# 11. Common legal pitfalls for programmers and tech professionals This section focuses on personal freedom and financial safety — essentially, avoiding imprisonment and costly lawsuits. Many developers and technical workers tend to treat the following issues as mere technical matters. In reality, they constitute specific criminal offenses under Chinese law or can lead to substantial civil liabilities. For each item, we list the relevant legal provisions and real-world cases published on the websites of the Supreme People’s Procuratorate and the Supreme People’s Court. The criminal law references come from a consolidated text republished by the Beijing Traffic Management Bureau, which reflects amendments introduced in the 11th Criminal Law Amendment. The items are ordered from those most likely to be underestimated by tech professionals to those with the most severe consequences. The first entry serves as a general guide: it explains how to assess risks before taking action and what steps to take immediately after any incident occurs. ### 1. Ask three questions before taking any action: Whose interests might be harmed? How capable is the other party of pursuing legal action? And how much evidence do I have? If legal action is taken, immediately hire a criminal defense attorney - Cost: No cost at all. Before acting, replace the question “Is this technically feasible?” with “Will the vendor, platform, or company file a police report?” The hard part is resisting the urge to think “this is a minor issue no one will care about” — server logs, payment records, and chat logs are all routinely subpoenaed during investigations. - In plain terms: Before doing anything, ask whether the vendor, platform, or company will report the incident to police. Server logs, payment records, and chat logs are all easily obtained during an investigation. If you are criminally detained, authorities must decide within 37 days whether to formally arrest you. You may hire a lawyer from the very first interrogation onward; those 37 days are the most critical window for securing effective legal representation. - Benefit: Any organization or individual who becomes aware of a crime may file a police report. Once authorities deem a crime to have occurred, they must open an investigation. After a criminal detention, police must request formal arrest approval from prosecutors within three days; this period may be extended by one to four days under special circumstances, or up to 30 days in cases involving multiple locations or serial offenses. Prosecutors then have seven days to make a decision. In total, the maximum timeframe for deciding whether to arrest is 37 days. From the first interrogation or upon being placed under any compulsory measure, you may retain legal counsel; during the police investigation phase, only lawyers may be hired. Lawyers must be granted access to clients within 48 hours of requesting a meeting. If the potential sentence involves lighter penalties such as probation or fines rather than imprisonment, you may be released on bail by posting a bond or securing a guarantor; this bail period may last up to 12 months nationwide. - Evidence grade: C - Sources:全国人大 (2018). 刑事诉讼法（2018 年修正，第三十四、三十九、六十七、七十九、九十一、一百一十、一百一十二条）. - Notes: These 37 days refer strictly to the interval between detention and the prosecutor’s decision on arrest; they do not represent the overall maximum detention period. Additional detention limits apply during the subsequent investigation phase. It is precisely during these 37 days that experienced attorneys can be most effective — meeting clients, submitting arguments to prosecutors that arrest is unwarranted, and applying for bail. Seeking legal help after indictment is far too late. All other items in this section address the same underlying issue: whether the other party has grounds to file a report. ### 2. Refraining from creating or selling game cheats and aids, including AI tools that only capture screenshots without touching memory - Cost: There is no monetary cost. The trade‑off is giving up potential income from such orders and “small tools.” The difficulty lies in the fact that this money comes quickly and it’s unclear who might eventually pursue legal action. - In plain terms: Selling to just 20 users or earning 5,000 yuan is enough to qualify as “serious circumstances,” leading to a sentence of up to three years. In especially serious cases the penalty ranges from three to seven years. One developer who created aim‑assist and wall‑hack cheats sold them over 80,000 times in three months, netting more than 30,000 yuan; he received a one‑year suspended sentence plus a 5,000‑yuan fine. Another individual obtained the game’s server code, ran a private server, and collected over 20 million yuan in payments; he was sentenced to four years in prison and fined up to 10 million yuan. - Benefit: Distributing programs or tools designed to intrude upon or illegally control computer systems can result in imprisonment of up to three years, along with a fine, or a fine alone if the circumstances are deemed “serious.” For especially serious cases the sentence rises to three‑seven years plus a fine. The threshold for “serious circumstances” is reaching 20 users or generating at least 5,000 yuan in illicit profit. Intentionally bypassing or sabotaging technical protection measures may also constitute copyright infringement, punishable by up to three years, or up to ten years in more severe instances. Official examples include Wang and others who sold memory‑modifying cheats; they earned over 30,000 yuan in three months and received a one‑year suspended sentence plus a 5,000‑yuan fine. Another case involved Xiang and others who sold the “TZ” series of cheats, generating over 200,000 yuan; Xiang got three years suspended and a 20,000‑yuan fine. Liu and others obtained server code, altered parameters, and ran a private server that attracted over 20 million yuan in payments; they received sentences ranging from four years down to two years and six months, along with fines from 1 million to 1.3 million yuan nationwide. - Evidence grade: A - Sources:全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百八十五条第三款、第二百一十七条第六项）. ；最高人民法院、最高人民检察院 (2011). 