1. The rapid development of information and communication technology (ICT) and the spread of non-face-to-face digital transformation spurred by COVID-19, data encryption technology for information protection has become more powerful, and the networking of data due to the spread of cloud services is creating legal and technical challenges that are difficult to solve through traditional legal interpretation alone, creating obstacles to the discovery of substantive truth, which is the goal of the criminal justice process. Therefore, in obtaining digital evidence in the investigation process, we need to move away from the traditional concept of seizure focused on physical objects, and establish new methods and procedures that are compatible with the characteristics of digital data, as well as secure legislative support to support them.

  Against this backdrop, this study seeks to explore: i) the direction of improvement on the seizure and search provisions aligned with digital evidence; ii) the direction of legislation guided by the balance between the discovery of substantive truth and the protection of privacy in the investigative process in the digital environment; and iii) the possibility of introducing a new evidence acquisition method that considers how digital data exists as determined by their technological methods.

  As such, this study progresses as follows: i) review the current seizure and search regulations in the Criminal Procedure Act and the issue of incompatibility with digital evidence; ii) analyze changes and trends in the relevant case law and legislations, highlighting major issues related to the seizure and search of digital evidence; iii) compare legislations and policy changes in major countries aimed at addressing the seizure and search nf digital evidence; and iv) examine the necessity of new methods for compulsive investigation to secure digital evidence.

  2. The incompatibility between the current law and digital evidence can be discussed from several perspectives: incompatibility with the concept of seizure; incompatibility with the method of seizure; and incompatibility with the legislative structure. First, the incompatibility with the concept of seizure stems from the fact that the current Criminal Procedure Act limits the scope of seizure to tangible objects. However, we also need to consider that digital information itself cannot be seized because the seizure of digital information cannot exclude the affected person from possessing the information. Next, the incompatibility with the method of seizure arises from the fact that the existing investigative methods have come to face practical limitations in securing digital data evidence due to changes in the digital technology environment. Therefore, we need to discuss the introduction of new investigative methods to ensure efficient securing of digital evidence. Finally, the incompatibility with the legislative structure has its roots in the unreasonableness of how the titles and chapters of the current Criminal Procedure Act are organized. The Act, as it is currently organized, ignores the fundamental difference between trial process and the investigative process by applying the rules for the former mutatis mutandis to the latter. This not only creates a gap between the actual law and the reality, but also restricts the ability to proactively respond to changes in the investigation environment boosted by technological advancements.

  3. From the early 2000s, when the importance of digital evidence in criminal proceedings began to be discussed, to the present, only 17 bills have been introduced in the National Assembly to amend the digital evidence provisions in the Criminal Procedure Act. As for the purpose of the bills, before 2015, most of them were aimed at ensuring the protection of personal information and the right to control one’s own information. In and after 2015, bills were introduced to address the need to control the abuse of authority by investigative agencies in the digital evidence seizure process. After the so-called Nth Room case, in which the perpetrator blackmail victims into making sexually exploitative videos and spread them online, legislative bills were submitted that emphasized the need for an institutional mechanism for rapid securing and preservation of digital evidence. This legislative history suggests that the purposes of the legislative bills have changed in accordance with how the center of gravity shifts in the situation where the discovery of substantive truth conflicts with the protection of privacy as digital technologies develop. These changes can be also found in the content of the bills. Earlier bills were drafted with a focus on controlling the seizure and search process by introducing more granular provisions on investigative methods, so as to protect privacy and personal information. However, as IT technology become more advanced, many of the recent bills were proposed with a focus on securing digital evidence more faster and more efficiently, guided by the recognition that there are limitations in securing digital evidence through public authorities that are not equipped to keep up with the speed of technological advancement. Finally, in terms of the structure of the law, several bills were introduced between the early 2000s and 2018, for amending provisions on the seizure and search process in courts. To the contrary, since 2019, amendments to the Criminal Procedure Act related to the seizure of digital evidence have been proposed for amending the provisions on seizure and search at investigative agencies under Article 215 and the following articles of the Investigation Division. These changes in the structure seems to stem from the need for procedural control to address the expansion of the total amount of investigations and the need to introduce a new seizure and search method to secure digital evidence in situations where technical defenses are available to counter the power of the investigative agencies.

