Ammar Sabilarrohman
In a significant move to modernize law enforcement procedures and adapt to the complexities of the digital age, China’s Ministry of Public Security has released a comprehensive draft of the "Rules for Electronic Data Forensic Work by Public Security Organs." This updated regulatory framework, intended to supersede the existing 2018 guidelines, outlines the standardized procedures for the collection, extraction, and preservation of digital evidence in both criminal and administrative cases. The draft represents a pivotal shift in how Chinese law enforcement interacts with digital infrastructure, balancing the need for efficient investigations with the legal requirements for data integrity and the protection of civil rights.
Comprehensive Framework for Digital Evidence
The draft rules are built upon a foundation of existing Chinese statutes, including the Criminal Procedure Law, the Administrative Punishment Law, and the Data Security Law. According to Article 1, the primary objectives of these regulations are to standardize the forensic process, ensure the quality and admissibility of electronic data, and safeguard the lawful rights of citizens and organizations.
The scope of "electronic data" is defined broadly in Article 57, covering almost every facet of modern digital life. This includes information published on web platforms (forums, blogs, microblogs), user identity information, system logs, network traffic data, computer programs (source code), and private communications such as mobile text messages and instant messaging logs. By providing such a granular definition, the Ministry of Public Security aims to eliminate ambiguity regarding what constitutes digital evidence in a court of law.
Strict Procedural Safeguards and the "Two-Officer" Rule
A cornerstone of the new draft is the emphasis on procedural transparency and accountability. Article 5 stipulates that all electronic data forensic work must be conducted by at least two people’s police officers. In cases requiring specialized technical knowledge, professional technicians may be appointed or invited to assist, but they must operate under the direct supervision of the police officers.
Furthermore, the draft introduces rigorous requirements for audio and visual recording of the forensic process. Under Article 13, the entire process of electronic data investigation must be recorded in cases involving:
- Serious threats to national security or public safety.
- Significant social impact.
- Crimes where the suspect may face five years or more of imprisonment.
- Situations where objective reasons prevent the presence of an independent witness.
This move is seen by legal analysts as an effort to prevent evidence tampering and to provide a verifiable "chain of custody" that can be scrutinized during legal proceedings.
Password Acquisition and Suspect Cooperation
One of the more controversial aspects of the draft involves the acquisition of account passwords and encryption keys. Article 8 outlines a tiered approach: initially, officers should seek the voluntary provision of passwords by the data holder. However, if the holder refuses to cooperate, the public security organ—with approval from a county-level or higher official—may issue a formal "Decision on Obtaining Account Passwords."
Once this decision is served, law enforcement is authorized to use "corresponding measures" to obtain the passwords. If the data holder or witnesses refuse to sign the decision, the process must be recorded via audio and video to maintain legal validity. In urgent situations where data might be lost or destroyed, these measures can be taken immediately, provided that formal approval is sought within 24 hours.
Seizure, Extraction, and the "Minimal Necessity" Principle
The draft distinguishes between the physical seizure of storage media (such as hard drives and smartphones) and the extraction of data. Article 14 mandates that if the original storage medium can be seized, it should be sealed and documented immediately. However, Article 25 allows for on-scene extraction if the physical media is integrated into a larger system (like a server bank) or if seizing the hardware would cause significant disruption to essential public services.
When freezing data—a process used when data volume is too large for immediate extraction or when there is a risk of remote wiping—Article 20 dictates that officers must follow the "minimal necessity" principle. This ensures that law enforcement actions do not overreach or unnecessarily infringe upon the operations of businesses or the privacy of individuals unrelated to the case.
Timeline of Chinese Digital Forensic Legislation
The evolution of these rules reflects China’s rapid digital transformation over the last two decades:
- 2012: The Criminal Procedure Law was amended to officially recognize electronic data as a distinct category of evidence.
- 2016: The Supreme People’s Court, the Supreme People’s Procuratorate, and the Ministry of Public Security issued joint "Provisions on Several Issues Concerning the Collection, Extraction, Examination, and Judgment of Electronic Data in Criminal Cases."
- 2018: The Ministry of Public Security issued the "Rules for Electronic Data Forensic Work by Public Security Organs," which provided the first dedicated internal police guidelines.
- 2026 (Proposed): The current draft is set to modernize these rules, accounting for advancements in cloud computing, encrypted messaging, and cross-border data transfers.
Supporting Data and Technical Challenges
The push for updated forensic rules comes amid a surge in cyber-related crimes. According to data from the Ministry of Public Security, telecommunications and network fraud cases accounted for nearly 40% of all criminal cases in major Chinese urban centers in recent years. Furthermore, the complexity of digital evidence has grown exponentially; the average size of data seized in a corporate fraud investigation has increased from gigabytes in 2018 to multiple terabytes in 2024.
The draft also addresses the challenge of "remote online extraction." Article 30 permits the collection of data stored on remote systems within Chinese territory via network access. Crucially, it also allows for the online extraction of data from overseas computer systems, provided the account credentials are provided by the suspect or are otherwise lawfully obtained. This reflects the increasingly global nature of digital evidence and the difficulties law enforcement faces with extraterritorial data storage.
Official Responses and Stakeholder Reactions
While official commentary from the Ministry of Public Security emphasizes "standardization" and "efficiency," the legal community has raised several points for discussion during the comment period.
"The draft provides much-needed clarity on the technical steps for integrity verification, such as the use of Hash values to ensure data hasn’t been altered," said a senior legal consultant specializing in Chinese cybersecurity law. "However, the provisions regarding the ‘corresponding measures’ for password acquisition will likely be a point of significant debate regarding the boundaries of police power and the right against self-incrimination."
Tech industry representatives have also noted that the rules for "Freezing Electronic Data" (Article 21) place a high burden of cooperation on Internet Service Providers (ISPs). Under the draft, ISPs must assist in locking accounts and implementing write-protection measures, which may require significant technical infrastructure and personnel costs.
Broader Impact and Implications
The implementation of these rules will have far-reaching implications for the Chinese legal system and the broader digital economy. By formalizing the use of "designated establishments" for forensic appraisals (Article 50), the draft encourages the growth of a specialized professional sector for digital forensics. These institutions must be qualified and use scientific methods, effectively raising the bar for the quality of evidence presented in court.
Furthermore, Article 9 establishes a mechanism for the "transformation" of evidence between administrative and criminal cases. This means that data collected during a routine administrative inspection by a regulatory body can be seamlessly utilized in a criminal prosecution if evidence of a crime is discovered. This "dual-use" capability significantly strengthens the state’s ability to prosecute white-collar and cyber-enabled crimes.
The draft also includes protections for "critical information infrastructure" (Article 56). Before taking forensic measures that could impact essential services—such as power grids, financial networks, or healthcare systems—officers must conduct an impact assessment to ensure that the investigation does not inadvertently cause a systemic failure.
As the public comment period continues, the Ministry of Public Security is expected to refine these provisions to address concerns over privacy and technical feasibility. Once finalized, these rules will serve as the definitive manual for digital investigations in China, marking a new era of "code-based" law enforcement where the digital footprint is as vital as the physical one. The transition from the 2018 rules to this new framework signifies a state that is not only reacting to the digital age but is actively seeking to codify its dominance over the digital domain.
Asep Darmawan
