Judiciary-friendly Computer Forensics

(By P. Vinod Bhattathiripad, Cyber Forensic Consultant, Calicut) 

The New Indian Express on 13th January 2009, carries a story that says, “The police are reported to have taken into custody for interrogation some former staff of a leading jewellery house in Palakkad in connection with a fraud of Rs 46 lakh committed by manipulating the software and data base of the computers of the firm. The frauds were committed during a three-and-a-half-year period beginning in early 2004. The police have already detected concrete proof for frauds perpetrated to the tune of Rs.15 lakh and are in the process of proving the balance amount. The case which falls in the category of cyber financial fraud was being investigated by the police since September 2007 when it was first noticed and reported by the management of the jewellery firm to the police..........”

The preliminary routine investigation by Palakkad police did not find any tangible evidence favouring the complaint. It perhaps did not occur to them at that stage that they might well be ‘fumbling in the dark’, without the assistance of a cyber forensic expert. There really was no physical evidence, but only digital evidence existed, which the police could not “see” and “feel”. It was after three months that the case was made over to Neeraj Kumar Gupta, a young Assistant Police Superintendent of Palakkad police, who sniffed out the whiff of crime in the case and sought the assistance of this author for investigating the case and as the Indian Express report (later) says, “The police unearthed all digital evidences with the help of its technical expert”. This digital evidence later got corroborated in the court by an expert commissioner, who also was a cyber forensic expert. (The final judgment of this suit is still pending in the court.)

Cases of the above type were unimaginable a few years back, but in the modern world of information and communication technology, criminals are expanding their horizons into the electronic space. The information and communication technology revolution has taken the world to greater heights, but one significant side-effect of this is the importance of the ethical, legal and practical issues related to abuse through or by the technology. Any crime related to this technology, in general, and computers, in particular, is a cyber crime, be it cyber financial fraud, identity theft, hacking, slacking, threat through email, virus, pornography, unauthorized disclosure of internal and confidential information, theft or trade of intellectual property, use of computers for personal gain, violation of company acceptable policies, launching of denial of service attacks on computer network servers, software piracy or supply of low-quality Information Technology (IT) products. There have been civil and criminal suits concerning all these areas, and the role of cyber forensic experts in identifying the crime, collecting, preserving and interpreting the evidence and in convincing the judiciary is important. The petitioners, lawyers, police and the judiciary seek the help of cyber forensic experts at various stages of the investigation, litigation and arbitration.

These developments have led on to the emergence of a new field of applied computer technology, generally called computer forensics or cyber forensics. Computer forensics, as the name indicates, is an inter-disciplinary area, largely straddling global use of computer technology and the law-enforcement and is responsible for identifying, locating, extracting, and analyzing types of data from various computers and related devices, and the cyber forensic experts interpret them to serve as legal evidence. The most important skill of a cyber forensic expert is his ability to identify and interpret the electronic evidence and communicate it in a judiciary-friendly manner. Cyber crimes occur in plenty of ways that a cyber forensic expert specialized in certain areas may not be able to do justice to other areas of cyber crime investigation. For instance, software piracy and cyber financial fraud investigations require computer engineers with hardcore experience in software engineering and database techniques while tracing the author of a threatening e-mail or a dangerous virus require expertise in computer network engineering. Because the judicial system often has difficulties in mandating and interpreting standardization for computer forensics, it becomes the responsibility of the computer engineers to assist in this endeavor.

The cliche that no man is an island is more true today of the computer community than any other, and this puts any individual computer user very much at risk in that his computer is likely to be prone and susceptible to any error or misuse originating from any part of the computer network, including the world wide web. It is probably true to say that unlike in the physical world, a person may technically be guilty of a computer crime without either the mens rea or the actus reus. It is therefore the duty of the cyber forensic experts to assist the investigators to detect and document all such electronic evidence.

