Information Technology Act, 2000 - S.
67A – Penal Code 1860 - Ss. 376, 376 (2), 376 (2)(n) & 354C - In case of
digital evidence stored in a computer, mobile phone, USB drive or digital
camera, the Investigating Officer should have ensured that there is a clear
link between the hardware and the digital evidence copied from that hardware.
Having gone through the case diary, I have no
doubt in my mind that the manner in which the investigating officer has handled
the mobile phone of the son of the de facto complainant which was a valuable
piece of evidence has to be deprecated in the strongest possible terms. All
that he had done was to transfer the data to a compact disc after taking a
screenshot of some of the pictures. He has not even retrieved the videos which
were allegedly recorded by the applicant and which were forwarded to the
recipient. The investigating officer ought to have borne in mind that it was
essential to display objectivity in a court of law when the case ultimately
comes up for trial. The investigating officer was bound to demonstrate as to
how the evidence was retrieved showing each process through which he had
accomplished the said objective. He should have maintained a record to show the chain of
custody which would address issues such as the person who collected the
evidence, the nature and mode as to how the evidence was collected, the name of
the person who took possession of the evidence, the manner in which the
evidence was stored, the protection offered to the evidence whilst in storage
and the names of persons who removed the evidence from storage including the
reasons. (Para.7)
In a case in which a mobile phone is used for the commission of the
crime, the first and foremost thing the officer should have done was to secure
the phone to prevent the destruction/manipulation of data.
He should have first
recorded the status of the device after taking a photograph and record any
on-screen information. If the device was switched on, it should have been
switched off and the batteries should have been removed. Turning off the phone
would preserve the various information, metadata and call logs and it would
also prevent any attempt to wipe off the contents of the phone remotely. The
officer also was bound to seize all cables, chargers, packaging, manuals etc.
if possible to assist the enquiry and minimise the delays in any examination by
the digital evidence specialist. The password/pin of the device, if any, also
had to be obtained from the owner of the phone. The phone had to be packed and
sealed in antistatic packaging such as plastic bag, envelope or cardboard box
and the secured device along with the collected data had to be sent to the
digital evidence specialist. Only the said specialist can obtain and copy the
digital evidence and also provide an analysis of the evidence. (Para.9)
It is high-time for the State Police to bring out a
good practise guide for digital evidence, if they intend to tackle cyber crime
head on.
The cyber criminals are way ahead of the law enforcement officers and
urgent measures are to be taken to train officers to successfully prosecute the
offenders. Flaws committed by the officers, such as in the instant case, may
prove fatal to the prosecution. Officers, who are engaged in investigation of
cyber crimes, are required to be trained in best practices to tackle the
criminal misuse of current and emerging technologies. (Para.9)
IN
THE HIGH COURT OF KERALA AT ERNAKULAM
PRESENT
THE HONOURABLE MR. JUSTICE RAJA VIJAYARAGHAVAN V
FRIDAY,
THE 02ND DAY OF NOVEMBER 2018 / 11TH KARTHIKA, 1940
Bail
Appl..No. 7022 of 2018
CRIME
NO. 320/2018 OF Nattukal Police Station, Palakkad
PETITIONER/ACCUSED
VIJESH
BY
ADV. SRI.BABU S. NAIR
RESPONDENTS/STATE
& COMPLAINANT:
1
THE STATE OF KERALA, REPRESENTED BY THE PUBLIC PROSECUTOR, HIGH COURT OF
KERALA, ERNAKULAM, KOCHI - 682 031.
2
THE SUB INSPECTOR OF POLICE, NATTUKAL POLICE STATION, PALAKKAD DISTRICT, PIN-
678583.
BY
PUBLIC PROSECUTOR, SRI AJITH MURALI
THIS
BAIL APPLICATION HAVING COME UP FOR ADMISSION ON 02.11.2018, THE COURT ON THE
SAME DAY PASSED THE FOLLOWING:
O
R D E R
This
application is filed under Section 439 of the Cr.P.C.
2. The
applicant herein is the accused in Crime No.320 of 2018 registered at the
Nattukal Police Station under Sections 376, 376(2), 376(n) and 354(c) of the IPC
and Section 67A of the Information Technology Act, 2000.
3. The
de facto complainant is a married woman and the mother of three grownup boys.
The applicant and the de facto complainant owe allegiance to the same political
party and they became acquainted. They used to contact over phone as well. In the
month of March 2017, the applicant herein is alleged to have gone to her
residential home, while she was alone, and subjected her to sexual intercourse.
He is alleged to have recorded the entire sexual act on his phone. Later, she
was forced to succumb to his carnal desires on two occasions by threatening her
that the videos in his possession would be made public. She finally conjured up
the strength and refused to accede to his demands. Aggrieved by the above, the
applicant is alleged to have forwarded the explicit videos and photographs to the
mobile phone of the son of the de facto complainant. These are the allegations
based on which the subject crime has been registered.
4. The
learned counsel appearing for the applicant submitted that there is no truth in
the allegations levelled against him. It is urged that the allegation that the
applicant had raped the de facto complainant and at the same time took photographs
and videos of the sexual act is incongruous.
According
to the learned counsel, the above fact would show that the relationship between
the parties were consensual and when the husband of the de facto complainant
became aware of the same, the de facto complainant decided to victimize the applicant
by levelling false accusations. He also denied the prosecution allegation that
the applicant herein had forwarded the videos and photographs to the Whatsapp
account of the son of the de facto complainant. This allegation is falsified by
the prosecution records, argues the learned counsel.
