Cellebrite Forensics in Police Custody: Global Lessons from the Citizen Lab Report and Indian Law on Mobile Seizure

A forensic report published by the University of Toronto’s Citizen Lab revealed that forensic extraction technology developed by Israeli firm Cellebrite was deployed against the mobile device of a prominent Kenyan activist while detained in police custody. The findings demonstrated how law enforcement leveraged targeted digital extraction to bypass device security, siphon encrypted communications, and monitor political dissent without procedural transparency.

While this investigation focused on East Africa, the underlying legal and technological questions resonate universally. In India, law enforcement agencies increasingly rely on advanced mobile forensic extraction devices (often referred to as Universal Forensic Extraction Devices or UFED) during searches, seizures, and custodial interrogations.

This analysis examines the threat of unregulated digital extraction, the legal safeguards governing mobile phone seizure in India under the new criminal codes, and the remedies available to individuals in Mumbai, Thane, and the Mumbai Metropolitan Region (MMR).

---

Understanding the Threat: How Mobile Forensics Tools Operate

Commercial digital extraction tools such as Cellebrite UFED, Oxygen Forensics, and GrayKey are engineered to bypass standard consumer security features, including lock-screen PINs, biometric barriers, and software sandboxing.

When a phone is subjected to forensic physical or logical extraction in custody, the software extracts:

• Complete Call Logs and Contact Lists: Historical contact mapping.
• Encrypted Messaging Databases: Local copies of chats from applications such as WhatsApp, Signal, and Telegram.
• Location and Geotagged Data: Historical coordinates, Wi-Fi network handshakes, and movement trajectories.
• Deleted Files and Media: Artifacts recovered from flash storage unallocated clusters.
• Authentication Tokens and Keychain Data: Stored credentials that could grant investigators access to cloud-stored assets, emails, and third-party servers.

When deployed arbitrarily or without statutory oversight, these tools convert a personal device into a tool of continuous self-incrimination, exposing personal communications, confidential work-product, and private medical or financial records.

---

The Indian Constitutional Framework on Device Searches

The unrestricted extraction of smartphone data conflicts directly with established constitutional guarantees in India.

1. Right to Privacy (K.S. Puttaswamy v. Union of India)

In the landmark 2017 judgment, a nine-judge bench of the Supreme Court recognized the right to privacy as an intrinsic component of Article 21 of the Constitution. The Court established a three-pronged test for state intrusion into individual privacy:

1. Legality: The action must have a clear statutory backing.
2. Need/Legitimate State Aim: The measure must pursue a legitimate state objective.
3. Proportionality: The nature and extent of the intrusion must be proportionate to the objective sought, with the least intrusive means adopted.

A blanket forensic extraction of a modern smartphone—containing an individual's entire life—rarely meets the threshold of proportionality unless strictly limited by a clear judicial warrant.

2. Privilege Against Self-Incrimination (Article 20(3))

Article 20(3) dictates that no person accused of any offence shall be compelled to be a witness against themselves. While Selvi v. State of Karnataka (2010) clarified that physical evidence (such as fingerprints) can be collected under lawful procedure, compelling a person to disclose a password or encryption key that lives within their mind remains an actively contested constitutional question.

In Virendra Khanna v. State of Karnataka (2021), the Karnataka High Court held that an accused can be directed to unlock their mobile device or provide passwords under Section 91 of the Code of Criminal Procedure (now Section 94 of the Bharatiya Nagarik Suraksha Sanhita, 2023). However, several other High Courts and legal scholars maintain that forcing an individual to unlock their phone violates Article 20(3) when it compels the disclosure of personal knowledge, especially without a defined judicial search protocol.

---

Statutory Provisions: BNSS, BSA, and the IT Act

India's criminal legal framework transitioned to new codes in July 2024, altering how electronic evidence and digital seizures must be handled.

1. Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS)

• Section 94 (Summons to produce document or other thing): Replaces Section 91 CrPC. Police can seek production of documents or digital materials.
• Section 105 (Recording of search and seizure through audio-video electronic means): Mandates that search and seizure procedures, including the seizure of electronic items, must be documented through audio-video recording to deter evidence tampering or fabricated recoveries.
• Section 107: Regulates the attachment, forfeiture, or custody of property discovered during criminal investigations.