Electronic evidence is in the form of data and information, stored in the computer disks or other electronic storage devices. (In IT, a distinction is often made between data and information. Roughly, information is what is available on the surface as processed version and data is how it is underlyingly represented in the raw form in computer storage.) Collecting ‘information’ is relatively easier than digging out the ‘data’, particularly if the storing of the data uses intentional and deliberate concealment techniques.

Traditionally, there are ways of storing data that control access and use of material stored. Even though most of this is fairly sophisticated, none of them are strictly beyond misuse by determined criminals. The complexities of storage and the cleverness of intrusions into the secrecy by determined criminals constitute serious problems for the expert, who, when called upon, has to wade through the morass of storage and concealment of both the encryptions and intrusions and come out with tangible and clear evidence that will be admissible to the judiciary.

Although the data is usually stored in files and data bases, there are many ways to intentionally conceal or obscure such storage. One way to conceal data is by using cryptographic algorithms in which the communications are encrypted and thus kept hidden from anyone for whom it is not intended. Only the intended recipient of the communication will have the key to decrypt the communication, back into an intelligible form. A sub-version of cryptography is a method known as Secret Sharing Scheme where ‘k’ out of ‘n’ people have enough information to decrypt the code but any set of k minus l people do not. The modern cryptographic algorithms are so perfectly designed that it is very difficult, but not impossible, for the expert to break into.

Steganography is another art of hidden writing. While cryptography enables one to keep the message unreadable, Steganography hides the secret information within a document, say, in an innocent photograph, from where the intended recipient can extract what is required by going into the data pertaining to this photograph. While cryptography and Steganography form important means of secret communication for the right kind of interactions including those involving national security, they also run the risk of being abused and misused by unscrupulous criminals. These sorts of crime investigation require cyber forensic experts specialized in the art of encryption intrusion.

Computer networks are prone to criminal invasion, and there are also several popular and ingenious techniques used for this. One concealment technique employed in the computer network, often open to abuse, is the Internet Protocol (IP). The abuse of this, called IP Spoofing, is the technique of attacking another computer by ‘spoofing’ the electronic identity (e.g. IP address) of a trusted machine in order to mask the attacker’s true IP address. Another such computer network attacking technique is ‘tapping’, which is the method of unauthorized gaining of access to a computer system by tapping somebody else’s existing login session on a computer system. Once the official user gains (or opens) a login session onto a remote computer system after giving the necessary authentication data (say, user name, password etc), the attacker too would be able to use this open path to gain another login session or get into the same remote computer system, bypassing all authentication requirements. Only experts specialized in computer networks can investigate such crimes.

A more insidious technique, used in viruses and worms, is polymorphism, which causes viruses etc. to mutate albeit by keeping the original algorithm intact and this makes the job of anti-virus and intrusion detection software difficult. Identifying the author of viruses and worms by tracing back through the computer network is a common area of investigation for cyber forensic experts.

Another invasive technique is to hide secret data in the swap file (alias virtual memory), which is the file created in the hard disk by the operating system to simulate extra RAM. As swap files are huge, it provides a way for the criminals to store secret data without the knowledge of the computer user. Once the computer is switched off, any data stored in the RAM will be lost but data stored in the swap file (though an extension of RAM) is not lost and this makes the job of the criminal easy and that of the expert, difficult.

File slacking is another data concealment technique, where the criminal makes use of the blank space of an already used cluster (usually the last cluster of a file). A cluster is the smallest block of data storage (in a hard disk, for example) on computers run on DOS, and Windows. The size of a cluster is fixed. If a stored file consumes 3.75 clusters, the last quarter of the 4th cluster would remain vacant and this blank space is called a ‘file slack’. Technically the computer informs the user that it has earmarked four clusters for the file but actually only 3.75 clusters are used. Because of this, if a criminal stores his secret file in the file slack (the balance 0.25 cluster, in the above example), the actual total storage consumption shown by the computer will not change and thus it is difficult, but not impossible, for the expert to get to know the information about the secret file thus stored.

