Written By: Apoorv Agarwal, Aastha Arora, Suvangana Agarwal, Deepika Sethia
Introduction: A New Frontier of Crime and Constitutional Governance
The digital domain has become inseparable from contemporary life. From financial transactions and e-commerce to social interaction, public administration, and national security, nearly all activities now leave electronic footprints. As India embraces large-scale digitisation, such as UPI, Aadhaar authentication, digital payments, e-governance platforms, and cloud infrastructure, the crime spectrum has expanded equally rapidly. Offences that once required physical proximity can now be committed anonymously from anywhere in the world; financial frauds can occur without a single forged cheque; intimidation, stalking, extortion, and impersonation can unfold behind encrypted interfaces. Cybercrime is therefore not merely a technological problem; it is a structural legal challenge.
In the last decade, India has attempted to establish a robust investigative and judicial framework tailored to the digital age. The evolution of this ecosystem is driven by four interrelated factors: the increasing sophistication of cyber-offenders, the fragility and volatility of digital evidence, jurisdictional complexities crossing national borders, and the constitutional obligation to safeguard privacy and liberty. Enforcement agencies must be adaptable, technologically proficient, and legally disciplined. Courts must supervise this authority diligently, ensuring that investigations remain proportionate and that electronic evidence adheres to strict standards of authenticity. The resultant ecosystem integrates technology, statutory authority, forensic science, and judicial oversight harmoniously.
Statutory Framework: Powers, Offences and Evidentiary Demands
1. The Information Technology Act, 2000: India’s Digital Penal Code
The Information Technology Act, 2000 (IT Act) forms the backbone of India’s cybercrime law. It defines a wide range of offences, regulates intermediaries, and empowers the State to issue directions for interception, monitoring and blocking of information in restricted circumstances.
Key offences under the Act include:
- Section 43: Unauthorised access, data theft, introducing malware, and causing damage to computer systems.
- Section 66: Criminalisation of conduct under Section 43 when done dishonestly or fraudulently.
- Section 66C: Identity theft.
- Section 66D: Cheating by personation using computer resources.
- Section 67 and 67B: Dissemination of obscene content and child sexual abuse material.
- Section 69: Power to direct interception, monitoring and decryption.
- Section 69A: Power to block public access to digital information.
These provisions cover a broad spectrum, from routine bankfraud cases to serious nationalsecurity cyber threats.
2. The IPC in Cyberspace
Despite the specificity of the IT Act, the Indian Penal Code (IPC)remains broadly applicable. Offences such as cheating (Section 420), criminal intimidation (Section 506), extortion (Section 383), defamation (Section 499), and obscenity (Section 292) frequently intersect with cyber activities. For instance, the Delhi High Court in Sharat Babu Digumarti v. NCT of Delhi (2017) clarified that, although obscenity on digital platforms falls within the scope of Section 67 of the IT Act, the provisions of the IPC are not entirely excluded unless explicitly overridden.
3. Special Statutes and Overlapping Jurisdiction
Several other laws intersect with cyber investigations:
- The PMLA (Prevention of Money Laundering Act, 2002) governs the laundering of criminal proceeds, including crypto assets.
- The UAPA (THE UNLAWFUL ACTIVITIES (PREVENTION) ACT, 1967) covers cyber-terrorism and online radicalisation.
- The POCSO Act (THE PROTECTION OF CHILDREN FROM SEXUAL OFFENCES ACT, 2012) applies to online sexual exploitation.
- The Copyright Act of 1957extends to digital piracy, torrent distribution and illegal streaming.
Cybercrime is rarely confined to a single statute; most cases involve multiplestatutes.
Procedure Under CrPC: Search, Seizure and Custody
The Code of Criminal Procedure (CrPC) governs investigation protocols,includingthose for cyber offences.
Under Section 91, investigators may compel production of documents or digital records.
Under Sections 93–94, courts can issue search warrants for digital devices, servers, cloud accounts and data centres.
The Supreme Court of India of India in Vijay Madanlal Choudhary v. Union of India (2022) reaffirmed that digital searches must comply with statutory procedure and may not rely on unfettered executive discretion. This procedural discipline becomes all the more crucial due to the ease with which electronic evidence can be manipulated or deleted.
Electronic Evidence and Section 65B: The Gatekeeper Requirement
No feature of cybercrime enforcement has shaped jurisprudence more than Section 65B of the Indian Evidence Act, which lays down strict requirements for the admissibility of electronic records.
The landmark judgment Anvar P.V. v. P.K. Basheer (2014) held that electronic evidence is admissible only when:
- It is accompanied by a Section 65B(4) certificate.
