Social Media Posts as Evidence under the Bharatiya Sakshya Adhiniyam, 2023: Proof, Account Attribution and Platform Records

Websites are named in the illustrations to the definition of 'document', so a post is plainly a document. What makes social media evidence difficult is everything else: the material sits on a server controlled by a company that is frequently foreign and never a party, it can be deleted in a moment, screenshots of it are worthless when contested, and the account from which it was published may have been opened by anybody in any name.

1. A Post Is a Document

'Websites' and 'server logs' are named expressly, and the addition of both is new to the Adhiniyam. The consequence is that the whole apparatus of Part III applies, together with Sections 57, 61 and 63.

2. Relevance

A post may matter in several ways, and identifying which determines what it can prove.

Where the words are the offence or the wrong. In defamation, in prosecutions for offences involving publication, in contempt, and in electoral matters, the words are the fact in issue. Proving that they were published proves the wrong, and no hearsay question arises.

As an admission. Section 15 includes a statement 'contained in electronic form'. A post by a party suggesting an inference against him is substantive evidence against him — a person who publishes that he was at a place, or that he did a thing, has made an admission.

As conduct. Under Section 6(2), a post made before or after an occurrence may be relevant as conduct — a threat published beforehand, a celebration afterwards, the deletion of an account.

As showing a state of mind. Under Section 12, posts showing intention, knowledge or ill-will in reference to the particular matter in question are relevant. Explanation 1 to that section is important here: a general disposition is not relevant, and a history of intemperate posting does not become admissible merely because it suggests the person is intemperate.

As part of the transaction. Under Section 4, posts made during or immediately after an occurrence may form part of the same transaction.

3. Forms of Production

How a post is produced determines what it is worth, and the four forms in use are very unequal.

3.1 A screenshot

The weakest and the commonest. A screenshot is an image of a screen, carrying no metadata, no post identifier, no verifiable link to the platform, and no indication of what was on the page around it. It is trivially editable, and browser tools make a convincing fabrication a matter of seconds.

A screenshot is adequate where the post is admitted. Where it is disputed, it establishes very little on its own.

3.2 A capture with the page address and time

Better. A capture that shows the full page address, the date and time of capture, and the surrounding page context is more informative, and where the capture was made by a person who deposes to having made it and hashed the file at the time, it becomes a usable record.

3.3 A platform download

Most platforms permit an account holder to download his own data — posts, messages, media, activity logs and account history — in a structured archive. Where the post is on the party's own account, this is a considerably stronger production than a screenshot, because it comes from the platform, carries identifiers and timestamps, and can be hashed as a file.

3.4 A platform record obtained by process

The strongest. Records produced by the platform itself in answer to legal process carry the platform's own authentication, include the account registration particulars and access logs, and come from a third party with no interest in the litigation. They are also the hardest to obtain, for the reasons set out below.

4. Proof

The first question is whether the output is primary evidence.

Explanation 4 to Section 57 — a record from proper custody is primary evidence unless disputed. A post downloaded by the account holder from his own account is from proper custody. In a contested case it will be disputed, and the Explanation then falls away.

Explanation 3 — a record stored simultaneously or sequentially in multiple files is primary evidence in each. A post exists on the platform's servers and in the local storage of the devices that displayed it.

Explanation 6 — automated storage including temporary files is primary evidence, which covers cached copies of pages recovered from a device.

Where the certificate is required, the four conditions in Section 63(2) must be satisfied and the certificate furnished under sub-section (4) in the form of the Schedule, with the hash value in Part A and the expert declaration in Part B.

5. Obtaining Records from a Platform

Platform records are the strongest evidence available and the most difficult to get, and the difficulty is jurisdictional rather than legal.

Where the platform has a presence in India, a summons to produce a document under Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023, corresponding to Section 91 of the Code of Criminal Procedure, 1973, is the ordinary route in a criminal matter, and the discovery machinery applies in a civil suit. The intermediary framework under the Information Technology Act, 2000 and the rules made under it requires significant intermediaries to appoint officers in India for compliance and grievance purposes, which gives a point of contact.

Where the data is held abroad and the platform declines to produce it on a domestic requisition, a request through mutual legal assistance channels may be required. This is slow, and a party who needs the material should begin the process at the earliest possible stage.

Two practical points recur. Platforms retain records for limited periods and honour preservation requests — a request to preserve, made promptly, stops the clock while the process of obtaining production runs. And what a platform will produce differs by category: basic subscriber information and access logs are ordinarily furnished more readily than content, which frequently requires a higher form of process.

6. Account Attribution

The attribution problem is worse on social media than anywhere else, because accounts can be opened in any name with minimal verification, impersonation is common, and an account may be operated by several people.

What must be established is that the person published the post, and the material available is an accumulation.

• Registration particulars — the email address or number used to open the account, and to whom they belong.
• Access logs — the internet addresses from which the account was accessed, which can be connected to a subscriber through the operator's session records.
• Device association — that the account was logged in on a device belonging to the person, established from a forensic extraction.
• Contents known to him alone — references to matters within his knowledge, in his idiom, consistent with his other communications.
• Continuity and pattern — an account used over years, consistent with the person's life, movements and relationships, is far harder to attribute elsewhere than a single post.
• Conduct — that he acted on the post, referred to it, responded to comments, or was confronted and did not deny it.
• Admission — the strongest route, and the one that disposes of the problem entirely.