Renaming of files is a clever method adopted by the criminals. They can introduce and store a file containing secret information and then name it as a DLL or JPEG file (or any other normal ‘harmless’ common file type) so as to escape detection or divert the attention of the cyber forensic expert. Computer criminality is so sophisticated that not only do criminals abuse the concealment techniques but also cleverly cover their tracks by concealing or obfuscating the detection of their incursions. This is generally called anti-forensics. One method used for this is spoliation, which refers to the material alteration or destruction of data thereby preventing or spoiling later access into it for the purpose of extracting information to be used as evidence of interference in potential litigation. Anti-forensic software tools like Timestamp, help concealing, editing or deleting valuable evidence in order to make it unreliable in the court. Many tools are available that can readily wipe files, directories, partitions, and hard drives. They are as sophisticated as the forensic tools they seek to defeat. The expert then has to look for evidence to establish spoliation.

There are standard, highly-specialized and judiciary-friendly procedures and software tools generally available for identifying, collecting, analyzing and documenting the above mentioned cyber crimes. Cyber forensic experts use these procedures and tools to supplement their intelligence, expertise, common sense and insight. For instance, in a sensitive case of transaction involving inter-state transportation of spirit, the Palakkad police, with the help of cyber forensic software expert, could recover already deleted digital evidence from a seized computer that was used to forge the registration documents of the three vehicles used in the crime. However, John J. Barbara, a crime laboratory analyst supervisor with Florida Department of Law Enforcement, quotes an unidentified source “......But forensic people don’t know how good or bad their tools are, and they’re going to court based on evidence gathered with those tools. You should test the validity of the tools you’re using before you go to court......”.

One area of cyber crime investigation that is still in its infancy due to the non-availability of standardization in procedures and software tools is software piracy investigation. It is simple and economical to copy software programs and so, software piracy is extensive. The nature of piracy disregards the intellectual effort and right of possessions of the original author. In addition to this, the author of the software is deprived of a fair return for his work. Software piracy has many negative consequences, not just to the author of the product, but also to the country where the pirated software is sold. Piracy can be investigated using software tools but its investigation demands a greater role for cyber forensic expert’s intelligence, expertise, common sense and insight because of the inherent complexity in software programming logic and underlying global commonalities in it.

In a software piracy context, a cyber forensic expert is the person who is often designated to compare the allegedly pirated software with the ‘original’ and prepare a report that is legally convincing and binding. The report is expected to be transparent to non-technical persons as well, and should help the judicial system in convincingly validating the legal process of resolving the situation. As programmers use underlying universal programming standards, sieving out the legally valid similarities and commonalities found in the two software programs and presenting them in a judicially convincing manner is no mean task for experts who mostly are computer engineers, untrained in legal studies.

When there is a complaint of software piracy, the legal authorities, with the assistance of an expert, seizes the digital evidence along with the physical evidence. The process of seizure itself has to be in a legally non-challengeable manner and has to take into account the concerns of not only the parties explicitly implicated in the case, but also those functionally involved in the pirated product. They include clients, customers or corporate associates of the concerned establishment. Wherever possible, the expert tries to ensure that these uninvolved parties are minimally affected by the seizure.

