BNS 2023 Cyber Provisions and BSA 2023 Electronic Evidence

Cyber conduct may engage general offences as well as computer-specific law. A medium such as WhatsApp does not decide the charge, and several provisions can require different intent, victim or conduct elements.

Section 354 is not defamation and section 197 is not a general “mob lynching” provision. Do not use a remembered old/new number without checking the actual text.

For a purported forged screenshot, investigate the representation, alterations, source, alleged purpose and reliance. An edited image is not automatically proof that all forgery provisions apply.

For stalking or threats, preserve the full sequence and context. A short extract can conceal replies, blocking attempts, dates or a legitimate explanation relevant to legal assessment.

The IT Act and BNS address overlapping but distinct questions. Do not mechanically pair one provision from each statute for every digital event.

A fraudulent impersonation can raise different questions from unauthorised access, intimidation or extortion. Similar payment loss does not make every case cheating, identity theft and cyber terrorism simultaneously.

Collection powers belong to the procedural framework, including the BNSS where applicable. BNSS section 94 concerns production and section 105 concerns audio-video recording of search/seizure; neither should be mislabelled using the older CrPC section number.

Record the authority and scope separately from the technical method. A lawful production route does not by itself establish the returned record’s completeness, attribution or truth.

Keep offence selection and court procedure with the appropriate legal decision-maker. The examiner should explain what was observed, the method and limitations without presenting a technical artefact as a concluded offence.

BSA section 63 must be read with its conditions and Schedule. It is not adequately described as unchanged section 65B plus one senior analyst’s signature.

The prescribed Schedule has Part A for the party and Part B for the expert, source/device particulars and hash-report requirements. Use the actual form and competent signatories, with appropriate current legal review.

Prepare a source-to-exhibit inventory: identify each record, acquisition/export, original package, derived exhibit, hash algorithm and value. Distinguish what the source custodian knows from what an examiner can establish independently.

Do not attest regular source operation, complete account history or a provider’s internal systems merely because an analyst received an export. Identify the relevant knowledge, records and unresolved matters.

A certificate supports a specified evidentiary process. It does not repair an undocumented transformation, prove a clock accurate, identify a human operator or make an incomplete return complete.

Keep preparation dates truthful. Do not backdate a certificate or invent a categorical outcome for every defect or later filing; questions of compliance and remedy require the actual law and court’s assessment.

Older judgments interpret the former Evidence Act, not the later BSA word for word. They remain important background, but the current statute and applicable transition must be assessed.

Anvar P V v P K Basheer (2014)

Anvar P.V. clarified the former section 65B route for secondary electronic evidence and rejected substituting general secondary-evidence rules for its requirements.

Shafhi Mohammad v State of HP (2018)

Shafhi Mohammad’s relaxation based on lack of possession of the device was subsequently overruled. Do not cite that relaxation as the settled current position.

Arjun Panditrao Khotkar v Kailash Kushanrao Gorantyal (2020)

Arjun Panditrao reaffirmed the certificate requirement under section 65B, discussed obtaining third-party certificates through court assistance, and addressed original-device and timing questions. “Any later certificate is always fatal” overstates the judgment.

These cases predate the BSA’s prescribed Schedule. A report should identify which regime applies and distinguish the actual holding from an analogy to the newer law.

The BSA’s savings provision addresses specified matters pending immediately before commencement. Do not decide the evidence regime solely from when a website page was written or when a prosecutor filed a later document.

Integrity checks require a defined byte scope. Hashing an E01 container, its decoded media stream and an exported file produces values for different representations; unequal hashes are not automatically a failed acquisition.

For a static readable source, compare equivalent acquired data using a documented method. With live sources, unreadable sectors or changing remote records, record the collection limits and what verification actually tested.

A mismatch over the same expected stable bytes requires investigation. Check scope, errors, source changes, storage, tools and logs. Preserve the initial outputs and findings; reacquisition may help but is not always possible or automatically the only proper response.

Use validated write protection where appropriate for the device and method. Live memory, remote APIs and some mobile methods do not fit a generic hardware-write-blocker workflow. Explain unavoidable interactions and their likely effects.

Preserve original packages and derive working copies with a documented transformation history. A cryptographic digest supports comparison; custody documentation explains provenance and access. Neither alone proves every asserted event.

The technical collection workflow is covered in Digital First Response; apply it to the actual source rather than forcing every case into a disk-imaging template.

Expert reporting should make the basis of an opinion reviewable: relevant qualifications, task, material received, method, validation, results, uncertainty and limitations. A list of certificates does not establish competence for every technique.

Explain the distinction between observation and inference. An artefact can support attribution when corroborated, but an account, IP or username alone does not prove who acted. Do not impose the opposite absolute that an expert can never discuss attribution.

Hypothetical Indian example: an examiner receives a server export, collection log and certificate materials. They inventory the package, verify comparable bytes, inspect timestamp definitions and explain missing fields before forming an opinion.

The report states whether relevant source-operation information came from the custodian and whether a derived exhibit changes format or content. Legal compliance and weight remain for the competent decision-maker; no court outcome is assumed.

When questioned, answer accurately within expertise, clarify assumptions and acknowledge limits. Do not turn generic witness advice into a rule to withhold a necessary correction or refuse every question outside the written report.

For proceedings in another country, check the applicable evidence rules and collection authority. The same technical record may have different requirements for production, authentication and expert testimony.