WhatsApp Chats and Messages as Evidence under the Bharatiya Sakshya Adhiniyam, 2023: Proof, Screenshots, Attribution and Completeness

Messaging has displaced correspondence, and a large proportion of the documentary evidence now produced in Indian courts consists of chats. The Adhiniyam accommodates them without difficulty as a matter of definition — 'messages' and 'documents on smartphones' are named in the illustrations to Section 2(1)(d). The difficulties lie elsewhere: in the form in which chats are produced, in the selective extraction of fragments, and above all in showing who was holding the phone.

1. A Chat Is a Document

Messages and documents on smartphones are named expressly, so the threshold question does not arise. What follows is the ordinary apparatus of Part III, together with the special provisions on electronic records.

The Adhiniyam also settles a question that had been argued under the earlier law. Section 63 now refers throughout to a 'computer or communication device', where Section 65B of the Indian Evidence Act spoke only of a computer. Whether a phone was a computer for the purposes of the certificate provision is no longer arguable.

2. Relevance Comes First

The commonest error with chat evidence is to argue about the certificate before establishing why the messages matter. The relevance question determines what the messages can prove.

As an admission. Section 15 includes a statement 'contained in electronic form'. A message by a party suggesting an inference against him is an admission and is substantive evidence against him. This is much the commonest and much the strongest route.

As an operative communication. Where the message itself has legal effect — a threat, a demand for dowry, an offer, an acceptance, an abusive utterance constituting an offence, a defamatory publication — the words are the fact in issue, and proving that they were sent proves the operative act. No question of hearsay arises.

As conduct or as showing a state of mind. A message received by a person and affecting his conduct is relevant under Explanation 2 to Section 6(2); a message showing intention, knowledge or ill-will in reference to the matter in question is relevant under Section 12.

As part of the transaction. Messages exchanged during or immediately after an occurrence may form part of the same transaction under Section 4, and their spontaneity is itself the guarantee.

3. The Form in Which Chats Are Produced

How a chat is produced makes more difference to its value than almost anything else, and the three common forms are very unequal.

3.1 Screenshots

The weakest form, and the commonest. A screenshot is an image of a screen. It carries no metadata about the underlying messages, no timestamps beyond what is visible, no message identifiers, and nothing by which it can be verified against the source. It is trivially editable, and an edited screenshot is indistinguishable from a genuine one.

A screenshot is also almost always selective, showing a handful of messages from a much longer exchange, which raises the completeness problem discussed below.

3.2 An export from the application

Considerably stronger. Messaging applications ordinarily permit a conversation to be exported as a text file, with or without attached media. The export contains every message in the conversation with its timestamp and sender in a consistent format, and it can be hashed as a file.

What an export does not contain is the underlying database structure, and it is produced by the application rather than extracted from storage, so it reflects what the application chooses to show.

3.3 A forensic extraction

The strongest form. A forensic tool extracts the application's underlying database from the device, which contains the messages, their identifiers, their timestamps, their delivery and read status, deleted material still present in the database, and associated metadata. The extraction is performed on a forensic image taken with a write blocker, and both are hashed.

This is what an examiner produces, and it is what supports a Part B declaration of any substance. It also permits recovery of material the application no longer displays.

4. Primary Evidence or Secondary?

The Explanations to Section 57 frequently make a chat record primary evidence, and three of them apply.

Explanation 3 — a record stored simultaneously or sequentially in multiple files is primary evidence in each file. A message exists in the sender's application database and in the recipient's, and each is a file storing the record.

Explanation 4 — a record produced from proper custody is primary evidence unless it is disputed. A chat produced from the phone of the person who sent or received the messages is from proper custody.

Explanation 6 — a record in multiple storage spaces in a computer resource, including temporary files, is primary evidence. This covers cached media and material recovered from the application's working files.

Where the certificate is required, the four conditions in Section 63(2) must be satisfied — that the phone was used regularly to create and store information for an activity regularly carried on by a person having lawful control; that messages were regularly fed in in the ordinary course; that the device was operating properly; and that the output reproduces or is derived from what was fed in. For a personal phone in ordinary use these are satisfied without difficulty, and the party himself signs Part A to the best of his knowledge and belief, as Section 63(4) permits.

5. Completeness — Section 33

This is the objection most worth taking against chat evidence and the one least often taken.

A chat is a conversation and is also an electronic record, so the section applies twice over. Three messages extracted from an exchange of three hundred may convey the opposite of what the conversation actually said — an apparent admission may be a repetition of what the other person had just alleged, an apparent threat may be a quotation, and an apparent agreement may be immediately withdrawn in the next message.

The section requires enough to be produced for the court to understand two things: the nature and effect of the statement, and the circumstances in which it was made. The second limb is the one that matters here, because a message's meaning is almost entirely a function of what preceded it.

