Webinar on 16th April

Posted in Cyber Law | Leave a comment

PDPA Book Reviewed at India Legal

The book is a manual for privacy activists, advocates, IT professionals, business managers, law enforcement officers and the government for comprehending the complex issues of personal data usage.

It not only explains the Act but discusses the different perspectives that make professionals draw inferences of the legal provisions. The author, Naavi, is a pioneer in cyber law, the author of several books on cyber law and cyber crimes and a visiting faculty at many premier law institutes in the country.

.…India Legal, April 20, 2020

 

Posted in Cyber Law | 1 Comment

Privacy Protection Through Data Protection..Webinar from FDPPI

If interested in attending the webinar, please send e-mail to fdppi@fdppi.in

Naavi

Posted in Cyber Law | Leave a comment

Excusing Section 65B certificate has to for the right reasons only…

The Dharwar bench of Karnataka High Court had on 25th October 2019 decided an appeal regarding dissolution of marriage in which certain references have been made to Section 65B of Indian Evidence Act. Hence the case is briefly discussed here.

Detailed judgement is available here

The appeal related to a challenge to the earlier family court judgement of 30th July 2013 by the wife who had allegedly committed adultery.

While the wife had several counter allegations including charge of attempt to murder, domestic violence etc., what is important for us is that the husband had produced certain digital evidence which was a recording made through a hidden digital camera in the house which had captured the adulterous behaviour of the wife.

The wife alleged that the DVD was created by morphing the images . It may be noted that the trial of this case occurred prior to 2013 when the Judiciary was not fully conversant with the Section 65B provisions.

This was a case where the adultery was sought to be proved with the DVD and there was perhaps compelling ancillary evidence to prove adultery and the DVD was perhaps one such evidence.

However, the procedural aspects of Section 65B which was perhaps not followed was a hindrance to the admission of the DVD. The Court however took the stand that in the case of adultery, it is not possible to get direct evidence and the court has to rely upon collateral evidence.  Hence the Court took a lenient view of the standard of evidence and decided to accept the evidence despite (as per indications) no certificate had been produced under Section 65B.

In the process of justifying the decision, the Court did make comments and references and to the Shafi Mohammed case which perhaps were not necessary. The Court could have arrived at its judgement even without such comments. The Court should have been bold enough to uphold the evidence on the basis of its conviction derived from circumstantial evidence.

We have no specific comment on the final judgement which perhaps was the justice that the respondent deserved. However we need to record that some of the comments made within the judgement on Section 65B need to be flagged as unwarranted.

We consider that the statement

“It is equally well settled preposition of law that electronic evidence by way of primary evidence is covered under Section 62 of the Evidence Act to which the procedure prescribed under Section 65-B of evidence act is not applicable”,

is not a correct view.

To justify the decision to ignore the non availability of the Section 65B certificate, the Court has taken the excuse of the Shafi Mohammed judgement which itself was a judgement of convenience.

Even the Afzal Guru judgement was one such judgement where the gravity of the offence required the Court to ignore some procedural niceties in the interest of justice. The P V Anvar Vs P.K Basheer judgement called out the Afzl Guru judgement.

We would have been happy if the Court as in the case of Sonu@Amar Vs State of Haryana taken the responsibility on itself and built a case for ignoring the procedure rather than creating a dubious precedent which in the context of the Shafi Mohamed judgement having been referred to a higher bench and the Basheer judgement being of a larger bench, appears questionable.

It is not clear what the Court has considered as “Primary Evidence” to which Section 62 is applicable and “Secondary Evidence” to which Section 65B is applicable.

The judgement has also quoted Ramsingh and others vs Col Ram Singh (Supreme Court order of 7th August 1985) to come to a conclusion that “It will be wrong to deny to the law of evidence advantages to be gained by new techniques and new devices provided the accuracy of the recording can be proved”.

In the light of the above,  the Court has exercised its discretion to accept the evidence without Section 65B certificate and using the oral evidence on an electronic document as it was done in the case of Afzal Guru  judgement.

The Court also observed that the contents of the DVD has not been disputed by either of the parties. This would have been sufficient to accept them despite lack of procedural formalities under Section 65B.

