In short: there is no single “cybercrime” law in China. Hacking, data theft, system sabotage and online fraud are prosecuted under different articles of the Criminal Law, and the penalty depends mainly on what was attacked and how much harm resulted — from fines or short detention up to life imprisonment when computers are used to commit very large frauds.
What does the Criminal Law actually punish?
Article 285 targets hacking. Breaking into computer systems that handle state affairs, national defence or cutting-edge science and technology carries up to three years’ imprisonment or criminal detention. Illegally obtaining data from other systems, or supplying hacking tools, is punishable by up to three years where the case is serious, rising to three to seven years in especially serious cases.
Article 286 targets damage. Deleting, altering, adding to or jamming a computer system, or spreading destructive programs such as viruses, carries up to five years where the consequences are serious — and five years or more where they are especially serious.
Article 287-1 (added in 2015) is the provision that catches many ordinary helpers: knowingly providing internet access, server hosting, storage, communications support, advertising or payment settlement for someone else’s online crime is punishable by up to three years and a fine where the assistance is serious. In practice, this is the charge often used against people who rent out their bank cards or payment accounts to scam gangs.
Where a computer is only the tool — for example, online fraud or stealing company secrets — courts convict under the underlying offence. Large-scale telecom fraud is therefore often punished as fraud under Article 266, which reaches ten years to life for extremely large amounts.
Can foreigners be prosecuted for cybercrime committed abroad?
Yes, in limited cases. Under Article 8 of the Criminal Law, China may exercise jurisdiction over a foreigner who commits a crime outside China against the Chinese state or a Chinese citizen, provided the offence carries a minimum sentence of at least three years under Chinese law and is also an offence where it happened. Attacking Chinese servers or defrauding Chinese victims from overseas does not automatically make you safe.
In practice, most people caught in this area are not master hackers. They are payment-account suppliers or technical-support staff for cross-border scam or gambling platforms. Even if you thought you were only doing a “side job”, Chinese investigators look closely at what you knew — and a conviction under Article 287-1 creates a criminal record that can affect visas and future business in China.
Illustrative scenario (hypothetical): a developer abroad is paid to keep a website running that resells stolen personal data of people in China. He never touches the data himself. If the platform operators are arrested in China and evidence shows he knew what the site did, he could face investigation under Article 287-1 and, if he re-enters China or is extradited, prosecution with a possible sentence of up to three years.
The bottom line: cybercrime penalties in China are specific and real. If you are asked to help with anything involving other people’s accounts, data or payment channels — especially across borders — check the legal risk before you say yes.
Related Reading
- Guides: China Criminal Law Guides
- Can You Leave China While Under Criminal Investigation?
- Does China Extradite Its Own Citizens?
Frequently asked questions
Q: What does the Criminal Law actually punish?
A: Article 285 targets hacking. Breaking into computer systems that handle state affairs, national defence or cutting-edge science and technology carries up to three years’ imprisonment or criminal detention. Illegally obtaining data from other systems, or supplying hacking tools, is punishable by up to three years where the case is serious, rising to three to seven years in especially serious cases. Article 286 targets damage.
Q: Can foreigners be prosecuted for cybercrime committed abroad?
A: Yes, in limited cases. Under Article 8 of the Criminal Law, China may exercise jurisdiction over a foreigner who commits a crime outside China against the Chinese state or a Chinese citizen, provided the offence carries a minimum sentence of at least three years under Chinese law and is also an offence where it happened. Attacking Chinese servers or defrauding Chinese victims from overseas does not automatically make you safe.
Wang Guan | Co-founder, Beijing Haolue Law Firm | +86 17813108512