Memorandum of Second Appeal “Cribbed, 

Cabined and Confined” by ‘Kalliani’

(By T.P. Kelu Nambiar, Sr.Advocate, High Court of Kerala)

With little hesitation, I venture to say, with respect though, without fear or illwill, that the decision of a learned Single Judge, in Kalliani v. Balagopalan (Reported in 2009 (1) KLT 288), blowing the whistle on S.100, of the Code of Civil Procedure, does not lay down the correct law on the rules relating to the procedure for filing Second Appeals. And, I do believe what I think.

My association with S.100, Code of Civil Procedure, is inveterate, starting from the time of my apprenticeship-at-law, during 1953-1954 in the High Court of Judicature at Madras, under veteran 'civil' lawyer Sri.Ayilyath Achuthan Nambiar.

I have intimate relationship with S.100, as it stood before 1.2.1977 and after 1.2.1977. Before 1.2.1977, under the then S.100, a Second Appeal lay to the High Court from a decree passed in appeal by any court subordinate to the High Court on any of the grounds, namely, the decision of the subordinate court being contrary to law or some usage having the force of the law; the decision having failed to determine some material issue of law or usage having the force of law; and a substantial error or defect in procedure provided by the Code or any other law for the time being in force, which may possibly have produced error or defect in the decision of the case upon the merits. S.100 started with the expression:

“Save as otherwise expressly provided in the body of this Code or by any other law for the time being in force....”

S.100 was amended with effect from 1.2.1977, by the Code of Civil Procedure (Amendment) Act 1976, by the substitution of a new S.100. The substituted Section (32-year-old) also started by saying:

“Save as otherwise expressly provided in the body of this Code or by any other law for the time being in force....”

The amendment provided that an appeal shall lie to the High Court from every decree passed in appeal by any Court subordinate to the High Court, if the High Court is satisfied that the case involves a substantial question of law. It was provided:

“In an appeal under this Section, the Memorandum of Appeal shall precisely state the substantial question of law involved in the appeal”. (Mark the word ‘state’). 

Further, on the High Court being satisfied that a substantial question of law is involved, it ‘shall formulate the question’, and the appeal shall be heard on the question so formulated.

O. 41, which relates to appeals from original decrees, provides, in R. 1, the form of appeal and what to accompany the Memorandum of Appeal. The relevant provision is:

“Every appeal shall be preferred in the form of a memorandum signed by the appellant or his pleader and presented to the Court or to such officer as it appoints in this behalf”.

O.41 R.2 relates to the contents of the memorandum of appeal. The provision, as far as it is relevant for the present purpose, says:

“The memorandum shall set forth precisely and under distinct heads the grounds of objection to the decree appealed from without any argument or narrative, and such grounds shall be numbered consecutively”.

No change was effected to these Rules by the Amendment Act 1976. Under R.9, of O. 41, “the court shall entertain the memorandum of appeal....and shall register the appeal”. Order 41 A provides for appeals to the High Court from original decrees of subordinate courts, (Regular First Appeals), and Rule 1 thereof says that the rules contained in O. 41 shall apply to appeals in the High Court of Kerala with the modifications contained in the Order.  O.42 relates to appeals from appellate decrees, with which we are now concerned. R.1 of O.42 says that the Rules of O.41, as modified by O.41A, shall apply, so far as may be, to appeals from appellate decrees. This provision is not amended by the Amendment Act of 1976.

Therefore, it falls into place that the relevant rules of procedure remained the same even after the amendment of S.100 with effect from 1.2.1977. It is clear that the amendment of S.100 will not affect the relevant rules as shown above. 

What S.100 says, after the amendment, is only that a Second Appeal shall lie to the High Court from a decree passed in appeal by a Subordinate Count, if the High Court is satisfied that the case involves a substantial question of law; and that, when a Second Appeal is filed, the Memorandum of Second Appeal shall precisely state the substantial question of law. The statement of the substantial question of law in the Memorandum of Appeal is not final, because, despite such statement, the High Court shall formulate the substantial question of law; and the appeal shall be heard either on such question of law formulated or any other substantial question of law formulated at a later stage. According to S.100, the appeal is from a decree passed in appeal and the Memorandum of Second Appeal shall state the substantial question of law. O.41, which applies to Second Appeals, provides that the appeal shall be in the form of a Memorandum. O. 41 also prescribes the contents of the Memorandum, by saying that the memorandum shall set forth precisely the grounds of objection to the decree appealed from.

Therefore, the position is clear that the procedures in O.41, O.41A, and O.42, are not affected by the amendment of S.100. S.100 does not prescribe any procedure. The rules of procedure are verily the rules contained in the First Schedule of the Code of Civil Procedure. 

Moreover, S.100, as already stated, starts by saying: “Save as otherwise expressly provided in the body of this Code or any other law for the time being in force”. Apart from the other provisions in the body of the Code, there are other laws in force concerning the matter, and other laws were these even before the Amendment Act 1976. The rules of the High Court of Kerala 1971 were in force at the time of the amendment of S.100 in 1976. The Rules of the High Court of Kerala were framed by virtue of the powers conferred by Art.225 of the Constitution of India, S.122 of the Code of Civil Procedure (itself), and all other enabling powers of the High Court of Kerala. Rules were made with the previous approval of the Government, conveyed in Government Order dated 19.11.1970. The rules are made to regulate the procedure of the High Court of Kerala. Art.225 of the Constitution of India confers power on the High Court to make rules of Court to regulate the proceedings of the Court and of members thereof sitting alone or in Division Court. The Article says that such powers shall be the same as immediately before the commencement of the Constitution. S.122 of the Code of Civil Procedure prescribes the power of the High Courts to make rules regarding their own procedure. Such rules are to be made after previous publication. That is why the Rules of the High Court of Kerala say that they were made after publication. S.122 also confers power on the High Courts to make rules to annul, alter or add to all or any of the rules in the First Schedule. R.47 of the Rules of the High Court of Kerala says:

“Statement of Facts:- The Memorandum of Second Appeals, Civil Miscellaneous Appeals and Civil Revision Petitions shall contain a brief statement of the facts of the case and shall set forth the grounds of objection to the judgment or order appealed against or sought to be revised”.

