>>>welcome 河南大学, You have logged in.
Logout History Contact us  
Font Size:  A A A Search “Fabao” Window English 中文 = 简体  繁体
  Favorite   DownLoad   Print
 
Rules of Obtainment of Electronic Data as Evidence by Public Security Authorities in Handling Criminal Cases [Effective]
公安机关办理刑事案件电子数据取证规则 [现行有效]
【法宝引证码】

Rules of Obtainment of Electronic Data as Evidence by Public Security Authorities in Handling Criminal Cases 

公安机关办理刑事案件电子数据取证规则

(Ministry of Public Security 2019) (公安部 2019年)

Chapter I General Provisions 

第一章 总 则

Article 1 For the purposes of regulating the obtainment of electronic data as evidence by public security authorities in handling criminal cases, ensuring the quality of the obtainment of electronic data as evidence, and improving the efficiency of the obtainment of electronic data as evidence, according to the Criminal Procedure Law of the People's Republic of China, the Provisions on the Procedures for Handling of Criminal Cases by Public Security Authorities, and other relevant rules, these Rules are hereby developed.   第一条 为规范公安机关办理刑事案件电子数据取证工作,确保电子数据取证质量,提高电子数据取证效率,根据《中华人民共和国刑事诉讼法》《公安机关办理刑事案件程序规定》等有关规定,制定本规则。
Article 2 Public security authorities shall, when handling criminal cases, comply with the statutory procedures, follow the relevant technical standards, and collect and take case-related electronic data in a comprehensive, objective and timely manner, so as to ensure the veracity and integrity of the electronic data.   第二条 公安机关办理刑事案件应当遵守法定程序,遵循有关技术标准,全面、客观、及时地收集、提取涉案电子数据,确保电子数据的真实、完整。
Article 3 The obtainment of electronic data shall include without limitation:   第三条 电子数据取证包括但不限于:
(1) collection and taking of electronic data; (一)收集、提取电子数据;
(2) examination and investigative reenactment of electronic data; and (二)电子数据检查和侦查实验;
(3) inspection and appraisal of electronic data. (三)电子数据检验与鉴定。
Article 4 Where the obtainment of electronic data as evidence by public security authorities involves state secrets, police work secrets, trade secrets, or individual privacy, confidentiality shall be preserved; and any material obtained that is not relevant to the case shall be returned or destroyed in a timely manner.   第四条 公安机关电子数据取证涉及国家秘密、警务工作秘密、商业秘密、个人隐私的,应当保密;对于获取的材料与案件无关的,应当及时退还或者销毁。
Article 5 The electronic data accepted or requested in accordance with the law by public security authorities which is collected or taken by another state agency in accordance with the law in the course of administrative law enforcement or investigation and handling of cases may be used as evidence in criminal cases.   第五条 公安机关接受或者依法调取的其他国家机关在行政执法和查办案件过程中依法收集、提取的电子数据可以作为刑事案件的证据使用。
Chapter II Collection and Taking of Electronic Data 

第二章 收集提取电子数据

Section 1 General Rules 

第一节 一般规定

Article 6 The collection or taking of electronic data shall be carried out by two or more investigators. When necessary, a professional technician may be assigned or engaged to collect or take electronic data under the auspices of investigators.   第六条 收集、提取电子数据,应当由二名以上侦查人员进行。必要时,可以指派或者聘请专业技术人员在侦查人员主持下进行收集、提取电子数据。
Article 7 Electronic data may be collected or taken by one or several of the following measures or methods as needed by the circumstances of the case:   第七条 收集、提取电子数据,可以根据案情需要采取以下一种或者几种措施、方法:
(1) Impounding or placing seal on and preserving the original storage medium. (一)扣押、封存原始存储介质;
(2) Taking electronic data on site. (二)现场提取电子数据;
(3) Taking electronic data online. (三)网络在线提取电子数据;
(4) Freezing electronic data. (四)冻结电子数据;
(5) Requesting electronic data. (五)调取电子数据。
Article 8 Under any of the following circumstances, relevant evidence may be fixed by printing, photographing, video recording or any other means:   第八条 具有下列情形之一的,可以采取打印、拍照或者录像等方式固定相关证据:
(1) The original storage medium cannot be impounded, and the electronic data cannot be taken. (一)无法扣押原始存储介质并且无法提取电子数据的;
(2) The presence of a self-destruct function or device for electronic data entails the timely fixing of the relevant evidence. (二)存在电子数据自毁功能或装置,需要及时固定相关证据的;
(3) There is necessity for exhibiting and examining relevant electronic data on site. (三)需现场展示、查看相关电子数据的。
Upon the relevant evidence being fixed by printing, photographing, video recording or any other means according to the provisions of the sub-paragraphs (2) and (3) of the preceding paragraph, the original storage medium shall be impounded if possible; and if the original storage medium is impossible to impound but the electronic data can be taken, the electronic data shall be taken. 根据前款第二、三项的规定采取打印、拍照或者录像等方式固定相关证据后,能够扣押原始存储介质的,应当扣押原始存储介质;不能扣押原始存储介质但能够提取电子数据的,应当提取电子数据。
Article 9 Where relevant evidence is fixed by means of printing, photographing or video recording, the contents of the electronic data shall be clearly represented, the relevant transcripts shall specify the reason for fixing the relevant evidence by means of printing, photographing or video recording and information on where the electronic data is stored and the characteristics and place of the original storage medium, and the investigators or the electronic data holder (provider) shall affix signature or seal; and if the electronic data holder (provider) is unable to sign or denies signature, a note shall be made in the transcripts, and the witness shall affix signature or seal.   第九条 采取打印、拍照或者录像方式固定相关证据的,应当清晰反映电子数据的内容,并在相关笔录中注明采取打印、拍照或者录像等方式固定相关证据的原因,电子数据的存储位置、原始存储介质特征和所在位置等情况,由侦查人员、电子数据持有人(提供人)签名或者盖章;电子数据持有人(提供人)无法签名或者拒绝签名的,应当在笔录中注明,由见证人签名或者盖章。
Section 2 Impoundment and Placing a Seal on and Preservation of Original 

