How was the personal information fortified on the resumes “unlocked” in batches?
Name, phone number, ID number... the personal information filled in a resume should only flow to the recruiter. But in the hands of some people, this information is "unboxed" and packaged for sale in batches.
Recently, with the trial of a case of illegal trading of citizens’ personal information, a black industry chain of “resume unboxing” hidden behind recruitment platforms has surfaced. Who is paying for the information after "opening the box"? Are virtual phone numbers personal information of citizens?
At the beginning of this year, Mr. Wang, an employee of a company in Putuo District, Shanghai, received a call from a stranger. The other party not only accurately called him by name, but also knew his company and job well. In just a few days, several colleagues received the same call. How could your name, mobile phone number, and workplace be accurately known by a complete stranger?
Employees who noticed the leakage of personal information reported it to the company one after another, and the company immediately reported the case to the public security agency.
Ding Lei, judge of the Criminal Tribunal of the Putuo District People's Court in Shanghai, said that after a preliminary investigation, the public security organs identified a common intersection among the people who reported the case - they all submitted their resumes on a mainstream recruitment website. Following this clue, the public security organs slowly identified the two suspects in this case: Lin and Gan.
According to the rules of relevant recruitment website platforms, ordinary users can view the work experience of job applicants, but their names and mobile phone numbers are anonymized by the platform. Only corporate accounts that have completed the registration review with valid human resources qualifications can unlock and view the complete names and contact information of job seekers by recharging tens of yuan in a single transaction or completing platform tasks to obtain points, and there is a limit on the number of daily redemptions for a single account.
How is the personal information that has been fortified at all levels “unlocked” in batches?
Zhao Wenkai, assistant prosecutor of the First Prosecution Department of the Putuo District People's Procuratorate, said that Lin obtained the authority to query resumes by purchasing some idle or expired registered accounts, forging authorization certificates from human resources companies, and uploading them to the backend of Liepin.com for review. In accordance with the requirements of downstream buyers, targeted inquiries are made about relevant information of persons who submit resumes online.
Lin found his old classmate Gan, and the two completed platform tasks like ordinary users to earn points every day, and used the points to unlock the contact information of job seekers. Although there is a limit to the number of exchanges per account in a single day, the two of them have 70 or 80 available accounts, which can generate considerable "output".
Ding Lei told reporters that their behavior was very concealed and the cost of the crime was very low. The crime occurred more than a year ago, but it involved an information purchase fee of more than 700,000 yuan. Buyers can obtain this personal information through formal channels, and the cost of each piece of information is tens of yuan or even higher, but through them, each piece of information can be purchased for only a dozen yuan.
Who is paying for the information after "opening the box"?
Zhao Wenkai said that most of the purchasers of this information are consulting service companies, and the purchased personal information is used to conduct business research on competitors.
The case handling agency also introduced that in addition to business consulting companies, some headhunting agencies will also purchase resume information from Lin and others. After getting the contact information, the buyer made a call using words such as "industry communication" and "paid consultation". During the trial of the case, Lin and Gan argued that many of the contact information they issued were "virtual numbers" with time limits and would become invalid upon expiration, so they could not be counted as citizens' personal information.
In order to clarify the technical facts, the prosecutor went to the communication operator to conduct investigation and verification. Zhao Wenkai said that according to relevant judicial interpretations, the key to determining whether it belongs to citizens' personal information lies in whether it can identify a specific natural person alone or in combination with other information.
It was found that Lin and Gan illegally obtained tens of thousands of pieces of personal information through recruitment websites, including more than 7,000 pieces of citizen personal information illegally provided to Liu. The two made a total of more than 700,000 yuan in illegal profits by "opening the box" of resumes.
The Putuo District People's Court sentenced Lin to four years in prison and a fine of RMB 700,000 for infringing on citizens' personal information; and Gan to one year and six months in prison and a fine of RMB 90,000. Currently, the judgment has taken effect.
The investigation of Liu and other related persons involved in the case is carried out simultaneously, and the entire chain of attacks on the upstream and downstream illegal production of personal information is continuing.
After investigation by the case-handling agency, the upstream sellers’ committing crimes vary:
Some people have similar tactics to Lin, exploiting loopholes in platform rules by acquiring idle accounts, forging corporate qualifications, and "opening the box" of job seekers' contact information on demand;
Others use technical means to break through protection, use crawler programs to bypass the front-end permission verification of the recruitment platform, capture resume data including contact information in batches, and even build a "resume database" that can be retrieved repeatedly.
The reporter searched a second-hand trading platform using "recruitment account" as the keyword and found that multiple merchants provided "recruitment platform account services." There are currently two ways to obtain an account:
One is a finished account, which is a corporate account that has been registered on a certain recruitment platform. The merchant said that it can be purchased directly without qualifications, and the price ranges from 2,000 yuan to 3,000 yuan.
The other is to provide the legal person certification certificate required for enterprise certification, which sells for about 1,000 yuan.
A company employee in charge of human resources management told reporters that these purchased registered accounts can be easily used to download resumes on recruitment platforms and then resell them for profit, which is very risky.
Li Huaisheng, a professor at the School of Criminal Justice of China University of Political Science and Law, said that although my country has increasingly cracked down on the protection of personal information, ordinary people still face many difficulties in safeguarding their rights when their personal information is leaked.
After information is leaked, it is often resold repeatedly and changed hands layer by layer, making it difficult to identify the source and identify the defendant;
Victims usually discover leaks after receiving harassing phone calls, but proving which link caused the problem requires a large amount of data comparison and technical identification, which is difficult for ordinary people to do;
Prosecution is time-consuming and labor-intensive, and compensation is often limited. Many people can only swallow their anger.
Li Huaisheng also said that the key to strengthening social governance of personal information protection is to conduct full-chain accountability.
Source governance
The law must clarify the boundaries of information collection, strictly implement the minimum necessary principle, and consolidate the responsibilities of platform entities. We cannot just write "protect privacy" in the agreement and be done with it.
Regulatory aspects
Network information, industry information technology, and public security must work together to not only target those who open the boxes, but also pursue downstream buyers to uproot the data sales network.
Rights protection
It is necessary to explore public interest litigation and collective litigation to reduce the cost of rights protection; in serious cases, criminal liability will be pursued, and the amount of civil compensation and administrative penalties will be increased to prevent offenders from committing crimes again.
Producer丨Liu Li
Reporter丨Guan Xin