It is despite the provisions and position as above, a learned Single Judge held that the failure to set forth grounds of appeal in the Memorandum of Second Appeal cannot render the Memorandum of Second Appeal defective and it is enough if the Memorandum of Second Appeal sets out the synopsis and narrates a statement of facts indicating as to how the substantial questions of law stated in the Memorandum of Second Appeal arise for consideration. The learned Judge observed: “It is, therefore, not compulsory that a Memorandum of Second Appeal should raise grounds of objection to the decree appealed from. The practice of raising grounds in a Memorandum of Second Appeal has come to stay more out of habit than a legal prescription. Old habits die hard. The objection raised by the Registry was not well taken. The Registry shall number the Second Appeal....” It is not seen noticed by the learned Judge that filing of the Memorandum of Appeal precedes  arguing of the Second Appeal. And, how can it be said that “the objection raised by the Registry was not well taken”. What else could have the Registry done at the time of examining the ‘Memorandum’.

The learned Judge is seen to have placed reliance on the expression “so far as may be” in O.42. This reliance does not seem to be correct, because that expression has been there even before the amendment of S.100; and, moreover, this expression can in no way be related to the amended S.100. It is very clear that the amended S.100 speaks of ‘addition’, not ‘annihilation’ or ‘negation’. Also, O.42 R.2, inserted by the Amendment Act of 1976, is clear that ‘grounds’ are not ousted, for it postulates the existence of ‘grounds’, when it says’.... it shall not be open to the appellant to urge any other ground’. The learned Judge underlined only that portion of R.2 just above the portion I have here underlined.

A very important question, involving various legal aspects, is decided without hearing anybody in opposition. Only the counsel for the appellant appeared, and was heard. The said counsel was interested in defending ‘the defective Memorandum of Appeal’. An important question relating to the rules of procedure of the High Court could have been decided after inviting the general views of the Bar. Notice could have been given to the President of the Kerala High Court Advocates Association and the Advocate-General, because this is not a mere matter concerning the counsel for the appellant in this particular case. Or, the question could have been placed before the Hon’ble Chief Justice for a reference to a Division Bench. A particular learned Single Judge may sit for admission in regard to Second Appeals for a period, and the jurisdiction may later go to other Judges. There may be other learned Judges who may take a different view, while hearing Second Appeals. There is no appeal against the present order of the learned Single Judge. The learned Single Judge wholly missed R. 47 of the Rules of the High Court of Kerala. That Rule is not affected by the Amendment Act of 1976.

I should congratulate Advocate Sri.K.G.Balasubramanian for his thoughts on this matter, reported in 2009 (3) K L T Page 3-Journal. He has highlighted the provision in R.47 of the Rules of the High Court of Kerala. But I fail to understand the meaning of his opening paragraph, which is: “It was quite a relief to read Kallyani v. Balagopalan (2009 (1) KLT 288). The learned Judge has ruled in his inimitable style, that it is not compulsory that a Memorandum of Second Appeal should raise grounds of objection to the decree appealed from. I initially thought of all that one could save in terms of time, energy, space and expense”. Possibly my learned friend wanted to be apologetic. There are different ways of expressing respectful opinion. Sri.Balasubramanian has done it in his own way; and I am doing it in my own way, without shedding my signature. There is no use mincing matters when you express an honest and studied opinion on an important subject, like this, especially, where a thirty-two-year-old procedure is bade adieu.

This is not a verdict on a judgment. This is but a lawyer’s, (not yet lapsed), non-violent (not winged) view on a bona fide review of a verdict.

N. I. Act 138 Trial – Jurisdictional Difficulties

(By K.G. Joseph, Advocate, Aluva)

1. On a careful reading of S.138 of N.I. Act the importance of “a bank” “the bank” and “that bank” is noteworthy. In the main section itself the above words are concurrently used. Also in provisos (a) and (b) of S.138  “the Bank” is repeated. It is pertinent to note that the inference is Drawee Bank/Paying Bank/Drawer’s Bank/Accused’s Bank.

2. Bank's function inter alia includes collecting of cheques/paying of cheques. Collecting Bank receive the cheque from its customers for collecting the proceeds from Drawee Bank. Collecting Bank  pays the proceeds to the payee after due process of collection. In case of insufficiency of fund/exceeds arrangement in the Drawer’s A/C the Drawee Bank returns the cheque to the Collecting Bank with information regarding the return of the cheque as unpaid. The Collecting Bank gives intimation to the payee with returned cheque/information received from the Drawee Bank. This is the core function of the Collecting Bank from the time of presentation of cheque to his Bank by his customer - payee till its disposal as mentioned above.

3. There are occasions more often when the payee directly approaches the Drawee Bank where he either gets the payment directly or gets back the unpaid cheque with the information of reason regarding return of the cheque as the case may be.

