POCSO Act, 2012
Digital Evidence in Section 15 POCSO Cases
A Section 15 prosecution is won or lost on digital evidence. The prosecution must show that the material existed, that it depicted a child, that it was in the accused's possession or control, and that he held it for the purpose the sub-section requires. All of that lives on a device, in a cloud account, or in a platform's logs. And all of it must be collected, preserved and proved so that its integrity cannot be doubted. This note follows digital evidence from seizure to trial, sets out what it must prove under each sub-section, and explains the law on admissibility.
The six stages from device to courtroom, what the evidence must show, and the law on admissibility
1. From Seizure to Trial
Stage | What is done | Why it matters |
|---|---|---|
Seizure | The device is seized under a seizure memo; the search and seizure are recorded by audio-video electronic means under BNSS s. 105; a phone is isolated from the network | Prevents remote wiping and later dispute about what was found |
Imaging | A bit-for-bit forensic copy is made through a write blocker | The original is never altered; analysis is done on the copy |
Hashing | Hash values of the original and the copy are generated and recorded | Identical hash values prove the copy is exact and unaltered |
Analysis | By a forensic laboratory or an Examiner of Electronic Evidence notified under IT Act s. 79A | Recovers files, metadata, browsing history, chats, sharing applications and cloud links |
Certificate | The certificate under BSA s. 63(4) in the Schedule form, with parts for the person in charge and an expert | Condition of admissibility for secondary electronic evidence |
Trial | The expert deposes; the material is kept sealed and not shown publicly | Proof without further harm to the child; ss. 23 and 33(7) |
§ The chain of custody Every transfer of the device or the image must be recorded: who held it, when, where it was kept, and in what condition. A break in the chain invites the argument that the material was planted or altered, and can destroy an otherwise strong case. The same lesson from sexual offence prosecutions generally. In Rahul v. State (NCT of Delhi) (2022), the Supreme Court acquitted where the prosecution failed to rule out tampering with forensic samples. Digital evidence is no different. |
2. What the Evidence Must Prove
§ Element by element • Possession or control. Files on the device or in a linked cloud account; browsing history and cache showing viewing with control, which is constructive possession after Harish; and evidence of who used the device, since shared devices are a common defence. • Section 15(1). The period for which the material was retained, the absence of any deletion or report under Rule 11, and circumstances from which the intention to share may be inferred. • Section 15(2). Evidence of the purpose to transmit or distribute: sharing applications, upload and send logs, membership of groups where such material is exchanged, peer-to-peer software, and messages offering or sending material. • Section 15(3). Evidence of commercial purpose: payment records, subscriptions, price lists, and a volume and organisation of material consistent with trade. • That a child is depicted. Where the age of a person depicted is not obvious, expert or other evidence may be needed. Section 2(1)(da) also covers computer-generated images indistinguishable from a real child, and images modified to appear to depict a child. |
3. Admissibility of Electronic Evidence
📖 Anvar P. V. v. P. K. Basheer, (2014) 10 SCC 473 The Supreme Court held that an electronic record, as secondary evidence, is admissible only if the requirements of Section 65B of the Evidence Act are satisfied, including the certificate, and that the general provisions on secondary evidence do not apply to electronic records. |
📖 Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1 A three-judge Bench held that the certificate is a condition precedent to the admissibility of secondary electronic evidence; it is not required where the original device itself is produced and proved; and where the certificate cannot be obtained from the person concerned, the party may apply to the court to require its production. The certificate may be furnished at any stage before the trial ends, subject to fairness to the accused. |
§ The Bharatiya Sakshya Adhiniyam, 2023 Section 63 carries forward Section 65B, and Section 63(4) requires the certificate in the form in the Schedule, which has a part to be completed by the person in charge of the device and a part by an expert. Section 61 provides that an electronic or digital record shall not be denied admissibility merely on the ground that it is electronic. The practical point. The investigating officer should obtain the certificate at the time of analysis, so that the evidence is not lost on a technicality at trial. |
4. Platform and Cross-Border Evidence
i. Subscriber details, IP logs and account records are obtained from intermediaries, which must preserve and furnish information to authorised agencies under the IT Rules, 2021.
ii. Many cases begin with a tip-off from a foreign platform or reporting body, such as CyberTipline reports routed to Indian agencies. The tip starts the investigation; the evidence must still be seized, analysed and proved in the ordinary way.
iii. Data held abroad may require mutual legal assistance, which takes time and should be sought early.
5. Protecting the Child in the Handling of Evidence
i. The material is sealed and handled by the fewest possible persons.
ii. It is not shown in open court, and descriptions in the record are kept to what the law requires.
iii. Section 23 and Section 33(7) protect the identity of any identifiable child depicted, and efforts should be made to identify and protect that child.
6. Frequently Asked Questions
Is a certificate always needed for electronic evidence?
For secondary electronic evidence, yes: Section 63 of the Bharatiya Sakshya Adhiniyam, following Arjun Panditrao Khotkar. It is not needed where the original device is itself produced and proved.
Why are hash values important?
They prove that the forensic copy analysed is identical to the original seized, so that the defence cannot claim alteration.
How is the purpose under Section 15(2) or (3) proved?
From digital traces of sharing or trade: sharing applications, upload logs, group memberships, messages, payment records and the organisation of the material.
Who examines the device?
A forensic laboratory or an Examiner of Electronic Evidence notified under Section 79A of the IT Act, whose expert gives evidence at trial.