Cybercrime Investigation in India after the 2023 Criminal-Law Reforms: Integrating Criminal Liability, Digital Evidence, Forensics and Institutional Enforcement

Abstract

Cybercrime investigation in India has entered a new legal phase following the commencement of the Bharatiya Nyaya Sanhita, 2023 (BNS), the Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS), and the Bharatiya Sakshya Adhiniyam, 2023 (BSA). These enactments operate alongside the Information Technology Act 2000, the Digital Personal Data Protection Act 2023 (DPDP Act), sectoral regulation and specialised cybercrime institutions. This article argues that the principal weakness of the present framework is not a lack of offences, but fragmentation across legal classification, investigative procedure, digital-evidence rules, forensic practice, privacy governance and institutional coordination. Using doctrinal legal research supplemented by official policy and institutional material, the article develops an investigation-chain framework linking complaint triage, offence classification, preservation, lawful acquisition, forensic examination, attribution, financial tracing, cross-border evidence, prosecution and adjudication. It evaluates the continuing interaction between general criminal liability under the BNS and technology-specific provisions of the Information Technology Act, while examining the evidentiary significance of electronic records under the BSA. Particular attention is given to cloud evidence, cryptocurrency, ransomware, artificial intelligence and deepfakes. The article contends that technological traceability must not be equated with human attribution and that evidentiary reliability depends on the entire acquisition-to-trial chain. It proposes harmonised investigative protocols, accredited forensic capacity, specialist prosecution and judicial training, auditable access to personal data, improved cross-border preservation mechanisms, and a human-verification requirement for significant AI-assisted investigative outputs. The analysis contributes an India-specific but internationally relevant model for assessing whether contemporary cybercrime law can produce reliable, rights-compliant and trial-ready investigations.