Cloud and AI-Manipulated Electronic Evidence under BSA 2023: Admissibility & Deepfake Risks

Summary: This research critically examines the admissibility and reliability of cloud-stored and artificially manipulated electronic evidence under the Bharatiya Sakshya Adhiniyam, 2023. It reviews the recognition of electronic records as documents under Section 2(1)(e), primary evidence under Section 57, admissibility conditions under Sections 61–63, expert opinion under Section 39 and the statutory certificate prescribed in the Schedule. It examines how cloud servers, cross-border data storage and restricted access to digital custodians complicate certification and chain-of-custody requirements. It also distinguishes the integrity of a file, which may be supported by a hash value, from the authenticity of its contents, particularly where audio, video or images were generated or manipulated by artificial intelligence before preservation. The article discusses the Supreme Court decisions in Anvar P.V. v. P.K. Basheer, Shafhi Mohammad v. State of Himachal Pradesh, Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, Tomaso Bruno v. State of Uttar Pradesh and Ritesh Sinha v. State of Uttar Pradesh. These cases address electronic-evidence certification, production of original devices, preservation of CCTV footage and voice-sample collection, but not a comprehensive test for synthetic media. The paper recommends clearer cloud-custodian certification, forensic authentication standards, recognised digital-examination experts, preservation procedures, stronger chain-of-custody rules, defined responses to credible deepfake challenges, improved judicial and investigative training, privacy safeguards and international cooperation. It concludes that admissibility should not be confused with evidentiary credibility: genuine records should be usable in court, while fabricated media should be detected through reliable forensic and procedural safeguards.

Admissibility of Cloud-Based and AI-Manipulated Electronic Evidence Under the Bharatiya Sakshya Adhiniyam, 2023: A Critical Analysis

Abstract

Electronic records have become one of the most common forms of evidence in Indian courts. Chats, call records, e-mails, CCTV footage and bank data are now mostly stored on cloud servers and not on a single device, and advances in artificial intelligence have made it easy to create or alter audio, video and images in a way that is very hard to detect. This paper examines how the Bharatiya Sakshya Adhiniyam, 2023 (BSA) deals with the admissibility of such evidence. It analyses Sections 2(1)(e), 39, 57, 61, 62 and 63 of the BSA, the certificate prescribed in the Schedule, and the related provisions of the Information Technology Act, 2000 and the Bharatiya Nagarik Suraksha Sanhita, 2023. It also studies the decisions of the Supreme Court in Anvar P.V., Shafhi Mohammad and Arjun Panditrao Khotkar. The paper argues that the BSA improves the earlier law by adding hash value and expert certification, but it does not deal specifically with cloud-stored data or with AI-generated and manipulated content. It suggests clear rules on authentication, chain of custody and forensic verification so that courts can separate genuine electronic evidence from fabricated material.

Keywords: Electronic evidence, Bharatiya Sakshya Adhiniyam, cloud computing, deepfake, section 63 certificate, hash value, authenticity, India.

1. Introduction

Today almost every dispute has some digital trace. A WhatsApp message, a location history, a bank transaction or a video clip can decide whether a person is convicted or acquitted. Courts have therefore had to decide, again and again, when such material can be accepted as evidence and how much weight it should be given.

For many years this question was governed by Section 65B of the Indian Evidence Act, 1872. From 1 July 2024 that Act has been replaced by the Bharatiya Sakshya Adhiniyam, 2023.^[1] Section 63 of the new Act carries forward the old Section 65B, with some important changes. The Act is also the first Indian evidence law that expressly treats electronic and digital records as documents.

However, two developments have created problems that the drafters of the law could not have fully seen. The first is the move from local storage to the cloud. Data is now held in servers that may be in another city or another country, are run by private companies, and are often copied across several locations. The second is artificial intelligence. Deepfake videos, cloned voices and edited screenshots can now be made by an ordinary person with a free application. A court that sees such a clip cannot tell, with the naked eye, whether it is real.