- The certificate identifies the device, the extraction process, and the authenticity of the record.
- The chain of custody is transparent.
The Court reaffirmed this standard in Arjun PanditraoKhotkar v. Kailash KushanraoGorantyal (2020), clarifying that no electronic record can be admitted without such certification unless produced by the device’s operator or the owner of the server infrastructure.
These rulings have had a transformative effect: police, ED, CBI and state cyber cells must now preserve metadata, hash values and extraction processes with utmost precision.
Institutional Architecture: Agencies and Intermediaries
1. State Cyber Cells and Cyber Police Stations
Most states now have fully operational Cyber Crime Police Stations, staffed by officers trained in forensics, IP tracking, email tracing, cryptocurrency analysis, and socialmedia investigations. They play a first-responder role, particularly in cases of UPI fraud, digital blackmail, sextortion, identity theft and phishing.
2. National-Level Agencies
National agencies provide technical depth and cross-border reach:
- CERT-In: India’s emergency response body for cyber incidents; mandated under Section 70B IT Act.
- CBI: Handles complex fraud and transnational hacking.
- NIA: Leads investigations involving cyber-terrorism.
- Enforcement Directorate: Tracks laundering through digital wallets, crypto exchanges, and shell payment systems.
3. The Role of Intermediaries
Telecom operators, banks, payment apps, socialmedia companies, and crypto exchanges constitute the backbone of digital investigation. Under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, intermediaries must:
- Preserve logs,
- Remove illegal content upon notice,
- Provide information to law enforcement under valid legal orders,
- Maintain a grievance redressal system.
The Supreme Court of India, in Shreya Singhal v. Union of India (2015), clarified that intermediaries are liable only after receiving actual knowledge through a court order or a government notice.Cooperation between agencies and intermediaries has become indispensable in tracing offenders across platforms, currencies, and jurisdictions.
The Cyber Investigation Workflow: From FIR to Trial
1. Registration and Initial Evidence Preservation
Most cyber offences are cognisable. Complaints may originate from:
- Local police stations,
- Special cyber police stations,
- The National Cybercrime Reporting Portal.
Immediate action is critical. Digital evidence evaporates quickly. Investigators must preserve IP logs, session histories, call data records, metadata, and device contents. The Supreme Court of India in State of Rajasthan v. Kashi Ram (2006) emphasised the necessity of preserving the chain of custody for all forms of evidence.
2. Seizure, Imaging and Chain of Custody
After obtaining warrants under Sections 91 and 93 CrPC, investigators seize digital devices. Forensic imaging is performed to create an exact bit-by-bit copy. The hash values of the source and copy must match; this is the only way courts can verify the integrity of the data. Any discrepancy can render valuable evidence inadmissible.
3. Forensic Examination
Digital forensics labs perform:
- Recovery of deleted files,
- Malware analysis,
- Profiling of communication patterns,
- Timestamp correlation,
- Decryption,
- Blockchain tracing for crypto transactions.
Tools such as Cellebrite, FTK, EnCase, Autopsy, and blockchain explorers are commonly used. Expert opinions are later recorded under Section 45 of the Evidence Act.
4. Mapping Financial and Digital Trails
In fraud, ransomware and impersonation cases, financial and online trails are crucial. Banks and payment processors supply KYC details, UPI histories, suspicious transaction reports, and IP addresses. Crypto exchanges provide wallet histories and KYC documents upon judicial order.
5. Decryption and Interception Orders
Under Section 69 of the Information Technology Act, the government has the authority to mandate decryption when deemed necessary to safeguard national security, sovereignty, public order, or to prevent criminal activities. The Supreme Court of India, in PUCL v. Union of India (1997), although predating the widespread use of the internet, established the foundational framework for lawful interception, emphasising that safeguards are essential to prevent misuse. Furthermore, the principles outlined in Puttaswamy (2017) have reinforced the importance of proportionality and well-founded justification in such measures.
6. Filing of Chargesheet
Prosecutors integrate forensic reports, intermediary responses, expert opinions, witness statements and financial summaries. The challenge lies in translating technical patterns into legally intelligible narratives that fit within statutory definitions.
7. Trial and Judicial Scrutiny
Courts closely examine:
- Chain of custody,
- Validity of Section 65B certificates,
- Integrity of seized devices,
- Legality of search and seizure,
- Whether privacy rights were respected,
- Reliability of expert testimony.
Judges often appoint independent forensic experts to verify contested electronic evidence.
Judicial Coordination and Constitutional Checks
1. Privacy, Liberty and Surveillance
Following the Puttaswamy(Supra), privacy constitutes a fundamental right. All digital searches, seizures, interceptions, or monitoring orders must adhere to the triple test:
- Legality: There must be a law regulating the action.