Section 90 forbids any presumption as to who sent an electronic message, and the reasoning extends here. A display name, a profile photograph and a verified appearance prove very little standing alone.

6.1 Impersonation and fake accounts

The commonest defence is that the account was not the person's, or was compromised. It is answered by the same material — registration particulars connecting the account to the person, access logs connecting the sessions to his connections, and device association connecting the account to his handset.

Where the defence is that the account was hacked, the platform's access logs are ordinarily decisive, because they show from where and on what devices the account was accessed. The absence of any anomalous access, coupled with continuous ordinary use, is a strong answer.

7. Public, Restricted and Deleted

Three situations require distinct treatment.

7.1 Public posts

A post published to the world raises no question of unlawful access. Anybody may view it and capture it, and the capture is admissible on ordinary principles. The difficulty is only one of proof.

7.2 Restricted posts

Where a post was visible only to a limited group, the person who obtained it must explain how. A capture by a member of the group who was entitled to see it presents no difficulty. A capture obtained by unauthorised access to an account is another matter: on the general Indian position in Pooran Mal v. Director of Inspection (Investigation), (1974) 1 SCC 345, the test of admissibility is relevancy, and material is not excluded because of the manner in which it was obtained unless a statute so provides — but unauthorised access is an offence under the Information Technology Act, 2000, and the circumstances remain a legitimate subject of comment on weight.

7.3 Deleted posts

A deleted post may survive in several places: in the platform's own records, in the local cache of a device that displayed it, in a screenshot taken before deletion, and in a third-party archive of web pages.

A cached copy recovered from a device is primary evidence under Explanation 6 to Section 57. An archived copy from a third-party archive is a record produced by that archive, and proving it requires the same certificate difficulty as any third-party record — though the archive's own record of when it captured the page may itself be valuable.

The fact of deletion may matter more than the content. Deleting a post after an occurrence is conduct under Section 6(2), and where a person is shown to have removed material after a dispute arose, the deletion is relevant and the inference under Illustration (g) to Section 119 — that evidence withheld would have been unfavourable — is available.

8. Completeness and Context

A post read alone frequently means something different from a post read in context, and Section 33 applies with full force.

A post is often a reply. A comment is part of a thread. A statement may quote what somebody else said, may be sarcastic, or may be withdrawn in the next post. The section requires enough to be produced for the court to understand the nature and effect of the statement and the circumstances in which it was made, and the second limb is the operative one.

Where a party produces a single post from a long exchange and resists production of the rest, the court may require the context under Section 33, and may presume under Illustration (g) to Section 119 that what is withheld would have been unfavourable.

9. The Substantive Setting

Social media evidence arises most often in three settings, and each carries its own law beyond the Adhiniyam.

Online speech offences. The constitutional limits were set in Shreya Singhal v. Union of India, (2015) 5 SCC 1, in which the Supreme Court struck down Section 66A of the Information Technology Act, 2000 as violative of Article 19(1)(a). A practitioner should be alert to prosecutions still being launched under a provision that no longer exists, which has been the subject of repeated judicial comment.

Defamation. The words are the fact in issue, and what must be proved is publication — that the post was accessible to somebody other than the parties. Platform records showing reach and visibility bear directly on this, and on damages.

Matrimonial and harassment proceedings. Posts are relevant as conduct under Section 6(2) and as showing a state of mind under Section 12, subject to Explanation 1 to that section: the post must show the state of mind in reference to the particular matter in question, not a general disposition.

10. A Practical Checklist

1. Capture immediately, before the post is deleted, and hash the capture at the moment it is made.
2. Send a preservation request to the platform at once, which stops the retention clock while production is pursued.
3. Download the account archive where the material is on the party's own account, rather than relying on screenshots.
4. Apply for platform records early, and allow for the delay where the data is held abroad.
5. Ask for registration particulars and access logs, not merely content, since attribution is the real battleground.
6. Produce the context, not a single post, because Section 33 requires it.
7. Plan the attribution case separately — registration, access logs, device association, contents, pattern, conduct, admission.
8. Check the provision under which any prosecution is launched, given that Section 66A has been struck down.

11. The Position Stated Shortly

1. Websites and server logs are named in the illustrations to Section 2(1)(d), and the addition is new to the Adhiniyam.
2. Relevance comes first — the words as the wrong itself, as an admission, as conduct, as showing a state of mind, or as part of the transaction.
3. A post by a stranger offered for its truth is hearsay, and proving it does not make it true.
4. The form of production decides its value, and a screenshot is worth little once the post is disputed.
5. The certificate is the central difficulty, because the person in charge of the record is an officer of a platform that is frequently foreign.
6. Platform records are the strongest evidence and the hardest to obtain, and preservation requests should be sent at once.
7. Attribution is the real battleground — registration particulars, access logs and device association are what answer it.
8. Section 33 requires the context, and deletion after a dispute is itself conduct under Section 6(2).

12. Related Topics and Provisions