Opinions on Several Issues in the Application of Criminal Procedures in Handling Cases of Information Network Crimes

Promulgation Date: 2022-8-26
Title: Opinions on Several Issues in the Application of Criminal Procedures in Handling Cases of Information Network Crimes
Document Number:Fafa (2022) No.23
Expiration date: 
Promulgating Entities:Supreme People's Court, Supreme People's Procuratorate, Ministry of Public Security
Source of text: https://www.court.gov.cn/fabu-xiangqing-370301.html

The following opinions are hereby put forward on the basis of the "Criminal Law of the PRC", The Criminal Procedure Law of the PRC", related laws and judicial interpretations, and in consideration of investigation, prosecution, and adjudication practice, so as to correct criminal activities on information networks in accordance with law.

I. Regarding the Scope of Information Network Crimes

1. Cases of information network crimes as used in this Opinion include:

(1) Criminal cases endangering the security of computer information systems;

(2) Criminal cases of refusing to perform information network security management obligations, illegally using information networks, or assisting in criminal activities on information networks;

(3) Criminal cases where information networks were used to carry out the main acts in crimes such as fraud, gambling, violating citizens' personal information;

II. Regarding Jurisdiction of Information Network Crimes

2. information network crime cases are to be filed and investigated by the public security organ for the site of the crime. When necessary, the public security organ at the site of the criminal suspects' domiciles may file and investigate.

The site of the crime for information network crimes includes the location of servers for online services used to conduct the criminal activity, the location of the network service providers, the locations of the infringed information network systems and their managers, the location of information network systems that were used by the criminal suspects, defendants, or victims in the course of committing the crime, the places where the victims suffered the harm, as well as the places where losses to victims' assets occurred.

In cases of information network crimes that have multiple stages, where criminal suspects assisted the information network crime, the public security organs for the site of their crime, their domicile, or the site of the crimes by those they assisted may file and investigate.

3. In cases of information networks that have multiple sites of the crime, the first public security organ to accept it or the public security organs for the principal location of the crimes are to file and investigate. Where there is controversy it is to be resolved through consultation in accordance with the principles of being conducive to clarifying the case facts and conducting litigation; and where a consensus cannot be reached through consultation, the public security organ at a common level above will designate a public security organ to file the case and investigate. Where it is necessary to request approval of arrest, or for the case to be transferred for review for prosecution or indictment, the people's procuratorate and people's court for the regions in which the public security organs that opened the case and investigated it are to accept it.

4. In any of the following circumstances, the public security organs, people's procuratorates, and people's courts may, within the scope of their respective duties, combine cases for handling:

(1) one person commits several crimes;

(2) joint crimes;

(3) a suspect or defendant in a joint also commits other crimes;

(4) There is a connection between criminal activity committed by multiple suspects or defendants, and joint disposition of the cases is useful for clarifying all of the case facts.

Where technical support such as program development, internet access, server hosting, online storage, or communications transmission; or assistance such as advertising and promotions or payment clearing; that were provided for information network crimes are suspected of being crimes, the cases may be combined for filing and investigation in accordance with the first paragraph above.

Where public security organs need to request approval of arrest, or for the case to be transferred for review for prosecution or indictment in cases that are combined in accordance with the preceding two paragraphs, the people's procuratorate and people's court for the location of that public security organs are to accept it:

5. Where cases of joint crimes or related crimes are combined for investigation and there is a large number of criminal suspects or the case is complex, the public security organs may divide the case to transfer it to be reviewed for prosecution. Where the case is divided to be transferred for review for prosecution, an explanation shall be made of the basis for combining the case and the reasons for the separate review for prosecution.

In the cases provided for in the preceding paragraph, the people's procuratorate may divide the case for indictment and the people's courts may divide the case for trial.

Ensuring the quality and efficiency of proceedings shall be a prerequisite for divided handling, and it must not impact parties' exercise of procedural rights such as to challenge evidence.

6. Where prior to the division, public security organs, people's procuratorates, and people's courts had jurisdiction of a case that is divided for handling in accordance with the preceding article, the jurisdiction of the relevant cases is not impacted following the division. Based on the specific circumstances, the cases divided for handling may be tried separately by people's court as different trial levels.

7. In joint crimes or related cases that have already been combined for investigation, where some of the criminal suspects have not yet been brought in but this will not impact the determination of facts for the criminal suspects or defendants who have already been brought in, the criminal responsibility of those criminal suspects or defendants who have already been brought in may be pursued first. After the criminal suspects or defendants who were previously not yet brought in are brought into the case, the public security organs, people's procuratorates, and people's courts for the location of the original case handling organs are to have jurisdiction over all involved cases.