The main difficulty is that the BSA tells us how an electronic record may be proved, but it does not tell us how a court should test whether the record is genuine in the first place. This paper looks at that gap and suggests how it can be filled.

2. Research Gap and Question

Many writers have discussed the certificate requirement under the old Section 65B and the conflict between the Supreme Court decisions on it. Fewer studies have examined how the new Act applies to cloud-hosted data, where the person producing the record often does not control the server. There is also very little Indian writing on the admissibility of AI-generated or AI-altered material. The existing discussion mostly stops at whether a certificate has been filed. It does not ask whether the certificate is enough when the content itself may have been fabricated. This research tries to cover that gap.

Is the framework under the Bharatiya Sakshya Adhiniyam, 2023 adequate to deal with the admissibility and reliability of cloud-stored and AI-manipulated electronic evidence?

3. Objectives and Research Methodology

The main objectives of this research are:

1. To understand the meaning and nature of electronic evidence, cloud-stored data and AI-manipulated content.

2. To examine the provisions of the BSA and related laws dealing with electronic evidence.

3. To analyse the important judicial decisions on the admissibility of electronic records.

4. To identify the weaknesses of the present law in dealing with cloud data and deepfakes.

5. To suggest reforms for a more reliable system of electronic evidence.

This research follows the doctrinal method. It relies on statutes, decisions of the Supreme Court and High Courts, and secondary materials such as reports and journal articles.

4. Legal Framework Governing Electronic Evidence in India

India does not have a separate law only for cloud or AI-generated evidence. Such material is dealt with under the general provisions on electronic records, read with the Information Technology Act and the procedural law.

4.1 Bharatiya Sakshya Adhiniyam, 2023

Section 2(1)(e) of the BSA defines a document to include electronic and digital records. This removes any doubt that an e-mail, a server log or a video file is a document in the eyes of the law. Section 61 adds that an electronic or digital record shall not be denied legal effect, validity or enforceability only because it is in electronic form.

Section 57 deals with primary evidence. The explanations to this section say that where an electronic record is stored in more than one file, or in more than one storage space at the same time or one after another, each of them is treated as primary evidence. This is a useful provision for cloud data, because the same record usually exists in several places.

Section 62 states that the contents of electronic records may be proved only in accordance with Section 63. Section 63 then lays down the conditions. The information must have been produced by a computer or communication device that was regularly used to store or process information, and the device must have been working properly during the relevant time. If these conditions are met, the printout or copy is treated as a document and is admissible without production of the original.

4.2 The Certificate Under Section 63(4) and the Schedule

Section 63(4) requires a certificate to be filed along with the electronic record. Unlike the old law, the certificate now has a fixed format in the Schedule to the Act.^[2] It has two parts. Part A is signed by the person in charge of the device or the party producing the record. Part B is signed by an expert. The certificate must also state the hash value of the electronic record.

The hash value is important. It is a fixed-length code generated from the contents of a file by an algorithm such as SHA-256. If even one pixel or one word of the file is changed, the hash value changes completely. So the hash works like a fingerprint and helps show that the file produced in court is the same as the file that was seized or downloaded. The BSA is therefore a clear improvement on Section 65B, which did not mention hash values or an expert at all.

4.3 Expert Opinion Under Section 39

Section 39 of the BSA allows the court to rely on the opinion of experts when it has to form an opinion on a point of science or on identity. Digital forensic examiners, handwriting experts and voice analysts fall within this provision. When a party claims that a video is a deepfake, the court will almost always need such an opinion. However, the Act does not say what qualifications an expert in AI-detection must have or which method the court should prefer.

4.4 Information Technology Act, 2000

The Information Technology Act, 2000 defines an electronic record and gives legal recognition to it. Section 79A allows the Central Government to notify an Examiner of Electronic Evidence, whose opinion can be used by courts. The Act also contains offences relating to identity theft, cheating by personation using a computer resource and publishing obscene material, and these are the sections most often used against creators of deepfakes. The Digital Personal Data Protection Act, 2023 is also relevant, because the production of cloud data in court often involves the personal data of third persons.

