The Supreme People's Procuratorate releases a case on protecting citizens' personal information, revealing criminal routines——
How personal information is “stolen” (Legal Focus)
Overseas "social engineering libraries" resold citizens' personal privacy, abused GPS positioning technology to illegally obtain personal information, stole more than 1 billion pieces of personal information and "unboxed" it online... On the 5th anniversary of the implementation of the "Personal Information Protection Law of the People's Republic of China", the Supreme People's Procuratorate released a number of typical cases of protecting citizens' personal information in accordance with the law, focusing on the new characteristics and trends of current crimes that infringe on citizens' personal information, revealing criminal routines and harmful consequences and providing warnings and reminders.
Be wary of the criminal chain of "finding buyers domestically - obtaining data overseas - reselling domestically at increased prices"
In June 2024, Wang and Xu Mouling discovered that the personal information of Chinese citizens could be purchased in bulk from overseas online "social work libraries", so they rented venues, recruited salespeople, and set up a "studio." Wang contacted the upstream sellers, Xu Moulin was responsible for the fund settlement, and the salesperson searched for downstream buyers through the phone and the Internet, forming a criminal chain of "finding buyers domestically - obtaining data overseas - reselling domestically at a higher price", reselling household registration, property status, whereabouts and other information, involving more than 1.98 million yuan. In order to avoid investigation and prosecution, the gang allocates work mobile phones and social media accounts, uses the Internet to pay and receive payments, and then uses virtual currency to pay overseas upstreams.
The People's Procuratorate of Wucheng District, Jinhua City, Zhejiang Province conducts a substantive review of electronic data, identifies the source of information, circulation paths, and fund settlements step by step, and determines the facts and amounts of crimes in accordance with the law; it guides investigation and supervision of case filing, and arrests upstream material suppliers and downstream secondary resellers to achieve full-chain punishment.
Crimes of infringement of citizens' personal information are increasingly characterized by organization, chaining, and cross-borderization. Similar criminal chains are also hidden in the secondary processing of "public information." Liu set up a real estate agency and recruited people to capture house rental and sales information released by "first-hand female landlords" from various platforms, then screened out women with certain financial strength, packaged the real estate information, contact information, etc., and sold them to overseas people. A total of more than 24,000 pieces of information were illegally obtained and sold, making a profit of more than 190,000 yuan.
The People's Procuratorate of Binhu District, Wuxi City, Jiangsu Province reviewed and determined that the disclosed information is not a "public resource" that can be resold at will - Liu changed the purpose and use of the information disclosure without the consent of the rights holder, and provided it cross-border after targeted processing, which clearly exceeded the limit of reasonable use. The procuratorial organ initiated a public prosecution for "particularly serious circumstances", issued procuratorial recommendations to industry authorities to provide risk warnings, and promoted the release and review of housing information and the source management of the intermediary industry.
The criminal method has changed from manual theft to technological theft, which is highly concealed and harmful.
Starting in 2020, Chen Moucheng, Lu Moupeng, and Ma Mouli used script codes to invade a provincial affairs platform system and illegally obtained more than 16 million citizen identity numbers and phone numbers in order to gain Internet influence; they also wrote programs to steal more than 1 billion pieces of user account information from multiple online post bars and cloud spaces. Relying on precisely stolen personal information, criminals targeted 47 netizens by "opening boxes," cyberviolence, and offline harassment. Five victims sought medical treatment for mental depression, and many minors and college students became tired of studying.
During the review and prosecution stage, the procuratorial organ organized network information experts to make a judgment: Lu Moupeng intruded into the national affairs computer information system and provided technical support, which constituted the crime of illegal intrusion into the computer information system and the crime of picking quarrels and provoking trouble, and was punished for several crimes; Chen Moucheng and Ma Mouli invaded the system to obtain information, and were punished for the crime of infringing on citizens' personal information. In addition, their cyber violence constituted the crime of picking quarrels and provoking trouble, and were punished for several crimes.
In the crime of infringing on citizens' personal information, the criminal methods are increasingly changing from traditional "manual theft" to "technical theft".
From April 2022 to February 2024, Wang Moumou and Lin Moumou used "crawler" programs on the Internet to illegally invade the server of a tertiary-level oncology hospital, steal more than 3.85 million patient personal information, outpatient medical order data, inpatient medical order data, etc., migrated to overseas servers for storage for half a year, and sold some medical data for profit. During the handling of the case, the People's Procuratorate of Yuexiu District, Guangzhou City, Guangdong Province solved the problem of determining the "identifiability" and "correlation" of medical and health information and confirmed that the prescription data can be accurately traced to a specific patient and is sensitive medical and health personal information clearly protected by law. After the criminal verdict came into effect, the procuratorate filed a separate civil public interest lawsuit: Although the provable profit was only 10,800 yuan, the data was highly sensitive, affected a wide range of areas, and had high repair costs, and the outbound storage affected public health and safety. Accordingly, the public welfare damage compensation was determined at 1.5 million yuan.
Customized routines for precise hunting of specific groups of people such as the elderly and celebrities
In a typical case, Pan and Fan found that many rural elderly people have actual needs to activate electronic medical insurance vouchers, but they are not familiar with mobile phone operations and have low awareness of prevention. The two formed a "village recommendation" gang, and in the name of "helping with business", they provided door-to-door "services" in more than 500 villages in Henan and other six provinces. They defrauded the names, identity numbers, and facial information of more than 20,000 elderly people. They authenticated Alipay accounts in batches and then resold them, making an illegal profit of more than 1.8 million yuan.
The People's Procuratorate of Mengzhou City, Henan Province carefully reviewed the electronic data, accurately determined the amount of information, and severely punished the organizers and commanders. In response to the problem that the elderly did not know how to deal with risky accounts, they teamed up with the public security and grassroots organizations to conduct household inspections, help cancel local accounts involved in the case, and simultaneously carried out legal publicity.
Criminals tailor their tactics to target specific groups of people and carry out precise hunting.
Shu Mouping, an outsourced customer service officer of an airline, was keen on chasing stars and used his system permissions to inquire about the celebrities’ scheduled flights. Information about more than 100 flights was leaked through online groups, triggering follow-up photos, accompanying flights, and "passing off". This not only violated personal privacy, but also disrupted the order of the airport and posed public safety risks. The People's Procuratorate of Chaoyang District, Beijing, determined that the flight to be traveled can lock the location of a specific natural person in the future, which is the whereabouts and trajectory information. The procuratorate initiated a public prosecution for the crime of infringing on citizens' personal information, and simultaneously initiated a criminal incidental civil public interest litigation.
The procuratorial organ reminds: No organization or individual may illegally collect, use, process, or transmit other people's personal information, and may not illegally buy, sell, provide, or disclose other people's information; the general public must increase their awareness of prevention, ask for the purpose before facial recognition authorization, do not purchase services such as "location inquiry" and "background investigation" from unknown sources, and report to the police if information is leaked in a timely manner.