8. In major cases of information network crimes where there are special circumstances or where designation of cross-provincial (autonomous region or directly controlled municipality) public security organ of another location for investigation would be more conducive to clarifying case facts and to ensuring fair handling, as well as in cases of information network crimes committed abroad, the jurisdiction of the investigation may be designated by the Ministry of public security in consultation with the Supreme People's Procuratorate and the Supreme People's Court.

(9) Where the people's procuratorate believes that a case that it is reviewing for prosecution shall be prosecuted by a higher-level people's procuratorate or a different people's procuratorate at the same level per the provisions on jurisdiction under the Criminal Procedure Law, it shall transfer the case to the people's procuratorate with jurisdiction and notify the public security organ that transferred the case. Where people's procuratorates find that they need to designate trial jurisdiction in accordance with the Criminal Procedure Law, they shall consult with the people's court of the same level to handle the designation of jurisdiction.

10. Where multiple public security organs have filed a case and investigated criminal suspects, the relevant public security organs shall normally consult and combine the cases for handling, and transfer the cases in accordance with law. Where consultation does not reach a conclusion, the situation may be reported to the public security organ at the shared level above for a designation of jurisdiction.

Where, in reviewing a case for prosecution, people's procurators discover that the criminal suspect has committed other crimes that are being filed and investigated by another public security organ, they shall notify the public security organ that transferred the case to be reviewed for prosecution.

Where in cases that have been raised in the people's courts, the people's courts discover that defendants have other crimes that are being reviewed for prosecution, filed, or investigated they may consult with the people's procuratorate and public security organs on combining the cases for handling, unless it might cause the trial to be excessively delayed. Where it is decided to combine the cases for handling and the requirements of Criminal Procedure Law article 204 are met, the people's procuratorate may recommend that the people's court extend the trial.

III. Investigation and Verification in Cases of Information Network Crimes

11、Where during the review of a case they accept or of leads they discovered, the public security organs find that the facts of the case or leads are unclear and that investigation is necessary before it can be confirmed whether or not it reaches the standard for filing a criminal case, they may conduct an investigation and verification; and where after the investigation and verification the standard for filing a criminal case is met, they shall promptly file the case.

12. During the process of investigation and verification, measures that do not restrict subjects' rights in their persons and assets such as questioning, interrogation, inquests, inspections, evaluations, and collecting evidence materials, but must not employ compulsory measures against the subject of the investigation, must not seal, seize or freeze the assets of the subject of the investigation, and must not employ technical investigation measures.

13. Materials such as electronic data that are lawfully collected by the public security organs during the course of investigation and verification may be used as evidence in accordance with relevant provisions.

Where the materials collected during investigation and verification are used as evidence, they shall be transferred with the case and have the approval materials for investigation and verification attached.

Where the evidence collected during investigation and verification are found to be true through inspection and the collection complied with relevant requirements, it may be used as the basis of a case verdict.

IV. Regarding the Collection of Evidence in Cases of Information Network Crimes

14. Where public security organs collect electronic data from internet service providers, a written notification of the collection of evidence shall be drafted, indicating the relevant information about the electronic data that needs to be collected. The written notice on collection of evidence and related legal documents may in digital form. Where electronic data is collected across regions, the digital file may be transmitted through the public security organ's IT system.

Where network service providers provide the public security organs with electronic data, they may do so in digital form. Where electronic data is provided in digital form, the integrity of the electronic data shall be ensured and an electronic proof document is to be drafted indicating information such as the document number for the collection of evidence, the unit's digital seal, integrity check values, and an explanation of the means by which the electronic data's integrity was protected.

Legal documents and electronic proof documents that are in digital form shall use electronic signatures, digital watermarks, and other means of ensuring integrity.

15. The questioning (interrogation) of witnesses, victims or criminal suspects related to the case who are in other regions may be done remotely by the public security organ handling the case, using online video or other such methods, and making a record.

Before remote questioning (interrogation), a cooperating public security organ at the site shall first verify the identity of the person being questioned (interrogated). The public security organ handling the case shall send the record of the questioning (interrogation) to the cooperating public security organ. After the person being questioned (interrogated) has confirmed the record of the questioning (interrogation) and signed and affixed a fingerprint to each page, the staff of the cooperating public security organ are to sign their name or affix a seal and send the original documents to the case-handling public security organ. After the persons conducting the questioning (interrogation) receive the record, they shall write "received on XX/XX/XXXX" in the upper right hand of the first page and sign it or affix a seal.

