 |
| An individual surnamed Zhang (张) is given a two-day administration detention by cybersecurity police in 2018 for selling software that speeds up connections to overseas websites. His profits were also confiscated. Image Credit: Jiangsu Cybersecurity Police |
In 2017, a series of criminal cases against VPN providers and users began to surface after the Ministry of Industry and Information instituted VPN restrictions earlier that year by issuing the Notice on Cleaning Up and Regulating the Internet Access Service Market. In these cases, authorities invoked the offense of “illegally providing a tool for intruding into a computer information system.” In a legal opinion column published in October 2018, China University of Political Science and Law Professor Luo Xiang likened the offense to the now-abolished crime of “hooliganism” (liumangzui 流氓罪), calling it “cyber hooliganism” (jisuanjiliumangzui 计算机流氓罪), because it is increasingly being misused by law enforcement, as hooliganism once was, and is raising what Luo sees as “similar challenges.” Prior to its abolition in the 1997 Criminal Law, “hooliganism” was used as a catch-all offense based on weak legal logic that gave authorities discretion to punish a broad range of vaguely defined crimes. Luo uses the term cyber hooliganism as an analogy to imply that the offense of illegally providing a tool to intrude into computers has become a new “pocket crime” (kou daizui 口袋罪). Such ill-defined offenses can all too easily be used, especially by police, to criminalize cyber activities, even those which “no explicit stipulations of law deems (sic) a crime,” and for which, according to Article 3 of the Criminal Law, they should not “be convicted or given punishment.”
An additional reason for concern is that the offence of using VPNs, which is now incorporated as Article 285 of the Criminal Law, is applicable in a broad range of circumstances, when an offender violates a decision or law formulated by the National People’s Congress (NPC) and its Standing Committee (SC), or even an administrative regulation, measure, or order issued by the State Council. In addition, the offense has been widely used even when an individual does not engage in any of the aforementioned cybercrimes: VPN providers are prosecuted simply for violating the 2017 VPN ban, an administrative notice by the Ministry of Industry and Information. As the VPN ban was not formulated by the State Council, however, violating this administrative measure should not incur criminal liability under Article 96 of the Criminal Law.
Hooliganism in the Cyber Age: What counts as a serious crime?
Available information shows that most offenders of cyber hooliganism were born in the 1980s to 1990s. Deng Jiewei (邓杰威) is one of the young VPN sellers known to have been convicted and sentenced to nine months’ imprisonment in Dongguan, Guangdong, in March 2017. The judgment stated that in October 2015 Deng began selling software on his website that allowed users to “visit foreign websites that could not be accessed by a mainland IP address” and “made an illegal profit of RMB 13,957.57.” Although Deng turned himself in and pleaded guilty during the trial, the court refused to mete out a lenient sentence on the grounds that Deng had been “committing the crime for a long time” and his actions “caused relatively great social harm.” Professor Luo disputed Deng’s conviction and sentencing in his column, because violating an administrative notice issued by the Ministry of Industry and Information should not have constituted a criminal offense.
In a separate case, news media sources widely reported that an individual surnamed Dai was sentenced to three years (with a three-year suspension), in Baoshan District, Shanghai, in September 2018. Dui Hua’s research revealed that his full name is Dai Guimao (戴贵茂). Dai, a software developer for a securities management company, was accused of renting multiple servers from overseas internet service providers and providing VPN services for hundreds of mainland users from April 2016 to October 2017. The transaction records of Dai’s Wechat and Alipay accounts were cited as criminal evidence against him. Dai was also given a fine of RMB 10,000, equivalent to all the revenue he made from selling VPNs.
Dui Hua also unearthed five other cases, in which a total of 17 individuals were sentenced for selling VPNs from 2017 to 2019 for crimes stemming from the concept of cyber hooliganism. Article 285 of the Criminal Law subjects offenders to no more than three years’ imprisonment in cases where the circumstances are "serious," and three to seven years’ imprisonment if the circumstances are “especially serious.” In 2011, the Supreme People’s Court issued an interpretation defining both serious and especially serious circumstances. A case is considered serious if an offender provides a special program or tool that can be used for intruding into or illegally controlling a computer information system that reaches more than 20 people, or makes an illegal income of RMB 5,000. Once either the number of users or the amount reaches five times this standard, the circumstances become especially serious.
Although the court judgments stated that all five cases were “especially serious,” their sentences varied from suspended sentences to 39 months’ imprisonment. Lu Bo (卢勃), who received the longest sentence among the 11 offenders in Henan, was accused of setting up a company that provided VPN services to 2,499 internet users and making an income of RMB 375,332 between April 1, 2015 and September 23, 2017. Lu and six other company employees, who were sentenced to 14-15 months’ imprisonment, lodged an appeal, but the Sanxiamen Intermediate People’s Court upheld the judgment on December 17, 2018.
In a separate case, also in Henan, Liu Bingyang (刘冰洋 ) was only given a three-year sentence with a five-year suspension, even though he had earned roughly the same amount as Lu by providing VPN services to over 4,000 internet users. Another two people, surnamed Sang (桑), were also given two to three years’ imprisonment (with suspensions of two to three years) in Kunming, Yunnan, for amassing a profit of RMB 300,000. They claimed to have served 20,000 users. In another case concluded on January 29, 2019, in Hubei, Liu Xiaokang (刘小康) was also given a three-year sentence (with a suspension of four years) for making an illegal profit of RMB 2,662,280, seven times more than Lu and all his employees had made. The prosecutors found that 486,830 online users had registered for Liu’s VPNs. Of these, 37,077 were paying users. In the most recent case, concluded on April 22, 2019, six defendants who had made a profit totalling RMB 263,669 were given three-year suspended sentences. The judgment did not state how many users had purchased their VPN services.
