Can a Cyber Forensics Expert Provide Evidence In Any case and Certify

Can any computer expert or cyber forensic expert provide and “certified” digital files as evidence?

Answer is No.

No court would expect a “certificate” from an expert who has been entrusted by the court to carry out a specific forensic duty regardless of his or her official standing in a government or a private organisation. The court would only expect a comprehensive forensic report from a court-appointed expert. The court, on the other hand, would want a “certificate” from an expert designated by other authorities such as the police, CBI, and so on. In such situations, the phrases “certify” and “certificate” related to Section 65B of the Indian Evidence Act were regularly questioned by attorneys particularly those representing the opposing side in numerous courts of law across India, noting the absence of a government list of “certifying authority.” Such a question is legally justified since such verification and authentication are only legitimate when authorized by an official certified by a certifying authority. However, no one has been recognized as a certification authority by the Government of India to “certify” digital evidence or issue a “certificate”. As a result of all of this, even a “certificate” given by a government forensic expert can be contested in court.

A common argument used by defence attorneys when contesting the veracity of the electronic evidence presented by the prosecution is that not all investigation officers may certify electronic records as evidence as they may not have actually retrieved the electronic evidence. Additionally, it implies that any electronic document that has been retrieved, verified, and produced in court by a third party other than the investigating officer lacks legal validity. Certain minute details of the four requirements under Section 65B(2) can only be certified by the individual who actually retrieved the electronic records from their digital source.

The legal provision under which the person was authorised as a cyber forensic expert who is qualified to extract those electronic records, which were subsequently presented by the investigation officer as evidence in that case, is one important point that can come up during the litigation process of a case in which an electronic record is presented as evidence. In cases where electronic records are presented as evidence by the prosecution, defence lawyers frequently raise the point that, under the current definitions, only the person with lawful control over the computer from which the electronic records were extracted or the person appointed by the court can become the cyber forensic expert in that particular case, and thus, any electronic record extracted by the cyber forensic expert and certified and presented in the court by the investigation officer has no legal standing.

These unfavourable events typically result from the legal definition of a cyber forensic expert’s qualifications being too vague, which has a detrimental effect on the admissibility of electronic evidence in court. Thus, events may even result in the regrettable circumstance of offenders getting away with it. The cyber forensic experts and investigation officers are expected to abide by 65B as much as is possible by adhering to the guidelines and thereby convincing the originality, authenticity, accuracy, legitimacy, or genuineness of the electronic record which is submitted as evidence in order to prevent such unfortunate situations in the court of law.

There is also the matter of the expert’s credentials. The cyber forensic expert does not need to be qualified in that particular field, according to Indian law. As was already indicated, it merely specifies that the forensic statement or the certificate must be signed by a person holding a senior official position related to the operation or administration of the pertinent services. Currently, the lower courts recognise credentials based on the experts’ abilities and prior professional experience. While this has been adequate up until now, it is projected that in the future, disputing the knowledge and credentials of expert witnesses will become more frequent. According to the US courts, an expert must be a living, breathing person (Meyers and Rogers, 2004) and cannot be an inanimate object (such as a forensic software package or other digital goods like a digital picture or a video clipping). However, this intriguing ruling does not exclude the use of the item or its findings as scientific evidence in US courts under any circumstances. It simply meant that, in these situations and as previously said, the person utilising forensic software to extract evidence or submit a digital product as evidence will have to first explicitly mention, then establish, and ultimately attest to it.

There is no need that a “oral witness” always follows a cyber forensic report. Oral confessions regarding the substance of electronic records are irrelevant, unless the veracity of the created electronic record is in issue, per Section 22A of the Indian Evidence Act. By making the cyber forensic report comprehensive, conclusive, informative, straightforward, and self-explanatory extra legal step of calling in a “oral witness” may be substantially avoided or eliminated.

Any legal or judicial system that values responsibility and accountability will work to ensure that it receives the right information from professionals in subjects that fall outside of its purview. It goes without saying that the Indian judiciary also believes that electronic evidence is a product of cyber forensics, which is outside the judiciary’s area of expertise. The opinion of the examiner of electronic evidence referred to in Section 79A of the Information Technology Act, 2000 is a relevant fact when in a proceeding the court must form an opinion on any matter relating to any information transmitted or stored in any computer resource or any other electronic or digital form, according to Section 45A of the Indian Evidence Act.

Detail of the Sections Mentioned Above

Section 65B in The Indian Evidence Act, 1872

65B. Admissibility of electronic records

(1) Notwithstanding anything contained in this Act, any information contained in an electronic record that is printed on paper, stored, recorded or copied in optical or magnetic media produced by a computer (hereinafter referred to as the computer output) shall be deemed to be also a document, if the conditions mentioned in this section are satisfied in relation to the information and computer in question and shall be admissible in any proceedings, without further proof or production of the original, as evidence of any contents of the original or of any fact stated therein of which direct evidence would be admissible.

(2) The conditions referred to in sub-section (1) in respect of a computer output shall be the following, namely:—

(a) the computer output containing the information was produced by the computer during the period over which the computer was used regularly to store or process information for the purposes of any activities regularly carried on over that period by the person having lawful control over the use of the computer;

(b) during the said period, information of the kind contained in the electronic record or of the kind from which the information so contained is derived was regularly fed into the computer in the ordinary course of the said activities;

(c) throughout the material part of the said period, the computer was operating properly or, if not, then in respect of any period in which it was not operating properly or was out of operation during that part of the period, was not such as to affect the electronic record or the accuracy of its contents; and

(d) the information contained in the electronic record reproduces or is derived from such information fed into the computer in the ordinary course of the said activities.

