How a cyber crime case study is built
A good cyber crime case study answers four questions in order. What were the facts, in the few lines that matter? What question did the court have to decide? What did it hold? And what does the decision change for the next person in the same position? The four case studies below follow that order. They are taken from the Supreme Court Reports text of each judgment, so the facts and the holdings are those that appear in the headnote and in the reasoning of the Court.
The four decisions are not cyber crime cases in the narrow sense of prosecutions for hacking or fraud. They are the cases that decide the rules under which such prosecutions and claims are run: which offences stand, how electronic proof is admitted, and what privacy protects. A student looking for a cyber crime case study in India should start here because every trial court is bound by these decisions. The short digest of all four is on the page of cyber crime cases in India.
Case study 1: Shreya Singhal v. Union of India (2015)
Facts and question
A batch of writ petitions was filed under Article 32 of the Constitution against section 66A of the Information Technology Act. The section had been added by the amendment of 2009, in force from 27 October 2009, and made it an offence punishable with up to three years and a fine to send, by a computer resource or communication device, information that was grossly offensive or menacing, or false information sent to cause annoyance, inconvenience, danger, insult or ill will, or an email sent to annoy or to deceive about its origin. The question was whether such a law is consistent with the freedom of speech and expression in Article 19(1)(a), and whether it can be saved by the permitted restrictions in Article 19(2).
Decision
The bench of J. Chelameswar and R.F. Nariman held on 24 March 2015 that the section violates Article 19(1)(a) and is outside Article 19(2). The Court reasoned from three ideas that it called fundamental to free speech: discussion, advocacy and incitement. Discussion and even advocacy of an unpopular cause lie at the heart of the freedom, and a law may curtail speech only when it reaches the level of incitement. Section 66A used terms such as annoyance, inconvenience and grossly offensive that are open ended and undefined, and the Court held that its reach has a chilling effect on speech. Because the section did not fall within any of the grounds in Article 19(2), no part of it could be severed, and it was declared unconstitutional as a whole.
Lesson
A criminal provision about online speech must define the conduct it punishes with precision. The Court also dealt with intermediaries and upheld section 79, with a safeguard that an intermediary is required to act only after a court order or a notification of the appropriate Government that conforms to the grounds in Article 19(2). A reader who finds a source that still treats section 66A as law is reading a source that is out of date.
Case study 2: Anvar P.V. v. P.K. Basheer (2014)
Facts and question
The appeal arose from an election petition. The petitioner alleged corrupt practice: that at least 25,000 copies of a leaflet containing a false statement about his involvement in a murder case had been printed and published with the consent of the returned candidate, and that speeches, songs and announcements had been made against him. The speeches, songs and announcements had been recorded on other instruments and fed into a computer, and CDs made from them were produced in court without any certification. The question was whether those CDs could be admitted as evidence.
Decision
A bench of three judges held on 18 September 2014 that the CDs were inadmissible because the requirements of section 65B of the Evidence Act were not met. The Court said that the Evidence Act does not permit proof of an electronic record by oral evidence where section 65B is not satisfied, and that a CD, VCD or chip must be accompanied by the certificate required by section 65B obtained at the time the document is taken. On the other limb of the case, there was no evidence that the leaflet was printed and published with the consent of the returned candidate, and the Court noted that connivance is different from consent. The appeal was dismissed. The Court overruled State (NCT of Delhi) v. Navjot Sandhu on the point.
Lesson
Electronic evidence has its own conditions of admissibility, and a certificate is not a formality. For anyone who may need to prove a message, a recording or a log in court, the time to arrange the certificate is when the record is made.
Case study 3: Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal (2020)
Facts and question
This was another election dispute. The appellant's election was challenged on the ground that his nomination papers had been filed after the time allowed and should have been rejected. The respondents relied on video recordings from cameras at the office of the Returning Officer. The recordings were produced by the Election Commission without the certificate required by section 65B(4), but the High Court admitted them on the strength of the Returning Officer's oral evidence in cross-examination, and declared the election void. The matter reached the Supreme Court and was referred to three judges because a two-judge decision, Shafhi Mohammad v. State of Himachal Pradesh, seemed to conflict with Anvar P.V.
Decision
On 14 July 2020, a bench of R.F. Nariman, S. Ravindra Bhat and V. Ramasubramanian held that sections 65A and 65B are a complete code on the admissibility of information in electronic records, that the certificate under section 65B(4) is a sine qua non and that oral evidence cannot replace it. The Court then applied the rule with some give: because the respondents had done everything possible to obtain the certificate, they were relieved of the obligation on the facts, and in any case other evidence supported the High Court's conclusion, so the judgment was not faulted. It added that the certificate is not needed if the original document is itself produced. The Court held that Anvar P.V., as clarified, is the law, and overruled Shafhi Mohammad. Justice Ramasubramanian, in a supplementing opinion, said that major jurisdictions had updated their laws on electronic evidence and that a fresh look at section 65B was needed.
Lesson
The certificate rule stands, with two exceptions that are narrow: production of the original, and the case of a party who cannot obtain the certificate despite all efforts. The Court also gave general directions to cellular companies and internet service providers, to apply until rules or directions are made under section 67C of the Information Technology Act.
Case study 4: Justice K.S. Puttaswamy (Retd.) v. Union of India (2017)
Facts and question
The petition, Writ Petition (Civil) No. 494 of 2012, challenged the Aadhaar scheme, and the question of the existence and scope of a right to privacy was referred to a bench of nine judges. Earlier decisions in M.P. Sharma and Kharak Singh had said that privacy is not a guaranteed right. The Court had to decide whether the Constitution protects privacy at all.
Decision
On 24 August 2017 the nine-judge bench held that privacy is a constitutionally protected right, protected as an intrinsic part of the right to life and personal liberty under Article 21 and as part of the freedoms in Part III. M.P. Sharma was overruled to the extent that it said otherwise, and Kharak Singh was overruled to the extent that it held that privacy is not protected. The judgment states a three-part requirement for any invasion of life or personal liberty: legality, which means that there must be a law; need, defined as a legitimate state aim; and proportionality, which requires a rational connection between the aim and the means.
Lesson
The judgment treats informational privacy as a facet of the right, and observes that the dangers to privacy in an age of information can come from non-State actors as well as the State. It records that the Union Government was entrusted to put in place a robust regime for data protection, balancing individual interests and the legitimate concerns of the State. The Digital Personal Data Protection Act 2023 is that regime, and the guide to the DPDP Act 2023 explains it. The Aadhaar judgment of 2018 is a different decision, from a five-judge bench, which applied this test and is not the same as the 2017 judgment.
What the four case studies have in common
Read together, the four case studies show how cyber law is made. A statute passed in a hurry can be removed by a court, as section 66A was. Rules of proof written for paper can be adapted to electronic records, as sections 65A and 65B were in Anvar and Khotkar. And rights that the Constitution does not name can be recognised, as privacy was. In each case the decision depended on the exact text of a provision and on the facts before the Court, which is why each judgment should be read in full before it is quoted. The wider background is in the guide to the IT Act 2000, and the numbers on cases that reach the police are in the page on cyber crime in India.