Pulkit Goyal
In October 2023, the electronic devices, such as phones, tablets, and laptops, of multiple journalists affiliated with the online news portal ‘newsclick’ were seized. The safeguards concerning seizure such as providing a seizure memo or generation of hash values (electronic fingerprints of records which speak to a record’s integrity) were not followed through. Pursuant to this, prominent journalists authored a letter addressed to the Chief Justice of India asking for urgent action and guidelines against abuse of investigative powers of the police. A case captioned Ram Ramaswamy v Union of India is pending before the Supreme Court urging the Court to pass guidelines regulating seizure of electronic devices. This raises an important question: can the state coerce individuals to unlock their devices or is the same prohibited by the constitutional guarantee against self-incrimination? A second question raised is what exactly can be attributed to an accused who unlocks a device, i.e., can an accused be attributed with the knowledge of all the contents of a device to which the accused knows the password?
The first question has seen some litigation in the High Courts and District Courts of the country. On 29 January 2022, the Kerala High Court approved, as a condition for bail, that the person accused provide complete access to the investigating agency to his mobile phones. This judgment in turn depended on a 2021 Karnataka High Court judgment which compelled an accused person to cooperate with an investigation against him by unlocking his phone. However, on 29 October 2022, a Delhi CBI Special Court refused to pass an order compelling an accused person to unlock their phone.
The principal issue that arose in these judgments, apart from that of privacy, was that of the protection against self-incrimination. Can the police force an accused to unlock electronic devices and deliver digital evidence? All three judgments have referred to the same set of precedents, Selvi and Oghad, to justify the two different outcomes that they reach.
As Sekhri explains, the police enjoy wide investigating power under the Code of Criminal Procedure, 1973 (“CrPC’). Specifically, under section 91 the police are empowered to issue summons to any person for the production of documents or anything that the police considered necessary or desirable for the investigation. If it is suspected that a person will not comply with a summon under section 91 CrPC, the court is empowered to issue a search-warrant under section 94 CrPC. A warrant under section 94 CrPC can also be issued where it is not clear whether the item, being searched for, is in the possession of the concerned person or not or where “the purposes of any inquiry, trial or other proceeding under this Code will be served by a general search or inspection”
Further, section 165 CrPC empowers the police to enter any place and conduct a warrantless search for investigation in order to avoid undue delay. It seems uncontroversial, then, whether in the exercise of their powers, the police can seize electronic devices if they consider it necessary for investigation. However, given the above contradictory judgments, it is unclear whether the police can compel an accused to unlock their electronic devices. This article argues that compelling accused persons to unlock their devices violates their constitutional guarantee against self-incrimination.
Before beginning with the above two inquiries, it will be useful to provide a small account of the two principal ways of unlocking devices. Devices are unlocked either by the use of a password or a biometric measure. Passwords are referred to by various names such as passcodes, pins, etc. They all involve a sequence of alphabets, numbers, special characters, or any combination of them which when entered unlocks a device and allows a user to access its contents. Biometrics on the other hand involve some physical measures such as fingerprints, retinal and face-scans, which are compared against stored biometric data to unlock devices. Most devices do not allow users to just have a biometric lock and require a password along with a biometric key. The password, and not the biometric key, is required to be entered on numerous occasions such as when the device is rebooted, updated, etc. In essence, a biometric rarely functions without a password.
The next section of the article outlines the law and how it has been (mis)applied in cases of passwords and biometrics by the Kerala and Karnataka High Courts and forwards the view adopted by the CBI Delhi Special Court with some reservations and modifications. The third section discusses the extent of the right against self-incrimination that is available with respect to digital devices. The fourth section discusses the evidentiary significance of unlocking a device under section 27 of the Evidence Act.
Law and its (mis)applications
The right against self-incrimination is present in Article 20(3) of the Constitution. It protects an accused from being compelled to be a witness against themselves. Sections 25 and 26 of the Indian Evidence Act (“the Act”) operationalise this right and render inadmissible, confessions made to police officers or confessions made in police custody respectively. Section 27 of the Act renders statements made by an accused to the police admissible in case a fact is discovered as a consequence of the information provided, i.e., the statement leads to the discovery of a fact. This provides a narrow exception to the general principles provided in sections 25 and 26 of the Act
It is worth mentioning, for the accurate exposition of the law, strictly speaking, section 27 does not act as an exception to the right against self-incrimination present in the Constitution. In Oghad, a 11-judge bench of the Supreme Court specifically held that, to read section 27 in a manner such that the provision is constitutional, if the original statement is compelled then it will be inadmissible under section 27 also. [How this is operationalised is a different story and outside the purview of this article]
In analyzing the contours of the right, it will be helpful to reproduce the article here:
Article 20
****
(3) No person accused of any offence shall be compelled to be a witness against himself.
