Contents
- Domain / website blocking – Sec 69A IT Act route (procedure information)
- INDRP / UDRP – look-alike domain (bankname-support.in) used for fraud
- Social-media account ban / shadow-ban challenge – creator/business page disabled
- BSA 63 certificate drafting – dual certificates (custodian + system/process)
- Police seizure without memo/hash – phone/laptop taken, no paper given
- Article 20(3) – password / biometric / decryption demand during search
- FSL – phone / hard-disk / CCTV forensic examination request (Kerala)
- Cloud data / Gmail / Drive / WhatsApp-backup disclosure – MLAT vs platform channel
- FSL-direction writ – device/FSL/report pending, trial or lien stuck
- Platform grievance → GAC → court escalation bundle (Rule 3 / 3A)
- Intermediary safe-harbour note – IT 79 due-diligence relevance
- Search of office/home in cyber case – BNSS 185 + 105 compliance checklist
- CDR / IPDR / TSP disclosure request – who can ask, how long retained
- Bank-statement / UPI-switch proof – BSA 63 pair for money trail
- CCTV / ATM footage preservation – overwrite-risk letter drafting
- App-permission / APK forensics – smishing-APK examination questions
- Voice / call-recording proof – vishing audio + transcript + BSA 63
- Hash / chain-of-custody note – one-page format for every device
- Cross-border fraud – server/admin outside India, victim in Kerala
- Emergency disclosure – imminent-harm request (threat / NCII spread)
- Gag / media-restraint prayer where investigation or victim-privacy at stake
- Costs / compensation for illegal search or data loss by custodian
- Record-retention for cyber file – what to keep for 6 years
- When to brief High Court counsel – cyber-matter triage (High Court-primary)
Domain / website blocking – Sec 69A IT Act route (procedure information)
Phishing/fake-bank/defamatory site persists after reporting.
What it involvesStatutory blocking through designated process, not private request.
Relevant lawIT 69A (grounds: sovereignty, defence, security, foreign relations, public order, incitement – defamation alone is not one) + IT (Procedure and Safeguards for Blocking for Access of Information by Public) Rules, 2009; IT 79 safe-harbour context.
ForumOrganisation's Nodal Officer (e.g., State nodal officer) → MeitY Designated Officer + committee; court-order route (r.10); platform grievance first.
Procedure & stageGrievance tickets → complaint to the Nodal Officer with URLs/headers (Designated Officer takes no direct complaints – r.6(3)) → committee + hearing notice (r.7–8) → Secretary's approval → direction to intermediary.
RemedyAccess-blocking; parallel FIR/injunction continues.
High Court connectionHC writs test 69A compliance (necessity, hearing, review, confidentiality) – plead Rule steps.
Documents normally requiredURLs, headers, tickets, FIR/NCRP, harm note.
LimitationNo fixed period to apply – grievance first; Nodal Officer's request to be decided within 7 working days (Blocking Rules r.11).
Related: INDRP/UDRP; platform bans.
HC orders block directly?
Generally through statutory process – HC directs consideration.
INDRP / UDRP – look-alike domain (bankname-support.in) used for fraud
Deceptive domain harvests credentials; registrar slow.
What it involvesArbitration for bad-faith deceptive registration + parallel crime.
Relevant lawINDRP (.in) / UDRP (gTLD) policy + registrar terms; BNS 318/319 + IT 66D for crime track.
ForumNIXI/INDRP arbitrator or WIPO/UDRP provider; Cyber PS for crime.
Procedure & stageWHOIS preservation → complaint (confusing similarity + no right + bad faith) → lock/transfer/cancel; FIR parallel.
RemedyTransfer/cancellation; prosecution continues.
High Court connectionHC civil/injunction support where deceptive domain + trademark overlap.
Documents normally requiredWHOIS, site captures with time, trademark proof, FIR/tickets, BSA 63.
LimitationNo filing deadline in the INDRP/UDRP policy texts – preserve WHOIS/site captures now; domain transfer is locked only once a proceeding is pending.
Related: Phishing-header; BEC.
Faster – crime or domain case?
Both – crime freezes money, domain case removes lure.
Social-media account ban / shadow-ban challenge – creator/business page disabled
Business page disabled for "policy" with appeal pending; livelihood hit.
What it involvesContract + Rule 3(1)/4(8) notice-and-dispute process for SSMI own-accord action.
Relevant lawIT Rules Rule 4(8) (prior notice + dispute + RGO oversight for SSMI own-accord removal); IT 79; contract.
ForumPlatform appeal → Grievance Officer → GAC (Rule 3A, 30 days) → civil court/HC per maintainability.
