Red Lines for Programmers and Tech Workers

Before you act, ask one question: would the vendor, platform or company report it to the police? Server logs, payment records and group chat records can all be pulled when a case is investigated. If you really are placed in criminal detention, whether to arrest you is decided within at most 37 days. You can hire a lawyer from the first questioning onward, and these 37 days are when a criminal lawyer is most useful.

Selling a cheat 20 times (人次), or earning 5000 yuan, is enough for a sentence of up to 3 years; especially serious cases get 3 to 7 years. One person made wall-hack and aimbot cheats, sold over 80,000 yuan's worth in 3 months, and got 1 year suspended for 1 year and a 5000 yuan fine. Someone used a server-side program to run a private server and took in over 20 million yuan in top-ups; the heaviest sentence was 4 years, and the largest fine 10 million yuan.

Even if a script doesn't modify memory or crack anything and just sends requests faster than a person, you will still be convicted; earning 5000 yuan or causing the other side a loss of 10,000 yuan is enough. One person used bought 12306 accounts to grab over 200 tickets for others, made over 20,000 yuan, and got 1 year 6 months suspended for 1 year 6 months and a 5000 yuan fine. Someone who sold ticket-grabbing software in an online shop paid 20,000 yuan in damages for unfair competition.

Data you can only get with a login, a token or a cracked signature counts as bypassing protection: up to 3 years, or 3 to 7 years in serious cases. Scraping personal information is more trouble still. 50 records of whereabouts, communications, credit or property information already count as serious circumstances. So do 500 records of lodging, health or transaction information, 5000 records of other kinds, or earning 5000 yuan.

Take one of these high-paying, vaguely specified jobs and you count as an accomplice of the gambling ring. Under the crime of operating a casino that means up to 5 years, or 5 to 10 years in serious cases, heavier than the maximum of 3 years for merely helping. For one esports betting app, 28 people who wrote the code were sentenced to 1 year to 3 years 6 months. Someone who unblocked QQ accounts for a fraud ring got 1 year 6 months and a 20,000 yuan fine.

The company gave you the account and password; that doesn't mean you can still use them after you leave. Logging in counts as illegal control: up to 3 years. Deleting data so that the system can't run carries up to 5 years, or 5 years or more if the consequences are especially serious. One senior engineer who had been dismissed logged in to the company server with the old administrator account and deleted data and logs, causing a loss of over 120,000 yuan; sentenced to 3 years suspended for 5 years and a 30,000 yuan fine.

The copyright in code you wrote yourself also belongs to the company, and client lists count as trade secrets too; taking them is taking the company's property. One former employee took the source code of a security-screening system to a new company; the employee got 5 years and a 500,000 yuan fine, and the new company was fined 4 million yuan. Someone exploited a system vulnerability to download over 33,000 design files and got 1 year 10 months. The company can also separately claim damages from you.

Controlling other people's computers, servers or cameras without permission: at 20 machines it carries up to 3 years, and especially serious cases carry 3 to 7 years. Even if it doesn't amount to a crime, you still face detention of up to 5 days, and possibly a fine of 50,000 to 500,000 yuan. Anyone who has received a criminal penalty is barred for life from key positions in network security management and network operations.

Whether you're convicted depends on whether you had authorization and how much you obtained, not on what you intended. Obtaining 500 sets of ordinary account names and passwords, or earning 5000 yuan, or causing the other side a loss of 10,000 yuan, is enough for up to 3 years. Exporting a user table along the way to prove a vulnerability often goes past 500 sets in one go. Even if you hold an account and password, using them outside the scope of authorization also counts as intrusion.

Individuals are also governed by the Provisions on the Management of Security Vulnerabilities of Network Products (网络产品安全漏洞管理规定). Before the vendor provides a fix, you may not disclose the vulnerability, and you may not disclose vulnerability details of systems in active use. You may not publish programs and tools made specifically to exploit vulnerabilities, and when you disclose, you must also explain how to fix it. Undisclosed vulnerabilities may not be handed to overseas organizations or individuals other than the vendor.

If you set up your own line out of the country, or use an international channel other than the state's public channels, the police can order you to stop connecting and give a warning, with a fine of up to 15,000 yuan and confiscation of illegal gains. If you run a business on it, the case-handling authority can treat it as the crime of illegal business operation, with up to 5 years where the circumstances are serious. This item is about selling and about setting up nodes. For individuals using it themselves, the penalty is capped at a warning plus a fine.

A non-compete restriction means that for a period after you leave you may not work for a competitor in the same line, at most 2 years, and the company must pay you compensation monthly. If no amount was agreed, it is 30% of your average wage over the 12 months before you left, and no less than the local minimum wage. If, for the company's own reasons, it hasn't paid for 3 months, you can ask to terminate the restriction. From 2025, people in positions that never had access to trade secrets can ask for the clause to be confirmed as not in effect.

For software written mainly with the company's equipment, intranet or business data, and for which the company bears responsibility, the copyright belongs to the company and you keep only the right of authorship; the same goes where the contract says so. Code written after hours can likewise count as the company's, as long as it used a company computer or business data. For inventions made with company resources, the patent belongs to the company too.

Copyright infringement is compensated by the other side's losses or by what you earned; if it was intentional and the circumstances serious, the award can reach 1 to 5 times that. One company hired a rival's former employees and produced substantially similar software, arguing that the rival's software used GPLv2 and should have been open source. The Supreme People's Court held that whether the rival open-sourced its code did not affect its copyright, and still ordered the infringement stopped and 500,000 yuan in damages.

Collect only the information the business needs; users under 14 need a guardian's consent. Violators are first ordered to correct, and the app may be shut down. Refusing to correct brings a fine of up to 1 million yuan, and 10,000 to 100,000 yuan for the responsible people. Serious cases bring a fine of up to 50 million yuan or 5% of the previous year's revenue, and 100,000 to 1 million yuan for the responsible people; those who write the code and build the product may also count as responsible people.

Filing costs nothing, and going through a cloud provider's process takes roughly a few weeks; a site on a domestic server that isn't filed will be shut down. If your filing says you don't charge but you are actually collecting money, the fine is 100,000 to 1 million yuan. Logs must be kept for a full 6 months; refusing to correct, or causing consequences, brings a fine of 10,000 to 100,000 yuan.

A generative AI service open to the public that can sway public opinion or mobilize people must get a security assessment and an algorithm filing before launch, and must also file changes or deregister when it is changed or shut down. Generated images and videos must be labeled. Small tools for your own use that aren't open to the public don't need to bother with any of this. Violations are penalized under the Cybersecurity Law (网络安全法) and other laws.

Making software that skips or blocks other apps' ads for users will get you sued by them for unfair competition. It can count even if you don't charge: the operators the law governs include individuals who provide services. One browser blocked Mango TV's pre-roll ads by default and paid 800,000 yuan. One app let people skip Mango TV's splash-screen ads directly and paid 80,000 yuan for losses.

An AI relay site is a website that resells access to overseas large-model APIs at low prices. A site operator in Shanghai was held in criminal detention for 37 days over this; after release on bail pending trial, he said himself that he would certainly be sentenced, and he has already made restitution and returned the illicit gains. The Ministry of State Security has also issued a warning saying that many relay sites lack operating qualifications and also secretly transfer user data abroad.