The fact that the appellants have not been able to adduce evidence that the DVD was morphed was also a factor under which the evidence could have been accepted without the unwarranted comments invoking Shafi Mohammed judgement.

To conclude, that we may agree that the final order was perhaps correct but the recording of the justification in the detailed judgement was in-correct and was avoidable. We hope that the circumstances under which these comments were made by the honourable judge would always be remembered when this judgement is quoted as a precedent elsewhere.

This should not be considered as a validation of the Shafi Mohammed judgement.

Before we conclude our comments, we need to add a few words on the discussion of “Primary” and “Secondary” evidence that Courts often allude to in respect of electronic evidence.

In the case of electronic evidence, the “Primary Document” is the one which captured the first impressions of what constitutes a document. Most often we have a media like the DVD which is touted as the “Primary Evidence”. But the DVD is a container of several electronic documents of which bits/bytes numbered “………..” represent the impugned document which is presented as evidence.

This “Primary sequence of binary bits” which constitute the document may be scattered around the DVD in different sectors and is recognized as a single document because there is an index table which is read by the computer first to bring together all the relevant data sectors in a sequence and show it as an ascii text or an image. This is a “Rendition” of the binary bits subject to some protocol without which the binary bits cannot depict any evidence.

In the case of a DVD, the binary sequence is recorded as “abc.avi” or some such file perhaps when the recording was terminated manually or automatically (on say hourly basis or otherwise) as it is programmed. Each such file is having a header information identifying how the record can be read by another computer. It is only because of this header information that is inserted into the document that the document displays as a video when played in a computer with the compatible software and hardware. Without such header information and the compatible software and hardware, the “Primary Evidence” is just a bundle of zeros and ones and there is no image or text which the human can see. What the human sees as “Evidence” is what the software wants him to believe.

Section 65B tries to bring in a human who confirms what software and hardware was used to convert the binary sequence into a human viewable document. Without such a human intervention, anything can be produced as evidence and false evidences can get admitted at the trial stage. It is for this reason we have called Shafi Mohammed judgement as a tragedy.  In the instant case justice might have been done by ignoring Section 65B certificate. But if this is used as a vindication of Shafi Mohammed, then false evidences will go into Courts against honest counter parties. This cannot be accepted.

The so called “Primary Evidence” which is a sequence of binary bits derive meaning only with the header information and along with the DVD player which can show it as a video that the Judge or any other person can view. This primary evidence is always seen as an image rendered on the screen of a computer as a secondary document and not as zeros and ones (by a human being). This can be saved again on another media and can be accompanied by a “Contemporaneous Section 65B Certificate” (Refer S Tiwari Vs Ajay Arjun Singh). What can be taken as admissible evidence is the Section 65B certified copy and not the original. The container where the original document resides can always be held by the Court as a property so that further copies can be extracted directly.

We should not confuse with the “Primary evidence” referred to under Section 62 of IEA with the DVD which is the container of the primary evidence.

Just as in  a copy of a printed book, every copy is the original, and only a xerox copy is the secondary copy, in the case of electronic document, every copy which we see or hear is “secondary” and the primary copy is only available for rendering a human viewable secondary copy and not for direct viewing/presentation.

The secondary copy in the case of an electronic document should not be confused with the copies made by a mechanical process referred to under Section 63(2).

I am aware that judges who have all through their life discussed primary and secondary evidence in a non electronic context find it extremely difficult to unlearn their present understanding and appreciate the view point expressed here.

I am also aware that some of the prominent lawyers may also agree more with the the Court’s view of the secondary document being a CD or a second DVD while the first DVD which captured the image first is the “Primary Evidence” and not a container of primary evidence.

I respect all their views and their own logic to come at such views. But we stand by our differential view in this matter and  leave this as a point of Cyber Jurisprudence awaiting some other future judgement to clarify this matter.

Naavi

 

Posted in Cyber Law | Leave a comment

Compliance of digital signature systems with Indian law

India has adopted the digital signature law as per Information Technology Act (ITA 2000) and declared it to be the only form of authentication of an electronic document recognized in India.

