Digital Evidence In Criminal Trials: Section 63 Of The Bharatiya Sakshya Adhiniyam, Hash Values & The New Rules of Admissibility

Introduction: When the Evidence Lives in a Machine

Imagine a modern-day courtroom. The prosecution places before the judge not a bloodstained knife or a signed confession, but a printout of WhatsApp messages, a screenshot of a bank transfer, and a video clip extracted from a seized mobile phone. The accused sits quietly, knowing that the most damaging evidence against him was never touched by human hands rather it was born inside a machine. It bears noting, however, that where such messages were sent by the accused, they may constitute admissions under Section 15 of the Bharatiya Sakshya Adhiniyam (corresponding to Section 17 of the Indian Evidence Act) and carry a distinct admissibility pathway that operates independently of the certificate framework discussed in this article.

This is the new reality of criminal trials in India. Digital evidence such as emails, call records, CCTV footage, GPS data, social media posts has become the backbone of modern prosecution. And yet, the rules governing how this evidence enters a courtroom are among the most technical, most contested, and most rapidly evolving areas of Indian law.

For defense, understanding these rules is not merely academic. It is the difference between a conviction and an acquittal.

Let’s just trace the journey of digital evidence law in India from its uncertain beginnings under the Indian Evidence Act, 1872, through the landmark Supreme Court rulings that reshaped the landscape, to the sweeping changes introduced by the Bharatiya Sakshya Adhiniyam, 2023, and the very latest judicial pronouncements.

The Old World — Section 65B and the Indian Evidence Act

The Problem with Digital Evidence

A document written on paper can be touched, examined, and authenticated by a handwriting expert. But what about a text message? It exists as a string of binary code on a server somewhere. When it is printed out and placed before a judge, how does the court know it has not been altered? How does it know the printout accurately reflects what was actually sent?

The Indian Evidence Act, 1872 was drafted in the age of paper. It had no answer for these questions. So Parliament inserted Sections 65A and 65B through an amendment, creating a special framework for electronic records. Section 65A declared that the contents of electronic records may be proved in accordance with Section 65B. Section 65B(1) established the foundational rule: any information stored in an electronic record and reproduced in printed form is deemed a "document" and is admissible in proceedings, provided certain statutory conditions are satisfied.

The most important of those conditions was the certificate under Section 65B(4), a written declaration by a responsible official confirming that the computer system was functioning properly, that the record was produced in the ordinary course of activities, and that the information was accurately reproduced.

For years, courts were inconsistent. Some admitted electronic records without any certificate. Others required it. The confusion ended in 2014.

In Anvar P.V. v. P.K. Basheer (2014) 10 SCC 473, the Supreme Court of India delivered a judgment that fundamentally changed the rules. The case arose from the 2011 Kerala Legislative Assembly elections, where CDs containing defamatory leaflets were submitted as evidence without a Section 65B certificate.

The Supreme Court held, unambiguously, that Sections 65A and 65B constitute a "special code" for proving electronic records. The general provisions of Sections 63 and 65 of the Evidence Act which governed secondary evidence of ordinary documents have no application to electronic records. The Section 65B(4) certificate is a mandatory condition precedent to admissibility. Oral evidence cannot substitute it.

Because the appellant in Anvar P.V. failed to produce the certificate, the CDs were held inadmissible. The case was dismissed.

The court also carved out one important exception: if the original electronic device itself is produced directly in court, no Section 65B certificate is required. The certificate is only needed when secondary evidence such as a printout, a copy, a CD is being offered.

The Shafhi Mohammad Detour

In 2018, a two-judge bench of the Supreme Court in Shafhi Mohammad v. State of Himachal Pradesh appeared to soften the Anvar P.V. rule. It held that a party not in possession of the device could not be expected to produce a certificate, and therefore the requirement could be relaxed in such cases.

This created confusion. Two Supreme Court benches had said different things. Which one was correct?

Arjun Panditrao Khotkar: The Final Word (Under the Old Law)

The conflict was resolved by the Supreme Court in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020) 7 SCC 1. The case itself arose from an election petition challenging the result of a Maharashtra Legislative Assembly election. Electronic evidence was central to the dispute.

The Supreme Court held that:

- The Section 65B(4) certificate is a mandatory condition precedent for the admissibility of electronic records as secondary evidence. Shafhi Mohammad was overruled.

- If the electronic record is produced from the original device itself, no certificate is required. But for any secondary reproduction, compliance is non-negotiable.

- It was also held that the certificate need not be filed at the time of producing the evidence. It can be produced at any stage of the trial before its conclusion, provided it does not prejudice the accused. The court clarified Anvar P.V.'s contemporaneous filing requirement on this point, balancing the mandatory nature of the certificate against practical realities of litigation, rather than overruling Anvar P.V. on the substance of the certificate requirement itself.

- Trial courts have the power to summon the person in control of the device to produce the certificate, using Sections 91, 311, 173(8), and 231 of the CrPC, and Order XVI of the CPC.

