioning System tracks, Logs from a hotel’s electronic door locks, Digital video or audio files. Digital Evidence tends to be more voluminous, more difficult to destroy, easily modified, easily duplicated, potentially more expressive and more readily available.
Computer forensics is a branch of forensic science pertaining to legal evidence found in computers and digital storage mediums. Computer forensics is also known as digital forensics. The goal of computer forensics is to explain the current state of a digital artifact. The term digital artifact can include A computer system storage medium (hard disk or CD-ROM) an electronic document (e.g. an email message or JPEG image) or even a sequence of packets moving over a computer network.
The definition of ‘evidence’ has been amended to include electronic records. The definition of ‘documentary evidence’ has been amended to include all documents, including electronic records produced for inspection by the court. Section 3 of the Evidence Act, 1872 defines evidence as:
“Evidence” – Evidence means and includes not only all statements which the court permits or requires to be made before it by witnesses, in relation to matters of fact under inquiry; such statements are called oral evidence but also all documents including electronic records produced for the inspection of the court. However, documents are called documentary evidence.
LAWS ON DIGITAL EVIDENCE IN INDIA
The term ‘electronic records’ has been given the same meaning as that assigned to it under the IT Act. IT Act provides for “data, record or data generated, image or sound stored, received or sent in an electronic form or microfilm or computer-generated microfiche”. The definition of ‘admission’ (Section 17 of the Evidence Act) has been changed to include a statement in oral, documentary or electronic form which suggests an inference to any fact at issue or of relevance.
Section 22-A has been inserted into Evidence Act, to provide for the relevancy of oral evidence regarding the contents of electronic records. It provides that oral admissions regarding the contents of electronic records are not relevant unless the genuineness of the electronic records produced is in question. The definition of ‘evidence’ has been amended to include electronic records. The definition of ‘documentary evidence’ has been amended to include all documents, including electronic records produced for inspection by the court. New sections 65-A and 65-B are introduced to the Evidence Act, under the Second Schedule to the IT Act.
Section 65-A provides that the contents of electronic records may be proved in accordance with the provisions of Section 65-B. Section 65-B provides that notwithstanding anything contained in the Evidence Act, any information contained in an electronic is deemed to be a document and is admissible in evidence without further proof of the original’s production, provided that the conditions set out in Section 65-B are satisfied.
The honourable court in several cases pronounced judgements that signify the importance of digital evidence. In Amitabh Bagchi Vs. Ena Bagchi (AIR 2005 Cal 11) [Sections 65-A and 65-B of Evidence Act, 1872 were analysed.] The court held that the physical presence of a person in the Court may not be required for purpose of adducing evidence and the same can be done through a medium like video conferencing.
Sections 65-A and 65-B provide provisions for evidence relating to electronic records and the admissibility of electronic records, and that definition of electronic records includes video conferencing. Further in the case of State of Maharashtra vs. Dr Praful B Desai (AIR 2003 SC 2053).In this case, the question involved whether a witness can be examined by means of a video conference.
The Supreme Court observed that video conferencing is an advancement of science and technology which permits seeing, hearing and talking with someone who is not physically present with the same facility and ease as if they were physically present. The legal requirement for the presence of the witness does not mean actual physical presence. The court allowed the examination of a witness through video conferencing and concluded that there is no reason why the examination of a witness by video conferencing should not be an essential part of electronic evidence.
Also with the coming of the relevancy of digital evidence, the term digital forensics has been often heard. Digital forensics is a process often used in criminal investigations. It involves collecting digital evidence from various devices, tools, or infrastructures such as computers, mobile devices, emails, hard discs, and cloud storage systems.
You can’t talk about criminal cases and digital forensics without mentioning the infamous BTK killer case. What remained to be a mystery for more than 30 years was finally solved via digital forensics in the early 2000s. The “BTK Killer,” aka Dennis Rader, tortured and killed at least ten people while he was still loose and undiscovered. He’d taunt the police forces by sending them cryptic messages during his killing sprees, baffling them even more. However, it was this very habit that finally led to his arrest. In 2005, Rader sent the police a Microsoft Word document on a floppy disk. Digital forensics experts were able to trace the metadata contained within the disk, helping unveil the BTK Killer’s true identity. Rader was finally arrested and imprisoned shortly after this. Further, In Larry J. Thomas Vs the State of Indiana, Larry J. Thomas was found guilty of an attempted robbery that resulted in the murder of Rito Llamas-Juarez.
While the case had eyewitnesses who confirmed Thomas’s presence at the crime scene, digital forensics helped strengthen the case even further. During the investigation, the authorities took the content posted on the culprit’s Facebook account under consideration.
They found that he had been using a handle named “Slaughtaboi Larro” and had posted photos of himself carrying an assault rifle. The ammunition used in the murder case matched that of the weapon shown in Thomas’s online images. The photos were also used to match a bracelet found at the crime scene. Thomas had been wearing a similar bracelet in the pictures posted online. Consequently, Thomas was arrested and imprisoned.
RECENT CHALLENGES IN DIGITAL EVIDENCE
Howsoever there are many challenges also in enforceability as well as spreading of awareness in the field of digital evidence like the digital forensic field is enormously wide. As technology advances, it becomes more and more complex. Understanding what is really going on beneath the surface on the level of bits and bytes is very hard, and with time it will be even harder. Under these circumstances, it is a challenge to decide where and how to start the process of education.
One of the main challenges is the lack of good, comprehensive up-to-date educational programs in the digital forensic field. Imagine that developing one good course takes between 6 months and one year of hard work from a few people who are experts in their field. Digital forensics is a hands-on discipline. Digital forensics is a practical discipline, and you need to be able to sit by the computer and do the investigation. You cannot learn it by reading a book, you need to try it and to solve the problems you will encounter that no one can predict in the first place. To have hands-on training, you have to have an evidence file. An evidence file is a forensic image of the real system, for example, a mobile telephone or a PC. But it cannot be just any mobile telephone or PC. Also, there is a lack of digital evidence professionals to do the job. Hence a question comes to mind, Who will design and develop courses? And who will deliver it? The design and development of courses need to be done by digital evidence professionals.
In today’s world, people with such knowledge are extremely busy conducting investigations. They can hardly devote themselves to spending time on such an attractive activity as writing material for courses. Even if you persuade someone to make version 1.0 of some course, maintaining the content of the course and keeping it up-to-date will be a struggle. We have seen courses that have simply disappeared as they have become obsolete. The challenge is about finding experienced instructors to provide the course.
The instructor must be a person with personal experience in digital forensic investigations who can solve tiny but crucial everyday problems, such as finding the right connector, improvising power supplies, finding workarounds for network segments, VLANs, bridges, etc. Digital forensic investigation is never straightforward outside the conditions of the laboratory. There are always situations where knowledge is obtained by experience and that cannot be read from books.
CONCLUSION
As technology changes in upcoming times, The method of digital collection of evidence by law enforcement agencies will also evolve with that. Cybercrime, Cyber fraud, and scam are increasing day by day as digital penetration has been happening in society. Internet and smartphone are becoming more accessible for common people so their vulnerability of being a victim in digital crime become high so the crucial of digital evidence has become more sophisticated.
