ON GUARD: Engineers at the National Computer Virus Emergency Response Center analyze threats to Internet security (LIU HAIFENG)	CRACKING CRIME: A police officer in Hangzhou, Zhejiang Province, investigates a phishing website (FANG LIE)

Leaked personal information has been used in telemarketing and even in criminal activities such as fraud, blackmail and kidnapping.

On May 15, 2012, police authorities in Nanjing, capital city of east China's Jiangsu Province, busted an Internet fraud ring and apprehended five suspects. The latter purchased personal identification numbers and bank account information from online sources and intercepted newly issued credit cards mailed to victims. They used the purchased data to activate the cards and withdraw cash in victims' names.

In February 2012, Beijing police waged a special campaign against cyber crime. Within half a year, it cracked nearly 4,000 cases, captured more than 5,000 suspects and punished over 7,500 rule-violating Internet businesses.

Stolen data contributed to some of the crimes. In one case, identity thieves exploited a Beijing resident's love of a television talent show to bilk him of 2,500 yuan ($402) in early 2012.

A man surnamed Li queried search engine Baidu.com for the producer's contact information, and called a number that appeared in the search results. The voice who answered promised Li a place on the show if he remitted 2,500 yuan to a certain bank account. The contact stopped returning calls after payment, and Li reported to the police.

After investigation, Beijing police found that from January to March last year, the account information of 660 clients of Baidu Tuiguang, an advertising service offered by Baidu.com, had been stolen. These accounts had been broken into, and clients' advertisements had been altered to commit fraud.

In Li's case, the phone number of the program's producer was changed so that when Li called, another party answered. On June 19, 2012, 13 suspects were arrested in southern Hainan Province. They confessed to cheating netizens out of more than 500,000 yuan ($80,333).

Legal process

Since the emergence of the technology in the 1990s, China has promulgated multiple laws and regulations to govern cyberspace.

In 2000, the NPC Standing Committee passed a decision on maintaining Internet security, which included a few provisions on data protection, yet it emphasized the safeguarding of state secrets. It stipulated that intrusion into computer systems in the field of state affairs, national defense, and cutting-edge science and technology, and tampering with data in computer systems should be punished according to the Criminal Law or the Law on Penalties for Administration of Public Security. The decision forbade illegal interception, alteration or deletion of other people's e-mails or other data, and prohibits infringement on citizen communication freedom and privacy.

The Tort Liability Law that took effect in July 2010 and the amended Criminal Law that went into force in May 2011 respectively specifies civil liabilities for infringement on others' rights through the Internet and criminal punishment for illegal acquisition and trading of personal information.

The State Council, China's cabinet, and industry regulators have also made some regulations and rules on protecting digital information.

"Overall, these laws and regulations on protecting online data are still relatively weak," said Li Fei at a press conference on December 28, 2012. According to him, the NPC Standing Committee and relevant government departments began to draft the decision on strengthening online information protection in 2011.

"Citizens have the basic right to keep their personal digital information confidential, and it is very important to make a law to protect such information," said Wang Liming, Vice President of the Renmin University of China and civil law expert.

Nonetheless, provisions in the NPC Standing Committee's decision are not detailed enough, according to Zhou Hanhua, a law research fellow at the Chinese Academy of Social Sciences.

"It has not specified function or power division among network supervisory departments. These need to be further specified in the future," Zhou told Xinhua News Agency.

"The State Council is making detailed rules to implement the NPC Standing Committee's decision on strengthening the protection of online personal information," said Yuan Shuhong, Deputy Director of the State Council's Legal Affairs Office. "The State Council is also checking its regulations to identify any discrepancies with the decision."

Email us at: wanghairong@bjreview.com