Morphed Photo, Two Phones and a 72-Hour FSL Window
A 19-year-old woman complains at a police station at 21:15 that a morphed photograph of her with an obscene caption has been forwarded in a WhatsApp group of 62 members. She brings her Android phone: 38% battery, screen lock set, WhatsApp logged in, screenshots already taken by her. The investigating officer asks the computer operator to (i) print the screenshots from her phone, (ii) delete the message from the group so that it stops spreading, and (iii) send the suspect's phone to the FSL tomorrow. The suspect's phone was seized at 20:00, is switched on with 74% battery, and has been lying unlocked on the IO's desk since then. The FSL is 40 km away and the next forensic pickup is in 72 hours. The operator has a Windows PC, a laser printer, no forensic toolkit, and has never prepared a certificate for electronic evidence.
1. Which legal provisions are relevant, and what must accompany the printouts for them to be usable in court?
Read the worked answer
Substantive law, to be assessed by the IO - the operator's job is to preserve, not to charge:
- Information Technology Act, 2000: s.67 (publishing or transmitting obscene material in electronic form) is the closest fit for the caption and circulation; s.66E (publishing an image of a private area without consent) needs checking against the facts, since the image is morphed; s.66C (identity theft) if a fake profile was used; s.66 if her account or device was accessed without permission. s.67A applies only if the material is sexually explicit.
- The corresponding provisions of the Bharatiya Nyaya Sanhita, 2023 for defamation, obscenity and criminal intimidation replace the old IPC sections; the IO must cite the 2023 section numbers, not the repealed IPC ones.
- POCSO and the JJ Act are not attracted because she is 19.
The printout by itself is weak evidence. An electronic record produced as a printout is admissible only with a certificate under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 (the successor to s.65B of the Indian Evidence Act). The certificate must identify the electronic record, describe the device and the manner of production, and be signed by the person in charge of the device - here the operator - along with the IO. Record the phone make, IMEI, and the time of printing, and note any hash if the tool allows.
Each printout must show the sender's number, the group name and the timestamp. A cropped image without them proves nothing.
2. What should be done with each phone, in what order, and why is deleting the message the wrong instruction?
Read the worked answer
Complainant's phone, first: ask her not to clear chats, and do not delete anything. Put the phone in airplane mode so a remote delete, an expiring message or a re-sync cannot alter what is on it, and keep it charged. Print the screenshots in her presence with the timestamps visible, and photograph the screen with a second device as secondary proof. Note make, IMEI and time in the seizure memo.
Suspect's phone: it was seized on and left unlocked on a desk - that is already a documented chain-of-custody defect, so write down the state as found (powered on, unlocked, 74%, seized at 20:00, first handled at 21:15) rather than trying to look clean. Then isolate it from the network (airplane mode or Faraday bag) and do not browse the contents. Do not switch it off if it may be locked by a passcode nobody knows, because a powered-off encrypted handset can be harder to image; follow FSL guidance, and hand it over against a signed chain-of-custody form.
Why deletion is wrong:
- It destroys the message and its metadata - the forward trail, timestamps, sender identity - which is the evidence itself.
- It may amount to destruction of evidence, and the operator would be the person who did it.
- It does not work: 62 members already hold copies, and the platform holds server copies.
The lawful route is a preservation/legal request to the platform, a direction to the group admin, and requesting members to stop forwarding. Refuse the deletion instruction, politely and in writing.
3. The FSL pickup is 72 hours away. What are the risks in that window, and what would you do about them?
Read the worked answer
Risks in 72 hours: unauthorised access by anyone who picks the phone up; remote wipe or remote logout; WhatsApp re-syncing and overwriting local data once it rejoins a network; battery drain to zero, which can affect some devices' state; and accidental deletion by someone "checking" the group.
Mitigations:
- Isolate both phones from all networks immediately (airplane mode, then a Faraday bag if available) and keep them charged.
- Store them under malkhana entry with a register: who handled, when, why. A phone left unlocked on a desk for an hour is exactly the fact the defence will use.
- Do not use the IO's or the operator's own phone to open the group "just to see" - that creates fresh copies and muddies who saw what.
- Prepare the Section 63 Bharatiya Sakshya Adhiniyam certificate now, so the FSL expert can sign it at handover instead of the paperwork holding up the report.
- If the FSL cannot take it sooner, a dated, witnessed photograph of the device state and a written note of the 20:00 seizure and 21:15 handling is far better than a silent 72-hour gap.
Judgement point: the operator's value here is discipline, not tools. No forensic toolkit is needed to avoid destroying evidence; the damage in this case has already started, and the record of it is what keeps the case usable.