Initially there was Section 3 which adopted a system that uses hashing of a document and encrypting the hash with the private key of the person as the method of authentication.

The created “digital signature of a document of a person” was therefore …

The hash value of the document encrypted with the private key of the person”.

This digital signature file has to be embedded with the document to create an integrated digitally signed document. (Please refer to an example of incorrect use of digital signature by ICICI Bank in 2004)

Subsequently ITA 2000 was amended and Section 3A was added to introduce an “Electronic Signature” which was technically not much different from Section 3 description. In around 2015 and later in 2016, rules were framed for “E-Sign” as an alternative means of authentication of electronic documents. E-Sign technically was similar to digital signature except that the certificate was one time use certificate issued on a real time basis with an e-KYC done through Aadhaar.  I have earlier discussed certain aspects of e-Sign which I am not going to repeat here.

At this point of time, my attention was drawn to the practice of some Indian companies using “Docusign” and “AdobeSign” and using the term “Electronic Signature” for them. I have earlier expressed my strong views against FIDO system 

I have no issues with the use of document management systems along with the authentication methods which may be proprietary to any commercial entity whether it is FIDO or Microsoft or Adobe. However when companies are looking at these solutions they should not be confused with the use of the term “Electronic signature” and think they are following a system which has the approval of the Indian judicial system.

Both Microsoft and Adobe have made their MS Office and Adobe reader compatible to Indian system in a different way. But  the system where they use a hand written signature on a mobile or tablet or a touch sensitive key board may not meet the Indian legal standards . To the extent there would be a provision to import the Indian Digital signature certificate like the system used in MS Office or Adobe reader (new version) or Adobe Acrobat, it would be compatible with the Indian law.

Docusign as well as AdobeSign may require the document to be uploaded into the server and probably a copy would be retained there with the meta data.  If so, there would be a confidentiality/Privacy issue which is a separate matter to be dealt with. In case the service provider is only capturing a hash value of the document to be signed without it being uploaded to the server and then retaining the meta data along with the hash value of the document, the confidentiality concern may not be there.

However, in the digital signing process, if the private key of the service provider is used or a PGP key or a private key generated in a cloud based HSM system, the requirements of ITA 2000/8 does not get satisfied.

It is interesting to note that the website of docusign.in liberally quotes ITA 2000 and says eSignature is recognized  in India since 2000. It makes a reference to Section 3, Section 1(4) and Section 3A, as well as Section 65B of Indian Evidence Act in its summary. However the references mislead the visitor to the website to believing that the Docusign system is compatible to ITA 2000. This needs to be corrected.

These systems take the advantage of the fact that even an “Undigitally signed” electronic document is recognized in law. If there are associated information that provides more corroboration to the undigitally signed electronic document, it will be like a “Witnessed” document and will be better than not having been not so authenticated. So The docusign or AdobeSign documents fall in between the undigitally signed documents and digitally signed documents.

The Courts have two options to deal with the documents using these “Systems which are not legally recognized in India”. The first is to consider the document as a “Oral Statement duly witnessed”. They can be produced in the Courts with Section 65B certificates.

The second option is to reject the admissibility of the documents since they are neither Section 65B certified nor digitally signed.

Naavi uses a system of CEAC-Dropbox which uses the Section 65B certification along with the metadata captured by the trusted third party.

If the Courts accept the docusign or Adobe sign documents as equivalent to digitally/electronically signed documents under Section 3 or 3A, then the Courts will be acting outside the ITA 2000. It may be recalled that there was a time when Banks used to take Safe Deposit Locker agreements without any stamps affixed and a standard procedure to pay a penalty when the documents were required to be presented to the Court. The Courts (This is a 1970’s judgement probably by the Karnataka High Court against State Bank of India) took the view that this would amount to cheating the Government of the revenue and hence the regularization of the document with penalty should not be allowed as a matter of routine.

This principle should also be applied here and Courts should not permit the companies like docusign or AdobeSign or FIDO to provide services which render the services of licensed Certifying Authorities meaningless.

