11 Common legal pitfalls for programmers and tech professionals

Any unit or individual who discovers facts of a crime has the right to report it. If investigating authorities believe there are facts of a crime, they shall open a case. Courts, procuratorates, and public security “have the power to collect and obtain evidence from relevant units and individuals,” and those units and individuals must provide it truthfully. After criminal detention, public security must apply for arrest approval within 3 days (ask the procuratorate for formal arrest). In special circumstances this may be extended by 1 to 4 days. For circumstances such as crimes committed while roaming across places in series, it may be extended to 30 days. The procuratorate then has another 7 days to decide. Added up, the arrest decision comes within at most 37 days. When the procuratorate reviews arrest approval, “if defense counsel requests it, the defense counsel’s opinions shall be heard.” Counsel also has the right to apply to change compulsory measures — for example, replacing detention with bail pending trial — and the investigating authority must reply within 3 days. From the first interrogation, or from the time a compulsory measure is imposed (detention, arrest, and the like), you may entrust a lawyer. While the case is still being investigated by public security, you may only entrust a lawyer. When counsel requests a meeting, the detention center must arrange it within 48 hours at latest. If the likely sentence is control, criminal detention, or another penalty lighter than imprisonment, or only accessory penalties without a principal penalty, bail pending trial is available. Bail means posting a bond or finding a guarantor and going home while the case proceeds. Bail lasts up to 12 months (nationwide)

Providing programs or tools specially used to intrude upon or illegally control computer information systems, when circumstances are serious, brings up to 3 years and a fine concurrently or alone. Concurrent means prison plus a fine; alone means fine only. Especially serious circumstances bring 3 to 7 years plus a fine. The threshold for “serious circumstances” is providing the tool to 20 person-times or more, or illegal gains of 5000 yuan or more. Illegal gains means the money earned from this. Intentionally bypassing or destroying technical protection measures set by the rights holder may also constitute copyright infringement, with up to 3 years, or 3 to 10 years in serious cases. Official case: Wang and others made and sold cheats that read and modified game memory for wall hacks and aim assist. In 3 months they sold over 80,000 yuan and profited over 30,000 yuan. Sentence: 1 year suspended for 1 year, fine 5000 yuan. Suspended for 1 year means a 1-year sentence that is not served yet; if you stay clean that year you need not go to prison. Xiang and others sold the “TZ” series of cheats with sales over 200,000 yuan; Xiang got 3 years suspended for 3 years and a 20,000 yuan fine. Liu and others obtained game server programs, changed parameters, ran private servers, and took over 20,000,000 yuan in top-ups. Sentences from 4 years to 2 years 6 months, fines from 10,000,000 to 1,300,000 yuan. Not only games. A Shanghai company made custom ROMs that added dozens of features to WeChat on the phone — auto-forward, like, mass message, and more. Those phones were sold as “marketing phones,” 2381 units. In 2019 the Shanghai Xuhui court convicted the company of copyright infringement, fined it 500,000 yuan, and sentenced the person in charge to 1 year 6 months suspended for 1 year 6 months (nationwide)

Breaking into a computer information system, or using other technical means to obtain the data in it, brings up to 3 years in serious cases, with a fine added or a fine alone; especially serious cases bring 3 to 7 years. The threshold for “serious circumstances” is illegal gains of 5,000 yuan or more, or losses of 10,000 yuan or more. Official case: a person used a bot to bulk-import bought 12306 accounts and submit ticket-purchase requests on many threads. He snatched more than 200 tickets for others and earned over 20,000 yuan. The court convicted him of the crime of illegally obtaining computer information system data and sentenced him to 1 year 6 months suspended for 1 year 6 months and a 5,000 yuan fine. Zheng sold ticket-snatching software for a certain ticketing app in an online shop and was held to have committed unfair competition, ordered to pay 20,000 yuan (nationwide).

