In writing only: email and e-filing

KSTGeneral information, not legal advice
← Case Studies

In-depth analysis · Criminal · Korean original

The Computer Was Returned, but Where Did the Information Remain? A Structural Analysis of a Case on the Search and Seizure of Electronic Information

Translated from the Korean original. Read the Korean

An analysis of the actual case structure confined to the publicly available decision. The original investigation records, the original warrants and the forensic logs were not inspected. Factual statements are limited to what is stated in the decision, and the supplementary verification table sets out research questions rather than a list confirming that actual records exist. This piece analyses the reasoning of the 2015 decision. It is not a legal opinion reviewing subsequent case law and current law as a whole.

Supreme Court Order 2011Mo1839 dated July 16, 2015 (en banc). The analysis reconstructs the path the information took from the removal of the original storage media through imaging, re-copying and a warrant for a separate offence. It then reads the judgments that diverged over the same facts, which treated them as a whole procedure, as individual stages, or item of information by item of information.

Published

1. What This Decision Quashed and What It Did Not Decide

The starting point for understanding this case is not whether a crime was committed. It is the route by which the investigative authorities obtained and came to hold the information. The prosecutor filed a re-appeal against the quasi-appeal decision of the Suwon District Court that had quashed the seizure dispositions. The Supreme Court dismissed the re-appeal. The disposition in these proceedings cannot be read as a determination of guilt or innocence on all the allegations against the person from whom the items were seized.

The Majority Opinion found no illegality in the initial imaging itself. Even so, it upheld the quashing of the entire search and seizure under the first warrant, on the ground of serious illegality arising in the subsequent re-copying, searching and printing. It also held that the execution of the separately issued second warrant was unlawful. The central difficulty of this decision is that three propositions hold at once: a lawful start, an unlawful subsequent process, and quashing of the whole.

The units of analysis must also be distinguished. Whether to quash a search and seizure disposition, whether the investigative authorities may continue to hold a copy, and whether a particular item of evidence is admissible at trial are connected questions, but they are not the same question. The several opinions attached to the decision diverge precisely over where to sever or maintain this connection.

2. Looking at Roles and Hand-Over Points Rather Than Personal Dispositions

The public decision features two quasi-appellants and several investigative actors. The following account does not trace the parties' real names; it follows their roles. What matters is which unit first obtained which information and to whom it handed over the next task. A change of unit does not, by itself, mean that the route by which the information was obtained starts afresh.

ActorRole confirmed in the decisionPoints to separate in the analysis
Quasi-appellant 1 and persons on its sideParty concerned in the breach-of-trust allegation under the first warrant. An office in the company building was searched, and they observed the imaging process.Initial observation and the guarantee of an opportunity to participate in subsequent procedures are separate matters.
Quasi-appellant 2, the companyConsented to the removal of the storage media and had the originals returned after imaging.The object and purpose of the consent to removal are not to be read broadly as consent to a search of unrelated information.
Prosecutor of the Violent Crimes Division, Suwon District Prosecutors' OfficeExecuted the first warrant, handed the media over to the Forensic Center, re-copied the data onto an external hard disk, searched and printed it, and gave notice of information on a separate offence.Distinguish each point in time of the movement of media and of the selection of information.
Digital Forensic Center of the Supreme Prosecutors' OfficeTook part in the stage of copying the electronic information on the storage media to the remote digital cooperation system by imaging.The body performing the technical work and the scope of authority to use the information are not the same question.
Prosecutor of the Special Investigation Division, Suwon District Prosecutors' OfficeObtained the second warrant using the information on a separate offence as supporting material, and searched and printed from the external hard disk.Examine the existence of the new warrant together with the lawfulness of its supporting material and its execution.
The quasi-appeal court and the Supreme CourtHeard the quashing of the dispositions and the re-appeal against it.Do not confuse the procedure for controlling searches and seizures with a substantive adjudication of all the alleged criminal facts.

3. A One-Month Timeline: When Participation Occurred and When It Disappeared

According to the decision, the initial warrant was issued and executed on site on the same day. The work of finding and printing the necessary information, however, did not end that day. Re-copying and searching continued even after the originals were returned to the company. A timeline that records only who was present on site therefore misses most of the procedure.