关于办理危害计算机信息系统安全刑事案件应用法律若干问题的解释（第三条）. （深圳市公安局转载）；最高人民检察院 (2026). 上海静安：严惩制售游戏外挂黑灰产共护清朗网络空间. ；最高人民检察院 (2021). 2020 年度检察机关保护知识产权典型案例（案例五）. - Notes: All published cheat‑related rulings involve programs that read or modify game memory and circumvent anti‑cheat systems. No official cases have yet addressed aids that merely capture screenshots or simulate keystrokes. Nevertheless, a recent ticket‑scaling case shows that even tools that do not touch memory but merely send requests can be deemed illegal data‑acquisition tools. Whether an act qualifies as a crime and which charge applies is determined by law‑enforcement agencies based on evidence supplied by game developers, not by the author’s interpretation. The requirement of just 20 users to meet the “serious circumstances” threshold is quite low. ### 3. Do not write or sell scripts for ticket snatching, flash sales, fake orders, or coupon farming — even if they merely “automate button clicks” - Cost: No expense and no time required - In plain terms: Even if a script does not modify memory or bypass security measures and merely sends requests faster than a human can, it still qualifies as illegal acquisition of computer system data. The legal threshold is either earning over 5,000 yuan or causing at least 10,000 yuan in losses. One individual bought multiple 12306 accounts and used them to snatch over 200 train tickets, netting more than 20,000 yuan; he was sentenced to 1 year and 6 months in prison, suspended for the same period, plus a fine of 5,000 yuan. Another person sold ticket‑snatching software online and was found guilty of unfair competition, ordered to pay 20,000 yuan in damages. - Benefit: Illegally accessing computer systems or obtaining their data via any technical means can lead to imprisonment of up to 3 years, a fine, or both; more serious cases incur 3–7 years in prison. The threshold for “serious circumstances” is earning over 5,000 yuan illegally or causing losses exceeding 10,000 yuan. Official cases include a person who used a bot to submit numerous ticket‑purchase requests using purchased 12306 accounts; he snatched more than 200 tickets and earned over 20,000 yuan, resulting in the same sentence as above. Zheng sold ticket‑snatching software for a specific booking app and was ordered to pay 20,000 yuan for unfair competition (national precedent). - Evidence grade: A - Sources:全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百八十五条第二款）. ；最高人民法院、最高人民检察院 (2011). 关于办理危害计算机信息系统安全刑事案件应用法律若干问题的解释（第一条）. ；最高人民检察院 (2026). 上海静安：查办利用外挂软件批量代抢火车票牟利案. ；最高人民法院 (2025). 2024 年人民法院知识产权典型案例（案例七，抢票软件不正当竞争案）. - Notes: Even scripts that do not alter memory or bypass security and merely operate faster than humans still fall under Article 285 of the Criminal Law. Both paid ticket‑snatching services and selling such scripts are considered profit‑generating activities. No official cases have been reported for individuals using such scripts solely for personal use. ### 4. The crawler only accesses publicly available pages that require no login; it does not attempt to bypass anti-scraping measures or handle any personal information, and any data it collects is never sold - Cost: No cost at all. A crawler is simply a program that automatically browses web pages and extracts the data on them. Before running one, check the robots.txt file and any API authorization guidelines — robots.txt is a file placed by website owners in their root directory that lists pages they do not want crawlers to access. Any data that requires a login, a token (a temporary access credential), or signature decryption to obtain is not targeted. The real challenge is resisting the temptation to collect such data even when technical means make it easy to do so — this depends entirely on self-discipline. - In plain terms: Any data that requires a login, a token, or signature decryption to access falls under bypassing protective measures; violations are punishable by up to 3 years in prison, or 3 to 7 years in more serious cases. Collecting personal information brings even heavier penalties. Possessing 50 or more records related to personal movement, communications, credit history, or financial information is already considered a serious offense. The same applies if you collect 500 or more records on accommodation, health, or transaction details, 5000 or more records of other types, or earn 5000 yuan or more from such activities. - Benefit: Illegally accessing system data by bypassing protective measures carries the same sentencing range as the third item (scripts used for ticket scalping or flash sale fraud): up to 3 years in prison, or 3 to 7 years in more serious cases. Illegally obtaining, selling, or providing citizens’ personal information also triggers heavy penalties if any of the following thresholds are met: 50 or more records on personal movement, communications, credit history, or financial details; 500 or more records on accommodation, communications, health, or transaction information; 5000 or more records of other types; or illegal earnings of 5000 yuan or more. Serious violations result in up to 3 years in prison, plus a fine or fine alone; extremely serious cases are punished with 3 to 7 years in prison. A real-world example: software developer Li used a feature disguised as a “face beauty detection” tool to steal 1751 facial photos from users’ phone albums, then sold data from a social engineering database he had compiled — he was sentenced to 3 years in prison, suspended for 3 years. A social engineering database is a collection of personal information leaked from various sources. Another case: an internet technology firm used a crawler to harvest store and order data from a food delivery platform, causing over 40,000 yuan in losses; it was prosecuted for illegally obtaining data from a computer information system (this case is documented nationwide). - Evidence grade: A - Sources:全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百八十五条第二款、第二百五十三条之一）. ；最高人民法院、最高人民检察院 (2017). 