Taking system data by bypassing protections has the same sentencing range as item 3 (ticket-snatching, flash-sale, and fake-order scripts): up to 3 years, or 3 to 7 years. Illegally obtaining, selling, or providing citizens’ personal information meets “serious circumstances” at any of the following: location tracks, communication content, credit, or property information of 50 records or more; accommodation, communication records, health, or transaction information of 500 records or more; other personal information of 5000 records or more; illegal gains of 5000 yuan or more. Serious circumstances bring up to 3 years and a fine concurrently or alone; especially serious cases bring 3 to 7 years. Official case: software developer Li disguised a function that stole phone albums as a “looks rating” app and obtained 1751 face photos. He also resold social-engineering database material and got 3 years suspended for 3 years. A social-engineering database is a database that aggregates personal information leaked from various places. A network technology company used a crawler to take store and order data from a food-delivery platform, caused over 40,000 yuan in losses, and was prosecuted for illegally obtaining computer information system data (nationwide)

Knowing that someone is using the network to commit a crime, and still giving them help such as technical support or payment settlement, brings up to 3 years in serious cases, with a fine added or a fine alone. If other crimes are also involved, the harsher penalty applies. Operating a casino carries up to 5 years plus a fine; serious cases bring 5 to 10 years. Official examples: The Zhang Sheng group developed gambling games and then sold them as “white-label sites” to others, charging site-building fees and report fees. The case involved nearly 7 billion yuan. Zhang Sheng got 9 years 9 months and a fine of 50,000,000 yuan. Wang Qiang and 78 others, 79 people in all, who handled the outsourced development, got from 6 months to 9 years 9 months. Chen Dong and others developed and ran an e-sports betting app; the technical team wrote code in Hainan, and 28 people were convicted of operating a casino and got from 1 year to 3 years 6 months, plus fines. Zhang, who ran a studio that unblocked banned QQ accounts for a fraud ring, got 1 year 6 months and a fine of 20,000 yuan (nationwide).

Illegally controlling a computer information system, when circumstances are serious, brings up to 3 years and a fine concurrently or alone; especially serious cases bring 3 to 7 years. Deleting or modifying system functions or data so the system cannot run normally, with serious consequences, brings up to 5 years; especially serious cases bring 5 years or more. Official case: senior IT engineer Lü, after being dismissed, logged into the company shared server with the old admin account. He changed the password, deleted data and logs, and caused over 120,000 yuan in losses. Sentence: 3 years suspended for 5 years, fine 30,000 yuan. Software-company employee Bai deliberately inserted faulty code into an upgrade program so the client system could not log in, causing over 40,000 yuan in losses. He was prosecuted for destroying a computer information system (nationwide)

Violating confidentiality duties by disclosing trade secrets or using them yourself, when circumstances are serious, brings up to 3 years and a fine concurrently or alone; especially serious cases bring 3 to 10 years plus a fine. The Anti-Unfair Competition Law also lists two acts as infringement: obtaining trade secrets by “electronic intrusion” (technical intrusion into a system); and inducing or helping others to breach confidentiality. Official case: Sun and other former employees took security-screening system source code and core algorithms and used them in a new company’s product. Sun got 5 years and a 500,000 yuan fine; the new company was fined 4,000,000 yuan. Tian exploited a system flaw to download over 33000 design files and got 1 year 10 months plus a 100,000 yuan fine. Engineer Yang stored App module source code on a personal computer and in the cloud, then built a similar App after switching jobs, and was prosecuted for infringing trade secrets (nationwide)

Illegally controlling a computer information system: serious cases bring up to 3 years, with a fine added or a fine alone; especially serious cases bring 3 to 7 years. Controlling 20 or more devices is deemed “serious.” Those not meeting criminal thresholds still face confiscation of illegal gains, up to 5 days of detention, and a possible fine of 50,000 to 500,000 yuan. More serious violations bring 5 to 15 days of detention and a possible fine of 100,000 to 1,000,000 yuan. Anyone with a prior public security penalty is barred for 5 years, while those with a criminal record are barred for life from critical cybersecurity and network operation roles. Official case: Li bought the IPs of network cameras and used software to control 105 of them to spy on people’s privacy, and got 3 years suspended for 5 years and a fine of 20,000 yuan. Wu and others implanted a trojan into phone motherboards, controlled over 3.3 million phones to send back verification codes, and got from 2 years to 4 years 6 months (nationwide).

