Accused Can't Be Forced To Share Password Of Devices, CBI Court Says

An accused cannot be compelled to give the password of seized devices, a district court in Delhi said, while dealing with a case under the Prevention of Corruption Act, 1988. 

The Central Bureau of Investigation had seized the computer of accused Mahesh Sharma and sent it to the Central Forensic Science Laboratory. But the data on the system could not be retrieved, prompting the CBI to come to the court with an application seeking Sharma's password and user ID for the computer and Tally software. 

Sharma argued against this ask by invoking his right to maintain silence and that he cannot be compelled to give his password, since it was tantamount to a self-incriminating testimony.

He relied on Article 20(3) of the Constitution, which says that no person accused of any offence shall be compelled to be a witness against himself. The Code of Criminal procedure, too, reiterates the principle against self-incrimination, he said. 

The CBI Court accepted this argument. It pointed out that the accused has a right to remain silent, as per Article 20(3) of the Constitution, as well as Section 161 of the CrPC. 

"It is also pertinent to note that such data may or may not contain incriminating evidence but if there is an apprehension that it may probably contain incriminating information, the accused is within his right to maintain silence". - Special CBI Court

The court acknowledged that a password does not itself constitute a ‘self incriminating testimony' but from practical point of view, the password alone is not the sole objective of the investigating officer.

"In fact, he wants to use it for the purpose of accessing the data which is contained in a computer system or a mobile phone which is/are seized from the accused and, therefore, the said password is to be taken as integral part of the said computer system/mobile phone which is/are not severable from it," the order said.

While the protection against self-incrimination should appear to be quite self-evident and obvious, it is often not understood very well, said Faisal Sherwani, partner at Luthra & Luthra Law Offices.

The reference is to the apex court's decision in Kathi Kalu Oghad case, which held that the bar of Article 20(3) can be invoked when the statements are likely to lead to incrimination by themselves or “furnish a link in the chain of evidence” needed to do so. 

Self-incrimination must mean conveying information based upon the personal knowledge of the person giving the information, the Supreme Court had held.

More recently, in 2010, the Supreme Court again reiterated this principle in the case of Selvi. It said that during the trial stage, the onus is on the prosecution to prove the charges levelled against the defendant and the “right against self-incrimination” is a vital protection to ensure that the prosecution discharges this onus. 

Time and again, courts have faced this legal proposition and have adjudicated with various interpretations, said Samarjit Pattnaik, partner at Karanjawala & Co.

In conclusion, the special CBI Court declined the agency's request to compel Sharma to share the passwords.

But, it clarified that investigating agencies are well within their rights to access the data of the seized computer system and its software with the help of a specialised person or agency.

Interestingly, in a recent petition before the apex court, the Foundation of Media Professionals has asked the Supreme Court to lay down guidelines on production, search and seizure of contents of digital devices. 

The petition raises several concerns regarding the powers of enforcement agencies during investigations to compel an individual to share passwords of personal devices without prior judicial scrutiny.