Introduction
The rapid development of information and communication technology has fundamentally changed modern society. Computers, smartphones, social networking platforms, online banking, digital payments and cloud-based services have become part of everyday life. These developments have brought considerable benefits to individuals, businesses and government institutions. However, the increasing dependence on digital technology has also created new avenues for criminal activity. Criminals can now exploit digital platforms to commit fraud, steal personal information, impersonate individuals, manipulate data and target victims located far away from them.
Cybercrime differs from many conventional forms of crime because the offender, the victim, the device and the relevant evidence may exist in different geographical locations. A person sitting in one State may target a victim in another State while using an online platform whose servers are located outside India. Similarly, digital evidence may be distributed among mobile phones, computers, email accounts, social-media platforms, banks and cloud servers. This creates substantial difficulties for investigators.
India’s criminal justice system has recently undergone a major legislative transformation through the enactment of the Bharatiya Nyaya Sanhita, 2023 (BNS), the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), and the Bharatiya Sakshya Adhiniyam, 2023 (BSA).1 These laws, in force since 1 July 2024, replaced the Indian Penal Code, 1860, the Code of Criminal Procedure, 1973 and the Indian Evidence Act, 1872 respectively.2
The importance of these reforms becomes particularly evident in the context of cybercrime. Modern criminal justice cannot respond effectively to digital offences without addressing electronic investigation, electronic records, digital communication and forensic evidence. The new laws therefore need to be understood together with the Information Technology Act, 20003 and the constitutional principles governing privacy, liberty and due process.
This paper examines whether India’s new criminal-law framework is sufficiently equipped to respond to emerging forms of cybercrime. It focuses particularly on investigation, digital evidence, jurisdictional problems, technological challenges and the protection of individual rights.
Research questions
The research is guided by the following questions:
1. How effectively do the new criminal laws address the investigation and prosecution of cybercrime in India?
2. What are the major legal and practical challenges involved in collecting, preserving and presenting digital evidence?
3. Does the existing legal framework adequately protect privacy and other constitutional rights during cybercrime investigations?
4. What institutional and technological reforms are necessary to improve India’s response to cybercrime?
Objectives of the study
The primary objective of this study is to examine the legal framework governing cybercrime in India after the introduction of the new criminal laws.
The study further aims to analyse the relationship between the BNS, the BNSS, the BSA and the Information Technology Act, 2000. It seeks to identify practical difficulties faced by police officers and other investigative authorities while dealing with digital evidence.
Another objective is to examine judicial approaches to electronic evidence and to determine how earlier judicial principles remain relevant under the new evidentiary framework.
The research also seeks to examine emerging threats such as content generated by artificial intelligence, deepfakes, online financial fraud and digital impersonation.
Finally, the study proposes legal, institutional and technological measures that may strengthen cybercrime investigation while protecting constitutional rights.
Research methodology
This research follows a doctrinal and analytical methodology. The study primarily relies upon statutory provisions, judicial decisions, government publications and other authoritative legal materials.
The major statutes examined include the Bharatiya Nyaya Sanhita, 2023, the Bharatiya Nagarik Suraksha Sanhita, 2023, the Bharatiya Sakshya Adhiniyam, 2023 and the Information Technology Act, 2000.
Important judicial decisions concerning electronic evidence, privacy and criminal investigation are also examined. The research does not claim to present original empirical survey findings. Instead, it analyses the existing legal framework and identifies areas where implementation and institutional capacity require improvement.
Concept of cybercrime in India
Cybercrime may broadly be understood as unlawful conduct involving computers, computer systems, digital networks or electronic communication. The term covers a wide variety of activities. Some offences directly attack computer systems, while others use computers or digital platforms as instruments for committing traditional crimes.
Examples include unauthorised access, data theft, identity-related fraud, online cheating, phishing, cyberstalking, online harassment, financial fraud, ransomware attacks and misuse of social-media platforms.
One of the major characteristics of cybercrime is anonymity. An offender may use fake identities, compromised accounts, virtual private networks or other technological methods to make identification difficult. The investigator therefore cannot always rely upon the apparent identity associated with a digital account.
Another characteristic is the speed with which digital evidence can disappear. A message can be deleted, an account can be deactivated and a server log may become unavailable after a certain period. Consequently, delay at the investigation stage can seriously affect the ability of the prosecution to establish its case.
Cybercrime is also increasingly organised. Criminal groups may divide responsibilities among different individuals, with one person obtaining victim information, another controlling payment accounts and another communicating with the victim. This makes traditional investigation techniques less effective when used in isolation.