关于办理侵犯公民个人信息刑事案件适用法律若干问题的解释（第三、四、五条）. ；最高人民检察院 (2022). 检察机关依法惩治侵犯公民个人信息犯罪典型案例（案例二）. ；最高人民检察院 (2025). 检察机关依法惩治侵害企业数据安全犯罪 服务保障企业创新发展（案例一）. - Notes: A 2017 judicial interpretation states that “providing information lawfully collected from others without their consent” also counts as “providing personal information” under the law. This provision also applies to companies that share user databases with external partners. 5000 records is roughly the size of a small database table. ### 5. Refuse development orders for gambling, fraud, or adult-content apps; do not set up payment gateways or unblock accounts for such “clients” - Cost: No direct monetary cost. The trade-off is forgoing outsourcing projects that pay well but have vague requirements. The difficulty lies in the fact that these clients often offer significantly higher pay than normal projects. - In plain terms: Taking on such high-paying yet poorly defined projects means you could be treated as an accomplice in gambling crimes, facing charges under the crime of operating illegal gambling dens: up to 5 years in prison, or 5–10 years for serious cases. This is not the “merely helping out, maximum 3 years” category. In one e-sports betting app case, 28 developers in Hainan were sentenced to 1–3 years and 6 months for operating illegal gambling dens. Those who unblocked QQ accounts for fraud rings received 1 year and 6 months in prison plus a 20,000-yuan fine. - Benefit: Providing technical support or payment settlement services to known online criminals can lead to imprisonment of up to 3 years and/or a fine, especially when the circumstances are serious. If other crimes are also involved, the harsher penalty applies. Operating illegal gambling dens carries up to 5 years in prison plus a fine; serious cases bring 5–10 years. Official examples: Zhangsheng Group developed gambling games and handled “online distribution,” earning fees for website setup and reporting; the total illicit revenue reached nearly 7 billion yuan. Its leader was sentenced to 9 years and 9 months plus a 50-million-yuan fine. 79 developers, including Wang Qiang, received sentences ranging from 6 months to 9 years and 9 months. In another case, 28 developers in Hainan who built an e-sports betting app were convicted of operating illegal gambling dens and received similar sentences, plus fines. One individual who ran a studio unblocking QQ accounts for fraudsters got 1 year and 6 months in prison and a 20,000-yuan fine (nationwide). - Evidence grade: A - Sources:全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百八十七条之二、第三百零三条第二款）. ；最高人民检察院 (2023). 建赌博网站并出售，涉案近 70 亿元. ；最高人民检察院 (2022). 上海闵行区：办理一起新型开设网络赌场案. ；最高人民检察院 (2025). 依法惩治帮助信息网络犯罪活动及相关犯罪典型案例（案例一）. - Notes: “Knowing intent” does not require the client to explicitly state the purpose. When a quote is far above market rates, the app includes top-up, cash-out, and betting features, and the client refuses to disclose usage, these facts are used to prove you were aware of the illegal nature. Developers of gambling apps are prosecuted as accomplices in operating illegal gambling dens, not under the “Crime of Assisting Information Network Criminal Activities” which caps at 3 years. ### 6. Upon leaving a job, return all account access rights; do not delete databases, leave backdoors, or alter password protection systems — even if the employer owes you wages - Cost: No cost involved. If the employer owes you wages, pursue them through labor arbitration (see Section 7 on labor arbitration). The real challenge is resisting the urge to tamper with the system while angry. - In plain terms: Account credentials are issued by the employer, but they do not remain valid after you leave the job. Logging in using those credentials constitutes illegal control of computer systems, punishable by up to 3 years in prison. Deleting data to render the system inoperable is punishable by up to 5 years in prison; more severe cases incur sentences exceeding 5 years. One example: a dismissed senior engineer logged into his former employer’s servers using his original admin credentials, deleted data and logs, resulting in over 120,000 yuan in losses. He was sentenced to 3 years in prison, suspended for 5 years, and fined 30,000 yuan. - Benefit: Illegal control of computer information systems is punishable by up to 3 years in prison, with or without a fine; more serious cases incur sentences ranging from 3 to 7 years. Deleting or altering system functions or data to the point the system cannot operate normally is punishable by up to 5 years in prison; more severe cases incur sentences exceeding 5 years. Official cases include: after being dismissed, senior IT engineer Lü used his original admin account to access his former employer’s shared servers, changed passwords, and deleted data and logs, causing over 120,000 yuan in losses; he received the same sentence as above. Another case: Bai, an employee at a software firm, deliberately inserted faulty code into an upgrade program, rendering client systems inaccessible and causing over 40,000 yuan in losses; he was prosecuted for disrupting computer information systems nationwide. - Evidence grade: A - Sources:全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百八十五条第二款、第二百八十六条）. ；最高人民检察院 (2024). 检察机关「依法惩治网络犯罪 助力网络空间综合治理」典型案例（案例六）. ；最高人民检察院 (2025). 