Intercepted Mobile Evidence on CD: Infringement of Constitutional Right of Defence

Intercepted communications is one of the crucial evidence collected by the investigation agencies in large number of cases relating to Corruption, Fraud and various other offences of heinous nature. Recently CBI registered the case against the former CBI Director, AP Singh, Moin Qureshi & Others under sections related to criminal conspiracy and Prevention of Corruption Act on the basis of 18 Black Berry Messages intercepted by Income Tax Authorities during an investigation. The hundred of such cases relying upon the intercepted communication some solely relying upon such evidence have been pending either with various investigation agencies or pending trial in the courts.

The interception is done by the investigation agencies through an executive order directing the Mobile/Telephone Service Provider which provides a parallel line to the investigation agencies. The investigations agencies have installed Voice Loggers which automatically record the intercepted calls. The voice logger may be a dedicated hardware device connected with the server or it may be a dedicated device containing the computer itself what we call as ‘Bastion Host’ in Cyber World. These devices have inbuilt ports, the descriptions & numbers of which may vary depending upon the requisition of Investigation agencies. The parallel calls are forwarded to the desired mobile or landline number of investigation agency which may be mobile or landline and the number is integrated in the intercepted device which would be receiving all the calls. The intercepted device receives these calls and automatically record these voice calls and save them into the server at a desired location.

The Voice Logger software provides an interactive Graphic User Interface and functionality which provides the investigation agencies to hear these calls simultaneously or subsequently at any time by logging to the server from a computer from a Local LAN network or in a WAN environment remotely. The logging software also preserve access logs and also provide the embedded notes for their comments by every User who access or hear these voice calls. However, one of the biggest drawback is lack of adherence to the standards for  admissibility, authenticity, veracity and reliability  of the these data  in terms of provision of Indian Evidence Act, 1872 or other procedural laws such as Cr.P.C. or C.P.C.. The gap is due to the fact that priority of the authors of these software codes or company is to provide adequate functionality to perform in a predictable manner with an acceptable level of performance and no compliance of legal standards is done at all. Rather these companies are trying to bridge the gaps/compliances through obscurity by restricting the sale of such software/hardware only to Law Enforcement Agencies. The investigation agencies also do not go into legal compliance of these softwares/hardwares and the opinion of the prosecution branch is hardly sought to check these software/hardware for adherence to legal requirement. Recently acquired Advanced Law Enforcement Monitoring Facilities (LEMF)1 by Delhi Police which combines mobile & Internet network technology also did not comply with the legal standards.

The prosecution agencies in order to meet these gaps are presenting the evidence in such a manner which violates the right of defence of the accused under Article 21 of the Constitution. These methods of compliances through obscurity have big risks & scope of fabrication of evidence and make the accused person remediless.  In such circumstances, the accused, even by preponderance of probabilities, may not be able to rebut such evidence even though it may be forged. As such, the prosecution agencies, being aware about these challenges, intentionally creating the mechanism to circumvent the scrutiny & e-discovery beyond the reach of the court and foreclosing the right of accused to detect any manipulation in the evidence and thus, circumventing the constitutional protection under Article 21which provides that “No person shall be deprived of his life or personal liberty except according to procedure established by law“2.

The Hon’ble High Court of Delhi in the matter of Dharmbir V’s CBI3 has held that the hard-disk of the computer in which the original voice recordings have been preserved, is a document within the meaning of Section 3 of the Evidence Act. The judgment also recognized the right of the accused to get the mirror image of the data comprising of active & subcutaneous memory and court also accepted the importance of valuable information/metadata relevant to the case which can be recovered from the subcutaneous memory or unallocated areas. The proposition does not change even though the investigation agency may say that it is not relying upon the original hard-disk and right of the accused to get the mirror image continue to subsist at the stage of 207 Cr.P.C. as well as during trial. The power to decide the right of the accused to such mirror image is now with the court and not with the prosecution as conferred subsequent to the amendment in the new Code of Criminal Procedure, 1973 which has been recognized by the Courts in the Judgment of Dharmbir4 & Parvinkumar Lalchand Shah5.

The preparation of mirror image involves copying the source media bit-by-bit on the destination media which not only includes the allocated portion but also the unallocated area, slack space, HPA and non-partitioned space. The main difference between the copy and the mirror image is, copy contains allocated area but the mirror image includes allocated, unallocated as well as other portion of the Hard Disk. Thus, the mirror image is the forensic duplication of the Hard Disk in such a manner that all the forensic recovery/ analysis of the data included deleted data which can be made from the original hard disk can also be made from the mirror image, the fact which have been recognized by the Hon’ble High Court of Delhi in the matter of Dharambir Vs CBI (Supra). 