Where questioning (interrogation) is done remotely, simultaneous audio or visual recordings shall be made of the entire questioning (interrogation) process, and transferred with the case.

Where witnesses, victims or criminal suspects related to the case personally write their testimony or confession, proceed with reference to the second clause of this article.

16. Where people's procuratorates conduct an investigation or supplemental investigation themselves in accordance with law or the people's courts investigate and verify related evidence, apply articles 14 and 15 of these Opinions.

17. The people's procuratorates and people's courts may conduct reviews and assessments of electronic data collected in accordance with article 14 of these Opinions through means such as verifying electronic signatures, digital watermarks, integrity check values, and whether the file numbers of legal documents are consistent with the proof documents.

Where there are questions about collected electronic data, the public security organs and the network service providers that provided the electronic data are to make explanations, or the organ that originally collected it is to collect materials to supplement the relevant evidence.

V. Regarding Other Issues in Cases of Information Network Crime

18. Where materials gathered through use of technical measures are used as evidence, they shall be transferred with the case with the legal documents authorizing the use of technical measures, a list of the evidence materials, and related explanations attached.

Where audiovisual materials and electronic data gathered through technical measures are transferred, a copy shall be made by two or more investigators, with an explanation stating information such as the location of the original evidence materials and the original storage medium attached, and signed by the person creating it, and with the unit's seal attached.

19. Evidence materials gathered through the use of technical measures shall be verified during court investigation through procedures such as presentation, identification, and debate.

Where the investigation at court of the evidence gathered through technical measures might endanger relevant persons' physical safety or might cause other serious consequences, the court shall adopt protective measures such as not revealing the revealing their identities or the technical equipment and technical methods used. When necessary, trial personnel may verify the evidence outside of court.

20. In handling cases of information network crimes, where the volume of physical and documentary evidence, witness testimony, victim statements, audiovisual materials, electronic data, or other evidence is especially large and possesses common traits, characteristics, or functions, and cannot be individually collected due to objective limitations, evidence shall be selected based on a set proportion or volume, and an explanation of the selection situation is to be made and debated.

The people's procuratorates and people's courts shall emphasize review of whether the means and process for collecting evidence were rational. Where after review it is found that the collection of evidence was not rational, the organ that originally collected the evidence shall make a supplemental explanation or collect evidence anew.

The people's procuratorates and people's courts shall consider other evidence materials and the explanations and defense opinions of the criminal suspects or defendants and their defenders, in reviewing the evidence identified for collection. Where reasonable doubts about the facts cannot be eliminated after review, a finding advantageous to the criminal suspects or defendants shall be made.

21. In cases of information network crimes involving an especially large number of people, where due to objective limitations it is not possible to individually collect all evidence or individually verify the funding sources of each account involved in the case, but bank accounts, non-bank payment accounts, and other transaction records and evidence are sufficient to determine that relevant accounts were primarily used to receive or transfer funds involved in the case, the amount involved in the case may be determined in accordance with the funds received in those accounts, except where the criminal suspects or defendants can make reasonable explanations. Where persons who are not parties to the case raise objections they shall be reviewed in accordance with law.

22. In handling cases of information network crimes, assets involved in the case shall be promptly sealed, seized, or frozen in accordance with law, persons involved in the case shall be urged to make replevin and restitution, for prompt recovery of losses.

The public security organs shall completely collect evidence showing the nature and ownership of assets involved in the case and the need for recovery, confiscation, ordering restitution in accordance with law, and make an explanation sent along with the case when transferring it to be reviewed for prosecution. Of these, where assets involved in the case need to be returned to the victims, the victims' losses shall be confirmed to the extent possible. The people's procuratorate shall conduct a review of the evidence materials on assets involved in the case and submit opinions on their disposition in when initiating the prosecution. The people's courts shall make a judgment in accordance with law and dispose of the assets involved in the case.

Where ownership of lawful assets that shall be returned to victims is clear, they shall be promptly returned in accordance with law; where ownership is unclear, they shall be returned to victims according to a proportion after the people's court's judgment or ruling takes effect, except for the portion for which there has been already restitution.

23. This opinion takes effect from September 1, 2022. The Supreme People's Court, Supreme People's Procuratorate, and Ministry of Public Security Opinion on Several Issues Regarding the Applicable Law for Handling Cases of Online Crimes （GongTongZi(2014)No10) is simultaneously repealed.

The Supreme People's Court, The Supreme People's Procuratorate

Ministry of Public Security

August 26, 2022