Collecting and Preserving Procedures of Electronic Evidence: Analysis of Qvod Player Case in China

Recently, in the big data era, with the widespread usage of the internet, various new types of criminal activities are emerging. The proliferation of the internet brings out new challenges and opportunities in forensic science theoretically and practically. Due to the complicated characteristic of the internet world and lack of relevant laws and regulations, collecting and preserving electronic evidence has become a hotly debated topic after the case of Qvod Player. On January 7, 2016, the Beijing Haidian District Court heard the case of Shenzhen Qvod Player (Kuaibo) Technology Co., Ltd (hereinafter referred to as Qvod Player Company). Qvod Player Company was suspected of making, copying, publishing, selling, and distributing obscene videos to obtain profit. In the course of the trial, there was a big dispute centering on the authenticity and legitimacy of electronic evidence. The defendant and the prosecution had a fierce cross-examination due to the extraction of electronic evidence. The debate centers on the following aspects:

1. The originality and integrity of evidence collected from the four servers has been influenced.

2. The seizure and search procedure of the four servers does not match legal provisions.

3. There is a high possibility that the evidence may be contaminated in the transfer of evidence and should be ruled out.

4. The evidence procedure of collecting, opening, and identifying electronic evidence is illegal. This paper aims at exploring some ways to promote the development of electronic evidence collection in China.

The defendant Wang Xin is the legal representative and CEO of Qvod Player Company. The Co-defendant Wu Ming is the manager, Zhang Kedong is the deputy general manager and technology platform of Qvod Player Company. In December 2007, since the establishment of the Qvod Player Company, this company has provided a network for users by releasing free QVOD Media Server Installer (hereinafter referred to as QSI) and player software to the Internet. During the period, the supervisors of Qvod Player company, Wang Xin, Wu Ming, Zhang Kedong, who knew their QSI and player software were used for broadcasting, searching, and downloading obscene videos for profit, they still turned a blind eye to these behaviors, resulting in a large number of obscene videos spread on the Internet.

On November 18, 2013, Beijing Haidian District Cultural Committee seized 4 servers hosted by Qvod Player company from Beijing Netlink Guangtong Technology Co., Ltd. (hereinafter referred to as Guangtong Company) located in Haidian District. Having extracted 29, 841 video files from the above three servers for identification by the Beijing Municipal Public Security Bureau, 21,251 of which were confirmed to be obscene videos. According to the provisions of Article 365, Article 366, Article 30 and Article 31 of the Criminal Law of the People’s Republic of China, Wang Xin, Wu Ming, and Zhang Kedong should be convicted and sentenced respectively [1]. In the first instance of this case, due to the live broadcast of the court, the arguments and evidence of this case aroused the attention of the public.

The judgment of this case has won praises from all walks of life. However, this case also illustrates that some difficulties in collecting and preserving electronic evidence in China. There are three aspects of problems in this case in judicial practice: the extraction of electronic evidence, the identification of electronic evidence and the authenticity of electronic evidence. In this case, the disputes on extraction of electronic evidence mainly centers on the legitimacy of third-party assistance, timeliness, and integrity of electronic evidence extraction. Firstly, the legitimacy of third-party assistance is not guaranteed. The extraction of electronic evidence cannot be verified, which directly determines whether the data collected from the four servers can be used as electronic evidence.

The first administrative agency found and detained the four servers involved in the case is the Haidian District Cultural Committee of Beijing. During the search and seizure, the administrative agency did not guarantee the originality of the evidence. When the Haidian District Culture Commission implemented the on-site seizure, the Culture Commission did not take photographs, thus it was difficult to determine the uniqueness of the servers and guarantee the electronic evidence is not being contaminated. The administrative agency of the Beijing Culture Commission only recorded the IP addresses of the four servers, but the IP address could not be used as evidence to identify the characteristics of the server and did not specify the features of four servers, which directly challenges the authenticity of the electronic evidence.

Accordingly, Qvod Player Company held that “the electronic evidence contained in four servers have been contaminated”.

1. There is no neutral third party on the spot when the Cultural Committee began to search and seizure. It is unknown whether the contents of the hard disk are contaminated or replaced. The purpose of the Cultural Committee collecting electronic evidence is for administrative cases. But can the electronic evidence which is obtained by the Haidian District Culture Commission be applied to the criminal cases? [2].

