Right of Self-Incrimination in Digital Age: Whether Compelled Disclosure of Password/Biometrics is Unconstitutional?

Recently, two courts in India had the chance to address the issue of whether an accused person can be forced to give a passcode, password, or biometric without violating the constitutional ban on self-incrimination as provided in Article 20(3) of the Indian Constitution.¹ So far there is no authoritative pronouncement by the Supreme Court of India on this issue, hence the question is res integra.

In the first case, the Karnataka High Court² decided that compelling the accused to disclose the passcode or biometrics would not violate the rule against self-incrimination because mere disclosure of password, passcode, or biometric alone is not incriminating and is relevant to searches as permitted by Section 93 of the Criminal Procedure Code (CrPC)³, which allows the ordering for a search of a “place” or a specified area.

In the other case, the Delhi CBI Special Court⁴, disallowed an application seeking direction to the accused person for disclosure of the passcode as it directly affects the right against self-incrimination. However, it held that unlocking of the phone through fingerprint/facial recognition will not violate Article 20(3) of the Constitution. The compelled unlocking of phones or laptops also affects the right of privacy. However, in the article, the authors have only analysed the issue with reference to self-incrimination. Both verdicts are analysed in this article. The authors argue that both the Courts’ justifications failed to take into account the comparative literature on the subject in order to offer a comprehensive solution that addresses every objection to the disclosure. Thus, in order to find a balance between fair investigations and the right against self-incrimination, the Supreme Court must address this matter.

Karnataka High Court judgment

The brief facts in the instant case were that a case under the Narcotic Drugs and Psychotropic Substances Act (NDPS), 1985⁵ and the Foreigners Act, 1946⁶ was registered against the petitioner. The police had seized the petitioner’s mobile, laptop among other objects and asked him to disclose the password of his mobile and laptop and even his e-mail account. The petitioner simply refused. Upon refusal, the police filed two applications before the trial court. In the first application, the police prayed for conducting polygraph test upon the petitioner without his consent to ascertain the password. In the second application, the police sought an order to direct the petitioner to disclose the password. Both applications were allowed by the trial court and thus, the petitioner challenged these two orders before the High Court in the instant case. In its ruling, the High Court overturned the order governing the administration of the polygraph test. However, the Court denied the appeal against the passcode disclosure order, noting that Article 20(3) of the Indian Constitution does not protect passcode disclosure as a matter of right. The Court first considered the distinction between testimonial and non-testimonial (physical) evidence for the purpose of providing protection under Article 20(3) of the Constitution in order to establish its rationale. According to Indian law, an accused is protected from revelations that could implicate them in a crime under Article 20(3).

The Supreme Court had determined the parameters of the protection against self-incrimination in the landmark case of State of Bombay v. Kathi Kalu Oghad⁷ where the Court was required to determine if giving handwriting, signature, or thumb impression samples violates Article 20(3). The Court ruled against the accused noting that a witness can provide both testimonial and non-testimonial (physical) evidence, and that an accused person can only be deemed a witness against oneself in the former case.

It reasoned that,

11. … Self-incrimination must mean conveying information based upon the personal knowledge … and cannot include merely the mechanical process of producing documents in court which may throw a light on any of the points in controversy, but which do not contain any statement of the accused based on his personal knowledge.⁸

Further at para 11 of Kothi Kalu Oghad case⁹ the Court observed that:

11. … “To be a witness” means imparting knowledge in respect of relevant facts, by means of oral statements or statements in writing, by a person who has personal knowledge of the facts to be communicated to a court or to a person holding an enquiry or investigation.

Relying on the dictum of Kathi Kalucase¹⁰, the Court observed that a direction to provide a password, passcode, biometric would not amount to testimonial compulsion as the petitioner is not answering any question that would expose the petitioner to guilt. It is only in the nature of a direction to produce a document. The information accessed on the smartphone is only to access the data and documents on the phone and it is for the investigation officer to prove and establish the same in a court of law by following the applicable rules of evidence. Disclosure of password, biometric is akin to supplying fingerprints, thumb impression, voice sample¹¹ or taking samples of garments, chemical samples that are physical evidence and do not amount to forced testimony from the accused.

The Court further held that a search warrant as per Section 93 CrPC can also be issued by the court in order to search a smartphone or computer system for investigation purposes. In the Court’s reasoning¹², Section 91 CrPC¹³ enables a right in favour of the court or officer in charge of a police station to issue summons or to order from a person’s possession production of any document for the investigation purpose. The Court treated a password/passcode/biometric as a document as provided under Section 91. The Court further relied on Section 100 CrPC¹⁴ to justify that on production of a search warrant, any person in charge of closed place would allow free access to the person executing search warrant. Thus, a person in possession of an electronic device/gadget must cooperate with the investigation officer by disclosing the passcode to let them gain access to the device.

