Beyond Content Matching: The Provenance Gap Between Platform Detection and Criminal Attribution in India's NCII Regime
Qinlei WangOct 21, 202610.5281/zenodo.23536878pp. 684–70219 pages
India's 2025 Standard Operating Procedure for non-consensual intimate imagery directs significant social media intermediaries to detect recurring content through hashes and, where onboarded, to communicate collated hashes to the Indian Cyber Crime Coordination Centre. The February 2026 amendment reduces the complaint-based removal period to two hours, while Rule 3(1)(g) separately requires preservation of removed information and associated records for 180 days. These measures create a discrete evidentiary problem. A content match may justify renewed removal yet provides no standalone account of the particular upload, the responsible account or the system that produced an evidentiary output. Through doctrinal analysis of the IT Rules, the 2025 NCII SOP, the Bharatiya Sakshya Adhiniyam and the decisions in X v Union of India and Arjun Panditrao Khotkar, this article identifies a provenance gap between the reusable detection fingerprint and the individual dissemination incident. It proposes a two-record protocol linking a restricted prevention identifier to a separately preserved, event-specific record of each removal, with source-system information, integrity data and a lawful export pathway supporting Section 63 certification. The analysis distinguishes existing duties from proposed implementation specifications and confines its claims to what public legal materials establish. The resulting approach maintains rapid protection while preventing evidence of similarity from being mistaken for proof of personal attribution.