检察机关依法惩治侵害企业数据安全犯罪 服务保障企业创新发展（案例七）. - Notes: Account credentials are issued by the employer, but they do not remain valid after you leave the job. Logging in using original credentials constitutes “illegal control.” Losses are calculated based on data recovery costs; amounts in the tens of thousands of yuan are sufficient to initiate legal proceedings. ### 7. Do not take source code, client lists, or technical documents upon leaving; do not upload them to personal cloud drives or reuse them at new employers - Cost: No cost involved. Before leaving, simply delete all company-related files from your personal computer and cloud drives. The difficulty lies in the fact that some files were written by you personally, making it hard to part with them. - In plain terms: Even code written by you personally remains the company’s intellectual property — taking it away is essentially stealing company assets. Client lists also qualify as trade secrets. In one case, a former employee who took source code and core algorithms of a security inspection system to a new employer was sentenced to 5 years in prison and fined 500,000 yuan; the new employer was fined 4 million yuan. Another individual who exploited system vulnerabilities to download over 33,000 design files was sentenced to 1 year and 10 months in prison and fined 100,000 yuan. Beyond criminal penalties, companies can also pursue separate civil compensation claims. - Benefit: Violating confidentiality obligations by disclosing or personally using trade secrets may result in imprisonment of up to 3 years, along with a fine or both. In more serious cases, the sentence ranges from 3 to 10 years, plus a fine. The Anti-Unfair Competition Law also deems two acts as violations: using technical means to illegally access systems and obtain trade secrets, and aiding or abetting others in breaching confidentiality. Official examples include the aforementioned cases where former employees took source code and algorithms to new employers, resulting in heavy criminal and financial penalties. Additionally, an engineer who stored App module source code on personal devices and later developed a similar product after changing jobs was prosecuted for trade secret infringement nationwide. - Evidence grade: A - Sources:全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百一十九条）. ；全国人大常委会 (2025). 反不正当竞争法（2025 年修订，第十条）. ；最高人民检察院 (2025). 检察机关知识产权保护典型案例（案例七）. ；最高人民检察院 (2020). 2019 年度检察机关保护知识产权典型案例（案例十六）. ；最高人民检察院 (2025). 检察机关依法惩治侵害企业数据安全犯罪 服务保障企业创新发展（案例五）. - Notes: Code written by employees remains the company’s property, as stipulated in Article 13 (code developed using company resources belongs to the company). Taking such code away is equivalent to stealing company assets. Client lists are classified as business information and also qualify as trade secrets. Apart from criminal penalties, companies may also file separate civil lawsuits for compensation. ### 8. Do not run your own programs on others’ computers, servers, or cameras; do not use company machines for mining - Cost: No expense and no time loss - In plain terms: Controlling someone else’s computer, server, or camera without permission is illegal. Operating 20 or more such devices qualifies as a serious offense, punishable by up to 3 years in prison; especially severe cases may incur 3 to 7 years. Even if it does not rise to a criminal offense, offenders can still be detained for up to 5 days and fined between 50,000 and 500,000 yuan. For tech professionals, the most damaging consequence is a lifelong ban from holding key positions in cybersecurity management and network operations after any criminal conviction. - Benefit: Illegally controlling computer information systems is a crime. Serious cases result in up to 3 years in prison plus a fine; especially severe cases incur 3 to 7 years. Controlling 20 or more devices is deemed “serious.” Those not meeting criminal thresholds still face confiscation of illegal gains, up to 5 days of detention, and fines ranging from 50,000 to 500,000 yuan. More serious violations bring 5 to 15 days of detention and fines from 100,000 to 1,000,000 yuan. Anyone with a prior public security penalty is barred for 5 years, while those with a criminal record are barred for life from critical cybersecurity and network operation roles. Example: Li was sentenced to 3 years in prison suspended for 5 years and fined 20,000 yuan after using software to illegally control 105 surveillance cameras; Wu and others received 2 to 4 years and 6 months in prison for implanting malware into mobile phone motherboards to harvest verification codes from over 3.3 million devices. - Evidence grade: A - Sources:全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百八十五条第二款）. ；最高人民法院、最高人民检察院 (2011). 关于办理危害计算机信息系统安全刑事案件应用法律若干问题的解释（第一条）. ；全国人大常委会 (2025). 网络安全法（2025 年修正，2026 年 1 月 1 日施行，第二十九、六十六条；2016 年文本为第二十七、六十三条，终身禁业为修正后的第六十六条第三款）. ；最高人民检察院 (2022). 山东滨州开发区：办理一起非法控制计算机信息系统案. ；最高人民检察院 (2021). 充分发挥检察职能 推进网络空间治理典型案例（案例六）. - Notes: No published cases from China’s Supreme People’s Procuratorate or Supreme People’s Court address mining on company servers; this entry is written under the legal provision concerning unauthorized system control. The lifelong ban from key roles is an additional consequence under China’s Cybersecurity Law, carrying heavier weight for tech professionals than monetary fines alone. ### 9. Testing someone else’s systems without written permission — “good intentions” and “reporting afterward” are not excuses - Cost: No cost at all. Before joining a vendor’s SRC or public beta test, obtain a document that clearly defines the permitted scope, target systems, and allowed testing windows. An SRC is a vendor-run security response center designed to receive external vulnerability reports. Once a vulnerability is confirmed, testing must stop. The real challenge is resisting the urge to “give it a quick try.” - In plain terms: Whether a crime is established depends solely on whether you had permission and how much access you obtained — not on your intentions. Possessing 500 sets of ordinary account credentials, or earning 5,000 yuan while causing 10,000 yuan in losses, is enough to warrant a sentence of up to three years. Even a single attempt to export a user list to prove a vulnerability often exceeds that 500‑credential threshold. Using credentials you already possess outside their authorized scope also constitutes unauthorized access. - Benefit: This law applies to computer information systems belonging to ordinary companies and individuals, excluding those used for national affairs, defense, or cutting‑edge scientific