Sakshya Adhiniyam Mandates Hashing the Original; Established Jurisprudence Requires Hashing the Copy Also.

Saji Koduvath, Advocate, Kottayam

Abstract

  • 1. Sec. 63 of the BSA mandates the hash certificate for the original electronic record alone.
    • However, to fulfill the intended purpose, the HASH value certificate for the copy (computer output) must also be provided.
  • 2. Sec. 63(4)(c) of the BSA does not specifically mandate that hashing must be done at the time of copying.
    • But the judicial precedents require recording the hash values at the time of ‘copying’.

Part I

Established Jurisprudence Varies from the Enacted Law

HASH Certificate Under Sec. 63 (BSA)

The (earlier) Indian Evidence Act, 1872, Sec.  65B mandated only a simple certificate, as provided under Sec. 65B(4), when ‘computer output’ (copy) was produced before a court. But, the new Bharatiya Sakshya Adhiniyam,  2023, requires, in Sec.  63(4), the HASH value certificate, also.

Also Read: Sec. 65B (Electronic Records) and Bhartiya Sakshya Adhiniyam, 2023

Section 63, Bhartiya Sakshya Adhiniyam

Section 63, Bhartiya Sakshya Act speaks as to copy (computer output)  as under:

  • 63. Admissibility of electronic records– (1) “… any information contained in an electronic record which is printed on paper….  or copied in any electronic form (hereinafter referred to as the computer output) shall be deemed to be also a document, if the conditions mentioned in this section are satisfied …..”

Section 63(4)(c) of the Act reads as under:

  • “(c) dealing with any of the matters to which the conditions mentioned in sub-section (2) relate, and purporting to be signed by a person in charge of the computer or communication device or the management of the relevant activities (whichever is appropriate) shall be evidence of any matter stated in the certificate; and for the purposes of this sub-section it shall be sufficient for a matter to be stated to the best of the knowledge and belief  of the person stating it in the certificate specified in the Schedule.“

HASH Value Certificate

The Certificate required in Sec. 63(4)(c) of the Sakshya Adhiniyam (BSA) must be “in the form specified in the Schedule”. It is laid down in the schedule (not expressly stated in the body of the section-text) that this certificate (HASH value certificate) is needed in addition to the Certificate that is required in sub-section (4) as regards the matters enumerated in sub-section (4).

HASH Value Certificate: Form in the Schedule

The Form in the Schedule directs to state the following:

  • “I state that the HASH value/s of the electronic/digital record/s is …… ……… …… , obtained through the following algorithm –
  • SHA1:
  • SHA256:
  • MD5:
  • Other …….. …….. …….. (Legally acceptable standard)
  • (Hash report to be enclosed with the certificate)”

What is (Literally) required is the Certificate concerning the Original

From the above form, it is evident that what is required is a certificate as regards the original ‘electronic/digital record(s)’, not any copy thereof.

Besides clause (c) of sub-section (4), clauses (a) and (b) also refer to the ‘original’ and not to a ‘copy’. Clauses (a) and (b) read as under:

  • “(a) identifying the containing the statement and describing the manner in which it was produced;
    (b) giving such particulars of any device involved in the production of that electronic record as may be appropriate for the purpose of showing that the electronic record was produced by a computer or a communication device referred to in clauses (a) to (e) of sub-section (3).”

The expression “identifying the electronic record containing the statement” in clause (a) of sub-section (4) further emphasises that the “statement” should pertain to that found in the ‘computer,’ indicating the statement within the physical device itself.

This interpretation aligns with the evidentiary logic that authentication must relate or refer to the source.

Moreover, the words “where it is desired to give a statement in evidence” in Sec. 63(4) can be understood to refer to the “statement” as it exists in the electronic form in the (original) computer or in its digital storage (rather than the ‘copy’ or reproduction of that statement introduced later in court).

