Expert Interpretation ｜ Opinions on handling cyber crime cases

□ Wu Mengluan

□ cyber crime cases include four types of security crimes that endanger computer information systems

□ Clarify the site server where the criminal behavior is used, the infringed computer information system, or the place where the manager is located is a criminal place.

□ While clearly inquiring (News) Asks for the process of asking for the process, request remote inquiry (News) Ask to make a full video, and transfer it with the case

□ Collecting and extracting electronic data shall be implemented by investigators with more than two related professional knowledge

In order to solve the new situations and problems encountered by public security organs, procuratorates, and courts in handling cybercrime cases in recent years, punish cyber crime activities in accordance with the law, ensure the quality of case handling, and maintain judicial justice. Recently formulated the "Opinions on Criminal Procedures for Criminal Procedures for Criminal Procedures for Criminal Cases" (hereinafter referred to as "Opinions"), and regulations on the jurisdiction of case jurisdiction and evidence collection that urgently need to be resolved in practice. It has important guiding significance.

The characteristics of cybercrime and difficulty in handling cases

Cyber ​​crimes are new types of crimes with the development of information technology. It takes computer information systems, the Internet as the object of infringement or criminal tools, including new types of crimes that invade and endangers computer information systems, as well as the new type of expression of traditional crimes on the Internet.

Compared with other types of crimes, cybercrime is unique: First, most of them consist of multiple links and form a chain of interest. The characteristics of information network technology determine the implementation of a network criminal behavior. It is necessary to complete the construction of website construction, advertising promotion, capital transfer, and technical support. A technical link can also help a large number of other criminal activities at the same time. These lack of common crime intentional and different links formed intricate relationships, which greatly reduced the technical threshold of crime and led to further flooding of cyber crimes. For example, people who buy Trojan scams in the online purchase of Trojan scams include "writing horses", "killing", money laundering, and fraud. Any intermediate link will provide a large number of different scam gangs with technical support required for criminals. The second is to organize crimes across regional organizations and for unspecified people. On the one hand, it is used to jointly implement criminal activities such as cyber attacks and online gambling with the help of unspecified people in the Internet. On the other hand, with the help of cross -geomics of the Internet, criminal activities such as fraud, extortion, etc. are used for unspecified people to make huge profits in a way to accumulate less. The third is strong technical and concealment. Many traditional crimes are combined with information network technology to form a new type of technical crime. For example, after the stealing QQ number deceives the stolen friends' remittances and steal funds through the theft of bank accounts, although it is essentially the category of fraud and theft, the technical characteristics of their crimes are more obvious. Due to the implementation of this type of crime, it is easy to conceal the facts and concealed identities through measures such as encryption, agency and other measures, and further increased investigation.

The characteristics of cyber crimes lead to the following outstanding problems in the case handling:

First, there are many regional jurisdictions. The Internet has cross -regional characteristics, and corresponding cyber crimes also have cross -regional characteristics. Persons related to crime (victims, suspects), and related resources (bank accounts, virtual identities, websites) and other basic elements are distributed in different places. There is a phenomenon of mutual pushing each other or competing for the case. Due to the unclear territory of the case, in recent years, many places have only combined the local branches of cyber criminal gangs, and have not tracked the top criminal gang located in different places.

The second is difficulty in obtaining evidence across regions. Evidence materials such as cyber data and bank accounts related to network crime involve many places. According to traditional evidence collection procedures, the police in the place of case handling usually need to bring legal documents to the location of the evidence to carry out evidence to retrieve the work. Related evidence. In particular, criminal suspects usually use computer networks to commit crimes against unspecified people or organize unspecified crimes. There are many people involved in the case. Facts have caused improper punishment for punishment for criminal suspects. It seriously restricts the blow to crimes such as cyber fraud and other crimes, and the masses have strong reports.