research. Unauthorized intrusion or use of any technical means to obtain stored, processed, or transmitted data may lead to imprisonment of up to three years, a fine, or both, if the circumstances are serious; for especially serious cases, the sentence ranges from three to seven years with a fine. “Serious circumstances” include obtaining ten or more authentication credentials for online financial services such as payments or securities trading, 500 or more other authentication credentials, illegally controlling 20 or more computers, or earning illicit profits exceeding 5,000 yuan or causing losses above 10,000 yuan. Five times these thresholds define “especially serious” circumstances. Prosecutorial Example No. 36 states that “using accounts or passwords beyond the granted scope to log into a computer system is itself an act of unauthorized intrusion.” In that case, three individuals used work‑related credentials to access their company’s internal system, downloaded non‑work data, and sold it for 37,000 yuan; they received sentences of 4 years, 3 years 9 months, and 4 years respectively, plus fines of 40,000 yuan each. - Evidence grade: A - Sources:全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百八十五条第一款、第二款）. ；最高人民法院、最高人民检察院 (2011). 关于办理危害计算机信息系统安全刑事案件应用法律若干问题的解释（第一条）. （深圳市公安局转载）；最高人民检察院 (2017). 第九批指导性案例（检例第 36 号，卫梦龙、龚旭、薛东东非法获取计算机信息系统数据案）. - Notes: Prosecutorial Example No. 36 involves a data‑selling scheme; it is cited only for the principle that exceeding authorized scope counts as intrusion, not to suggest that well‑meaning tests incur identical penalties. Intentions and post‑test reporting cannot erase criminal liability; they may only influence sentencing or whether charges are filed. A vendor’s initial thanks and later filing of a report are not mutually exclusive — gratitude does not equal permission. At the time of writing, no publicly documented cases on permissible testing were found on the Supreme People’s Court or Supreme People’s Procuratorate websites; therefore this description relies on statutory provisions and penalty criteria. Always participate through a vendor’s official SRC or under a written contract that specifies scope, targets, and time limits. To prove a vulnerability, collect only minimal evidence and avoid bulk data extraction. Even conduct that does not meet criminal thresholds remains subject to administrative penalties, professional bans, and fines comparable to those outlined in Section 8 (running unauthorized programs on others’ machines). Guidance on post‑disclosure procedures appears in Section 10 (reporting vulnerabilities as required). ### 10. Vulnerabilities must be reported per regulations; no details, exploit tools, or disclosure to foreign entities before patching - Cost: No cost involved. Simply report the vulnerability to the product vendor or an official platform. Until the vendor releases a patch, no details or verification code should be disclosed. - In plain terms: The “Regulations on the Management of Security Vulnerabilities in Network Products” applies not only to companies but also to individuals. There are five strict rules for vulnerability disclosure; the first two state that no details about vulnerabilities affecting active systems may be released before a vendor provides a fix. Additionally, no programs or tools specifically designed to exploit those vulnerabilities may be published, and any release must include instructions on how to remediate them. One often-overlooked rule: unreported vulnerabilities must not be shared with any foreign organizations or individuals outside the vendor. - Benefit: These regulations govern three main groups: domestic network product vendors, network operators, and any organizations or individuals involved in discovering, collecting, or publishing vulnerability information. No entity may use vulnerabilities to compromise network security, nor may they illegally collect, sell, or distribute such information. Five additional rules apply to public disclosure: first, nothing may be released before a vendor provides a patch; second, no details about vulnerabilities in active networks or systems may be published; third, no exaggerated claims about risks or malicious exploitation attempts may be made; fourth, no tools or programs designed for malicious exploitation may be released; and fifth, any disclosure must include remediation steps. Unreported vulnerabilities must also not be shared with foreign entities. The regulations encourage reporting to four official platforms: the Ministry of Industry and Information Technology’s Cybersecurity Threat and Vulnerability Information Sharing Platform; the National Cybersecurity Information Notification Center’s Vulnerability Platform; the National Computer Network Emergency Response Technical Team/Coordination Center of China’s Vulnerability Platform; and the China Information Security Evaluation Center’s Vulnerability Database. Violators may face penalties ranging from fines of 10,000 to 100,000 RMB, suspension of services, revocation of licenses or business licenses, and even criminal liability for responsible personnel. - Evidence grade: A - Sources:工业和信息化部、国家互联网信息办公室、公安部 (2021). 网络产品安全漏洞管理规定（工信部联网安〔2021〕66 号，第二、四、九、十、十四条，2021 年 9 月 1 日施行）. ；全国人大常委会 (2025). 