In its final assessment, the Court found that disclosure of passcode does not constitute violation of right against self-incrimination as CrPC provides mechanism for disclosure of passcode/biometrics.

Problem with the High Court judgment

Given that everything in the modern world is stored on a laptop or mobile device, the judgment¹⁵ conveyed that the court believed that withholding the passcode would substantially impair investigations. Investigating officers would not have access to the data on mobile devices required for conducting inquiries if the right against self-incrimination was upheld in the instant case. Three errors were made by the Court in forming its reasoning.

First, the Court erred in treating passcode/password and biometrics as same for the purpose of interpretation of Article 20(3). Passcodes and passwords cannot be considered non-testimonial or physical evidence because, when an accused person is forced to reveal a password, he or she must use their mental faculties to recall it and therefore the information falls under the category of testimonial evidence.

The Supreme Court in Selvi v. State of Karnataka¹⁶ had observed that a zone of mental privacy is established by Article 20(3), which the State may not invade in order to obtain personal information concerning a crucial fact. Further, the Court in Selvi¹⁷ held that if statements may lead to incrimination by themselves or “furnish a link in the chain of evidence” the bar of Article 20(3) of the Constitution would apply. Thus, the Court committed an error in treating the passcode/password as non-testimonial evidence.

Second, in para 12.3 of the judgment¹⁸, the Court vaguely noted that under Section 93 CrPC the Court has the power to issue a search warrant for a place which also covers mechanism for search of phones/laptop. It treated the word “place” and “part thereof” in Section 93(2) CrPC to also include a phone/laptop but no reasoning is assigned in the judgment in support of the same.

It was further noted that the disclosure of a passcode or biometric is comparable to the procedure for producing a document set forth in Section 91 of the Criminal Procedure Code, and as a result, failure to reveal a passcode or password would give the investigating officer the right to search the phone in accordance with Section 93, and the owner of the phone could be compelled to unlock it in accordance with Section 100 CrPC. The reasoning is flawed and is not compatible with the Code of Criminal Procedure. Firstly, the passcode is not a document for the purpose of Section 91 CrPC that exists as physical evidence but is personal information that resides in the zone of mental privacy. It usually exists as a combination of numbers or patterns in the mind and therefore its revelation is protected under Article 20(3) of the Constitution. Secondly, the power to issue search of mobile/laptop cannot be found in Section 93. The Court erred in treating electronic device and the word “place” as the same under Section 93. The word “place” has been defined under Section 2(p) CrPC¹⁹ to include a house, building, tent, vehicle, and vessel. Applying the interpretation rule of ejusdem generis²⁰, it cannot be said that electronic devices are of the same kind as a house, building, tent, vehicle, or vessel. Therefore, the search for mobile cannot be directed under Section 93.

Third, the flaw lies in ignoring the discussion on doctrine of “foregone conclusion” which serves as an exception to the rule of self-incrimination vis-à-vis unlocking of phones. The “foregone conclusion” doctrine has only been used by a small number of US courts to sanction passcode compelling theory.²¹ The foregone conclusion exception “provides that an act of production does not involve testimonial communication where the facts conveyed already are known to the Government, such that the individual ‘adds little or nothing to the sum total of the Government’s information’.”²² This rule is applied when the prosecution can show that the police already knew what was on the phone, and a passcode will not change the prosecution’s case in any way. For instance, in order to gain access to X‘s phone, the police would need to show both X‘s ownership of the device and X‘s knowledge of the passcode. Also, the police already know what is on the phone and where any evidence that could be used to incriminate the owner is located. The Court, rather than compelling that production of passcode as document, should have focused on the incriminating material that the investigation officer thinks or believes to be in phone/laptop and how production of passcode will not add anything to the sum total of the investigation officer.

Delhi Special CBI Court judgment

An application for disclosure of the passcode of the computer seized from the accused was moved before the Delhi Special CBI Court. To support its case the prosecution cited the Karnataka High Court decision in Virendra Khanna v. State of Karnataka²³ (detailed above). The opposition to the application was based on the grounds that there is no particular provision for the revelation of the passcode and that the trial court lacks the inherent authority to order unlocking of the phone/computer. Article 20(3) prohibits compelled extraction of passcode since doing so would amount to testimonial evidence. Further, it was contended that the judgment in Virendra Khanna v. State of Karnataka²⁴ is per incuriam in light of Selvi judgment²⁵.