This ruling was subsequently reaffirmed in Ravinder Singh @ Kaku v. State of Punjab (May 2022), which reiterated that oral evidence cannot substitute the mandatory certificate requirement. The principle was further applied in State of Karnataka v. T. Naseer (2023), which confirmed that the certificate can be introduced at any stage before the trial ends if no prejudice is caused to the defence.

The Arjun Panditrao Khotkar ruling also confirmed that the certificate must identify the electronic record, detail the device particulars, confirm compliance with Section 65B(1) conditions, and be signed by a person in a responsible official position who manages the device or relevant activities.

The New World — Section 63 of the Bharatiya Sakshya Adhiniyam, 2023

A New Law for a New Era

On July 1, 2024, the Bharatiya Sakshya Adhiniyam, 2023 (BSA) replaced the Indian Evidence Act, 1872. The old Sections 65A and 65B were replaced by Sections 62 and 63 of the BSA.

Section 62 of the BSA mirrors the old Section 65A: the contents of electronic records may be proved in accordance with Section 63. But Section 63 goes significantly further than its predecessor.

The Two-Part Certificate: A Stricter, More Technical Framework

Under the BSA, the certificate required for electronic evidence is bifurcated into two distinct parts:

Part A is filled by the party producing the electronic record. It must contain the basic details of the electronic record and, critically, the specific hash value, meaning an alphanumeric string that functions as a unique digital fingerprint of the file. The party must state: "I state that the HASH value/s of the electronic/digital record/s is..." and must also specify the hash function used (for example, SHA-256).

Part B is filled by an expert. The expert must certify the technical matters stated in the certificate, including the integrity of the record and the hash function used. Under Section 63(4)(c) of the BSA, the expert's opinion is treated as evidence of any matter stated in the certificate.

This is a significant departure from the old law. Under Section 65B of the Indian Evidence Act, hash values were a forensic best practice which was recommended by experts but not mandated by statute. Under Section 63 of the BSA and its Schedule, hash value disclosure has statutory force. Failure to include the hash value in Part A is not a procedural irregularity, rather, it is a failure to satisfy a mandatory admissibility condition.

What is a Hash Value, and Why Does It Matter?

A hash value is a mathematical output generated by running a file through a specific algorithm. If even a single character in the file is changed as in, even a comma, even a space, the hash value changes completely. This makes it an extraordinarily reliable tool for detecting tampering.

When a party discloses the hash value of an electronic record in Part A of the certificate, and an expert certifies it in Part B, the court has a verifiable assurance that the record placed before it is identical to the record that was originally captured. If the hash values do not match, the record has been altered.

This is why the BSA's insistence on hash value disclosure is such a significant development. It transforms digital evidence authentication from a procedural formality into a forensic verification exercise.

Recent Judicial Pronouncements

The Madras High Court: A Bottleneck in Expert Availability

As Section 63 of the BSA came into force, a practical problem emerged. Part B of the certificate must be signed by an "expert." But who qualifies as an expert?

The Madras High Court took a restrictive view. It held that only Examiners of Electronic Evidence notified by the Central Government under Section 79A of the Information Technology Act, 2000 could sign Part B of the certificate. The court noted a severe shortage of such notified experts in Tamil Nadu and directed the Ministry of Electronics and Information Technology (MeitY) to notify experts within three months.

This ruling created significant hardship for litigants. In many states, there were simply no government-notified experts available. Cases were being delayed. Evidence was being excluded not because it was unreliable, but because the right bureaucratic stamp was unavailable.

Pune Bar Association v. Union of India (2026): The Supreme Court Settles the Question

The Supreme Court of India has now resolved this controversy in Pune Bar Association v. Union of India. The court upheld the constitutional validity of Section 63(4) of the BSA, rejecting the challenge that the hash value and expert certification requirements are unduly burdensome.

On the critical question of who qualifies as an expert, the Supreme Court disagreed with the Madras High Court's restrictive interpretation. Reading Sections 39(1) and 39(2) of the BSA together, the court held that any person with special skill and expertise in computer science or cyber forensics may sign Part B of the certificate as an expert.

The Supreme Court explicitly stated that the Madras High Court's restriction to government-notified experts is not a binding precedent.

The practical implications of this ruling are substantial:

- Lawyers and litigants can now rely on private experts with proven expertise in cyber forensics, not just government-notified officials.

- The admissibility framework of hash value disclosure in Part A, expert certification in Part B remains intact and constitutionally valid.

- The ruling prevents procedural bottlenecks caused by the scarcity of notified experts, particularly in states like Tamil Nadu.

The Seizure Problem — How Evidence is Gathered Matters

The Supreme Court of India, in proceedings before a bench comprising Justices Sanjay Kishan Kaul and Sudhanshu Dhulia, expressed serious concern about the absence of comprehensive guidelines for the search and seizure of digital devices. In November 2023, the court directed the Central Government to frame such guidelines within six weeks, noting that the government had been sitting on this issue since 2021.

