INTRODUCTION
The world that criminal courts must contend with today is inescapably digital. Mobile phone records, computer files, cloud data, these are no longer peripheral to criminal proceedings; they are central to them, featuring in an estimated ninety percent of cases globally.1 Yet for all that prevalence, the deployment of digital evidence before Indian courts remain riddled with procedural failures that successive rounds of legislative reform have not managed to fix.
Two connected arguments run through this article. The first is that India’s current legal framework, despite the genuine progress represented by the BSA and BNSS, still leaves too much unsaid about the technical and procedural requirements for digital evidence admissibility and that ambiguity generates real doctrinal uncertainty. The second is that the failures are not merely legal. Inadequate infrastructure, officers who have never been taught to use write-blockers, judges who find technical expert reports impenetrable: these are the real reasons why otherwise solid evidence collapses at trial.
The article is structured as follows. Part II surveys the key scholarly contributions. Part III examines the AACC principles and chain-of-custody doctrine. Part IV works through India’s statutory framework. Part V analyses the landmark judicial decisions. Part VI identifies the systemic challenges in implementation. Part VII develops a comparative analysis and sets out a proposed four-pillar reform framework. Part VIII offers conclusions and specific recommendations.
LITERATURE REVIEW
Gupta and Das2 provide the most thorough empirical picture of what is actually happening in India’s forensic laboratories. Their account is a sobering one: law enforcement agencies lean heavily on unscientific methods, data collection is poor, and acquittal rates are correspondingly high, with police stations dependent on chronically under-resourced external laboratories. Das and Sarkar3 take a different angle, examining digital evidence from the perspective of its inherent volatility. Because digital material can be altered or destroyed so easily, they argue, authenticity can only be guaranteed through cryptographic hashing and rigorous chain-of-custody documentation. They also identify India’s Section 65B regime, hardened further by Arjun Panditrao4 as a structural vulnerability that makes both overbroad exclusion and arbitrary admission too easy.
Wahab5 offers a careful overview of BSA Sections 61 and 63, recognising them as the statute’s most consequential innovations while being frank about the implementation gaps that forensic infrastructure shortages create. Attry6 reaches the stark conclusion that BSA’s effectiveness is entirely conditional on urgent upgrades to technical standards, infrastructure, and professional training. This article shares that diagnosis and builds on it. Where the existing literature falls short, however, is in not producing a systematic four-pillar reform framework tailored to the BSA-BNSS context, which is precisely what this article seeks to provide.
DIGITAL FORENSICS JURISPRUDENCE: AACC AND CHAIN OF CUSTODY
Digital forensics jurisprudence is concerned with the principles that govern how digital evidence is collected, preserved, analysed, and presented in judicial proceedings. The difficulty, what might be called the “dual nature” problem, is that digital evidence is simultaneously a technological artefact and a legal instrument. Those two roles do not always sit comfortably together, and the tension between forensic science logic and evidentiary law logic has produced much of the doctrinal uncertainty that characterises this area.
The AACC framework, Authentic, Accurate, Complete, Convincing, is the bedrock of digital evidence admissibility, and BSA Section 63 expressly operationalises all four criteria.7 Authenticity means that the evidence must be verified through cryptographic hashing (typically MD5 or SHA-256) and certified under Section 63. Accuracy requires timestamped audit trails and the use of write-blockers during acquisition to prevent metadata corruption. Completeness means the forensic process must be documented sufficiently to allow independent reproduction. And for evidence to be convincing, expert reports must be written in language that judicial officers without technical backgrounds can actually understand, a requirement that is often honoured in the breach.
Chain of custody underpins the entire admissibility framework under the BNSS’s forensic mandates. The chain begins with pre-seizure judicial authorisation, moves through forensic imaging with cryptographic verification, and must be maintained by signed transfer logs, inventory checklists, and court-supervised preservation measures. CERT-In guidelines require documentation of device specifications, storage media condition, and encryption status.8 When this chain breaks, an improper shutdown that alters timestamps, evidence transported in unsealed packaging, the consequences have been severe, with acquittals following in a number of recorded cases. The BNSS’s Section 176 videography mandate and Section 173 reporting requirement address some of this vulnerability,9 but the statute’s silence on technical acquisition standards for live systems leaves an important gap that only alignment with ISO/IEC 27037 can fill.