第二节 扣押、封存原始存储介质

Storage Media 
   第十条 在侦查活动中发现的可以证明犯罪嫌疑人有罪或者无罪、罪轻或者罪重的电子数据,能够扣押原始存储介质的,应当扣押、封存原始存储介质,并制作笔录,记录原始存储介质的封存状态。
Article 10 For electronic data discovered in the investigation activities evidencing that the criminal suspect is guilty or innocent or commits a trivial or grave crime, if the original storage medium is possible to impound, the original storage medium shall be impounded or preserved by placing a seal, and transcripts shall be prepared to record the preservation status of the original storage medium. 勘验、检查与电子数据有关的犯罪现场时,应当按照有关规范处置相关设备,扣押、封存原始存储介质。
When a crime scene related to electronic data is investigated and examined, the relevant equipment shall be disposed of in accordance with relevant rules, and the original storage medium shall be impounded and preserved by placing a seal. 
   第十一条 对扣押的原始存储介质,应当按照以下要求封存:
Article 11 The original storage medium impounded shall be preserved by placing a seal in accordance with the following requirements: 
 (一)保证在不解除封存状态的情况下,无法使用或者启动被封存的原始存储介质,必要时,具备数据信息存储功能的电子设备和硬盘、存储卡等内部存储介质可以分别封存;
(1) Ensuring that if the state of preservation by placing a seal is not terminated, the original storage medium cannot be used or activated, and if necessary, electronic equipment with data and information storage functionality and built-in storage media such as hard disks and the memory cards may be separately preserved by placing a seal. 
 (二)封存前后应当拍摄被封存原始存储介质的照片。照片应当反映原始存储介质封存前后的状况,清晰反映封口或者张贴封条处的状况;必要时,照片还要清晰反映电子设备的内部存储介质细节;
(2) Photographs of the original storage medium shall be taken before and after placing a seal for preservation. The photographs shall show the state of the original storage medium before and after placing a seal and clearly indicate the state of the place where the seal is placed; and if necessary, the photograph shall also clearly represent the details of the built-in storage media of the electronic equipment. 
 (三)封存手机等具有无线通信功能的原始存储介质,应当采取信号屏蔽、信号阻断或者切断电源等措施。
(3) When an original storage medium with wireless communication functionality such as mobile phone is preserved by placing a seal, measures such as signal jamming, signal blocking and power cut shall be adopted. 
   第十二条 对扣押的原始存储介质,应当会同在场见证人和原始存储介质持有人(提供人)查点清楚,当场开列《扣押清单》一式三份,写明原始存储介质名称、编号、数量、特征及其来源等,由侦查人员、持有人(提供人)和见证人签名或者盖章,一份交给持有人(提供人),一份交给公安机关保管人员,一份附卷备查。
Article 12 The original storage media impounded shall be clearly inventoried in conjunction with the witness present and the original storage medium holder (provider), and an Impoundment Inventory shall be made in triplicate on the spot, specifying the title, serial number, quantity, characteristics and sources, among others, of the original storage media, signed or sealed by the investigators, the holder (provider) and the witness, with one copy given to the holder (provider), another one delivered up to the custodian of the public security agency, and the remainder attached to the file and made available for inspection. 
   第十三条 对无法确定原始存储介质持有人(提供人)或者原始存储介质持有人(提供人)无法签名、盖章或者拒绝签名、盖章的,应当在有关笔录中注明,由见证人签名或者盖章。由于客观原因无法由符合条件的人员担任见证人的,应当在有关笔录中注明情况,并对扣押原始存储介质的过程全程录像。
Article 13 Where an original storage medium holder (provider) cannot be determined, or the original storage medium holder (provider) is unable to affix signature or seal or refuses to do so, a note shall be given in the relevant transcripts and signed or sealed by the witness. If it is impossible for a qualified person to act as a witness for objective reasons, a note as to the situation shall be given in the relevant transcripts, and a video recording of the whole process of impounding the original storage medium shall be made. 
   第十四条 扣押原始存储介质,应当收集证人证言以及犯罪嫌疑人供述和辩解等与原始存储介质相关联的证据。
Article 14 In the impoundment of an original storage medium, evidence related to the original storage medium such as witness statement and criminal suspect suspect's confession and defense. 
   第十五条 扣押原始存储介质时,可以向相关人员了解、收集并在有关笔录中注明以下情况:
Article 15 When an original storage medium is impounded, the following information may be requested and collected from relevant persons and stated in the relevant transcripts: 
 (一)原始存储介质及应用系统管理情况,网络拓扑与系统架构情况,是否由多人使用及管理,管理及使用人员的身份情况;
(1) The management of the original storage medium and the application system, network topology and system architecture, whether there is more than one user and administrator, and the identity of administrators and users. 
 (二)原始存储介质及应用系统管理的用户名、密码情况;
(2) The user name and password for the administration of the original storage medium and application system. 
 (三)原始存储介质的数据备份情况,有无加密磁盘、容器,有无自毁功能,有无其它移动存储介质,是否进行过备份,备份数据的存储位置等情况;
(3) Data backup of the original storage medium, whether there is an encrypted disk or container, whether there is self-destruct functionality, whether there is another mobile storage medium, whether the backup has been performed, the storage location of the backup data, and the like. 
 (四)其他相关的内容。
(4) Contents otherwise relevant. 
 