Procedure & stageAppeal with ID/business proof; RGO escalation; GAC within 30 days; suit/writ per respondent nature.
RemedyRestoration + reasons; damages only on contract track.
High Court connectionWrit vs private platform is maintainability-sensitive – plead public-function/state-action only where arguable; else civil suit.
Documents normally requiredBan notice, appeal tickets, business-loss note, GAC filing.
LimitationGAC – 30 days from the Grievance Officer's communication (r.3A(3)).
Related: Grievance; injunction.
HC restores page?
Rare directly – record of Rule 4(8)/GAC exhaustion decides.
BSA 63 certificate drafting – dual certificates (custodian + system/process)
Electronic record objected as secondary/unproved at trial.
What it involvesTwo-track proof – account/custody source + device/process integrity.
Relevant lawBSA 63 (admissibility of electronic records – certificate signed by person in charge and an expert, in Schedule form: Part A party, Part B expert, each with hash).
ForumIO filing → trial court.
Procedure & stagePart A – party/person in charge of the device or source (device details, lawful control, hash); Part B – expert (source details, hash + hash report); link by covering memo.
RemedyAdmissibility; avoids re-trial proof gap.
High Court connectionHC appeal/revision turns on this pair.
Documents normally requiredExtract + hash note + two BSA 63 drafts + covering memo.
LimitationBSA 63 certificate with the record each time it is submitted for admission (s.63(4)); prepare with the record.
Related: Preservation; FSL.
One bank seal enough?
No – BSA 63(4) certificate is signed by the person in charge and an expert (Schedule Parts A and B).
Police seizure without memo/hash – phone/laptop taken, no paper given
Device taken "for check"; no seizure memo, no hash, no copy.
What it involvesBNSS 105/106 compliance – memo + AV recording + hash + copy where feasible.
Relevant lawBNSS 106 (seizure + report to Magistrate); BNSS 105 (AV recording of search/seizure); BSA 63 downstream.
ForumIO → jurisdictional Magistrate; revision/HC on illegality.
Procedure & stageWritten request for memo/hash/105 video ref + 106 court-report number; Magistrate application for copy/release.
RemedyDirection for compliance/copy/release; exclusion weight at trial.
High Court connectionHC revision/writ on illegal search/seizure after Magistrate record.
Documents normally requiredSeizure date/time note, witness note, written requests, Magistrate application.
LimitationNo fixed statutory period – request memo/hash/106 report immediately; Magistrate application promptly.
Related: Art 20(3); FSL.
Refuse to give phone?
Do not obstruct – ask for memo/hash/receipt and note objections in writing.
Article 20(3) – password / biometric / decryption demand during search
IO asks for password/fingerprint/face to open phone; fears self-incrimination.
What it involvesTestimonial vs physical-evidence line; compulsion limits.
Relevant lawConstitution Art 20(3); BNSS 105/106, 185; IT 69 (decryption only on a direction by an authorised Central/State Government officer; s.69(3) assistance duty).
ForumIO; Magistrate for direction; HC on compulsion question.
Procedure & stageSeek written direction; counsel present; biometrics vs password distinction noted; challenge before Magistrate/HC where compulsion alleged.
RemedyRegulated access; protection against compelled testimony.
High Court connectionHC-primary – compulsion and admissibility arguments.
Documents normally requiredWritten demand, device ownership note, Magistrate/HC filings.
LimitationNo fixed statutory period – seek written direction at the search stage; challenge before Magistrate/HC promptly.
Related: Seizure-memo; cloud-MLAT.
Must share password on spot?
Ask for written order and take advice – do not destroy or alter.
FSL – phone / hard-disk / CCTV forensic examination request (Kerala)
Device with IO for months; no mirror/hash/FSL movement.
What it involvesImaging + hash + tool-examination + opinion.
Relevant lawBNSS 106/105; BSA 63 + BSA 39 (expert opinion; 39(2) Examiner of Electronic Evidence under IT 79A).
ForumIO → FSL → trial court.
Procedure & stageWritten FSL request with questions (authenticity, morph, malware, timeline); hash-noted imaging; opinion + BSA 63 chain.
RemedyAdmissible forensic opinion; de-freeze/release parallel.
High Court connectionHC direction for time-bound FSL where trial/lien stalls.
Documents normally requiredDevice details, hash note, question list, IO letters, 105 memo.
LimitationNo fixed statutory period – FSL request with questions at forwarding; follow up in writing.
Related: Seizure; cloud.
Private lab report enough?
IO/FSL chain is stronger for trial.
