Web gets Stickier

A recent Judicial Interpretation issued jointly by the Supreme People’s Court and Procuratorate clarifies terminology critical to establishing certain online crimes.Specifically, the Interpretation addresses three charges, all added to the Criminal Law in 2015, as part of the 9th Amendment to the Criminal Law：

1. Refusal to perform network security duties (286-1)
2. Use of Networks to break laws (287-1)
3. Providing Support to those committing online crimes (287-2)

The crimes can all be perpetrated by either organizations or individuals, but when carried out by an organization, the directly responsible management and other responsible staff can be convicted. [article 14] In addition to the penalties listed below for each offense, temporary or longer-term professional restrictions, barring work in a certain field may be given [article 17].

CRIMINAL LAW 286-1 : Refusal to perform network security duties

This crime targets network service providers that 1) fail to perform network security management obligations and 2) refuse to correct the situation when ordered to do so by the regulatory authority, 3) resulting in any of three listed types of harm.

The punishment is up to three years in prison, short-term detention, or controlled release, and the possibility of a concurrent fine.

Network Service Providers is defined broadly to include either individuals or organizations providing any of the following services (not exclusive):

A Regulatory Authority is also defined broadly to include any department with network security review authority, including, but not limited to police, internet, and telecom departments.

More interesting is that the Interpretation makes clear that in deciding whether an order was refused, the court will look at whether the order had a legal basis, as well as the reasonableness of the order, and the company’s capacity to comply. This seems intended as a limit on when criminal authority will be used to enforce an administrative order. 【article 2】

Resulting Harm Requirements

Article 286-1 of the Criminal Law provides 4 distinct harmful consequences, any one of which can support the charge. The Interpretation goes through them one by one.

(1) Cause the transmission of a large volume of unlawful information;

Large Volumes is defined in article 3 as

• 200 videos,
• 2,000 non-videos,
• Prorata combination of the above that meet the standards,
• Transmitting in Social Media groups of 3,000 or more, or accounts with 30,000 or more followers,
• 50,000 or more clicks, or
• Other

(2) Cause leaks of user information, causing serious consequences;

Serious Consequences is defined in article 4 as leaking:

• 500 pieces of tracking, communications, financial credit information, or asset information,
• 5, 000 or more items of housing information, communications records, physical health information, transaction information, and other such user information that might impact security in one’s person or property,
• 50,000 other pieces of information, or
• Prorata combination of the above that meet the standards

[Note the numbers are about pieces of information, not necessarily reflecting the number of persons whose information was leaked]

OR where the leak causes:

• death, serious injury, psychiatric abnormalities, or being kidnapped,
• Major economic losses,
• Disruption of social order, or
• Other

(3) Cause the destruction of evidence in criminal cases, where the consequences are serious.

Article 5 adds that the destroyed evidence may impact either guilt or sentencing. It is unclear if the ‘impact’ reflects a requirement on the importance of the evidence, or if it is merely a way of describing its use.

Here Serious Consequences is defined as destruction of evidence where:

• it is in a case of serious crimes: national security, terrorist activity crimes, organized crime, corruption, or crimes punishable by 5 years imprisonment or higher,
• There are several instances of destruction,
• It has a serious impact on proceedings, or
• Other

(4) Other serious circumstances.

Article 6 uses this catch all provision to specify other breaches of security management that might result in criminal charges, defining Serious Circumstances as:

1. Not keeping logs or verifying identification for the vast majority of users,
2. Refusals to make corrections several times w/in 2 years,
3. Resulting in services or facilities being used:
   • primarily for illegal ends,
   • for network attacks with serious impacts,
   • for national security, terrorist activity crimes, underworld criminal organization crimes, embezzlement and bribery, of other major crimes;
   • to damage state organs’ information networks or networks used to provide public services
4. Other situations

Criminal Law article 287-1: Use of Networks to Break Laws

This crime targets any individual or organization that 1) uses information networks 2) to carry out certain types of offense listed below, where 3) the circumstances are serious.

The penalty is up to three years imprisonment, short-term detention, and/or a fine.

The 3 specified types of offense are:

(1) Establishing websites or chat groups used to commit fraud, pass on criminal methods, create or sell prohibited or controlled items, and other such illegal and criminal activity. [Includes websites designed for these purposes, or used primarily for these purposes after established- Article 8]

(2) Publishing information on the production or sale of drugs, guns, pornography, and other prohibited or controlled items, or other illegal or criminal information;

(3) Publishing information so as to carry out illegal or criminal activities such as fraud.