Where a party produces a screenshot of selected messages and resists production of the rest, two consequences follow. The court may require the context under Section 33. And under Illustration (g) to Section 119 it may presume that evidence which could be produced and is not would, if produced, be unfavourable to the person withholding it.

6. Attribution — Who Was Holding the Phone

Everything in the statutory scheme addresses the record. Nothing addresses the person, and in chat cases this gap is wider than anywhere else, because a phone is a personal object that other people pick up.

Section 90 permits the court to presume that an electronic message forwarded through a server corresponds with the message as fed in for transmission, and then says in terms that the court shall not make any presumption as to the person by whom such message was sent. The statute could hardly be clearer.

What is available is an accumulation of circumstances, and a chat case is won or lost on how well they are assembled.

• The number and the account. Evidence that the number is registered to the person, that the account is his, and that the device is his.
• Exclusive possession of the device. That he alone used it, that it was password protected, and that nobody else had access.
• Contents known to him alone. References to matters within his knowledge, in his idiom, consistent with his other communications.
• Continuity of the conversation. A single exchange running over time, in which the person is addressed by name and responds, is far harder to attribute to somebody else than an isolated message.
• Conduct following the messages. That he acted on what was said, referred to it afterwards, or was confronted with it and did not deny it.
• The profile. The display name, photograph and status associated with the account, though these prove very little alone.
• Admission. The strongest route, and the reason a party's own messages are ordinarily easier to use than a stranger's.
• Corroborative records. Call detail records, tower location data, or other material placing the person with the device at the material time.

7. Particular Difficulties

7.1 End-to-end encryption

Where a messaging service encrypts messages end to end, the provider does not hold the content and cannot produce it. The practical consequence is that the only sources are the devices of the participants. A party who expects to obtain chat content from the service provider by a summons will ordinarily be disappointed; what the provider can supply is subscriber information and, in some cases, metadata, but not the messages themselves.

This makes the preservation of the device correspondingly important, and it makes an application for its production — under Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023, corresponding to Section 91 of the Code of Criminal Procedure, 1973, or by discovery in a civil suit — the principal route where the other side holds the material.

7.2 Deleted and disappearing messages

A deleted message may persist in the application's database, and a forensic extraction may recover it. Where it does, the recovered fragment is primary evidence under Explanation 6 to Section 57, being material in automated storage.

Two cautions attach. A recovered fragment may be incomplete, undated or out of sequence, and Section 33 applies to it with particular force. And where a message has been deleted, the fact of deletion may itself be relevant as conduct under Section 6(2), which is sometimes more valuable than the content.

7.3 Group conversations

A group chat raises attribution problems for every participant, not merely for one. What must be established is which member sent which message, and the ordinary display of a name is a function of the recipient's contact list rather than of anything the sender did.

A group chat also raises a Section 8 question in a conspiracy case. Things said by a conspirator in reference to the common design are relevant against all, but only where there is independent material giving reasonable ground to believe a conspiracy existed, and only for the period during which it subsisted. A group conversation is not automatically evidence against every member of the group.

7.4 Forwarded messages

A forwarded message is evidence that the forwarder sent it. It is not evidence that the original author wrote it, still less that its contents are true. Where the origin of a forwarded message matters, it must be traced, and in most cases it cannot be.

8. A Practical Checklist

1. Preserve the device or the export at once, and compute a hash at that moment rather than when the certificate is drawn.
2. Export the whole conversation rather than taking screenshots, and where authenticity is likely to be contested, obtain a forensic extraction.
3. Produce the whole exchange, not a selection, because Section 33 requires it and selective production invites an adverse inference.
4. Obtain the certificate under Section 63(4) at the outset, notwithstanding Explanation 4 to Section 57.
5. Retain the device and do not continue using the account in a way that alters the record.
6. Plan the attribution case separately — number, device, exclusive possession, contents, continuity, conduct, admission, corroborative records.
7. Apply early for the other side's device where the material is with them, since the provider will not hold encrypted content.
8. Do not rely on delivery or read indicators to prove service or knowledge.

9. The Position Stated Shortly

1. Messages and smartphone documents are named in the illustrations to Section 2(1)(d), and 'communication device' now appears throughout Section 63.
2. Relevance comes first. A chat is evidence of its contents' truth chiefly as an admission under Section 15, or where the words themselves are operative.
3. A third party's message is hearsay, and proving the chat does not make it true.
4. The form of production decides the value. A screenshot is weak, an export is adequate, a forensic extraction is strong.
5. Explanations 3, 4 and 6 to Section 57 often make a chat primary evidence, but Explanation 4 fails the moment the record is disputed.
6. Section 33 is the strongest objection to selective production, and it operates alongside the adverse inference in Illustration (g) to Section 119.
7. Section 90 forbids any presumption as to who sent a message, and attribution must be built from ordinary evidence.
8. End-to-end encryption means the provider has nothing to produce, so the devices are the only source and must be preserved and, where necessary, compelled.

10. Related Topics and Provisions