As an interim measure, the court ordered all central agencies to adhere to the CBI Manual for digital device seizures until official guidelines are finalized.

The Proposed Safeguards

The court highlighted several proposed safeguards based on the petitioners' submissions:

- Judicial Warrant: A warrant should be mandatory for device seizures, except in genuine emergencies where written reasons must be recorded.

- Password Disclosure: Owners cannot be compelled to disclose passwords or biometrically unlock devices.

- Device Return and Integrity: Devices must be returned or deposited in court within 30 days. Investigators must record hash values, prefer seizing copies over original devices, and ensure storage in appropriate conditions. These remain proposed safeguards highlighted by the Court, not yet enacted statutory obligations, as final guidelines have not been framed.

- Privacy Safeguards: Investigators are barred from accessing irrelevant, personal, or privileged data. Searches should be conducted by a qualified Forensic Examiner, not the investigating officer.

- Specificity: Seizure applications must explicitly state the necessity of the device, prohibiting conjectural or roving inquiries.

Currently, digital evidence seizure is governed by Section 69 of the Information Technology Act, 2000 and Sections 91 and 93 of the CrPC, alongside the interim standard of the CBI Manual.

The Right to Privacy as a Constitutional Backstop

The constitutional foundation for these safeguards was laid in Justice K.S. Puttaswamy (Retd.) v. Union of India, where the Supreme Court unanimously recognized the right to privacy as a fundamental right under Article 21 of the Constitution. This recognition built upon the earlier evolution of privacy jurisprudence, including the foundational contribution of Gobind v. State of M.P., which represents an important step in the constitutional lineage leading to Puttaswamy. A digital device such as a smartphone, a laptop is not merely a piece of hardware. It contains a person's entire private life: their communications, their finances, their medical records, their relationships. Treating it as just another item to be seized without procedural safeguards is constitutionally untenable.

Courts have also directed that Call Detail Records of both the accused and the police staff must be secured to verify the location and timing of seizures, and that the recovery and seizure process should ideally be photographed or video-recorded. Cellular companies and internet service providers must preserve and segregate CDRs under Section 67C of the Information Technology Act to prevent data corruption.

Toolkit for Defense

Challenging Electronic Evidence Under the BSA

For defense, the following challenges are available when the prosecution relies on electronic evidence:

Challenge 1: Absence of a Valid Certificate

If the prosecution has not filed a two-part certificate under Section 63 of the BSA, the electronic record is inadmissible. This is not a technicality, it is rather a mandatory statutory condition. The Supreme Court in Arjun Panditrao Khotkar confirmed that oral evidence cannot substitute this requirement. The certificate must identify the electronic record, detail the device particulars, and be signed by a responsible official.

Challenge 2: Missing or Incorrect Hash Value

Under the BSA, Part A of the certificate must contain the specific hash value of the electronic record and identify the hash function used. If the hash value is absent, or if the hash value in the certificate does not match the hash value of the record produced in court, the integrity of the evidence is fatally compromised. This is now a statutory requirement, not merely a forensic best practice.

Challenge 3: Unqualified Expert in Part B

After Pune Bar Association v. Union of India, the expert signing Part B need not be a government-notified Examiner of Electronic Evidence. However, the expert must still possess "special skill and expertise" in computer science or cyber forensics.

Challenge 4: Broken Chain of Custody

Even a perfectly certified electronic record can be challenged if the chain of custody is broken. If the device was not properly sealed, if hash values were not recorded at the time of seizure, or if the device passed through multiple hands without documentation, the integrity of the evidence is in doubt. It should be noted that recording hash values at the point of seizure is currently an interim CBI Manual standard and a proposed safeguard, not yet a universally enacted statutory mandate for all agencies; the strength of this ground of challenge will therefore depend on whether the seizing agency was bound by the CBI Manual or equivalent guidelines at the relevant time.

Challenge 5: Unlawful Seizure

If the device was seized without a warrant and without recording written reasons for the emergency, the seizure itself may be challenged as violating the accused's fundamental right to privacy under Article 21. Evidence obtained through an unlawful search may be excluded on constitutional grounds.

Conclusion

The journey from Section 65B of the Indian Evidence Act to Section 63 of the Bharatiya Sakshya Adhiniyam is a journey from uncertainty to structure. From Anvar P.V. in 2014, through Arjun Panditrao Khotkar in 2020, to Pune Bar Association v. Union of India in 2026, the courts have been steadily building a framework that takes digital evidence seriously: seriously enough to demand rigorous authentication, and seriously enough to exclude evidence that does not meet that standard.

The law is not yet complete. Comprehensive guidelines for the search and seizure of digital devices remain pending. Questions about the admissibility of AI-generated evidence, deepfakes, and encrypted communications are only beginning to reach the courts.

But for the defense, tools are there. The certificate requirement is mandatory. The hash value is statutory. The expert must be qualified. The chain of custody must be intact. The seizure must be lawful.

Proving the unseen is not impossible. But it must be done right — and the law now says exactly what "right" means.