The Court held that Sections 102²⁶ and 161²⁷ of the Criminal Procedure Code give investigators the authority to exclusively or with the court’s assistance under Sections 91 and 93 CrPC seek any information or document from any person including an accused but at the same time, the accused (or a witness) is not obliged to give any answer which is self-incriminatory.²⁸ Further the words “to investigate the facts and circumstances of the case” in Section 157 CrPC²⁹ that provides for procedure of investigation are wide enough to include any kind of information, things or object which the investigator may require from an accused, or a witness needed for fair investigation. To support its finding, the Court held that without there being a specific provision in the CrPC and before the amendment to the Criminal Procedure (Identification) Act, 2022³⁰ for collection of blood sample, DNA/hair samples, etc., the investigator had the power to order the giving of samples and such power of the investigator fell within the realm of investigation.

Regarding the second objection, the Court ruled that forcing a witness to provide a password or security pattern violates Article 20(3) of the Indian Constitution. The difference between testimonial and non-testimonial evidence was also discussed by the court. In para 18, it stated:

18. … a testimony in oral (like voice sample) or written form (like specimen handwriting or signature) though may be personal yet they can be taken under compulsion from an accused if it is to be used for the purpose of identification or comparison with already available voice recording or signature/handwriting which is/are obtained from other sources like seizure of document or chance print, fingerprints of the scene of crime, etc.³¹

However, in para 19, it observed that since, the password of the accused is not required for comparison or identification purpose, therefore, it is protected personal information that resides in the mental zone and therefore disclosure of passcode would tantamount to disclosure against Article 20(3). Relying on Selvi dictum³², the Court further observed that the Supreme Court had ruled that narcoanalysis/lie detector test procedure involves personal knowledge of the accused and therefore it cannot be conducted without the consent of the accused. Similarly, disclosure of passcode involves disclosure of personal knowledge and therefore an accused cannot be compelled for its disclosure.

Contrary to the Karnataka High Court, this Court distinguished the password from biometrics in light of the Criminal Procedure (Identification) Act, 2022 (hereafter referred to as “the Act”). The Act’s definition of the term “measurements” was the court’s main concern.

As per Section 2(1)(b) of the Act,

(b) measurements includes finger impressions, palm-print impressions, footprint impressions, photographs, iris and retina scan, physical, biological samples and their analysis, behavioural attributes including signatures, handwriting or any other examination referred to in Section 53³³ or Section 53-A³⁴ of the Code of Criminal Procedure, 1973.³⁵

The Court then considered Section 3 of the Act³⁶, which states that an accused shall permit the police to collect his measurements in accordance with the law whenever necessary. Additionally, a Magistrate may order the accused to provide his measurement under Section 5 of the Act³⁷. After perusal of the abovementioned provisions, the Court noted that the Act does not include the words password/user ID in the definition of the word “measurement” therefore the Court cannot direct disclosure of passcode under the Act. However, the Court inferred from the definition of “measurement” under the Act that a direction for providing biometric i.e. finger impressions, face, or iris recognition for opening of electronic device by the investigator can be ordered. It was observed that Article 20(3) of the Constitution protects information emanating from “personal knowledge” and biometrics are only physical evidence which does not require attribution of personal knowledge. Consequently, giving of biometric is not protected under the Constitution.

It observed that the Criminal Procedure (Identification) Act, 2022 does not say that the purpose of collection of physical evidence is for comparison with other materials collected during investigation. Therefore, the police can take biometrics as per Section 3 of the Act whenever it requires unlocking of phones protected with finger impressions/facial recognition techniques.

What the Delhi Court missed

The Delhi Court order³⁸ is legally sound and in line with the Supreme Court judgments in Kathi Kalu Oghad³⁹, Selvi⁴⁰ and other judgments as it rightly observed that password/security pattern is derived from the personal knowledge of the accused and therefore its disclosure is protected under Article 20(3). However, it failed to analyse one of the major challenges to compelled disclosure of biometrics which has been accepted by few courts in US, that biometrics perform the same function as a password with respect to information therefore the passwords and biometrics are “functionally equivalent” for the purposes of right of self-incrimination. Though, there is no unanimity in US regarding application of functionally equivalent doctrine, this issue becomes relevant because biometrics and passcode perform the same function i.e. locking of phone.

