Azzam Bilal Chamdy
The Ministry of Public Security of the People’s Republic of China has released a comprehensive new draft regulation titled the "Provisions on Electronic Data Evidence Collection by Public Security Organs (Solicitation Draft)," marking a significant update to the procedural framework for handling digital evidence. This draft is designed to standardize how police forces across the country collect, extract, seal, and examine electronic data in both criminal and administrative investigations. By replacing the previous 2018 guidelines, the new provisions reflect the rapid evolution of digital technology, the rise of cloud computing, and the increasing prevalence of artificial intelligence in modern society. The draft aims to balance the necessity of law enforcement efficiency with the protection of citizens’ legal rights and the integrity of the judicial process.
Strengthening the Legal Foundation for Digital Investigations
The draft regulation is grounded in several high-level national laws, including the Criminal Procedure Law, the Administrative Punishment Law, and the Public Security Administration Punishment Law. Article 1 clarifies that the primary objectives are to standardize work, ensure the quality of digital evidence, and protect the legitimate rights and interests of citizens and organizations. In an era where nearly every criminal case involves some form of digital footprint, these provisions provide the granular detail required for "bit-based" evidence to meet the stringent requirements of a court of law.
Article 2 defines the scope of activities covered by the regulation, which includes the inspection of electronic data, the seizing and sealing of original storage media, the freezing of electronic data, and the extraction and examination of such data. These rules apply to all stages of case handling, ensuring that from the moment a device is seized on-scene to the final forensic appraisal, a clear and legally defensible chain of custody is maintained.
Core Principles: Legality, Objectivity, and Integrity
Under Article 3, the regulation mandates that public security organs must collect electronic data in accordance with legal authority and procedures. Law enforcement is required to follow established technical standards to ensure that the data collected is legal, authentic, complete, and relevant. This "four-pronged" requirement for evidence—legality, authenticity, completeness, and relevance—is the cornerstone of the new draft.
To ensure accountability, Article 5 stipulates that at least two police officers must conduct electronic data evidence collection. While specialized technical personnel may be invited to assist under the supervision of the police, the ultimate responsibility for the integrity of the evidence lies with the commissioned officers. Furthermore, Article 7 places a heavy burden of confidentiality on law enforcement, requiring them to protect state secrets, commercial secrets, and personal privacy encountered during the evidence-gathering process. Any material found to be unrelated to the case must be returned or destroyed promptly.
The Chronology of Digital Evidence Regulation in China
The release of this solicitation draft is the latest step in a decade-long effort by Chinese authorities to codify digital forensics.
- 2014: Early guidelines were established as cybercrime began to move from niche offenses to mainstream criminal activity.
- 2016: The Supreme People’s Court, the Supreme People’s Procuratorate, and the Ministry of Public Security issued joint rules on electronic data in criminal cases.
- 2018: The Ministry of Public Security issued the "Rules on Electronic Data Evidence Collection by Public Security Organs," which served as the primary manual for nearly eight years.
- 2026 (Targeted): The current draft is expected to be finalized and implemented, incorporating modern concepts like remote cloud extraction and AI-generated content identification.
This timeline demonstrates a clear shift from viewing digital evidence as a secondary "supplemental" form of proof to recognizing it as the primary evidence type in the 21st century.
Procedural Innovations: Passwords and Remote Extraction
One of the most notable sections of the draft concerns the acquisition of passwords and the handling of remote data. Article 8 outlines a tiered approach to obtaining access to encrypted devices or accounts. Initially, officers should request the password from the data holder. If the holder refuses, and the case is urgent—meaning a delay could lead to data loss or destruction—the police may employ technical measures to bypass or obtain the password. Such actions require approval from a county-level public security official or higher, and the process must be documented via video recording.
Furthermore, the draft addresses the "borderless" nature of digital data. Article 11 allows for "network remote inspections" of computer systems. This is particularly relevant for cases involving cloud storage or servers located in different jurisdictions. When the physical location of the data is inaccessible, but the data is vital to an ongoing investigation, officers can conduct remote extraction provided they document the tools used and the integrity of the data retrieved.
Sealing, Freezing, and the "Minimum Necessity" Principle
The regulation introduces strict protocols for "sealing" physical hardware and "freezing" digital accounts. Article 18 requires that when a device is sealed, it must be done in a way that prevents it from being used or powered on without breaking the seal. For mobile phones and devices with wireless communication capabilities, signal shielding measures—such as Faraday bags or signal jammers—must be used to prevent remote wiping or tampering (Article 18, Section 3).
When physical seizure is not possible or practical, such as with large-scale databases or live cloud services, Article 20 allows for the "freezing" of data. This is governed by the "Minimum Necessity" principle, ensuring that law enforcement actions do not cause undue disruption to legitimate business operations. Freezing measures include calculating integrity check values (hashes), locking network accounts, or applying write-protection. Article 23 sets a standard time limit for freezing: six months for criminal cases and thirty days for administrative cases, with possibilities for extension under strict oversight.
Supporting Data: The Rising Volume of Digital Evidence
The necessity for these updated provisions is underscored by the sheer volume of digital data in the legal system. According to judicial statistics, over 85% of criminal cases handled in major Chinese cities now involve electronic data as a key evidence type. In financial crimes and telecommunications fraud, this figure approaches 100%. The complexity is also increasing; a single investigation into a fraudulent online platform can involve several terabytes of data, necessitating the standardized sampling methods outlined in Article 45 of the new draft.
Addressing Artificial Intelligence and Specialized Appraisals
A forward-looking inclusion in the draft is Article 50, which addresses the need for specialized knowledge in analyzing application functions and identifying "artificial intelligence-generated information." As "Deepfake" technology and AI-driven scams become more sophisticated, the draft empowers public security organs to appoint experts or specialized institutions to issue forensic reports on these specific issues. These institutions must be designated by the Ministry of Public Security and possess verified laboratory qualifications (Article 54).
Broader Impact and Implications for Privacy and Business
The implementation of these provisions is expected to have a profound impact on several sectors:
- Judicial Clarity: By providing clear rules on what constitutes "complete" digital evidence, the draft reduces the likelihood of evidence being excluded during trial due to procedural errors.
- Privacy Protections: The mandatory requirement for video recording in serious cases (Article 13) and the explicit instructions to destroy unrelated personal data (Article 7) offer a layer of protection against overreach.
- Tech Industry Compliance: Internet service providers and tech companies gain a clearer understanding of their obligations when assisting in investigations. Article 37 requires that when police "extract" data from a company, the company must provide an integrity check value and a description of the data’s protection status.
- International Cooperation: The rules on remote extraction of overseas data (Article 30) signal China’s intent to formalize how its law enforcement interacts with the global internet, though this remains a complex area of international law.
Official Intent and Public Consultation
The Ministry of Public Security has emphasized that this draft is a response to the "new situations and new problems" arising from the digital economy. The provisions are currently in a public consultation phase, allowing legal experts, industry stakeholders, and the general public to submit feedback before the final version is enacted. This transparent approach suggests that the government is keen to ensure the rules are both technically feasible and socially acceptable.
In conclusion, the "Provisions on Electronic Data Evidence Collection by Public Security Organs" represent a vital modernization of China’s investigative toolkit. By codifying the nuances of digital forensics—from signal shielding to AI identification—the draft provides a roadmap for law enforcement to navigate the digital age while upholding the principles of the rule of law. As technology continues to advance, these provisions will serve as the essential bridge between the virtual world of data and the physical reality of justice.
Sagoh