THE INDIAN LEGAL FRAMEWORK FOR DIGITAL EVIDENCE
BHARATIYA SAKSHYA ADHINIYAM, 2023
The BSA marks a genuine turning point in Indian evidence law. Section 2(1)(d) defines electronic records broadly to include data, images, and sounds stored or transmitted in electronic form, a technology-neutral formulation that captures cloud data and IoT outputs without requiring the legislature to revisit the definition every time a new technology emerges. Section 63 goes further, elevating electronic records to primary evidence status, but subject to four conditions that a responsible official must satisfy: hash-value disclosure, documented chain of custody, formal certification, and (where applicable) a valid digital signature.10 These conditions are the statutory embodiment of the AACC criteria.
Before the BSA, courts were working with the Indian Evidence Act of 1872, a statute designed for paper documents, and applying its rules to digital material with increasingly strained results. The BSA corrects that structural anachronism, though Section 61’s empowerment of courts to appoint independent technical experts11 comes without any prescribed qualification standards for those experts. That lacuna will need to be filled by subordinate legislation aligned with ISO/IEC 27037. And the infrastructure problem remains stubbornly acute: fewer than thirty percent of state forensic laboratories are currently equipped to carry out the hash-value verification that Section 63 requires.12
B. Section 65B Certification Under the IT Act
Section 65B of the Information Technology Act, 2000 has long been the main legal gateway for electronic records.13 the story of its judicial evolution is instructive. In State (NCT of Delhi) v. Navjot Sandhu,14 the Supreme Court took a permissive approach, allowing oral evidence to supplement the formal certification requirement. Anvar P.V. v. P.K. Basheer15 overruled that approach in unambiguous terms: a five-judge Constitution Bench held that the Section 65B(4) certificate is a condition precedent to admissibility, not an optional formality. No certificate, no admissibility, regardless of the underlying quality of the evidence. Arjun Panditrao Khotkar16 reaffirmed the mandatory character of the certificate while introducing some equitable flexibility for cases where obtaining certification is genuinely beyond the producing party’s control. What the BSA adds to this picture, the mandatory hash-value disclosure requirement, represents a materially higher evidentiary standard, moving from attestation to actual cryptographic verification.
C. BNSS Forensic Investigation Mandates
The BNSS does something its predecessor, the Code of Criminal Procedure 1973, conspicuously failed to do: it integrates digital forensics requirements directly into the investigative framework. Section 176 mandates crime scene videography for offences carrying sentences of seven or more years’ imprisonment, creating a supplementary chain-of-custody record from the earliest stage of investigation. Section 173 requires forensic reports to be submitted within seven days, a timeframe that is aspirational at best given that laboratory backlogs in several states already exceed eighteen months.17 Section 193 requires forensic experts to appear as witnesses subject to cross-examination, which should in principle create stronger incentives for meticulous methodology documentation. Whether it does so in practice remains to be seen.
JUDICIAL PERSPECTIVES: FROM NAVJOT SANDHU TO ARJUN PANDITRAO
The arc from Navjot Sandhu18 through Anvar P.V.19 to Arjun Panditrao20 tells the story of India’s courts moving from ad hoc accommodation of electronic evidence to a disciplined, certification-centred admissibility regime. The shift was necessary. But the strictness of Anvar P.V.’s exclusionary rule proved, in practice, more disruptive than reformative. Defence lawyers quickly realised that Section 65B compliance challenges could be deployed as a technical weapon against evidence of unimpeachable quality, not to contest genuine authenticity, but simply to keep good evidence out on procedural grounds. Arjun Panditrao’s equitable relaxation corrected the worst of this formalism without abandoning the core integrity-verification rationale, and that balance is broadly right.