Relevant words in Sec. 63(4) reads as under:

  • “Where it is desired to give a statement in evidence by virtue of this section, a certificate… shall accompany the electronic record…”

The term “electronic record,” as used in this context, appears incongruent because the statute seems to treat the original electronic source and the document produced from it (such as a printout or soft copy) under the same terminology. This conflation could lead to multiple confusions, including what exactly is being certified, the original data in the system, or the document derived from it.

Further Discordant Notes

1. The law compulsorily requires the HASH certificate. But, the requirement for the HASH certificate is unnecessary, especially in situations where there is no dispute regarding the computer output (copy or print-out).

2. It is not made clear in Sec. 63, BSA –

  • (i) What is the precise purpose of ascertaining the hash value of the (original) ‘electronic or digital record’ and not a copy (computer output) that is actually produced before the court?
  • (ii) This raises also another question: how is the court to verify the authenticity of the copy, if only the original’s hash is referenced?
  • (iii) Why does the requirement of including HASH value appear only in the Schedule (certificate format) and not in the main body of Sec. 63 itself?
  • (iv) The lack of explicit mention in the section text also creates uncertainty about whether hash values are mandatory or directory (merely illustrative of best practices).

Established Jurisprudence

Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020)3 SCC 216 (although it was delivered before the introduction new Adhiniyam of 2023), is regarded as the most authoritative decision on this matter.

Read: Certificate is Required Only for ‘Computer Output’; Not for ‘Electronic Records’: Arjun Panditrao Explored.

The enacted law (Sec. 63, BSA) requires the HASH value ‘certificate’ as regards the original ‘electronic or digital record(s)’, the prevailing consensus among the courts in India is the following –

  • The primary objective of the certificate being verification of the authenticity of the copy (CD, pen drive, etc.), the certificate must refer to the copy (computer output), as well as to the original (electronic record) from which the copy was derived.

As regards the HASH value in Sec. 63(4), BSA, the following matters requires consideration –

  • The main text of Section 63(4) does not use the term “hash value”.
  • The ‘HASH value/s of the electronic/digital record/s‘ is required to be given under the ‘Form’ scheduled.
  • Even though it is not specifically stated, the ‘HASH values’ of both the original and the copy of the record must be provided (otherwise, the intended purpose will not be served).

Part II

The Law Does Not Mandate Hashing at the Time of Copying

As shown above, the Court decisions refer to the HASH value of the copy (computer output) produced in court, and not the original (electronic or digital record).

It is also worth noting that the Section does not clarify when hashing must be done—whether during copying from the original or at the time of presentation before the court.

It is true that the hash value of the copy of the CCTV footage (or any other digital evidence) should ideally be generated at the time the copy is made, and not merely at the time when the pen drive or other storage device is produced in court.

Hash Value Is Insisted at Four Stages even under Evidence Act

Madras High Court, in Yuvaraj v. State, 2023-4 Mad LJ (Cri) 238, observed as under:

  • “206. To ensure that what is collected as an evidence in the source is exactly reflected or produced at the time of marking the electronic evidence before the Court, particularly when it comes to CCTV footages, a standard operating procedure must be followed. Such a practice will guarantee that nothing gets altered/deleted/added by the time the evidence is tendered before the Court. Hence, the concept of hash value is insisted at four stages and this value must be the same on all those four stages to ensure authenticity. When the CCTV footage gets stored in the hard disk, that is the first stage where the hash value must be noted down when it is received by the analyst from the Court on requisition made by the prosecution. Thereafter, the analyst creates a copy/mirror image of what is contained in the hard disk and this must also have the same hash value. As the next step, the forensic examination starts and ultimately, it is concluded and a report is given by the forensic analyst. In all those four stages, the hash value must be the same.”
  • 207. For convenience, after the examination is completed by the forensic analyst, the footage can be downloaded to a DVD/CD and the same hash value will be reflected without any change. Since the extraction from the hard disk to the DVD/CD makes such DVD/CD as a secondary evidence, it goes without saying that such a DVD/CD must be accompanied with Section 65-B certificate. Copies taken and given to the accused persons under Section 207 of CrPC. regarding the CCTV footages should also be accompanied with Section 65-B certificate.”