The critical phrase for interpretation in this provision is “to be a witness”. The Supreme Court has interpreted the phrase to mean giving testimony which requires communicating something in personal knowledge. Testimony need not be oral but even actions, including involuntary stimuli, which communicate something in the personal knowledge of the person amount to testimony. So, in Selvi, a 3-judge bench of the Supreme Court held polygraph tests, which rely on taking physical measurements and interpreting them to figure out whether a person is lying were, amount to testimony and were prohibited under article 20(3). This can be contrasted with the taking of thumbprints for the purposes of comparison, which was held to be excluded from the protection of Article 20(3) in Oghad. A qualifier to “be a witness” is it should be against the person themselves, i.e., it should be self-incriminatory. It can be incriminatory directly or even derivatively by providing a link in the chain of evidence.
Importantly, as Selvi holds, this protection is available not only at the stage of trial but even at the stage of investigation. So, evidence cannot be compelled from an accused at the stage of investigation even if it is then excluded at the stage of trial. Compulsion was defined in Oghad to mean:
“a physical objective act and not the state of mind of the person making the statement, except where the mind has been so conditioned by some extraneous process as to render the making of the statement involuntary and, therefore extorted.”(emphasis supplied)
The crux of the matter lies in the involuntary nature of statements made. Further, the extension of the right to the stage of investigation also relates to the prohibition of the derivative use of compelled testimony as well. Testimony is said to be used derivatively when it leads to inculpatory evidence but is not in itself inculpatory, i.e., it provides a link in the chain of evidence. Lastly, even though the prohibition is on inculpatory testimony, at the stage of investigation it is for the person providing the testimony to decide whether it is inculpatory or not because a judicial determination can happen only post facto and post facto determination would render the guarantee meaningless. In Selvi, the court held “[I]t is for the person being examined to decide whether the answer to a particular question will eventually prove to be inculpatory or exculpatory. Furthermore, it is also likely that the information or materials collected at an earlier stage of investigation can prove to be inculpatory in due course.”
The question essentially before the Kerala and Karnataka High Court was whether handing over a password was analogous to communicating something in personal knowledge or to providing physical measurements for the purposes of comparison. The Karnataka High Court held (positively cited later by the Kerala High Court):
“Would providing a password, passcode or Biometrics amount to self-incrimination or testimonial compulsion?
14.1. As regards the contention that providing of the password/pass code will amount to testimonial compulsion, I am of the considered opinion that there is no testimony which is given by the accused by providing the said password, passcode or biometrics by which the document is being accessed by the Investigating officer.
14.2. The XI Judge Bench of the Apex Court in Kathi Kalu Oghad’s case has categorically held that providing of a thumb impression or impression of the palm or foot or fingers or specimen in writing or exposing a part of the body of an accused person for the purpose of identification would not amount to testimonial compulsion. Mere providing of an access of to smartphone or e-mail account would not amount to being a witness, the information that is accessed by the Investigating officer on the smartphone and or the e-mail account being only access to the data and/or documents, it is for the Investigating officer to prove and establish the same in a Court of Law by following the applicable Rules of evidence.”
***
14.5. A direction to provide a password, passcode, biometrics would not amount to testimonial compulsion. It is only in the nature of a direction to produce a document. Mere providing access to a smartphone or e-mail account would not amount to self- incrimination since it is for the investigating agency to prove its allegation by cogent material evidence.
Importantly, the Karnataka High Court also laid down guidelines to be followed to ensure preservation and proper handling of data present on a device. This included requiring professionals from forensic labs and not police officers to handle the device, keeping the device running to ensure Random Access Memory is not erased, making a note of the networks the device was connected to etc.