4.5 Bharatiya Nagarik Suraksha Sanhita, 2023

The BNSS supports the use of electronic material at the investigation stage. It provides for audio-video recording of search and seizure, and for forensic collection of evidence from the scene in serious offences.^[3] It also allows trial and other proceedings to be held in electronic mode. These provisions are meant to improve the quality of electronic evidence at the time it is collected, which is the stage where most problems begin.

5. Cloud and AI-Manipulated Evidence: The Practical Problems

5.1 Cloud-Stored Evidence

In cloud computing, data is held on servers owned by a service provider and accessed through the internet. Three problems arise in court.

The first is control. Section 63(4) requires the certificate to be given by a person in charge of the device or the relevant activities. When a police officer downloads a chat backup from a cloud account, the cloud company is the real custodian, and the company may refuse to sign a certificate or may be located outside India. The investigating agency may then have to certify something that it does not control.

The second is identification of the original. Because the same file may exist in many servers, it is not easy to say which copy is the source. The explanations to Section 57 help by treating each storage as primary evidence, but they do not solve the question of which copy is reliable.

The third is jurisdiction and access. Data stored in another country can usually be obtained only through the Mutual Legal Assistance process or by a request to the company. This takes time, and in the meantime the data may be changed or deleted.

5.2 AI-Manipulated Evidence

AI tools can now clone a person’s voice from a few seconds of audio, swap a face in a video, or generate a realistic photograph of an event that never took place. For a court, this creates a double problem. A false record may be accepted as real, and a real record may be rejected by the accused who simply says that it is a deepfake. Writers sometimes call this second risk the “liar’s dividend”.

Under the BSA, a deepfake video that is accompanied by a properly signed certificate with a hash value can satisfy every condition of Section 63. The hash only proves that the file has not been changed after it was created. It does not prove that the file was not fake when it was created. So the certificate protects against tampering after seizure, but gives no protection against fabrication before it.

Further, the explanation of how the AI-detection tools work is often technical and the tools themselves are not fully reliable. A forensic expert may give an opinion with a probability and not a clear yes or no, and the court has to decide how to treat such an opinion.

6. Important Judicial Developments

1. Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473.^[4]

The Supreme Court held that electronic records produced as secondary evidence are inadmissible unless they are accompanied by the certificate required by Section 65B. The Court said that Section 65B is a special provision and that it overrides the general rules on secondary evidence. In doing so, the Court overruled the earlier view taken in State (NCT of Delhi) v. Navjot Sandhu, (2005) 11 SCC 600, where a printout of call records had been accepted without a certificate. The decision made the certificate the centre of electronic evidence law in India.

2. Shafhi Mohammad v. State of Himachal Pradesh, (2018) 2 SCC 801.^[5]

In this case the Court said that the certificate requirement is a procedural rule and can be relaxed where a party is not in possession of the device and so cannot obtain the certificate. The reasoning was practical, because a litigant cannot be expected to get a certificate from a company that will not cooperate. However, this view reduced the force of Anvar and created confusion in the lower courts.

3. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1.^[6]

A three-judge bench settled the conflict. It held that Anvar P.V. was correctly decided and that Shafhi Mohammad was wrongly decided. The certificate is mandatory when secondary electronic evidence is produced, and Section 65B is a complete code on the subject. At the same time, the Court recognised that a party who has applied to the court or to the authority for the certificate and has not received it should not be penalised, and that the court can direct the person in control of the device to produce it. The Court also said that the certificate can be produced at a later stage of the trial in appropriate cases, subject to the court’s discretion. When the original device itself is produced and the witness proves it in the box, the certificate is not necessary, because that is primary evidence.

This decision is directly relevant to cloud data. Where a party cannot get a certificate from a cloud company, the decision gives a way to ask the court to direct production. The BSA has now followed this approach by making the certificate a formal document with two parts.