Systems of ordinary companies and individuals are computer information systems outside the fields of state affairs, national defense construction, and cutting-edge science and technology. Intruding into such systems, or using other technical means to obtain data stored, processed, or transmitted in them, when circumstances are serious, brings up to 3 years of fixed-term imprisonment or criminal detention, and a fine concurrently or alone. Especially serious cases bring 3 to 7 years plus a fine. “Serious circumstances” has several standards: obtaining 10 or more sets of identity-authentication information (account passwords and the like) for online financial services such as payment settlement, securities trading, or futures trading; obtaining 500 or more sets of other identity-authentication information; illegally controlling 20 or more computer information systems; illegal gains of 5000 yuan or more, or economic losses of 10,000 yuan or more. Five times or more of those figures is “especially serious circumstances.” Official case: Prosecutorial Example No. 36 established one sentence — “using an account and password to log into a computer information system beyond the authorized scope is an act of intruding into a computer information system.” Meaning: you already have the account and password, but using them outside the authorized scope itself counts as intrusion. In that case three people used accounts, passwords, and tokens obtained at work to log into the company’s internal system from another place. They downloaded data outside their work scope, sold it online, and had illegal gains of 37,000 yuan. They were sentenced to 4 years, 3 years 9 months, and 4 years respectively, each fined 40,000 yuan (nationwide)

This regulation covers three kinds of subjects: domestic network product providers, network operators, and organizations or individuals engaged in discovering, collecting, publishing, and similar activities involving vulnerabilities. No organization or individual may use vulnerabilities for activities that harm cybersecurity, or illegally collect, sell, or publish vulnerability information. Publishing vulnerability information to the public must follow five rules. First, do not publish before the product provider offers a remediation measure. Second, do not publish details of vulnerabilities in networks, information systems, and equipment currently used by network operators. Third, do not deliberately exaggerate harm and risk, and do not use vulnerability information for malicious hype or fraud. Fourth, do not publish or provide programs and tools specially used to exploit vulnerabilities for activities that harm cybersecurity. Fifth, when publishing, publish remediation or prevention measures at the same time. Also, unpublished vulnerability information must not be provided to organizations or individuals abroad other than the product provider. The regulation encourages reporting vulnerabilities to four official platforms. One is the MIIT cybersecurity threat and vulnerability information sharing platform. Two is the National Cyber and Information Security Information Notification Center vulnerability platform. Three is the CNCERT/CC vulnerability platform. Four is the China Information Technology Security Evaluation Center vulnerability database. Collecting or publishing vulnerability information in violation is handled by MIIT and the Ministry of Public Security according to their duties. Conduct that meets circumstances under the Cybersecurity Law (网络安全法) is punished under that law. Publishing system vulnerabilities and other cybersecurity information to the public shall comply with relevant state rules. Violations bring orders to correct and warnings from the competent authority, and may bring a fine of 10,000 yuan or more and 100,000 yuan or less. Refusal to correct or serious circumstances bring a fine of 100,000 yuan or more and 1,000,000 yuan or less. The authority may also order suspension of related business, shutdown for rectification, or closure of the website or application. It may also revoke related business permits or the business license. Persons directly in charge and other persons directly responsible are fined 10,000 yuan or more and 100,000 yuan or less (nationwide)

Direct international internet connectivity must be facilitated via international gateway channels supplied by the national public telecom network. No organization or individual may independently establish or utilize any other channels, meaning neither private outbound connections nor third-party nodes are permitted. Violators face police orders to disconnect from the internet, warnings, and possible fines up to 15,000 yuan plus confiscation of illicit profits. Commercial operators violating this rule may be prosecuted for illegal business operations; severe violations incur up to five years imprisonment plus a fine of one to five times the illegal earnings, or that fine alone. Especially serious cases bring five years or more (nationwide).