While the judgment also recognized the privacy interests inherent in dealing with electronic devices such as phone, the guidelines did not reflect it. There was no requirement laid down for narrowly tailored searches or search-warrants which specifically identifies the digital devices and digital objects being searched for in order to protect the privacy of the accused. As Krishankumar has noted “where data is concerned, there is a higher likelihood that a non-particularised or vague order would result in the collection of exponentially more information than a similar order applied in the physical domain.” Further it contained no guidelines for noting down the hash values of the evidence secured to ensure that it is not tampered with or providing the accused with the hash values to enable them to potentially challenge any evidence that is recovered from the device. Both of these requirements are recognized best practices for digital evidence. (For privacy law implications of digital evidence see here)
Further, the reasoning of the Court, as it emerges from the extracts, is flawed on three accounts. First, after noting that body measurements are not protected under Art 20(3), it equates passwords with body measurements and states that protection is not to be granted. This line of reasoning does not note, as Bhatia has argued, that body measurements were excluded only for the purposes of comparison and not as a whole. In fact, in the case of polygraph and BEAP (Brain Electrical Application Profile) tests, bodily measurements or physiological responses such as heart rate, blood pressure, perspiration, etc., which communicated something in the personal knowledge of the person were held to be protected under Article 20(3). Second, the logic that evidence gathered would have to be proved in a court as per rules of evidence misses the point that the guarantee applies at the stage of investigation as well and not just at trial. Third, as held in Oghad and reitterated by a 5-judge bench in State of Gujarat v. Shyamlal Mohanlal Choksi, the guarantee against testimonial compulsion extends to production of documents as well. [Sekhri notes this here as well]
Noting the first flaw the Delhi CBI Special Court (Rouse Avenue) held that passwords are protected under Article 20(3) and refused to pass an order compelling an accused person from handing over passwords. Interestingly however, in light of the Criminal Procedure (Identification) Act 2022, the Special Court held that body measurements must be distinguished from testimonial acts and the former would not be protected by Article 20(3), therefore fingerprints used to unlock a phone or other electronic device would not be protected under Article 20(3). However, since this was not directly a question before the court, the court did not pass any order as to this.
This line of reasoning puts the cart before the horse as a parliamentary law cannot make taking of thumbprints to unlock phones constitutional if taking of thumbprints to unlock phones itself violates Article 20(3). Further, given that the Criminal Procedure (Identification) Act 2022 is broadly phrased as it mandates taking of measurement for the “purpose of investigation”. There is ample scope for interpretation and it must be interpreted in a constitutional manner, i.e., as this article argues, excluding taking of thumbprints to unlock a device.
The test should’ve been, in line with Selvi: whether the act is communicative and not just for the purposes of identification. In fact, the Court, in Selvi, relying on the SCOTUS decision in Schmerber v California, recognised that the distinction between physical evidence and testimonial evidence, though useful, may break down and cannot unproblematically be applied to each fact situation before the court. The Court in Selvi thus stressed on the consequences of the compelled activity to determine whether acts are testimonial or not. As Sekhri notes the court here is essentially applying the American standard of functional equivalence. The CBI Special Court has been criticized for ignoring this standard in its judgment. Thus, the test remains essentially whether the evidence communicates something within the personal knowledge of the person or not.
Application to Passwords and Biometrics
Giving a password vocally or in writing amounts to communicating something in the personal knowledge of the person giving the password. This can be contradistinguished from material evidence which involve bodily substances or physical objects. The real trouble starts when we consider biometrics. The article argues that biometrics used for unlocking devices are testimonial in nature and not mere physical evidence. Biometrics here perform the same function as passwords which, as has been argued above, are testimonial in nature. In fact, most phones do not allow biometrics to be the sole mode to open a device and require it to be coupled with a password which can be used alternatively (and in certain situations mandatorily). To borrow from American jurisprudence on the subject, biometrics here are functionally equivalent to passwords. As observed in Selvi, the SC has used a function or purpose-based test for deciding whether a piece of evidence is protected by Article 20(3) or not.
Secondly, and independently, unlocking a phone with biometrics communicates, perhaps even more strongly than in the case of passwords, that the person stands in some connection with the device. A biometric lock will only open if it previously had stored information about the biometric used. This necessarily implies that the person at some point fed their biometric into the device and thus communicates that the person stands in some relationship with the device.