Further, through the analysis of mirror image, the timeline of the data, access logs, built in security mechanism to protect the sanctity of data can only be find out.  Thus, if the accused get the mirror image of the hard-disk on which the original calls were recorded during interception, the accused can analyze the unallocated portion and find out the manipulations, insertions, modifications if any, which otherwise is not possible  as such analysis cannot be done of voice calls which are copied and supplied in a Compact Disc(CD).

Section 65B only permits the non production of original at the stage of admissibility but it does not deal with the proving of genuineness, authenticity of the data which may require the production of the original. The exemption to produce the original is granted under section 65B for the admissibility6 only but still for proving the authenticity, veracity of the evidence and making it reliable for the court to conclude such evidence as proved may require the original to be produced. The electronic record can easily be manipulated, forged and hence the production of the original may not only be required to prove its authenticity but also to provide the appropriate opportunity to the accused to challenge its veracity, if it is so manipulated.

Startlingly, the prosecution not only denies the mirror image but allows the original to be destroyed to  defeat the constitutional right of defense enshrined under Article 21 of the Constitution but in most of these cases, prosecution even does not provide the  description/configuration of computer, software used, authenticity of the software, technology used and whether such technology/ process complies with the principle governing acceptance of expert evidence i.e. Daubert Principle which was upheld by Hon’ble High Court of Delhi in the matter of State vs Patrick7[MANU/DE/2075/2014]  and by Supreme Court in the matter of Selvi & Ors.8  

Further, the complete dominion of the prosecution over all the stages of chain of custody i.e. collection, preservation, analysis and presentation coupled with suo moto proceedings by the prosecution agency itself poses great risk of malicious prosecution without any opportunity to rebut the allegations based on such electronic evidence. The risk is further aggravated due to failure of prosecution even  to get computer forensic examination  which ultimately takes away the genuineness of data and  the suppression of original data itself draw adverse presumption of  manipulation on part of prosecution, if the accused raises such plea.

The mere auditory inspection of the voice calls even in original hard-disks cannot reveal the manipulations, fabrications or modifications in such data and no such process exist in the forensic world to determine interpolations or manipulations through inspection. In case of fabrication or interpolation, files in the CD or in the original hard disk would appear one and same as the evidence relating to the manipulation can be located in the unallocated space which is only possible by the computer forensic analysis of mirror image. Even upon fabrication and manipulation, the metadata of the files can be easily restored with the various programs available in the market to show that the original files are intact. However, the forensic analysis done at the binary level coupled with the analysis of unallocated space, these manipulations can only be unearthed. The voice examination which is mainly by manual inspection of Spectrograph chart is not a substitute for computer forensic examination as it is highly subjective and unreliable.

The mere fact that the prosecution has not produced it, does not take away the right of the applicant accused to seek its mirror image and get the same forensically analyzed for proving his defence. The original hard disks are also not been forensically examined for computer forensics and as such there is no material to prove authenticity or genuineness of the voice calls relied upon by the prosecution. These calls, being electronic record, can be modified, altered, subject to insertion by the single click and in absence of mirror image, the applicant accused cannot bring these manipulation before the court in his defense. Even the availability of any software in the mirror image which can be used for modification/manipulation can be of great significance to the defense to prove the unreliability of data.

The prosecution record the voice call data on the hard-disk and then does not preserve this original hard-disk for further recording allowing this original hard-disk to be overwritten in the due course and consequently the original voice calls to be obliterated and foreclosing all the means to detect the integrity of evidence. In a number of cases involving tape recording, various judgments have required the prosecution to seal the tape recording cassettes immediately upon seizure to preserve its sanctity and there is no reason as to why the prosecution does not preserve and seal these hard-disk to protect the integrity of data for perusal of court. For maintaining the authenticity of evidence, the prosecution agency has no immunity and rather it has higher obligation to maintain the sanctity of the evidence particularly when the collection, preservation, analysis and presentation, all components of chain of custody are in control of the prosecution and the proceedings are also initiated suo moto by the prosecution.

The fallout of proposition of law in Dharambir case (supra), it is duty of the prosecution to create a system by which such voice recording can be originally preserved on separate media which is technically feasible so that it can be subject to the court’s scrutiny and protection of the right of accused. By not putting the mechanism enabling the segregation of data, the prosecution agency is suppressing  the mechanism to  the scrutiny & e-discovery  of crucial evidence beyond the reach of the court and foreclosing the right of accused to the right of defence. It is the fiduciary duty of the prosecution towards the court to maintain the sanctity, integrity and chain of custody of the electronic evidence and in case of failure, the court can not only draw adverse inference but can proceed against the concerned officer for manipulation of the evidence violating the fundamental right of the accused as enshrined in Article 21 of the Constitution of India.