TimeEvent stated in the public decisionQuestion opened at that point
April 25, 2011The first warrant for the breach-of-trust allegation was issued and executed. Storage media containing both related and unrelated information were sealed and removed with the company's consent.What circumstances and warrant conditions led to removal off site instead of selection on site?
On or around April 26, 2011The storage media were handed over to the Digital Forensic Center of the Supreme Prosecutors' Office.Who received which media, and who could access them afterwards?
April 27, 2011Persons on the party's side were notified, observed the unsealing and the imaging, and left of their own accord partway through.Which task was the departure that day a choice about, and does it extend to later, separate tasks?
After completion of the first disposition (exact return date not stated)The original storage media were returned to the company. Work using the imaged copy continued afterwards.Are the materials confirming the return of the originals distinguishable from those confirming the copies remaining with the investigative authorities?
May 3–6, 2011The second disposition: the imaged copy was re-copied onto an external hard disk held by the prosecutor.Who had an opportunity to verify the creation and the scope of use of the additional copy?
May 9–20, 2011The third disposition: while searching the external hard disk for information relating to the breach-of-trust allegation, information relating to suspected violations of the Pharmaceutical Affairs Act and the Punishment of Tax Evaders Act was also printed.When and how did the search for the original allegation and the acquisition of information on a separate offence diverge?
On or around May 26, 2011A prosecutor of the Special Investigation Division obtained the second warrant using the information on a separate offence as supporting material, and searched and printed from the same external hard disk.On material obtained by what route did the new warrant rely, and was there a separate opportunity to participate?
October 31, 2011 / July 16, 2015The Suwon District Court quashed the dispositions, and the Supreme Court then dismissed the prosecutor's re-appeal.In a completed search and seizure, how far should the unit of quashing extend?

4. From the Originals to the Investigation of a Separate Offence: Dividing the Movement of Information into Six States

This table is the analyst's reconstruction of the path of the information as stated in the decision. Actual media identification numbers, file lists, hash values and access logs cannot be confirmed from the public decision. The table therefore does not mean that the technical identity of each copy has been directly verified. It is a map for asking whether an explanation that the copies contain the same content is, by itself, enough to make the authority and procedure at each stage the same.

State of the informationConfirmed movement and useControl to be examined separately
Original storage media at the companySealed on site and removed to the investigative authorities.The object and method under the first warrant, and the consent to removal
Imaged copy at the Forensic CenterAll electronic information files were copied. The Majority Opinion recognised the initial lawfulness of the first disposition.The scope of observation and consent, and the purpose of prompt return of the originals
The prosecutor's external hard diskThe imaged copy was copied again on May 3–6.Opportunity to participate in the new copying, and prevention of the spread of unrelated information
Material searched and printedInformation relating to the original allegation and information relating to a separate offence were printed together.Scope of the search, assessment of relevance, and selection of what was printed
Supporting material for the second warrantInformation on a separate offence was passed to another investigative unit and submitted as the basis for a new warrant.The prior procedure through which the supporting material was produced
Material searched and printed again under the second warrantThe Special Investigation Division secured information on a separate offence from the external hard disk.Right to participate and delivery of a list in the separate execution, and the problem of the existing route of acquisition

5. The First Warrant Was Not Permission to View Every File Freely

The execution conditions of the first warrant, as quoted in the decision, provided even for how a device containing mixed information was to be handled. They restricted full copying or imaging without the consent of the owner or other relevant persons, and prescribed that related information be copied or printed after confirmation. For exceptions, such as where printing or copying was impossible or considerably difficult, they permitted seizure of the storage device itself but attached conditions for its return. The single fact that a warrant had been obtained does not make these conditions disappear.

The Majority Opinion set out a framework that exceptionally permits removal off site where, owing to circumstances at the scene or the large volume of information, printing or copying limited in scope is impossible or markedly difficult. It found that the removal in this case fell within that exception. It also held that the first disposition was not unlawful, because it was a measure for returning the originals promptly and implied consent and participation could be recognised.

