(This post connects to a primer available on SSRN which deals with these issues, which is available here)
Earlier this month, a Single Judge Bench of the Karnataka High Court delivered the judgment in Virendra Khanna v. State of Karnataka and Anr. [W.P. No. 11759/2020 (Decided on 12.03.2021)]. The decision is likely to prove the first in a series of cases in the near future, in which courts grapple with issues posed to criminal investigations by mobile phones and similar digital devices. These issues require courts to not only consider the scope of constitutional protections but also interpret existing provisions of the Criminal Procedure Code 1973 ["Cr.P.C."] and Information Technology Act 2000 ["IT Act"].
In this post, I argue that the conclusions arrived at in Virendra Khanna — in respect of the applicability of the fundamental right against self-incrimination, of the Cr.P.C. search and seizure provisions, and of the fundamental right to privacy, all in context of accessing digital devices — are incorrect. The interpretation that is endorsed by the High Court is also deeply problematic, as in the face of advancing technology, it seeks to restrict rather than enhance the contours of our constitutional rights to equip individuals with the means to protect themselves against unlawful incursions into enjoyment of one's personal liberty by state agencies. The post does not engage with the guidelines provided by the Court, or its reiteration of the law laid down in Selvi [(2010) 7 SCC 263] that compelled administration of a polygraph test was is illegal.
The Facts and Issues Before the Court
The Petitioner was a person caught in the crosshairs of law enforcement agencies, and his mobile phone was allegedly important to advance the investigation into offences. In September 2020, the police went before the trial court asking for court orders to direct the Petitioner to unlock his mobile phone and grant access to email accounts, as the Petitioner had refused to cooperate. The court duly passed this direction and it appears the Petitioner complied. Then, the police moved another application before the trial court, this time asking for directions that the Petitioner be subjected to a polygraph test to confirm the mobile / email passwords, as it appeared that the Petitioner had been lying about the same during investigation. The court allowed this application as well and directed the polygraph tests be conducted — orders which, according to the Petitioner, were passed without ever giving him an opportunity to be heard and without considering if he had indeed consented to undergoing such tests. The Petitioner challenged this order and the consequent direction to undergo a polygraph test.
Following the judgment in Selvi, no court can direct any accused person to undergo polygraph tests unless such person consented to the same, and if seen from that perspective Virendra Khanna was an open-and-shut case requiring that the order be set aside. But the High Court was more indulgent with the legal issues placed before it and considered questions that lay beneath the surface as well. Out of these, I focus on the following three points taken up in the judgment:
- What is the specific legal regime under which police can seek access to a digital device for pursuing its investigation?
- What is the interplay between Article 20(3) and directions issued to an accused person for unlocking a digital device?
- What are the legal limits, if any, upon law enforcement agencies while they "explore" the contents of a digital device for investigation purposes?
The High Court first considered whether there was any legal basis to root the actions of police officers in accessing a digital device for purposes of investigation. It observed that an officer could always ask an accused to open the device, but to direct compliance required some basis in law. This legal basis was found in the existing search and seizure regime of the Cr.P.C., concluding that the regime — which it admitted only applied to a "place" — was also applicable for accessing a digital device. Accordingly, the police would have to apply for search warrants to access a phone under Sections 93 / 94 of the Cr.P.C., and in emergent circumstances they could dispense with this requirement and act under Section 165 Cr.P.C. The obligations of the accused would be the same in both scenarios, i.e. assist in providing access to any locked space as provided by Section 100 Cr.P.C.
Extending the existing search and seizure regimes from the realm of physical space to that of electronic / digital space is a path that many countries are taking. Erecting a need for judicial supervision by requiring search warrants to be sought before digital devices can be accessed helps redress the imbalance of power in such situations and also helps to keep law enforcement activity tailored to the needs of investigation and avoid roving inquiries into personal data. Viewed in the abstract, then, the choice of the Court does not seem problematic at all but a pragmatic solution.
