Rules on the Electronic Data Collection and Forensics of Public Security Organs (Draft for Comments)

The Ministry of Public Security of the People’s Republic of China has released a comprehensive draft of the updated "Rules on the Electronic Data Collection and Forensics of Public Security Organs." This draft, intended to replace the existing 2018 regulations, establishes a rigorous legal and technical framework for how law enforcement agencies handle digital evidence in both criminal and administrative proceedings. The move reflects the increasing digitalization of criminal activity and the necessity for standardized procedures to ensure the admissibility and integrity of electronic evidence in a court of law.

The draft consists of 61 articles divided into six chapters, covering general provisions, seizure and freezing of storage media, extraction and collection of data, examination and experimental testing, and specialized appraisal. By seeking public comment, the Ministry aims to balance the efficiency of investigative powers with the protection of the legal rights of citizens and organizations.

Background and Context of Digital Forensics Reform

The necessity for this update stems from the rapid evolution of China’s digital economy and the corresponding shift in criminal methods. According to data from the Supreme People’s Procuratorate, cybercrime has seen a significant upward trend over the last five years, with telecommunications fraud and online gambling accounting for a substantial portion of the criminal docket. In nearly every modern case, electronic data—ranging from encrypted chat logs to blockchain transaction records—serves as the "smoking gun."

The 2018 version of the rules laid the groundwork for digital forensics, but the 2026 draft introduces more nuanced protocols for cloud computing environments, remote data extraction, and the handling of personal information. The update aligns the Ministry’s internal procedures with broader national laws, such as the Criminal Procedure Law, the Administrative Punishment Law, and the Data Security Law.

Core Principles and General Provisions

Article 1 of the draft explicitly states that the regulations are designed to standardize the work of public security organs, ensure the quality of evidence, and protect the legitimate rights and interests of citizens. A key theme throughout the document is the requirement for "objectivity" and "integrity."

Under Article 3, public security organs are mandated to collect electronic data comprehensively and promptly while ensuring its legality and authenticity. Article 5 emphasizes accountability by requiring that at least two police officers conduct any electronic data forensics work. For highly specialized technical tasks, professional technicians may be hired to assist, but they must operate under the direct supervision of the police.

Furthermore, Article 7 introduces a strict confidentiality requirement. Law enforcement must protect state secrets, trade secrets, and personal privacy encountered during the forensics process. Any gathered material found to be irrelevant to the case must be promptly returned or destroyed, reflecting a growing judicial emphasis on data minimization.

Detailed Procedures for Data Seizure and Freezing

The draft provides a clear distinction between the physical seizure of storage media and the digital freezing of data. Articles 14 through 19 outline the protocols for seizing original storage media, such as hard drives, smartphones, and servers.

When a physical device is seized, officers must:

1. Complete a detailed inventory (Article 16).
2. Record the "sealing state" through photographs or video.
3. Use signal-blocking measures, such as Faraday bags, for mobile devices to prevent remote wiping (Article 18).

In scenarios where physical seizure is impractical—such as when dealing with massive cloud databases or critical infrastructure that cannot be powered down—the draft allows for the "freezing" of data. Article 20 specifies that data may be frozen if it is too large to extract immediately or if there is a risk of tampering. Freezing methods include calculating integrity check values (hashes), locking network accounts, or applying write-protection measures.

Extraction and Remote Forensics Protocols

One of the most significant sections of the draft concerns the extraction of data. Article 25 permits on-scene extraction if the original medium cannot be moved or if the case is urgent. To prevent the loss of volatile data, such as information stored in a computer’s RAM, officers are authorized to extract data before shutting down the system.

The draft also addresses the complexities of remote data. Article 30 allows for the online collection of data that is publicly available or stored on remote systems within Chinese territory. For data stored on overseas servers, the rules permit extraction if the suspect provides the necessary credentials (account and password).

Article 8 introduces a specific hierarchy for obtaining passwords. While officers should first seek cooperation from the data holder, they may, with the approval of a county-level or higher public security official, employ technical measures to bypass or obtain credentials if the holder refuses to cooperate. This process must be documented via video recording to ensure procedural transparency.

Integrity Checks and Scientific Examination

To ensure that electronic data has not been altered from the moment of collection to its presentation in court, the draft relies heavily on "integrity check values," commonly known as hash values. Article 41 requires that whenever data is transferred between departments, the hash values must be verified. If the values do not match, the discrepancy must be noted in the record, which could potentially invalidate the evidence.

The draft also introduces "Electronic Data Experimental Testing" (Articles 46–49). This is a process where investigators recreate digital conditions to verify if a certain action could lead to a specific outcome. For example, testing whether a specific piece of malware could have automatically deleted logs. These experiments must be conducted at least twice to ensure consistency and must be recorded in their entirety.

Specialized Appraisal and Institutional Requirements

For complex cases involving source code analysis or the identification of AI-generated content, public security organs may commission specialized appraisals. Article 50 specifies that these institutions must be designated by the Ministry of Public Security. These appraisers act as expert witnesses and are subject to the same confidentiality and recusal rules as judicial officers.

Timeline and Implementation

The draft outlines a clear chronology for the implementation of these rules:

• Drafting Phase: The Ministry of Public Security conducted extensive research into current forensic bottlenecks and international standards.
• Public Consultation: The current phase, where legal experts, tech companies, and the public can submit feedback.
• Final Review: The MPS will synthesize comments and finalize the text.
• Effective Date: The draft suggests a 2026 implementation date, at which point the 2018 rules will be officially repealed.

Impact and Implications for the Legal System

The introduction of these rules is expected to have a profound impact on the Chinese judicial system.

1. Higher Standards for Admissibility: By codifying the use of write-blockers and hash values, the rules make it harder for poorly collected digital evidence to reach the courtroom. This protects defendants from the use of corrupted or tampered data.

2. Increased Demand for Forensic Technology: The requirement for signal blocking, remote extraction, and integrity verification will likely drive a surge in the procurement of high-end forensic tools by local police departments.

3. Clarification of Corporate Responsibility: Internet service providers and data holders are given a clearer understanding of their obligations to assist in investigations (Article 37). The rules specify that if a company lacks the technical capacity to preserve data integrity, the public security organ must provide assistance.

4. Privacy Protections: The mandate to return irrelevant data and protect personal information addresses long-standing concerns from civil society regarding the "over-collection" of digital footprints during criminal investigations.

Conclusion

The "Rules on the Electronic Data Collection and Forensics of Public Security Organs (Draft for Comments)" represents a strategic pivot toward a more professional and scientifically grounded approach to law enforcement in the digital age. By providing detailed "how-to" instructions for every step of the digital evidence lifecycle, the Ministry of Public Security is attempting to close the gap between rapid technological change and the slow evolution of procedural law. As the public consultation period continues, the final version of these rules will likely serve as a cornerstone for China’s criminal justice system for the next decade.