The problem the exception solves here is the place and method of the selection work. It does not also enlarge the extent to which information unrelated to the original allegation may be used for new investigative purposes. Whether the whole of the originals could be copied once, and whether particular files within that copy could later be searched and printed, must therefore be explained with different materials and reasons.

7. If Re-Copying Is a Technical Task, Does It Have No Legal Significance?

The second disposition was the task of moving the imaging file again onto the prosecutor's external hard disk. The explanation that no new file content was created is technically arguable. What was at issue in the decision, however, was not only whether the content was new. The issue was the place of that step in the procedure: information relating to the original allegation and unrelated information were placed together on an additional medium, and that copy made the subsequent searching and printing possible.

The Majority Opinion regarded re-copying and printing as an important process by which actual evidence is acquired. That is why it required the right to participate and measures to prevent arbitrary copying of unrelated information. Even assuming there were material showing that the contents of the two media were completely identical, that material would only explain whether anything had been altered. It would not automatically prove the permitted scope of the creation, access to and use of a new copy. Technical identity and procedural lawfulness belong in different columns.

Nor is there any basis in this analysis for concluding that the re-copying was evidence of a hidden intention. The public decision does not reveal the state of mind of any particular prosecutor or technician. It does, however, give reason to verify who was subject to what controls at the point when the additional copy was created. If the second disposition is dismissed as mere preparatory work, the actual starting point of the third disposition can no longer be explained either.

8. Procedural Problems That Remain Even After Information Is Labelled Related

The work on May 9–20 was a process of searching for information relating to the breach-of-trust allegation in the first warrant, but information on a separate offence, relating to suspected violations of the Pharmaceutical Affairs Act and the Punishment of Tax Evaders Act, was also printed. Here, unrelated information does not mean information that is worthless or has no connection with any crime. It is a relative classification: information unrelated to the facts of the allegation in the first warrant. The fact that information may be important to some separate offence does not widen the scope of the original warrant.

The Majority Opinion held that, in the absence of necessary measures such as the right to participate, the process could not in principle be assessed as lawful even if, in the end, only related information was copied or printed. The reason is that guaranteeing the opportunity to participate and taking measures to prevent arbitrary copying of unrelated information are required separately from the selection of what is copied or printed. What was read and then discarded, or whether something was used only as a lead for the investigation of a separate offence, may not appear in the list of files finally submitted. This is the risk the supplementary opinion to the Majority Opinion particularly emphasised.

The assessment of relevance and the assessment of the right to participate must therefore be made separately. It is necessary to examine whether material is connected with the original allegation, but a conclusion that it is connected does not by itself settle the lawfulness of the route by which that material was reached. Conversely, a finding that the procedure was unlawful does not by itself support the conclusion that what a document states is untrue. The content of the information, the route of acquisition and the possibility of its use at trial must be read separately.

9. Which Problem Did the Belatedly Obtained Separate Warrant Fail to Solve?

This decision did not close off the route of obtaining a separate warrant for information on a separate offence discovered by chance. It explained that where, before the original search and seizure is completed, information on a separate offence is discovered by chance during a lawful search for information relating to the original allegation, the investigators may stop further searching, obtain a separate warrant, and search for and seize that information. This contains a sequence: lawfulness of the search before discovery, cessation of further searching, and a separate warrant.

This case failed at that starting condition. The information targeted by the second warrant was on the external hard disk that had been re-copied arbitrarily without giving an opportunity to participate. The Majority Opinion held that this information was itself unlawfully seized property and therefore did not meet the requirements, explained above, for requesting a warrant for information on a separate offence. A description that information was discovered by chance and a legal assessment that it was discovered in the course of a lawful search are not the same thing.

The new execution had its own separate problems. The prosecutor of the Special Investigation Division did not give the party's side an opportunity to participate and did not deliver a list of the electronic information seized. The decision held the entire execution of the second warrant unlawful on the further ground that there had been no opportunity to participate at all. The second warrant in this case must therefore be examined on two levels: the route by which the prior information was acquired, and the procedure of the new execution. The single fact that a warrant was later issued cannot be read as automatically removing the earlier illegality.

