How to collect evidence in Cryptocurrency cases

In criminal cases related to virtual currency, because the defendant’s business entities are mostly established overseas, and business activities mostly occur online, compared with traditional evidence such as documentary evidence and physical evidence, cross-border electronic evidence has become the main evidence in such cases composition. By writing this article, Sister Sa’s team hopes to introduce readers to the basic regulations on electronic evidence and the practice of cross-border collection of electronic evidence.

What is electronic evidence?

In Chinese law, electronic evidence is also called “electronic data” and is one of the eight types of legal evidence stipulated by the Criminal Procedure Law.

There is no essential difference between the terms “electronic evidence” and “electronic data”, except that the starting point of the concept is different . Electronic evidence focuses on the definition of the carrier of this type of evidence, that is, “various materials and derivatives that can prove the true situation of the case arising from the application of electronic information technology . ” Electronic data focuses on defining the essential attributes of this type of evidence, that is, “data formed during the occurrence of a case, stored, processed, and transmitted in digital form, that can prove the facts of the case.”

It should be noted that evidence such as witness testimony, victim statement, confession and defense of criminal suspects and defendants recorded in digital form is not electronic evidence. If it is really necessary, the collection, extraction, transfer, and review of relevant evidence may refer to the relevant provisions of the applicable electronic evidence.

In terms of types, the types of electronic evidence include, but are not limited to, the following information and electronic files: (1) Information published by webpages, blogs, microblogs, Moments of Friends, Tieba, Netdisk and other online platforms; (2) Mobile phone text messages, emails , Instant messaging, communication groups and other network application services communication information; (3) user registration information, identity authentication information, electronic transaction records, communication records, login logs and other information; (4) documents, pictures, audio and video, digital certificates , Computer programs and other electronic files.

Channels for cross-border electronic evidence collection

1. Fixed overseas public data

The first is to browse the overseas public webpages connected to the server, and fix the webpage data as electronic evidence through screenshots, video recordings, and photographs. This is the most commonly used method of obtaining evidence in “overseas server” cases , often with other cross-border evidence collection methods . Electronic evidence collection measures are also applicable.

The process of collecting evidence is usually collected online by the staff of the network security department of the public security organ and then issued a transcript of the online collection as court evidence. For example, in the case of “Guo and Luo providing programs and tools for trespassing and illegally controlling computer information systems”, the Internet Security Police of Xining City Public Security Bureau entered into the purchase network by entering the domestic website promoted by Guo and others in the browser. The overseas website “” of the attacking software Aegis DDOS finally found that the registrant of the website service address was Guo, thus proving Guo’s criminal behavior. See the Criminal Judgment of the People’s Court of Chengxi District, Xining City, Qinghai Province (2018) Qing 0104 Xing Chu No. 41 2. Log in to the server involved in the case and extract data

The second is to conduct remote inquiries to extract data from overseas servers by entering a user name and password. The public security organ obtains the account and password of the suspect’s management platform involved in the case during the preliminary investigation, and then the network security department staff of the public security organ enters the user name and password to log in to the platform to obtain data from overseas servers.

This kind of cross-border electronic evidence collection method is often suitable for the collection of evidence in “help criminal” cases that provide an Internet crime platform for others. By entering the account name and password to enter the platform, you can accurately obtain the number of registered members of the platform and the number of times the platform has been used, etc., which affect convictions, Important evidence for sentencing.

For example, in the case of “Fang XX and other crimes of fraud and illegally obtaining citizens’ personal information”, Rudong County Public Security Bureau conducted a remote inspection of overseas VOS platform data and found that fraudsters made fraudulent calls through the 198 platform provided by Fang XX frequency. See the Criminal Judgment of the People’s Court of Rudong County, Jiangsu Province (2016) Su 0623 Xing Chu No. 368.

3. Use technical investigation methods to obtain data

The third type is technical investigation. Professionals use technical means to obtain electronic evidence stored in an overseas server, and then form an electronic evidence inspection report or an electronic evidence judicial appraisal report as evidence for the conviction and sentencing of the case . Judging from the judgment documents, the “professionals” here are generally the cybersecurity or technical investigators of the public security organs. For example, in the “Teng Mouhui, Teng Mouping organization, and leadership MLM activities case”, the Changde City Public Security Bureau’s cybersecurity department from Teng From the overseas servers rented by Hui and Teng Mouping extracted the three membership numbers registered by Teng Mouping on the MLM website, as well as the downline personnel developed by each membership number, a total of 14,729 person-times, and issued the “Changde City Public Security Bureau Changgong Network Inspection [ 2015] No. 409 Electronic Evidence Inspection Analysis Report” as court evidence. See the Criminal Judgment of the People’s Court of Jin City, Hunan Province (2016) Xiang 0781 Xing Chu No. 70.

It may also be a technician of a professional electronic evidence appraisal agency. For example, in the “Illegal Operation Case of Li Jun, Yu Mou, Zuo Mou, etc.”, Shanghai Honglian Network Technology Co., Ltd. reported on the data of MetaTrader 4 software in the overseas server 185.961661 involved in the case. Fixed, extracted 1110 user information, 153384 transaction records, and issued the “Shanghai Honglian Network Technology Co., Ltd. Computer Judicial Appraisal Institute (2016) Wujianzi No. 36 Judicial Appraisal” as the key evidence in the court. See the Criminal Judgment of the Intermediate People’s Court of Chengde City, Hebei Province (2017) Ji 08 Xing Chu No. 11.

Write at the end

Sister Sa’s team believes that for the defender, knowing the way and thinking of obtaining evidence is a prerequisite for effective cross-examination. Before analyzing the content of electronic evidence, its formation time, formation channel, formation method, etc. are all important ways for us to make reasonable doubts. Therefore, it is also necessary to learn about the methods and channels used by investigative agencies to retrieve overseas electronic data.

Posted by:CoinYuppie,Reprinted with attribution to:
Coinyuppie is an open information publishing platform, all information provided is not related to the views and positions of coinyuppie, and does not constitute any investment and financial advice. Users are expected to carefully screen and prevent risks.

Leave a Reply