Cloud data / Gmail / Drive / WhatsApp-backup disclosure – MLAT vs platform channel
Data on foreign server; IO says "no jurisdiction".
What it involvesDomestic production + platform law-enforcement channel + MLAT where needed.
Relevant lawBNSS 94/185 production/search; IT 75 extra-territorial; MLAT executive channel; IT 79/r.3(1)(j) (72-hr assistance on written order).
ForumIO → platform LE channel → MHA/MLAT where foreign compulsion.
Procedure & stagePreservation request (fast) → production order → MLAT (slow) – run in that order.
RemedyPreservation + disclosure for trial.
High Court connectionHC status-direction where preservation lapses for want of request.
Documents normally requiredAccount IDs, preservation tickets, IO orders, MLAT ref.
LimitationPreservation windows are short – request in days.
Related: FSL; BSA 63.
Victim requests Google directly?
Victim gets own data; suspect/third-party needs IO channel.
FSL-direction writ – device/FSL/report pending, trial or lien stuck
FSL pendency blocks charge/return of device/money.
What it involvesTime-bound examination/report/return prayer without dictating opinion.
Relevant lawBNSS 106 (seizure report), 193 (police report on completion); Art 226.
ForumHigh Court of Kerala (after Magistrate representation).
Procedure & stageIO/FSL representations → Magistrate note → writ with paper-book.
RemedyDirection to examine/report/consider release – not a finding on merits.
High Court connectionCore HC-primary forensic writ.
Documents normally requiredSeizure memo, FSL forwarding, reminders, Magistrate application.
LimitationNo fixed statutory period – writ after Magistrate representation; move promptly as trial/lien stalls.
Related: De-freeze; revision.
HC orders FSL result?
Direction to act time-bound, not dictated opinion.
Platform grievance → GAC → court escalation bundle (Rule 3 / 3A)
Counterfeit/abuse complaint closed with template reply.
What it involvesThree-rung record – officer → appellate → court.
Relevant lawIT Rules Rule 3(2) + Rule 3A GAC (30-day appeal, 30-day disposal) + Rule 4(8) where SSMI own-accord. IT Rules clocks (as amended by G.S.R. 120(E) dated 10.02.2026, w.e.f. 20.02.2026): ack 24 hrs; disposal 7 days (r.3(2)(a)(i)); 36-hr removal (proviso r.3(2)(a)(i)); 3-hr removal on court/government order (r.3(1)(d)); 2-hr intimate-image/impersonation (r.3(2)(b)); 72-hr assistance on written order (r.3(1)(j)).
ForumGrievance Officer → GAC → civil/criminal court/HC.
Procedure & stageURL-wise tickets → reasoned appeal → court with both orders.
RemedyRemoval/restoration direction + prosecution/injunction per track.
High Court connectionExhaustion record decides writ maintainability.
Documents normally requiredTickets, officer order, GAC appeal/order, URL bundle.
LimitationGAC appeal 30 days; GAC disposal endeavour 30 days.
Related: Injunction; 69A.
Skip GAC to court?
Courts ask why statutory appeal was bypassed.
Intermediary safe-harbour note – IT 79 due-diligence relevance
Platform says "we are only intermediary".
What it involvesProtection depends on due-diligence + expeditious action on actual knowledge/court/government notice.
Relevant lawIT 79 (safe harbour only with due diligence and expeditious removal on actual knowledge/government notification – s.79(2)(c), 79(3)(b)); Rules 3–4 due diligence.
ForumIO/court appreciation; HC in takedown/writ.
Procedure & stageServe court/government-grade notice + Rule 3(2) ticket; preserve non-action.
RemedyLoss of safe-harbour argument; direction to act.
High Court connectionHC tests 79 in blocking/takedown writs.
Documents normally requiredNotices, tickets, non-action log, harm note.
LimitationNo fixed statutory period – notice + Rule 3(2) ticket before/at filing; preserve non-action log.
Related: 69A; injunction.
Notice in comments enough?
No – grievance-page + written notice with URLs.
Search of office/home in cyber case – BNSS 185 + 105 compliance checklist
Search without witnesses/video; staff phones imaged.
What it involvesAuthority + witness + AV + memo + hash + copy.
Relevant lawBNSS 185 (search by police), BNSS 105 (AV), BNSS 106 (seizure report).
ForumIO → Magistrate; challenge via Magistrate/revision/HC.
Procedure & stageNote authority, witnesses, video ref, memo, hash, copy request – contemporaneously.
RemedyCompliance direction; evidentiary weight at trial.
High Court connectionHC on illegal-search plea after Magistrate record.
