In today's economic crime cases, electronic data has become a very important form of evidence in investigation and trial. With the development of digitalization, many important transaction records, financial data, communication information, and illegal activities exist in electronic form. Although these data provide rich clues for the case, they also pose many challenges due to their susceptibility to tampering or deletion. For defense lawyers, it is possible to effectively verify electronic data, exclude the use of electronic data by judges, and protect the rights and interests of the parties as much as possible. This article explores the legality, authenticity, and relevance of electronic data in accordance with the requirements of criminal evidence.

1、 Cross examination of the legality of electronic data

The review of the legality of electronic data mainly focuses on the examination of the personnel and procedures involved in extracting electronic data. According to the judicial interpretation of the Criminal Procedure Law and the Rules for Electronic Data Collection of Criminal Cases by Public Security Organs, the extraction of electronic data should be carried out by two or more investigators and investigators, and it is required to prepare a "Record of On site Extraction of Electronic Data" and a "Fixed List of Electronic Data Extraction". For investigation organs in some remote areas, due to the lack of specialized investigators and investigators, data extraction is often carried out by suspect or other personnel without extraction qualifications, without witnesses or making records, which are illegal evidence gathering situations.

For data extraction on computer hosts, it is necessary to ensure that the computer is virus-free to prevent virus programs from interfering with or affecting electronic data extraction. For cloud host data and cloud web page data, it is also necessary to follow the corresponding host login specifications to ensure that there is no domain hijacking or other situations, and the accessed host is determined. The corresponding standards can refer to industry standards related to the Ministry of Public Security and courtroom science, such as GA/T-1476 and GA/T-1478.

Due to insufficient technical capabilities related to network and electronic data in investigative agencies, they often rely on the appraisal opinions of judicial appraisal agencies as endorsements for the probative value of electronic data. Cross examination of judicial appraisal opinions on electronic data is also an important step in ensuring the legality of electronic data. In a blockchain related case that I came into contact with, the appraisers only made an appraisal opinion on the software's related functions based on an independent source code file submitted by the investigating authority without conducting online operation. According to the Technical Specification for Software Function Evaluation, for software that cannot run, an evaluation opinion should be made that does not meet the inspection conditions. The judicial appraisal opinion is a clearly illegal appraisal opinion and should be excluded from acceptance.

2、 Verification of the authenticity of electronic data

For electronic data, it can be reviewed whether the electronic data provided as evidence is stored on the original storage medium. If the case file shows a screenshot of a computer or a screenshot of a mobile operation interface, the prosecuting authority can be requested to submit the corresponding mobile or computer storage device to confirm whether the data comes from the seized mobile or computer device, and then use it as the basis for subsequent data legality and correlation proof. If the original storage medium cannot be submitted, verify the reasons for the inability to submit and the process of collecting and extracting electronic data.

If the collection and extraction process is not fixed by evidence, cross examination can be requested to reproduce the collection and extraction process. Due to the investigation organ's attack on criminal acts and the suspect's arrest, the network server providing services often stops, and the corresponding website or APP cannot provide services, which will lead to the fact that the data that can be extracted during investigation cannot be extracted at the time of trial, and finally the authenticity of the data cannot be determined.

The integrity of electronic data is also an important direction for verifying its authenticity. For the authentication of the original storage medium, the seizure and sealing status of the original storage medium can be reviewed, as well as the access logs and file modification timestamps of the stored data. For the verification of extracted data, methods such as reviewing video recordings of data collection and extraction processes, verifying whether the integrity check value (hash value) of electronic data has changed, and comparing it with backup data can be used for verification.

3、 Cross examination of the correlation between electronic data

The core point in proving the correlation nature of electronic data is to raise reasonable questions about whether the collected electronic data is under the management or control of the defendant.

In terms of the management of domain names or cloud hosting resources, it can be questioned whether they were purchased, directly managed, or indirectly managed by the defendant. The common way to determine whether to manage or not is to check whether you have a password or access key files for remote login. For network service programs, to determine whether the defendant submitted the upload and ran it, a more detailed evidence chain needs to be provided, and it needs to be compared with the locally developed program to confirm their consistency. In terms of app listing, it can be determined whether the application was personally operated by the defendant or was listed on the app market under their instructions by verifying the developer's account and submission records. Regarding the question of whether there can be an association between wallet addresses and defendants in blockchain, given that it is located in a decentralized network system, it is quite difficult to determine such an association. As for the user identity in foreign encrypted chat tools, it also faces considerable difficulties to meet the evidence recognition standards in criminal law.

By conducting correlation proof from multiple perspectives mentioned above, the evidential power of electronic data in identifying the defendant can be denied.

In short, electronic data has important evidential value in criminal cases, but it also comes with many challenges in terms of legality, authenticity, and relevance. Defense lawyers should fully utilize these cross examination perspectives to conduct a comprehensive review of the electronic data collection process, content integrity, and relevance to the defendant, in order to ensure a fair trial and maximize the protection of the defendant's legitimate rights and interests.