IO liable for leaking private data from mobile phones, computers of accused to third parties without court's permission: Karnataka High Court

The Karnataka High Court recently held that an investigating officer has no right to disclose the private data seized from the smartphones or electronic gadgets of an accused to a third party, without the written permission of the concerned court (Virendra Khanna v. State of Karnataka). .A single-judge of Justice Suraj Govindaraj further held that an investigating officer who leaks such private data to a third party should be proceeded against for dereliction of duty or delinquency.."The responsibility of safeguarding the information or data which could impinge on the privacy of the person will always be that of the investigating officer, if the same is found to have been furnished to any third party the investigation officer would be proceeded against for dereliction of duty or such other delinquency as provided," the order said. .The Court, however, deemed it pertinent to clarify that the use of such data retrieved during the course of investigating would not amount to violation of the right to privacy, as it is covered under the exceptions given in the Supreme Court's KS Puttaswamy judgment, which held that right to privacy is a fundamental right..Importantly, the Court held that examination of a smartphone or email is in the nature of a search and would therefore require a search warrant. A mere trial court order directing the petitioner to co-operate with the investigating agency cannot be used to force the petitioner to provide password, passcode, biometrics etc for opening a smartphone or email account, the Court held. .The Court was dealing with a petition filed by an accused in the infamous sandalwood drug case, Virendra Khanna, who challenged the order passed by the Special NDPS Court in September 2020. The Special Court had directed Khanna to cooperate with the investigating authority to unlock his mobile phone. Khanna approached the High Court contending that the said order is illegal and an abuse of process of law..Arguments of Parties.Senior Advocate Hashmath Pasha appearing for the petitioner submitted that insisting the petitioner to unlock his mobile phone which contains his personal information is violative of right to privacy as held by the Supreme Court in the case of Justice KS Puttaswamy..Further, it was argued that there is no specific law which enables courts to take away right to privacy or issue directions to divulge password of mobile phone, unlock the same or use of the data contained in the mobile for the purpose of investigation. Moreover, since the right to privacy is recognised as a fundamental right under Article 21 of the Constitution, to take away this fundamental right, even of an accused can be only by way of a law enacted by Parliament. The law must meet the test of Article 21 as laid down in Maneka Gandhi's case, i.e. it must be just fair and reasonable not illusory, it was contended. .The prosecution, on the other side, argued that the subordinate court order directing the petitioner to furnish the password of his mobile phone does not violate any of his rights under Articles 20(3) or 21 of the Constitution of India and Section 161(2) of the Code of Criminal Procedure, 1973..What the Court held Before delving into the merits of the case, the Court chose to dwell upon the impact of technology and its all-pervasive character. Technology, the Bench said, has come a long way from telephonic landline to sophisticated instruments like smartphones, the latter having become the central device for running the affairs of every person. ."Essentially today, a smartphone in many cases has replaced the laptop, which has replaced the office and the smartphone by itself is an office for several persons," the Court said..Smartphone, the Court said, is being used for various activities, including sending messages, conversing on social media like WhatsApp, Facebook, Twitter, Instagram, Telegram, Signal etc., sending and receiving emails, accessing the internet, carrying out online transactions and online purchases..Further, the Court said that it could not pass any directions to the accused to furnish the password, passcode or Biometrics and direction to cooperate as the gathering of evidence come under the domain of the investigation officer. .On the point of breach of right to privacy, the Court held that once the investigating agency has access to an electronic equipment more particularly smartphones and/or laptops, the investigating officer has a free access to all data not only on the said equipment but also any cloud service that may be connected to the said equipment, which could include personal details, financial transactions, privileged communications etc. .Such data the Court said could either incriminate the person or it could be private to a person though not necessarily incriminatory. The Court, however, made it clear that use of such data during the course of investigating would not amount to violation of the right to privacy and would come within the exceptions carved out in the Justice Puttaswamy's case. ."However, the disclosure making public or otherwise in court proceedings would have to be determined by the concerned judge by passing a judicial order," the Court said. .The Court then proceeded to stress on the responsibility of a police officer in safeguarding such information or data which would impinge on the privacy of the person."In no case could such details or data be provided by the investigating office to any third party during the course of investigation without the written permission of the court seized of the matter. The responsibility of safeguarding the information or data which would impinge on the privacy of the person will always be that of the investigating officer, if the same is found to have been furnished to any third party the investigation officer would be proceeded against for dereliction of duty or such other delinquency as provided," the judgment said. .The Court further held that