§11 · 19 tips

Red lines for programmers and tech workers

What code you write and what jobs you take can get you convicted?

Tips from this section that apply in the United States. This section describes legal rules, mostly mainland China’s. It is general information, not legal advice; for your own case, talk to a lawyer.

Before you act, ask whether the vendor, platform or company would report it; if you are pursued, get a criminal defense lawyer right away

Before you act, ask whether the vendor, platform or company would report it. Server logs, payment records and group-chat records can all be pulled in a case. If you are actually placed in criminal detention (刑事拘留), the decision on whether to arrest you comes within 37 days at most. You can hire a lawyer from the first questioning, and these 37 days are when a criminal defense lawyer helps most.

High value
Evidence C
Keeps you free

Don't make or sell game cheats or assist tools, including AI assists that "only read the screen and never touch memory," and don't sell modified versions that add features to software like WeChat

Selling a cheat to 20 people, or earning 5,000 CNY, is enough for a sentence of up to 3 years, and 3 to 7 years in especially serious cases. One person made wallhack and aimbot cheats and sold more than 80,000 CNY worth in 3 months. The sentence was 1 year, suspended for 1 year, and a fine of 5,000 CNY. Another used a game server program to run a private server and took in more than 20,000,000 (2000多万) CNY in top-ups. The heaviest sentence was 4 years, with fines of up to 10,000,000 (1000万) CNY.

High value
Evidence A
Keeps you free

Hand over all account access when you leave, and don't delete databases, leave backdoors or change passwords to lock the system, even if the company owes you money

Account passwords were given to you by the company, which does not mean you can still use them after you leave. Logging in counts as illegal control, with up to 3 years. Deleting data so the system can't run carries up to 5 years, and 5 years or more if the consequences are especially serious. A senior engineer who was dismissed logged into the company server with his old administrator account and deleted data and logs. The loss was more than 120,000 CNY, and he got 3 years, suspended for 5 years, and a fine of 30,000 CNY.

High value
Evidence A
Keeps you free

Don't take source code, customer lists or technical documents when you leave, don't upload them to a personal cloud drive, and don't reuse them at your next employer

The copyright in code you wrote yourself also belongs to the company, and a customer list counts as a trade secret, so taking them means taking the company's property. An employee who left with the source code of a security-screening system for a new company was sentenced to 5 years and fined 500,000 CNY, and the new company was fined 4,000,000 (400万) CNY. Another person exploited a system flaw to download more than 33,000 design files and got 1 year 10 months. The company can also sue you separately for damages.

High value
Evidence A
Keeps you free

Don't run your own programs on other people's computers, servers or cameras, and don't use company machines to mine cryptocurrency

Controlling other people's computers, servers or cameras without permission carries up to 3 years once it reaches 20 machines, and 3 to 7 years in especially serious cases. Even when it is not a crime, it brings detention of up to 5 days and a possible fine of 50,000 to 500,000 CNY. A person who has received a criminal penalty is barred for life from key posts in network security management and network operations.

Top value
Evidence A
Keeps you free

Don't test other people's systems without written authorization; "good intentions" and "reporting afterward" are not defenses

Whether it is a crime depends on whether you had authorization and how much you obtained, not on your intent. Obtaining 500 sets of ordinary account passwords, or earning 5,000 CNY, or causing the other side a loss of 10,000 CNY, is enough for up to 3 years. To prove a vulnerability, people often export a user table on the side, and that alone can pass 500 sets in one go. If you already hold an account and password, using them outside the authorized scope also counts as intrusion.

High value
Evidence A
Keeps you free

Report vulnerabilities as the rules require, and before they are fixed don't publish the details, release exploit tools or hand them to anyone abroad

Individuals are also covered by the Provisions on the Management of Network Product Security Vulnerabilities (网络产品安全漏洞管理规定). Before the vendor has a fix, you may not make the vulnerability public, nor the details of a vulnerability in a system that is in use. You may not release programs and tools made specifically to exploit vulnerabilities, and when you do make a vulnerability public you must say at the same time how to fix it. A vulnerability that has not been made public may not be handed to any organization or individual abroad other than the vendor.

High value
Evidence A
Keeps you free

Code written during work hours or with company resources belongs to the company; do your own open-source projects on your own time and equipment, with no company code mixed in

For software written mainly with the company's equipment, internal network or business data, and for which the company bears responsibility, the copyright belongs to the company and you keep only the right to be named as author. The same holds if your contract says so. Code written after work also may count as the company's if it used a company computer or business data. An invention made with company resources also has its patent belong to the company.

Moderate value
Evidence A
Saves money

When you build a product with GPL or other open-source code, open your source or change the license as the license requires, and don't assume "nobody will enforce it"

For copyright infringement, damages are set by the other side's loss or the money you made, and in intentional and serious cases they can go up to 1 to 5 times that. One company hired a competitor's former employees and built substantially similar software, and argued that the competitor's software used GPLv2 and should have been open source. The Supreme People's Court held that whether the other side opens its source does not affect its copyright, and still ordered the company to stop infringing and pay 500,000 CNY.