4. There are again instances of Collecting Bank and Drawee Bank to be one and the same when the drawer and payee keep Bank A/Cs in one and the same Bank. There also the process of collecting/paying will be the same as above.

5. Banking Business necessitates/warrants the functions of the Paying Bank and the Collecting Bank which is distinct and unique and cannot be separated as it is like two sides of a coin and two wings of a bird. 

6. In Banking Law and practice the above system is in vogue from time immemorial. Ever since the coming into force of N.I. Act S.138 w.e.f. 1.4.1989 the scope and applicability of the new law have expanded considerably as is being witnessed for the last 20 years. The credibility/acceptability of cheque operations have gone a long way in establishing sound and easy financial transactions in the trade/commercial fields which smoothened the relationships of parties as well.

7. The important corner stones of the new law are based on the judicial declarations/pronouncement/rulings of Hon’ble Supreme Court/High Courts. Hon’ble Supreme Court with two Judge Bench have proclaimed a Dictum/Ratio in (1999 (3) KLT 440 (SC) - Bhaskaran v. Balan):  regarding jurisdiction for trial of offence fixing 5 local places starting from:-

Place of (1) Drawing of the cheque.

“ (2) Presentation of the cheque to the Bank.

“ (3) Returning the cheque unpaid by the Drawee Bank. 

“ (4) Giving notice in writing to the drawer of the cheque demanding payment of the cheque amount and 

“ (5) Failure of the Drawer to make payment within 15 days of receipt of notice.

8. The Dictum/Ratio declared by the Hon’ble Supreme Court is being adopted/followed all over India as the Law of the land on this subject bound by Art.141 of the Constitution of India. While explaining the law Hon’ble High Court in Santhosh Kumar v. Mohan (2008 (3) KLT 461) para 5 - last sentence it was clearly affirmed and pointed out that “the law relating to the jurisdiction is thus clearly stated. The difficulty, if any, can only be in correctly understanding the dictum and in applying the same to the given facts”. In the light of the clarification/explanation of the Hon’ble Supreme Court there is an earnest attempt to overcome the difficulty to correctly understand the dictum and the difficulty is being redressed considerably, as the same is being applied to the given facts. However with regard to the jurisdiction in place (2) in para 14, i.e. place of presentation of cheque to the Bank, there is difficulty to understand the same place as the place (3) in para 14 while applying the dictum with its explanation.

9. It is a well established system of Banking that the cheques are to be presented for payment to the Drawers Bank - Drawee Bank -Accused’s Bank - Paying Bank within 6 months/within the period of its validity which ever is earlier. The payee has got the option of presenting the cheque directly to the above Bank - Paying Bank or through his Bank - Collecting Bank - for payment. In either case the cheque is to be presented within the stipulated period to “the Drawee Bank” or else it is subject to bouncing on that ground under S.138(a) of N.I. Act as confirmed by 3 Judge Bench of Supreme Court in Ishar Alloy Steels Ltd. v. Jayaswals Neco Ltd. (2001 (2) KLT 148 (SC)). Returning the cheque unpaid by “the Drawee Bank” is coming under place (3) in the dictum. In other words it is correctly understood that “the Bank” in S.138(a) and “the Bank” ruled in 2001 (2) KLT 148 (SC) and “the Drawee Bank” in 1999 (3) KLT 440 (SC) para 14 place (3) are one and the same which is “Drawee Bank” and at the same time “the Bank” as ruled in para 14 place (2) is the Collecting Bank though these matters were discussed and explained in 2008 (3) KLT 461 by Hon’ble High Court.

10. Then it is difficult to understand that “presentation of the cheque to the Bank” under place (2) and Drawee Bank in place (3) are one and the same as it ultimately ends in the extinction of place (2) without considering the significance of the process of collection of cheque through Collecting Bank-Payee’s Bank which is not even considered under the dictum in 2 Judge Bench of Supreme  Court 1999 (3) KLT 440 (SC) nor discussed in the 3 Judge Bench decision in 2001 (1) KLT  148 (SC) where “the Bank” is Drawee Bank, on which the cheque is drawn and not banks where the cheque is presented for collection. There is no difficulty to understand “the Bank” in S.138(a) as same as “the Drawee Bank” in para 14 place (3). But the difficulty is to understand “the Bank” in para 14 place (2) as the same as place (3) in para 14 of 1999 (3) KLT 440 (SC). Confirming of jurisdiction to the place of “presentation of the cheque to the Bank” in para 14 - place (2) is established by Hon’ble Supreme Court and in the absence of subsequent Dictum/Ratio declared by the Hon’ble Supreme Court there is difficulty. The Supreme Court Dictums in the light of explanation of the High Court in para 5, 2008 (3) KLT 461 is to be correctly understood and applied, so as to avoid/minimize the difficulty regarding the jurisdiction.

11. Thought there is no new Ratio Decidendi/overruling/dissenting from the Dictum established so far after the 1999 (3) KLT 440 (SC) by the Hon’ble Supreme Court the obiter dicta - incidental legal principles discussed - as contained in 2008 (3) KLT 461 (including para 15) is being followed with persuasive effect as the criteria for fixing the jurisdiction thereby treating place (2) and (3) into same category ultimately putting an end to place (2) which is the actual difficulty at present for which suitable remedy is inevitable to attain ends of justice in the larger interest. The actual difficulty still subsists with a ray of hope in good faith for getting remedial relief atleast in due course, as is visible in Purushothaman  v.  State  of  Kerala (2009 (2) KLT 540)  by not following Ahammedkutty Haji v. State of Kerala (2007 (1) KLT 68)  and by following the 1999 (3) KLT 440 (SC) in respect of place of demand notice for jurisdiction.