The third is that the investigation measures that can be taken before the case are not clear. At present, the investigation measures can be taken before the public security organs can be taken before the case filing, but investigations need to investigate the clues of illegal crimes on the Internet, otherwise it is difficult to determine whether the file is reached. The lack of deficiencies has caused a large number of clues of illegal crimes to enter the investigation procedure. Illegal information spreads on the Internet, and repeatedly deleted.

Fourth, electronic evidence collection procedures lack unified norms. Electronic evidence is an indispensable important evidence for investigating cybercrime cases. Although the Criminal Procedure Law has regarded electronic evidence as the type of new legal evidence, the lack of unified standards for the extraction, fixation, presentation, identification, and qualifications of electronic evidence, leading to a unified norm, leading to a unified norm, leading to a unified norm, resulting In practice, the identification of some cases has different understanding.

In order to solve the above problems, the Supreme People's Court, the Supreme People's Procuratorate, and the Ministry of Public Security have formulated the "Opinions" after investigation and demonstration.

The scope of the "Opinions"

On the basis of fully analyzing the characteristics of cybercrime, Article 1 of Opinions summarizes the scope of cybercrime cases into four categories:

The safety criminal cases of computer information systems, including the crime of illegal invasion of computer information systems stipulated in Article 285 and 286 of the Criminal Law, illegally obtain computer information system data, illegal control of computer information systems, provide invasion, illegal control computer information system program, Delivery crime, destroying the crime of computer information system. The theft, fraud, extortion and other criminal cases such as the security behavior of the computer information system and the implementation of theft, including the use of various criminal acts implemented by the Internet with the help of hackers.

Establish a website, communication group or publishing information on the computer network that is mainly used to implement criminal activities, or to organize, teach, and help unspecified criminal cases, including various criminal crime cases implemented on the Internet Essence

Except for the above crimes, other major criminal acts are implemented on the Internet.

Jurisdiction of cyber crime case

Cyber ​​crimes are complicated and many links may involve multiple criminal places. The issue of jurisdiction is a problem of more reflection and concentration in the cases of online crime cases. It mainly involves specific determination of criminal land, jurisdiction disputes involved in multiple cases, coordination of public security organs, procuratorial organs, and trial agencies. Jurisdiction at different places and so on. Therefore, the "Opinions" focuses on answering the above questions.

Regarding the specific determination of the crime. On the basis of fully summing up the practical experience, the "Opinions" clarifies the specific situation of the criminal place, that is, Article 2 of the "Supreme People's Court on the Application of the Criminal Procedure Law of the People's Republic of China" issued on December 20, 2012 The second paragraph has been further improved, and the "website server where the website server is used to implement criminal acts" instead of "the site server where the criminal behavior is occurred" to make the expression more accurate; "Replacing the" invaded computer information system and the location of its managers "emphasized that both can be avoided, avoiding ambiguity when applying.

Regarding the specific determination of jurisdiction. Considering the cross -regional characteristics of cyber crime cases, especially the victims and criminal suspects, helping the offender and the implementation of the criminals are often separated. Lost land has jurisdiction and help the public security organs in the place of residence may be filed for investigation in accordance with the principle of criminal land or the jurisdiction of the place of residence if necessary.

Regarding the specific determination of the designated jurisdiction. In order to further improve the efficiency of investigation, the Opinions made targeted and simplified specific procedures for specified jurisdictions: for forming multi -level chain, cross -regional networks for formation of network transactions, organizational assistance, technical support, and fund payment settlement. Criminal cases can be determined by the public security organs of the public security organs in accordance with the principles that are conducive to investigating the facts of the criminal facts and conducive to litigation. For special circumstances (such as criminal suspects are closely related to the local public security organs or telecommunications authorities, the jurisdiction of local jurisdiction is sometimes not conducive to investigation). The major cases of cross -provincial cases that ensure the fair treatment of the case may be designated by the Supreme People's Court of the Ministry of Public Security and the Supreme People's Procuratorate.