In order to prove in the court of law that the allegedly pirated software has been commercially exploited, the seizure procedure usually requires seizure of the allegedly pirated software from the hard disk of the computer system of the establishment which bought the software. As this computer system, mostly the main computer server, would contain live data also, it will take a minimum of one day for the concerned officials of the establishment to install another computer server with the necessary software and data, before resuming their normal operations. In the case of banks, a delay of even one hour in rendering service would create inconvenience to their innocent account holders across the globe. The process of seizure requires hashing of hard disk, a technique of electronically (mathematically) sealing the hard disk, which itself is time consuming (say, 3 to 12 hours or even more, mostly during business hours), causing inconvenience to the clients of the concerned establishment. The delay in restoring the necessary software and data in the back up system can be reduced if the cyber forensic expert, strictly at the beginning of the raid, can sympathetically let the client officials be aware of the imminent seizure of the hard disk during the raid and of the necessity of getting the back up system ready by the time of completion of the seizure. Moreover, since the client establishment per se is not accused, the expert is sympathetic but not necessarily over-lenient on the procedures of seizure. In similar situations, the author has always ensured that no operation of the concerned establishment is affected during and after the seizure. In an unusual situation, while conducting a raid in the suspected computer incident scene of a case (Sesame Software Solutions v..Perfect Software Solutions), the staff and management of the involved party (alleged pirate) appealed to the Advocate Commissioner that, if the suspected computer was seized, their day-to-day business operations would be affected in the absence of the software and databases in it. Subsequently, as directed by the Advocate Commissioner, the author himself (as the expert commissioner to conduct the raid) copied the software as well as the databases in the suspected hard disk to the firm’s network server without allowing the alleged pirate to touch the computer, and this unusual sympathetic procedure was recorded in the expert commissioner’s report submitted to the court. (The final judgment of this suit is still pending in the court.). During seizure, the cyber forensic expert should be careful not to destroy evidence by being over-sympathetic On the other hand, by being over-strict, his act of seizure should not force the raided establishment to close down its shutters for ever either.

During the analysis of the digital evidence, the expert concentrates on systematically finding and collating out the similarities and commonalities along four parameters namely the nomenclature tradition of the software company in naming various entities in the program; the logic of the program; the errors; and the comments, which is not an easy task. The duty of the cyber forensic expert is to establish the possible piracy through a rigorous formulation of statistical occurrences of the data structures, variables, data base tables, fields, modules , procedures, logic, remark, error and blunders in the allegedly pirated software and arrive at several values, preferably in percentages, to indicate the strength of piracy. For instance, while comparing the software and the data base tables as part of the software piracy investigation as the expert commissioner of the honourable Judicial I class magistrate, Kozhikode, Kerala, on the suit, Software Associates vs. Together Infotech, (Suit number: CMP 10371/2002), this author found significant statistical occurrence of fields (in the allegedly pirated data base script) bearing exactly same names, datatypes, length, context, and sequence of appearance, as in the ‘original’. Even if these fields bear moderately universal names, it is very difficult to imagine that two software engineers will program exact similarity in names, data types, length, context, as well as the sequence of appearance of fields in two commercially available complex software packages. This finding alone may not prove piracy. Yet, the expert can add it to the list of supporting evidence for suggested piracy.

Findings like this encourage the cyber forensic expert to present a very clear report to the court like for example, “There is 81% similarity as 9 out of 11 fields bear exactly same names, datatypes, length, context, and sequence of appearance in this table”. These percentages, as tangible evidence unambiguously arrived at by the technical experts, would be concrete enough to help the judge to pronounce judgment.

Software carries a thumb impression or special nomenclature patterns of the owner of the software. The presence of such thumb impression verbatim (or its logical derivatives) in the original as well as the allegedly pirated source code suggests piracy. However, identifying any type of thumb impressions in a software and establishing piracy is tougher when the software under investigation was written by one software engineer and updated at various instances later, by other software engineers, which is a serious issue due to the frequent turnover of employees in software industry. These multiple thumb impressions compatibly identified in both the ‘original’ and the ‘pirated’ source codes can prove to be vital. Here, only the cyber forensic expert’s expertise, common sense, intuition and insight can make his interpretation look more intelligent.

