Rules for Public Security Organs on Electronic Data Evidence Collection

The Ministry of Public Security of the People’s Republic of China has released a comprehensive update to the procedural framework governing the collection, preservation, and analysis of electronic data in criminal and administrative investigations. Titled the Rules for Public Security Organs on Electronic Data Evidence Collection, this 2026 draft is set to replace the previous 2018 iteration, reflecting a significant shift in how law enforcement interacts with digital ecosystems, encrypted communications, and artificial intelligence-generated content. The update aims to standardize the work of public security organs, ensure the quality and integrity of digital evidence, and enhance the efficiency of law enforcement while providing a robust legal basis for protecting the rights of citizens and organizations.

Modernizing the Legal Framework for a Digital Era

The 2026 Rules are grounded in a suite of existing national laws, including the Criminal Procedure Law, the Administrative Punishment Law, and the Public Security Administration Punishment Law. As digital evidence has transitioned from a niche component of cybercrime investigations to a central element in nearly every category of law enforcement—from financial fraud to public safety—the need for more granular and technically accurate regulations has become paramount.

According to data from the Ministry of Public Security, over 90% of criminal cases investigated in the last three years have involved some form of electronic data. This includes information stored on mobile devices, cloud servers, and decentralized networks. The 2026 update addresses these complexities by expanding the definition of electronic data and refining the protocols for remote extraction and cross-jurisdictional cooperation.

Key Provisions and General Principles

The first chapter of the new rules establishes the foundational principles of legality, objectivity, and timeliness. Article 3 mandates that all electronic data collection must follow statutory authority and procedures while adhering to relevant technical standards. This ensures that the evidence remains admissible in court and resistant to challenges regarding its authenticity or integrity.

A critical requirement retained and strengthened in the 2026 draft is the "two-officer rule." Article 5 stipulates that electronic data evidence collection must be conducted by at least two police officers. While specialized technical personnel may be invited to assist, they must operate under the direct supervision of the officers to maintain the chain of custody.

Furthermore, Article 7 introduces enhanced privacy protections. Public security organs and any commissioned third-party agencies are legally bound to maintain the confidentiality of state secrets, trade secrets, and personal privacy encountered during the forensic process. Any materials gathered that are subsequently found to be unrelated to the case must be promptly returned or destroyed, a move seen by legal analysts as a step toward balancing state power with individual data rights.

Procedural Innovations in Data Extraction

The 2026 Rules provide a detailed roadmap for various stages of digital forensics, including on-scene investigation, seizure of original media, and freezing of data.

Password Acquisition Protocols

One of the most discussed sections of the draft is Article 8, which outlines the hierarchy of methods for obtaining account passwords or encryption keys. The preferred method remains voluntary provision by the data holder. However, if the holder refuses, the rules allow for the use of technical measures to bypass security, provided that approval is obtained from the head of a public security organ at or above the county level. In urgent cases where data might be lost or destroyed within 24 hours, police may proceed with extraction immediately and complete the approval formalities retroactively.

Seizure and "Write-Protection"

Chapter II emphasizes the physical seizure of original storage media (such as smartphones, hard drives, and servers) whenever possible. Article 18 mandates the use of "write-protection" measures to ensure that the original data remains unchanged during the forensic process. For mobile devices with wireless communication capabilities, the rules require signal shielding or the use of Faraday bags to prevent remote wiping or unauthorized synchronization.

Freezing Electronic Data

Article 20 introduces a "minimum necessity" principle for freezing data. This measure is employed when the volume of data is too large to extract immediately or when the extraction process would take so long that it risks the data being tampered with. Freezing involves calculating integrity check values (hashes) or locking network accounts to preserve the state of the evidence at a specific point in time.

Chronology of Digital Forensic Legislation in China

The evolution of these rules reflects China’s broader trajectory toward becoming a "cyber-superpower" (网络强国).

