A qualitative comparative doctrinal and institutional analysis published in Frontiers in Computer Science has evaluated how legal rules, procedural safeguards, and institutional capacity govern digital forensics during cybercrime investigations in the United States and India. Conducted by researchers Rasheed Tahir, Sangar Dawood Mohammed, and Kawar Mohammed Mousa from Near East University, the investigation examined primary statutes, court decisions, procedural rules, official institutional records, and secondary scholarship across five dimensions: legal authority, procedural safeguards, institutional capacity, cross-border cooperation, and fundamental rights. The researchers identified a core divergence in the procedural role assigned to electronic-evidence certification. While both jurisdictions permit certification to establish authenticity, the United States incorporates certification as an optional self-authentication mechanism within a plural authentication structure, whereas India embeds certification directly into its statutory admissibility pathway for qualifying computer output.
The study contextualizes these legal mechanisms within the rapid expansion of digital crime, observing that criminal activities increasingly depend on interconnected platforms, cloud computing, mobile systems, artificial intelligence, and sophisticated techniques such as encryption and anonymization. To demonstrate the operational landscape without drawing direct comparative prevalence conclusions, the authors documented national figures from separate reporting systems. In the United States, data from the Federal Bureau of Investigation Internet Crime Complaint Center recorded 791,790 complaints with 4.2 billion dollars in losses in 2020, rising to 847,376 complaints with 6.9 billion dollars in losses in 2021, 800,944 complaints with 10.3 billion dollars in losses in 2022, and 880,418 complaints with 12.5 billion dollars in losses in 2023, where investment fraud accounted for 4.57 billion dollars and business email compromise reached 2.9 billion dollars. In India, records from the National Crime Records Bureau showed registered offenses rising from 50,035 cases in 2020 (a rate of 3.7 per 100,000 population) to 52,974 cases in 2021 (3.9 per 100,000) and 65,893 cases in 2022 (4.8 per 100,000), with fraud representing 64.8 percent of registered cases in 2022. The authors explicitly emphasize that because United States figures reflect complaints submitted to IC3 while Indian figures reflect formally registered offenses, these datasets derive from fundamentally different recording practices and cannot measure relative criminal prevalence between the two countries.
In analyzing the United States federal framework, the researchers found that investigative and evidentiary powers are decentralized across constitutional provisions, federal criminal statutes, and procedural rules rather than consolidated in a single legislative code. Substantive cyber offenses are primarily prosecuted under the Computer Fraud and Abuse Act, codified at 18 U.S.C. section 1030, while government access to stored electronic communications and subscriber records held by third-party service providers is governed by the Stored Communications Act under 18 U.S.C. section 2703. Constitutional constraints under the Fourth Amendment govern the seizure and subsequent forensic analysis of hardware. Supreme Court jurisprudence in Riley v. California established that searching the digital contents of a lawfully seized mobile phone generally requires an independent warrant, separating physical custody from digital examination, while Carpenter v. United States confirmed that acquiring historical cell-site location information from service providers constitutes a search requiring constitutional protection due to the extensive personal details revealed.
Evidentiary rules in the United States federal courts establish a pluralistic authentication model. Under Federal Rule of Evidence 901(a), the proponent of evidence must present evidence sufficient to support a finding that the item is what it is claimed to be, allowing authentication through witness testimony, distinctive characteristics, system evidence, metadata, or forensic evaluation. Federal Rules of Evidence 902(13) and 902(14) provide self-authentication pathways through formal certification by a qualified person, eliminating the requirement for live foundational testimony. Rule 902(13) applies to records generated by an electronic process or system that produces an accurate result, whereas Rule 902(14) governs data copied from a device, storage medium, or file where integrity is confirmed via digital identification such as cryptographic hash values. The authors highlight that certification under Rule 902 establishes authenticity but leaves open independent inquiries concerning hearsay, relevance, or unfair prejudice, while Federal Rule of Evidence 702 independently regulates expert opinion testimony based on scientific or specialized technical knowledge.
In contrast, India regulates electronic evidence through a more statutorily structured pathway under the Information Technology Act 2000 and the newly enacted Bharatiya Sakshya Adhiniyam 2023, which took effect on July 1, 2024. Sections 61 and 62 of the BSA grant electronic records legal validity but direct the proof of their contents specifically through Section 63. Section 63 provides that computer output—defined as information stored, recorded, printed, or copied in electronic form—is treated as a document if certain statutory conditions are met, such as regular device use, ordinary input of information, proper system operation, and accurate reproduction. Section 63(4) mandates that whenever an electronic record is submitted for admission, it must be accompanied by a certificate identifying the record, describing the production manner, detailing the system, and affirming compliance with statutory operating conditions. The certificate requires execution by the person responsible for the computer device or activity alongside an expert, and its statutory Schedule expressly mandates recording technical details, including source-device particulars and cryptographic hash values.