第三节 现场提取电子数据

Section 3 Taking Electronic Data on the Scene 
   第十六条 具有下列无法扣押原始存储介质情形之一的,可以现场提取电子数据:
Article 16 Under any of the following circumstances in which the original storage medium cannot be impounded, the electronic data may be taken on the scene: 
 (一)原始存储介质不便封存的;
(1) The original storage medium is not suitable for preservation by placing a seal. 
 (二)提取计算机内存数据、网络传输数据等不是存储在存储介质上的电子数据的;
(2) Computer memory data, network transmission data, or other electronic data which is not stored on a storage medium is taken. 
 (三)案件情况紧急,不立即提取电子数据可能会造成电子数据灭失或者其他严重后果的;
(3) The case is urgent, and the failure to immediately take electronic data may result in the destruction or loss of electronic data or other serious consequences. 
 (四)关闭电子设备会导致重要信息系统停止服务的;
(4) Shutting down electronic equipment may cause an important information system to cease functioning. 
 (五)需通过现场提取电子数据排查可疑存储介质的;
(5) There is necessity for screening the suspicious storage medium by taking electronic data on the scene. 
 (六)正在运行的计算机信息系统功能或者应用程序关闭后,没有密码无法提取的;
(6) When the computer information system or application is shut down, the taking is impossible without password. 
 (七)其他无法扣押原始存储介质的情形。
(7) Otherwise impossible to impound the original storage medium. 无法扣押原始存储介质的情形消失后,应当及时扣押、封存原始存储介质。
When the impossibility of impounding the original storage medium ceases to exist, the original storage medium shall be impounded or preserved by placing a seal in a timely manner. 
   第十七条菊花碎了一地 现场提取电子数据可以采取以下措施保护相关电子设备:
Article 17 When electronic data is taken on the scene, the following measures may be adopted to protect related electronic equipment: 
 (一)及时将犯罪嫌疑人或者其他相关人员与电子设备分离;
(1) Separating the criminal suspect or any other related person from the electronic equipment in a timely manner. 
 (二)在未确定是否易丢失数据的情况下,不能关闭正在运行状态的电子设备;
(2) If whether there is vulnerability to loss of data is uncertain, the electronic equipment in the running state may not be shut down. 
 (三)对现场计算机信息系统可能被远程控制的,应当及时采取信号屏蔽、信号阻断、断开网络连接等措施;
(3) If the computer information system on the scene may be remotely controlled, measures such as signal jamming, signal blocking, and disconnection of the network shall be adopted in a timely manner. 
 (四)保护电源;
(4) Protecting the power supply. 
 (五)有必要采取的其他保护措施。
(5) Protective measures otherwise necessary. 
   第十八条 现场提取电子数据,应当遵守以下规定:
Article 18 When electronic data is taken on the scene, the following provisions shall be observed: 
 (一)不得将提取的数据存储在原始存储介质中;
(1) The data taken shall not be stored on the original storage medium. 
 (二)不得在目标系统中安装新的应用程序。如果因为特殊原因,需要在目标系统中安装新的应用程序的,应当在笔录中记录所安装的程序及目的;
(2) No new application program may be installed in the target system. If there is necessity for installing a new application program in the target system for special reasons, the installed program and object shall be stated in the transcripts. 
 (三)应当在有关笔录中详细、准确记录实施的操作。
(3) The operations performed shall be stated in detail and accurately in the relevant transcripts. 
   第十九条 现场提取电子数据,应当制作《电子数据现场提取笔录》,注明电子数据的来源、事由和目的、对象、提取电子数据的时间、地点、方法、过程、不能扣押原始存储介质的原因、原始存储介质的存放地点,并附《电子数据提取固定清单》,注明类别、文件格式、完整性校验值等,由侦查人员、电子数据持有人(提供人)签名或者盖章;电子数据持有人(提供人)无法签名或者拒绝签名的,应当在笔录中注明,由见证人签名或者盖章。
Article 19 When electronic data is taken on site, a Transcript of Taking Electronic Data on the Scene shall be prepared, stating the source of electronic data, cause and purpose, objects, the time, place, method and process of taking electronic data, the reason for impossibility of impounding the original storage medium, and the storage location of the original storage medium, with an Inventory of Taken and Fixed Electronic Data attached, stating the category, file format, checksum, and so forth, and signed or sealed by the investigators and electronic data holder (provider); and if the electronic data holder (provider) is unable to sign or denies signature, a note shall be made in the transcripts, and the witness shall affix signature or seal. 
   第二十条 对提取的电子数据可以进行数据压缩,并在笔录中注明相应的方法和压缩后文件的完整性校验值。
Article 20 The electronic data taken may be compressed, and the corresponding method and the checksum of the compressed file shall be stated in the transcripts. 
   第二十一条 由于客观原因无法由符合条件的人员担任见证人的,应当在《电子数据现场提取笔录》中注明情况,并全程录像,对录像文件应当计算完整性校验值并记入笔录。
Article 21 Where a qualified person is unable to serve as witness for objective reasons, a note shall be made in the Transcript of Taking Electronic Data on the Scene, a video recording shall be made in the whole process, and the checksum for the video recording shall be computed and stated in the transcripts. 
   第二十二条 对无法扣押的原始存储介质且无法一次性完成电子数据提取的,经登记、拍照或者录像后,可以封存后交其持有人(提供人)保管,并且开具《登记保存清单》一式两份,由侦查人员、持有人(提供人)和见证人签名或者盖章,一份交给持有人(提供人),另一份连同照片或者录像资料附卷备查。
Article 22 An original storage medium that is impossible to impound, or electronic data which is impossible to take at one time may, upon registration, photographing or video recording, be preserved by placing a seal and delivered up to the holder (provider) for custody, and a Registration and Preservation Inventory shall be issued in duplicate and signed or sealed by the investigators, the holder (provider) and the witness, with one copy for the holder (provider) and the other attached to the file with photographs or video recordings for inspection. 持有人(提供人)应当妥善保管,不得转移、变卖、毁损,不得解除封存状态,不得未经办案部门批准接入网络,不得对其中可能用作证据的电子数据增加、删除、修改。必要时,应当保持计算机信息系统处于开机状态。
The holder (provider) shall exercise due safekeeping and may not conduct transfer, sale or damage, terminate the state of preservation by placing a seal, access the network without the approval of the case handling authority, nor increase, delete or modify the electronic data that may be used as evidence. If necessary, the computer information system shall remain on. 对登记保存的原始存储介质,应当在七日以内作出处理决定,逾期不作出处理决定的,视为自动解除。经查明确实与案件无关的,应当在三日以内解除。
For the original storage medium registered and stored, a processing decision shall be made within seven days, and any failure to do so shall be deemed as automatic termination. If non-relevancy to the case is established, termination shall be made within three days. 
 