There is scope for extending the software piracy investigation beyond mere software comparison. Any other sundry complainant-specific data found in the computer system of the alleged pirate is also an indication of piracy. For example, from the pirate’s computer system, if the cyber forensic expert could dig out, say, files related to the complainant’s clientele or a back up copy of the live database of a client of the complainant, it can form serious evidence. Such rare instances occur when the piracy was done by performing a disk copy (of the complainant’s computer) that resulted in pirating not only the source code and data base related files but also other confidential data of the complainant. The existence of such material is stronger evidence of piracy as these are materials irrelevant for the functioning of the software and hence should not have been there in the first instance, if it was not pirated. For example, page 6 of the above mentioned expert commissioner’s report submitted to the court by the author, narrates such a rare situation, where the author could gather from the seized computer, an unaltered copy of the complainant’s original software together with the back up copy of the live database taken from one of the complainant’s client installations in Kenya. In this case, although the software comparison results were indicative of potential piracy, the presence of the back up copy of live database of a client of the complainant helped the author to unequivocally establish it. Again, the author was called in to investigate a case where a UK-based software firm alleged that one of its (former) employees had appropriated a software product of his employers and was marketing it as his own even while he was still employed in the company. The author found that the alleged culprit had created and maintained a website to market the allegedly pirated software even as he was still employed by this firm and this proof from the DNS server was enough to initiate a case in the court. 

One final thing to remember is that expert opinion can be challenged in the court of law. Such challenge can generally be due to incomplete comparison leading to unreliability of evidence, and in such cases, during the subsequent cross examinations in the court of law, the lawyers will prove that there was still scope for further in-depth analysis. For example, the cyber forensic report on the suit number OS 2/2007, before the District Judge, Kozhikode (See CDAC, 2008) was later challenged in the court. The challenge was upheld by the court as the expert conceded that he had relied solely on the results of automatic comparison tools. Obviously, events like this might cause inconveniences to the jury and delay the final judgment. Hence, the first report of the technical expert itself should wherever possible be thorough, convincing and binding and it is the duty of the technical expert to avoid creating ambiguities and inconveniences to the judiciary, with the possible consequence of an unintended delay or miscarriage of justice.

Computer forensics is gaining importance in the modern digital world, to counter the intelligent activities of the cyber criminals. The cyber forensic experts are typically required to substantiate cyber issues arising from secret data concealment, patent and copyright infringements, trade secret misappropriation, and software piracy. The variety of cyber crimes are so plenty that a cyber forensic expert specialized in certain areas may not be able to do justice to other areas of cyber crime investigation. In arbitrations arising out of software piracy, even though the investigations are generally performed with the help of special software tools, the cyber forensic expert’s intelligence, expertise, common sense and insight play a bigger role in software piracy investigation. The biggest challenge before the cyber forensic expert, a non-legal professional, is to identify, collect, organize and interpret the electronic evidence and communicate the interpretation in a legally binding and judicially convincing manner.

References

Albert J. Marcella, Jr., and Doug Menendez, (2008), Cyber Forensics, New York: Auerbach Publications CDAC, (2008) Analysis report of the Resource Centre for Cyber Forensics, Centre for Development of Advanced Computing, Government of India, Thiruvananthapuram - 695 033, Kerala, Report number CDAC/RCCF/2007-20AR/Jan/2008, on the suit number OS 2/2007, District Judge, Kozhikode

Clyde W. Holsapple, Deepak lyengar, Jin Haihao., Shashank Rao, (2008), Parameters for Software Piracy Research, The Information Society, 24.4

Don L Lewis, (2009), The Hash Algorithm Dilemma - Hash Value Collisions, Forensic Magazine from http://www.forensicmag.com/Article_Print.asp?pid=238

Dr. Santhosh Baboo and Vinod Bhattathirpad P., (forthcoming), Software Piracy Forensics: Exploiting non-automated and judiciary-friendly techniques, Journal of Digital Forensic Practice, USA

Hal Berghel, 2007, Hiding Data, Forensics, and Anti-forensics, Communications of the ACM

John J. Barbara, 2009, Digital Insider: Anti-Digital Forensics, The Next Challenge, Forensic Magazine from http://www.forensicmag.com/Article_Print.asp?pid=245

Vinod Bhattathiripad P., (2002) Software Comparison report, Software Associates vs. Together Infotech, submitted to Judicial I class magistrate, Kozhikode, Kerala, India, case number CMP 10371 / 2002.