Regarding the coordination of investigation of jurisdiction and procuratorial jurisdiction and jurisdiction. According to the "Supreme People's Court, Supreme People's Procuratorate, the Ministry of Public Security, the Ministry of Public Security, the Ministry of Public Security, the Ministry of Justice, and the Standing Committee of the Standing Committee of the Standing Committee of the Standing Committee of the Standing Committee of the Standing Committee of the Standing Committee of the National People's Congress, Article 23 If the public security organs designated the case of the investigation of the investigation of the public security organs, if the suspect is required, the public security organs of the case shall be investigated and approved by the people's procuratorate at the same level; if the public security organ needs to be filed for public prosecution, The spirit of the regulation of review and prosecution, "Opinions" further specified in Article 3, 4, and 5. For cyber criminal cases specified by higher -level public security organs to be investigated and investigated by public security organs, they need to be approved to be approved to arrest and transfer them. If the prosecution and public prosecution shall be reviewed and the prosecutor and court of the public security organs where the public security organs investigate the case are accepted. In order to ensure timely cases and avoid oversupply, the procuratorial organs and courts who have not jurisdiction over the examination that have no jurisdiction after review and find that there are no jurisdictions that the "Opinions" stipulates that after the joint jurisdiction designated by the superior procuratorate and the court, there is a jurisdiction to jurisdiction over jurisdiction. Procuratorate and court of power. The "Supreme People's Procuratorate, the Supreme People's Court, and the Ministry of Public Security on the Supreme People's Procuratorate on the Application of Laws on the Application of Laws in the Application of Laws in the Application of Laws in the Ministry of Public Security have made such similar provisions. Essence

Some criminal suspects in cyber crime have not yet arrived, but if it does not affect the criminal facts of the criminal facts of the same case, the "Opinions" stipulates that the suspect of the crime of the same case in accordance with the law can be pursued in accordance with the law. Criminal responsibility of people and defendants. Cases involved in the criminal suspects and defendants who had not yet arrived in the case were under the jurisdiction of the former public security organs, procuratorial organs, and courts.

The preliminary investigation of cyber criminal cases

The "Opinions" clarify the procedures and measures of the initial investigation: Public security organs found that the facts of the case were unknown in the review, or they needed to be investigated to confirm whether the criminal case pursuit criteria were reached. In the process of preliminary investigation, measures such as inquiry, inquiry, inspection, inspection, identification, and evidence materials can be taken. At the same time, it is stipulated that the initial investigation shall not take compulsory measures to the initial investigation, and shall not check, seize, and freeze the property of the initial investigation. Evidence of cyber criminal cases

The "Opinions" clearly stipulates the specific procedures for obtaining evidence on behalf of the online crime case. Clarify that the investigation of cyber crimes in public security organs requires a different place on behalf of the investigation and evidence, and can transmit the collaborative letter of the case handling of the information system and the relevant legal documents and vouchers through the informationization system of the public security organs. organ. After receiving the public security organs in collaboration, after review and confirmation, after the legal documents came up with the official seal of the local public security organs, they were inspected and retracted relevant evidence. For those who need to collect relevant evidence to be collected in the same criminals who are required to be killed in different places and the criminals, they may be written by the victims, the same case, or the local public security organs as questioned (information), collect relevant evidence and transfer to the public security organs of the case.

The Opinions clearly specify the specific procedures for remote video inquiries (News). Remote video inquiry (News) Asked is the new application of information technology in criminal proceedings in recent years, and it is particularly needed for cross -regional criminal crime cases. Article 12 of the Opinions stipulates that after verifying the victims, or the public security organ of the victim, the place where the same case is located, or the identity of the same case, the public security organs in the case of the case shall question the victims and the same case (information) through remote network videos. While clearly inquiring (News) Ask the recording of the program, if you ask for remote inquiries (information), the recording video should be performed and transferred with the case. If the evidence of a different place, the victim, and a criminal suspect who are related to the case, the procedure is handled by this procedure.