• 2005: Initial guidelines for computer crime forensics are established as the internet begins to permeate the Chinese economy.
• 2013: Revisions to the Criminal Procedure Law formally recognize electronic data as an independent category of evidence.
• 2016: The MPS, the Supreme People’s Court, and the Supreme People’s Procuratorate issue joint provisions on the collection and examination of electronic data.
• 2018: The first comprehensive "Rules for Public Security Organs on Electronic Data Evidence Collection" are implemented, focusing on mobile devices and basic network data.
• 2026 (Current Draft): The framework is expanded to include AI-generated content, sophisticated cloud environments, and streamlined cross-jurisdictional cooperation.

Addressing New Technologies: AI and Cloud Computing

A notable addition in the 2026 draft is the focus on specialized knowledge in Article 50. This provision allows for the commissioning of experts to analyze "artificial intelligence-generated information recognition" and "program function analysis." This is a direct response to the rise of deepfakes and automated cyber-attacks.

As data increasingly moves away from local hardware, Article 30 clarifies protocols for "online extraction." Public security organs are authorized to collect data that is publicly available or stored on remote servers within the mainland territory via network tools. For data stored overseas, the rules allow for extraction if the suspect provides the necessary credentials, though this remains a sensitive area regarding international digital sovereignty.

Cross-Jurisdictional Cooperation and Efficiency

In a move to reduce administrative bottlenecks, Article 38 outlines a modernized system for cross-jurisdictional evidence collection. Public security organs can now send "Case-handling Cooperation Letters" and legal documents via secure internal information systems or fax. The local public security organ in the destination jurisdiction is then empowered to conduct the extraction on behalf of the investigating agency, provided the documents are verified and stamped locally.

This system is supported by data from the MPS showing that nearly 65% of cybercrime cases involve suspects, victims, and data servers located in different provinces. The new rules aim to cut the time required for inter-provincial evidence requests by 40%.

Official Responses and Expert Analysis

Legal experts within the Chinese Academy of Social Sciences have noted that the 2026 Rules represent a "technical maturation" of the Chinese police force. By codifying hash value verification (Article 22) and the recording of network topology (Article 32), the MPS is aligning its internal procedures with international ISO/IEC 27037 standards for digital evidence handling.

However, some civil law practitioners suggest that the broad powers granted in Article 34 regarding the extraction of "personal communication content" (such as SMS and instant messages) will require strict judicial oversight. The rules specify that if a suspect refuses to cooperate, a formal "Decision on Obtaining Personal Communication Content" must be issued, ensuring that such intrusive measures are documented and approved by high-ranking officials.

Broader Impact and Implications

The implementation of the 2026 Rules is expected to have a ripple effect across the Chinese legal system. By raising the bar for how evidence is collected, the MPS is effectively forcing a technological upgrade across all levels of the public security apparatus. Smaller, county-level police departments will need to invest in more sophisticated forensic workstations and training to comply with the new "write-protection" and "integrity check" mandates.

For the private sector, particularly internet service providers (ISPs) and cloud storage companies, the rules clarify their obligations. Article 37 mandates that units and individuals must truthfully provide electronic data and assist law enforcement. For companies that objectively lack the technical capacity to preserve data integrity, public security organs are now tasked with providing technical assistance, shifting some of the burden of forensic quality from the private sector back to the state.

As the draft moves through its comment period, it serves as a clear signal that the future of Chinese law enforcement is inextricably linked to the digital domain. The 2026 Rules for Public Security Organs on Electronic Data Evidence Collection provide the necessary legal and technical scaffolding to navigate a world where the most incriminating evidence is no longer found in a file cabinet, but in a cloud-based ledger or an encrypted chat log.

The rules are slated to take effect in late 2026, at which point the 2018 regulations will be officially abolished. This transition period allows for the necessary infrastructure upgrades and training programs to be implemented across China’s vast public security network, ensuring a seamless move into the next generation of digital justice.