第四节 网络在线提取电子数据

Section 4 Taking Electronic Data Online 
   第二十三条 对公开发布的电子数据、境内远程计算机信息系统上的电子数据,可以通过网络在线提取。
Article 23 Electronic data publicly accessible or on a domestic distance computer information system may be taken online. 
   第二十四条 网络在线提取应当计算电子数据的完整性校验值;必要时,可以提取有关电子签名认证证书、数字签名、注册信息等关联性信息。
Article 24 For online taking, the checksum of the electronic data shall be computed; and if necessary, the related information such as relevant electronic signature authentication certificates, digital signature, and registration information may be taken. 
   第二十五条 网络在线提取时,对可能无法重复提取或者可能会出现变化的电子数据,应当采用录像、拍照、截获计算机屏幕内容等方式记录以下信息:
Article 25 For online taking of electronic data that may not be repeatedly taken or may change, the following information shall be recorded by video recording, photographing, creating a screen capture, or any other means: 
 (一)远程计算机信息系统的访问方式;
(1) The means to access the distance computer information system. 
 (二)提取的日期和时间;
(2) The date and time of taking. 
 (三)提取使用的工具和方法;
(3) Instrumentalities and methods used for the taking. 
 (四)电子数据的网络地址、存储路径或者数据提取时的进入步骤等;
(4) The IP address or storage path of the electronic data, the access procedure at the time of data taking, or the like. 
 (五)计算完整性校验值的过程和结果。
(5) The process and results of calculating the checksum. 
   第二十六条 网络在线提取电子数据应当在有关笔录中注明电子数据的来源、事由和目的、对象,提取电子数据的时间、地点、方法、过程,不能扣押原始存储介质的原因,并附《电子数据提取固定清单》,注明类别、文件格式、完整性校验值等,由侦查人员签名或者盖章。
Article 26 For online taking of electronic data, the relevant transcripts shall specify the source of the electronic data, cause, purpose and object, the time, place, method and process of taking the electronic data, and the reason for the impossibility of impounding the original storage medium, with an Inventory of Taken and Fixed Electronic Data attached, stating the category, file format, checksum, and the like and signed or sealed by the investigators. 
   第二十七条 网络在线提取时需要进一步查明下列情形之一的,应当对远程计算机信息系统进行网络远程勘验:
Article 27 Where there is necessity for further establishing any of the following circumstances at the time of online taking, the distance computer information system shall be investigated remotely online: 
 (一)需要分析、判断提取的电子数据范围的;
(1) There is necessity for analyzing and calculating the scope of taking electronic data. 
 (二)需要展示或者描述电子数据内容或者状态的;
(2) There is necessity for exhibiting or describing the subject matter or status of electronic data. 
 (三)需要在远程计算机信息系统中安装新的应用程序的;
(3) There is necessity for installing a new application program in the distance computer information system. 
 (四)需要通过勘验行为让远程计算机信息系统生成新的除正常运行数据外电子数据的;
(4) There is necessity for enabling the distance computer information system to generate new electronic data other than the normal operation data through the investigation. 
 (五)需要收集远程计算机信息系统状态信息、系统架构、内部系统关系、文件目录结构、系统工作方式等电子数据相关信息的;
(5) There is necessity for collecting electronic data-related information such as the status, system architecture, internal system relationship, file directory structure, system working mode and the like of the distance computer information system. 
 (六)其他网络在线提取时需要进一步查明有关情况的情形。
(6) Other circumstances in which there is for further establishing related information at the time of online taking. 
   第二十八条 网络远程勘验由办理案件的县级公安机关负责。上级公安机关对下级公安机关刑事案件网络远程勘验提供技术支援。对于案情重大、现场复杂的案件,上级公安机关认为有必要时,可以直接组织指挥网络远程勘验。
Article 28 Online distance investigation shall be undertaken by case-handling county public security authorities. Higher-level public security authorities shall provide technical support for the online distance investigation by lower-level public security authorities in criminal cases. For a case with significant facts and a complicated scene, the higher-level public security authority may directly organize and direct an online distance investigation as it deems necessary. 
   第二十九条 网络远程勘验应当统一指挥,周密组织,明确分工,落实责任。
Article 29 For online distance investigations, unified direction, prudential organization, clear division of labor, and implementation of responsibilities shall be effected. 
   第三十条 网络远程勘验应当由符合条件的人员作为见证人。由于客观原因无法由符合条件的人员担任见证人的,应当在《远程勘验笔录》中注明情况,并按照本规则第二十五条的规定录像,录像可以采用屏幕录像或者录像机录像等方式,录像文件应当计算完整性校验值并记入笔录。