Documents normally requiredSearch note, memo copy, hash, representation.
LimitationNo fixed statutory period – note compliance contemporaneously; challenge after Magistrate record.
Related: Seizure-memo; Art 20(3).
Stop search?
Do not obstruct – record objections in writing.
CDR / IPDR / TSP disclosure request – who can ask, how long retained
Victim asks TSP directly; refused for "privacy".
What it involvesIO/court channel for call/data records; retention limits.
Relevant lawBNSS 94 production/185 search; BSA 63 for proof.
ForumIO → TSP; Magistrate/court direction.
Procedure & stageFIR → IO requisition with numbers/period → TSP disclosure → BSA 63 certificate.
RemedyAttribution (SIM-swap, vishing, mule linkage).
High Court connectionHC direction where TSP awaits format/order and trail ages.
Documents normally requiredNumbers, period note, FIR, IO requisition, disclosure + BSA 63.
LimitationNo fixed statutory period – IO requisition promptly while records are available.
Related: SIM-swap; preservation.
Victim gets CDR?
Own billing details yes; others' records via IO/court.
Bank-statement / UPI-switch proof – BSA 63 pair for money trail
Trail printouts doubted as unsigned/unproved.
What it involvesStatement + switch-log + dual certificates.
Relevant lawBSA 63; BNSS 106 report linkage.
ForumIO → trial court; de-freeze Magistrate.
Procedure & stageCertified statement + UTR-switch extract + custodian + system certs + hop-table.
RemedyProved trail; faster lien/release decisions.
High Court connectionHC reads this bundle first in freeze writs.
Documents normally requiredStatements, switch extracts, BSA 63 pair, hop-table.
LimitationBSA 63 pair at filing; certified statements promptly.
Related: Lien; CIBIL-next.
Passbook copy enough?
Certified + BSA 63 is stronger.
App-permission / APK forensics – smishing-APK examination questions
APK deleted after reset; lender link gone.
What it involvesSender-link, permission-abuse and exfiltration-opinion questions.
Relevant lawIT 66, 43; BSA 39 expert opinion + BSA 63.
ForumIO → FSL.
Procedure & stagePreserve link/sender/APK file; question list – permissions, SMS-forward, C2, data-exfil.
RemedyAttribution + compensation support.
High Court connectionForensic-direction writ where device sits idle.
Documents normally requiredLink, APK, permission screens, device, question list.
LimitationNo fixed statutory period – preserve link/APK at once; FSL question list with forwarding.
Related: Smishing; ransomware.
Reset phone?
Only after IO imaging.
Voice / call-recording proof – vishing audio + transcript + BSA 63
Recording labelled edited; transcript doubted.
What it involvesOriginal + transcript + voice-comparison where needed.
Relevant lawBSA 63 (recording) + BSA 39 expert voice opinion; BNSS 105 where IO-recorded.
ForumIO → trial court.
Procedure & stageOriginal file + hash + transcript + custodian cert; FSL voice where disputed.
RemedyAdmissible inducement proof (OTP/vishing).
High Court connectionHC bail/quash courts test inducement prima facie on this.
Documents normally requiredOriginal audio, transcript, BSA 63, FSL request where needed.
LimitationBSA 63 + transcript with the recording at filing; no fixed statutory period.
Related: OTP; vishing.
Recorded without telling – admissible?
Legality vs admissibility is court-tested – preserve original either way.
Hash / chain-of-custody note – one-page format for every device
Devices change hands without paper; hash mismatch alleged.
What it involvesSingle custody sheet – seizure → seal → hash → movement → FSL → return.
Relevant lawBNSS 105/106; BSA 63 chain.
ForumIO file → court.
Procedure & stageFill at each handoff; photograph seal; re-hash on open.
RemedyWithstands tampering allegation.
High Court connectionHC evidentiary challenge turns on this sheet.
Documents normally requiredCustody sheet, hash logs, seal photos.
LimitationFill the custody sheet at each handoff; re-hash on open; no fixed statutory period.
Related: Seizure; FSL.
Hash needed for phone?
Yes – re-opening without re-hash invites dispute.
Cross-border fraud – server/admin outside India, victim in Kerala
Admin IDs foreign; platform slow; police cite limits.
What it involvesIT 75 + preservation + platform LE + MLAT sequencing.
Relevant lawIT 75 (extra-territorial); BNSS/MLAT procedure; IT 69A where blocking needed.
ForumKerala IO → nodal → MHA/MLAT; platform LE channel parallel.
Procedure & stagePreserve → domestic freeze/lock → platform disclosure → MLAT for compulsion.