4. Tomaso Bruno v. State of Uttar Pradesh, (2015) 7 SCC 178.^[7]

The Court drew an adverse inference against the prosecution for not producing available CCTV footage and said that electronic evidence is often the most reliable form of evidence when properly preserved. This shows that courts also expect the investigating agency to collect and preserve such material in time.

5. Ritesh Sinha v. State of Uttar Pradesh, (2019) 8 SCC 1.^[8]

The Supreme Court held that a Magistrate may direct a person to give a voice sample for investigation even without an express provision in the Code of Criminal Procedure. This is relevant to the present research because voice comparison is one of the few ways of testing an audio recording that is alleged to be cloned. It shows that the courts are willing to use scientific methods to test authenticity, even when the statute is silent.

It must be noted that none of these decisions deals with AI-generated material. They all assume that the content of the record is genuine and only ask how it should be proved. The question of fabricated content is therefore still open before Indian courts.

7. Critical Analysis of the Existing Legal Framework

The BSA is a step forward, but the framework still has serious weaknesses when it is applied to cloud and AI-based evidence.

First, the Act is silent on cloud computing. It was written with a computer or a communication device in mind. The requirement that the device be in regular use and the person in charge sign the certificate does not fit well with a global cloud network run by a third party.

Second, the Act does not deal with AI-generated or manipulated content. The test in Section 63 is about the manner of production of the record and not about its truth. A fake clip made by software that was working properly and stored on a properly maintained server could satisfy all the conditions.

Third, the hash value proves integrity and not authenticity. This difference is not made clear in the Act, and there is a risk that courts will treat a certificate with a hash value as proof that the content is genuine.

Fourth, there is no standard for experts. Section 39 allows expert opinion, but there is no notified list of laboratories for AI-detection, no prescribed method, and no rule on how courts should deal with probabilistic findings. Different courts may therefore give different treatment to similar reports.

Fifth, the investigating agencies often lack training and equipment. Evidence is sometimes collected through screenshots or through a phone owned by the complainant, without a proper record of how it was copied. Once the first copy is damaged, no later certificate can repair it.

Finally, there is the risk of delay and misuse. An accused person may claim that every electronic record against him is a deepfake and force a long technical inquiry. If courts are not given a clear procedure, this can be used to delay trials.

8. Suggestions and Recommendations

8.1 Specific Provision for Cloud-Stored Data

The BSA should be amended, or rules should be made, to state who can issue the certificate when the data is stored with a cloud service provider. The provider, or its authorised officer in India, should be required to give the certificate within a fixed time when a lawful request is made. This will remove the practical difficulty that arises in Arjun Panditrao Khotkar-type situations.

8.2 Definition of AI-Generated and Synthetic Content

The law should clearly define terms such as synthetic media, deepfake and AI-generated content. Without definitions, courts and investigators will have to depend on general words, which can lead to inconsistent decisions.

8.3 Authentication Beyond the Certificate

The Schedule certificate should be supported by an additional authentication test for audio and video evidence. The party relying on the record should be asked to show its source, the device used to create it, and the metadata. If the other side raises a credible doubt about manipulation, the court should be able to order a forensic examination before the record is relied upon.

8.4 Recognised Forensic Laboratories and Standards

The Government should notify laboratories and experts for the examination of digital and AI-manipulated evidence under Section 79A of the Information Technology Act. Standard methods and minimum qualifications should be prescribed, so that reports are uniform and can be tested in cross-examination.

8.5 Chain of Custody Rules

Clear rules should be made for the seizure, imaging, storage and transfer of electronic evidence. Each step should be recorded with the date, time, name of the officer and the hash value. This will make it difficult to change evidence after it is collected and will make it easier for the court to trust it.

8.6 Preservation and Timely Production

Investigating agencies should send preservation requests to cloud companies as soon as the offence is reported, because deleted data may not be recoverable later. The courts should also be given the power to direct preservation of data on an urgent application.