Judiciary-friendly Computer Forensics

(By P. Vinod Bhattathiripad, Cyber Forensic Consultant, Calicut) 

The New Indian Express on 13th January 2009, carries a story that says, “The police are reported to have taken into custody for interrogation some former staff of a leading jewellery house in Palakkad in connection with a fraud of Rs 46 lakh committed by manipulating the software and data base of the computers of the firm. The frauds were committed during a three-and-a-half-year period beginning in early 2004. The police have already detected concrete proof for frauds perpetrated to the tune of Rs.15 lakh and are in the process of proving the balance amount. The case which falls in the category of cyber financial fraud was being investigated by the police since September 2007 when it was first noticed and reported by the management of the jewellery firm to the police..........”

The preliminary routine investigation by Palakkad police did not find any tangible evidence favouring the complaint. It perhaps did not occur to them at that stage that they might well be ‘fumbling in the dark’, without the assistance of a cyber forensic expert. There really was no physical evidence, but only digital evidence existed, which the police could not “see” and “feel”. It was after three months that the case was made over to Neeraj Kumar Gupta, a young Assistant Police Superintendent of Palakkad police, who sniffed out the whiff of crime in the case and sought the assistance of this author for investigating the case and as the Indian Express report (later) says, “The police unearthed all digital evidences with the help of its technical expert”. This digital evidence later got corroborated in the court by an expert commissioner, who also was a cyber forensic expert. (The final judgment of this suit is still pending in the court.)

Cases of the above type were unimaginable a few years back, but in the modern world of information and communication technology, criminals are expanding their horizons into the electronic space. The information and communication technology revolution has taken the world to greater heights, but one significant side-effect of this is the importance of the ethical, legal and practical issues related to abuse through or by the technology. Any crime related to this technology, in general, and computers, in particular, is a cyber crime, be it cyber financial fraud, identity theft, hacking, slacking, threat through email, virus, pornography, unauthorized disclosure of internal and confidential information, theft or trade of intellectual property, use of computers for personal gain, violation of company acceptable policies, launching of denial of service attacks on computer network servers, software piracy or supply of low-quality Information Technology (IT) products. There have been civil and criminal suits concerning all these areas, and the role of cyber forensic experts in identifying the crime, collecting, preserving and interpreting the evidence and in convincing the judiciary is important. The petitioners, lawyers, police and the judiciary seek the help of cyber forensic experts at various stages of the investigation, litigation and arbitration.

These developments have led on to the emergence of a new field of applied computer technology, generally called computer forensics or cyber forensics. Computer forensics, as the name indicates, is an inter-disciplinary area, largely straddling global use of computer technology and the law-enforcement and is responsible for identifying, locating, extracting, and analyzing types of data from various computers and related devices, and the cyber forensic experts interpret them to serve as legal evidence. The most important skill of a cyber forensic expert is his ability to identify and interpret the electronic evidence and communicate it in a judiciary-friendly manner. Cyber crimes occur in plenty of ways that a cyber forensic expert specialized in certain areas may not be able to do justice to other areas of cyber crime investigation. For instance, software piracy and cyber financial fraud investigations require computer engineers with hardcore experience in software engineering and database techniques while tracing the author of a threatening e-mail or a dangerous virus require expertise in computer network engineering. Because the judicial system often has difficulties in mandating and interpreting standardization for computer forensics, it becomes the responsibility of the computer engineers to assist in this endeavor.

The cliche that no man is an island is more true today of the computer community than any other, and this puts any individual computer user very much at risk in that his computer is likely to be prone and susceptible to any error or misuse originating from any part of the computer network, including the world wide web. It is probably true to say that unlike in the physical world, a person may technically be guilty of a computer crime without either the mens rea or the actus reus. It is therefore the duty of the cyber forensic experts to assist the investigators to detect and document all such electronic evidence.

Electronic evidence is in the form of data and information, stored in the computer disks or other electronic storage devices. (In IT, a distinction is often made between data and information. Roughly, information is what is available on the surface as processed version and data is how it is underlyingly represented in the raw form in computer storage.) Collecting ‘information’ is relatively easier than digging out the ‘data’, particularly if the storing of the data uses intentional and deliberate concealment techniques.

Traditionally, there are ways of storing data that control access and use of material stored. Even though most of this is fairly sophisticated, none of them are strictly beyond misuse by determined criminals. The complexities of storage and the cleverness of intrusions into the secrecy by determined criminals constitute serious problems for the expert, who, when called upon, has to wade through the morass of storage and concealment of both the encryptions and intrusions and come out with tangible and clear evidence that will be admissible to the judiciary.

Although the data is usually stored in files and data bases, there are many ways to intentionally conceal or obscure such storage. One way to conceal data is by using cryptographic algorithms in which the communications are encrypted and thus kept hidden from anyone for whom it is not intended. Only the intended recipient of the communication will have the key to decrypt the communication, back into an intelligible form. A sub-version of cryptography is a method known as Secret Sharing Scheme where ‘k’ out of ‘n’ people have enough information to decrypt the code but any set of k minus l people do not. The modern cryptographic algorithms are so perfectly designed that it is very difficult, but not impossible, for the expert to break into.