网络安全法（2025 年修正，2026 年 1 月 1 日施行，第二十八、六十五条；2016 年文本为第二十六、六十二条，规定第十四条援引的是 2016 年文本的条号）. - Notes: This regulation explicitly includes individuals as subjects; claiming “I’m just an amateur” does not exempt anyone from compliance. Submitting vulnerabilities found in domestic systems to foreign bug bounty platforms violates the rule prohibiting disclosure to foreign entities. This rule addresses how vulnerabilities must be handled after discovery. Whether one is legally permitted to test systems depends on other provisions, such as the requirement for written authorization before testing any system. Even legally discovered vulnerabilities may incur penalties if disclosed improperly. Unauthorized testing results in violations on both fronts. Among reporting channels, the MIIT platform and CNCERT are most commonly used. The regulations do not specifically address cases where a vendor is notified but fails to act; in practice, documentation of negotiation and reporting processes is required before official submission. ### 11. No selling of tools for bypassing firewalls or VPN accounts, no setting up such nodes for others - Cost: No expense or time required - In plain terms: Any individual or entity that builds their own outbound network connections or uses international channels outside of state-provided public telecom services may be ordered by police to cease internet access, receive a warning, and face fines up to 15,000 yuan plus confiscation of any illegal earnings. Those running businesses based on such services may be charged with illegal business operations; in severe cases, imprisonment of up to five years applies. This rule specifically addresses selling or setting up such nodes. For personal use only, the maximum penalty remains limited to a warning and fine as stipulated in Article 14 of the provisional regulations. - Benefit: Direct international internet connectivity must be facilitated via international gateway channels supplied by state-owned telecom networks. No organization or individual may independently establish or utilize any other channels, meaning neither private outbound connections nor third-party nodes are permitted. Violators face police orders to disconnect from the internet, warnings, and possible fines up to 15,000 yuan plus confiscation of illicit profits. Commercial operators violating this rule may be prosecuted for illegal business operations; severe violations incur up to five years imprisonment plus fines ranging from one to five times the illegal earnings. Particularly egregious cases may result in imprisonment exceeding five years nationwide. - Evidence grade: B - Sources:国务院 (1997). 计算机信息网络国际联网管理暂行规定（第六、十四条）. （重庆市农业农村委员会转载）；全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百二十五条第四项）. - Notes: At the time of drafting, no publicly documented court rulings regarding firewall circumvention were found on Supreme People’s Court or Supreme People’s Procuratorate websites, and regional enforcement practices vary widely; hence this B rating was assigned. This section exclusively addresses selling or setting up such nodes. For personal usage alone, the maximum penalty remains limited to warnings and fines as outlined in Article 14 of the provisional regulations. ### 12. After signing a non-compete agreement, if the employer fails to pay compensation monthly, send a written notice; if payment still doesn’t come after 3 months, you may terminate the agreement. Workers who never handled any trade secrets can request that the clause be declared invalid - Cost: No cost involved. Keep the original non-compete agreement and any proof that the employer didn’t make monthly payments after leaving the job. - In plain terms: A non-compete clause simply means you’re not allowed to work for a competitor for a certain period after leaving your job. This rule is there to protect you. The maximum duration is 2 years, and the employer must pay compensation every month. If the amount isn’t specified, it’s calculated as 30% of your average monthly wage over the previous 12 months, and it can’t be lower than the local minimum wage. If the employer fails to pay for 3 months due to its own reasons, you can ask to end the agreement. Starting in 2025, workers who never learned about or handled any trade secrets at their job can request that the non-compete clause be ruled invalid. - Benefit: Non-compete clauses only apply to senior executives, highly skilled technicians, and anyone with a duty to keep secrets. The maximum term is 2 years, and the employer must provide monthly financial compensation during that time. If the amount isn’t set, it’s 30% of your average monthly wage over the last 12 months, never lower than the local minimum wage. If the employer doesn’t pay for 3 months for reasons on its end, you can ask to cancel the clause. If the employer ends it voluntarily, it must pay an extra 3 months of compensation. From 2025, workers who never knew about or touched any trade secrets can ask to have the clause declared void. Any part of the clause that goes beyond what they actually knew about is also invalid. Official case example: A pharmaceutical firm sued its former CTO, Zheng, seeking 7.1 million yuan in damages. The court ruled that Zheng’s new employer’s products had no overlap with the original firm’s offerings, so the non-compete scope should be limited to what Zheng actually knew. The claim was dismissed in full (nationwide ruling). - Evidence grade: A - Sources:全国人大常委会 (2012). 劳动合同法（2012 年修正，第二十三、二十四条）. （抚顺市应急管理局转载）；最高人民法院 (2020). 关于审理劳动争议案件适用法律问题的解释（一）（第三十六至四十条）. ；最高人民法院 (2025). 关于审理劳动争议案件适用法律问题的解释（二）（法释〔2025〕12 号，第十三至十五条）. ；最高人民法院 (2025). 劳动争议典型案例（案例四）. - Notes: This rule is there to protect you. On the flip side, if the agreement is valid and the employer pays as required, but you still go to work for a competitor, you’ll have to pay the agreed-upon penalty. Even after paying that, you might still be required to serve out the remaining non-compete period. Non-compete terms agreed upon while you’re still employed also count as valid, even if no extra payment is made by the employer. ### 13. Code written during work hours using company resources belongs to the company; personal open‑source projects should be done in your own time and on your own equipment, without mixing them - Cost: No cost involved. When you start a new job, be sure to read the intellectual‑property clauses in your employment contract. The main difficulty is that personal projects and work tasks often share the same computer, so you must keep them separate. - In plain terms: Work‑related creations are defined as works made in the course of your duties. Software is explicitly listed in law as “copyright belonging to the employer.” If a program is primarily produced using company hardware, internal networks, or business