Hash Value Must Be Recorded – Guidelines of Govt. in Tax Matters

In the “Digital Evidence Investigation Manual, 2014, Central Board of Direct Taxes (CBDT), Department of Revenue Ministry of Finance Government of India, reads, in Para 6.8, as under:

  • “6.8 Forensic Imaging/Cloning: If on previewing, important data is found either in deleted or in active form, the storage medium is required to be cloned for evidence purpose. Otherwise a normal data backup can be taken. The following steps should be taken at the time of cloning:
  • • Preparation-
  • ….. In cases where very high capacity disks/ servers (Over 200 GB) are found at the search premises, separate Hardware imaging devices, which are up to ten times faster, would be needed. These hardware devices have in-built authentication engines. On completion of the imaging process, the device displays the hash value of the cloned hard disk. The image/clone has to have the same hash value as that of the target hard disk. The Hash value should be recorded in the Panchnama and the assessee can be given the option of seeking a copy of the imaged/cloned hard disk by paying the copying charges.”

Para 6.8 also requires the following under the heading ‘Report’:

  • • Report: Take printout of report generated by the imaging tool which contains the details of imaging attributes, details of Hard Disk Drives imaged, date and time and the most important thing the hash value of the Hard Disk Drive. Attach the report along with panchnama as an annexure to it.

In M/S. Saravana Selvarathnam Retails v. The Commissioner of Income Tax, 2024-463 ITR 523: 298 Taxman 319: 339 CTR 10 (Mad)(HC), the main grievance of the petitioner was that the digital data evidences were collected by the respondents from unknown locations without any valid search warrant and without following the guidelines issued by the CBDT vide Digital Evidence Investigation Manual. The Madras High Court addressed the contention in detail and held as under:

  • “The Digital Evidence Investigation Manual has been issued by the CBDT by virtue of powers available under Section 119 of the IT Act and hence, the Income Tax Authorities and all the other persons employed in the execution of this Act are bound to observe and follow such orders, instructions and directions issued by CBDT. ….. Hence, it is mandatory for  W.P. Nos. 9753, 9757, 9761 & 11176 of 2023 respondents to follow the Digital Evidence Investigation Manual issued by CBDT while conducting search and seizure and it is not optional.”

Directives of Maharashtra and Kerala Govts.

In Umesh v. State of Karnataka, 2023-2 KarLJ 397, it is pointed out –

  • “In fact, the Government of Maharashtra has already implemented the practice of collecting hash value of electronic evidences and collecting the memory component of the device it is recorded on at the first instance since 2016. A reference can also be made to the Standard Operating Procedures issued by the Government of Kerala for collection of digital evidence related to crimes against women and children, since 2021. In fact, guidelines on extraction of hash value are also given in Digital Evidence Investigation Manual Central Board of Direct Taxes Department of Revenue, Ministry of Finance, Government of India.”

Hash Values of the Original and Copy at the Time of Copying, Required

Though Sec. 63(4)(c) of the BSA does not specifically mandate

  • (i) that hashing must be done at the time of copying, and (ii) that the hash value must pertain to the copy (computer output), also,

established jurisprudence, through long-standing legal precedents, requires recording the hash values of both the original and the copy at the time of copying, to demonstrate that the data is protected against tampering.

Conclusion

It is a fact that Section 65 of the old Act and Section 63 of the new Act were introduced as enabling provisions, designed to simplify the admissibility of electronic records.

  • However, due to poor and rigid drafting, they have paradoxically had the opposite effect.

In practice, it may be more feasible for many litigants to physically produce the original device—such as a computer, laptop, or mobile phone—before the court, rather than to obtain a certified hash value through a forensic expert.

Read Similar Articles

End Notes:

Section 63, Bhartiya Sakshya Adhiniyam

(Changes introduced in the New Adhiniyam – from the Evidence Act – are emphasised.)