The problems only arise when we move beyond the realm of abstraction into practice. The Indian search and seizure regime does not mandatorily require search warrants; instead, police liberally use their powers under the "emergent circumstances" exception to conduct searches. The result is a situation where privacy is at the mercy of police. This is not to say that the search warrant regime itself, when invoked, supplies the necessary bulwark. The Cr.P.C. 1973 adopted wholesale the search regime that was present in the old British codes, the avowed purpose of which was to maximise scope of interference with personal liberty and not to safeguard it. Under this antiquated regime, general warrants allowing a roving search at a place are the rule, and a court may "if it thinks fit" restrict the scope of this search expedition.
As noted above, this regime was designed to maximise state interests. Importing this regime in 1973 was a dubious decision. Applying it in 2021 to digital devices which are nothing short of portable vaults full of sensitive personal data, is a disastrous one.
Issue 2: The Right against Self-Incrimination and Unlocking Mobile Phones
The High Court held that compelling a person to give up a password and / or biometrics to unlock a digital device did not attract the fundamental right against compelled self-incrimination as it was not the kind of evidence protected by the prohibition: providing a password did not disclose anything incriminating, and it was not the "testimonial compulsion" which Article 20(3) sought to protect. As a result, adverse inferences could be drawn if a person refused to comply with court orders. This analysis was coupled with portraying disaster if the view was taken to its logical consequence, which according to court:
"would result in a chaotic situation: no blood sample could be taken; no sample for DNA analysis could be taken; no handwriting samples can be taken; no other body sample for the purpose of DNA analysis could be taken; no search of a house or office could be undertaken; the data of a laptop or computer or server cannot be accessed by the investigating officer; offences like cyber crime could never be investigated; offences like pornography, child pornography which are more often than not, on the internet, could not be investigated."
Both these conclusions of the High Court are, unfortunately, incorrect. The legal position is misstated, and the approach on the factual aspects is deeply misguided and troubling.
The High Court called upon the "testimonial compulsion" concept in its reasoning and concluded that the furnishing of a password / biometrics was not of this nature, but was akin to "physical evidence". This binary logic was engrafted upon Article 20(3) by the Supreme Court in Kathi Kalu Oghad [AIR 1961 SC 1808], according to which there is a kind of material called "physical evidence" which falls outside the scope of the protection and persons can be compelled to furnish it. This includes blood samples, hair samples, or even asking an accused to wear specific clothing. Then, there is "testimonial compulsion" which is the material Article 20(3) covers, which traditionally makes one think of confessions. What is the basis behind this distinction? "Physical evidence" is only relevant for purposes of comparison and so by itself it is not incriminating — police take the sample to compare it with other material. "Testimonial compulsion" is incriminating by itself, and conveys to the police information that is the direct product of testimony. The key then is whether the testimonial act — be it speaking, or making gestures — conveys information that can help furnish a link in the chain of evidence, by its own merit.
Is giving the password / biometrics really not conveying any information? Is it of no value as testimony by itself? Surely, the answer is no. At its most basic formulation, the testimonial value in having an accused person unlock the phone lies in the many inferences that can be drawn from this act. Not only does it lend support to the inference that the accused owns the phone, but also to the inference that the accused was in control of its contents. And where the contents of this device are what are potentially incriminatory, surely this is as obvious a link in the chain of evidence as any.
On a more specific point, while the Court relied upon Kathi Kalu Oghad, it seemingly ignored the decision in Shyamlal Mohanlal Choksi [AIR 1965 SC 1251]. Otherwise, the High Court could not have observed that giving a password is not testimonial compulsion because "it is only in the nature of a direction to produce a document." After all, Shyamlal specifically held that a direction of this nature could not be issued to an accused person as it would run contrary to Article 20(3).