- Necessity: The action must be necessary for a legitimate goal.
- Proportionality: The extent of intrusion must be minimal.
Courts frequently inquire whether investigators have complied with these constitutional standards.
2. Arrests and Custodial Interrogation
In cases of cyber offences, arrest is not automatic. The guidelines established in Arnesh Kumar v. State of Bihar (2014) mandate that law enforcement authorities must substantiate the need for arrest, rather than conducting it as a routine measure. Numerous cybercrimes, particularly first-time digital frauds, do not necessitate custodial interrogation unless technical recovery procedures explicitly require it.
3. Judicial Oversight of Digital Evidence
The judiciary ensures that electronic evidence is accepted solely when reliability is established. Courts exclude evidence obtained through illegal searches, coercion, tampering, or improper certification. In Navjot Sandhu (2005), The Supreme Court of India admitted electronic evidence without a 65B certificate; however, this decision was subsequently overruled by Anvar and Arjun Panditrao, which now constitute binding precedents.
4. Quashing and Re-Investigation
High Courts routinely quash FIRs for cybercrimes when the essential elements of the offences are not satisfied, especially in cases involving online speech. They also mandate the formation of specialised investigation teams in instances of large-scale scams, such as multi-state OLX frauds or cryptocurrency Ponzi schemes.
5. Compensation and Accountability
Courts may grant compensation pursuant to Article 226 of the Constitution of India in cases where unlawful seizures, violations of privacy, or investigative overreach result in harm. Additionally, they may impose disciplinary measures on culpable officers. This dual mechanism serves to maintain public trust and uphold investigative discipline.
Cross-Border Complexities and Global Coordination
Cyber offences rarely remain confined within the boundaries of a single nation. Servers may be situated abroad, data may be stored in foreign jurisdictions, offenders may be located on different continents, and victims may be dispersed across multiple regions. Investigators rely on:
- Mutual Legal Assistance Treaties (MLATs),
- Letters Rogatory,
- Interpol’s I-24/7 network,
- CERT-to-CERT cooperation,
- Bilateral data exchange arrangements,
- Liaison officers in foreign missions.
Nevertheless, delays are common. Logs kept by social media corporations often expire within ninety days; consequently, by the time foreign responses are received, the evidence may have disappeared. The lack of a dedicated Indo-US data-sharing treaty remains a bottleneck, given that most prominent platforms are headquartered in the United States.
Emerging Threats: Deepfakes, Encryption, Crypto and AI
1. Deepfake-Driven Crime
Deepfakes have fundamentally altered the landscape of impersonation, blackmail, and political manipulation. Judicial authorities encounter unprecedented evidentiary challenges when the “face” or “voice” is artificially engineered.
2. End-to-End Encryption
Platforms such as WhatsApp and Signal provide encryption that precludes even service providers from accessing message contents. This complicates lawful interception processes and necessitates device-level access rather than network-level access.
3. Cryptocurrency Laundering
Crypto wallets, mixers, cross-chain swaps, and decentralised exchanges obscure the origin and destination of funds. In several ED and CBI cases, blockchain forensics uncovered multi-layered laundering chains, demonstrating the necessity for specialised tools.
4. AI-Generated Threats
Generative AI now generates phishing emails that are indistinguishable from legitimate communications, creates convincing synthetic identities, and automates fraudulent activities. Investigators are now required to understand both AI models and the methods criminalsemploy.
The Road Ahead: Towards a Coherent, Rights-Respecting Cyber Justice System
India’s cybercrime investigation framework has advanced considerably; however, it must continue to evolve. Enforcement agencies require ongoing training in forensic science, network security, blockchain tracing, and digital privacy law. Forensic laboratories need prompt upgrades to manage encrypted devices, cloud-based evidence, and AI-generated artefacts. Inter-agency coordination must become seamless rather than episodic. The judiciary’s role is equally vital. Courts should establish specialised cyber benches, expand the pool of judicially recognised cyber experts, and refine the jurisprudence on privacy, proportionality, and evidentiary standards. Legislative reform is also imperative. The IT Act must be modernised to address contemporary threats, streamline procedures, and establish a clear legal framework for digital forensics and cross-border data access.
Above all, the future of cyber governance in India must balance two imperatives: effective enforcement and constitutional fidelity. A system that sacrifices liberty for security risks eroding public trust; conversely, a system that neglects digital threats jeopardises financial stability, social cohesion, and national security. Therefore, the challenge lies in constructing an investigative and judicial infrastructure that is technologically advanced, procedurally disciplined, and steadfastly committed to the rule of law.