Lastly, opening such a device can be incriminating especially in light of the position that the guarantee against self-incrimination extends to derivative use of evidence as well. Opening a device can give the investigating agencies access to material which is incriminatory. Even when the police know that the device contains incriminatory material, opening it places the accused in some connection with the device and is directly incriminating in such scenarios.
From the above arguments, it is concluded that unlocking devices should be protected under Article 20(3) since it is a testimonial and incriminating piece of evidence. Further, it also is in line with the purpose of the right against self-incrimination. It ensures reliable evidence and deters the police from coercing accused persons into giving evidence and encourages independent and reliable methods of investigation. The next part discusses the extent of this protection in light of section 27 which allows information given to the police, by an accused, to be treated as admissible evidence in case it leads to a subsequent discovery of fact.
Digital Evidence and Section 27
Section 27 makes information given to the police admissible to the extent that the information relates to facts discovered as a consequence of that information. The fact discovered in consequence is the knowledge of the person of the state of affairs and not the thing discovered in consequence of the information, as was held in Pulukari Kottaya. E.g., if an accused says “I have hidden a knife under a particular tree with which I killed the deceased” and the police go and discover the knife, the fact discovered here is not the knife but the knowledge of the accused that there was a knife hidden under a particular tree. This is what is made admissible under section 27.
So, the extent section 27 allows inferences to be made is dependent on what exactly is communicated by the accused. When an accused opens a device, they communicate either (1) that they stand in some connection to the device or (2) that they stand in connection to the device and its contents. There are two reasons to prefer (1) over (2).
First, as the case of Rona Wilson, an accused in the Elgar Parishad case, demonstrates electronic evidence is not inherently reliable. Thirty two months after Rona Wilson’s arrest, an independent digital forensics science investigation of the accused’s (Wilson’s) laptop by the American forensic expert firm Arsenal Consultancy in the Elgar Parishad case concluded that the accused’s laptop had been compromised over 22 months before his arrest. The report states that a malware in the nature of a remote access trojan was installed on Mr Wilson’s laptop. This malware connected it to a command-and-control server using a virtual private server. This was used to deliver incriminating evidence to the accused’s laptop into a hidden folder. The report further states that there is no evidence to show that any of these incriminating files were ever legitimately opened or used by the accused. Therefore, inference (2) is not necessarily true whereas inference (1) suffers from no such anomaly.
Second, in India especially, people share devices frequently among family members. So, it would be artificial to draw an inference in the nature of (2). Therefore, based on these reasons, a person who unlocks a device only communicates (1) and not (2). Therefore, in line with section 27, if the accused unlocks a device for the police by communicating their password or through biometrics, the fact discovered is the knowledge of the accused of how to unlock the device.
Regardless of the statement being made, the contents discovered on the device will be admissible evidence, except where the device was unlocked using coercive methods. Where coercion is used to unlock the device, any derivative evidence found is also rendered inadmissible as per the ratio in Oghad and Selvi. Section 27, here, only decides what inference can be drawn from unlocking a device and discovery of objectionable material. Thus, the prosecution will still have to prove what is the position of the accused vis a vis the objectionable material.
Conclusion
It is concluded that unlocking a device, regardless of the method (password or biometrics) is a testimonial act. While giving a password is directly testimonial, opening devices using biometrics also communicates something about the connection between the device and the person and is thus testimonial in nature. Further, unlocking a device can be incriminating either directly or derivatively. In either case, as per the ratio in Selvi, it is for the accused to decide whether what is being communicated during investigation is incriminating or not. Since both the requirements of Article 20(3) are fulfilled, it is argued that an accused cannot be compelled to unlock an electronic device as that is protected by the right against self-incrimination.
Once a person unlocks a device, the extent of protection, in terms of what legitimate inferences can be drawn from unlocking a device, is controlled by section 27 of the Evidence Act. The article has argued that under section 27, no inference can be made about the connection between the accused and the contents of the device. This does not affect the use of the contents as evidence by the police. However, in case the original unlocking was coerced, no inference can be drawn at all and neither can the contents of the device be used as evidence as it is derivative of unlocking the device as per the law laid down in Oghad and Selvi.
Pulkit Goyal is a IVth year student at National Law University Delhi interested in questions of investigation and criminal justice.