data — and the company assumes responsibility for it — then the copyright rests with the employer. The same applies when the contract states this. As the creator, you retain only the right to be credited. Inventions developed using company resources also belong to the company, with patent rights following the same rule. Even if you write code “after hours,” using a company computer or business data can still make it qualify as a work created mainly with employer resources. - Benefit: Works produced to fulfill job duties are considered “work‑made‑for‑hire.” Under normal circumstances the author keeps copyright, while the employer has the right to use them for its own business and may not allow third parties to use them in the same way for two years. However, two exceptions exist: works such as software or engineering designs that are created mainly with employer resources and for which the employer bears responsibility, and any works expressly assigned to the employer by contract. In both cases the author retains only the right to be credited. “Employer resources” include hardware, internal networks, and business data. Inventions created while performing job duties or using those same resources are classified as “work‑made‑for‑hire inventions,” with all patent rights belonging to the employer nationwide. - Evidence grade: A - Sources:全国人大常委会 (2020). 著作权法（2020 年修正，第十八条）. ；全国人大常委会 (2020). 专利法（2020 年修正，第六条）. - Notes: Software is explicitly categorized as “copyright belonging to the employer,” so programmers rarely qualify for the standard rule granting them copyright while the employer retains a two‑year exclusive right to use it. Code written outside work hours can still be deemed a product of employer resources if it is produced on a company computer, accessed company networks, or uses business data. To keep personal projects truly separate, use your own machine, avoid company repositories, and ensure they do not overlap with any company work. ### 14. Using open-source code such as GPL in products: Open-source it per the license or switch licenses — don’t treat this as “no one cares” - Cost: There is no cost involved. Before using someone else’s open-source code, check its license for any stated usage terms. The GPL family of licenses requires that any product built using it must also have its source code released, which conflicts with selling the product as closed-source software for profit. If such a conflict exists, you must switch to another license. The hard part is giving up a library you’ve already grown comfortable using. - In plain terms: Copyright infringement requires you to compensate the copyright holder based on their actual losses or the profits you earned from the infringement. If you commit infringement intentionally and under aggravating circumstances, you may be ordered to pay damages ranging from 1 to 5 times the original amount. One company hired a former employee of a competitor and developed software that was substantially similar to the competitor’s product. The company argued that since the competitor’s software used GPLv2, it was required to be open-source anyway. The Supreme People’s Court ruled that whether a developer complies with GPLv2 or not has no bearing on their copyright rights, and ordered the company to cease infringement and pay 500,000 yuan in damages. - Benefit: Copyright infringement demands compensation based on the rights holder’s actual losses or the infringer’s profits. If neither of these can be accurately calculated, damages are determined by how much it would cost to obtain a proper license for the same software. Intentional and aggravated infringement can also result in 1 to 5 times the standard compensation amount. If the infringement harms public interests, any illegal profits may be confiscated and fines imposed. A relevant official case is Supreme People’s Court Civil Appeal No. 51 of 2021. In this case, a defendant hired a former employee of a plaintiff and developed gateway software that was substantially similar to the plaintiff’s product. The defendant claimed the plaintiff’s software used GPLv2 and thus should have been open-source. The Supreme People’s Court reiterated that compliance with GPLv2 and copyright ownership are two separate issues, and ordered the defendant to cease infringement and pay 500,000 yuan in damages nationwide. - Evidence grade: B - Sources:全国人大常委会 (2020). 著作权法（2020 年修正，第五十三、五十四条）. ；最高人民法院知识产权法庭 (2022). 涉「开源软件」著作权侵权案（（2021）最高法知民终 51 号）. - Notes: This case makes it clear that “the other party used GPL code” cannot serve as justification for copying their software. Conversely, there are already effective court rulings in China where GPL authors successfully sue commercial entities that fail to release source code. No original text of these rulings could be found on the Supreme People’s Court website, so they are not cited here. This item is graded B because compliance with open-source licenses is governed only by general contract and copyright laws, without any specific legal provisions dedicated to this area. ### 15. Only collect personal data strictly necessary for the app’s operation; consent from guardians is required for users under 14, and the privacy policy must be clearly written - Cost: No cost involved. Before launch, cross‑check the list of permissions the app requests against the privacy policy and remove any unnecessary permissions. The main challenge is that product teams often want to retain data “just in case it might be useful later.” - In plain terms: Only gather information that is genuinely needed for business purposes, and obtain consent from a guardian for any user under 14. For violations, regulators first order corrections and issue warnings, and may also confiscate illegal earnings; the app can be ordered to suspend or terminate its services. If the violation persists, fines up to 1 million RMB can be imposed on the app, while individuals directly responsible may be fined between 10,000 and 100,000 RMB. In severe cases, fines can reach 50 million