On March 29th, the first part of the series of activities of “Criminal Case Thinking and Debating” organized by the Criminal Department of King&Capital Law Firm was successfully held in Beijing. The theme of this activity is “how lawyers use electronic evidence to expand the idea of handling cases”, shared by the King&Capital Law Firm senior partner, criminal three partners in charge of Peng Jiyue lawyers, and specially invited the People's University of China Physical Evidence Technology Appraisal Center, electronic data appraisal teacher Mao Zijian, on the application of electronic evidence in criminal cases and practical operation of an in-depth discussion. He also invited Mr. Mao Zhanjian, an expert in electronic data from the Appraisal Center for Physical Evidence Technology of Renmin University of China, to discuss the application of electronic evidence in criminal cases.
At the beginning of the event, the host, Ms. Ma Huiwen, welcomed all the guests and friends to the meeting. At the same time, Mr. Zhu Yonghui, Director of King&Capital Law Firm, sent a congratulatory message for this event. In the message, Mr. Zhu expressed his congratulations and expectations for the series of activities, emphasizing that business learning and internal training not only show the spirit of pursuing excellence of King&Capital people, but also the embodiment of King&Capital people's continuous improvement of the professional level of legal services.
Ms. Vivian Ma
Mr. Peng Jiyue focused on the use of electronic evidence in criminal defense, and made an in-depth analysis from the formation principle, extraction process, review points and other levels of electronic evidence. Combined with his own rich experience in handling cases, he shared how to accurately grasp the proving ability and probative power of electronic evidence by analyzing it in practice. Mr. Peng discussed from four parts: the importance of electronic evidence, the “three elements” of electronic evidence, the common problems in reviewing the “three elements” of electronic evidence, and the analysis of the Xunbao case.
Peng Jiyue
Part I: The importance of electronic evidence
In the current legal environment, electronic evidence has become a form of evidence that cannot be ignored and is relatively common. It plays a crucial role in criminal and civil cases and often has a significant impact on key facts. In cases of different types of crime, electronic evidence may sometimes become a “lynch pin”, revealing key issues. For example, some electronic evidence is more direct than other evidence in proving the hierarchy of pyramid schemes, the amount of money involved in the case, the existence of criminal contact, and the amount of illegal income.
Part II: The “Three Elements” of Electronic Evidence
Mr. Peng emphasized that the key to the review of electronic evidence lies in the three core elements, i.e., the process of obtaining evidence, the electronic evidence itself and the appraisal opinion. These three core elements ensure the legitimacy, integrity and authenticity of electronic evidence.
1, the forensic process: because the electronic evidence itself with technical dependence, easy to disappear, virtual and other characteristics, so involving the extraction of electronic data, sealing and preservation process, requires detailed records and standardized operation, in order to ensure the originality and integrity of electronic data.
2, the electronic evidence itself: although the electronic evidence itself is invisible, untouchable, but also case officers and lawyers can not touch the evidence, but the existence of any electronic evidence will certainly be embodied through a certain medium exists.
3, appraisal: appraisal as electronic data after extraction, verification, screening, analysis of the formation of the “finished product”, such opinions often directly affect the judge's judgment, for the appraisal, as a lawyer need to seriously examine.
The third part: electronic evidence “three elements” review of common problems
Peng lawyer pointed out:
1, in the process of electronic data extraction, common problems are:
(1) should be carried out by more than two investigators. Sometimes only one investigator's signature on the transcript, or the signature of the person itself is not an investigator. (2) In principle, the original storage media should be seized and sealed, and the sealing requires a detailed record of the unique characteristics of the storage media. (3) There is no record of the process of sealing the storage media and the state of sealing. (4) There shall be at least one witness. (5) If there is no witness, the extraction process shall be videotaped. (6) The production of transcripts should record the cause of the case, the object, content, collection, extraction of electronic data, time, location, method, process. (7) With a list of electronic data, indicating the category, file format, integrity check value. (8) Investigators, electronic data holder (provider) signature or seal. (9) electronic data holders (provider) can not sign or refused to sign, it should be noted in the transcript, signed or stamped by the witness. (10) extraction transcripts recorded in the integrity of the check value and appraisal opinions and other documents embodied in the check value is inconsistent. (11) should be made to extract the transcript, some do not extract the transcript.