Steganography is another art of hidden writing. While cryptography enables one to keep the message unreadable, Steganography hides the secret information within a document, say, in an innocent photograph, from where the intended recipient can extract what is required by going into the data pertaining to this photograph. While cryptography and Steganography form important means of secret communication for the right kind of interactions including those involving national security, they also run the risk of being abused and misused by unscrupulous criminals. These sorts of crime investigation require cyber forensic experts specialized in the art of encryption intrusion.

Computer networks are prone to criminal invasion, and there are also several popular and ingenious techniques used for this. One concealment technique employed in the computer network, often open to abuse, is the Internet Protocol (IP). The abuse of this, called IP Spoofing, is the technique of attacking another computer by ‘spoofing’ the electronic identity (e.g. IP address) of a trusted machine in order to mask the attacker’s true IP address. Another such computer network attacking technique is ‘tapping’, which is the method of unauthorized gaining of access to a computer system by tapping somebody else’s existing login session on a computer system. Once the official user gains (or opens) a login session onto a remote computer system after giving the necessary authentication data (say, user name, password etc), the attacker too would be able to use this open path to gain another login session or get into the same remote computer system, bypassing all authentication requirements. Only experts specialized in computer networks can investigate such crimes.

A more insidious technique, used in viruses and worms, is polymorphism, which causes viruses etc. to mutate albeit by keeping the original algorithm intact and this makes the job of anti-virus and intrusion detection software difficult. Identifying the author of viruses and worms by tracing back through the computer network is a common area of investigation for cyber forensic experts.

Another invasive technique is to hide secret data in the swap file (alias virtual memory), which is the file created in the hard disk by the operating system to simulate extra RAM. As swap files are huge, it provides a way for the criminals to store secret data without the knowledge of the computer user. Once the computer is switched off, any data stored in the RAM will be lost but data stored in the swap file (though an extension of RAM) is not lost and this makes the job of the criminal easy and that of the expert, difficult.

File slacking is another data concealment technique, where the criminal makes use of the blank space of an already used cluster (usually the last cluster of a file). A cluster is the smallest block of data storage (in a hard disk, for example) on computers run on DOS, and Windows. The size of a cluster is fixed. If a stored file consumes 3.75 clusters, the last quarter of the 4th cluster would remain vacant and this blank space is called a ‘file slack’. Technically the computer informs the user that it has earmarked four clusters for the file but actually only 3.75 clusters are used. Because of this, if a criminal stores his secret file in the file slack (the balance 0.25 cluster, in the above example), the actual total storage consumption shown by the computer will not change and thus it is difficult, but not impossible, for the expert to get to know the information about the secret file thus stored.

Renaming of files is a clever method adopted by the criminals. They can introduce and store a file containing secret information and then name it as a DLL or JPEG file (or any other normal ‘harmless’ common file type) so as to escape detection or divert the attention of the cyber forensic expert. Computer criminality is so sophisticated that not only do criminals abuse the concealment techniques but also cleverly cover their tracks by concealing or obfuscating the detection of their incursions. This is generally called anti-forensics. One method used for this is spoliation, which refers to the material alteration or destruction of data thereby preventing or spoiling later access into it for the purpose of extracting information to be used as evidence of interference in potential litigation. Anti-forensic software tools like Timestamp, help concealing, editing or deleting valuable evidence in order to make it unreliable in the court. Many tools are available that can readily wipe files, directories, partitions, and hard drives. They are as sophisticated as the forensic tools they seek to defeat. The expert then has to look for evidence to establish spoliation.

There are standard, highly-specialized and judiciary-friendly procedures and software tools generally available for identifying, collecting, analyzing and documenting the above mentioned cyber crimes. Cyber forensic experts use these procedures and tools to supplement their intelligence, expertise, common sense and insight. For instance, in a sensitive case of transaction involving inter-state transportation of spirit, the Palakkad police, with the help of cyber forensic software expert, could recover already deleted digital evidence from a seized computer that was used to forge the registration documents of the three vehicles used in the crime. However, John J. Barbara, a crime laboratory analyst supervisor with Florida Department of Law Enforcement, quotes an unidentified source “......But forensic people don’t know how good or bad their tools are, and they’re going to court based on evidence gathered with those tools. You should test the validity of the tools you’re using before you go to court......”.

One area of cyber crime investigation that is still in its infancy due to the non-availability of standardization in procedures and software tools is software piracy investigation. It is simple and economical to copy software programs and so, software piracy is extensive. The nature of piracy disregards the intellectual effort and right of possessions of the original author. In addition to this, the author of the software is deprived of a fair return for his work. Software piracy has many negative consequences, not just to the author of the product, but also to the country where the pirated software is sold. Piracy can be investigated using software tools but its investigation demands a greater role for cyber forensic expert’s intelligence, expertise, common sense and insight because of the inherent complexity in software programming logic and underlying global commonalities in it.

In a software piracy context, a cyber forensic expert is the person who is often designated to compare the allegedly pirated software with the ‘original’ and prepare a report that is legally convincing and binding. The report is expected to be transparent to non-technical persons as well, and should help the judicial system in convincingly validating the legal process of resolving the situation. As programmers use underlying universal programming standards, sieving out the legally valid similarities and commonalities found in the two software programs and presenting them in a judicially convincing manner is no mean task for experts who mostly are computer engineers, untrained in legal studies.

When there is a complaint of software piracy, the legal authorities, with the assistance of an expert, seizes the digital evidence along with the physical evidence. The process of seizure itself has to be in a legally non-challengeable manner and has to take into account the concerns of not only the parties explicitly implicated in the case, but also those functionally involved in the pirated product. They include clients, customers or corporate associates of the concerned establishment. Wherever possible, the expert tries to ensure that these uninvolved parties are minimally affected by the seizure.

