Rules On Seizures Of Laptops, Phones A ‘Grey Zone’, Experts Say Amid NewsClick Raids

The recent seizures of mobiles and laptops of journalists of NewsClick during searches by Delhi Police, after similar action in some more cases in the recent past, has sparked a discussion on the law governing electronic evidence. There appears to be a lacuna in the law regarding guidelines for search and confiscation of personal digital devices.
 
Earlier this month, the Special Cell of Delhi Police raided 50 locations, including homes and offices of several journalists of NewsClick, in connection with a case registered under anti-terror law UAPA over allegations that the news portal received money to spread pro-China propaganda. NewsClick founder Prabir Purkayastha and the HR head of the company were also arrested and sent to judicial custody. In a statement, NewsClick rejected all allegations and said due process was not followed in the seizure of electronic devices and documents. 

Recently, over a dozen media bodies sought to draw the attention of the Supreme Court on this matter and wrote to Chief Justice of India DY Chandrachud on the need to frame norms for the interrogation of journalists and seizures from them. The journalists said guidelines were needed to ensure that such raids were not “undertaken as fishing expeditions with no bearing to an actual offence”.

While there are no clear rules with regards to digital evidence, here is what the law says on the seizure of personal devices:

CrPC chapter VII contains provisions related to production of documents and other laws related to search and seizure by investigating agencies. Section 91 of the CrPC empowers the court to compel the production of “documents or any things” that are necessary to carry out investigation, inquiry or proceedings.

Typically, prior sanction of a court is required before a search can be carried out by agencies. Thus, police or any investigative agency seem to have almost unchecked power to demand production of electronic devices like a phone or laptop from an accused.

However, the police are required to generate a “hash” or an unique numerical value after seizing a phone or laptop so as to make sure that the data is not tampered with during police custody.

As per the rules, when a phone or laptop is seized during searches or raids, police have to clone the data and generate a hash or numerical value. This is done to ensure integrity of the device and the data is not tampered with. For example, if anything is deleted or added to the device, the hash value changes, indicating that the seized device has been tampered with.

This cloned data can then be used as evidence by the police in their investigation.

READ | ‘Not A Penny Came From China, Case Is Bogus’: NewsClick Founder Tells Delhi HC

‘Process Of Seizure Of Laptops, Phones A Grey Zone’

The legal experts ABP Live spoke to said the process of seizure of phones and laptops was a “grey zone” in India and it becomes more flexible for the prosecution to go and collect electronic evidence in any haphazard manner as they feel necessary.

Speaking to ABP Live, Supreme Court advocate and cyber law expert Pavan Duggal said there were no standardised procedures on how electronic evidence could be seized and preserved.

“Right now, the law pertaining to electronic evidence is pretty much a grey zone. The law has developed on the ground of how electronic evidence can be produced and made admissible. But there are no guidelines on how electronic evidence has to be picked up and preserved. When the electronic evidence comes in a court of law, it is the onus upon the prosecution to prove that the evidence has not been tampered, altered or manipulated with,” Duggal said.

He said the only law that guides us is the case of Arjun Panditrao Khotkar vs Kailash Kushanrao Gorantyal where the Supreme Court had said how electronic evidence has to be produced and proved but did not talk about how it has to be collected. “The top court had asked the government to come up with appropriate rules but it is yet to be framed despite the ruling coming two years earlier,” Duggal said.

Senior Bombay High Court advocate Ajay Panicker highlighted that in the landmark KS Puttaswamy case, the Right to Privacy was held a fundamental right protected under Article 21 and thus, when we talk about seizure of electronic devices, it is a “matter of personal contents under a state of incarceration”.

“In the digital era, electronic devices hold a plethora of private and sensitive data. With the recognition of the Right to Privacy as a fundamental right, the seizure of electronic devices must be conducted in a manner that upholds this right. The absence of specific guidelines or laws may lead to inconsistent practices and interpretations,” Panicker told ABP Live.

Technology lawyer Mishi Choudhary said India was far behind any modern democracy in lasting out rules on search or seizure of devices. “Forcing a person to share their passwords goes against the right to self-incrimination as provided under Article 20 of the Constitution. But police and courts have been liberally following practices of their own. The current law is unclear and very wide in favor of police powers,” Choudhary told ABP Live.

So, What Can Be Done To Protect Digital Privacy?

The matter pertaining to guidelines on seizure, examination and preservation of gadgets has reached the court several times.

In 2022, the Supreme Court, frowning upon the Centre’s plea to dismiss a PIL seeking a set of rules for confiscation of gadgets, said electronic devices seized by investigating agencies “have personal contents and we have to protect this”.

The Karnataka High Court in 2021 had issued detailed interim guidelines for investigating officers when dealing with smartphones, electronic equipment, or email accounts during investigations. The HC mandated the presence of a qualified forensic examiner during searches involving electronic devices. The search must be documented with photographs, including all cable connections, and a diagram illustrating the device connections.

The guidelines further stated that if a computer was turned on with a blank screen, photographs should be taken when the screen displayed an image. Additionally, the MAC address (a 12-character alphanumeric attribute to identify individual electronic devices on a network) must be identified and secured. Moreover, it stated that in the absence of a forensic examiner, the computer and cables should be unplugged, labeled, and placed in separate faraday covers.

Experts said India should establish or revise its legal framework to provide clear guidelines for the seizure of electronic devices. According to Panicker, this framework should respect the Right to Privacy and ensure that all seizures are carried out in compliance with the law.

The Bombay HC advocate also suggested that law enforcement agencies should undergo comprehensive training to effectively manage electronic evidence.

“Maintaining a secure chain of custody is essential. This entails documenting all individuals who had control of the device to safeguard the evidence’s integrity. Promote the involvement of digital forensics experts and tools for electronic device handling. This will enhance data integrity and facilitates data recovery when needed,” he added.