In the case of Dharmbir Supra,  the  right of the accused to have  mirror image of the hard-disk containing voice calls was recognized however, one of the main reason of denial was owing to the fact that hard-disk contains the voice calls of other intercepted communication, the privacy of other persons may be compromised if the prosecution provides the mirror image. However, the defence of prosecution as to privacy of other persons against grant of mirror image has now being made as weapon of offence in every case for countenance to the claim of the accused to get the mirror image of the original hard-disk. Once, the right of the accused to mirror image has been established by the court, it was incumbent on the investigation agencies to create a system by which such voice recording can be originally preserved on separate media which is technically feasible so that it can be subject to the court’s scrutiny and protection of the right of accused.

Technology has much advance now, particularly after the case of Dharambir (supra) and the files belonging to any other person can be securely deleted to protect the privacy and mirror image containing original files pertaining to accused along with unallocated space can be given to the accused for forensic analysis. The mirror image of the original hard disk can be prepared and from the mirror image so prepared, the data belonging to third party can be securely deleted in the presence of counsel of applicant accused. The residual data containing original files and unallocated space would be relevant for the applicant accused for forensic analysis. The concept of ‘Secure/Target Deletion’ makes it possible to delete a certain portion of the hard disk in such a manner that it is forensically not possible to recover such data9.

Surprisingly the investigating agencies like CBI, ED, Anti-Corruption Braches, Cyber Cells which are known for their expertise into investigation are resorting to such irrational procedures which are contrary to the principle of natural justice and in breach of basic concept of equality before law enshrined in the Constitution. The ED has even gone a step ahead to skew the procedure in their favour and curtailing the right of accused and integrity of procedures by conducting the in-house forensic through the executive within the same organisation. In case of any manipulation, the accused will find impossible to prove its innocence but even it would be difficult for the court to arrive at a logical conclusion to ruled out that the record have not been tampered and are as originally existed, one of the primary requirement for authenticity of electronic evidence as observed by Delhi High Court in the matter of Kundan Singh vs State10.

Technology changing so fast that it is not only outdating the procedures but also the law. The emerging SSD hard-disks have made all the procedures and legal provisions relating to the hash value as redundant but still the forensic & legal communities have to find the alternative solution to tackle these emerging challenges. The new challenges of the technology making it difficult to apply the old laws to the new technology but there are certain new challenges which requires defining new concept and to evolve procedures/law feasible for such situation. The requisite procedural aspects and legal concept to be evolved may altogether be new as the centuries old concept may not be feasible to apply to these unique issues. The suppression of technology or using the concept of complying the existing method of proving the evidence through obscurity is not a solution   but involve an inherent risk of misuse contrary to the basic concept of criminal jurisprudence of equality for prosecution and defence. The attempt to create disbalance among the right of prosecution and defence to incorporate these technological challenges is in fact a failure of the constitutional machinery and would have disastrous implications on the society which would later be hard to rectify.

Thus, in order for the accused to properly defend, the accused deserve to have mirror image of the original hard-disk so that the accused would have equal opportunity to get it forensically examined and rebut the case of prosecution for any manipulation or fabrication. The prosecution also to prove the authenticity or any challenge to the veracity of the content, must submit the original hard-disk to the court to satisfy the Integrity Test laid down by Delhi High Court in the judgement of Kishan Tripathi11.

References:

1. Advanced Law Enforcement monitoring facilities (LEMF), http://timesofindia.indiatimes.com/city/delhi/delhi-police-planning-tectonic-shift-in-phone-tapping/articleshow/57036341.cms
2. Article 21, Constitution of India
3. Dharmbir V’s CBI, [148(2008)DLT289]
4. Dharmbir V’s CBI, [148(2008)DLT289]
5. Parvinkumar Lalchand Shah, [1981 GLH 373(1982)1GLR116]
6. Anvar P.V. Vs P.K. Basheer, [MANU/SC/0834/2014]
7. State vs Patrick [MANU/DE/2075/2014], 2014(4JCC [Narcotics])
8. Selvi & Ors. [MANU/SC/0325/2010]
9. http://www.secure-eraser.com/
10. Kundan Singh vs State [MANU/DE/3674/2015]
11. Kishan Tripathi Vs. The State [MANU/DE/0434/2016]

Read Full Article at: http://www.neerajaarora.com/intercepted-mobile-evidence-on-cd-infringement-of-constitutional-right-of-defence/