Vinod Bhattathiripad P. (2007), Report submitted to the honourable District Court, Kozhikode, Kerala on Sesame Software Solutions v. Perfect Software Solutions

The Canadian Connection in Election Involved in Art.324 Imbroglio

(By T.P. Kelu Nambiar, Senior Advocate, High Court of Kerala)

Today is my 'Super-Friday'; therefore I thought of writing on an important subject, making a useful waste of time, putting my blue pencil to good effect.

It is trite that esteemed and responsible persons should not render curt and casual, or rehearsing, opinions on matters of moment. Such opinions bake no cake. This is specially so in regard to substantial questions relating to the interpretation of the Constitution of India, the 'manufacture' of the Constituent Assembly. Study carefully and opine cautiously, is the lesson I have learnt, living legal profession since 1954, (and, now, preparing for a life without 'Your Lordship'.)

I have been diligently following the recent controversy, (the Panic of 2009), over the recommendation of the Chief Election Commissioner (CEC) of India to remove from office one of the Election Commissioners. Among those who ventured opinion on the correctness or otherwise of the action of the CEC, some leading politicians, leaders with 'big bags' and Senior Advocates, (big names in the legal profession, wearing heavy price tags, considered to be opinion power-house), figured. The speed with which they rendered their high-decibel opinions showed that the opinions were mostly off-hand, and dicey, without re-visiting the Constitution, when a hard re-look was needed sitting at the home-work desk; and, off-hand, on a vital Constitutional aspect, 'a matter of the greatest importance', according to Pandit Hirday Nath Kunzru, in his speech in the Constituent Assembly of India; winged words, indeed. Those who ignore this, will have to make a historic apology to the Constituent Assembly. I have the honour of acquaintance with the Constituent Assembly Debates, my weakness and my strength. I always remember that there is only one Constitution for India.

I beg to differ, with respect though, with those who went to the extent of saying, without any self-doubt, that the recommendation of the CEC was unconstitutional. (The Regret of 2009). There is too much doubt to be certain about the audacious articulation, which does not make eminent sense; and I remain unconvinced. It may not be considered that I am searching for superlatives to applaud the CEC.

The Constitutional provision concerning the aspect is in Art.324, (in Part XV -Elections).

The provision in Cl.(l) of Art.324 transfers the superintendence, direction and control of the preparation of the electoral rolls and of all elections to Parliament and the Legislatures of States and to the offices of President and Vice-President, to a body outside the Executive, to be called the Election Commission. CI.(2) says that there shall be a Chief Election Commissioner and such number of other Election Commissioners, appointed by the President. CI.(3) says that the Chief Election Commissioner shall act as the Chairman of the Election Commission. Cl.(4) provides for appointment of Regional Commissioners.

Cl.(6) provides for appointment of staff necessary for the discharge of the functions of the Election Commission.

At present, we are concerned with cl.(5) of Art.324. Therefore, it would only be appropriate to read cl.(5) here:

"(5) Subject to the provisions of any law made by Parliament, the conditions of service and tenure of office of the Election Commissioners and the Regional Commissioners shall be such as the President may by rule determine:

Provided that the Chief Election Commissioner shall not be removed from his office except in like manner and on the like grounds as a Judge of the Supreme Court and the conditions of service of the Chief Election Commissioner shall not be varied to his disadvantage after his appointment:

Provided further that any other Election Commissioner or a Regional Commissioner shall not be removed from office except on the recommendation of the Chief Election Commissioner".

The controversy centres around the interpretation of the Second Proviso.