RemedyPartial (domestic freeze/takedown) + long-track MLAT.
High Court connectionHC direction for preservation + status where domestic leg stalls.
Documents normally requiredIDs/URLs/TX list, preservation tickets, MLAT ref.
LimitationPreserve domestically at once (MLAT is slow); no fixed statutory period.
Related: Cloud; PMLA note.
MLAT timeline?
Long – domestic preservation must not wait.
Emergency disclosure – imminent-harm request (threat / NCII spread)
Threat to kill/publish tonight; routine ticket too slow.
What it involvesEmergency LE + platform-escalation + protection simultaneously.
Relevant lawBNS 351/308/78/79 per threat; IT Rules grievance + platform emergency channel; BNSS 173.
Forum112/1930/SHO + platform emergency + NCRP.
Procedure & stageCall + written emergency note with URLs/numbers + protection request.
RemedyExpedited preservation/action + protection.
High Court connectionHC protection direction where threat persists after complaints.
Documents normally requiredThreat URLs/numbers, emergency tickets, FIR/NCRP.
LimitationImmediate – emergency channel + 112/1930 now; no fixed statutory period.
Related: Sextortion; stalking.
Wait for FIR copy?
No – emergency request and FIR run together.
Gag / media-restraint prayer where investigation or victim-privacy at stake
Parallel media posts prejudice probe or expose victim.
What it involvesNarrow restraint + platform-takedown, not blanket press ban.
Relevant lawContempt + BNS/IT privacy heads; CPC injunction where civil; Press norms.
ForumTrial/civil court; HC on appeal/writ.
Procedure & stageExact posts + prejudice/privacy affidavit; time-bound narrow prayer.
RemedyTargeted restraint/removal.
High Court connectionHC balances free speech vs fair-trial/privacy – specificity decides.
Documents normally requiredPost URLs, prejudice note, FIR/case number.
LimitationNo fixed statutory period – move promptly with exact URLs and prejudice/privacy affidavit.
Related: Defamation; injunction.
Ban all reporting?
Courts prefer narrow URL-specific orders.
Costs / compensation for illegal search or data loss by custodian
Device/data damaged in custody; business loss.
What it involvesCustody-complaint + compensation track per forum.
Relevant lawBNSS 106 custody bond, 497/503 custody/disposal orders; IT 43A only against a negligent body corporate; civil damages.
ForumMagistrate (custody complaint) → civil/consumer for loss.
Procedure & stageCondition-noted seizure memo + damage report + loss ledger.
RemedyReturn/repair/compensation per proof.
High Court connectionHC writ/revision on custody illegality after Magistrate record.
Documents normally requiredPre-seizure condition note, custody receipts, loss bills.
LimitationNo fixed statutory period – custody complaint promptly; civil compensation for an act done under an enactment – 1 year from the act (Limitation Act, Art 72); residuary 3 years (Art 113).
Related: Seizure; FSL.
Prove condition?
Photograph + hash + memo at seizure.
Record-retention for cyber file – what to keep for 6 years
Papers scattered across phone, bank, police.
What it involvesSingle indexed file – complaints, acks, statements, BSA 63, orders, deposit receipts.
Relevant lawLimitation Act, 1963 (civil suits/appeals); BNSS 514 (bar to cognizance) – periods differ by track.
ForumAll – file supports every forum.
Procedure & stageMaster index + chronological PDFs + certified orders.
RemedyFaster bail/de-freeze/appeal/writ drafting.
High Court connectionIndexed paper-book is what HC reads.
Documents normally requiredIndex template + master PDF.
LimitationNo single statutory retention period – keep the file until every limitation/appeal period in your tracks has run.
Related: Drafting; CIBIL-next.
Keep originals?
Yes – originals + certified + hash-noted copies.
When to brief High Court counsel – cyber-matter triage (High Court-primary)
Unsure whether Magistrate, Sessions, or HC is next.
What it involvesTriage – de-freeze→Magistrate; bail→Sessions then HC; quash/inaction/blocking→HC.
Relevant lawBNSS 106/175(3)/438 r/w 442 (revision)/482-483/528; Art 226/227; IT 62/69A.
ForumMap before filing.
Procedure & stageOne-page triage note + paper-book check before HC filing.
RemedyCorrect forum first time; costs/time saved.
High Court connectionThis note exists to keep HC filings precise and review-ready.
Documents normally requiredTriage checklist + paper-book index.
LimitationNo fixed statutory period – forum-dependent; act per custody/charge/trial stage.
Related: All above.
Direct HC for refund?
HC generally directs decision per law – build Magistrate/bank record first.