The "Opinions" clearly stipulates the procedures and requirements for the collection and review of electronic data for online crime cases. Electronic data is a new type of evidence stipulated in the Criminal Procedure Law, and is the key evidence to identify the facts of cyber crimes. However, electronic data is easy to be tampered with. Many electronic evidence (such as information stored on overseas hosts) cannot obtain evidence by seizing the original storage medium, nor can it be determined by the primitive of electronic data through repeated evidence collection process. Many electronic evidence cannot be displayed directly, such as computer virus programs, website code, network attack logs and other electronic data cannot explain the facts proved by direct display. In response to the above issues, the "Opinions" stipulates that collecting and extracting electronic data shall be implemented by investigators with more than two related professional knowledge. Evidence collection equipment and processes shall meet relevant technical standards and ensure the integrity and objectivity of the collected and extracted electronic data.

The "Opinions" stipulates that electronic data collection is based on the collection of original storage media. Only when the original storage medium is inconvenient to seal and extract data is not stored on the storage medium, the original storage medium is located abroad, etc. can the electronic data be extracted. If conditions permit, the relevant activities should be recorded. In accordance with the requirements of the current judicial interpretation, those who cannot be inspectors who cannot meet the qualified personnel shall indicate the situation in the transcript material and record the relevant activities.

The "Opinions" requires that the collection and extraction of electronic data should be produced in detail, and the investigators collected and extracted by electronic data signed or stamped. For remote extraction of electronic data, the reason should be explained, and the evidence collection process should be recorded or signed by the witness. For electronic data obtained by data recovery, cracking, etc., the process and method of recovery and cracking should be explained by the deleted, hidden or encrypted electronic data obtained by data recovery and cracking.

For the transfer of electronic data, the "Opinions" requires that the collected original storage medium or the extracted electronic data should be transferred with the case and the copy of the electronic data is transferred. For electronic data that can be displayed directly by documents, pictures, web pages, can be directly displayed and judged by electronic data. You may not be transferred to the electronic data printing with the case, but the display method description and display tool should be attached. For electronic data that cannot be directly displayed by procedures, tools, and computer viruses that cannot directly display computer information systems, should be attached with relevant instructions. For issues such as computer program functions, data statistics, and data of the same sex, the public security organs shall be issued by the public security organs.

It is often involved in the specialty of electronic data to handle cyber crime cases. The current judicial interpretation stipulates that if there is doubt about electronic data, it should be appraised or inspected. Considering that there are fewer institutions with electronic data appraisal qualifications and expensive costs, and it is difficult to meet the actual needs of the case, the "Opinions" stipulates that it is difficult to determine the specialized issues involved in electronic data. The designated institution designated by the ministry issued a inspection report.

If evidence is required to collect technical investigation measures for online crime cases, the Opinions require that the relevant legal documents and evidence materials shall be transferred to the case.

The "Opinions" clarifies the standards for or organized, instigated, and helped unspecified most people and cannot collect relevant words on cyber crime cases one by one. In many cyber criminal cases, the number of victims and suspects is large and there are many places. For criminal cases that use the number of computer information systems that have been invaded, the amount of funds involved in the case involved, the victims Criminal suspects or computer information systems are obtained. In this regard, on the basis of fully summing up the practical experience, the "Opinions" stipulates that for such special cyber crime cases, there are evidence records such as electronic data, book evidence, etc. If the restrictions of objective conditions cannot be collected one by one, the relevant words evidence can be collected one by one, and on the basis of carefully reviewing the defendant's justification and the defense opinion of their defender, the evidence of the whole case can be comprehensively comprehensively. In the case, criminal facts such as the number of victims, the number of computer information systems that have been violated, and the amount of funds involved in the case are identified. (Author Unit: Legal Policy Research Office of the Supreme People's Procuratorate) Editor: Li Xiao review: Li Junxiao

- END -