Non-competes may only bind senior managers, senior technical staff, and others with confidentiality duties. The term is at most 2 years. The company must pay economic compensation monthly during that term. If no compensation amount was agreed, pay 30% of average wages over the 12 months before leaving, and not below the local minimum wage. If for the company’s own reasons nothing is paid for 3 months, the worker may request termination of the non-compete. If the company terminates on its own initiative, it must pay an extra 3 months of compensation. From 2025, workers whose posts never knew or touched trade secrets may request a ruling that the clause does not take effect. If the agreed scope exceeds the secrets they actually knew, the excess is void. Official case: a pharmaceutical company sued CTO Zheng for 7,100,000 yuan in liquidated damages. The court found the new employer’s products were not substitutes for the former company’s, that the non-compete scope should be limited to secrets he actually knew, and dismissed the claim in full (nationwide)

Works created to complete the unit’s work tasks are works for hire (things made while doing the job). In the ordinary case copyright belongs to the author; the unit has priority to use them within its business scope, and for 2 years the author may not license third parties to use them in the same way. But two kinds of cases differ. One is engineering designs, software, and similar works created mainly with the unit’s material and technical conditions, for which the unit bears responsibility. The other is works the contract assigns to the unit. In both, the author keeps only the right of authorship. The unit’s material and technical conditions means company equipment, intranet, business data, and the like. Inventions completed while performing the unit’s tasks, or mainly using the unit’s material and technical conditions, are service inventions. The right to apply for a patent and the patent obtained both belong to the unit (nationwide)

Copyright infringement demands compensation based on the rights holder’s actual losses or the infringer’s profits. If neither of these can be accurately calculated, damages are determined by how much it would cost to obtain a proper license for the same software. Intentional and aggravated infringement can also result in 1 to 5 times the standard compensation amount. If the infringement harms public interests, any illegal profits may be confiscated and fines imposed. A relevant official case is (2021) 最高法知民终 51 号 (Supreme People’s Court, Civil Appeal No. 51 of 2021). In this case, a defendant hired a former employee of a plaintiff and developed gateway software that was substantially similar to the plaintiff’s product. The defendant claimed the plaintiff’s software used GPLv2 and thus should have been open-source. The Supreme People’s Court held that “whether the developer itself violates the GPLv2 agreement and whether it enjoys software copyright are two independent questions,” and ordered the defendant to cease infringement and pay 500,000 yuan in damages (nationwide).

Processing personal information shall have a clear and reasonable purpose, be directly related to that purpose, and use the method with the least impact on individuals’ rights and interests. Processing personal information requires the individual’s consent, or a statutory basis. For those under 14 years of age, consent of a parent or guardian is required. Violations bring orders to correct, warnings, and confiscation of illegal gains from the regulator, and orders to suspend or terminate the offending App’s services. Refusal to correct brings a fine of 1,000,000 yuan or less, and persons directly in charge and other persons directly responsible 10000 to 100,000 yuan. Serious circumstances bring a fine of 50,000,000 yuan or less, or 5% or less of the prior year’s revenue. Responsible persons are fined 100000 to 1,000,000 yuan. Those people may also be barred for a period from serving as directors, supervisors, or senior managers of related enterprises. Selling or providing personal information that constitutes a crime is in item 4 (nationwide)

Commercial internet information services require a license; non-commercial ones require filing. Without a license or filing, you may not operate. Without filing, telecom authorities order correction; refusal brings an order to close the site. Operating without a license brings confiscation of illegal gains plus a fine of 3 to 5 times those gains, or a fine of 100000 to 1,000,000 yuan. Not displaying the filing number on the homepage brings a fine of 5000 to 50,000 yuan. Network operators must, under the multilevel protection system (dengbao), set security management rules, defend against attacks, retain network logs for no less than 6 months, and classify, back up, and encrypt data. Failure brings orders to correct and warnings. Refusal to correct or causing consequences brings a fine of 10000 to 100,000 yuan, and persons in charge 5000 to 50,000 yuan (nationwide)

