One of my clients recently had a case which I am explaining below and if you are stuck in such similar situation, here is what to do.
Note: Due to attorney-client privilege, I cannot disclose complete case details or identify the actual parties involved. However, I am sharing the essential facts and legal approach so that if you find yourself in a similar situation, you can understand the available solutions and legal remedies.
TL;DR: Threatening to circulate a leaked private chat is a criminal offence in India, not a college disciplinary matter. Depending on what was said and whether the chats were real, you are looking at criminal intimidation, defamation, forgery and IT Act provisions. Preserve everything, do not delete anything, and get a written complaint filed quickly.
Late on a February evening in 2025, Karan Bhatt's phone would not stop buzzing. He was in his third year at a private engineering college in Pune, and a conversation he had had months earlier with a classmate was now doing the rounds in a WhatsApp group he wasn't part of. Someone had taken screenshots. Someone else had forwarded them.
Then the messages turned. Two classmates, Nikhil Sharma and Aryan Deshpande, began writing to Karan directly: stay quiet about an unrelated hostel dispute, or the screenshots would travel further. One of them said the text could be edited to look worse than it was. Karan replied that he would complain to the college. The answer, sent around mid-March 2025, was that if he did, they would produce chats he had never written and send them to the principal, to his parents, and to a group of seniors.
That was the part that frightened him. Not the original leak. The manufactured one.
Karan first went to a local lawyer, who told him to sort it out with the college authorities. It went nowhere. He then approached the Chamber of Advocate Sudhir Rao. Advocate Sudhir Rao's office preserved the messages along with their metadata and built the complaint around the fabricated chats rather than the leaked conversation. Advocate Sudhir Rao's experience in cyber crime and criminal intimidation shaped the application, and the protection sought against further circulation was granted.
We only have Karan's side of this. That matters, and it always matters in these cases.
Key Facts of the Case
- A private chat between two students was screenshotted and circulated without the sender's consent.
- The circulation came first. The threats came afterwards, which changes the legal character of the dispute.
- The people making the threats were identifiable classmates, not anonymous handles. That makes investigation far easier.
- No money was demanded. The demand was silence about an unrelated hostel dispute.
- The central wrong was the threat to publish chats that had been fabricated, not the leak itself.
- The messages were preserved in their original form, with metadata, before anything was deleted or the phone was reset.
- The first lawyer Karan consulted advised him to take it up with the college. That route cost him roughly three weeks and produced nothing.
What the law says about a leaked private chat used as leverage
The single most common mistake in these matters is treating them as one offence. They are usually three or four, and they sit in different statutes. Which ones apply depends entirely on what was said, to whom, and whether the material being threatened is genuine or manufactured.
Criminal intimidation — Section 351, Bharatiya Nyaya Sanhita, 2023
This is the backbone of the case and the provision that replaced Section 503 of the old Indian Penal Code. Criminal intimidation covers any threat of injury to a person's reputation, property or person, made with the intent to cause alarm or to force that person to do something they are not legally bound to do — including to stop doing something they are entitled to do.
Read that against the facts. The demand was silence. Silence about a hostel dispute. Karan was entitled to complain. A threat to publish material unless he stayed quiet fits the section almost word for word.
The punishment sits in Section 351(2) — up to two years, or fine, or both. The aggravated limb in Section 351(3) carries up to seven years, but it applies to threats of death or grievous hurt, or threats to impute unchastity to a woman. Reputation threats do not fall there. Be realistic about that: what you are dealing with is generally a two-year offence.
Defamation — Section 356, Bharatiya Nyaya Sanhita, 2023
Defamation requires an imputation, made by words intended to be read by someone other than the person defamed, which lowers that person's reputation. A WhatsApp group of seniors qualifies as "someone other than the person defamed". So does a message to a principal. So does a shared screenshot.
Section 356 replaced the old Sections 499 and 500, and the exceptions carried over. Truth is a defence only when it is published for the public good. Fair comment, good-faith censure by someone with lawful authority, and good-faith imputations made to protect a legitimate interest are also exceptions. This is where a defamation case can turn on facts you cannot see yet. What did the screenshots actually say? Did the recipients have any reason to receive them? A college principal arguably has a lawful interest in knowing about student misconduct. A group of seniors does not.
The punishment is simple imprisonment up to two years, or fine, or both.
Forgery, if the chats are fabricated
Threatening to publish chats that were never written is a different and heavier animal. Fabricating a document or electronic record and using it as genuine falls under the forgery chapter of the BNS. Where the forgery is committed specifically to damage a person's reputation, or to cheat, the punishment goes up sharply.
I am deliberately not putting section numbers on this part. The chapter was renumbered in 2023 and the sub-sections matter. What matters for a reader is the shape of it: creating a fake chat record and threatening to publish it is not a prank, and it is not merely defamation.