Article 30 Online distance investigations, a qualified person shall serve as witness. If he or she is unable to do so for objective reasons, a note shall be made in the Transcript of Distance Investigation, and a video recording shall be made in accordance with the provisions of Article 25 of these Rules, by video screen capture, camera, or any other means, and for video files, the checksum shall be computed and stated in the transcripts. 
   第三十一条 远程勘验结束后,应当及时制作《远程勘验笔录》,详细记录远程勘验有关情况以及勘验照片、截获的屏幕截图等内容。由侦查人员和见证人签名或者盖章。
Article 31 Upon distance investigation, a Transcript of Distance Investigation shall be prepared in a timely manner, containing in detail information on the distance investigation, investigation photographs, screen captures, and other contents. The investigators and witnesses shall be affix signature or seal. 远程勘验并且提取电子数据的,应当按照本规则第二十六条的规定,在《远程勘验笔录》注明有关情况,并附《电子数据提取固定清单》。
In the case of distance investigation and taking of electronic data, the relevant information shall be stated in the Transcript of Distance Investigation in accordance with the provisions of Article 26 of these Rules, with an Inventory of Taken and Fixed Electronic Data attached. 
   第三十二条 《远程勘验笔录》应当客观、全面、详细、准确、规范,能够作为还原远程计算机信息系统原始情况的依据,符合法定的证据要求。
Article 32 A Transcript of Distance Investigation shall be objective, comprehensive, detailed, accurate, well-regulated, able to function as the basis for representing the original information on the distance computer information system, and in conformity with the statutory requirements for evidence. 对计算机信息系统进行多次远程勘验的,在制作首次《远程勘验笔录》后,逐次制作补充《远程勘验笔录》。
If more than one distance investigation on the computer information system is conducted, supplemental Transcript(s) of Distance Investigation shall be made subsequent to the first Transcript of Distance Investigation. 
   第三十三条 网络在线提取或者网络远程勘验时,应当使用电子数据持有人、网络服务提供者提供的用户名、密码等远程计算机信息系统访问权限。
Article 33 For online taking or online distance investigation, the user name, password and other access authority provided by electronic data holders and network service providers shall be used. 采用技术侦查措施收集电子数据的,应当严格依照有关规定办理批准手续。收集的电子数据在诉讼中作为证据使用时,应当依照刑事诉讼法一百五十四条规定执行。
If technical investigation measures are used to collect electronic data, approval procedures shall be instituted in strict accordance with relevant rules. When the collected electronic data is used as evidence in legal proceedings, the provisions of Article 154 of the Criminal Procedure Law shall apply. 
   第三十四条 对以下犯罪案件,网络在线提取、远程勘验过程应当全程同步录像:
Article 34 For the following criminal cases, a real-time video recording of online taking and distance investigation shall be made in the whole process: 
 (一)严重危害国家安全、公共安全的案件;
(1) Cases that seriously endanger national security or public security. 
 (二)电子数据是罪与非罪、是否判处无期徒刑、死刑等定罪量刑关键证据的案件;
(2) Cases in which electronic data is critical evidence for conviction and sentencing such as finding guilty or innocent and whether life imprisonment or capital punishment is administered. 
 (三)社会影响较大的案件;
(3) Cases with a relatively considerable social impact. 
 (四)犯罪嫌疑人可能被判处五年有期徒刑以上刑罚的案件;
(4) Cases in which the criminal suspect may be sentenced to a fixed-term imprisonment of five years or a severer punishment. 
 (五)其他需要全程同步录像的重大案件。
(5) Major cases otherwise requiring real-time video recording. 
   第三十五条 网络在线提取、远程勘验使用代理服务器、点对点传输软件、下载加速软件等网络工具的,应当在《网络在线提取笔录》或者《远程勘验笔录》中注明采用的相关软件名称和版本号。
Article 35 Where a proxy server, peer-to-peer transfer software, download acceleration software or any other network tool is used for online taking or distance investigation, the title and version number of the relevant software shall be noted in the Transcript of Online Taking or the Transcript of Distance Investigation. 
 

第五节 冻结电子数据

Section 5 Freezing Electronic Data 
   第三十六条 具有下列情形之一的,可以对电子数据进行冻结:
Article 36 Under any of the following circumstances, electronic data may be frozen: 
 (一)数据量大,无法或者不便提取的;
(1) The data is massive, rendering its taking impossible or inconvenient. 
 (二)提取时间长,可能造成电子数据被篡改或者灭失的;
(2) The lengthy duration of taking may cause the electronic data to be tampered with or lost. 
 (三)通过网络应用可以更为直观地展示电子数据的;
(3) Electronic data may be exhibited more visually through web applications. 
 (四)其他需要冻结的情形。
(4) Circumstances otherwise entailing freezing. 
 