Moderate value
Evidence B
Saves money

When building an app, collect only the personal information the business needs, get a guardian's consent for children under 14, and write the privacy policy clearly

Collect only the information the business needs, and get a guardian's consent for anyone under 14. Violators are first ordered to correct it, and the app may be taken down. For refusing to correct, the fine is up to 1,000,000 (100万) CNY, and the person in charge is fined 10,000 to 100,000 CNY. In serious cases the fine is up to 50,000,000 (5000万) CNY or 5% of the previous year's turnover, and the person in charge is fined 100,000 to 1,000,000 CNY. People who write code and build the product can also count as the person in charge.

Moderate value
Evidence B
Keeps you free

Mainland China only 9 tips

These tips describe mainland-China rules and do not apply in the United States; they are here for people living in China.

Don't write or sell scripts for grabbing tickets, flash sales, fake orders or bonus-farming, even if it is only "automating button clicks"
A script that doesn't change memory or crack anything, and only sends requests faster than a person can, can still lead to a conviction. Earning 5,000 CNY or causing the other side a loss of 10,000 CNY is enough. One person used bought 12306 (China's national railway ticketing site) accounts to grab more than 200 tickets for others and earned more than 20,000 CNY. The sentence was 1 year 6 months, suspended for 1 year 6 months, and a fine of 5,000 CNY. Someone who sold ticket-grabbing software in an online shop paid 20,000 CNY in damages for unfair competition.
Scrape only public pages that need no login, don't get around anti-scraping measures, don't touch personal information, and don't sell what you scrape
Data you can only get with a login, a token, or by cracking a signature counts as getting around protection, with up to 3 years, and 3 to 7 years in serious cases. Scraping personal information is more serious. 50 items of location, communications, credit or property information count as serious circumstances. So do 500 items of lodging, health or transaction information, 5,000 items of other kinds, or earning 5,000 CNY.
Don't take development jobs for gambling, fraud or porn apps, and don't set up payment channels or unblock accounts for a "client"
Jobs like this pay well and have vague requirements. If you take one, you count as an accomplice of the gambling ring. Under the crime of running a gambling venue (开设赌场罪) the sentence is up to 5 years, and 5 to 10 years in serious cases. That is heavier than simply helping out, which carries up to 3 years. In one esports betting app, 28 people who wrote the code got 1 year to 3 years 6 months. A person who unblocked QQ accounts for a fraud ring got 1 year 6 months and a fine of 20,000 CNY.
Don't sell circumvention tools or VPN accounts, and don't set up such nodes for others
If you set up your own line abroad, or use an international channel other than the state's public channels, the police can order you to stop the connection, give a warning, fine you up to 15,000 CNY and confiscate illegal gains. For those doing it as a business, the investigating authority may handle it as the crime of illegal business operation (非法经营罪), with up to 5 years in serious cases. This item is about selling and setting up nodes. For personal use, the penalty goes no higher than a warning plus a fine.
If you signed a non-compete, and the company doesn't pay the monthly compensation after you leave, send a written demand; after 3 months without payment you can terminate it; for a post that never touched trade secrets, you can ask that the clause be declared ineffective
A non-compete (竞业限制) means that for a period after you leave you may not work for a competitor. It lasts 2 years at most, and the company must pay compensation every month. If no amount was agreed, it is 30% of your average wage over the 12 months before you left, and not below the local minimum wage. If the company fails to pay for 3 months for its own reasons, you can ask to terminate it. From 2025, if your post never touched trade secrets, you can ask that the clause be declared ineffective.
Before launching a website or app, file the ICP record, and keep logs for at least 6 months as the classified protection rules require
Filing costs nothing, and through a cloud vendor's process it takes about a few weeks. A site on a server in China that is not filed will be shut down. If a filer says it is free but actually charges, the fine is 100,000 to 1,000,000 CNY. Logs must be kept for a full 6 months, and for refusing to correct, or when harm results, the fine is 10,000 to 100,000 CNY.
Before offering a generative AI service to the public, complete the security assessment and algorithm filing the rules require, and label generated content
A generative AI service aimed at the public that can influence public opinion or mobilize people needs a security assessment and an algorithm filing before launch, and a change or shutdown must also be filed or canceled. Generated images and videos must be labeled. Small tools for your own use that are not open to the public don't need any of this. Violations are punished under the Cybersecurity Law and other laws.
Don't make or release tools that automatically skip or block ads in other companies' apps; even if they are free and offline, they can be found to be unfair competition
Making software that skips or blocks ads in other companies' apps for users can get you sued for unfair competition. It can count even if you charge nothing, because the businesses the law covers include individuals who provide services. A browser that blocked Mango TV's (芒果TV) intro ads by default paid 800,000 CNY in damages. An app that let people skip Mango TV's splash ads directly paid 80,000 CNY for the loss.
Don't build an "AI relay station" that resells overseas large-model access at low prices: a site operator in Shanghai has already been placed in criminal detention
An AI relay station (AI 中转站) is a website that resells access to overseas large-model APIs at low prices. A site operator in Shanghai was placed in criminal detention for 37 days over this. After release on bail, he said himself that he would surely be sentenced, and he has already returned the money and illegal gains. The Ministry of State Security (国家安全部) has also issued a notice saying that many relay stations have no operating qualification and privately send user data abroad.