5. The
learned Public Prosecutor has fervently opposed the prayer. It is submitted
that the act committed by the applicant borders on extreme depravity. After
raping a lady, pictures and videos were forwarded to her own son. The boy, who
is aged 16 years, was traumatised by the acts of the applicant, is the
submission. It is further submitted that the allegation that the videos and
photos did not reach the recipient is incorrect. According to the learned
Public Prosecutor, the investigating officer had taken screenshots of certain
pictures and the same was transferred to a compact disc. The phone was then
handed over back to the son of the de facto complainant as it was required for
his everyday use.
6. Having
considered the submissions advanced and after going through the case diary, I
find that two serious allegations are levelled against the applicant. He is
alleged to have raped the de facto complainant and in the course of the same
took more than 50 explicit photographs and 3 videos.
When
their relationship became strained, the applicant herein is alleged to have
forwarded the videos to the mobile phone of the son of the victim.
7. Having
gone through the case diary, I have no doubt in my mind that the manner in
which the investigating officer has handled the mobile phone of the son of the
de facto complainant which was a valuable piece of evidence has to be deprecated
in the strongest possible terms. All that he had done was to transfer the data
to a compact disc after taking a screenshot of some of the pictures. He has not
even retrieved the videos which were allegedly recorded by the applicant and which
were forwarded to the recipient. The investigating officer ought to have borne
in mind that it was essential to display objectivity in a court of law when the
case ultimately comes up for trial. The investigating officer was bound to
demonstrate as to how the evidence was retrieved showing each process through
which he had accomplished the said objective. In the case of digital evidence
stored in a computer, mobile phone, USB drive or digital camera, he should have
ensured that there is a clear link between the hardware and the digital
evidence copied from that hardware. He should have maintained a record to show
the chain of custody which would address issues such as the person who
collected the evidence, the nature and mode as to how the evidence was
collected, the name of the person who took possession of the evidence, the
manner in which the evidence was stored, the protection offered to the evidence
whilst in storage and the names of persons who removed the evidence from
storage including the reasons.
8. There
is no reason why the investigating officer had failed to seize the mobile phone
of the son of the victim which was the most important piece of evidence in the
instant case.
The
hardware itself ought to have been seized and the same should have been sent to
a digital evidence specialist to retrieve the data in a scientific manner. Only
then, the range of digital evidence that need to be obtained including audit
trials, data logs, biometric data, the metadata from applications, the file system,
intrusion detection reports and the content of data bases and files could be
properly retrieved. Given the nature of evidence to be copied, maintaining the
evidential continuity and integrity of the evidence that is copied is of
paramount importance. Such evidence will be subjected to cross examination in
relation to its integrity. In other words, the process of copying and handling
such evidence should be carried out to the highest possible standards.
9. In
a case in which a mobile phone is used for the commission of the crime, the
first and foremost thing the officer should have done was to secure the phone
to prevent the destruction/manipulation of data. He should have first recorded the
status of the device after taking a photograph and record any on-screen
information. If the device was switched on, it should have been switched off
and the batteries should have been removed. Turning off the phone would
preserve the various information, metadata and call logs and it would also prevent
any attempt to wipe off the contents of the phone remotely. The officer also
was bound to seize all cables, chargers, packaging, manuals etc. if possible to
assist the enquiry and minimise the delays in any examination by the digital
evidence specialist. The password/ pin of the device, if any, also had to be
obtained from the owner of the phone. The phone had to be packed and sealed in
antistatic packaging such as plastic bag, envelope or cardboard box and the
secured device along with the collected data had to be sent to the digital evidence
specialist. Only the said specialist can obtain and copy the digital evidence
and also provide an analysis of the evidence.
None
of these procedures were adopted by the investigating officer. It is high-time
for the State Police to bring out a good practise guide for digital evidence,
if they intend to tackle cyber crime head on. The cyber criminals are way ahead
of the law enforcement officers and urgent measures are to be taken to train
officers to successfully prosecute the offenders. Flaws committed by the
officers, such as in the instant case, may prove fatal to the prosecution.
Officers, who are engaged in investigation of cyber crimes, are required to be
trained in best practices to tackle the criminal misuse of current and emerging
technologies.
10. Back
to the case on hand, it appears that the investigation has progressed to the
final stages. I do not think that further detention in custody of the applicant
is required for the purpose of investigation. He can now be released on bail on
conditions. Before parting, it is made clear that expression of any opinion
shall not be treated as an expression on merits of the case.
11. In
the result, this application will stand allowed. The applicant shall be
released on bail on his executing a bond for Rs.50,000/- (Rupees Fifty thousand
only) with two solvent sureties each for the like sum to the satisfaction of the
court having jurisdiction. The above order shall be subject to the following
conditions:
1). The applicant shall appear before the Investigating Officer on
every Mondays and Saturdays between 9 a.m. and 11 a.m., for a period of 3
months from today or till the final report is filed, whichever is earlier.
2).
He shall not intimidate or attempt to influence the witnesses; nor shall he
tamper with the evidence. He shall not contact the victim or her family members.
3).
He shall not commit any offence while on bail.
4).
He shall not leave India without the permission of the Court and if having
passport, shall deposit the same before the Trial Court within a week; If release
of the passport is required at a later period, the applicant shall be at
liberty to move appropriate application before the Court having jurisdiction.
In
case of violation of any of the above conditions, the jurisdictional Court
shall be empowered to consider the application for cancellation, if any, and
pass appropriate orders in accordance with the law.
A
copy of this order shall be forwarded to the State Police Chief who shall take
necessary follow up.
Comments
Post a Comment