Evidence also suggests that promoting the use of VPNs even without an intent to profit can result in prosecution. On March 25, 2019, Sun Dongyang (孙东洋) was indicted for “illegally providing a tool for intruding into a computer information system.” Sun founded doubibackup.com, a website that provides free-of-charge instructions for online users, not only about VPNs but also about other circumvention software, such as Telegram and Shadowsocks. At the time of writing, Sun remains incarcerated in Henan’s Xinmi City Detention Center.
Illegal Business
Internet users who sell VPNs unapproved by the state are can also fall victim to the “illegal business activity” charge. The most severe sentence known to have been given involved Wu Xiangyang (吴向洋), a network engineer who was sentenced to five years and six months’ imprisonment in Guangxi in December 2017. Since 2013, Wu had operated an online store on his own website, popular e-shopping site Taobao, and social networking sites, where he made an “illegal profit” totalling RMB 500,000 from leasing or selling VPN software and hardware devices without applying for a business permit. Wu’s VPN service, which aimed to provide better access to overseas audio and video programs, claimed to have served 8,000 foreign clients and 5,000 businesses. Wu is expected to complete his sentence in December 2022. Dui Hua’s research recently revealed that the Guigang Intermediate People’s Court ordered the Pingnan County People’s Court to retry the case due to insufficient evidence on September 25, 2018. The outcome of the retried case remains unknown at the time of writing.
Dui Hua’s research also discovered four similar cases involving eight defendants who were also sentenced in 2018. Their sentences ranged from suspension to nine months’ imprisonment. In one of these cases, a defendant surnamed Liao (廖) was given a prison sentence in Anhui for allegedly making revenue of about RMB 1.2 million in the 16 months from May 2016 to September 2017 from selling VPNs and EVO boosters, a software application that speeds up connections to overseas game servers, without a business license.
The amount of proceeds made from selling VPNs and other software applications, again, does not appear to be an important factor in determining sentencing. For instance, both Wu and Liao, who received prison sentences, made substantially lower revenues, while three other people whose revenues were much higher were only given suspended sentences. The three, surnamed Chen (陈), Cao (曹) and Zeng (曾), sold VPNs for around RMB 8.8 million and made profits of RMB 250,000 each. Despite the scale of their businesses across China, the court in Hunan gave them suspended sentences, because the judgment stated that they each had surrendered RMB 500,000 before they were indicted.
Dui Hua has previously reported that the offense of illegal business activity is also commonly used against Christian book sellers. The offense, which contains a vague clause of “other activities” in Article 225(3) of the 1997 Criminal Law, has allowed the Supreme People’s Court to issue judicial interpretations that extend the scope of criminal liabilities to violators of administrative regulations under the guise of “disrupting market order.” In the cases discussed above, VPN sellers were likewise found guilty of disrupting the market order governed by the Ministry of Industry and Information.
The Costs of China’s Criminalization of VPNs
China pays a high price for enforcing high-stakes and arbitrary control over the internet. Externally, it is an important irritant in U.S.-China relations. In 2016, the U.S. for the first time began calling China’s online censorship a trade barrier. According to the American Chamber of Commerce in China's 2016 American Business in China White Paper, among the severe challenges faced by its members was the fact that “China is extending this restrictive regulatory framework beyond traditional telecommunications services into any IT sector that utilizes Internet connectivity, including…. technical standards that often diverge from global standards, Internet content restrictions, and privacy and cross-border data flow restrictions.”
Domestically, internet users forced to spend money on VPNs to access overseas information are additionally often subjected to slow and low-capacity internet connections. The Great Firewall is detrimental to creativity and innovation, because mechanisms that block access to the web leave entrepreneurs, artists, scientists, and inventors unfamiliar with global trends and practices, and unable to communicate with peers abroad. In 2017, The Guardian, which appears intermittently on the list of blocked foreign websites, wrote that the ban on VPNs also harms academics, software developers, and foreign businesses: “For years Chinese researchers have complained they lack adequate access to overseas journals and methods to communicate with universities around the world, while developers rely on code hosted on websites based outside China.”
While online information is not necessarily easy to access even in democratic societies, netizens there face no legal risk for using or selling VPNs. China under Xi has made the pursuit of internet freedom even more costly than under his predecessors. Since 2017, providers and users of VPNs have faced criminalization as part of Xi's bid to fortify the Great Firewall against any ideas or information that Xi deems threatening. VPN providers can easily fall prey to charges of “illegally providing a tool for intruding into a computer information system” or illegal business activity, since, as we have seen, both “pocket crimes” effectively extend criminal liabilities to violators of administrative regulations. More research is needed to understand the rationale behind sentencing. Despite an announcement by the Beijing city government on August 15 of a three-year plan to expand openness in some areas in internet content service, it is doubtful that the trend towards increasingly strict government control over the distribution and sharing of content in cyber space that could be interpreted as political will see meaningful change. What is crystal-clear, however, is that Xi has magnified his internet control by punishing online users who access or post information that is deemed sensitive or subversive by the state, or enable others to do so, outside of China’s government-approved domestic networks.