装完逼就跑

  第三十七条 冻结电子数据,应当经县级以上公安机关负责人批准,制作《协助冻结电子数据通知书》,注明冻结电子数据的网络应用账号等信息,送交电子数据持有人、网络服务提供者或者有关部门协助办理。
Article 37 For the freezing of electronic data, a Notice of Assistance in Freezing Electronic Data shall, with the approval of the person in charge of the public security authority at or above the county level, be prepared, stating the information for freezing electronic data such as accounts for web applications, and delivered to the electronic data holder, network service provider or relevant authority for assistance. 
   第三十八条 不需要继续冻结电子数据时,应当经县级以上公安机关负责人批准,在三日以内制作《解除冻结电子数据通知书》,通知电子数据持有人、网络服务提供者或者有关部门执行。
Article 38 When there is no necessity for continuing to freeze electronic data, a Notice of Unfreezing Electronic Data shall, with the approval of the person in charge of the public security authority at or above the county level, be prepared within three days and given to the electronic data holder, network service provider, or the relevant authority for implementation. 
   第三十九条 冻结电子数据的期限为六个月。有特殊原因需要延长期限的,公安机关应当在冻结期限届满前办理继续冻结手续。每次续冻期限最长不得超过六个月。继续冻结的,应当按照本规则第三十七条的规定重新办理冻结手续。逾期不办理继续冻结手续的,视为自动解除。
Article 39 The time limit for freezing electronic data shall be six months. If renewal is necessary for special reasons, the public security authority shall institute the procedures for renewing the freezing before the expiration of the time limit. The period for each renewal shall not exceed six months. If the freezing continues, the freezing procedures shall be re-instituted in accordance with the provisions of Article 37 of these Rules. Non-institution of the procedures for renewing the freezing within the time limit shall be deemed as automatic unfreezing. 
   第四十条 冻结电子数据,应当采取以下一种或者几种方法:
Article 40 Electronic data shall be frozen by one or several of the following methods: 
 (一)计算电子数据的完整性校验值;
(1) Computing the checksum for the electronic data. 
 (二)锁定网络应用账号;
(2) Locking accounts for web applications. 
 (三)采取写保护措施;
(3) Adopting write protection measures. 
 (四)其他防止增加、删除、修改电子数据的措施。
(4) Other measures to prevent the addition, deletion and modification of electronic data. 
 

第六节 调取电子数据

Section 6 Requesting Electronic Data 
   第四十一条 公安机关向有关单位和个人调取电子数据,应当经办案部门负责人批准,开具《调取证据通知书》,注明需要调取电子数据的相关信息,通知电子数据持有人、网络服务提供者或者有关部门执行。被调取单位、个人应当在通知书回执上签名或者盖章,并附完整性校验值等保护电子数据完整性方法的说明,被调取单位、个人拒绝盖章、签名或者附说明的,公安机关应当注明。必要时,应当采用录音或者录像等方式固定证据内容及取证过程。
Article 41 When the public security authority is to request electronic data by the relevant entity or individual, the public security authority shall, with the approval of the person in charge of the case handling authority, issue a Notice of Request for Evidence, stating the information relating to the necessity for requesting electronic data, and notify the electronic data holder, network service provider, or relevant authority for implementation. The respondent entity or individual shall sign or seal the acknowledgment of the notice and attach a description of the method to protect the integrity of the electronic data such as checksum, and if the respondent entity or individual refuses to do so, the public security authority shall made a note. When necessary, the subject matter of the evidence and the process of evidence taking shall be fixed by means such as audio recording and video recording. 公安机关应当协助因客观条件限制无法保护电子数据完整性的被调取单位、个人进行电子数据完整性的保护。
The public security authority shall assist the respondent entity or individual incapable of protecting the integrity of electronic data due to objective conditions in so doing. 
   第四十二条 公安机关跨地域调查取证的,可以将《办案协作函》和相关法律文书及凭证传真或者通过公安机关信息化系统传输至协作地公安机关。协作地办案部门经审查确认后,在传来的法律文书上加盖本地办案部门印章后,代为调查取证。
Article 42 Where the public security authority investigates and obtains evidence across regions, it may deliver the Letter of Cooperation in Case Handling and related legal documents and proof by fax or the public security authority information technology-enabled system to the public security authority in the place of cooperation. The case-handling authority in the place of cooperation shall, upon examination and confirmation, affix its seal to the received legal documents and conduct the investigation and obtainment of evidence on behalf. 协作地办案部门代为调查取证后,可以将相关法律文书回执或者笔录邮寄至办案地公安机关,将电子数据或者电子数据的获取、查看工具和方法说明通过公安机关信息化系统传输至办案地公安机关。
The case-handling authority in the place of cooperation may, upon on-behalf investigation and obtainment of evidence, mail the acknowledgment of the relevant legal documents or transcripts to the public security authority in the place of case handling and transmit the electronic data, or the instrumentality to acquire or view the electronic data and instruction manual to the same through the public security authority information technology-enabled system. 办案地公安机关应当审查调取电子数据的完整性,对保证电子数据的完整性有疑问的,协作地办案部门应当重新代为调取。
The public security authority in the place of case handling shall examine the integrity of the received electronic data, and if the integrity of electronic data is suspected, the case-handling authority in the place of cooperation shall re-obtain evidence on behalf. 
 