Nor does the fact that the information on a separate offence was already on the investigative authorities' disk extinguish the position of the person who originally managed it. The decision explained the right to participate and related rights in the separate procedure by reference to the person who had managed that information since before the original search and seizure. Looking only at where the information currently sits misses whose interests must be protected in a procedure concerning a copy held by the investigative authorities.

10. Four Ways of Dividing the Same Facts

Dividing the conflict of opinions into a side that values due process and a side that does not loses the actual issue. The several opinions all accepted the need to control unrelated information, but differed on what to treat as a single unit of quashing and on which point in time should carry weight. The table below summarises the divergence concerning the first warrant. The dissents must not be expanded into arguments that the execution of the second warrant as a whole was lawful.

OpinionUnit binding the judgmentConsequence in this case
Majority OpinionThe whole process of executing a single, completed warrant. Seriousness is assessed by the purpose of the procedure violated, the importance of the process, and the possibility of infringement of legal interests.Recognised the initial lawfulness of the first disposition but quashed the whole because of the serious illegality of the second and third dispositions.
Separate Concurring Opinion of Justice Kim Yong-deokAssessment by stage is possible, and the purpose of the seizure and the need for continued retention at the time of the quasi-appeal decision are also examined.Agreed with the conclusion of quashing the whole. The first disposition was quashed not because subsequent illegality extended to it but because there was no need to continue holding its results.
Dissenting Opinion of Justices Kim Chang-seok and Park Sang-okThe whole process is assessed for each item of information subject to seizure, rather than by simply dividing the procedure into stages.Distinguished the unrelated-information part from the related-information part, and considered that the illegality was not serious enough to quash the related-information part as well.
Dissenting Opinion of Justice Kwon Soon-ilAssesses the substantive and procedural requirements of each individual disposition and distinguishes the effect of a lawful prior disposition.Agreed with quashing the second and third dispositions but dissented from the part quashing the first disposition as well, considering that the effect of the lawful first disposition is not retroactively denied by subsequent illegality.

11. Opinions That Would Delete the Same Copy Still Differed on the Grounds for Quashing

The Separate Concurring Opinion of Justice Kim Yong-deok and the Dissenting Opinion of Justice Kwon Soon-il appear close in two respects: both regard the initial imaging as lawful, and both hold that later illegality does not automatically render an earlier disposition retroactively unlawful. They part ways, however, on whether to quash the first disposition. The difference arises from how each connects lawfulness at the time of the disposition with the present need to maintain retention.

The Separate Concurring Opinion of Justice Kim Yong-deok treated the fact that the need to continue holding the material obtained under the first warrant had disappeared as an independent ground for quashing. That opinion records the prosecutor's statement that, although related material had been found, it was not submitted in the breach-of-trust case because its probative value was weak, for example because it duplicated existing evidence. It also records that, after the decision below, the acquittal in that breach-of-trust case became final. These are materials for judgment presented by the separate concurring opinion. They are not to be extended into outcomes concerning every allegation of a separate offence, nor recast as the Majority Opinion's reason for quashing the whole.

The Dissenting Opinion of Justice Kwon Soon-il reasoned that because the prosecutor may use evidence collected under a lawful seizure disposition, an error in another seizure disposition does not justify retroactively denying the effect of lawfully collected evidence. On that reasoning, it held that the lawful first disposition was not subject to quashing. It was the Separate Concurring Opinion of Justice Kim Yong-deok that considered the imaged copy should be deleted or destroyed. In the end, neither opinion makes subsequent illegality retroactive to the earlier disposition, but they give different answers on whether the disappearance of the need for retention should lead to quashing. This point vanishes when the case is reduced to a single box marked lawful or unlawful.

12. Two Opposing Explanations of the Effectiveness of the Right to Participate

What the supplementary opinion to the majority feared was that information could be used beyond the evidence later submitted. If a storage medium is searched without participation and only the relevant materials are then submitted to the court, the use of irrelevant information as a lead in the investigation of a separate case may never come to light after the fact. On this view, if procedural violations concerning relevant information are not also checked, the mechanism that enforces the scope of the warrant is weakened. The supplementary opinion saw quashing not merely as a sanction against investigative authorities but as a means of securing the effectiveness of procedural rules.