The new criminal laws and cybercrime
The BNS, the BNSS and the BSA represent a substantial restructuring of India’s criminal justice legislation. Their significance for cybercrime should not, however, be understood as meaning that the Information Technology Act has become irrelevant.
The Information Technology Act continues to provide specialised provisions dealing with various forms of cyber misconduct.4 At the same time, digital technology may be used to commit offences that are also recognised under the general criminal law.
For example, an online deception may involve elements of cheating, while manipulation of electronic records may raise questions concerning forgery or other offences, depending upon the circumstances.5 Investigators must therefore determine the appropriate combination of specialised and general criminal-law provisions.
The BNS provides the substantive criminal-law framework, while the BNSS regulates criminal procedure and investigation. The BSA deals with the law relating to evidence, including electronic and digital records.6
This three-part framework is particularly relevant to cybercrime because successful prosecution depends not merely on identifying criminal conduct but also on establishing the identity of the accused and proving the relevant facts through legally admissible evidence.
Cybercrime investigation under the new procedural framework
Cybercrime investigation presents unique procedural challenges. In a traditional investigation, the police may identify a physical crime scene and collect tangible objects. In cybercrime, the relevant crime scene may consist of several devices, accounts and remote servers.
A single cybercrime complaint may involve a mobile phone belonging to the victim, a bank account maintained in another State, a social-media account controlled through another device and data stored by a service provider outside India.
This creates problems of jurisdiction and coordination. Police agencies may need to communicate with banks, telecommunications companies, online platforms and other institutions within a short period.
Another problem is the technical competence of investigators. A police officer may have extensive experience in conventional criminal investigation but may not possess sufficient knowledge of digital forensics. Improper handling of a device may alter or destroy relevant evidence.
Cybercrime investigation therefore requires specialised training in areas such as evidence preservation, forensic imaging, metadata, account attribution, network analysis and the digital chain of custody.
Digital evidence under the Bharatiya Sakshya Adhiniyam, 2023
Digital evidence has become central to modern criminal trials. Emails, text messages, call records, CCTV footage, social-media communications, electronic banking records and digital photographs may all become relevant in criminal proceedings.
The difficulty is that electronic information can be copied and modified without leaving obvious physical signs. A screenshot, for example, may show the contents of a conversation, but it does not by itself establish who created the conversation, whether the account was controlled by the accused or whether the material has been altered.
The BSA recognises the growing importance of electronic and digital records.7 Nevertheless, statutory recognition does not eliminate questions relating to authenticity, integrity and attribution.
Investigators must therefore maintain a reliable chain of custody. The circumstances in which electronic material was obtained, preserved, examined and produced before the court may become important during trial.
The Supreme Court’s decision in Anvar P.V. v. P.K. Basheer established important principles relating to electronic evidence under the earlier evidentiary framework.8 The Court subsequently considered the issue in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal.9 These decisions demonstrate the importance of procedural compliance when electronic evidence is relied upon.
The transition to the BSA does not make these principles irrelevant. Instead, earlier judicial experience provides useful guidance for understanding the practical difficulties associated with electronic evidence, while courts must ultimately apply the statutory provisions currently in force.
Chain of custody and authenticity
The concept of chain of custody is particularly important in cybercrime cases. Digital evidence should be collected and preserved in a manner that allows the prosecution to demonstrate that the evidence presented before the court is substantially the same material that was originally obtained.
Forensic investigators should document the circumstances of seizure or acquisition, the devices involved, the methods used for preservation and the persons who handled the material.
A failure to document these steps properly may create questions concerning reliability. This does not necessarily mean that every procedural error automatically destroys the evidentiary value of the material. However, poor documentation may give the defence an opportunity to challenge authenticity or integrity.
Courts therefore need to evaluate digital evidence carefully rather than assume that technologically generated information is automatically accurate.
Privacy and constitutional rights
Cybercrime investigation frequently involves access to highly personal information. A smartphone may contain private conversations, photographs, financial information, location data and information relating to family members and other individuals.
The Supreme Court’s judgment in Justice K.S. Puttaswamy (Retd.) v. Union of India recognised privacy as a fundamental right under the Constitution.10
This principle has considerable importance for digital investigations. The fight against cybercrime cannot become a justification for unlimited access to personal information.
Investigative authorities must operate within the authority granted by law and must ensure that investigative measures are proportionate to the legitimate objective being pursued.11
The challenge is therefore to establish an appropriate balance. The State must possess adequate powers to investigate serious cybercrime, but those powers must be accompanied by safeguards against unnecessary or excessive intrusion.