RMB or 5 % of the previous year’s revenue, and responsible personnel may face fines from 100,000 to 1 million RMB. The term “directly responsible personnel” can include the technical and product staff who actually implement the app. - Benefit: Personal data should be processed only for a clear, legitimate purpose that is directly related to that purpose, using methods that minimize impact on individuals’ rights. Consent from the individual is required unless another legal basis applies. For users under 14, consent from parents or guardians is mandatory. Violations lead to regulatory orders to correct the problem, warnings, and confiscation of illegal earnings; the offending app may be suspended or shut down. Persistent breaches incur fines up to 1 million RMB, while responsible managers and staff may be fined between 10,000 and 100,000 RMB. In extreme cases, fines can exceed 50 million RMB or 5 % of annual revenue, and those individuals may be barred from serving as directors, supervisors, or executives of related companies. Criminal acts involving the sale or disclosure of personal data are covered under Section 4 (National). - Evidence grade: B - Sources:全国人大常委会 (2021). 个人信息保护法（第六、十三、三十一、六十六条）. - Notes: In practice, the “directly responsible personnel” label often applies to developers and product managers. The Ministry of Industry and Information Technology regularly publishes lists of removed or penalized apps; however, no specific announcement was identified for this section, so it is not cited here. ### 16. Before launching a website or app, complete ICP registration and retain logs for at least 6 months per classification protection requirements - Cost: Registration itself is free; using a cloud provider’s process takes a few weeks. Fees for classification protection assessments vary by level. Classification protection, also known as “DB”, is a set of national security management measures that classify systems based on their importance; small websites generally do not need to undergo assessments. - In plain terms: ICP registration costs nothing, and the cloud provider’s process takes a few weeks. Domestic servers without registration will be shut down. Providers that claim registration is free but charge fees face fines ranging from 100,000 to 1,000,000 yuan. You must retain logs for at least 6 months; failure to comply or causing any consequences results in fines of 10,000 to 100,000 yuan. - Benefit: Commercial internet information services require a license, while non-commercial ones need only registration. Operating without a license or registration is prohibited. Non-compliant sites will be ordered to make corrections by telecom authorities; refusal leads to site closure. Unlicensed operators face confiscation of illegal earnings plus fines of 3 to 5 times those earnings, or fines ranging from 100,000 to 1,000,000 yuan. Failure to display the ICP registration number on a website’s homepage incurs fines of 5,000 to 50,000 yuan. Network operators must develop security policies under classification protection rules, defend against attacks, retain logs for at least 6 months, and encrypt and back up data by category. Non-compliance leads to corrective orders and warnings; persistent violations result in fines of 10,000 to 100,000 yuan for operators and 5,000 to 50,000 yuan for responsible personnel nationwide. - Evidence grade: A - Sources:国务院 (2011). 互联网信息服务管理办法（2011 年修订，第四、十九、二十二条）. ；全国人大常委会 (2025). 网络安全法（2025 年修正，2026 年 1 月 1 日施行，第二十三、六十一条；2016 年文本为第二十一、五十九条）. - Notes: Domestic servers cannot be accessed via domain names without ICP registration. Details on how to register, associated penalties for missing registration numbers, and how to verify a provider’s qualifications are covered in Section 26, Item 4 (domestic servers must be registered). Common pitfalls include registering as a personal non-commercial site while actually charging fees, and failing to update registration after changing domains or operators. Keeping logs for 6 months is both a legal obligation and a safeguard; they can prove your innocence in case of incidents. ### 17. Before offering generative AI services to the public, conduct required safety assessments and algorithm registration; mark all generated content - Cost: There is no monetary cost, but you must follow procedures set by internet regulators — completing them takes some time. Small personal tools that are not made available to the public do not fall under these rules. - In plain terms: If you offer generative AI services with public influence or social mobilization potential to the general public, you must perform a safety assessment and register the algorithm per national regulations before launch. Any changes or shutdowns also require filing updates or cancellation paperwork. All generated images and videos must be clearly marked. Tools meant solely for personal use and not open to the public are exempt from these requirements. The regulation itself does not specify penalties; violations are handled under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law. - Benefit: Providers of generative AI services that can shape public opinion or mobilize people must conduct safety assessments, register their algorithms, and handle subsequent updates or cancellations as required by law. “Public influence” or “social mobilization potential” means the ability to affect how people think or to organize them. Providers must also add identifying marks to any generated images or videos. This regulation took effect nationwide on August 15, 2023. - Evidence grade: B - Sources:国家互联网信息办公室等七部门 (2023). 生成式人工智能服务管理暂行办法（第十二、十七条）. - Notes: The regulation itself does not state exact penalty amounts. Violations are penalized under the Cybersecurity Law, Data Security Law, and Personal Information Protection Law, which is why this item is rated B. No civil cases involving copyright or portrait rights violations caused by AI‑generated content are cited here, as the original texts were not verified on the Supreme People’s Court website.