2. Bharatiya Sakshya Adhiniyam, 2023 (BSA)

Under the BSA, the admissibility and handling of digital evidence are governed by Sections 61 through 63 (which update and replace the erstwhile Section 65B of the Indian Evidence Act, 1872):

• Electronic evidence must maintain an uncompromised chain of custody.
• Extraction outputs (forensic disk images) must be accompanied by appropriate electronic records certifications.
• If police extract data using commercial software without generating cryptographic hash values (e.g., SHA-256) at the exact point of seizure, the defense can challenge the integrity and admissibility of that evidence.

3. The Information Technology Act, 2000

• Section 43 & Section 66: Penalizes unauthorized extraction, downloading, or copying of digital data without the owner's permission. While public servants acting under bona fide lawful authority have statutory exemptions, extra-legal or non-procedural extraction may open avenues for departmental and civil action.
• Section 72: Imposes penalties for breach of confidentiality and privacy by persons who have secured access to electronic material pursuant to statutory powers.

---

Legal Safeguards and Remedies in Mumbai and Thane

If you suspect your digital device was unlawfully seized, subjected to unauthorized extraction, or tampered with by private actors or overreaching authorities, you have practical legal recourse in the Mumbai Metropolitan Region.

1. Demand Strict Seizure Protocol at the Point of Confiscation

• Insist on a Seizure Memo (Panchnama): Ensure the device's exact make, model, IMEI number, and current power state (switched off/on) are noted.
• Faraday Bagging: Insist that the device be placed inside an anti-static, signal-blocking Faraday bag to prevent remote tampering or unauthorized remote wipes.
• Hash Value Generation: Request that the investigating officer document the SHA-256 hash value before initiating any extraction.

2. Reporting Unauthorized Interception or Hacking

If an individual’s device is unlawfully intercepted, cloned, or extracted outside of judicial or investigative authority:

• Lodge a Complaint on the National Cyber Crime Reporting Portal: Visit cybercrime.gov.in or dial the national helpline at 1930.
• Approach Regional Cyber Crime Police Stations:
  • Mumbai: The Cyber Crime Police Station at Bandra-Kurla Complex (BKC) handles centralized high-stakes digital offenses, alongside dedicated regional cyber stations (South, Central, Western, Eastern, and Northern regions).
  • Thane: The Thane Cyber Crime Police Station at Commissioner of Police Office, Thane West.
  • Mira-Bhayandar: The MBVV (Mira-Bhayandar-Vasai-Virar) Police Commissionerate Cyber Cell.

3. Judicial Remedies Under the BNSS and the Constitution

• Application under Section 497 / Section 503 BNSS: File an application before the jurisdictional Magistrate seeking custody (superdari) or return of the seized electronic equipment.
• Section 528 BNSS (Inherent Powers): Invoke the inherent powers of the High Court of Judicature at Bombay to prevent abuse of the process of any court or to secure the ends of justice.
• Writ Jurisdiction under Article 226: File a Criminal Writ Petition before the Bombay High Court challenging arbitrary search, seizure, or violation of fundamental privacy rights.

---

Frequently Asked Questions (FAQs)

Can the police force me to unlock my phone with my fingerprint or face ID in India?

While investigating agencies often demand biometric unlocking during questioning, compelling an individual to provide biometric access remains contested under Article 20(3) (privilege against self-incrimination). While some High Court rulings permit investigative orders for access, an accused person retains the right to consult legal counsel before complying, and any forced access can be contested before the Magistrate.

What is a hash value, and why does it matter in digital seizures?

A hash value (such as SHA-256) is a unique mathematical string generated from the contents of a digital storage medium. If a single byte of data is altered, added, or deleted, the hash value changes entirely. Recording the hash value immediately upon seizure guarantees that investigators have not modified, injected, or altered the contents of the phone during custodial examination.

What should I do immediately if police seize my phone without giving a receipt?

Demand an immediate copy of the seizure memo (panchnama) with signatures of independent witnesses (panchas). If refused, notify your advocate immediately, who can file an urgent application before the jurisdictional Magistrate Court recording the irregular seizure and seeking judicial directions to preserve device logs.

---

Protect Your Digital Rights with APS Law

The intersection of criminal procedure and cyber forensics demands swift, technically sound legal intervention. At APS Law, our advocates advise clients across Mumbai, Thane, and Mira Road on cyber laws, search-and-seizure safeguards, evidentiary challenges under the BSA 2023, and device-release applications.

If you are navigating an investigation involving electronic evidence or suspect unauthorized device extraction, contact APS Law today to schedule a confidential consultation.