The Information Technology Act, 2000
Two provisions are usually worth pressing here. Section 66C covers identity theft — the fraudulent or dishonest use of another person's electronic signature, password or unique identification feature. Section 66D covers cheating by personation using a computer resource or communication device. If someone created a profile or a forged chat in Karan's name, or in a classmate's name, to make the fabrication look credible, these sections come into play.
Section 67 applies to publishing obscene material in electronic form, and it matters if the leaked content is sexual in nature. Section 72A deals with disclosure of information in breach of a lawful contract. Section 66E, which people often cite, is narrower than it sounds — it covers capturing and publishing images of a person's private area, not text.
One practical point about cognizability: offences under the IT Act punishable with three years are generally cognizable, which means the police can register an FIR without a magistrate's order. A standalone criminal intimidation case is not, and that is often the difference between a complaint that moves and one that dies on a station counter.
It is usually not extortion
Extortion under the BNS requires the delivery of property — money or valuables — obtained by putting a person in fear. No money was demanded here. The demand was silence. That pushes the facts towards criminal intimidation rather than extortion, and it is worth getting that characterisation right in the complaint. Personnel at a police station often mislabel these as extortion and then find the ingredients missing.
Why the college is not the right forum
Colleges can run a disciplinary inquiry. They cannot try a criminal offence, they cannot summon records from a phone, and they cannot restrain anyone from publishing anything. An internal committee's finding is worth something as corroboration, but it is not protection.
There is a second, uglier reason to be careful. The moment a college gets involved, the underlying leaked chat gets examined too. If it contains something the complainant said — bullying, casteist remarks, anything — the disciplinary process can turn around. I have seen exactly that happen. Complain to the institution if it helps your case, but do not make it your only move.
What to do in the first 48 hours
- Do not delete anything. Not the chat, not the screenshots, not the threats. Deleted messages are the first thing an accused party will point to.
- Do not reply. No explanations, no denial, no "say that again". Every reply you send becomes evidence about your own state of mind.
- Screenshot the full thread, not the message. Include the contact name, the number, the date and the time. Partial screenshots get attacked in court.
- Back up to cloud and keep the original handset. Do not factory reset. Do not switch phones.
- Write one page of chronology. Date-wise, in your own words, on plain paper. This becomes the spine of the complaint.
- Do not confront the person on a call. A conversation you cannot record usually becomes a dispute about who said what.
Preserving a leaked private chat as evidence — and getting it admitted
Screenshots alone are weak. Anyone can make a screenshot. What a court wants is the original device, or the original data with a certificate.
Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 — the provision that replaced Section 65B of the Indian Evidence Act — deals with the admissibility of electronic records. It requires a certificate signed by the person in possession or control of the device, identifying the record and describing how it was produced. Get this wrong at the complaint stage and the same problem will follow you to trial.
Practically: keep the phone, generate a hash value of the data if you can, keep a copy on a cloud account that logs access, and hand over the device only against a written receipt if the police ask for it. Never surrender your only phone without a receipt and a copy.
What happens at the police station
Give a written complaint, get a receipt stamp or a diary number on your copy. If the offence alleged is cognizable, an FIR follows. If the officer refuses, an FIR can be registered at any police station and transferred to the one with jurisdiction — or you go to the Superintendent of Police. Parallel to that, a complaint to the cyber crime cell and to cybercrime.gov.in creates a second record with timestamps.
If the police still do nothing, the next step is a complaint before the Magistrate, who can direct an investigation. That route is slower, usually weeks to a few months, but it is not a dead end.
On timelines: offences punishable with imprisonment up to three years attract a limitation of roughly one year from the date of the offence for taking cognizance. Criminal intimidation and defamation both fall in that band. Sitting on a threat from March until the following year is a real problem, and it is the most common problem I see in these files.
What a court can and cannot restrain
A civil suit can seek a permanent injunction against publication, along with damages, and an interim injunction can be granted at the early stage. Courts have been willing to restrain further circulation of private material where the right to privacy is engaged — the Supreme Court's judgment in K.S. Puttaswamy v. Union of India (2017) is the foundation for that line of argument.
What no court can do is un-send what has already gone out. If a screenshot has been forwarded to forty people, it is out. An injunction stops tomorrow, not yesterday. That is worth understanding before you measure success by how much gets taken down.
Where this kind of case is weak
Honestly, in some versions of these facts there is very little to argue. If the chat is genuine, if the person who circulated it received it as a forward rather than from you, if the alleged threat was phrased as a vague warning with no demand attached, and if the recipients had a legitimate reason to see it — the defamation case thins out, and the intimidation case may come down to one message whose meaning is disputed.
