(This is a guest post by Ratyansh Garg)
On 22 September 2026 the defendant in BPTP Ltd v. Nitin Naresh told the Delhi High Court that a twelve-minute recording of him allegedly demanding money was “in all probabilities a mere AI generated cloned recording of his voice”. Rather than decide the point on the papers, the Court sent the recording to the Central Forensic Science Laboratory “for the purpose of ascertaining the truthfulness and veracity of the recording as also to ascertain the hash value”.
The order treats the truth of the recording and its hash value as two questions. Four months earlier the Supreme Court treated the hash as answering both. Disposing of a challenge to section 63(4) of the Bharatiya Sakshya Adhiniyam 2023 (BSA) in Pune Bar Association v. Union of India, the Court began from the threat that “artificial intelligence and deepfake technology” pose to electronic evidence. It described a hash value as “synonymous with an electronic fingerprint” that and reasoned that the expert’s certification in Part B “provides an additional layer of authenticity”.
This post argues that the Court in Pune Bar asked more of the hash than it can give. A matching hash shows integrity: the file before the court is bit-for-bit the file that was hashed. It says nothing about authenticity, or veracity, whether that file is a genuine record of what it appears to show, which is the relevant inquiry for deepfakes. Conflating the two attributes makes admission costlier for honest litigants and stamps an expert’s signature on records whose veracity no one has verified.
What Section 63(4) BSA now asks for
Section 65B(4) of the Evidence Act required a certificate signed by a person “occupying a responsible official position” in relation to the device. Section 63(4) of the BSA adds three things. The certificate must accompany the record “at each instance where it is being submitted for admission”; it must follow the form in the Schedule; and it must be signed by the person in charge of the device “and an expert”. Part A of the Schedule, filled in by the party, identifies the device, makes sworn declarations about its regular use and proper working, and states the record’s hash value, with a choice of “SHA1”, “SHA256”, “MD5” or “Other”. Part B, filled in by the expert, restates the device particulars and the hash value. As Sulaiman observed, all the expert’s certificate does is “merely replicate the information already provided in Part A”. Beyond the party’s own declarations, neither Part asks anyone to examine whether the record is genuine.
The Court disposed of the petition without issuing notice to the Union, and kept open the question of who may sign Part B. Sekhri has called its reasoning “a lazy recitation of an old logic of tampering”. The present argument is narrower: The order’s premise about what a hash establishes is itself mistaken.
Integrity is not Authenticity
A cryptographic hash function reduces a file to a fixed-length string. Change a single bit and, the result is “a completely different message digest”. Comparing the hash of a copy with that of the original therefore tells a court whether the copy is identical, and nothing more. The Scientific Working Group on Digital Evidence, a US forensic standards body, explicitly states: “hashing files does not protect against manipulation of evidence before it is hashed”, and “the only way to manipulate the evidence without detection is to do it before it is hashed” (SWGDE, 2019).
Take a shop owner who fabricates CCTV footage of a burglary and hashes the fabricated file. Every later copy will match, and the hash values in Part A and Part B will be accurate. Part A’s declaration that the footage was produced in the ordinary course will be false, but nothing in the certificate tests it, and Part B will certify the fingerprint of a fake. The same holds for a cloned voice note or a doctored screenshot. A hash taken at a trusted moment, such as seizure, does rule out tampering after that moment. Whatever was false before it stays false, now with a matching fingerprint. Mishra made the same point before Pune Bar: section 63 “might act as a safeguard to detect tampering with e-record but it does not vouch for the legitimacy of e-evidence”.
Indian evidence law has long treated tampering as only one of several questions. Ram Singh v. Col Ram Singh set six conditions for tape recordings: the speaker’s voice be identified; accuracy of the recording be proved; “every possibility of tampering with or erasure” be ruled out; and the cassette be sealed and kept in official custody. A hash act as a seal, ruling out alteration after hashing. However, it says nothing about whose voice is on the recording, whether the recording is accurate, or whether it was altered before it was hashed. In Himanshu Chordia v. State of Rajasthan, decided ten weeks after Pune Bar, the Supreme Court asked if photographs sought to be adduced were “genuine pictures” or “doctored using technological advancements”, and observed: “Verification within the meaning of Section 65B of the Evidence Act, 1872… is not the only issue.”
The conflation predates Pune Bar. The Karnataka High Court’s guidelines in Umesh v. State of Karnataka (2022) preferred “cryptographic analysis by hash value method” over spectrographic analysis for assessing “the reliability and authenticity of an electronic document”. Ironically, while spectrography can help identify a speaker; a hash cannot. The Madras High Court in Yuvaraj v. State (2023) directed hash values to be recorded at four stages, reasoning that matching values “would ensure its authenticity”. A Delhi magistrate in State v. Satwant Rao, post Pune Bar, wrote that a hash “assists in verifying the authenticity and integrity of the electronic record”. Careful commentary reads the Schedule the same way, as giving “a more meaningful assurance of the genuineness” of the record (Verma, NLSIR 2025). A trial judge handed a certificate by an “expert” will likely read it as an authenticated forensic finding, which it is not.