Cross-border cybercrime
Cybercrime frequently crosses national boundaries. A victim may be located in India while the offender, the service provider or the relevant digital infrastructure is located in another country.
This creates difficulties concerning jurisdiction, investigation and access to evidence. Traditional territorial principles are not always sufficient to deal with crimes committed through global digital networks.
International cooperation is consequently essential. Requests for information, preservation of electronic records and assistance in identifying suspects may require cooperation between different countries.
The effectiveness of India’s cybercrime framework will therefore depend not only upon domestic legislation but also upon international cooperation mechanisms.
Emerging challenges: artificial intelligence and deepfakes
Artificial intelligence (AI) has created new opportunities for both legitimate technological development and criminal misuse.
AI-generated photographs, audio recordings and videos can be used to create convincing false representations. Deepfake technology may be used to impersonate individuals, spread misinformation, commit fraud or damage reputations.
This creates a new evidentiary challenge: a recording that appears genuine may not in fact be genuine.
Investigators and courts may increasingly require assistance from digital forensic experts to determine whether audio, video or images have been manipulated.
The emergence of generative artificial intelligence demonstrates that criminal law must remain technologically responsive. However, the solution should not simply be the creation of new offences whenever a new technology emerges. Existing criminal-law principles, combined with specialised legislation and effective enforcement mechanisms, may often provide a more flexible response.
Online financial fraud
Online financial fraud has become one of the most visible forms of cybercrime affecting ordinary citizens.
Fraudsters may contact victims through telephone calls, social-media platforms, messaging applications or fake websites. They may impersonate bank officials, government authorities, employers or other trusted persons.
The investigation of such offences requires coordination between police authorities and financial institutions. The speed of financial transactions makes immediate reporting particularly important.
Investigators may need to establish the sequence of transactions, identify beneficiary accounts, trace subsequent transfers and connect the accounts with the individuals involved.
The problem becomes more complicated when multiple intermediary accounts are used. Such transactions can make it difficult to identify the ultimate beneficiary.
Cybercrime prevention should therefore include stronger public awareness, rapid reporting mechanisms and improved cooperation between financial institutions and law-enforcement authorities.
Challenges faced by police and investigating agencies
The first major challenge is the shortage of specialised manpower. Cybercrime investigation requires officers with knowledge of both law and technology.
The second challenge concerns forensic infrastructure. Digital evidence may require specialised laboratories and trained forensic professionals.
The third challenge is the rapid development of technology. Criminal methods evolve quickly, while institutional procedures may take considerably longer to change.
The fourth challenge is inter-agency coordination. Cybercrime investigations may require cooperation between local police, cybercrime units, banks, telecommunications providers, technology companies and forensic laboratories.
The fifth challenge is public awareness. Many cyber offences succeed because victims unknowingly provide confidential information or transfer funds after being deceived.
These challenges demonstrate that legislative reform must be supported by institutional reform.
Judicial role in cybercrime
Courts have an important role in adapting established legal principles to new technological circumstances.
The judiciary must determine the authenticity and reliability of digital evidence while ensuring that procedural safeguards are respected.
At the same time, courts must avoid creating standards that investigators cannot satisfy in genuine cases. The objective should be to ensure reliable evidence without making legitimate prosecution unnecessarily difficult.
Judicial decisions concerning electronic evidence, privacy and technological investigations will therefore continue to influence the development of Indian cyber law.
Suggestions and recommendations
India should strengthen specialised cybercrime units and ensure that investigators receive continuous training. Training should not be limited to technical officers, because ordinary investigating officers increasingly encounter electronic evidence in conventional criminal cases.
Digital forensic laboratories should be expanded and adequately equipped. Standardised procedures should be developed for the collection, preservation and examination of electronic evidence.
There should also be stronger coordination between police authorities, financial institutions, telecommunications companies and online platforms.
Cybercrime reporting systems should be made simple and accessible so that victims can report offences immediately.
Public awareness programmes should explain common forms of online fraud and the importance of protecting passwords, authentication credentials and financial information.
At the same time, privacy safeguards must remain an essential part of digital investigation. Investigative powers should be exercised according to law and should be proportionate to the legitimate purpose of investigation.
Finally, India should continue developing international cooperation mechanisms, because cybercrime frequently involves actors, infrastructure and evidence located outside the country.
Findings of the study
The study finds that India’s new criminal laws provide an important legal foundation for dealing with offences committed through or involving digital technology.