Both decisions do, however, remain anchored in a conception of electronic evidence that predates cloud computing, distributed storage, and end-to-end encrypted communications. In contemporary digital investigations, the requirement to identify a single “responsible official” capable of certifying a computer system becomes increasingly difficult to satisfy when records are generated by automated processes running across servers in multiple jurisdictions. Non-compliance with Section 65B certification remains among the primary causes of acquittals in cybercrime prosecutions, a problem compounded by the fact that many investigating officers simply do not know what the certification requirement entails, and by the disruption to certification continuity that routine officer transfers produce.
The cybercrime prosecution record in India’s northeastern states makes this painfully concrete. NCRB data for 2019–2023 shows conviction rates in these states consistently below ten percent, against a national average that is itself only around twenty-six percent, reflecting compounded failures in Section 65B certification, metadata preservation, and cross-border evidence collection. Cases involving transnational cybercrime syndicates operating across the India-Myanmar border illustrate how close to impossible it is to obtain internationally compliant digital evidence within India’s current framework.
SYSTEMIC CHALLENGES IN DIGITAL FORENSICS IMPLEMENTATION
India has approximately thirty state forensic science laboratories and one hundred seventy regional ones. The picture they present is not encouraging. Fewer than forty percent have functioning digital forensics divisions equipped with industry-standard tools like EnCase or FTK.21 Most equipment has not been updated since it was first procured, meaning it predates smartphones and cloud storage, which are now the primary sources of digital evidence in virtually every case. Fewer than fifteen percent of investigating officers have received any formal training in write-blocking, hash verification, or Section 65B certification.22
Cross-border evidence presents a separate and equally intractable set of problems. An estimated seventy to eighty percent of cybercrime digital evidence sits on servers operated by foreign cloud providers. India’s mutual legal assistance treaty (MLAT) process with the United States takes between ten and eighteen months to complete, wholly impractical for cybercrime investigations where evidence can be deleted within hours of a preservation request. End-to-end encryption adds another layer of difficulty: even where investigators have gone through all the right legal channels, server-side data from platforms like WhatsApp or Signal is cryptographically inaccessible without device-held decryption keys. India has not enacted anything comparable to the United Kingdom’s Investigatory Powers Act, 201623 or Australia’s Assistance and Access Act, 2018.24
At the judicial level, technology literacy gaps continue to produce legal principles that are technically ill-founded. The Navjot Sandhu decision, which allowed oral testimony to substitute for cryptographic verification, is the paradigmatic example of a court reaching a conclusion that simply did not reflect how digital evidence works. The National Judicial Academy has introduced digital evidence modules, but coverage is limited and the content does not update quickly enough to keep pace with technological change.
COMPARATIVE ANALYSIS AND A PROPOSED HARMONISED FRAMEWORK
INTERNATIONAL STANDARDS AND COMPARATIVE FRAMEWORKS
ISO/IEC 27037:201225 is the most comprehensive internationally recognised technical framework for digital evidence handling. What makes it particularly valuable for India’s purposes is its reproducibility requirement: forensic documentation must be sufficient to allow an independent examiner to replicate the process and arrive at identical results. That standard directly addresses the examiner-to-examiner variation that is endemic in Indian forensic practice.
India’s BSA 2023 incorporates elements of ISO/IEC 27037 through Section 63’s hash-value verification requirement, but it does not formally adopt the standard. The most instructive international comparator is the United Kingdom’s framework, grounded in the Police and Criminal Evidence Act, 198426 and strengthened by the Forensic Science Regulator Act, 2021.27 The FSR issues Codes of Practice that require ISO/IEC 17025 laboratory accreditation and compliance with Digital Forensics Specialist Group standards, creating a quality assurance gate that operates across the entire system. India has no equivalent independent regulatory body. The NABL accredits forensic laboratories against general quality management standards but exercises no sector-specific oversight of digital forensics practice.