  On the other hand, a review of changes in the case law related to the seizure and search of digital evidence shows that, first of all, the right to participate in the seizure and search process was the main issue before 2020, whereas the seizure of voluntary submissions was primarily discussed in and after 2020. In addition, the criteria for determining the legality of seizure and search against digital evidence were initially discussed from the perspective of ensuring the fairness of the process and protecting the procedural rights of the defendants. However, with advancements in digital technology, the focus has shifted from procedural fairness to the due process for privacy protection, as advancements in digital technology greatly expanded the amount of information subject to seizure and search.

  4. This study also examines the evolution and trends in legislative issues related to the seizure and search of digital evidence in two sets of countries: Germany and Japan, which follows the civil law system; and the United Kingdom and the United State, which are common law countries. Germany, unlike the United States, has not only continued to incorporate new investigative methods made possible by technological advances into its laws over the past two decades based on the rule of law and the principle of proportionality, but has also attempted to offset serious violations of fundamental rights unforeseen by existing investigative methods through legislations. In Japan, the 2011 amendment to its Code of Criminal Procedure introduced new provisions on the seizure of electronic records including the execution in lieu of seizure of record media concerning electronic records, the seizure of record order copy, and the remote search and seizure. There were other provisions included in the bill for the amendment that did not make it into the final amendment due to their controversial nature, such as those on the extraterritorial search and seizure and the determination of the scope of seizure of electronic records. In addition, the amendment introduced a new system for the seizure of electronic record orders. However, the effectiveness of the system is currently being questioned as it lacks the means to enforce the order of the investigative agencies in case of non-compliance.

  The United States has explicitly built a seizure process aligned with the characteristic of digital evidence through several amendments, by specifying the information to be seized, introducing an electronic warrant system to speed up the process of requesting and issuing warrants, and introducing a trans-jurisdictional Network Investigative Technique warrant (NIT warrant) system to enable the seizure of information outside its jurisdiction. The Clarifying Lawful Overseas Use of Data Act (CLOUD Act) also allows for offshore seizures. In other words, when it comes to the procedures for the seizure of digital evidence, the United States adopted regulations that consider the efficiency of investigations rather than procedural controls to protect the privacy of suspects. Finally, in the United Kingdom, the 2001 Criminal Justice and Police Act (CJPA) not only specified information as an object of seizure, but also amended the 1984 Police and Criminal Evidence Act (PACE) to increase the scope of seizure to include "anything stored in electronic forms." In addition, the 2016 Investigatory Powers Act (IPA) allows the government to request provision and preservation of data by foreign telecommunication service providers, and intercept data at the request of a foreign country. The 1990 Computer Misuse Act (CMA) provides for online search, and the 2000 Regulation of Investigatory Powers (RIPA) allows the government to force a suspect to decrypt data, and subject a non-compliant suspect to criminal punishment. These legislations indicate how the United Kingdom has continuously addressed the difficulty in criminal investigations and the protection of personal data caused by the inability of the existing law to keep up with the rapid changes in ICT, by introducing and amending various laws and regulations.

  5. The main issues currently discussed regarding the seizure and search of digital evidence include procedural controls to ensure the legality of the seizure of digital evidence in criminal proceedings and the possibility of introducing a new seizure and search system that is compatible with digital evidence.

  To elaborate, the main issues discussed regarding the procedural controls to ensure the legality of seizure and search under the current Criminal Procedure Act include the right to participate and the seizure of voluntary submissions. Despite the importance of the right to participate in preventing violations of privacy and fundamental rights caused by the mixture of internal and external information in the seizure of digital evidence, the current legislations fail to stipulate clear standards for the right, causing controversies regarding its interpretation. Therefore, in order to ensure the effectiveness of the right to participate as a means to realize due process in the seizure and search of digital evidence, the relevant legislations need to clarify the legal status of the right, define the scope of the people with the right to participate, change the provisions for issuing seizure lists to exclude irrelevant information, which constitutes the essence of the right of participation, and establish procedures for the deleting and disposing of irrelevant information. As for the seizure and search of voluntary submissions, the issue arises mainly because, if we apply the rationale for the seizure of voluntarily submitted tangible objects to information storage media, it leads to the unreasonable conclusion that the entire media can be seized. In particular, the seizure of media containing a large amount of information related to personal privacy, such as smartphones, may cause serious violations of the privacy and fundamental rights of the person subject to the seizure unless the process complies with the basic principles that apply to the seizure of information. Therefore, voluntary submission of information storage media not only requires a process to verify the voluntariness of submission and limitation of the scope of submission, but also determination of relevance to the alleged facts, selective reproduction and display of the scope of seizure, and the protection of the right to participate in the seizure, which are aimed at ensuring the lawfulness of the process.

