Digital criminal case as a tool for storing electronic/digital evidence

Turshin Andrei Ivanovich ORCID: 0009-0005-2926-9091 Postgraduate student; Department of Criminal Procedure Law named after N.V. Radutnaya; Russian State University of Justice 152850, Russia, Yaroslavl region, Poshekhonye, Sogozhi river embankment, 2, sq. 9 antursh@yandex.ru

It is difficult to deny that information technology has a significant impact on the field of criminal justice. A whole group of "cybercrimes" has appeared, the traces of which are captured by computer devices in electronic form ^{[1, pp. 10-53]}. The ease of modification is noted, as well as the absence of a procedural procedure for collecting and recording digital information attached as evidence ^{[2, p. 177]}. In this context, it is particularly important to ensure the safety and immutability of electronic evidence — information recorded in electronic and digital form, used to establish the circumstances to be proved in accordance with Article 73 of the Code of Criminal Procedure of the Russian Federation ^{[3, pp. 86-88]}. L. A. Voskobitova points out the need to create a special procedure for storing and ensuring the reliability of electronic evidence ^{[4, p. 102]}. Increasingly, there are proposals to introduce an electronic criminal case, which should ensure the storage of electronic evidence ^[3]. The works of many authors are devoted to the digitalization of criminal proceedings, the problems of electronic criminal proceedings and electronic evidence: S. V. Zuev, N. A. Morugina, O. V. Kachalova, Yu.A. Tsvetkov, A. F. Abdulvaliev, A. I. Zazulin, P. S. Pastukhov and others. The publications consider the concept of electronic criminal proceedings, analyze the foreign experience of its implementation, identify the advantages and risks of switching to it in the Russian Federation. At the same time, the issue of using an electronic criminal case to attach and store electronic evidence is either not addressed or mentioned superficially, not being the main one. In this regard, it is important and relevant to study the electronic criminal case from the point of view of ensuring the safety of electronic evidence with its help. The universal dialectical method of cognition, the logical method, analysis, synthesis, deduction, and induction were used to achieve scientifically sound research results. The formal legal method is used to study the current legal regulation. The method of legal forecasting made it possible to study the prospects for the introduction of electronic criminal proceedings from a scientific point of view. The conducted research allowed to obtain the following results.

To date, in order to preserve electronic information in the materials of a criminal case, it is copied to optical disks or flash drives ^{[5, p. 195]}. They are packaged, filed with paper documents and submitted to the court along with the criminal case. This method leads to a number of problems, potentially leading to a change, modification or complete loss of evidentiary information. Let's consider the most significant of them.

Electronic media in the form of optical discs are quite fragile, they are easily damaged during the design and transportation of paper materials to which they are usually attached. This is well illustrated by the appeal ruling of the Perm Regional Court in criminal case No. 22-2996/2023. In court, the presence of mechanical damage on the DVD was discovered, which did not allow to examine its contents. At the request of the prosecution, a copy of the video obtained from the Investigative Department of the Ministry of Internal Affairs of Russia was attached and examined. This method of information recovery was not recognized as a significant violation of the criminal procedure law, although it could have been changed during storage on a computer. However, in the absence of a surviving copy, electronic information that is valuable for establishing the circumstances of a criminal case may be lost with no prospect of recovery.

At the same time, it is very easy to lose the ability to reproduce the contents of a disc, it does not necessarily have to be broken into several parts. For example, the usual application of an explanatory inscription on the paper packaging of a disc can lead to difficulties in reproducing the information stored on it ^{[6, p. 217]}.

Flash drives are characterized by a large amount of computer memory, ease of handling and speed of recording information. However, their significant drawback stands out. CD-R and DVD-R discs cannot be overwritten, and the information stored on them cannot be changed. In turn, it is extremely problematic to completely protect a flash drive from file conversion. Thus, optical disks are vulnerable on the physical level, while flash drives are vulnerable on the digital level.