A Weaker Fingerprint than the Court assumed.
First, the Schedule offers MD5 and SHA-1. As of now, both have low collision resistance. The Internet Engineering Task Force said in 2011 that MD5 “is no longer acceptable where collision resistance is required” (RFC 6151), and the National Institute of Standards and Technology, under the US Department of Commerce, has announced that SHA-1 should be phased out by 2030 because “collision” attacks “have been used to undermine SHA-1”. These attacks do not let an outsider alter a file that someone else has already hashed; no practical attack of that kind exists. They let a person who controls a file before hashing prepare two different files with the same hash. Forensic practice still accepts MD5 and SHA-1 for integrity checks because “technical and procedural controls during the data collection process” guard against manipulation before hashing (SWGDE, 2019). Part A under has no such controls: the party hashes its own file, and the Schedule lets it hand-pick the weakest algorithm. The practical risk is narrow, since a fabricator who knows that no one examines the content need not bother with collisions at all. But a form whose hash value is treated as an “electronic fingerprint” should not list algorithms that standards bodies have abandoned wherever collision resistance matters.
Second, hashes are brittle in the other direction. A photograph sent on WhatsApp at standard quality is compressed before it is sent, and CCTV footage is often exported in a converted format. The resulting files differ from originals bit-for-bit and so carry different hashes, though no one has tampered with them. A mismatched hash does not prove tampering, just as a matching hash does not prove genuineness. A test that is neither necessary nor sufficient for genuineness is a poor gatekeeper of it.
The Cost at the Gate
None of this would matter much if the certificate were easily accessible, which it is not. Only government bodies can be notified as Examiners of Electronic Evidence under section 79A of the IT Act, and in July 2026 there were reportedly “just 21” of them. Pune Bar suggested that a person with “special skill and expertise in computer science and cyber forensics” may sign Part B if the court is satisfied, but declined to decide the point. Courts have responded unevenly. The Delhi High Court has regularly granted exemptions and extra time for hash and expert certificates (here, here and here). A Delhi civil court held a document inadmissible for want of a section 63 certificate (Devender Kumar v. Gurmeet Singh), and a commercial court held that Pune Bar was inapplicable to commercial suits. (Panasonic Life Solution v. Dinesh Kumar). As Mayank Khichar and Makhija and Sharma argue, the burden falls hardest on private litigants and the defence.
A Wrongly Borrowed Provision, and the Wrong Cure
Section 63 inherits an old problem. As Nariman J noted in Arjun Panditrao Khotkar, section 65B “has its genesis in Section 5 of the Civil Evidence Act 1968 (UK)”. The UK itself repealed that provision with effect from 1997, more than three years before India copied it, and removed its criminal counterpart, section 69 of the Police and Criminal Evidence Act 1984, in 2000. In the same case Ramasubramanian J. called for “a relook at Section 65B”, and the Madras High Court in Yuvaraj said there “could be no better instance of fitting a square peg into a round hole”. The BSA’s response was to add an expert and a hash to the peg. In UK criminal cases, once section 69 went, courts fell back on a common law presumption that, absent evidence to the contrary, “mechanical instruments were in order at the material time”. That presumption too is now under review because of the Post Office scandal, in which sub-postmasters were convicted on data from a system later found to be “not remotely robust” (Hamilton v Post Office).
What Should Replace it?
The BSA’s validation of electronic evidence can significantly improve with three changes: First, courts must treat a Section 63 certificate as going to integrity alone: as evidence that a copy matches the record that was hashed. Moreover, Courts liberally exempt the production of the s.63(4) certificate. While Arjun Panditrao calls it a condition precedent, it permits a certificate to be produced at any stage before the trial ends. The Delhi High Court also treats a missing certificate as a curable issue, granting time for cure.
Second, once a party establishes serious doubts to the record’s genuineness, the dispute should go where BPTP sent it: to a forensic examiner under section 39. For deepfakes, the US Advisory Committee on Evidence Rules is discussing a separate draft rule under which the opponent must first produce evidence sufficient to support a finding of fabrication, and the proponent must then show that the item is more likely than not authentic. Such inquiries can use metadata, device logs, detection software, and provenance metadata that India’s amended IT Rules have, since February 2026, required intermediaries to embed in synthetic content made with their tools. But detection tools should serve as evidence, not as certification. Open-source detectors lost about half their performance on deepfakes circulating in 2024 (Deepfake-Eval-2024), and people themselves do little better than chance. Turning a detector’s output into a new admissibility “certificate” would repeat the mistake this post describes.
Third, Parliament should amend Section 63(4) and the Schedule, removing MD5 and SHA-1, requiring the hash to be recorded at the earliest practicable moment: automatically at seizure where systems such as e-Sakshya allow it, and otherwise when the record is first tendered, as the Delhi High Court’s Original Side Rules already require. Then, dropping the filing-stage expert signature reduces costs while losing little, since the expert only checks against tampering while copying anyway.