The study traces the judicial origin of this statutory requirement to the interpretation of Section 65B of the repealed Indian Evidence Act 1872. Landmark decisions including Anvar P.V. v. P.K. Basheer in 2014 established that the statutory certification procedure was mandatory for admitting computer output, displacing general secondary evidence rules. The Supreme Court refined this doctrine in Arjun Panditrao Khotkar v. Kailash Kushanrao Gorantyal in 2020, distinguishing between original electronic records produced directly from the primary device and computer output derived from that device; the certificate was characterized as a condition precedent to the admissibility of computer output, though courts retain procedural discretion to permit certificate production at later stages before trial concludes. In 2026, the Supreme Court in Pune Bar Association v. Union of India confirmed that Section 63(4) of the BSA preserves and strengthens this architecture by incorporating mandatory hash values and expert certification. Section 90 of the BSA further clarifies that while a court may presume an electronic message matches the text entered for transmission, it creates no presumption regarding the identity of the human sender, reinforcing the boundary between technical provenance and substantive authorship.
Examining institutional capacity, the authors observed that both nations experience significant internal variations in technical readiness and resource allocation. In the United States, digital forensics relies on a decentralized model spanning federal, state, and local agencies. Specialized resources include the FBI-sponsored Regional Computer Forensic Laboratory network, which in 2025 encompassed 17 full-service forensic laboratories where federal authorities supply infrastructure, equipment, training, and operational funding while participating agencies assign personnel. Nevertheless, resource gaps persist between metropolitan or federal units and smaller local departments, impacting examination turnaround times and access to cutting-edge tools. Operational guidance from the Department of Justice Computer Crime and Intellectual Property Section assists federal prosecutors, requiring mandatory consultation on designated Computer Fraud and Abuse Act charges to manage prosecutorial breadth.
India operates its forensic infrastructure through centrally coordinated entities and State and Union Territory forensic laboratories. Citing official Ministry of Home Affairs reports from 2026, the authors documented that projects totaling 244.89 crore rupees had been approved across 30 States and Union Territories to enhance cyber-forensic and DNA-analysis capabilities. However, operational availability remains uneven: cyber-forensic divisions were active in many jurisdictions, but others remained under establishment, and several Union Territories relied on Central Forensic Science Laboratories or neighboring facilities. Specific institutional workload indicators show that as of February 3, 2026, the National Cyber Forensic Laboratory (Evidentiary) in Hyderabad had 181 cases pending examination, operated by four in-house experts and five contractual staff. Concurrently, the National Forensic Sciences University conducted 66 training programs for 1,852 personnel over five years, the National Digital Investigation Support Centre assisted in over 13,417 cases by January 31, 2026, and the I4C CyTrain platform registered 151,081 officers and awarded 142,025 training certificates.
Regarding transnational evidence acquisition, the study underscores that international cooperation mechanisms frequently lag behind cloud architectures, multinational hosting platforms, and encrypted services. Cross-border investigations require navigating four distinct legal stages: preservation, lawful access, disclosure, and judicial admissibility. While traditional Mutual Legal Assistance Treaties enable intergovernmental requests, their lengthy administrative procedures often risk the loss of volatile digital proof. The Council of Europe Convention on Cybercrime (Budapest Convention), which entered into force on July 1, 2004, binds the United States as a State Party, whereas India remains a non-party relying on bilateral treaties and domestic statutes. Its Second Additional Protocol opened for signature on May 12, 2022, but had garnered only four ratifications among 52 signatories by October 2026, falling short of the five ratifications required for entry into force; the United States signed the protocol but has not ratified it. Similarly, the United Nations Convention against Cybercrime, adopted on December 24, 2024, had 95 signatories and three Parties by September 2026, remaining well below the 40 ratifications necessary for enforcement. Under the U.S. CLOUD Act, 18 U.S.C. section 2713 mandates domestic provider disclosure regardless of data storage location, and authorizes bilateral executive agreements; however, while agreements exist with the United Kingdom and Australia, no bilateral agreement is in force with India.
The authors analyze these comparative findings through the conceptual lens of the Cyberfare State, which views digital evidence management as a critical component of state capacity and rule-of-law governance. Under this framework, democratic resilience requires that investigative capabilities—including physical seizure, forensic imaging, mobile analysis, and cloud retrieval—remain strictly disciplined by procedural safeguards, judicial oversight, and technical standards such as ISO/IEC 27037, 27041, 27042, and 27043. While India’s structured Section 63 pathway embeds technical integrity parameters like hash values directly into statutory admissibility, it requires continuous institutional support to prevent procedural bottlenecks. Conversely, the U.S. plural framework allocates evidentiary evaluation across judicial gatekeeping, foundational testimony, and self-authentication. The authors conclude that effective digital forensic governance requires sustained investment in forensic laboratory resources, accredited examiner training, updated statutory frameworks, and bilateral interoperability, while noting that empirical research will be required to measure the direct effects of specific policy reforms on operational case processing.
Subject of Research: Comparative legal and institutional analysis of digital forensics in cybercrime investigations in the United States and India
Article Title: Digital forensics in cybercrime investigation: a comparative legal and institutional analysis of the United States and India
Article References: Tahir, R., Mohammed, S. D., & Mousa, K. M. (2026). Digital forensics in cybercrime investigation: a comparative legal and institutional analysis of the United States and India. Frontiers in Computer Science, 8, 2010006. https://doi.org/10.3389/fcomp.2026.2010006
Image Credits: AI Generated
DOI: 10.3389/fcomp.2026.2010006
Keywords: Digital Forensics, Cybercrime Investigation, Electronic Evidence, Legal Frameworks, Evidence Admissibility, United States Law, Indian Law, Criminal Justice, Digital, forensics, cybercrime, investigation
Click Here For The Original Source.
——————————————————–