In order to prove in the court of law that the allegedly pirated software has been commercially exploited, the seizure procedure usually requires seizure of the allegedly pirated software from the hard disk of the computer system of the establishment which bought the software. As this computer system, mostly the main computer server, would contain live data also, it will take a minimum of one day for the concerned officials of the establishment to install another computer server with the necessary software and data, before resuming their normal operations. In the case of banks, a delay of even one hour in rendering service would create inconvenience to their innocent account holders across the globe. The process of seizure requires hashing of hard disk, a technique of electronically (mathematically) sealing the hard disk, which itself is time consuming (say, 3 to 12 hours or even more, mostly during business hours), causing inconvenience to the clients of the concerned establishment. The delay in restoring the necessary software and data in the back up system can be reduced if the cyber forensic expert, strictly at the beginning of the raid, can sympathetically let the client officials be aware of the imminent seizure of the hard disk during the raid and of the necessity of getting the back up system ready by the time of completion of the seizure. Moreover, since the client establishment per se is not accused, the expert is sympathetic but not necessarily over-lenient on the procedures of seizure. In similar situations, the author has always ensured that no operation of the concerned establishment is affected during and after the seizure. In an unusual situation, while conducting a raid in the suspected computer incident scene of a case (Sesame Software Solutions v..Perfect Software Solutions), the staff and management of the involved party (alleged pirate) appealed to the Advocate Commissioner that, if the suspected computer was seized, their day-to-day business operations would be affected in the absence of the software and databases in it. Subsequently, as directed by the Advocate Commissioner, the author himself (as the expert commissioner to conduct the raid) copied the software as well as the databases in the suspected hard disk to the firm’s network server without allowing the alleged pirate to touch the computer, and this unusual sympathetic procedure was recorded in the expert commissioner’s report submitted to the court. (The final judgment of this suit is still pending in the court.). During seizure, the cyber forensic expert should be careful not to destroy evidence by being over-sympathetic On the other hand, by being over-strict, his act of seizure should not force the raided establishment to close down its shutters for ever either.

During the analysis of the digital evidence, the expert concentrates on systematically finding and collating out the similarities and commonalities along four parameters namely the nomenclature tradition of the software company in naming various entities in the program; the logic of the program; the errors; and the comments, which is not an easy task. The duty of the cyber forensic expert is to establish the possible piracy through a rigorous formulation of statistical occurrences of the data structures, variables, data base tables, fields, modules , procedures, logic, remark, error and blunders in the allegedly pirated software and arrive at several values, preferably in percentages, to indicate the strength of piracy. For instance, while comparing the software and the data base tables as part of the software piracy investigation as the expert commissioner of the honourable Judicial I class magistrate, Kozhikode, Kerala, on the suit, Software Associates vs. Together Infotech, (Suit number: CMP 10371/2002), this author found significant statistical occurrence of fields (in the allegedly pirated data base script) bearing exactly same names, datatypes, length, context, and sequence of appearance, as in the ‘original’. Even if these fields bear moderately universal names, it is very difficult to imagine that two software engineers will program exact similarity in names, data types, length, context, as well as the sequence of appearance of fields in two commercially available complex software packages. This finding alone may not prove piracy. Yet, the expert can add it to the list of supporting evidence for suggested piracy.

Findings like this encourage the cyber forensic expert to present a very clear report to the court like for example, “There is 81% similarity as 9 out of 11 fields bear exactly same names, datatypes, length, context, and sequence of appearance in this table”. These percentages, as tangible evidence unambiguously arrived at by the technical experts, would be concrete enough to help the judge to pronounce judgment.

Software carries a thumb impression or special nomenclature patterns of the owner of the software. The presence of such thumb impression verbatim (or its logical derivatives) in the original as well as the allegedly pirated source code suggests piracy. However, identifying any type of thumb impressions in a software and establishing piracy is tougher when the software under investigation was written by one software engineer and updated at various instances later, by other software engineers, which is a serious issue due to the frequent turnover of employees in software industry. These multiple thumb impressions compatibly identified in both the ‘original’ and the ‘pirated’ source codes can prove to be vital. Here, only the cyber forensic expert’s expertise, common sense, intuition and insight can make his interpretation look more intelligent.

There is scope for extending the software piracy investigation beyond mere software comparison. Any other sundry complainant-specific data found in the computer system of the alleged pirate is also an indication of piracy. For example, from the pirate’s computer system, if the cyber forensic expert could dig out, say, files related to the complainant’s clientele or a back up copy of the live database of a client of the complainant, it can form serious evidence. Such rare instances occur when the piracy was done by performing a disk copy (of the complainant’s computer) that resulted in pirating not only the source code and data base related files but also other confidential data of the complainant. The existence of such material is stronger evidence of piracy as these are materials irrelevant for the functioning of the software and hence should not have been there in the first instance, if it was not pirated. For example, page 6 of the above mentioned expert commissioner’s report submitted to the court by the author, narrates such a rare situation, where the author could gather from the seized computer, an unaltered copy of the complainant’s original software together with the back up copy of the live database taken from one of the complainant’s client installations in Kenya. In this case, although the software comparison results were indicative of potential piracy, the presence of the back up copy of live database of a client of the complainant helped the author to unequivocally establish it. Again, the author was called in to investigate a case where a UK-based software firm alleged that one of its (former) employees had appropriated a software product of his employers and was marketing it as his own even while he was still employed in the company. The author found that the alleged culprit had created and maintained a website to market the allegedly pirated software even as he was still employed by this firm and this proof from the DNS server was enough to initiate a case in the court. 

