Don't test other people's systems without written authorization; "good intentions" and "reporting afterward" are not defenses

Cost

Free. Before joining a vendor's SRC or a crowd-sourced test, get a document that states the scope of authorization, the list of targets and the permitted time window. An SRC is a security response center run by a vendor itself, which takes vulnerability reports from outsiders. Stop once you have confirmed that the vulnerability exists. The hard part is giving up the "just try it quickly" moment.

What you get

A normal company's or individual's system is a computer information system outside the fields of state affairs, national defense and advanced science and technology. Breaking into such a system, or using other technical means to obtain the data stored, processed or transmitted in it, carries up to 3 years in prison or short-term detention (拘役) when the circumstances are serious, with a fine on top or a fine alone. In especially serious cases it is 3 to 7 years plus a fine. "Serious circumstances" has several standards: obtaining 10 or more sets of identity credentials (such as account passwords) for online financial services like payment and settlement, securities trading or futures trading; obtaining 500 or more sets of other identity credentials; illegally controlling 20 or more computer information systems; illegal gains of 5,000 CNY or more, or economic losses of 10,000 CNY or more. Five times or more of these figures counts as "especially serious circumstances." Official case: Procuratorate Case No. 36 (检例第 36 号) set out one sentence: "Logging into a computer information system with an account and password beyond the scope of authorization is an act of breaking into a computer information system." This means that even if you already hold the account and password, using them outside the authorized scope is itself an intrusion. In that case, three people used the accounts, passwords and tokens they had from work to log into the company's internal system from other places, downloaded data outside their work duties and sold it online, with illegal gains of 37,000 CNY. They were sentenced to 4 years, 3 years 9 months and 4 years, and each fined 40,000 CNY (nationwide)

Notes

The guiding case, Procuratorate Case No. 36, was itself about selling data for profit. It is cited only for the sentence that "logging in beyond the scope of authorization also counts as intrusion," not to say that a good-faith test would be punished as heavily. What you meant to do and whether you reported afterward cannot cancel the charge. They can only affect how heavy the sentence is and whether to prosecute. A vendor thanking you first and reporting to the police later are not contradictory, and a thank-you is not authorization. In 2016, a white-hat hacker submitted a vulnerability in the Jiayuan (世纪佳缘) website to a third-party vulnerability platform. Jiayuan later called the police and he was arrested. Jiayuan told reporters it called the police because data had been taken, and it did not know at the time that the person who took the data was the person who submitted the vulnerability. This case exists only in media reports, with no judgment and no official announcement, and there is no official statement on how it ended. No good-faith testing case that could be checked word for word was found on the websites of the Supreme People's Court or the Supreme People's Procuratorate either, so this item is graded only on the legal provisions and penalty standards. If you want to do this work, use a vendor's public SRC, or a testing engagement with a written commission, and write the scope, targets and time window into the document. Use the least evidence needed to prove the vulnerability, and don't pull data in bulk. Conduct that falls short of a crime still brings a public security penalty and a ban from the profession, with the same fine amounts and years as in §11.8 (don't run your own programs on other people's machines). For what to do after finding a vulnerability, see §11.10 (report vulnerabilities as the rules require).

Evidence grade

A : Specific numbers from meta-analyses, large cohorts or randomized trials; for law and policy, the statute or official text.

Sources

1. 全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百八十五条第一款、第二款）. https://jtgl.beijing.gov.cn/jgj/jgxx/flfg/fl/11033925/index.html
2. 最高人民法院、最高人民检察院 (2011). 关于办理危害计算机信息系统安全刑事案件应用法律若干问题的解释（第一条）. https://ga.sz.gov.cn/ZWGK/ZCFG/ZCJD/content/post_1304363.html（深圳市公安局转载）
3. 最高人民检察院 (2017). 第九批指导性案例（检例第 36 号，卫梦龙、龚旭、薛东东非法获取计算机信息系统数据案）. https://www.spp.gov.cn/spp/jczdal/201710/t20171017_202593.shtml
4. 央广网 (2016-06-29). 白帽子发布漏洞后被抓 世纪佳缘否认“钓鱼”使其上套（记者赵珂，实习记者刘香玺）. https://m.cnr.cn/news/yctt/20160629/t20160629_522531823.html（网页存档 https://web.archive.org/web/20261005043859/https://m.cnr.cn/news/yctt/20160629/t20160629_522531823.html）

Translated from the Chinese original. Original book, section 11, tip 9. This section describes legal rules, mostly mainland China’s. It is general information, not legal advice; for your own case, talk to a lawyer. Content may be out of date and rules differ by place. When you actually deal with an agency, a doctor or a court, follow what local officials, doctors and lawyers tell you. Disclaimer