  • 63. Admissibility of electronic records –
    (1) Notwithstanding anything contained in this Adhiniyam, any information contained in an electronic record which is printed on paper, stored, recorded or copied in optical or magnetic media or semiconductor memory which is produced by a computer or any communication device or otherwise stored, recorded or copied in any electronic form (hereinafter referred to as the computer output) shall be deemed to be also a document, if the conditions mentioned in this section are satisfied in relation to the information and computer in question and shall be admissible in any proceedings, without further proof or production of the original, as evidence or any contents of the original or of any fact stated therein of which direct evidence would be admissible.
    (2) The conditions referred to in sub-section (1) in respect of a computer output shall be the following, namely:—
    (a) the computer output containing the information was produced by the computer or communication device during the period over which the computer was used regularly to create, store or process information for the purposes of any activity regularly carried on over that period by the person having lawful control over the use of the computer or communication device;
    (b) during the said period, information of the kind contained in the electronic record or of the kind from which the information so contained is derived was regularly fed into the computer in the ordinary course of the said activities;
    (c) throughout the material part of the said period, the computer or communication device was operating properly or, if not, then in respect of any period in which it was not operating properly or was out of operation during that part of the period, was not such as to affect the electronic record or the accuracy of its contents; and
    (d) the information contained in the electronic record reproduces or is derived from such information fed into the computer in the ordinary course of the said activities.
    (3) Where over any period, the function of creating, storing or processing information for the purposes of any activity regularly carried on over that period as mentioned in clause (a) of sub-section (2) was regularly performed by means of one or more computers or communication device, whether—
    (a) in standalone mode; or
    (b) on a computer system; or
    (c) on a computer network; or
    (d) on a computer resource enabling information-creation or providing information—processing and storage; or
    (e) through an intermediary
    all the computers used for that purpose during that period shall be treated for the purposes of this section as constituting a single computer; and references in this section to a computer shall be construed accordingly.
    (4) In any proceeding where it is desired to give a statement in evidence by virtue of this section, a certificate doing any of the following things shall be submitted along with the electronic record at each instance where it is being submitted for admission, namely:—
    (a) identifying the electronic record containing the statement and describing the manner in which it was produced;
    (b) giving such particulars of any device involved in the production of that electronic record as may be appropriate for the purpose of showing that the electronic record was produced by a computer or a communication device referred to in clauses (a) to (e) of sub-section (3);
     (c) dealing with any of the matters to which the conditions mentioned in sub-section (2) relate, and purporting to be signed by a person in charge of the computer or communication device or the management of the relevant activities (whichever is appropriate) shall be evidence of any matter stated in the certificate; and for the purposes of this sub-section it shall be sufficient for a matter to be stated to the best of the knowledge and belief  of the person stating it in the certificate specified in the Schedule.
     (5) For the purposes of this section,—
    (a) information shall be taken to be supplied to a computer or communication device if it is supplied thereto in any appropriate form and whether it is so supplied directly or (with or without human intervention) by means of any appropriate equipment;
    (b) a computer output shall be taken to have been produced by a computer or communication device whether it was produced by it directly or (with or without human intervention) by means of any appropriate equipment or by other electronic means as referred to in clauses (a) to (e) of sub-section (3).

How to Subscribe ‘IndianLawLive’? Click here – “How to Subscribe free “

Read in this cluster (Click on the topic):

Civil Suits: Procedure & Principles

Book No, 1 – Civil Procedure Code

Principles and Procedure

PROPERTY LAW

Title, ownership and Possession

Adverse Possession

Land Laws/ Transfer of Property Act

Land Reform Laws

Power of attorney

Evidence Act – General

Sec. 65B

Admission, Relevancy and Proof

Law on Documents

Documents – Proof and Presumption

Interpretation

Contract Act

Law on Damages

Easement

Stamp Act & Registration

Divorce/Marriage

Negotiable Instruments Act

Criminal

Arbitration

Will

Book No. 2: A Handbook on Constitutional Issues

Religious issues

Book No. 3: Common Law of CLUBS and SOCIETIES in India

Book No. 4: Common Law of TRUSTS in India

Unknown's avatar

Published by sajikoduvath

Leave a Comment