2, for the electronic data itself, lawyers in the case process, to focus on reviewing the following aspects:
(1) the source of electronic data. Electronic data is different from the traditional evidence, if there is no process to prove the source, its authenticity is questionable. (2) review whether the electronic evidence is complete, with or without deletion. Often embodied in the transcript of a certain information from electronic evidence, but the electronic evidence does not reflect the information, indicating that there is an incompleteness of electronic evidence. (3) Concerned about whether the electronic evidence integrity check value before and after the same. Each piece of electronic evidence is unique, although the identity of electronic evidence embodies different expressions, but the hash value is still relatively common used to verify the electronic evidence of reference data, lawyers should pay attention to electronic evidence before and after the process of hash value is the same. (4) focus on electronic evidence creation, modification, access time. Electronic evidence is different from traditional evidence, once accessed, modified, will leave traces. Electronic data, ancillary information evidence and associated traces of evidence is often a “trinity”, can completely reflect the process of electronic data changes. In some cases, there is indeed electronic data is extracted and then accessed, so it is difficult to ensure the authenticity of electronic evidence. (5) also pay attention to the relevance of electronic evidence and facts to be proved, pay attention to whether the electronic data is used as the basis for identification.
On the identification of opinions, mainly from three aspects to be examined. First of all, from the source of samples for review. According to the Renmin University of China Professor LiuPinXin “identify - number - take” point of view, samples is the formation of the necessary components of the identification opinion, samples whether there is a legitimate extraction procedures, whether from the process of the case, etc., need to lawyers keep a good gate. Secondly, in addition to review the electronic evidence itself, but also need to be reviewed in conjunction with other evidence. Peng lawyers also cited an example they have handled a case of false VAT invoices, verbal evidence that the return point is about 8%, but part of the electronic evidence extracted from the conclusion of the information is the return point to 81%, obviously shows that the electronic evidence mixed with other information, data reliability problems. Also, need to pay attention to the relevance of the appraisal opinion and the case, to prevent taking the appraisal opinion indiscriminately.
Part IV: fast broadcasting case analysis - why electronic evidence issues were “hanging”
Through the case of “fast broadcasting”, Mr. Peng demonstrated the problems of the subject of electronic data extraction, sealing problems, transfer problems, etc. in the case of fast broadcasting. In this case, the prosecution in order to prove that the four servers containing obscene video electronic data has not been tampered with and change, put forward the server's IP address did not change, so as to conclude that the electronic data did not change. Mr. Peng Jiyue finally explained in detail why the prosecution's conclusion was not valid.
Mr. Mao Zijian
Ms. Mao Zijian from the combination of technical and legal perspectives, the extraction of electronic evidence, fixation and analysis of in-depth explanation, Ms. Mao in the training elaborated on “how to use electronic evidence to expand the idea of handling the case”, her speech is summarized in the following points:
I. Focus on key electronic evidence in a case
Ms. Mao emphasized the importance of identifying and focusing on key electronic evidence in a case, and suggested that key electronic evidence related to the facts of the case can be quickly locked through the interpretation of the case file, time line analysis and other methods.
1, check the case file materials, such as the keywords in the indictment, quickly lock the location “examined and identified in accordance with the law .....” , “identified/accounted for by ......” The key words in the indictment, such as “identified by examination in accordance with the law”, “identified/accounted for ‘, ’identification opinion”, “identification opinion expression”, “the use of samples”, etc. in the identification opinion.
2, based on the following dimensions, quickly focus on key electronic evidence, such as the description of the evidence content, file name, checksum value (hash value, MD5, SHA1), file size, time attributes, IP address.
Second, the use of electronic evidence to restore the forensic process
Mr. Mao explained how to review electronic evidence by extracting transcripts, access to evidence notification and lists and other instruments to restore the process of electronic evidence, while reviewing the legality of the evidence and the integrity of the evidence.
1, to use professional software and tools to review the electronic data, including file name, checksum value, file size, time attributes, etc., and to reconstruct the process of obtaining third-party data by analyzing the notification and list of access to evidence.
2、For the electronic data extracted by the investigating authorities themselves, pay attention to the extraction of transcripts and fixed lists, as well as relevant pictures and video information, and quickly screen out key documents and abnormal situations by analyzing time sorting and file attributes.
3, the use of time information, file size, hash value and other data to test the consistency and integrity of electronic evidence. Combined with the content of the document and environmental information, to assess the generation of electronic data and authenticity.
Third, the use of electronic evidence to reconstruct the facts of the case
Mr. Mao pointed out that electronic evidence can be used to reflect the criminal process and facts of the case. By analyzing system logs, file attributes, database records, etc., the electronic evidence can be comprehensively analyzed and the facts of the case can be reconstructed.
1. Reveal the generation and modification of electronic data by analyzing system logs and file attributes. Combined with specific cases, it demonstrates how to use electronic evidence to expand case ideas and discover new case facts.
2、Combined with database records, member information, fund flow and other data, it analyzes the criminal hierarchy, member structure and economic transactions of the case. Through specific cases, it analyzes electronic data such as server mirrors, database records, chat records and other electronic data, and reveals the problems and doubts that may exist in the process of forensics.
3、Identify and exclude test data, illegal attack records and other information unrelated to the case
Fourth, using electronic evidence to put forward new defense claims
Mr. Mao emphasized that through the in-depth analysis of electronic evidence, new facts and clues in the case can be discovered, so as to put forward new defense claims and provide stronger legal support for the defendant.
