Lina Irawan
The Ministry of Public Security has unveiled a comprehensive new draft of regulations designed to standardize the collection, preservation, and forensic analysis of electronic data in criminal and administrative proceedings. This regulatory update, which is poised to replace the existing 2018 framework, reflects the rapid evolution of digital technology and the increasing reliance on electronic evidence in the modern judicial system. As criminal activities increasingly migrate to digital platforms—ranging from telecommunications fraud to sophisticated cyber-attacks—the proposed rules aim to provide law enforcement with a clear, technically sound, and legally robust set of procedures. The primary objectives of the draft are to ensure the quality of digital evidence, protect the legitimate rights of citizens and organizations, and improve the overall efficiency of law enforcement operations. By aligning these rules with the Criminal Procedure Law and the Administrative Punishment Law, the Ministry seeks to create a unified standard that withstands the scrutiny of the courtroom while adapting to the complexities of cloud computing, encrypted communications, and artificial intelligence.
Strengthening the Evidentiary Chain of Custody
A central pillar of the new draft is the emphasis on the integrity and authenticity of electronic data. Unlike physical evidence, digital information is inherently volatile and susceptible to tampering or accidental modification. To mitigate these risks, the regulations mandate the use of "write-protection" technologies during the examination process. This ensures that the original data remains unchanged, with investigators typically working on bit-stream backups or "mirrored" copies rather than the source media itself. The draft stipulates that any deviation from these technical standards—such as when write-protection is technically unfeasible—must be meticulously documented, and the entire process must be recorded via audio or video to maintain a transparent chain of custody.
The proposed framework also introduces rigorous standards for "integrity check values," commonly known as hashes. These digital fingerprints are used to verify that data has not been altered from the moment of collection to its presentation in court. The draft requires that these values be calculated and recorded at multiple stages of the investigation. If a storage medium is transferred between departments or sent for professional appraisal, the receiving party must verify that the current hash matches the original. Any discrepancy must be noted in the official record, potentially affecting the admissibility of the evidence. This focus on technical verification reflects a broader move toward "scientific policing," where the validity of an investigation is measured by its adherence to objective, repeatable technical processes.
Procedural Safeguards and Oversight
To ensure that the expanded powers of digital data collection do not infringe upon civil liberties, the draft incorporates several layers of procedural oversight. Under the new rules, most significant actions—such as freezing data, seizing original storage media, or conducting remote extractions—require the prior approval of a responsible official at the county level or above. In urgent scenarios where data might be lost or destroyed if not acted upon immediately, officers are permitted to take emergency measures, but they must seek retroactive approval within 24 hours. If the higher-level authority deems the emergency action unnecessary or improper, the measures must be lifted immediately.
Furthermore, the regulations emphasize the importance of third-party verification. The draft maintains the requirement that a witness should be present during the seizure of storage media or the on-site extraction of data. In cases where a witness cannot be secured due to objective circumstances, law enforcement must utilize synchronized audio and video recording to document the entire procedure. This "all-process recording" is particularly mandatory for cases involving national security, public safety, or serious crimes where the suspect faces significant imprisonment. By creating a visual and auditory record of the investigation, the rules aim to prevent procedural abuses and provide a factual basis for resolving any future disputes regarding the handling of evidence.
The Evolution of Extraction: From Physical to Remote
One of the most significant updates in the 2026 draft is the detailed guidance on "remote online extraction." As data increasingly moves from local hard drives to remote servers and cloud environments, physical seizure of hardware is often insufficient. The draft authorizes law enforcement to collect data that is publicly available or stored on remote systems within the territory via network connections. For data stored on servers located outside the territory, the rules allow for online extraction if the account credentials are provided by the suspect or if the data is otherwise accessible through legal means.
This shift recognizes the borderless nature of digital information but also introduces complex jurisdictional challenges. To address this, the draft encourages cross-jurisdictional cooperation between public security organs. A case-handling unit in one province can now formally request assistance from a unit in another jurisdiction through a digitized cooperation system. The assisting unit can then perform the necessary data collection or freezing on behalf of the requesting party, provided all legal documents are verified and stamped. This streamlined process is intended to eliminate the delays that often allow cybercriminals to delete evidence before a warrant can be executed across provincial lines.
Detailed Definitions and the Scope of Digital Evidence
The draft provides an expansive and modernized definition of what constitutes "electronic data." It moves beyond simple files and emails to include a wide array of digital footprints generated in the course of modern life. This includes information published on social media platforms, blogs, and forums; user registration data and identity verification information; system logs, login records, and network traffic data; and even computer programs or source code used in the commission of a crime.
Crucially, the regulations also cover private communications, such as instant messages and mobile phone texts. Given the sensitive nature of personal correspondence, the draft requires that the collection of such data be handled with extra care. If a suspect refuses to cooperate by providing passwords or unlocking a device, law enforcement must obtain specific approval from a high-ranking official before using technical means to bypass security measures. This tiered approach to authorization suggests an attempt to balance the needs of an investigation with the privacy interests inherent in personal communication devices.
Forensic Examination and Professional Appraisals
When an investigation encounters specialized technical hurdles—such as analyzing encrypted files, identifying AI-generated deepfakes, or tracing complex malware—the draft allows for the involvement of professional institutions and experts. The Ministry of Public Security will designate specific agencies to provide forensic reports on specialized issues. These institutions must be legally qualified and possess the necessary laboratory equipment to conduct scientific testing.
The draft outlines the tasks of these forensic examinations, which include verifying whether certain software actions led to specific outcomes or determining if data was modified at a particular timestamp. The individuals conducting these tests are required to act independently, free from external influence, and are held legally responsible for the truthfulness and legality of their reports. This professionalization of digital forensics is intended to provide courts with objective, expert-driven insights that can clarify the "how" and "why" behind digital crimes, which are often opaque to non-technical observers.
Impact on the Judicial Landscape and Privacy
The implementation of these rules is expected to have a profound impact on the efficiency of the Chinese criminal justice system. By providing a clear "manual" for digital evidence, the Ministry of Public Security is reducing the likelihood of evidence being thrown out of court due to procedural errors. For the legal profession, these rules provide a clearer target for defense attorneys to challenge the validity of an investigation, focusing on whether the "integrity check values" were properly maintained or whether the "two-officer" rule was followed.
From a social perspective, the regulations highlight the ongoing tension between security and privacy. While the rules include provisions for protecting state secrets, commercial secrets, and personal privacy, the sheer breadth of data that can be collected—including logs, social media interactions, and remote cloud data—underscores the extensive reach of modern law enforcement in the digital age. As these rules move toward final adoption, the focus will likely remain on how effectively the oversight mechanisms, such as the 24-hour approval rule and the witness requirements, can safeguard against the over-collection of data.
Chronology of Regulatory Development
The path to the 2026 draft reflects a decade of rapid regulatory adaptation. In 2016, the initial joint provisions on electronic data were issued, marking the first major attempt to standardize digital evidence across the police, procuratorate, and courts. This was followed by the 2018 Public Security Organ Rules, which provided more specific operational guidance. The 2026 update represents the third generation of these rules, incorporating lessons learned from the rise of the platform economy, the proliferation of IoT devices, and the emergence of blockchain and AI technologies.
As the draft enters the solicitation phase, stakeholders from the legal, tech, and academic sectors are expected to provide feedback on the feasibility of the technical requirements and the adequacy of the privacy protections. Once finalized, the rules will serve as the definitive guide for millions of public security officers, shaping the future of digital justice for years to come. The proposed effective date will see the total repeal of the 2018 version, signaling a clean break and a full commitment to this modernized evidentiary standard.
Layla Zulfa
Nana
