Siti Muinah
The Ministry of Public Security of the People’s Republic of China has released a comprehensive new set of draft regulations titled the Public Security Organ Rules on Electronic Data Evidence Collection, signaling a major overhaul of the nation’s digital forensic procedures. This draft, intended to replace the previous 2018 guidelines, establishes a modernized legal framework for the handling of electronic evidence in both criminal and administrative investigations. As digital footprints become the primary source of evidence in modern litigation, these rules aim to standardize the process of "seizing, sealing, freezing, and extracting" data while balancing the needs of state security with the protection of civil liberties and personal privacy.
The release comes at a critical juncture as China continues to integrate advanced technologies into its judicial system. The draft rules provide granular instructions for police officers on how to maintain the "integrity, authenticity, and legality" of digital evidence, ensuring that data presented in court is beyond reproach. This development is expected to have far-reaching implications for tech companies, internet service providers, and legal practitioners across the country.
A Standardized Framework for Digital Forensics
The draft regulations, structured across six chapters and 61 articles, establish a rigorous chain-of-custody protocol. Article 1 clarifies that the rules are grounded in the Criminal Procedure Law, the Administrative Punishment Law, and the Law on Penalties for Administration of Public Security. The primary objective is to improve case-handling efficiency while ensuring that the legal rights of citizens and organizations are not infringed upon during the evidence-gathering process.
Under the new rules, all electronic data collection must be conducted by at least two police officers. While professional technical personnel may be invited to assist under the supervision of these officers, the accountability remains strictly within the public security organs. This measure is designed to prevent the mishandling of sensitive information by third-party contractors and to maintain the official nature of the investigation.
The Procedural Lifecycle: Sealing and Seizing Storage Media
One of the most significant portions of the draft pertains to the physical handling of storage media, such as hard drives, mobile phones, and servers. Article 14 mandates that when investigators find electronic data that can prove the guilt or innocence of a suspect, they should ideally seize the original storage medium.
To ensure the evidence is not tampered with, the rules require a "sealing" process. This involves using physical seals or digital write-protection measures. The draft emphasizes that witnesses must be present during this process. In cases where witnesses cannot be found, the entire procedure must be recorded via synchronized audio and video to provide a verifiable record for the courts.
For mobile devices, the draft introduces specific technical safeguards. Article 18 requires officers to employ signal-blocking measures—such as Faraday bags or signal jammers—to prevent remote data wiping or modification. This reflects the growing challenge of "remote-kill" features in modern smartphones, which can render evidence useless before it reaches a forensic lab.
Freezing Data: Constraints and Timeframes
In scenarios where data volumes are too large to extract immediately or where the extraction process might disrupt essential public services, the draft allows for the "freezing" of electronic data. This is a digital equivalent to freezing a bank account.
The draft sets clear temporal limits on these actions to prevent indefinite data retention. For criminal cases, the initial freezing period is capped at six months, with the possibility of extensions upon approval from higher-level authorities. For administrative cases, the limit is 30 days. This tiered approach provides a legal safeguard against overreach, ensuring that data is only held as long as is strictly necessary for the investigation.
On-Scene Extraction and Remote Network Collection
Recognizing that seizing physical servers is often impractical in the age of cloud computing, the draft provides extensive guidelines for on-scene extraction and remote network collection. Article 25 allows for on-scene extraction if the original medium is inconvenient to move or if the case is urgent and data might be destroyed.
Furthermore, Article 30 addresses the collection of data stored on remote servers or cloud platforms. Public security organs are authorized to collect publicly available data through online means. For non-public data, investigators may use account credentials provided by suspects or authorized third parties to access and extract information.
Crucially, the rules mandate that for any online extraction, the "integrity check value" (commonly known as a hash value) must be calculated immediately. This digital fingerprint ensures that the data has not been altered from the moment of collection to its presentation in court.
Mandatory Audio-Visual Recording for Major Cases
To enhance transparency and prevent procedural errors, Article 13 of the draft mandates synchronized audio and video recording for the entire evidence collection process in high-stakes cases. These include:
- Cases involving serious threats to national security or public safety.
- Cases with significant social impact.
- Cases where the suspect may face a prison sentence of five years or more.
- Situations where no witnesses are present during the collection.
This requirement places a heavy technical and logistical burden on local police departments but is seen as a necessary step to reduce instances of contested evidence and to uphold the "truthfulness" of the judicial process.
Cooperation with Third Parties and Cross-Jurisdictional Logistics
The draft rules formalize the relationship between police and internet service providers (ISPs). Under Article 37, public security organs can issue formal "Evidence Collection Notices" to units and individuals. These parties are legally obligated to provide the requested data and to assist in maintaining its integrity.
For cross-jurisdictional investigations, the draft introduces a streamlined "Case-handling Cooperation" system. Police in one city can request assistance from colleagues in another jurisdiction via fax or internal digital systems, allowing for faster response times in cybercrime cases that often span multiple provinces.
Modernizing the Definition of Electronic Data
Article 57 provides a modernized and exhaustive list of what constitutes "electronic data." This reflects the current digital landscape in China, moving beyond simple emails and documents to include:
- Information from social media platforms (webpages, forums, blogs, and WeChat-style "Moments").
- User identity information and digital certificates.
- System logs, application logs, and network traffic records.
- Source code and computer programs.
- Multimedia files including documents, images, audio, and video.
- User transaction records and communication logs.
- Personal communication content such as SMS, instant messages, and emails.
By including "live stream" data and "short videos," the MPS is signaling that its forensic capabilities are evolving alongside consumer trends in the digital economy.
Supporting Data and Contextual Analysis
The necessity for these new rules is underscored by the surge in telecommunications and online fraud in China. According to data from the Supreme People’s Procuratorate, cyber-related crimes have seen a double-digit percentage increase annually over the past five years. In 2023 alone, Chinese authorities handled hundreds of thousands of cases related to online gambling, phishing, and data theft.
The 2018 rules were drafted before the full implementation of the Data Security Law (2021) and the Personal Information Protection Law (2021). Consequently, the 2026 draft serves as a bridge, aligning police procedures with these high-level national statutes. By standardizing the "integrity check value" and hash algorithms, the MPS is adopting international forensic standards, which may also facilitate future international cooperation in chasing transnational cybercriminals.
Timeline and Broader Implications
The draft is currently open for public comment, allowing legal experts, tech firms, and the public to weigh in on the potential impact of the rules. According to Article 61, the rules are slated to take effect in late 2026, at which point the 2018 rules will be officially abolished.
The broader implications of this framework are twofold. For the state, it provides a powerful, standardized toolkit to combat increasingly sophisticated digital crimes. For the citizen, it offers a more predictable legal environment where the "rules of engagement" for digital searches are clearly defined. However, some legal analysts suggest that the power to access "personal communication content" under Article 34 and 39 will require strict judicial oversight to ensure that privacy is only breached when there is a legitimate and proportionate need for investigation.
As China moves toward a more "data-driven" governance model, the Public Security Organ Rules on Electronic Data Evidence Collection will serve as the cornerstone of digital justice, ensuring that in the eyes of the law, a bit of data is as solid as a physical fingerprint.
Neng Nana