The joint dissent of Justices Kim Chang-seok and Park Sang-ok took the view that guaranteeing the right to participate matters relatively little for relevant information, and that the quasi-appeal stage should not foreclose even the possibility that such evidence may exceptionally be held admissible at trial. Their position is that the acquisition of irrelevant information should be quashed, but that it should be decided separately whether the violation concerning relevant information is grave enough to rule out its use from the outset. This is distinct from the assertion that the right to participate is unnecessary.

Justice Kim Chang-seok's supplementary opinion also pointed to technical limitations. As long as the forensic center's full image file remains, even allowing participation in particular re-copying or printing operations does not entirely eliminate the possibility of separate searches. In his view, more refined controls were needed, such as measures to prevent irrelevant information from being copied in the first place. This criticism should be read not as a factual statement that the majority actually required 24-hour monitoring, but as a counter-argument that took a different view of how effective that form of participation would be.

Read together, the two explanations make the research questions more concrete. These are separate questions: whether a record of notice alone could confirm the actual selection, what confirms access during periods when no one participated, and how to establish which copies remained after the work. The record table below is an analytical tool for examining this gap; it does not assert that the decision required a particular technical device.

13. Testing Plausible Explanations Against the Records

The published decision sets out the principal facts and rulings of this case, but it does not show every individual search query or work screen. The table below does not reopen facts that are already established. It is a review framework showing, for the analysis of similar cases, which records support or limit which explanations. Nor does it treat the absence of a record as automatic evidence of a particular person's intent.

Explanation to ReviewRecords That Test the ExplanationWhat This Case's Published Decision Allows Us to Say
They participated at first and then left of their own accord, so they had no intention of participating later.Notices stating the date, time, and scope of each operation; whether they were received; and what any statement declining to attend referred to.The initial voluntary departure and the later failure to offer an opportunity to participate are recorded separately. No grounds are given for extending the former to cover the latter.
Re-copying merely transferred copies with identical content.Records of the creation, access, and removal of copies; evidence of technical identity; and the scope permitted for each operation.The majority opinion treated the re-copying as an important stage of the search and seizure. The published decision alone cannot verify the detailed technical state of the copies.
Because the information on the other case came to light by chance, the later operations were permitted as well.When the information was first discovered; the searching, viewing, and printing before and after that point; and when the search was halted and when a separate warrant was executed.The decision does describe the discovery as accidental, but that did not avoid the finding that the re-copied information from which it started had been unlawfully seized.
Because another department obtained a new warrant, the acquisition was lawful and independent.The content of the notifications between departments; the source of the materials supporting the warrant application; and the notice, participation, and inventory for the separate execution.The second warrant also relied on the earlier information on the other case, and in the new execution there was neither an opportunity to participate nor delivery of an inventory.
Because the original was returned, the investigative authority's control over the company's information also ended.Apart from the receipt for the returned original, records of the remaining copies, their storage locations, access to them, and their disposal.The timeline, which shows that re-copying, searching, and printing continued after the original was returned, limits that explanation.

14. If the Original Records Could Be Inspected, What Should Be Linked First?

To test the structure of the case more thoroughly, collecting the contents of files is not enough. Materials are also needed that show who reached each file, when, and under what authority. The items below are not a list of materials that the author of this article has inspected. They are items to request and review, organized by where the gaps in the published decision might be filled; whether they actually exist and can be obtained must be checked separately.

Record BundleItems to LinkQuestion to Verify
Warrants and execution conditionsThe originals of the first and second warrants; the items, methods, and places of seizure; and the supporting materials for each application.Which method was permitted for which suspected offense, and what materials did the new warrant rely on?
Handover of media and copy creationThe times of sealing, handover, and return; identifiers for the originals and copies; and work records for the imaging and re-copying.Can we distinguish sameness of medium from sameness of information, and tell when separate copies were added?
Opportunity to participateThe content and delivery records of the notice for each task; the extent of attendance; statements declining to attend; and documents on delegation.Can we distinguish, date by date, between choosing not to participate and being unable to participate?
Search, selection, and printingSurviving search and viewing records, lists of selected files, print logs, and materials on relevance decisions.Can we identify when the search went beyond the scope of the original suspicion, and when information on the other case was first used?
Inter-departmental transmissionNotification documents on the other case and their attachments, times of receipt, and how these correspond to the materials for the second warrant application.How are the later materials connected to the earlier information?
Continued retention and terminationLists of seized items and electronic information, the status of remaining copies, and materials concerning return, deletion, disposal, or continued retention.When was the physical original returned, and when did retention of the information end?

