Case against Li *, He * Min, Zhang * Bo, and Others for Disrupting Computer Information Systems

Case Brief

The automated environmental air quality monitoring substation in the Chang’an district of Xi’an (substation) is one of the city’s 13 state-controlled stations certified by the Ministry of Environmental Protection (MEP). It collects and sorts air quality data automatically, transmitting information to the China Environmental Monitoring Centre (Centre) every hour for live publication online. This data is also used to compile monthly, quarterly, and annual national air quality bulletins for nationwide publication. The substation is one of two municipal substations under direct state monitoring, with maintenance contracted out by the MEP to a Wuhan environmental protection company. Unauthorized access is forbidden.

On 4 February 2016, the substation was relocated to the roof of the Kinetics Building on the southern campus of the Xi’an University for Posts and Communications in the city’s Chang’an district. Defendant Li * took advantage of this relocation to intercept the substation’s key and memorize the password to its monitors. From March to June 2016, defendants Li * and Zhang * Bo repeatedly accessed the substation, stuffing its sampling machines with cotton yarn to interfere with the data-collecting capacity of the automated air quality monitoring system. Despite having full knowledge of the duo’s actions, defendant He * Min failed to intervene, requesting simply that the air pollution index be lowered.

On several occasions, defendant Li * instructed defendants Zhang * 1 and Zhang * 2 to interfere with the substation’s automated monitoring system by using the same method. This caused repeated anomalies with severe distortions in the data over several monitoring periods, disrupting normal operations of the national air quality monitoring system. Trying to cover their tracks, defendants Zhang * 1 and Zhang * 2 acted on defendant Li X’s instructions, accessing the substation on 7 and 9 March to delete surveillance footage.

In February and March 2016, data from the substation had already been transmitted live to the Centre every hour, published to society at large, and used to compile the MEP’s air quality assessment and rankings for 74 cities in February/March and the first quarter of 2016.

During an audit on 5 March 2016, the Centre found unusually low figures from the substation, leading it to uncover the data fabrication. Police arrested the five defendants Li *, He * Min, Zhang * 1, Zhang * 2, and Zhang * Bo. All defendants admitted the charges—except for He * Min, who argued that he only acquiesced to interference with the monitors, and should be found not guilty.

Verdict

On 15 June 2017, the Xi’an Intermediate People’s Court in Shaanxi Province delivered the [2016, Shaanxi, 01, Criminal First Trial, No. 233] Criminal Judgment. For the crime of disrupting computer systems, the court imposed custodial sentences on all five defendants:

(i) Li *: 22 months’ imprisonment

(ii) He * Min: 19 months’ imprisonment

(iii) Zhang * Bo: 16 months’ imprisonment

(iv) Zhang * 1: 15 months’ imprisonment

(v) Zhang * 2: 15 months’ imprisonment

None of the defendants appealed.

Reasoning

The court held that all five defendants breached state regulations. Article 68 of the Environmental Protection Law of the People’s Republic of China (EPL) forbids altering or forging monitoring data or instructing others to do the same; while Article 126 of the Atmospheric Pollution Prevention and Control Law of the People's Republic of China prohibits deceit or trickery in air quality monitoring. Article 7 of the Rules for Protecting Environmental Computer Systems of the People’s Republic of China provides that the safety of computer information systems is inviolable. All five defendants fabricated monitoring data by obstructing the sampling machines or instructing others to do the same, thereby violating the state regulations.

The actions of all five defendants constituted disruption of computer systems. Article 11 of the Judicial Interpretation of the Supreme People’s Court and the Supreme People’s Procuratorate on Issues of Applicable Law in Trying Criminal Cases of Harming Computer Information Systems provides that computer systems and computer information systems refer to systems capable of automatic data processing and include computers, online equipment, communications equipment, and automated equipment.

Article 10(1) of the Judicial Interpretation of the Supreme People’s Court and the Supreme People’s Procuratorate on Issues of Applicable Law in Trying Criminal Cases of Environmental Pollution provides that interfering with the sampling of environmental quality monitoring systems to cause severe data distortion constitutes disruption of computer information systems. The substation was a state-controlled automated air quality monitoring station whose figures were relayed by system software to the Centre and published via official government websites of the MEP and Centre. Publication of such air quality data was in real-time.

The sampling machine was an integral part of the air quality monitoring system; its PM10 and PM2.5 data were two of the most important indicators in assessing air pollution. The defendants’ actions in dismantling or obstructing the sampling machines with cotton yarn had the natural consequence of affecting airflow throughout the machines, distorting the monitoring data, and interfering with a correct assessment of air pollution. Such interference caused the computer information systems to malfunction.

The actions of all five defendants had severe consequences.

Firstly: defendants Li *, Zhang * Bo, Zhang * 1, and Zhang * 2 repeatedly interfered with sampling by obstructing or dismantling the sampling machines. Meanwhile, while fully aware of the others’ actions, defendant He * Min did nothing to stop them, and simply requested that Li * lower the air pollution index.

Secondly: the defendants’ interference caused markedly abnormal readings, so from February to March 2016, the substation reported data on particulates that did not conform to fluctuation patterns reported by neighboring substations: its PM2.5 data displayed anomalies from 6 p.m. on 24 February to 4 p.m. on 25 February, and from 4 a.m. on 3 March to 7 p.m. on 6 March; its PM10 data displayed anomalies from 6 p.m. on 18 February to 8 a.m. on 19 February, from 8 a.m. on 21 February to 8 p.m. on 25 February, and from 7 p.m. on 5 March to 11 p.m. on 6 March.

The substation's PM10 data reported a 41% decrease from 361 to 213 between 7 p.m. and 10 p.m. on 5 March 2016, while nearby substations reported an average 14% increase from 316 to 361. From 4 p.m. to 5 p.m. on 6 March, the substation reported an increase of 127% from 188 to 426, while others reported minor fluctuations, down to 310 from 318. Between 5 p.m. and 7 p.m. on 6 March, the substation reported a 27% drop from 426 to 309, while the others reported negligible changes (from 310 to 304). It was therefore clear that the defendants' actions in obstructing the sampling machines caused severe data distortion, as noted in the markedly low readings uncovered by the Centre during a routine audit.

Thirdly: the distorted data had already been reported to the Centre in real-time, and published to society at large. Average hourly readings from the substation had already been reported live online.

Fourthly: the distorted data had already been used to compile monthly and quarterly environmental assessments. The MEP used the distorted data in compiling its air quality rankings for 74 key cities in February/March 2016 and for the first quarter of 2016, which in turn had been published and reported to the State Council. The distorted data impacted the country’s air quality control assessment and the credibility of the Government of the People’s Republic of China; it also misinformed environmental decision-making. The five defendants’ actions in interfering with the sampling thus satisfied the requirement of “severe consequences” in Article 286 of the Criminal Law.

All five defendants were convicted of the crime of disrupting computer information systems. However, the court accepted more lenient sentences could be passed, given their confessions and contrite behavior after arrest.