The United States federal framework, by contrast, takes a technology-neutral approach under Rule 901 of the Federal Rules of Evidence,28 permitting authentication through any means sufficient to establish the evidence’s identity. The flexibility this creates is checked by Daubert29 standards for expert testimony, which enable adversarial challenges to forensic reliability. India currently sits in the middle of these two models, combining statutory certification requirements with nascent accreditation infrastructure, without the comprehensive regulatory oversight of the UK or the well-developed adversarial quality assurance of the US. The most promising reform pathway is one that develops both dimensions simultaneously.
B. A Four-Pillar Harmonised Framework
The following four-pillar framework is designed to address systemic weaknesses while building on what the BSA and BNSS have already put in place.
Pillar One, Statutory National Digital Forensics Regulator (NDFR). India needs a statutory NDFR modelled on the UK’s FSR, with functional independence protected through security of tenure for its leadership. The NDFR would prescribe mandatory quality standards for forensic laboratories and practitioners aligned with ISO/IEC 27037 and ISO/IEC 17025; operate a publicly accessible register of accredited laboratories and examiners; investigate complaints about forensic quality in criminal proceedings; and issue binding guidance to courts on the reliability of specific forensic methodologies.
Pillar Two, Technical Standardisation. ISO/IEC 27037 should be formally adopted as the mandatory reference framework for digital evidence handling through subordinate legislation under the BNSS. The subordinate legislation should specify that BSA Section 63 certification is only valid where the underlying forensic examination complied with ISO/IEC 27037 procedures. A prescribed certificate template, with mandatory fields for hash value, acquisition tool, examiner credentials, methodology summary, and chain-of-custody documentation, would eliminate the quality variability that currently makes Section 65B compliance so unpredictable.
Pillar Three, Systematic Capacity Building. Mandatory digital evidence handling certification should be introduced for all investigating officers within a defined transition period. Each state police force should establish a dedicated cybercrime investigation unit with appropriate staffing and equipment. A Judicial Digital Evidence Training Programme should be administered by the National Judicial Academy, providing foundational literacy for all judicial officers and advanced training for specialist High Court panels dealing with technology-intensive criminal cases. And in cases where digital evidence is disputed, defence legal aid must be extended to cover forensic expert access, without this, the asymmetry between prosecution and defence forensic resources will continue to undermine fair trials.
Pillar Four, Targeted Procedural Reform. BSA Section 63 should be amended to prescribe minimum certification content and to create a presumption of admissibility for records certified in accordance with prescribed procedures, reducing the scope for purely technical exclusion challenges that have nothing to do with the reliability of the underlying evidence. The BNSS should be amended to establish a dedicated cross-border digital evidence collection framework, including expedited judicial authorisation for preservation orders directed at foreign entities and a fast-track mutual legal assistance mechanism for cybercrime cases. Finally, a technical assistance framework should be enacted to require end-to-end encryption providers operating in India to offer lawful access mechanisms for specified categories of serious crime, subject to judicial oversight and proportionality review.
CONCLUSIONS AND RECOMMENDATIONS
The BSA 2023 and BNSS 2023 together represent the most ambitious statutory framework for digital evidence admissibility that India has produced. Elevating electronic records to primary evidence status, codifying the AACC criteria through Section 63’s hash-value verification and certification requirements, these are real advances. But the gap between what these statutes promise and what is actually happening in investigation rooms, forensic laboratories, and courtrooms across the country is stark, and it will not close on its own.
Four principal conclusions flow from this analysis. First, legislative reform alone cannot produce reliable digital evidence admissibility; it must be matched by genuine investment in forensic infrastructure and the people who operate it. Second, India’s courts have shown they are capable of developing technically grounded evidentiary doctrine, Anvar P.V. and Arjun Panditrao both demonstrate this, but only when judges have access to technical expertise, which current training provisions do not systematically ensure. Third, India’s reform path lies in a hybrid institutional model that combines the UK’s regulator-driven accreditation approach with a stronger adversarial quality assurance function. Fourth, digital evidence failure is not merely a technical problem; it is the systemic outcome of institutional underinvestment, and its costs fall disproportionately on communities that are already marginalised, as the northeastern cybercrime prosecution record demonstrates.
