Source: http://locolaw.blogspot.com/2012/07/encryption-and-self-incrimination.html
Timestamp: 2018-01-19 15:01:29
Document Index: 261571970

Matched Legal Cases: ['Art 20', 'Art 20', 'Art 20', 'Art 20', 'Art 6', 'Art 6', 'Art 20']

Loco Law: Encryption and Self-Incrimination
Encryption of data is a means to secure and sensitive private data and prevent third parties from obtaining that information. It is a part of our everyday life, and we come across encryption each time we conduct an online transaction through our credit/debit cards, or install a new software on our computer by inserting the product key. The easy availability of such software however makes it easy to be used for a number of nefarious purposes, with "criminals including drug traffickers, pedophiles and terrorists [turning] to encryption to conceal their activities". To drive home the point of the security issue, you can see a slightly old but very compelling list of incidents involving encryption here.
This reality has prompted States to enact key disclosure laws so that law enforcement is not crippled when faced with encrypted data, thus providing for compelling individuals to produce encryption keys. These laws pose searching questions for legal regimes which provide a right against self-incrimination, as witnessed in the U.K. and U.S.A. India also provides for compelled disclosure through s. 69 of the IT Act, 2000, but it has somehow remained under the radar for more than a decade in spite of the Constitution providing a fundamental right against self-incrimination through Article 20(3). Through this comment I seek to explore this aspect of s.69, reminding us of the challenges that the right against self-incrimination creates and faces in an era of intense security and surveillance.
Supreme Court on Self-Incrimination
It is essential to provide a background sketch of the law on self-incrimination in India today, as that will shape any interpretation which the Court adopts. The Supreme Court in the early years of independence gave many significant rulings on interpretations of Part III Articles, and one such ruling was M.P. Sharma v. Satish Chandra where the scope and extent of Art 20(3) was clarified. Speaking for a unanimous bench, Jagannadhadas, J. famously held that, “[t]o be a witness is nothing more than to furnish evidence … indeed, every positive volitional act which furnishes evidence is testimony”, making it clear that oral and documentary evidence could come within the confines of Art 20(3).
This catch-all phrase did not hold the field for long though and less than a decade later, eleven judges in of that Court in State of Bombay v. Kathi Kalu Oghad reconsidered the matter. By an 8-3 majority, the concept of “personal knowledge” as the key constituent of evidence for Art 20(3) was introduced and continues to be the test today. The scope of 20(3) was significantly restricted, and evidence such as fingerprints and handwriting exemplars were excluded from its ambit since they did not have a communicative, personal aspect, and were independent of the will of the person as such. An equal if not more important development ignored by textbooks, is the shift in the approach of the Court; from focusing on the positive volitional acts of testimony, the focus was now the testimony itself. It has remained so since.
Why do I refer to Shyamlal as a decision of particular importance? Both s. 69 of the IT Act and s. 91 of the Cr.P.C. depend on compelling the individual to produce the necessary information. Taking the decision in Shyamlal to its logical conclusion, one would find it difficult to argue that compelling an accused to produce encryption keys or assist in decryption would not offend Art 20(3). If the Court would have been more receptive of the testimonial-physical distinction brought in by Kathi Kalu Oghad, then such an outright restriction would certainly not be the outcome.
Evidentiary Nature of Encryption Keys
State access to keys was provided in s. 49 of the Regulation of Investigatory Powers Act 2000 (“RIPA”) which like the IT Act only allows for decryption directions when necessary. Arguments were made that the section offends Art 6 of the ECHR, but were not given much credence at the time. These claims formed the principal arguments in R v. S and the reasoning adopted by the Court of Appeal is of particular interest. Briefly, the Police issued notices to both defendants compelling them to provide the encryption keys to the hard drives without which the data was rendered inaccessible. The defendants toed the Art 6 line. Noting the observations of the European Court in Saunders, the question became whether the key itself would be evidence dependent of the will of the accused – or testimonial evidence in Indian parlance. The Court held it did not, employing the oft-used analogy of the locked drawer: just as the key to that locked drawer exists independent of the will of the accused, so does the encryption key. The act of giving the key itself was not incriminating, but comparable to giving blood or urine samples.
Recognition of the engagement of the right against self-incrimination is followed by the next important step of balancing the claims involved. Here again American jurisprudence proves handy. In both Boucher and John Doe, the case actually turned on what is called the "foregone conclusion” doctrine. Simply put, compelling an accused to produce evidence would not engage self-incrimination rights if the existence and location of that evidence is a “foregone conclusion” by virtue of it being known to the investigating agency through other independent sources. Thus such testimony “adds little or nothing to the sum total of the Government’s information.” Indian jurisprudence has primarily focused on reliability of evidence as a rationale behind Art 20(3), which is supplemented by the concept of fairness underlying criminal trials. It is argued that the doctrine fits neatly in this framework. Not only does it augment reliability of evidence for which the sole source was otherwise the accused himself, but it also makes compulsion on the accused seem less abhorrent since he is not providing evidence to which the authorities otherwise had no access at all. It would be a mistake to criticise this position merely for it takes assistance of the accused: a high burden of proof in criminal law is not an exclusive burden upon the State forbidding assistance from the accused and mustn't be confused as such.
Thus I believe this approach offers a fitter alternative to the current position espoused by Shyamlal. It does indeed involve judicial appreciation that can turn controversial, but provides a helpful starting point nonetheless.
Post by Abhinav Sekhri, who studies law at the National Law School of India University, Bangalore.