Similarly, if the accused is a minor, the Juvenile Justice Act changes the forum and the outcome. If the accounts were anonymous and routed through a VPN, identification takes time and sometimes does not happen at all. And a complaint filed months late, with no preserved device, is hard to build on.
None of this means nothing can be done. It means the assessment has to be made before drafting, not after.
Frequently Asked Questions
Is forwarding a leaked private chat a crime in India?
Forwarding by itself is not automatically a crime. It becomes one when the imputation damages someone's reputation and is read by a third person, which is what Section 356 of the Bharatiya Nyaya Sanhita requires. A genuine chat forwarded to a group can still be defamation if it lowers your reputation and no exception applies. Truth is a defence only when the publication is for the public good. So forwarding a true screenshot into a WhatsApp group for no reason other than spite is not shielded by the fact that the words were really said.
Where the forwarder is part of the same demand for silence, they are not a bystander. They become a co-accused in the intimidation.
Can I file an FIR for a threat to share my chats?
You can always file a written complaint, and the police must put a diary number on your copy. Whether an FIR follows depends on how the offence is classified. Criminal intimidation under Section 351 is generally non-cognizable when it stands alone, which means the station cannot register an FIR without a Magistrate's order.
That changes if an Information Technology Act provision with a three-year punishment is added to the complaint. Those are generally cognizable. This is precisely why the drafting matters: a complaint that reads only as "he threatened me" gets sent away, and a complaint that also lays out the fabrication of an electronic record or the misuse of an identity does not.
If the station refuses, you have two routes — the Superintendent of Police, or a complaint before the Magistrate asking for a direction to investigate.
What punishment can the person get?
For criminal intimidation under Section 351(2), up to two years, or fine, or both. For defamation under Section 356, up to two years, or fine, or both. Under the IT Act, the identity-theft and personation provisions carry imprisonment that can extend to three years with a fine. Publishing obscene material in electronic form carries a heavier sentence on a repeat conviction. The forgery chapter, where it applies, is heavier still.
Sentences in these cases are usually modest. What people actually want — the material coming down, and the threats stopping — is achieved through an injunction and through the accused person's arrest or appearance, not through the length of the sentence.
Should I go to the police or to court directly?
Police first. A station complaint costs nothing and creates a timestamped record, which matters later on limitation. Only if that fails do you move to the Magistrate. A civil suit for injunction can run alongside the criminal complaint; the two do different jobs. The criminal case punishes and deters. The civil suit stops the publication.
Can I get the posts or the chats taken down from a platform?
Yes, in part. Intermediaries — messaging apps, social platforms, hosting services — have a grievance officer, and under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 they are required to act on complaints involving non-consensual intimate imagery within a short window, and the larger platforms have dedicated channels for it. A takedown request is not a substitute for a police complaint, but it is fast and it costs nothing.
Be realistic. Takedown removes a copy. It does not remove the forty phones that already have it.
Does it matter that the person is a classmate or a colleague?
It helps. Identification is the hardest part of most cyber complaints, and a named, reachable accused removes that hurdle. It also means the device is available for seizure, which is where the fabricated chats would be found. Where the accused is a minor, the Juvenile Justice framework applies and the process changes substantially — the inquiry is not a trial in the ordinary sense, and outcomes lean towards counselling and rehabilitation.
How long will this take?
An FIR, if one is registered, usually takes days to a few weeks. Investigation runs to a few months. A trial in a defamation or intimidation matter can run for years, and many of them end in a compromise between the parties rather than a verdict. Interim protection, if you get it, comes much sooner — sometimes within weeks of the application.
What to send us before you call
If you are in this situation now, put together three things. A copy of the threat messages, full thread, with the contact name, number, date and time visible. A one-page typed chronology — date on the left, what happened on the right, no adjectives. And a copy of any complaint you have already filed, with the diary number or receipt stamp on it.
If the deadline has already passed — the leak happened last year and you are only moving now — send it anyway. Limitation is a real obstacle, but a continuing threat that is still live today is generally a fresh cause of action, and the delay can sometimes be explained. What kills these cases is not always the delay. It is a phone that was reset in the meantime.
You can write to the chamber through /contact-us or book a slot at /book. Bring the messages as they exist. Do not clean them up, do not delete the abusive ones, and do not send a summary instead of the thread.
This article is general information about Indian law and is not legal advice on your own situation. Every case turns on its own facts, and the outcome of a complaint or a suit depends on evidence that only a lawyer can assess after reading your file.
Advocate Sudhir Rao, Supreme Court of India
Facing a similar matter? Speak to a criminal advocate in Delhi — Advocate Sudhir Rao appears in bail, trial and appellate matters before the Delhi District Courts, the Delhi High Court and the Supreme Court of India.