第三章 电子数据的检查和侦查实验

Chapter III Examination and Investigative Reenactment of Electronic Data 
 

第一节 电子数据检查

Section 1 Examination of Electronic Data 
   第四十三条 对扣押的原始存储介质或者提取的电子数据,需要通过数据恢复、破解、搜索、仿真、关联、统计、比对等方式,以进一步发现和提取与案件相关的线索和证据时,可以进行电子数据检查。
Article 43 When, with respect to an original storage medium impounded or electronic data taken, there is necessity for further discovering and taking case-related clues and evidence by data recovery, cracking, searching, simulation, correlation, statistics, comparison, and other means, electronic data may be examined. 
   第四十四条 电子数据检查,应当由二名以上具有专业技术的侦查人员进行。必要时,可以指派或者聘请有专门知识的人参加。
Article 44 An examination of electronic data shall be conducted by two or more investigators with professional skills. If necessary, a person with expertise may be assigned or engaged to participate. 
   第四十五条 电子数据检查应当符合相关技术标准。
Article 45 The examination of electronic data shall comply with relevant technical standards. 
   第四十六条 电子数据检查应当保护在公安机关内部移交过程中电子数据的完整性。移交时,应当办理移交手续,并按照以下方式核对电子数据:
Article 46 In the examination of electronic data, the integrity of electronic data during the handover within the public security authority shall be protected. At the time of handover, the handover procedures shall be instituted, and the electronic data shall be verified according to the following means: 
 (一)核对其完整性校验值是否正确;
(1) Verifying whether the checksum is correct. 
 (二)核对封存的照片与当前封存的状态是否一致。
(2) Verifying whether the sealing photograph is consistent with the current sealing state. 对于移交时电子数据完整性校验值不正确、原始存储介质封存状态不一致或者未封存可能影响证据真实性、完整性的,检查人员应当在有关笔录中注明。
If the checksum for the electronic data is incorrect at the time of handover, the sealing state of the original storage medium is inconsistent, or the failure to place a seal may affect the veracity and integrity of the evidence, the examiners shall make a note in the relevant transcripts. 
   第四十七条 检查电子数据应当遵循以下原则:
Article 47 The examination of electronic data shall be subject to the following principles: 
 (一)通过写保护设备接入到检查设备进行检查,或者制作电子数据备份、对备份进行检查;
(1) Conducting examination by connecting the write-protection device to the examination equipment, or making a backup of electronic data and examining the backup. 
 (二)无法使用写保护设备且无法制作备份的,应当注明原因,并全程录像;
(2) If the use of a write-protection device cannot be used and the making of a backup is impossible, the reason shall be stated, and a video recording shall be made in the whole process. 
 (三)检查前解除封存、检查后重新封存前后应当拍摄被封存原始存储介质的照片,清晰反映封口或者张贴封条处的状况;
(3) Photographs of the original storage medium preserved by placing a seal shall be taken before and after the termination of preservation and the renewal of preservation, clearly depicting the conditions of the seal. 
 (四)检查具有无线通信功能的原始存储介质,应当采取信号屏蔽、信号阻断或者切断电源等措施保护电子数据的完整性。
(4) In the examination of an original storage medium with wireless communication functionality, measures such as signal jamming, signal blocking and power cut shall be taken to protect the integrity of electronic data. 
   第四十八条 检查电子数据,应当制作《电子数据检查笔录》,记录以下内容:
Article 48 For the examination of electronic data, a Transcript of Examination of Electronic Data shall be prepared, stating the following: 
 (一)基本情况。包括检查的起止时间,指挥人员、检查人员的姓名、职务,检查的对象,检查的目的等;
(1) Basic information including the start and end time of the examination, the names and offices of the director and examiners, the object of the examination, and the purpose of the examination. 
 (二)检查过程。包括检查过程使用的工具,检查的方法与步骤等;
(2) Examination process including the instrumentalities used in the examination and the methods and steps of the examination. 
 (三)检查结果。包括通过检查发现的案件线索、电子数据、等相关信息。
(3) Examination results including case clues discovered by examination, electronic data, and other related information. 
 (四)其他需要记录的内容。
(4) Contents otherwise required to be stated. 
   第四十九条 电子数据检查时需要提取电子数据的,应当制作《电子数据提取固定清单》,记录该电子数据的来源、提取方法和完整性校验值。
Article 49 Where there is necessity for taking electronic data at the time of examination of electronic data, an Inventory of Taken and Fixed Electronic Data shall be made, stating the source of the electronic data, taking method and checksum. 
 

