Snoop on chatter & dark web, be mindful of privacy: IT dept tells its sleuths, revises search manual after 17 years

Shoot ‘ look out circular’ (LOC) to stop someone from fleeing, dip into the dark web, fish for crypto wallets, check taxpayers’ credit scores, but don’t trample on data privacy rules. There’s a slew of directions from the government to Income tax (I-T) officers in a new ‘search and seizure manual’, an internal handbook that has been revised after 17 years -- a period that has seen the passage of harsh laws, changes in technology, and an explosion of social media.

Tax investigators have been encouraged to go beyond the conventional information sources --- use data access tools from the Centre for Development of Advanced Computing (CDAC) to enter the dark web where tax dodgers often trade and chat. User credentials have been created for I-T officials to peep into this murky edge of the web not indexed by search engines and accessed through special software. But they must be careful not to give away their identities while tapping common databases like LinkedIn or Truecaller, says the manual.

Taxmen today deal with an array of digital evidence. “The manual comes at a time when the Supreme Court is deliberating on the need for standard rules governing search and seizure of digital devices. Also, the Madras High Court recently ruled that tax authorities must strictly comply with the procedures set out in their manuals during search and seizure,” said Ashish Karundia, founder of the CA firm Ashish Karundia & Co.

NEW LAWS & CHALLENGES
Bitcoin, Ethereum and other cryptocurrencies pose a unique challenge as it’s tough to spot, value and tax virtual digital assets (VDAs), admits the manual. “So, it outlines steps for identification and seizure of hardware and paper wallets, locating recovery phrases and QR codes to access private keys, checking for involvement in NFTs (non-fungible tokens) and identifying mining rigs and GPUs (graphics processing units) used by crypto miners,” said Harshal Bhuta, partner at P. R. Bhuta & Co, another CA firm.

“While determining the ownership and location of unaccounted VDAs, if violations of other laws (on black money, forex, or money laundering) are detected, it may trigger investigations under those laws as well,” said Bhuta.

Since 2007, when the manual was last revised, laws to curb black money (focussing on secret Swiss bank accounts and other unreported offshore assets) and benami arrangements to control assets through fronts have been enacted.

While asking officers -- who are often vilified for their high-pitched demands and intimidating ways -- to avoid a search if there's a wedding or death at the suspect’s home, the manual says, “wherever considered appropriate, Tax Clearance Certificate (TCC) under the I-T Act, 1961 or Look Out Circular (LOC) for preventing an individual from leaving the country should be explored, if the person(s) concerned has/ have prima-facie committed a cognisable offence under the Black Money Act, 2015. (BMA)” Many BMA cases are built on information shared by other countries.

“Tax officers have been reminded that information received through international tax treaties must remain confidential and used solely for tax-related matters unless express permission is granted by the concerned foreign authority to share it with other law enforcement bodies. Also, TCC or LOC should be issued with caution and only when there is clear initial evidence of offence under the BMA,” said Karundia.

DATA PRIVACY
Section 132 of the I-T Act empowers the department to carry out search and seizure actions to collect evidence which increasingly include mobile phones, ipads, and laptops that may hold encrypted data and tax concealment proof. “Due attention needs to be given to data security and privacy. The officers are advised to follow the procedures and directions contained in the ‘Digital Evidence Investigation Manual 2014’,” says the manual.

Says Supratim Chakraborty, partner at the law firm Khaitan & Co, “It’s good to see that the Digital Personal Data Protection Act 2023 (Act) has started finding mention in documents such as these -- though the Act is yet to be brought into force. Although the Act provides certain exemptions for processing of personal data ‘in the interest of prevention, detection, investigation or prosecution of any offence or contravention of any law’, such exemption is not a complete exemption from the applicability of the Act altogether. For example, the I-T Department in its capacity as a data fiduciary (i.e. one who determines the purpose and means of processing of personal data) is required to protect personal data in its possession or under its control by taking reasonable security safeguards to prevent its breach.”

The draft Digital Personal Data Protection Rules issued in early January 2025 had detailed out certain minimum requirements that should be adhered to for maintaining ‘reasonable security safeguards. “It would be interesting to see how such measures are brought into practice by the I-T Department,” said Chakraborty.