Providing generative artificial-intelligence services with public-opinion attributes or social-mobilization capacity shall conduct a security assessment per state rules. Algorithm filing under the algorithm-recommendation management rules is also required, plus later amendment and cancellation procedures. Public-opinion attributes or social-mobilization capacity means the ability to affect public views or to organize and mobilize people. Providers shall mark generated content such as images and video. The measure states that when enterprises, research institutions, and others develop or apply generative AI technology and “do not provide generative AI services to the domestic public, this measure does not apply.” Violations of the measure are “punished in accordance with the Cybersecurity Law, the Data Security Law, the Personal Information Protection Law, the Law on Progress of Science and Technology, and other laws and administrative regulations.” The measure took effect on 15 August 2023 (nationwide)

The law provides that operators must not use technical means to obstruct or disrupt the normal operation of network products or services lawfully provided by other operators. Operators here means natural persons, legal persons, and unincorporated organizations that provide goods or services. Harm to the other side is compensated by the other’s actual losses, or by the benefit you gained, plus reasonable expenses the other side spent to stop the infringement. Market regulators may also fine 100,000 to 1,000,000 yuan, or 1,000,000 to 5,000,000 yuan in serious cases. Official case: 720 Browser’s built-in feature by default intercepted Mango TV’s site pre-roll and pause ads. First instance dismissed Mango TV’s claim. Guangzhou Intellectual Property Court on appeal reversed, found unfair competition, and awarded 800,000 yuan in economic losses and reasonable expenses. In 2021 the Supreme People’s Court listed it as a model case. The “Lan Jingling” App let users jump past Mango TV’s splash ads. First instance ordered it to stop and pay 80,000 yuan in economic losses and 10,000 yuan in reasonable expenses. In April 2024, Beijing Intellectual Property Court affirmed on appeal. The appeal court held it had in substance blocked the splash ad, not merely clicked “skip” for the user (nationwide)

In June 2026 the Ministry of State Security issued a risk warning. It said AI relay sites are a proxy layer between users and model vendors’ official services. Some relay sites lack operating qualifications. Some, without data-export compliance credentials and without the statutory security-assessment process, send user-input data to servers abroad. Some also let users bypass network-access, official-authorization, and cross-border transmission limits. China Newsweek reported a case in June 2026. In May 2026, a Shanghai relay-site operator posted a shutdown notice in a tech community. He said that for illegally obtaining large-model APIs he had been criminally detained by Shanghai police for 37 days and was now on bail. He said he “will definitely be sentenced,” had already returned illicit gains, and would still pay a fine. The report said such relay sites bulk-register or buy foreign large-model subscriptions, host overseas servers as jump hosts, and resell to domestic users at low prices (nationwide / Shanghai)