The present Art.324 was draft Art.289 before the Constituent Assembly. Introducing the said Article for the consideration of the Assembly, on 15th June 1949, Dr. Ambedkar said as follows:

"So far as cl.(4) is concerned, (cl.(4) of the draft Art.289 is cl.(5) of the present Art.324), we have left the matter to the President to determine the conditions of service and tenure of office of the members of the Election Commission, subject to one or two conditions, that the Chief Election Commissioner shall not be liable to be removed except in the same manner as a Judge of the Supreme Court. If the object of this House is that all matters relating to Elections should be outside the control of the Executive Government of the day, it is absolutely necessary that the new machinery which we are setting up, namely the Election Commission, should be irremovable by the executive by a mere fiat. We have therefore given the Chief Election Commissioner the same status so far as removability is concerned as we have given to the Judges of the Supreme Court. We of course, do not propose to give the same status to the other members of Commission. We have left the matter to the President as to the circumstances under which he would deem fit to remove any other member of the Election Commission, subject to one condition that the Chief Election Commissioner must recommend that the removal is just and proper".                   (emphasis supplied for reader convenience.)

Mark, Dr.Ambedkar said very little and conveyed a lot in his speech.

Though Prof. Shibban Lal Saxena moved an amendment to the effect that both the Chief Election Commissioner and the Election Commissioners should be removable in the same manner, as stated in the first Proviso, leaving the Regional Commissioners alone in the second Proviso, the amendment does not seem to have been seriously pressed; and it was not accepted by the House. Apart from the active participation of Pandit Hirday Nath Kunzru and Prof. Shibban Lal Saxena, dominant intellectual forces of the Constituent Assembly like Sri.T.T. Krishnamachari, Sri H.V. Pataskarand Sri. K. M. Munshi (Advocate's Special) also shed the light of wisdom to the discussion, emphazising the need for total independence of the Election Commission.

The Provision in the Second Proviso and the address of Dr. Ambedkar relating thereto, are clear, simple, and straight-forward. That the recommendation of the Chief Election Commissioner is crucial, is evident. Let me put it succinctly this way: The recommendation may emanate from the Chief Election Commissioner. The President may accept or refuse to accept such a recommendation. The President may deem it necessary to remove an Election Commissioner. But he cannot do it on his own. He may take a decision to remove an Election Commissioner; but he shall seek the recommendation of the Chief Election Commissioner. If the Chief Election Commissioner recommends, agreeing with the President for removal, the Election Commissioner can be removed. But, if the Chief Election Commissioner disagrees with the President and does not recommend that there may be a removal, it looks as though the President may not be able to remove the Election Commissioner. Therefore, either way, the recommendation of the Chief Election Commissioner is the deciding factor, either initially or after the Presidential action. This accords with the object that the Election Commission should be irremovable by the Executive by a mere fiat. The Executive Government is not the proprietor of the Election Commission. The position is very clear in that the President, acting on the advice of the Council of Ministers alone, cannot remove an Election Commissioner, unless the CE.C. recommends such removal. Absolute independence of the Election Commission is assured by the Framers of the Constitution. This cannot be ignored. This is stark simple. The Executive Government cannot sleep-walk into the Election Commission.

It may be noted here that the matter relating to election is so important that it was thought at one point of time, when the question was before the Fundamental Rights Committee of the Constituent Assembly, that it should be included in the Fundamental Rights on the ground that the Fundamental Right of adult franchise should not only be guaranteed by the Constitution but its proper exercise should also be guaranteed in practice. (Here, I call attention to the petition pending before the Supreme Court, relating to the right to 'negative voting', to reject a candidate.)

But later it was thought appropriate to put the matter in a separate part, possibly because the matter relating to election was conceived on the basis of the Canadian Election Act. Art.289 was drafted on the lines of the provisions of the Canadian Election Act. The proceedings of the Constituent Assembly indicate that much was borrowed from the Canadian Act. The Constituent Assembly proceedings, a veritable store-house of knowledge, an enticing treasure would certainly throw light on the interpretation of the Constitutional provisions. The discussions may not be rejected, or isolated, as 'time-krred or otise. Do not interrogate the past. Old wood is appropriate for new homes. It is better that lawyers remember that legal opinion is no poll-speech.

Over to the readers.