第二节 电子数据侦查实验

Section 2 Investigative Reenactment of Electronic Data 
   第五十条 为了查明案情,必要时,经县级以上公安机关负责人批准可以进行电子数据侦查实验。
Article 50 In order to establish the facts of a case, if necessary, investigative reenactment of electronic data may be conducted when necessary with the approval of the person in charge of the public security authority at or above the county level. 
   第五十一条 电子数据侦查实验的任务包括:
Article 51 The tasks for investigative reenactment of electronic data shall include: 
 (一)验证一定条件下电子设备发生的某种异常或者电子数据发生的某种变化;
(1) verifying certain abnormalities in electronic equipment or certain changes in electronic data under certain conditions; 
 (二)验证在一定时间内能否完成对电子数据的某种操作行为;
(2) verifying whether certain operational actions on electronic data can be completed within a certain period of time; 
 (三)验证在某种条件下使用特定软件、硬件能否完成某种特定行为、造成特定后果;
(3) verifying whether certain software or hardware can be used under certain conditions to perform a specific act or have specific consequences; 
 (四)确定一定条件下某种计算机信息系统应用或者网络行为能否修改、删除特定的电子数据;
(4) Determining whether a certain computer information system application or network behavior can modify or delete specific electronic data under certain conditions; 
 (五)其他需要验证的情况。
(5) Circumstances otherwise requiring verification. 
   第五十二条 电子数据侦查实验应当符合以下要求:
Article 52 The investigative reenactment of electronic data shall meet the following requirements: 
 (一)应当采取技术措施保护原始存储介质数据的完整性;
(1) Technical measures shall be used to protect the integrity of the data on an original storage medium. 
 (二)有条件的,电子数据侦查实验应当进行二次以上;
(2) If conditions permit, the investigative reenactment of electronic data shall be conducted twice or more. 
 (三)侦查实验使用的电子设备、网络环境等应当与发案现场一致或者基本一致;必要时,可以采用相关技术方法对相关环境进行模拟或者进行对照实验;
(3) The electronic equipment, network environment and the like used in the investigative reenactment shall be consistent or basically consistent with the crime scene; and if necessary, relevant technical methods may be used to simulate or conduct a controlled experiment on the relevant environment. 
 (四)禁止可能泄露公民信息或者影响非实验环境计算机信息系统正常运行的行为。
(4) Conduct that may divulge citizens' information or affect the normal operation of computer information systems in non-experimental environments shall be prohibited. 
   第五十三条 进行电子数据侦查实验,应当使用拍照、录像、录音、通信数据采集等一种或多种方式客观记录实验过程。
Article 53 When investigative reenactment of electronic data is conducted, the process of the investigative reenactment shall be objectively recorded by one or more means such as photographing, video recording, audio recording, and collection of communication data. 
   第五十四条 进行电子数据侦查实验,应当制作《电子数据侦查实验笔录》,记录侦查实验的条件、过程和结果,并由参加侦查实验的人员签名或者盖章。
Article 54 When investigative reenactment of electronic data is conducted, a Transcript of Investigative Reenactment of Electronic Data shall be prepared, stating the conditions, process and results of the investigative reenactment, and signed or sealed by the participants in the investigative reenactment. 
 

第四章 电子数据委托检验与鉴定

Chapter IV Commissioned Inspection and Appraisal of Electronic Data 
   第五十五条 为了查明案情,解决案件中某些专门性问题,应当指派、聘请有专门知识的人进行鉴定,或者委托公安部指定的机构出具报告。
Article 55 In order to establish the facts of a case and resolve certain specialist problems in the case, a person with expertise shall be assigned or engaged to conduct an appraisal, or an establishment designated by the Ministry of Public Security shall be commissioned to issue a report. 需要聘请有专门知识的人进行鉴定,或者委托公安部指定的机构出具报告的,应当经县级以上公安机关负责人批准。
In such a case, the approval of the person in charge of the public security authority at or above the county level shall be obtained. 
   第五十六条 侦查人员送检时,应当封存原始存储介质、采取相应措施保护电子数据完整性,并提供必要的案件相关信息。
Article 56 Investigators shall, at the time of submission for inspection, preserve the original storage medium by placing a seal, adopt corresponding measures to protect the integrity of electronic data, and provide necessary case-related information. 
   第五十七条 公安部指定的机构及其承担检验工作的人员应当独立开展业务并承担相应责任,不受其他机构和个人影响。
Article 57 An establishment designated by the Ministry of Public Security and its employee charged with inspection shall independently conduct business and assume corresponding liability, without being affected by another establishment or individual. 
   第五十八条 公安部指定的机构应当按照法律规定和司法审判机关要求承担回避、保密、出庭作证等义务,并对报告的真实性、合法性负责。
Article 58 The establishments designated by the Ministry of Public Security shall, in accordance with the provisions of the law and the requirements of the judiciary, assume obligations such as disqualification, confidentiality, and testifying before court and be responsible for the veracity and legality of reports. 公安部指定的机构应当运用科学方法进行检验、检测,并出具报告。
The establishments designated by the Ministry of Public Security shall use scientific methods for inspections and tests and issue reports. 
   第五十九条 公安部指定的机构应当具备必需的仪器、设备并且依法通过资质认定或者实验室认可。
Article 59 The establishments designated by the Ministry of Public Security shall have requisite instruments and equipment and be qualified or accredited with being a laboratory according to the law. 
   第六十条 委托公安部指定的机构出具报告的其他事宜,参照《公安机关鉴定规则》等有关规定执行。
Article 60 The Rules of Appraisal by Public Security Authorities and other relevant rules shall apply mutatis mutandis to other matters as to commissioning the establishments designated by the Ministry of Public Security to issue a report. 
 

第五章 附 则

Chapter V Supplemental Provision 
   第六十一条 本规则自2019年2月1日起施行。公安部之前发布的文件与本规则不一致的,以本规则为准。
Article 61 These Rules shall come into force on February 1, 2019. If any document previously issued by the Ministry of Public Security is inconsistent with these Rules, these Rules shall prevail. 法小宝 
     
     
Scan QR Code and Read on Mobile
【法宝引证码】        北大法宝en.pkulaw.cn
Message: Please kindly comment on the present translation.
 
Confirmation Code:
Click image to reset code
 
  Translations are by lawinfochina.com, and we retain exclusive copyright over content found on our website except for content we publish as authorized by respective copyright owners or content that is publicly available from government sources.

Due to differences in language, legal systems, and culture, English translations of Chinese law are for reference purposes only. Please use the official Chinese-language versions as the final authority. Lawinfochina.com and its staff will not be directly or indirectly liable for use of materials found on this website.

We welcome your comments and suggestions, which assist us in continuing to improve the quality of our materials as we dynamically expand content.
 
Home | About us | Disclaimer | Chinese