In addition, difficulties arise when reviewing electronic information at the pre-trial stage. The desire to ensure the immutability and safety of information on electronic media in some cases leads to restrictions on the rights of participants in criminal proceedings. A. I. Zazulin cites a refusal to familiarize himself with electronic media as a violation of the right to protection due to possible "violation of the integrity or damage of information during copying" ^{[7, p. 660]}. Such concerns are quite logical, since the person leading the preliminary investigation in most cases does not have deep knowledge in the field of information technology. On the other hand, modern technologies make it possible to get acquainted with electronic information without the risk of damaging or editing it ^{[7, p. 663]}.

In some cases, excessively closed storage of electronic media leads to unexpected difficulties during court proceedings. For example, as follows from the appeal ruling of the Omsk Regional Court in criminal case No. 1-397/202, it was only during the court session that the presence of 8 unrelated recordings on the disk was established. The request to postpone the trial in order to attach a proper disk was not granted. In fact, the Public Prosecutor was deprived of the opportunity to present and examine relevant evidence. Reviewing the decision, the regional court pointed out the inconsistency of the argument about sufficient time to prepare evidence, since the absence of the necessary information on the disk was established only during the judicial investigation. Consequently, the court of first instance dismissed the prosecution's motion without sufficient grounds, which affected its participation in the evidence.

Based on the above, the disadvantages of the current procedure for handling electronic evidence become apparent, consisting in the insufficient reliability of the electronic media used, difficulties in familiarizing with them due to conservative requirements for their storage in sealed form as a tangible object in a criminal case. In contrast to the storage of electronic evidence on separate media, proposals are being made for their attachment through an electronic criminal case. An electronic criminal case is understood as a set of electronic documents that provides research, verification and evaluation of evidence through an electronic document management system ^{[8, p. 164]}. In the Russian Federation, the creation of such a system is just beginning to be discussed at the theoretical level. The experience of foreign countries is often analyzed in the literature. As a rule, it is positive, but it is not devoid of vulnerabilities ^{[9, pp. 161-164]}. The key risks of the electronic format, which should be taken into account first of all, is considered to be an increase in the chance of falsification and access to secrecy ^{[10, p. 100]}. Thus, it is necessary to analyze the electronic criminal case for the possibility of ensuring the preservation of electronic evidence, countering the identified threats.

Unlike portable media, an electronic criminal case stores information on a server, that is, an information carrier that does not have any limits on the amount of stored data ^{[11, p. 34]}. In this case, each electronic proof is individualized not in connection with a specific medium, but in the form of a separate file (document) with a name and accompanying explanatory data. A high level of information security on the server is ensured by the use of RAID array technology, that is, simultaneous storage of information on several media ^[12]. It is possible to create backup servers located at a significant geographical distance, which allows you to save all data in the event of a natural disaster or anthropogenic impact. Backup is considered effective for system recovery and is recommended for use in electronic document management systems by the National Standard of the Russian Federation GOST R 54471-2011. It can be stated that there are enough technical solutions that make it possible to ensure reliable storage of evidentiary and other information without the risk of its loss.

Verification of information for the absence of changes can be provided by calculating a "checksum", which, using mathematical algorithms, allows you to represent any information stored on a computer in the form of a sequence of fixed-length characters. Any modification or modification of the contents of an electronic document, even as invisible to a person as a single letter in the text of a book, will lead to a complete change in the checksum ^{[13, pp. 120-127]}. In this regard, familiarization with electronic information can be carried out through interaction with its copy, the correspondence of which to the original information is confirmed by calculating and comparing their checksum ^{[14, p. 151]}. This eliminates the risk of changing information during its research.