1. Based on the results of the analysis of the electronic evidence, put forward defense claims about crime and non-crime, this crime and that crime, and the severity of the penalty.
2. Reveal the possible illegal behavior of the public security authorities in the process of evidence collection, such as illegal evidence collection and data tampering.
3. Prove the defendant's innocence or misdemeanor, such as the lack of criminal intent, the existence of wind control measures, and actively cooperate with the investigation.
V. Countermeasures in the case of lack of electronic data
1, in the absence of electronic data, through a careful review of the existing instruments and evidence materials, looking for contradictions and anomalies.
2, the use of paperwork in the supporting materials such as maps, screenshots, etc., to verify the authenticity and legitimacy of the evidence.
3, for the missing or insufficient evidence, put forward reasonable questioning and supplementary investigation recommendations.
Sixth, common problems in the review of electronic evidence
Mr. Mao also pointed out common problems in the review of electronic evidence, such as unclear source of electronic data, inconsistent data integrity check value, abnormal creation and modification time of electronic data, etc., and reminded legal practitioners that they need to pay special attention to these problems when reviewing electronic evidence.
Mr. Mao's sharing provided legal practitioners with valuable guidance on the review and application of electronic evidence and a set of systematic methods for reviewing and analyzing electronic evidence, emphasizing the importance of electronic evidence and the necessity of using electronic evidence for effective defense in modern legal practice. By combining theory with practice, legal practitioners can better utilize electronic evidence to provide stronger legal services to their clients. She emphasized that the authenticity, legality and relevance of electronic evidence are the key to review, and that lawyers should focus on the completeness of electronic evidence and the consistency of the check values in their practice. Ms. Mao also shared the problems and solutions that may be encountered in the process of electronic evidence extraction, which provided valuable practical guidance for the attorneys present.
During the question and answer session, the attorneys actively spoke and raised various problems encountered in the practical operation of electronic evidence.
Xu Ying
Ms. Xu Ying shared a recent case she handled, through the review of electronic evidence to achieve the effect of effective defense, through their own personal practice, so that we can more truly feel the effective review of electronic evidence, for the case brought about by the actual effect, suggesting that we must pay great attention to, and continue to learn the relevant rules of electronic evidence.
Liu Lijie
Liu Lijie explained the corroborative relationship between electronic data and other evidence in the criminal proof system, and raised the question about the simulated reconstruction of website data and the upload time of Baidu.com, to which Ms. Mao gave a detailed answer, she pointed out that the simulated reconstruction is not an investigation experiment, but a restoration of the state at that time, and the upload time of Baidu.com is determined by the server clock and is not affected by the local clock.
Sun Guangzhi
According to Mr. Sun Guangzhi, “Electronic data is, in my opinion, a type of evidence that is both modern and traditional. Its modernity is mostly reflected in the form of expression and presentation, but from the traditional point of view, as evidence, it always still comes to prove the facts of the case. Therefore, the traditional evidence for the review of the angle, method is also applicable to electronic data. As criminal defense lawyers, when we study electronic data, we must first determine what the facts of the case are that the evidence points to (to be proved), and whether the relevant facts affect the conviction and sentence. If the suspect/defendant for whom we are providing defense services has no objection to the relevant facts, then the examination of the relevant electronic data can be appropriately simplified. If the relevant electronic data points to the facts of the case that have a significant impact on the conviction and sentence, and the suspect/defendant has objections to the relevant facts, then we need to scrutinize the relevant electronic data. Therefore, there is a difference between the perspective of a defense attorney and that of an evidence expert in viewing electronic data. Defense attorneys are more inclined to view the evidence from the perspective of the case as a whole and of conviction and sentencing, whereas evidence experts are sometimes more inclined to argue on the basis of the evidence. In addition, when reviewing electronic data, defense lawyers should also focus on reviewing and grasping the electronic data from the perspective of logical relationships at the factual level as well as formal elements at the formal level (e.g., paperwork, transcripts, notes, audio and video recordings for collecting and extracting electronic data) as necessary.”
Niu Xingli
Attorney Niu Xingli, on the other hand, shared an extortion case she once handled, mentioning the problem of the time cost of retrieving electronic evidence in practical operation and the importance of exchanging and studying with technical experts.
Ms. Mao suggested that after getting a hard disk, lawyers then retrieve on their own may have practice risks. The safest thing is to get a hard disk and then do not turn it on again, to get a third party appraisal agency, and under the supervision of the notary public, the appraisal agency will be fixed into a mirror image before sealing.
After the event, the lawyers expressed that they had benefited a lot and looked forward to more similar learning opportunities in the future. King&Capital Law Firm will continue to provide high-quality legal services to maximize the legal benefits for our clients.