One final thing to remember is that expert opinion can be challenged in the court of law. Such challenge can generally be due to incomplete comparison leading to unreliability of evidence, and in such cases, during the subsequent cross examinations in the court of law, the lawyers will prove that there was still scope for further in-depth analysis. For example, the cyber forensic report on the suit number OS 2/2007, before the District Judge, Kozhikode (See CDAC, 2008) was later challenged in the court. The challenge was upheld by the court as the expert conceded that he had relied solely on the results of automatic comparison tools. Obviously, events like this might cause inconveniences to the jury and delay the final judgment. Hence, the first report of the technical expert itself should wherever possible be thorough, convincing and binding and it is the duty of the technical expert to avoid creating ambiguities and inconveniences to the judiciary, with the possible consequence of an unintended delay or miscarriage of justice.

Computer forensics is gaining importance in the modern digital world, to counter the intelligent activities of the cyber criminals. The cyber forensic experts are typically required to substantiate cyber issues arising from secret data concealment, patent and copyright infringements, trade secret misappropriation, and software piracy. The variety of cyber crimes are so plenty that a cyber forensic expert specialized in certain areas may not be able to do justice to other areas of cyber crime investigation. In arbitrations arising out of software piracy, even though the investigations are generally performed with the help of special software tools, the cyber forensic expert’s intelligence, expertise, common sense and insight play a bigger role in software piracy investigation. The biggest challenge before the cyber forensic expert, a non-legal professional, is to identify, collect, organize and interpret the electronic evidence and communicate the interpretation in a legally binding and judicially convincing manner.

References

Albert J. Marcella, Jr., and Doug Menendez, (2008), Cyber Forensics, New York: Auerbach Publications CDAC, (2008) Analysis report of the Resource Centre for Cyber Forensics, Centre for Development of Advanced Computing, Government of India, Thiruvananthapuram - 695 033, Kerala, Report number CDAC/RCCF/2007-20AR/Jan/2008, on the suit number OS 2/2007, District Judge, Kozhikode

Clyde W. Holsapple, Deepak lyengar, Jin Haihao., Shashank Rao, (2008), Parameters for Software Piracy Research, The Information Society, 24.4

Don L Lewis, (2009), The Hash Algorithm Dilemma - Hash Value Collisions, Forensic Magazine from http://www.forensicmag.com/Article_Print.asp?pid=238

Dr. Santhosh Baboo and Vinod Bhattathirpad P., (forthcoming), Software Piracy Forensics: Exploiting non-automated and judiciary-friendly techniques, Journal of Digital Forensic Practice, USA

Hal Berghel, 2007, Hiding Data, Forensics, and Anti-forensics, Communications of the ACM

John J. Barbara, 2009, Digital Insider: Anti-Digital Forensics, The Next Challenge, Forensic Magazine from http://www.forensicmag.com/Article_Print.asp?pid=245

Vinod Bhattathiripad P., (2002) Software Comparison report, Software Associates vs. Together Infotech, submitted to Judicial I class magistrate, Kozhikode, Kerala, India, case number CMP 10371 / 2002.

Vinod Bhattathiripad P. (2007), Report submitted to the honourable District Court, Kozhikode, Kerala on Sesame Software Solutions v. Perfect Software Solutions

The Canadian Connection in Election Involved in Art.324 Imbroglio

(By T.P. Kelu Nambiar, Senior Advocate, High Court of Kerala)

Today is my 'Super-Friday'; therefore I thought of writing on an important subject, making a useful waste of time, putting my blue pencil to good effect.

It is trite that esteemed and responsible persons should not render curt and casual, or rehearsing, opinions on matters of moment. Such opinions bake no cake. This is specially so in regard to substantial questions relating to the interpretation of the Constitution of India, the 'manufacture' of the Constituent Assembly. Study carefully and opine cautiously, is the lesson I have learnt, living legal profession since 1954, (and, now, preparing for a life without 'Your Lordship'.)

I have been diligently following the recent controversy, (the Panic of 2009), over the recommendation of the Chief Election Commissioner (CEC) of India to remove from office one of the Election Commissioners. Among those who ventured opinion on the correctness or otherwise of the action of the CEC, some leading politicians, leaders with 'big bags' and Senior Advocates, (big names in the legal profession, wearing heavy price tags, considered to be opinion power-house), figured. The speed with which they rendered their high-decibel opinions showed that the opinions were mostly off-hand, and dicey, without re-visiting the Constitution, when a hard re-look was needed sitting at the home-work desk; and, off-hand, on a vital Constitutional aspect, 'a matter of the greatest importance', according to Pandit Hirday Nath Kunzru, in his speech in the Constituent Assembly of India; winged words, indeed. Those who ignore this, will have to make a historic apology to the Constituent Assembly. I have the honour of acquaintance with the Constituent Assembly Debates, my weakness and my strength. I always remember that there is only one Constitution for India.

I beg to differ, with respect though, with those who went to the extent of saying, without any self-doubt, that the recommendation of the CEC was unconstitutional. (The Regret of 2009). There is too much doubt to be certain about the audacious articulation, which does not make eminent sense; and I remain unconvinced. It may not be considered that I am searching for superlatives to applaud the CEC.

The Constitutional provision concerning the aspect is in Art.324, (in Part XV -Elections).