As noted earlier, there are reasonable concerns about the security of the electronic criminal record. Indeed, there are publications in the news about hacking the database of a company, which leads to the dissemination of personal data of its customers. In the field of criminal justice, such leaks are unacceptable and unacceptable. However, this does not mean that it is absolutely impossible to create an electronic criminal case. Protection against hacking can be provided by isolating the system from the external environment, as implemented in the information networks of the Ministry of Defense of the Russian Federation ^[15]. With the help of the identification system, it is possible to establish various levels of access, including limiting interaction with evidence only in a case that is under the jurisdiction of a particular subject. The disadvantages of this method of ensuring security include isolation from the external Internet, which will result in the lack of direct access to the evidence base from the defense without appearing directly to the investigator, inquirer or court. It seems that this is a necessary measure to ensure a high level of data protection. On the other hand, the attachment of documents with evidentiary value by the defense side can be implemented through the online module of the criminal case, which is not connected to the general repository of evidence. The person conducting the proceedings will be able to verify such information and subsequently move it to a secure virtual storage.

It is possible to reduce the risk of falsification and increase the transparency of its storage in electronic form by automatically documenting all actions with the attached data. Any access, review, addition or modification of the materials of the criminal case should be automatically recorded in a separate electronic document that cannot be edited.

It should be noted that all the mentioned means of preserving the reliability of evidence begin to operate only from the moment they are attached by uploading an electronic criminal case file into the system. In this regard, it is necessary to resolve the issue of the procedure for the actions of the staff of the preliminary investigation bodies at the stage of collecting and attaching electronic information as evidence. To some extent, a procedural form has already been prepared for this purpose in the form of the procedure for copying information from electronic media, which includes the participation of a specialist and the preparation of a protocol, as well as proposals made in scientific papers on calculating and fixing the checksum of the attached information in the protocol ^{[14, p. 15]}. At the same time, neither the current method of attaching electronic media nor an electronic criminal case can artificially ensure the reliability of information that is obviously untrue. They are only more or less aimed at preserving and confirming the immutability of information during the storage of electronic information, which makes it possible to demonstrate the absence of falsification of electronic evidence.

Other disadvantages of introducing an electronic criminal case include the cost of resources for the implementation of such a project, the need to train participants. However, given the international experience and the general trend towards digitalization, these obstacles look surmountable. Initially, an electronic criminal case can be implemented as a project in several subjects of the federation ^{[10, p. 101]} or for certain types of proceedings ^{[16, p. 96]}, subsequently completely replacing the paper form.

Related to this is the problem of "duplication" of criminal case materials. L. V. Golovko indicates that some of the documents will be stored in paper form, some in electronic form, and physical evidence separately ^[17]. However, as P. S. Pastukhov rightly notes, the transition from a paper-based documentation system to an electronic digital one leads to the displacement of the electronic written form ^{[18, pp. 128-129]}. Thus, when a high level of security of an electronic criminal case is achieved, a situation is possible where only the very physical evidence that cannot be "uploaded" into electronic form will remain outside of it. Consequently, the state of the materials will be in the same split form as it is today: documents in electronic form and physical evidence that require separate storage.

From the results of the conducted research, it follows that it is permissible and necessary to develop and implement an electronic criminal case system in the Russian Federation, which allows for the attachment and storage of electronic evidence. An electronic criminal case can fully comply with security requirements and provide protection against falsification, ensuring the safety and immutability of the information contained in it. It has been established that the format of an electronic criminal case makes it possible to offset the disadvantages of electronic media used today: instability to external damage (optical discs), inability to provide sufficient protection against modification (flash drives), significant limitations when reviewing information recorded on these media at the pre-trial stage.

At the same time, an electronic criminal case is not a tool for automatically ensuring the reliability of evidence. Its main function is to preserve the immutability of electronic information from the moment it is shared. It cannot act as a means of artificially making data reliable solely on the basis of the fact that they are uploaded to an electronic file and should not lead to excessive formalization of evidence. Therefore, the transition to an electronic criminal case should be aimed not at destroying existing legal standards, but at supplementing and improving them through the introduction of digital technologies.