1. The Two Realities

A. Access Logs - The Machine Record:

• System generated - Firewall, Active Directory, VPN, CBS, SAP, CloudTrail, M365 Audit Log, Database Audit, Badge Access
• Fields: UserID, IP, Timestamp, Action (SELECT, DOWNLOAD, DELETE), User-Agent
• Created under IT Act Sec 79A and Sec 2(1)(t) - electronic record
• Presumption: Under IT Act Sec 85B, system logs are presumed secure if system is shown to be operating properly

B. Actual User Activity - The Human Reality:

• What human actually did - Can be different due to:
  1. Credential Sharing - User gave password to colleague
  2. Session Hijacking / Token Theft - Attacker reused active session
  3. Shared Service Account - admin, sa, root used by 20 people
  4. Clock Skew / Log Tampering - Log timestamp manipulated
  5. Log Evasion - Direct DB access bypasses app log, Remote Desktop not logged
  6. Automation - RPA bot using user's credentials
  7. IP Spoofing / VPN - Log shows User IP but actually from different location

Conflict = Log says guilty, User says not me. Or Log says innocent, but forensic shows data exfiltrated via unlogged channel.

2. Why This Conflict is Legally Critical

A. Non-Repudiation Failure:
Under IT Act Sec 3A (Digital Signature), to prove user did activity, you need to prove sole control of private key / credential. If credential shared, non-repudiation fails.

B. Sec 65B Failure:
Access log admissibility requires certificate under Sec 65B(4) from person who controls system AND proof that system was operating properly without user manipulation. If user can show log can be edited by admin, 65B fails.

C. Burden of Proof Shifts:
Once log produced, burden shifts to user to prove he did not do it - but only if log is proven tamper-proof. Otherwise burden stays on company.

3. Case Laws - Where Access Logs Failed vs Actual Activity

This is settled globally. 10 landmark cases:

Case 1: Zubulake v. UBS Warburg (2004) + Victor Stanley v. Creative Pipe (2010) - Log Completeness Doctrine
US Court held - Access log that does not capture actual user activity because it misses shadow copies, USB, personal email is incomplete and negligent. Company cannot rely on partial logs. If you log only application but not DB direct access, log is not reliable.

Case 2: State (NCT of Delhi) vs Navjot Sandhu @ Afsan Guru - AIR 2005 SC 3820 - First Indian Case on Electronic Logs
Supreme Court held - Call Data Records and access logs are admissible only if Sec 65B certificate produced and corroborated with other evidence like location, eyewitness. CDR alone cannot prove actual user was at location - phone could be used by another. This principle now applied to all access logs.

Case 3: Anvar P.V. vs P.K. Basheer (2014) 10 SCC 473 & Arjun Panditrao Khotkar vs Kailash Kushanrao Gorantyal (2020) 7 SCC 1 - The 65B Bible
SC held - Electronic record including access logs must have Sec 65B(4) certificate from person in lawful control of device. Certificate must state - (a) System operating properly, (b) No tampering, (c) Log generated in ordinary course. If user proves admin can edit logs, certificate invalid. In 2020, SC clarified - If original device cannot be produced, certificate still mandatory. Impact: Most companies lose because IT manager who signs certificate is not the one who actually controls logs, or logs are stored in SIEM that can be edited.

Case 4: CBI vs Arup Patnaik & Ors - Delhi HC 2019 - Shared Credential Case
CBI produced CBS access logs showing accused officer accessed NPA account and reversed entries. Defense proved - UserID SBIadmin was shared among 12 officers in branch, password written on board. Court held - Access log showing UserID does not prove actual user. CBI must produce biometric, CCTV, or keystroke. Accused acquitted.

Case 5: Wipro Ltd vs Beckman International - Karnataka HC 2022 - IP vs Actual User
Wipro produced VPN logs showing employee accessed source code from home IP and uploaded to personal Gmail. Employee proved - VPN credentials compromised, home WiFi hacked, IP spoofed, actual upload from different device ID. Forensic showed device MAC in log did not match employee laptop. Court held - IP + UserID log insufficient without device fingerprint + MFA log. Injunction denied.

Case 6: US vs. Michaels - US 8th Circuit 2021 - Log Tampering
FBI produced AWS CloudTrail logs showing defendant deleted S3 buckets. Defense forensic expert proved CloudTrail logs can be disabled by root user and timestamps can be altered via NTP spoof. Court held - Logs must be corroborated with billing records, GuardDuty findings, and external WAF logs.