2. In the stage of the investigation, due to the QVOD format videos cannot be read directly by police, Wenchang Company provided technical support and transcoded the videos. However, Wenchang company has no qualifications to join in the criminal investigation. In addition, Wenchang company has competing interests with Qvod Player Company.

3. It is universally acknowledged that the decoding of the electronic evidence should be carried out in the copy. Owing to two servers are directly transcoded before the authentication. So, the original data is destroyed during the investigation process.

There is no legal basis for the third-party assistance to intervene in the criminal investigation and evidence collection process to extract electronic data, so the Qvod Player Company’s doubt is not unreasonable. However, due to the high technical requirements of electronic evidence collection, extraction and analysis, police must have a fairly high level of computer professionalism. In the Qvod Player Case, the police turned to the third party for assistance because of the lack of technical support. However, the current legislation in China does not clarify the qualification of third-party assistance in forensic science, which has triggered the debate on third-party assistance to be justified. Secondly, the most popular process in the “Qvod Player Case “centers on the identification of obscene videos. In this process, the defendant and his attorney doubted and questioned the qualification of an examiner. The lawyer held that the procedural of examining violated obscene video identification. The examiner made the first identification report on April 11, 2014. The examiners were Xing Zhengbo and Xu Ping. According to the first identification report, the number of hard disks recorded in the server was 7 hard disks, and each hard disk capacity was 2T.

On January 20, 2015, the examiner issued the second identification report with the same document number as the first one, but the signature of examiners was Ding Yanhua and Zhao Shicai. Most importantly, the signature was signed by the same person. Because of the procedural violations in the above-mentioned identification report, the police applied for a supplementary investigation and issued a third identification report for obscene videos of Qvod Player Case on November 6, 2015. The document number of the report is different from the previous two, but the examiners are the same. The third identification procedure is still illegal, which violated the laws and regulations on the requirements of different examiners in a different process.

In China, electronic evidence collection assisted by third parties should be carried out in two aspects. First, relevant administrative agencies should make a list of qualified third-party forensics assistance agencies to the public. In the beginning, the People’s Court may lead and arrange to review the relevant technical professional institutions. After the review, the qualifications shall be classified according to the technical characteristics. Secondly, in the process of investigation, if the police consider it is necessary to obtain technical support from a third party, the third party may be randomly selected one of forensics assistance agencies from the above-mentioned list. After obtaining the letter of authorization, the neutral third party can join in the investigation process and cooperate with the police to collect evidence. Besides, it should be specially pointed out that before the third party is entrusted to formally contact the electronic evidence, the electronic evidence storage medium should be in a fixed storage state to ensure the originality and integrity of the electronic evidence [3].

In terms of the identification process of collecting electronic evidence, firstly, it is necessary to make clear and unified provisions on the qualifications of electronic evidence forensic examiners by the form of unified legislation, to avoid possible conflicts and poor implementation of legislation. As for the qualifications of examiners:

1. Professional and technical ability. Professional technical skills are undoubtedly the primary premise of becoming an examiner. Only those who have mastered professional skills can come to authoritative and convincing analysis opinions.

2. Legal knowledge and professionalism. The judicial characteristics of the judicial examiners distinguish it from the general professional and technical characteristics.

Therefore, the electronic evidence examiner needs to have relevant legal expertise, which is beneficial for the examiners to better identify according to the statutory requirements when making the examination. A good foundation is laid out in the use of evidence and court review. With the establishment of the examiners’ testimony system in court, examiners are required to be familiar with the trial process and the testimony rules to ensure the efficiency and rapid conduct of the trial. Besides, it is also necessary to specify and regulate the criteria, assessment content, assessment procedures and assessment subjects of electronic evidence examiners. At the same time, in the judgment of the ability of electronic evidence, the identification report which is made by the examiner without relevant qualification shall adopt the principle of absolute exclusion.

None.

No conflict of interest.

1. The people’s court of Haidian District (2015) No.512 Verdict of Criminal Cases of Haidian People’s Court of First Instance Trial.
2. Pinxin Liu (2017) Peking University Law Journal 29(1): 89-103.
3. Dengke Xie (2018) The Competent Collector of Electronic Evidence: Between Legitimacy and Technicality Global Law Review 1: 83-99.