Since the High Court was incorrect in comparing the giving of a password with giving of bodily samples and the like, it is already obvious that the "heavens will fall" approach to the consequences of concluding an Article 20(3) violation are an exaggeration unfounded in the law. But let's ignore that for a minute, and take up the assertion on its face value. What it reveals is a troubling state of affairs where the High Court assumes that cooperation by an accused is necessary to secure any or all of these obviously legitimate investigative aims. This cannot be further from the truth and, in fact, the Court itself alludes to this when at a later point in the decision it recommends that police proceed to "hack" a device to gain access where the accused refuses to cooperate. What is troubling here is that this kind of piggybacking upon an accused to secure investigations is what a protection against self-incrimination, in its myriad forms, was designed to reduce. Technological advances have made it more possible for police to do their job independently and have helped to usher in a situation where investigations are not subject to the sweet will of an accused, and at the same time are free of any potential taints of accused persons being assaulted to secure information. It is unfortunate that the High Court endorsed a view which still sought to place the accused as the focal point of a police investigation, without appreciating the well-established perils of this approach.
Issue 3: The Right to Privacy
The High Court in Virendra Khanna was keenly aware of the potential invasion of one's privacy at stake considering how much data is found on our digital devices. It acknowledged that once police gain access to a device, even if for a specific reason, that often enables full-blown access to all aspects to a person's life. After heading in this direction, the High Court simply noted that the use of any such data during the course of investigations would not amount to a violation of the right to privacy, as it was protected under the exceptions carved out. At the same time, the High Court observed that unlawful disclosures of this material with third parties could certainly amount to an actionable wrong.
With all due respect, the High Court's analysis of the privacy issues barely scratched the surface and, in effect, simply placed the cart before the horse. Yes, a criminal investigation can certainly require invasions of the right to privacy that are otherwise prohibited, but to confer a blanket protection over all all kinds of activities that may be done under the pretext of an investigation effectively extinguishes the fundamental right altogether. Let's take an example. The police allege that an accused spoke to other conspirators over email and this correspondence is evidence to show the existence of an agreement to commit a crime. This is as genuine a law enforcement need as can be justifying going inside an email account and one's private chats.
According to Virendra Khanna, when faced with this situation a court should support untrammelled access for police agencies to the email account. Such an approach is hardly the only way out and actually asks courts to forsake their responsibility of crafting a proportionate intrusion to best safeguard law enforcement interests without sacrificing one's privacy altogether. Rather than confer a carte blanche upon the police, an approach which took privacy seriously — the respect a fundamental right deserves — would have a court consider if the police could demonstrate with reasonable particularity what they hoped to find or if it was just a hunch and, importantly, create a time-limit so that the individual is not forever beholden to police snooping through her inbox.
The seemingly benign way in which the High Court viewed potential breaches of the right to privacy can be seen not only from how it viewed state interests as an unquestionable concept, but also in how it failed to address what remedies may lie in the event of a breach. As mentioned above, the High Court did note that disclosures to third parties were possible and could constitute a breach, but it neither offered nor suggested a remedy to the aggrieved accused in this regard. What's worse, the High Court in its support for getting search warrants endorsed the regular position that the fruits of an illegal search could still be admissible as evidence. It failed to engage with the small but significant line of recent cases where another High Court took strong exception to searches being conducted without following procedures, noted that this amounted to a breach of the right to privacy, and excluded material gathered pursuant to search from being considered as evidence.
Conclusion: Setting Back the Clock, by Some Measure
On its face, the petition in Virendra Khanna offered a straightforward issue — administering polygraph test without consent. The High Court looked past this simplicity to address the underlying legal questions which are becoming critical in their relevance to law enforcement needs and ordinary life. That it chose to do so and contributed to the discourse by offering clear answers to some questions was a welcome move. The problem is that the answers themselves are severely wanting, either proceeding on an incorrect legal basis or drawing exaggerated hypothetical conclusions.
How this judgment is treated by the other benches in the Karnataka High Court, the state police, as well as other courts, will be interesting to see.
No comments:
Post a Comment