(3) Where over any period, the function of storing or processing information for the purposes of any activities regularly carried on over that period as mentioned in clause (a) of sub-section (2) was regularly performed by computers, whether—

(a) by a combination of computers operating over that period; or

(b) by different computers operating in succession over that period; or

(c) by different combinations of computers operating in succession over that period; or

(d) in any other manner involving the successive operation over that period, in whatever order, of one or more computers and one or more combinations of computers, all the computers used for that purpose during that period shall be treated for the purposes of this section as constituting a single computer; and references in this section to a computer shall be construed accordingly.

(4) In any proceedings where it is desired to give a statement in evidence by virtue of this section, a certificate doing any of the following things, that is to say,—

(a) identifying the electronic record containing the statement and describing the manner in which it was produced;

(b) giving such particulars of any device involved in the production of that electronic record as may be appropriate for the purpose of showing that the electronic record was produced by a computer;

(c) dealing with any of the matters to which the conditions mentioned in sub-section (2) relate, and purporting to be signed by a person occupying a responsible official position in relation to the operation of the relevant device or the management of the relevant activities (whichever is appropriate) shall be evidence of any matter stated in the certificate, and for the purposes of this sub-section it shall be sufficient for a matter to be stated to the best of the knowledge and belief of the person stating it.

(5) For the purposes of this section,—

(a) infomation shall be taken to be supplied to a computer if it is supplied thereto in any appropriate form and whether it is so supplied directly or (with or without human intervention) by means of any appropriate equipment;

(b) whether in the course of activities carried on by any official information is supplied with a view to its being stored or processed for the purposes of those activities by a computer operated otherwise than in the course of those activities, that information, if duly supplied to that computer, shall be taken to be supplied to it in the course of those activities;

(c) a computer output shall be taken to have been produced by a computer whether it was produced by it directly or (with or without human intervention) by means of any appropriate equipment. Explanation.—For the purposes of this section any reference to information being derived from other information shall be a reference to its being derived therefrom by calculation, comparison, or any other process.]

Section 45 in The Indian Evidence Act, 1872

45. Opinions of experts

When the Court has to form an opinion upon a point of foreign law or of science or art, or as to identity of handwriting 35 [or finger impressions], the opinions upon that point of persons specially skilled in such foreign law, science or art, 36 [or in questions as to identity of handwriting] 35 [or finger impressions] are relevant facts. Such persons are called experts. Illustrations

(a) The question is, whether the death of A was caused by poison. The opinions of experts as to the symptoms produced by the poison by which A is supposed to have died are relevant.

(b) The question is, whether A, at the time of doing a certain act, was, by reason of unsoundness of mind, incapable of knowing the nature of the Act, or that he was doing what was either wrong or contrary to law. The opinions of experts upon the question whether the symptoms exhibited by A commonly show unsoundness of mind, and whether such unsoundness of mind usually renders persons incapable of knowing the nature of the acts which they do or of knowing that what they do is either wrong or contrary to law, are relevant.

(c) The question is, whether a certain document was written by A. Another document is produced which is proved or admitted to have been written by A. The opinions of experts on the question whether the two documents were written by the same person or by different persons, are relevant. Comments Conflict of opinion of Experts When there is a conflict of opinion between the experts, then the Court is competent to form its own opinion with regard to signatures on a document; Kishan Chand v. Sita Ram, AIR 2005 P&H 156. Expert opinion admissibility Requirement of expert evidence about test firing to find out whether double barrel gun is in working condition or not, not necessary; Jarnail Singh v. State of Punjab, AIR 1999 SC 321. The evidence of a doctor conducting post mortem without producing any authority in support of his opinion is insufficient to grant conviction to an accused; Mohd Zahid v. State of Tamil Nadu, 1999 Cr LJ 3699 (SC). Opinion to be received with great caution The opinion of a handwriting expert given in evidence is no less fallible than any other expert opinion adduced in evidence with the result that such evidence has to be received with great caution; Ram Narain v. State of Uttar Pradesh, AIR 1973 SC 2200.

Section 22 in The Indian Evidence Act, 1872

22. When oral admissions as to contents of documents are relevant

Oral admissions as to the contents of a document are not relevant, unless and until the party proposing to prove them shows that he is entitled to give secondary evidence of the contents of such document under the rules hereinafter contained, or unless the genuineness of a document produced is in question.

Section 79 in The Information Technology Act, 2000

 79. Exemption from liability of intermediary in certain cases

(1) Notwithstanding anything contained in any law for the time being in force but subject to the provisions of sub-section (2) and (3), an intermediary shall not be liable for any third-party information, data, or communication link made available or hosted by him.

(2) The provisions of sub-section (1) shall apply if-

(a) the function of the intermediary is limited to providing access to a communication system over which information made available by third parties is transmitted or temporarily stored or hosted; or

(b) the intermediary does not-

(i) initiate the transmission,

(ii) select the receiver of the transmission, and

(iii) select or modify the information contained in the transmission;

(c) the intermediary observes due diligence while discharging his duties under this Act and also observes such other guidelines as the Central Government may prescribe on this behalf.

(3) The provisions of sub-section (1) shall not apply if-

(a) the intermediary has conspired or abetted or aided or induced, whether by threats or promise or otherwise in the commission of the unlawful act;

(b) upon receiving actual knowledge, or on being notified by the appropriate Government or its agency that any information, data, or communication link residing in or connected to a computer resource, controlled by the intermediary is being used to commit the unlawful act, the intermediary fails to expeditiously remove or disable access to that material on that resource without vitiating the evidence in any manner.

Explanation- For the purpose of this section, the expression “third party information” means any information dealt with by an intermediary in his capacity as an intermediary.]

Loading…

Something went wrong. Please refresh the page and/or try again.

error: Content is protected !!

Discover more from Forensic's blog

Subscribe now to keep reading and get access to the full archive.

Continue reading