Do not test others’ systems without written authorization; “good intentions” and “reporting afterward” are not defenses in the statute

The statute looks at whether you had authorization and how much you obtained — not at what you meant. Obtaining 500 sets of ordinary account passwords, or earning 5000 yuan or causing the other side 10000 yuan in losses, is enough for up to 3 years. Exporting one user table “to prove the bug” often crosses 500 sets in a single pass. Having account passwords and using them outside the authorized scope also counts as intrusion

Cost

No money spent. Before joining a vendor SRC or a public bug-bounty test, first obtain a document that states the authorized scope, target list, and allowed testing window. An SRC is a vendor-run security response center that receives externally reported vulnerabilities. Stop once you have verified the vulnerability exists. The hard part is giving up the “quick try” impulse

Benefit

Systems of ordinary companies and individuals are computer information systems outside the fields of state affairs, national defense construction, and cutting-edge science and technology. Intruding into such systems, or using other technical means to obtain data stored, processed, or transmitted in them, when circumstances are serious, brings up to 3 years of fixed-term imprisonment or criminal detention, and a fine concurrently or alone. Especially serious cases bring 3 to 7 years plus a fine. “Serious circumstances” has several standards: obtaining 10 or more sets of identity-authentication information (account passwords and the like) for online financial services such as payment settlement, securities trading, or futures trading; obtaining 500 or more sets of other identity-authentication information; illegally controlling 20 or more computer information systems; illegal gains of 5000 yuan or more, or economic losses of 10000 yuan or more. Five times or more of those figures is “especially serious circumstances.” Official case: Prosecutorial Example No. 36 established one sentence — “using an account and password to log into a computer information system beyond the authorized scope is an act of intruding into a computer information system.” Meaning: you already have the account and password, but using them outside the authorized scope itself counts as intrusion. In that case three people used accounts, passwords, and tokens obtained at work to log into the company’s internal system from another place. They downloaded data outside their work scope, sold it online, and had illegal gains of 37000 yuan. They were sentenced to 4 years, 3 years 9 months, and 4 years respectively, each fined 40000 yuan (nationwide)

Notes

Prosecutorial Example No. 36 itself was a case of selling data for profit. It is cited only for the sentence that logging in beyond authorized scope counts as intrusion — not to say that good-faith testing will be sentenced the same way. Article 285 of the Criminal Law and the 2011 interpretation do not list good intentions or reporting afterward as reasons that it is not a crime. The author infers from that: what you meant to do, and whether you reported afterward, cannot cancel the offense; they may only affect how heavy the sentence is or whether to prosecute. A vendor thanking you first and filing a report later are not contradictory; thanks are not authorization. In 2016, a security researcher commonly called a “white hat” submitted a vulnerability in the Jiayuan site to a third-party vulnerability platform. Jiayuan later reported to police and he was arrested. Jiayuan told reporters the report was because data had been taken, and at the time they did not know the person who took the data was the one who submitted the vulnerability. This case has only media reports, no judgment and no official bulletin; there is no official account of how it ended. No good-faith testing case that can be checked word for word was found on the Supreme People’s Court or Supreme People’s Procuratorate websites, so this item is graded only from the statute and penalty standards. If you test, go through the vendor’s public SRC, or a written engagement, and put scope, targets, and time window in the document. Prove the bug exists with the least evidence; do not bulk-extract data. Conduct below the criminal threshold still faces public-security penalties and occupational bans; fine amounts and years match item 8 (do not run your programs on others’ machines). What to do after finding a vulnerability is in item 10 (report vulnerabilities as required).

Sources · 3

1. 全国人大 (2020). 刑法（根据刑法修正案（十一）修正，第二百八十五条第一款、第二款）. jtgl.beijing.gov.cn/jgj/jgxx/flfg/fl/11033925…
2. 最高人民法院、最高人民检察院 (2011). 关于办理危害计算机信息系统安全刑事案件应用法律若干问题的解释（第一条）. ga.sz.gov.cn/ZWGK/ZCFG/ZCJD/content/post_1304…（深圳市公安局转载）；最高人民检察院 (2017). 第九批指导性案例（检例第 36 号，卫梦龙、龚旭、薛东东非法获取计算机信息系统数据案）. spp.gov.cn/spp/jczdal/201710/t20171017_202593…
3. 央广网 (2016-06-29). 白帽子发布漏洞后被抓 世纪佳缘否认“钓鱼”使其上套（记者赵珂，实习记者刘香玺）. m.cnr.cn/news/yctt/20160629/t20160629_5225318…（网页存档 web.archive.org/web/20261005043859/https://m.…）