15. Case Profile — The Risk Arose in the Expanding Path Rather Than in the Content

Structurally, the case begins with materials from several cases stored together on a single storage medium. A warrant limited to specific suspected offenses led, through full imaging, to additional copies and printouts, some of which became the basis for a new warrant obtained by another department. The further the information moved, the wider its investigative use became, but after the initial observation no further opportunities to participate were given. The serious illegality that the majority found lay at a critical stage along this path.

The return of the original shows that the physical item was restored. That the copies could still be searched afterwards shows that control over the information remained separately. Copying the same content onto a different medium also creates separate opportunities for access and use. So the claim that identical information exists on different media does not, by itself, show that the procedure was the same, and the existence of a later warrant does not, by itself, allow the earlier acquisition path to be disregarded.

What this long analysis should leave behind is not a judgment of either side's motives but the points where facts are established and the points where the arguments diverge. In this case, the differences among the four opinions become clear when each of the following is read separately: the lawfulness of the initial imaging, the absence of later opportunities to participate, the printing of irrelevant information, and the source of the materials for the second warrant. Reduced to a short question card, it comes down to one question: have we kept the records that explain 'where this file came from' separate from those that explain 'whether that path was permitted'?

Sources and verification notes

  1. Supreme Court Order 2011Mo1839 dated July 16, 2015 (en banc): Disposition and Reasons 1 and 3 ↗

    The official public decision was read directly on the Korea Law Information Center. The disposition, the general legal principles in Reasons 1 and their application to the case, and the conclusion in Reasons 3 were confirmed. The decision is not used as material verifying current legislation or subsequent case law as a whole.

    Checked 2026-09-30
  2. 2011Mo1839, Reasons 1(b): Warrant Conditions, Removal, Imaging, Re-copying and Searching ↗

    The facts stated in the official decision on the basis of the reasons for the decision below and the record were confirmed. The author did not inspect the original record and has not added the exact date of the return of the originals, technical logs or media identifiers.

    Checked 2026-09-30
  3. 2011Mo1839, Reasons 2: Information on a Separate Offence and the Second Warrant ↗

    The following were distinguished: the conditions for chance discovery during a lawful search; cessation of further searching and a separate warrant; the right of the original manager of the information to participate and to receive a list; and, in this case, the prior illegality and the problems of the new execution.

    Checked 2026-09-30
  4. 2011Mo1839, Reasons 4–6: The Separate Concurring Opinion and the Two Lines of Dissent ↗

    The full texts of the Separate Concurring Opinion of Justice Kim Yong-deok, the Dissenting Opinion of Justices Kim Chang-seok and Park Sang-ok, and the Dissenting Opinion of Justice Kwon Soon-il were confirmed. Division by object was not confused with division by stage. The separate concurring opinion's reference to the final acquittal in the breach-of-trust case was confined to that opinion's argument on the need for retention.

    Checked 2026-09-30
  5. 2011Mo1839, Reasons 7–8: Supplementary Reasoning of the Majority Opinion and the Dissenting Opinion ↗

    The opinions of Justices Lee In-bok, Lee Sang-hoon and Kim So-young supplementing the majority opinion, and the opinion of Justice Kim Chang-seok supplementing the dissenting opinion, were checked. The competing arguments on the limits of ex post control and on the effectiveness of the mode of participation have each been attributed to the relevant opinion.

    Checked 2026-09-30

General information and research commentary, not legal advice. Each entry identifies its facts, assumptions and sources.

↑ Back to the title
You are reading PRO SE
RISCON Labsrisconlabs.com