[Publishing for (2) and (3) includes publication of links, QR codes, etc. that directs users to the relevant information]

Article 7 of the Interpretation, however, greatly expands the scope of this crime, by defining ‘illegal and criminal’ to include crimes, and illegal activity that is of the same type as provided for in crimes, but has not yet reached the level of a crime. This means there can be criminal punishment for some use of the internet in furtherance of non-criminal activity. 

For example, try replacing the ‘illegal and criminal’ in the 3 types of covered offense above, with not yet criminal, illegal ‘crime-like’ acts.  For the third item (3) above, it would mean that there could be criminal consequences for publishing information so as to carry out ‘crime-like’ or at least ‘fraud-like’ activities. Items (1) and (2) would potentially criminalize making websites or groups used for ‘crime-like’purposes, or publishing ‘criminal-like’ information. 

This undermines careful interpretations made previously to distinguish between criminal and non-criminal conduct, as courts will seemingly have to consider if conduct that is expressly non-criminal is now eligible for punishment under this offense. The pervasive of mobile and internet communications in all aspects of life could mean that there is a substantial number of cases involved.

As a result, it is critical that the crime further requires that there be ‘serious circumstances’ as one of it’s elements.

Serious Circumstances for this charge is defined in article 10, both generally and in terms specific to the individual offense types.

Generally, the circumstances are serious if:

• Unlawful gains from the activity total 10,ooo RMB  (~$1,400 USD) or more. A relatively low amount.
• The offense occurs within two years of having received an administrative punishment for illegal use of information networks, aiding in online crimes, or endangering computer security.

For the 1st offense type, (1) Establishing websites or chat groups to carry out illegal ‘crime-like’ activity is serious where one:

• impersonated a state organ or financial organization in setting up the site or group,
• set up 3 or more websites, or sites totaling 2,000 or more registered users,
• set up 5 or more chat groups, or groups totaling 1,000 or more members.

For the 2nd and 3rd types of conduct; (2) Publishing information on the production or sale of drugs, guns, pornography, and other prohibited or controlled items, or other illegal or criminal information; or (3) Publishing information so as to carry out illegal or criminal activities is serious where:

• publishing 100 or more items on websites,
• sending to 2,000 or more recipient accounts,
• Sending to groups with 3, 000 or more total members,
• sending from social media accounts with 30,000 or more total followers,

Additional Definitions

Criminal Law Article 287-2 Providing Support to those committing online crimes

This article targets individuals and entities that 1) knowing others are using networks to commit crimes 2) provide them with technical support, such as access, hosting, storage, communications, etc; or providing advertising, financial support; 3) when circumstances are serious.

It is punishable by up to 3 years imprisonment, short-term detention, and/or a fine.

First, the Interpretation makes clear that the offense is in the provision of assistance, and there need not be a conviction of those responsible for the underlying crimes.

Second, the Interpretation explores the requirement of ‘knowing’ that a crime is being assisted, by creating several situations in which there is a rebuttable presumption of knowledge [article 11]:

1. Continue after being told to stop
2.  After receiving a report, the do not perform their legal duties to address it; 
3.  Transaction prices or methods are clearly irregular, suggesting something amiss; 
4. The programs, tools, or technical support provided is specially for use in illegal conduct;
5. The defendant frequently used measures to avoid regulation or elude investigation (hidden internet access, encrypted communications, or destruction of data, fake identities, etc.)
6. Provided technical support or assistance to others used for avoiding regulation or eluding investigation;
7. Other situations sufficient to determine knowledge of the actor. 

The final element, serious circumstances is addressed in article 12.

1. Provided assistance to 3 or more targets; 
2. Payments were 200,000 RMB (~$28,000 USD) or more; 
3. Provided capital of 50,000 RMB (~$7,000 USD) or more through advertisements or other such means;
4. Where unlawful gains are 10,000 RMB (~$1,400 USD) or more;

1. Where, having received administrative punishments for illegally using information networks, assisting in criminal information network activities, or endangering computer information system security within the preceding two years, one again assists criminal information network activities; 
2. Where the person being assisted carried out a crime that causes serious consequences;
3. Other situations where the circumstances are serious.