The specific recommendations that emerge from this analysis are: (i) enact a statutory NDFR with binding standard-setting, accreditation, and oversight functions; (ii) formally adopt ISO/IEC 27037 as a mandatory reference standard through subordinate legislation; (iii) introduce mandatory digital evidence certification for all investigating officers; (iv) establish a Judicial Digital Evidence Training Programme and specialist High Court panels for technology-intensive criminal cases; (v) amend BSA Section 63 to prescribe standard certification content and create an admissibility presumption for compliant certificates; (vi) enact a cross-border digital evidence framework within the BNSS; and (vii) extend defence forensic expert access through legal aid in cases involving disputed electronic evidence. Implemented together, these reforms would give the BSA and BNSS the institutional infrastructure without which their progressive promise will remain largely unrealised.
*****
Footnotes
1. National Crime Records Bureau, Crime in India 2022 (Ministry of Home Affairs 2023) [hereinafter NCRB 2022].
2. Sadhna Gupta & Meghali Das, Criminal Investigation of Electronic Evidence and Challenges Faced with Digital Forensics, J. Forensic Sci. & Crim. Investigation (July–Dec. 2023).
3. Pratyusha Das & Pradeepta Sarkar, The Importance of Digital Forensics in the Admissibility of Digital Evidence, 7 J.L. & Tech. (Issue II) (2023).
4. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1 (India).
5. M.I. Wahab, Bharatiya Sakshya Adhiniyam, 2023: An Overview of Key Amendments, Int’l J. Multidisciplinary Res. (2024).
6. Parth Attry, Bridging Legal Rigour and Technological Constraints: Analysing Deficiencies in Digital Evidence Handling under the Bharatiya Sakshya Adhiniyam 2023 (2025) (unpublished manuscript).
7. BSA § 63 (requiring hash value disclosure, chain of custody documentation, and official certification for electronic records as primary evidence).
8. CERT-In, Digital Evidence Investigation Manual (Ministry of Electronics and IT, 2014).
9. BNSS §§ 173, 176.
10. BSA § 63.
11. BSA § 61.
12. NCRB, Crime in India 2023, Ch. 19 (Ministry of Home Affairs 2024).
13. Information Technology (Amendment) Act, 2008, No. 10 of 2009 (India) (inserting § 65B into the IT Act).
14. State (NCT of Delhi) v. Navjot Sandhu, (2005) 11 SCC 600 (India) (overruled on this point by Anvar P.V.).
15. Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473, 24 (India).
16. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1, 54–56 (India).
17. NCRB 2022, supra note 8 (documenting pendency exceeding 18 months in several states).
18. State (NCT of Delhi) v. Navjot Sandhu, (2005) 11 SCC 600 (India).
19. Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473 (India).
20. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1 (India).
21. Parliamentary Standing Committee on Home Affairs, Cybercrime: Challenges and Framework 22 (Lok Sabha Secretariat 2022).
22. BPR&D Survey, supra note 4.
23. Investigatory Powers Act 2016 (UK) c. 25.
24. Telecommunications and Other Legislation Amendment (Assistance and Access) Act 2018 (Cth) (Austl.).
25. ISO/IEC 27037:2012, Information Technology, Security Techniques, Guidelines for Identification, Collection, Acquisition and Preservation of Digital Evidence (Int’l Org. for Standardization 2012).
26. Police and Criminal Evidence Act 1984 (UK) c. 60.
27. Forensic Science Regulator Act 2021 (UK) c. 22.
28. Federal Rules of Evidence r. 901(a), (b)(9) (2023).
29. Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993) (establishing the standard for admissibility of expert scientific testimony in federal courts).