8.7 Procedure When Deepfake Is Alleged

A short and time-bound procedure should be laid down for cases where a party says that a record is fabricated. The party raising the plea should be required to give some basis for it, and the court should decide the question at an early stage. This protects the accused from false evidence and also prevents the plea from being used only to delay the trial.

8.8 Training of Police, Lawyers and Judges

Regular training should be given to police officers, prosecutors, lawyers and judicial officers on digital forensics and on how AI-generated content is created and detected. A judge who understands the basics of the technology is better able to decide whether the expert evidence is reliable.

8.9 Privacy and Safeguards

Access to cloud data should be balanced with the right to privacy. Requests should be limited to the data needed for the case, and there should be proper judicial oversight, so that the collection of electronic evidence does not turn into a general search of a person’s digital life.

8.10 International Cooperation

India should improve its arrangements for obtaining data held in other countries, including quicker Mutual Legal Assistance procedures and agreements with major service providers. Since cloud servers and AI tools operate across borders, a purely domestic solution will not be enough.

9. Conclusion

The Bharatiya Sakshya Adhiniyam, 2023 has made electronic evidence a regular part of the law of evidence. By giving the certificate a fixed form, adding the hash value, and requiring the signature of an expert, it has addressed several problems that were seen under Section 65B. The Supreme Court decisions in Anvar P.V. and Arjun Panditrao Khotkar continue to guide the interpretation of the new provisions.

However, the Act was not designed for evidence that sits in a cloud network or for content that can be created by software. A certificate shows that a record has not been altered after it was produced, but it cannot show that the record was true to begin with. As AI tools become cheaper and better, this gap will become more serious.

India therefore needs clear rules on cloud-stored data, a definition of synthetic content, recognised forensic standards, a proper chain of custody, and a fair procedure for deepfake allegations. At the same time, the law must not become so strict that genuine electronic evidence is excluded for technical reasons. The aim should be a system in which courts can trust a digital record when it is genuine and reject it when it is not.

Notes:

^[1] Bharatiya Sakshya Adhiniyam, No. 47 of 2023, § 63 (India). ↩

^[2] Bharatiya Sakshya Adhiniyam, No. 47 of 2023, § 63(4) & Sched. (India). ↩

^[3] Bharatiya Nagarik Suraksha Sanhita, No. 46 of 2023, §§ 105, 176(3) (India). ↩

^[4] Anvar P.V. v. P.K. Basheer, (2014) 10 S.C.C. 473 (India). ↩

^[5] Shafhi Mohammad v. State of Himachal Pradesh, (2018) 2 S.C.C. 801 (India). ↩

^[6] Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 S.C.C. 1 (India). ↩

^[7] Tomaso Bruno v. State of Uttar Pradesh, (2015) 7 S.C.C. 178 (India). ↩

^[8] Ritesh Sinha v. State of Uttar Pradesh, (2019) 8 S.C.C. 1 (India). ↩

*****

References

Statutes

1. The Constitution of India, 1950.

2. The Bharatiya Sakshya Adhiniyam, 2023.

3. The Bharatiya Nyaya Sanhita, 2023.

4. The Bharatiya Nagarik Suraksha Sanhita, 2023.

5. The Information Technology Act, 2000.

6. The Digital Personal Data Protection Act, 2023.

7. The Indian Evidence Act, 1872 (repealed).

Cases

1. Anvar P.V. v. P.K. Basheer, (2014) 10 SCC 473.

2. Shafhi Mohammad v. State of Himachal Pradesh, (2018) 2 SCC 801.

3. Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal, (2020) 7 SCC 1.

4. Tomaso Bruno v. State of Uttar Pradesh, (2015) 7 SCC 178.

5. State (NCT of Delhi) v. Navjot Sandhu, (2005) 11 SCC 600.

6. Ritesh Sinha v. State of Uttar Pradesh, (2019) 8 SCC 1.

Authors: Vasee and Harini (Co-author), Vinayaka Mission’s Law School, Vinayaka Mission’s Research Foundation.