Civil side first. The Copyright Law allows rights holders to add technical measures to works. Technical measures are effective technology, devices, or components that prevent or restrict others from using a work without permission. Without the rights holder’s permission, no one may intentionally bypass or destroy technical measures. No one may manufacture, import, or provide to the public related devices or components for bypassing technical measures. No one may intentionally provide technical services to others for bypassing technical measures. Computer software is a work; doing any of these is infringement and requires stopping the infringement and paying damages. Damages are by the rights holder’s actual losses or what you earned. If that cannot be calculated, refer to what a normal license would cost. Intentional infringement with serious circumstances brings 1 to 5 times. If public interest is also harmed, the copyright authority may confiscate illegal gains. Illegal business volume of 50,000 yuan or more may be fined 1 to 5 times that amount. Below 50,000 yuan or if the amount cannot be calculated, a fine of 250,000 yuan or less is possible. Criminal side next. Amendment (XI) to the Criminal Law wrote “intentionally bypassing or destroying technical measures” into the crime of copyright infringement, on the premise of profit. Illegal gains of 30,000 yuan or more, or illegal business volume of 50,000 yuan or more, bring up to 3 years, with a fine concurrently or alone. At 10 times those figures, the sentence is 3 to 10 years plus a fine. Someone who knows another person is committing copyright infringement and still provides devices, components, or technical services mainly used to bypass or destroy technical measures faces the same crime once the same thresholds are met. Official case 1: From March 2019 to July 2022, Liu made “dongles” that could bypass software technical measures for profit. He also copied pirated software and sold it together with the dongles. His illegal business volume was over 1,060,000 yuan. Shanghai No. 3 Intermediate People’s Court found especially serious circumstances and sentenced him for copyright infringement. The Supreme People’s Procuratorate said this was the first nationwide “intentionally bypassing or destroying technical measures” copyright-infringement case after Amendment (XI) took effect. In April 2023, Shanghai courts sentenced the three defendants in this string of cases to between 3 years 2 months and 1 year, some suspended, with fines from 700,000 to 80,000 yuan. Official case 2: Medical-equipment repair worker Liu spent 80,000 yuan in a QQ group to buy 50 cracked dongles, then resold them online for a few thousand yuan each. Plugging one in bypassed the medical equipment’s identity check and entered the maintenance software. Shanghai Putuo court sentenced him to 1 year 2 months, suspended, plus an 80,000 yuan fine. Official case 3: From May 2021, Li and others in Xuzhou had crack programs made for game machines and produced crack devices to sell. Illegal business volume was over 39,000,000 yuan. In November 2024, 10 people were sentenced to between 3 years 6 months and 2 years 6 months, some suspended, with fines from 11,000,000 to 1,500,000 yuan (nationwide)

Interfering with the functions of a computer information system so it cannot run normally, with serious consequences, brings up to 5 years of fixed-term imprisonment or criminal detention. Especially serious consequences bring 5 years or more. Courts treat DDoS as the “interference” here. “Serious consequences” has several standards. One is that the main software or hardware of 10 or more computer information systems cannot run normally. One is illegal gains of 5000 yuan or more, or economic losses of 10,000 yuan or more. Another is that a system serving 10000 or more users cannot run normally for a cumulative 1 hour or more. Machine counts or money amounts at 5 times those figures count as especially serious consequences. Knowing someone is committing such destruction and still providing programs or tools for destruction is punished as joint crime. The threshold is illegal gains of 5000 yuan or more, or providing to 10 person-times or more. Providing server hosting, technical support, and similar help with illegal gains of 5000 yuan or more is the same. Providing programs or tools specially used to intrude upon or illegally control computer information systems — at 20 person-times or more, or illegal gains of 5000 yuan or more — brings up to 3 years and a fine concurrently or alone. Below the criminal threshold, interfering with computer information system functions or providing such tools, when harm results, brings detention of up to 5 days, or 5 to 15 days if more serious. Official case 1 (Prosecutorial Example No. 69): In early 2017, Yao Xiaojie and others were hired to form the “Dark Night Group” abroad. They bought large amounts of server resources and used malware to launch DDoS. They attacked three times the IPs of three game companies on a cloud of an internet company; games could not log in and users dropped frequently. The victim company spent over 40,000 yuan on emergency repair. In June 2018, Shenzhen Nanshan court sentenced 11 people to 1 to 2 years for destroying a computer information system. Official case 2: In March 2017 Tang and Wang built a DDoS website that could top up membership and submit attack tasks. They took orders and launched traffic attacks on over 80 target IPs. Nantong Haimen court sentenced Tang and others to between 10 months and 5 years 6 months for destroying a computer information system. Zhang, who ordered attacks on that site to suppress competitors, submitted over 100 attack tasks against 11 IPs or domains of rival companies. The court found the orderers and the site operators were joint offenders. The orderer was the one who initiated and was a principal offender. Official case 3: Wang built a DDoS platform and sold attacks under clear “bronze,” “silver,” “gold,” and “diamond” packages. Beijing Haidian procuratorate charged him with illegally using information networks; in 2020 first instance he got 1 year and a 50,000 yuan fine (nationwide)