However, the principal difficulty lies in implementation rather than merely in legislative recognition.
The effectiveness of cybercrime prosecution depends heavily upon the quality of investigation and digital evidence.
The study further finds that technological development is occurring faster than institutional adaptation. This creates a continuing requirement for training, forensic capacity and procedural improvement.
Another important finding is that cybercrime enforcement must be balanced against privacy and due-process requirements. Strong enforcement and constitutional protection should not be treated as competing objectives; both are necessary components of a legitimate criminal justice system.
Conclusion
Cybercrime represents one of the most significant challenges confronting modern criminal justice systems. The digital environment has changed not only the manner in which crimes are committed but also the manner in which crimes must be investigated and proved.
India’s introduction of the Bharatiya Nyaya Sanhita, the Bharatiya Nagarik Suraksha Sanhita and the Bharatiya Sakshya Adhiniyam provides an opportunity to modernise criminal justice in response to technological developments.
However, the effectiveness of these laws cannot be measured solely by the wording of statutory provisions. Their success will depend upon the ability of police officers, forensic experts, prosecutors and judges to understand and work with digital evidence.
Cybercrime investigation requires speed, technical knowledge and careful documentation. Digital evidence requires authentication, preservation and a reliable chain of custody. At the same time, investigative powers must operate within constitutional boundaries.
The future of cybercrime regulation in India therefore depends upon a combination of legal reform, technological expertise, institutional cooperation and constitutional responsibility. The new criminal laws provide the legal foundation, but sustained investment in cyber-forensics, professional training, public awareness and international cooperation will determine whether India can respond effectively to the rapidly changing nature of cybercrime.
*****
Footnotes
1. The Bharatiya Nyaya Sanhita, No. 45 of 2023, India Code (2023); The Bharatiya Nagarik Suraksha Sanhita, No. 46 of 2023, India Code (2023); The Bharatiya Sakshya Adhiniyam, No. 47 of 2023, India Code (2023).
2. Bharatiya Nyaya Sanhita § 358(1) (repealing the Indian Penal Code, 1860); Bharatiya Nagarik Suraksha Sanhita § 531(1) (repealing the Code of Criminal Procedure, 1973); Bharatiya Sakshya Adhiniyam § 170(1) (repealing the Indian Evidence Act, 1872). The date of commencement, July 1, 2024, was appointed by Ministry of Home Affairs, Notification S.O. 850(E) (Feb. 23, 2024) (Bharatiya Nyaya Sanhita, except § 106(2)), Notification S.O. 848(E) (Feb. 23, 2024) (Bharatiya Nagarik Suraksha Sanhita, except the First Schedule entry relating to Bharatiya Nyaya Sanhita § 106(2)) and Notification S.O. 849(E) (Feb. 23, 2024) (Bharatiya Sakshya Adhiniyam).
3. The Information Technology Act, No. 21 of 2000, India Code (2000).
4. See, e.g., Information Technology Act §§ 43 (penalty and compensation for damage to a computer or computer system), 66 (computer-related offences), 66C (identity theft), 66D (cheating by personation by using a computer resource), 66E (violation of privacy).
5. See Bharatiya Nyaya Sanhita §§ 318 (cheating), 336(1) (forgery, which extends to the making of a “false electronic record”); cf. Information Technology Act § 66D (cheating by personation by using a computer resource).
6. Bharatiya Sakshya Adhiniyam § 2(1)(d) (defining “document” to include electronic and digital records), § 2(1)(e) (defining “evidence” to include statements given electronically and electronic or digital records).
7. Id. §§ 61 (an electronic or digital record is not to be denied admissibility on the ground only that it is such a record), 62, 63 (admissibility of electronic records, including the certificate required by § 63(4) in the form specified in the Schedule).
8. Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473 (India) (holding that secondary evidence of an electronic record is admissible only with the certificate required by Section 65B(4) of the Indian Evidence Act, 1872).
9. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1 (India) (reaffirming Anvar P.V. and holding the Section 65B(4) certificate to be a condition precedent to the admissibility of electronic records produced as secondary evidence).
10. Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1 (India) (holding that the right to privacy is protected as an intrinsic part of the right to life and personal liberty under Article 21 and as a part of the freedoms guaranteed by Part III); see India Const. art. 21.
11. See Puttaswamy, supra note 10 (plurality opinion of Chandrachud, J.) (requiring that an invasion of privacy be sanctioned by law, pursue a legitimate aim and be proportionate to that aim).