Can any state institution force you to unlock and search your digital device?
[Warning: Not a lawyer, just interested in this stuff, so this may be wrong. Don’t use the information provided here to do stupid stuff.]
I was going through The Electronic Transactions Act, 2063 (2008), and Section 28 made me wonder:
>28. The Controller to have the Access to Computers and data: (1) The Controller shall, if there is a reasonable ground to suspect that provision of this Act and Rules framed hereunder has been violated, have the power to have the access to any computer system, apparatus, devices, data, information system or any other materials connected with such system.
(2) The Controller may, for the purpose of Sub-section (1), issue necessary directives to the owner of any computer system, apparatus, device, data, information system or any material connected with such system or to any other responsible person to provide technical or other cooperation as he/she deems necessary.
(3) It shall be the duty of the concerned person to comply with such directive issued under Sub-section (2)
This immediately made me wonder: What actually constitutes "reasonable ground" under Sub-section (1)? What does it truly mean to "issue necessary directives... to provide technical or other cooperation"? And when Sub-section (3) states that "it shall be the duty of the concerned person to comply" does that mean you can be legally compelled to hand over your password or forced into a biometric unlock if the Controller deems it "necessary"? This felt like way too much unchecked power for the Controller, so I went digging.
Since I am not a lawyer and don’t have time to go through legal mumbo-jumbo, I gathered some sources [Warning: AI Generated]:
>1. Passwords and the Right Against Self-Incrimination
Under Article 20(7) of the Constitution of Nepal, any person accused of an offense has a fundamental right against self-incrimination, meaning they cannot be compelled to testify against themselves.
The Communication of a Fact: The Supreme Court of Nepal has held that the constitutional boundary of self-incrimination turns on whether a police action compels the accused to communicate a fact (which is testimonial and strictly protected) or merely provide a physical sample (which is non-testimonial and not protected).
No Forced Passcodes: Because a phone password or passcode resides in your mind and memory, forcing you to reveal it is considered compelling testimonial communication. Therefore, the government cannot legally force you to disclose your passcode, and you are within your constitutional rights to refuse.
2. Biometrics as Physical Evidence
In contrast, Nepalese law treats biometric unlocking (such as fingerprints or facial scans) differently:
Physical Traces Are Not Protected: The right against self-incrimination does not extend to physical evidence.
Compelled Biometrics: An accused person can be legally required to provide physical and biological samples—such as fingerprints, handwriting specimens, or blood samples—because these are classified as physical traces rather than forced testimonies. Because biometrics are classified as physical identifiers rather than mental knowledge, authorities can, in limited circumstances, legally compel you to provide your fingerprint or face to unlock a device.
3. Judicial Warrant Requirements to Search a Phone
Even if the police successfully unlock your phone (whether through biometrics or voluntary consent), they cannot conduct a search of its contents without a judicial warrant.
Supreme Court Precedent: In the landmark case Advocate Baburam Aryal v. Government of Nepal, the Supreme Court of Nepal established that digital devices—including cell phones, computers, and digital accounts—strictly require search warrants or prior judicial authorization for data extraction.
Privacy Violations: Accessing Call Detail Records (CDRs) or searching a device’s internal data without a court-issued warrant violates privacy protections under Section 297 of the National Criminal Code, 2074 and the constitutional Right to Privacy under Article 28.
What I got from this is that the Controller's (or any state institution's) power has been restricted by Supreme Court precedent and they can't go around digging without warrants. Things that reside in your mind are protected by Article 20(7) (Right Against Self-Incrimination) of the Constitution of Nepal. However, since biometrics are classified as physical identifiers, authorities can force you to provide a biometric scan to unlock a device. Even then, they cannot go around digging through the contents before obtaining a judicial warrant (similar to legal stuff in many other countries).
TLDR: The Mamas probably will ignore the search warrant stuff, but legally speaking, if you want to be sure they don't dig through your device without a warrant, use a password instead of biometrics. Authorities are allowed to compel biometric unlocks, but searching the unlocked device still legally requires a search warrant. If you use a password or "things that reside in the mind," no one can legally force you to reveal it but they can get a warrant to conduct digital forensics on the device and attempt to crack it (similar to legal stuff in many other countries).
Don't use this information to do stupid stuff. I have seen people taking pictures near army bases or sensitive security sites, where the officer on duty asks to go through their phone. In those circumstances, they have reasonable suspicion. If you start yapping about 'your rights' or some shit, they could probably legally detain you and obtain a court warrant. They aren't interested in digging through your personal life, they just want to verify if you took photos of a sensitive facility. Don't play stupid games.