In an interesting case before the United States District Court Northern District of California in Search of a Residence in Oakland, In re⁴¹ the Court denied permission to unlock the phone using biometrics. In this case, the accused used Facebook Messenger to communicate with a victim in which they threatened to distribute embarrassing video of him if he did not yield to their demand. The police seized electronic devices from the accused and moved a motion before the court seeking biometrics for unlocking the devices. The Court denied the request and declared that use of accused biometric feature to potentially unlock an electronic device is testimonial in nature. The Court further observed that in modern times, technology is outpacing law. The Court viewed that:

… utilising a biometric feature to unlock an electronic device is not akin to submitting to fingerprinting or a DNA swab, because it differs in two fundamental ways. First, the Government concedes that a finger, thumb, or other biometric feature may be used to unlock a device in lieu of a passcode. In this context, biometric features serve the same purpose of a passcode, which is to secure the owner’s content, pragmatically rendering them functionally equivalent. As the Government acknowledges, there are times when the device will not accept the biometric feature and require the user to type in the passcode to unlock the device. For example, a passcode is generally required “when a device has been restarted, inactive or has not been unlocked for a certain period of time”. This is, no doubt, a security feature to ensure that someone without the passcode cannot readily access the contents of the phone.

Second, requiring someone to affix their finger or thumb to a digital device is fundamentally different than requiring a suspect to submit to fingerprinting. A finger or thumb scan used to unlock a device indicates that the device belongs to a particular individual. In other words, the act concedes that the phone was in the possession and control of the suspect and authenticates ownership or access to the phone and all of its digital contents. Thus, the act of unlocking a phone with a finger or thumb scan far exceeds the “physical evidence” created when a suspect submits to fingerprinting to merely compare his fingerprints to existing physical evidence (another fingerprint) found at a crime scene, because there is no comparison or witness corroboration required to confirm a positive match. Instead, a successful finger or thumb scan confirms ownership or control of the device, and, unlike fingerprints, the authentication of its contents cannot be reasonably refuted.

The Court further observed that using a fingerprint to place it at a particular location is a starkly different scenario than using a finger scan to access a database of someone’s most private information. Therefore, biometric feature is analogous to the non-verbal, physiological responses elicited during a polygraph test, which are used to determine guilt or innocence, and or considered testimonial.

However, a contrary view has been taken in State v. Diamond⁴², wherein the Supreme Court of Minnesota observed that compelled disclosure of biometrics merely demonstrates physical characteristics and did not communicate assertions of facts from mind. The test to determine whether communications or communicative acts are privileged under the self-incrimination protection is whether they are “testimonial, incriminating, and compelled”. Applying the test in reverse, the Court found that compelling or forcing an accused to give finger scan is certainly compelled and incriminating, however it will not be testimonial.⁴³ Thus, it appears that no uniformity exists in cases pertaining to compelled disclosure of biometrics.

Another problem with the order lies in it treating the biometrics for unlocking of phone as equivalent to measurements as provided under the Criminal Procedure (Identification) Act, 2022 and therefore holding that phone unlocking was possible. The Court has not offered any justification for drawing such an inference. The Act’s stated goal is to “authorise obtaining measures of convicts and other persons for the sake of identification and investigation in criminal issues”. Such interpretation would allow police with uncontrolled and unguided access to electronic devices of individuals regardless of their position as an accused, a convict, or someone unrelated to the case. Thus, the Court should have dealt with the issue carefully particularly in view of the Act’s stated objective.

Conclusion

It is an intriguing topic that calls for formulation of new theory or principles in order to carefully respect the constitutional prohibition on self-incrimination without obstructing impartial investigations. As in the 1960s, the Supreme Court could not have established legal standards pertaining to self-incrimination in connection to mobile phones, the Kalu Oghad case⁴⁴ may not be used as a benchmark to decide the question of self-incrimination in relation to passcode today. The Supreme Court would be required to look at the issue from the perspective of self-incrimination and right to privacy as an individual’s information is stored in the mobile phones and an unbridled access to the police may expose an individual’s privacy beyond the State’s legitimate interest in information stored in phone for the purpose of investigation. Therefore, a timely resolution of the legal issue is the need of the hour and in doing so it is crucial for the Supreme Court to balance individual right against self-incrimination and the State’s duty to investigate crimes. The “foregone conclusion” doctrine as used in the US is a good doctrine that serves as an exception to the rule against self-incrimination. It would be in order if the Indian Supreme Court evolves a similar rule that may play an important balancing role between individual rights and State’s duty to investigate crimes.