How the Bharatiya Sakshya Adhiniyam, 2023 turned a forensic technique into a statutory requirement. Includes a practical guide to checking hashes with GtkHash.
Introduction
A pen drive or a CCTV clip reaches the courtroom as a bare file. It looks the same whether it is genuine or edited. The law therefore needs a way to show that the file produced in court is the same file that was seized or extracted. That way is the hash value.
The Supreme Court has described a hash value as "synonymous with an electronic fingerprint" that gives "a sure way of identifying and verifying digital data". A hash is produced by running a file through an algorithm such as MD5, SHA-1 or SHA-256. Changing even one bit of the file produces a completely different hash.
From Section 65B to Section 63 BSA
Under the old Evidence Act, Section 65B(4) required a certificate for electronic records. In Anvar P.V., and again in Arjun Panditrao Khotkar (2020), the Supreme Court held that the certificate is a condition precedent to admitting secondary electronic evidence such as a CD, VCD or pen drive. Oral evidence cannot replace it. The Court also held that no certificate is needed if the original device is produced and proved in the witness box . Where the party doesn't control the device, the Court said such a party cannot be asked to produce the certificate . If a custodian refuses to give a certificate, the party can apply to the court to summon it .
The older certificate did not require a hash value. The Bharatiya Sakshya Adhiniyam (BSA), 2023 changed that. Section 63(4) now requires a certificate in the form set out in the Schedule. The certificate has two parts:
- Part A, filled by the party or person in charge of the device, must contain the hash value of the electronic record and the algorithm used (SHA-1, SHA-256, MD5 or another "legally acceptable standard"). The hash report must be enclosed with it .
- Part B, filled by an expert, certifies the technical matters, including the integrity of the record and the hash function used.
One commentary argues that leaving out the hash value from Part A is not a mere irregularity, because it fails a mandatory admissibility condition. It also says that a mismatch between the certificate hash and the hash of the record produced in court seriously damages the integrity of the evidence . That is the author's view and not a settled court ruling, so confirm it against the case law before relying on it.
Constitutional Validity Upheld (2026)
A three-Judge Bench of the Supreme Court (Surya Kant CJ, Joymalya Bagchi and Vipul M. Pancholi JJ) in the case of Pune Bar Association Vs Union of India and Others upheld Section 63(4) BSA against a challenge of manifest arbitrariness. The Court reasoned that disclosing the hash value serves the purpose of verifying authenticity and integrity, and that expert certification in Part B adds "an additional layer of authenticity".
The Court also dealt with who may sign Part B. It said the Madras High Court's view in R. v. B. (that only an Examiner of Electronic Evidence notified under Section 79-A can sign) is not binding precedent. A person with special skill in computer science and cyber forensics may also qualify as an expert if the court is satisfied on unimpeachable material. The Court left the final question open for a suitable case.
Where BNSS Fits In
Section 94 of the Bharatiya Nagarik Suraksha Sanhita (BNSS) came into force on 1 July 2024 and replaced Section 91 CrPC. It allows a court or a police officer in charge to require production of documents and electronic communication, including communication devices likely to hold digital evidence.
Practice guides link this to a handling routine. The original storage is hashed before anyone accesses it, then imaged on a write-blocker, and the original is sealed. A chain of custody form is signed at every hand-over, and the court or parties check that the hash of the produced clone matches the hash of the original .
Verifying a Hash with GtkHash
Lawyers don't need to be forensic experts to run a basic check. GtkHash is a free desktop tool for Linux and Windows that computes MD5, SHA-1, SHA-2, SHA-3 and BLAKE2 hashes .
- Install it (
sudo apt install gtkhashon Linux) . - Select the file, for example the CCTV video or the image of the pen drive.
- Tick the algorithm named in the Part A certificate.
- Paste the certificate hash into the Check field and click Hash.
- Save or screenshot the result, with the date and time, for the record .
An exact match shows the file in court is identical to the one that was hashed. A mismatch is a ground to object to admissibility, or to ask the court to send the item to a forensic laboratory.
Practical Takeaways for Advocates
- Check the certificate first. Look for a Part A with a hash value and an algorithm, and a Part B signed by a person who qualifies as an expert.
- Check the object. The hash of a single video file is different from the hash of a full pen drive image. Confirm which one the certificate refers to.
- Check the timing. A match proves the file is unchanged since it was hashed. It does not prove the footage was authentic before then, so ask when, by whom and on what device the first hash was taken.
- Watch for re-exports. Converting or re-saving CCTV footage changes the hash even if the video looks the same. A mismatch may therefore be explained by a re-export, which the chain of custody should show.
- Ask for the hash report. The Schedule requires it to be enclosed with the certificate.
Conclusion
The hash value connects the seizure memo, the forensic lab and the courtroom into one verifiable chain. Under Section 63 BSA it is now a statutory requirement. Advocates on both sides should check hashes as routinely as they check signatures and dates.
Disclaimer: this article is for general information and is not legal advice.
Print Page
No comments:
Post a Comment