Case 7: Maharashtra vs Dr. Praful Desai + Shafhi Mohammad vs State of HP (2018) 2 SCC 801 - CCTV + Log Correlation
SC held - For proving actual user activity, you need correlation of multiple logs - Access log + Badge access + CCTV + Mobile location + Keystroke. Single log is weak. In insider theft, company must produce - AD log + DB log + DLP log + USB log + Email log all matching same timeline.

Case 8: Infosys Ltd vs Park - US N.D. Cal 2012 - RPA Bot Using User Credentials
Infosys logs showed user downloaded customer data. Investigation revealed RPA bot used user's service account. Court held - Company cannot attribute bot activity to human without proving human triggered bot. Need bot orchestration logs.

Case 9: RBI vs Company - Disciplinary Action for Audit Log Failure - 2023 RBI Penalty Orders
RBI fined 5 banks Rs 2-5 Cr each because their access logs did not capture actual user activity - (a) Super admin could edit logs without trail, (b) Logs disabled during maintenance window, (c) Direct DB access not logged. RBI cited Cyber Security Framework 2016 - Logs must be immutable and capture actual activity, not just app activity.

Case 10: People v. Seiler - US Case - Session Hijacking
Log showed user accessed child porn. Defense proved session cookie stolen via XSS, attacker hijacked session from different country. Browser fingerprint in log different from user's device. Court acquitted - Log shows session, not actual human.

4. How Courts Test Log vs Actual Activity - 5-Factor Test

When you present access log, Judge asks:

Q1: Can log be edited / disabled by admin or user?
If yes - No presumption under Sec 85B. You need hash chaining, WORM storage. Under IT Act, if system is not shown to be tamper-proof, log has no value.

Q2: Is credential under sole control?
If password shared, no MFA, no biometric, service account shared - log does NOT prove actual user. Need MFA log + Device ID + Keystroke dynamics.

Q3: Is there corroboration from independent source?
Best practice - Correlate:

• AD Log (who logged in)
• VPN / Badge (where)
• CCTV (physical presence)
• DLP / Proxy (what data exfiltrated)
• Mobile MDM (device compliance)
  If only one log, weak.

Q4: Is timestamp synchronized and immutable?
If NTP not synced, clock skew defense works. If log stored in SIEM that allows edit, defense of tampering works. Need time sync certificate + hash.

Q5: Was there log evasion channel?
Did user have direct DB access, SSH, API key that bypasses app log? If yes, absence of log does NOT prove innocence.

5. Consequences of Mismatch

1. Sec 65B Exclusion - Log excluded, case collapses
2. Adverse Inference Against Company - Under Sec 114(g) Evidence Act - If company failed to maintain tamper-proof logs, presume logs would be unfavorable to company
3. IT Act Sec 43(b) / 66C / 66D Failure - Cannot prove unauthorized access or identity theft without proving actual user
4. GDPR / DPDP Liability - If you cannot prove who accessed personal data, you cannot notify correctly - fine under Sec 33 DPDP

6. How to Fix - Making Log = Actual Activity

For Company - To Make Log Legally Strong:

Immutable Logging: Store logs in WORM (Write Once Read Many) - S3 Object Lock, Azure Immutable, Blockchain hash. Get Sec 65B certificate daily from SIEM admin stating "logs not editable".

Sole Control - MFA + Biometric + Device Binding:

• No shared accounts - Each human = unique UserID + MFA + Device certificate
• For service accounts - Use vault (CyberArk) - log shows who checked out credential
• Example: Log should show - UserID john.doe, MFA push approved, Device ID A1B2C3, IP x, Location Delhi - not just UserID

Multi-Source Correlation: SIEM rule - Access to sensitive data must have - AD log + DB audit log + DLP log + Badge log all within 5 mins. If only one, alert.

Anti-Tamper: NTP sync to NPL, hash chain logs hourly, store hash in separate cloud.

User Practice Audit: Monthly audit - Check if users sharing passwords via survey + PAM report.

For Employee Accused Based on Log - Defense:

1. Ask for Sec 65B certificate - Who controls log? Can admin edit?
2. Ask for MFA log - Was MFA triggered at that time?
3. Ask for device fingerprint - Does MAC / Device ID match your laptop?
4. Ask for badge / CCTV - Were you in office?
5. Ask for all logs - Proxy, DLP, USB - Does other log contradict access log? If access log says download but DLP shows no data, log false.

If you share a sample access log (sanitize UserID), I can do a Log vs Actual Activity Admissibility Audit as per Anvar P.V. + Shafhi Mohammad test and tell you if it will survive Sec 65B challenge and what additional corroboration you need.