providing the password or passcode of an electronic device would not amount to self-incrimination or testimonial compulsion. In this regard, the Court drew comparisons with providing blood samples, finger prints etc. Just as direction to provide thumb impression, blood sample, etc will not amount to testimonial compulsion, a direction to provide a password, passcode, biometrics would also not amount to testimonial compulsion.."It is only in the nature of a direction to produce a document. Mere providing access to a smartphone or e-mail account would not amount to self incrimination since it is for the investigating agency to prove its allegation by cogent material evidence," the Court ruled. .Guidelines for Search of Smartphones, Laptops, Electronic Gadgets, Email Accounts.An important ruling of the Court was that a search warrant is necessary for the examination of a smartphone, laptop or email account of an accused. An accused cannot be constrained to disclose the password/passcode of his gadgets or accounts through a mere order of a trial court to cooperate with the investigation, said the Court. In this regard, the following guidelines were laid down:- It would be required for the prosecution to approach the Court to seek a search warrant to search the smartphone and or e-mail account;- Once a search warrant is issued, it is up to the Petitioner-accused to provide the password, passcode, biometrics etc;- In the event of the accused or any other person not providing the password, passcode, or biometrics, on an application made by the prosecution, the court could direct the service provider viz., manufacturer of the smartphone and/or e-mail service provider, to open or unlock the smartphone and/or email account to enable access to the said smartphone and/or email account..The Court further said that it would be in the interest of all the stakeholders that detailed guidelines on search and seizure of electronic gadgets are prepared by the police department. Pending such formulation, the Court proceeded to issue the following guidelines to be followed by investigating officers: .In the case of a personal computer or a laptop When carrying out a search of the premises, the search team to be accompanied by a qualified Forensic Examiner. IO to not use the computer or attempt to search a computer for evidence. The usage of the computer and/or search should be conducted by a properly authorized and qualified person.The place where the computer is stored or kept is to be photographed in such a manner that all the connections of wires including power, network, etc.,are captured along with a diagram showing the manner in which the computer is connected.If the computer or laptop is in the power-off mode, the same should not be powered on. If the computer is powered on and the screen is blank, the mouse could be moved and as and when the image appears on the screen, the photograph of the screen to be taken. If the computer is switched on and connected to a network, the investigating officer to secure the services of a forensic examiner to capture the volatile network data like IP address, actual network connections, network logs, etc., The MAC address also to be identified and secured. In case of a laptop if the removal of the power cord does not shut down the laptop to locate and remove the battery. If the laptop battery cannot be removed, then shut down the laptop and pack it in a faraday bag so as to block any communication to the said laptop since most of the laptops, nowadays have wireless communication enabled even when the laptop is in the stand by mode.Seizure of networked devices To ascertain as to whether the said equipment is connected to any remote storage devices or shared network drives, if so to seize the remote storage devices as also the shared network devices. To seize the wireless access points, routers, modems, and any equipment connected to such access points, routers, modems which may sometimes be hidden. To ascertain if any unsecured wireless network can be accessed from the location. If so identify the same and secure the unsecured wireless devices since the accused might have used the aid unsecured wireless devices.To ascertain who is maintaining and running the network, get all the details relating to the operations of the network and role of the equipment to be seized from such network manager. To obtain from the network manager, network logs of the machine to be searched and/or seized so as to ascertain the access made by the said machine of the network.Mobile devices Mobile devices would include smartphone, mobile phone, tablets GPS units, etc., during the course of seizure of any of the mobile devices, apart from the steps taken in respect of a computer and/or laptop, the following additional steps to be taken,Prevent the device from communicating to the network and/or receiving any wireless communication either through wifi or mobile data by packing the same in a faraday bag. Keep the device charged throughout, since if the battery drains out, the data available in the volatile memory could be lost. Look for slim-slots, remove the sim card so as to prevent any access to the mobile network, pack the sim card separately in a faraday bag.While conducting the search, the investigating officer seized any electronic storage devices like CD, DVD, Blu-Ray, pen drive, external hard drive, USB thumb drives, solid-state drives etc., located on the premises, label and pack them separately in a faraday bag.The computers, storage media, laptop, etc.,to be kept away from magnets, radio transmitters, police radios etc., since they could have an adverse impact on the data in the said devices.The entire process and procedure followed to be documented in writing from the time of entry of the investigation/search team into the premises until they exit..In the instant case, since there was no search warrant, a mere direction by the trial court cannot be used to force the petitioner provide password, biometrics etc. The Court, therefore, set aside the order passed by the High Court. .[Read Judgment]