The provision in Cl.(l) of Art.324 transfers the superintendence, direction and control of the preparation of the electoral rolls and of all elections to Parliament and the Legislatures of States and to the offices of President and Vice-President, to a body outside the Executive, to be called the Election Commission. CI.(2) says that there shall be a Chief Election Commissioner and such number of other Election Commissioners, appointed by the President. CI.(3) says that the Chief Election Commissioner shall act as the Chairman of the Election Commission. Cl.(4) provides for appointment of Regional Commissioners.

Cl.(6) provides for appointment of staff necessary for the discharge of the functions of the Election Commission.

At present, we are concerned with cl.(5) of Art.324. Therefore, it would only be appropriate to read cl.(5) here:

"(5) Subject to the provisions of any law made by Parliament, the conditions of service and tenure of office of the Election Commissioners and the Regional Commissioners shall be such as the President may by rule determine:

Provided that the Chief Election Commissioner shall not be removed from his office except in like manner and on the like grounds as a Judge of the Supreme Court and the conditions of service of the Chief Election Commissioner shall not be varied to his disadvantage after his appointment:

Provided further that any other Election Commissioner or a Regional Commissioner shall not be removed from office except on the recommendation of the Chief Election Commissioner".

The controversy centres around the interpretation of the Second Proviso.

The present Art.324 was draft Art.289 before the Constituent Assembly. Introducing the said Article for the consideration of the Assembly, on 15th June 1949, Dr. Ambedkar said as follows:

"So far as cl.(4) is concerned, (cl.(4) of the draft Art.289 is cl.(5) of the present Art.324), we have left the matter to the President to determine the conditions of service and tenure of office of the members of the Election Commission, subject to one or two conditions, that the Chief Election Commissioner shall not be liable to be removed except in the same manner as a Judge of the Supreme Court. If the object of this House is that all matters relating to Elections should be outside the control of the Executive Government of the day, it is absolutely necessary that the new machinery which we are setting up, namely the Election Commission, should be irremovable by the executive by a mere fiat. We have therefore given the Chief Election Commissioner the same status so far as removability is concerned as we have given to the Judges of the Supreme Court. We of course, do not propose to give the same status to the other members of Commission. We have left the matter to the President as to the circumstances under which he would deem fit to remove any other member of the Election Commission, subject to one condition that the Chief Election Commissioner must recommend that the removal is just and proper".                   (emphasis supplied for reader convenience.)

Mark, Dr.Ambedkar said very little and conveyed a lot in his speech.

Though Prof. Shibban Lal Saxena moved an amendment to the effect that both the Chief Election Commissioner and the Election Commissioners should be removable in the same manner, as stated in the first Proviso, leaving the Regional Commissioners alone in the second Proviso, the amendment does not seem to have been seriously pressed; and it was not accepted by the House. Apart from the active participation of Pandit Hirday Nath Kunzru and Prof. Shibban Lal Saxena, dominant intellectual forces of the Constituent Assembly like Sri.T.T. Krishnamachari, Sri H.V. Pataskarand Sri. K. M. Munshi (Advocate's Special) also shed the light of wisdom to the discussion, emphazising the need for total independence of the Election Commission.

The Provision in the Second Proviso and the address of Dr. Ambedkar relating thereto, are clear, simple, and straight-forward. That the recommendation of the Chief Election Commissioner is crucial, is evident. Let me put it succinctly this way: The recommendation may emanate from the Chief Election Commissioner. The President may accept or refuse to accept such a recommendation. The President may deem it necessary to remove an Election Commissioner. But he cannot do it on his own. He may take a decision to remove an Election Commissioner; but he shall seek the recommendation of the Chief Election Commissioner. If the Chief Election Commissioner recommends, agreeing with the President for removal, the Election Commissioner can be removed. But, if the Chief Election Commissioner disagrees with the President and does not recommend that there may be a removal, it looks as though the President may not be able to remove the Election Commissioner. Therefore, either way, the recommendation of the Chief Election Commissioner is the deciding factor, either initially or after the Presidential action. This accords with the object that the Election Commission should be irremovable by the Executive by a mere fiat. The Executive Government is not the proprietor of the Election Commission. The position is very clear in that the President, acting on the advice of the Council of Ministers alone, cannot remove an Election Commissioner, unless the CE.C. recommends such removal. Absolute independence of the Election Commission is assured by the Framers of the Constitution. This cannot be ignored. This is stark simple. The Executive Government cannot sleep-walk into the Election Commission.

It may be noted here that the matter relating to election is so important that it was thought at one point of time, when the question was before the Fundamental Rights Committee of the Constituent Assembly, that it should be included in the Fundamental Rights on the ground that the Fundamental Right of adult franchise should not only be guaranteed by the Constitution but its proper exercise should also be guaranteed in practice. (Here, I call attention to the petition pending before the Supreme Court, relating to the right to 'negative voting', to reject a candidate.)

But later it was thought appropriate to put the matter in a separate part, possibly because the matter relating to election was conceived on the basis of the Canadian Election Act. Art.289 was drafted on the lines of the provisions of the Canadian Election Act. The proceedings of the Constituent Assembly indicate that much was borrowed from the Canadian Act. The Constituent Assembly proceedings, a veritable store-house of knowledge, an enticing treasure would certainly throw light on the interpretation of the Constitutional provisions. The discussions may not be rejected, or isolated, as 'time-krred or otise. Do not interrogate the past. Old wood is appropriate for new homes. It is better that lawyers remember that legal opinion is no poll-speech.

Over to the readers.