In a world fast migrating from real space to cyberspace and now the metaverse, crime has morphed dramatically—but our legal systems remain stubbornly terrestrial. At a recent talk with the CBI investigators, Bharat explored the challenges of investigating and proving what we call “new-age crimes”: offences involving AI-generated deepfakes, crypto frauds, metaverse-based offences, and other virtual aberrations of human intent.

We live in an era where a deepfake can destroy reputations before truth gets a hearing. Where money, once lost in a wallet, isn’t leather-bound but blockchain-bound—scattered across jurisdictions and server farms. Where the assault may not touch the body but shatter the mind.

Old Courts, New Crimes

The law has traditionally relied on physicality—eyewitnesses, tangible evidence, direct causation. Today’s cybercrimes flip this on its head: decentralised, anonymous, encrypted. Think deepfake extortion, cryptocurrency theft, virtual sexual assault in the metaverse—none of which leave fingerprints, but all of which leave victims.

In India, we see deepfake-related frauds projected to cause ₹70,000 crore in losses by 2024. Investigating agencies must now contend not only with the criminal, but with the medium that hides them.

The Evidentiary Challenge

Digital evidence is volatile—susceptible to deletion, alteration, or outright spoofing. The UNODC lays down four pillars: Identification, Collection, Acquisition, and Preservation. But the road from seizure to conviction is fraught with potholes.

India’s legal framework—anchored by Section 65B of the Indian Evidence Act and its BNS-era counterpart, Section 63 of the Bharatiya Sakshya Adhiniyam—requires certificates to prove digital records. The 65B certificate acts as the passport of electronic evidence; without it, most courts won’t even entertain a digital exhibit. And yet, many prosecutions fail simply because this paperwork is botched or missing. As per the new amendment, the 65B Certificate is to be issued by the person incharge of the device and an expert. Also, the certificate is to contain crucial details regarding meta data and chain of custody. (Meta data is the new blood-stain, fingerprint, that a crime leaves)

Deepfakes and the Proof Paradox

We’re entering a time when the question is no longer “Did it happen?” but “Did it happen, or was it generated?” In one real-life example, a company lost $25 million because a deepfake of the CFO ordered a wire transfer. Detecting such fakery is a game of fine margins—analysing metadata, file naming, lip-sync discrepancies, or inconsistencies in reflections.

But let’s be honest: even forensic experts struggle. Courts are even more cautious. In perhaps one of the only cases on the subject yet – in State of Washington v. Puloka(2024), an AI-enhanced video offered by the defence was rejected by the court for lacking peer review and explainability.

Seeing is no longer believing. Authenticity is the new battlefield.

Case in Point: The Metaverse Assault

Take the 2024 Nina Jane Patel case: a woman was “virtually assaulted” within seconds of logging into a metaverse platform. No physical contact occurred, but the trauma was real. Yet the law (in UK) predicates “assault” on physical touch.

This is the gap we must bridge. Can “haptic” non-consensual touch be prosecuted under existing IPC/BNS provisions on sexual harassment, outraging the modesty of a woman, stalking, or wrongful confinement? Perhaps yes. But proving such offences requires creative use of server logs, avatar metadata, and VR headset seizure—none of which is part of standard police SOPs as they stand now.

Chain of Custody in a Borderless World

Evidence often resides in private servers, governed by foreign law. Mutual Legal Assistance Treaties (MLATs) are cumbersome. The EU now leapfrogs this through European Production Orders—forcing service providers across borders to hand over data swiftly. Also instructive in this regard is the EU’s E-evidence regulations which provide for cross-border access to electronic evidence. In this regard, Budapest Convention of 2001 on Cyber Crime is also instructive and India’s position to the same needs to be informed and nuanced.

India’s Digital India Act (DIA), in the works, aspires to do the same—streamlining requests and preserving data before it vanishes into the ether.

Crypto, Chain Analysis, and the D’Aloia Debacle

In D’Aloia v Persons Unknown (UK), crypto worth thousands was allegedly stolen. The victim served court notices via NFTs—a legal first. Yet the case failed because expert testimony didn’t convincingly trace the crypto trail. The lesson? Crypto crimes demand not just blockchain evidence, but coherent, defensible tracing methodologies.

AI: Ally or Adversary?

AI can also assist prosecution—enhancing videos, tracing patterns, or automating review. But transparency is key. The Frye standard (and India’s cautious judiciary) demands explainability. Any AI-based tool used in court must be peer-reviewed, documented, and understandable. If not, it risks exclusion.

Where Do We Go From Here?

1. Build Capacity: Train police, prosecutors, and judges in handling and appreciating digital evidence.
2. Reform Procedure: Simplify 65B/63 BSA certification. Explore presumptions. The certificate shouldn’t be fetishised and, in appropriate cases, other ways of proving electronic evidence should be explored. For instance, as in Singapore which takes a much more nuanced take on electronic evidence and it’s proof.
3. Rely on Experts, not Assumptions: Define who qualifies as an “expert” in digital forensics/electronic evidence as per S.63 BSA.
4. Use Technology Wisely: Embrace AI, but demand transparency.
5. Victim-Centric Frameworks: Recognise the mental and emotional toll of virtual offences. Update substantive law accordingly.

The courtroom of tomorrow will no longer be about “the knife that killed” but about “the keystroke that hacked,” or “the algorithm that deceived.”

We must adapt, lest justice becomes the next casualty of technology.

Put together by Team Bharat taking insights from Mr. Chugh’s presentation/lecture on this issue to a batch of CBI Investigators delivered at the CBI Academy at Ghaziabad, India.