  This study also examines the order to preserve digital evidence, the electronic warrant system, the remote location search system, and the online search system as new methods of securing evidence in the digital environment.

  First, the order to preserve digital evidence is aimed at securing important digital evidence ly, minimizing the possibility of data loss or alteration by requiring telecommunications service or remote computing service providers to preserve data for a certain period of time. The preservation order is less likely to infringe on fundamental rights because it does not involve the transfer of data. However, it can be understood as a compulsory measure because it restricts data use and the performance of certain tasks. Therefore, a legislation of the data preservation order should provide requirements for the order including the exhaustion of other procedures, necessity, and relevance. The targets of the preservation order should be limited to telecommunications service or remote computing service providers. In addition, a certain time limit should be set for the data preservation order, and the order needs to be controlled by the courts as it constitutes an compulsory investigative measure.

  As for the electronic warrant system, the relevant provisions have been already legislated within the 2020 Act on the Use of Electronic s in Criminal Justice Procedures. As the Act has not entered into effect, it is high time that Korea improved on the warrant provisions in its Criminal Procedure Act. Specifically, the Act needs to lay the legal groundwork for the electronic warrant system, as well as a revision to the rules providing for exceptions to the principle of presentation of warrants.

  The remote search system is a means of obtaining digital evidence by accessing information storage media located at a location specified in the warrant, which can be used in a seizure and search against a person who uses cloud services or overseas email services. While the need for remote search in the current digital environment cannot be questioned, it would be difficult to fully accommodate remote seizure and search into the current statutory provisions because the geographical scope of the search would have to be expanded to include digital devices listed in the warrant and remote servers connected to the network.

  Therefore, a legal basis for remote seizure and search needs to be put in place under new statutory provisions separate from the current provisions that rely on the physical concept of space. In addition, as the expansion of the seizure and search authority may result in the infringement on the privacy of third parties or the jurisdiction of other countries, explicit provisions should be introduced to limit the scope of the authority to the extent permitted by the general access rights granted to the person against whom the seizure and search is conducted.

  Lastly, online search involves covert accessing another person's ICT system using technical means for the purpose of monitoring the use of the system, and reading in and recording the content stored in the system. It can be described as ‘lawful hacking’ by the state to respond to specific crimes. By its nature, online search infringes on fundamental rights more than any existing compulsory investigation methods. Therefore, it should be allowed only against criminal suspects, the target crimes and time limits must be explicitly defined, and a dual control mechanism should be introduced that consists of preventive regulation by the courts and follow-up regulation by the National Assembly.

  6. When we consider the direction of legislation to improve on the process of searching and seizing digital evidence, the discussion should be predicated on the recognition that as IT technology becomes more sophisticated, the possibility of prosecuting criminal activities using ICT and networks is bound to be restricted in practice. Ensuring appropriate seizure and search of information under this premise requires a judicial perspective and legislative reform that balance the protection of privacy and fundamental rights with the discovery of the substantive truth. In addition, the title and chapter structure of the current Criminal Procedure Act needs to be revised to separate the provisions on investigative procedures from those on the trial procedures, and regulate the investigation process through provisions specifically enacted for the purpose, rather than borrowing the provisions on the trial process. These would be more effective in ensuring appropriateness and judicial control of the investigative procedures.

  Lastly, policy considerations for improving the seizure and search process for digital evidence include strengthening the exclusion of illegally obtained evidence and deleting and destroying irrelevant information. As long as explicit provisions are in place to consistently maintain the lawfulness of the digital evidence seizure process, it would be desirable to apply the exclusion of illegally obtained evidence without exception in cases where procedural rules are violated, so as to minimize the possibility of privacy and fundamental rights being violated in the process of searching for and seizing digital evidence. Strict exclusion of illegally obtained evidence may provide a more powerful means of guaranteeing the legitimacy of investigation than any procedural rules. As for the second consideration, the deletion and destruction of irrelevant information is conducted as a means to eliminate the possibility of abuse or misuse of “imaging” copies of digital evidence seized by investigative agencies. However, it should be also considered that  the deletion and destruction of imaging copies immediately after seizure may undermine the fairness of criminal proceedings. As such, there needs to be a procedural discussion on when and how to delete or destroy imaging copies obtained by investigative agencies. A possible alternative would be requiring the court to store the evidence until the final and conclusive judgment.