In the current scenario where Companies are resorting more and more to use of online documents, there is an increased interest in e-Sign and digital signatures. The Companies should put in place an E-Sign API so that any user who is required to submit a digitally signed document can use their Aadhaar number and affix their signatures as they do in case of the filing of IT return or MCA return. The Company itself should issue secured digital signature dongles to their employees, make them download their own digital signatures and use them when they have to issue digitally signed documents on behalf of the company. The designation and representative capacity of the signer can be embedded in the digital certificate as a parameter.

The cost of implementing these systems is low and should not be a constraint.

Besides these, the users can use their own digital signatures either for e-mail or for documents by using desktop e-mail applications such as outlook/Mozilla (for e-mails) and MS Office and Adobe Acrobat/Adobe DC for pdf documents.

Additionally, there are stray companies like Odessey Technologies Ltd in Chennai which did develop desktop solutions for applying digital signatures either once on a document or sequentially be multiple persons using Indian digital signature systems. Companies should explore this Make in India option and develop their document management system instead of using systems which are legally not completely acceptable. Even this company which is quite old and in a way was a pioneer in the area is not marketing its services to the individuals and is focusing only on Banks.

There is a need for some innovative companies to start developing solutions which can be used by every individual desktop user and a mobile user which are also compatible to Indian law. Ujvala Consultants Pvt Ltd of Naavi and another Software company developed a tools called “Ujvala-Bellur digi sign”  tool which was for the specific purpose of compliance with Section 7A of ITA 2000/8. This was not seriously marketed but proved that such tools are not rocket science to develop and many large companies may be able to develop such tools in-house.

Probably the Corona lock out is the right incentive for such companies and technology enthusiasts to develop such tools  which have not been developed since 2000 when the law of digital signature became a reality in India.

Naavi

Posted in Cyber Law | Leave a comment

A prototype of E Courts was ready in 2010 and has become relevant now in the Corona lock down situation

The extended lock down of businesses due to the Corona virus has given a boost to the use of Digital Media for interaction. Even the Courts which were hesitant to use video conferencing despite repeated nudges from experts and easy availability of solutions have now yielded and would be using video conferencing for court hearings.

Naavi had been promoting the ODR (Online dispute resolution) system through www.odrglobal.in which used the video conferencing along with Section 65B certification to ensure that the sessions are legally admissible as evidence.

Presently the Supreme Court is working on a procedure for E-Hearings and it can directly adopt the procedure suggested by the undersigned in odrglobal.in. Apart from what is presented in the website of ODR Global, Naavi had presented a E-Court system which had been taken to the Technical committee of the Supreme Court by one of the partners.

I would like the Supreme Court and any service provider who would like to structure the service to the Court to go through the following three links for an understanding of the suggested methodology.

Link 1: Link to the service page in arbitration.in website

Link 2: The link to the demo page with DSC based log in was also provided as indicated here.

Link 3: The dummy court room/arbitration room was indicated here.

The above web pages were created long time back (The domain name arbitration.in was created some time in 2005). The demo itself was made to the Supreme Court perhaps some time in November  2010 when the undersigned was ready with the prototype. (The actual presentation was made by a representative of E Mudhra/3i-CSL and I was not allowed to directly meet the committee. Whoever  made the presentation did not succeed in convincing the committee).

The tragedy was that neither the Courts nor the IT savvy companies could foresee the potential of what I was suggesting. Even when I relaunched the online arbitration service as ODRGLOBAL (www.odrglobal.in) there are still techies and legal experts who are unable to see the utility of the system.

It is therefore a good feeling now that at least after 10 years since the idea was first promoted, and thanks to Corona, the Supreme Court is considering some mechanism for online hearings.

However, I am still convinced that the Court and their advisers may not appreciate the need for digitally signed log in and Section 65B certification that the service presented by me involved.

I can still claim the IPR for this combination of using the website, video conferencing, digital signature based log in and Section 65B certification as a solution which can be used either for E Courts or for private arbitrations. If some company is interested in developing this service on commercial basis, I can provide the necessary assistance.

I was forced to look back on this history because my attention was drawn to the use of digital signatures in the current corona crisis. I will express my views on the digital signature in the following article.

Naavi

 

 

Posted in Cyber Law | Leave a comment