On October 16, the Jinshan District police in Shanghai disclosed a case. At more than 30 locations of a certain sushi chain, as soon as the stores opened in the morning, the online queue-number system showed several hundred people waiting ahead, and the numbers on the calling screen scrolled past one by one, yet no one entered the stores. Over nearly a month, more than 50,000 such empty numbers accumulated. The numbers were grabbed by a man surnamed Lei, who listed them for sale on a second-hand platform at 15 yuan each and made more than 10,000 yuan in total. Lei was arrested on September 29 and criminally detained on suspicion of the crime of illegally controlling a computer information system; the case is still under investigation.
The headlines of two media outlets said "using AI to grab numbers." I went through the police notice and the full text of several reports, and all of them said "using technical means to crack the queue-number system used by the store"; AI did not appear anywhere. That has little effect on the legal analysis, however. This provision of the Criminal Law looks at what you did to someone else's system; whether the code was typed by a person or written by a model is not a consideration.
If you are building products for booking on behalf of others, grabbing purchases on behalf of others, or automatic ordering, or building an AI Agent that can click buttons and fill in forms for users, this case is not far from you. In both cases a program clicks on a person's behalf; Lei was criminally detained, so on what basis is your product fine? Where that line is drawn is what this article aims to explain clearly.
The red line is drawn at "authorization," not at "automation"
The charge against Lei comes from Article 285, paragraph 2, of the Criminal Law:
Whoever, in violation of State regulations, intrudes into a computer information system other than those specified in the preceding paragraph, or uses other technical means to obtain data stored, processed, or transmitted in that computer information system, or implements illegal control over that computer information system, if the circumstances are serious, shall be sentenced to fixed-term imprisonment of not more than three years or criminal detention, and shall also, or shall only, be fined; if the circumstances are especially serious, shall be sentenced to fixed-term imprisonment of not less than three years but not more than seven years, and shall also be fined.
In plain terms: without permission, using technical means to enter someone else's system and take data, or making someone else's system follow your commands, is a crime if the circumstances are serious. The conditions contain neither the word "automatic" nor "AI."
The Supreme People's Court's opinions on the trial of AI-related disputes issued on September 7 do specifically address AI:
(20) Punish criminal activities carried out using artificial intelligence in accordance with law. Where artificial intelligence is used to commit fraud, insult, defamation, damage to commercial reputation or product reputation, infringement of citizens' personal information, illegal acquisition of computer information system data, production, sale, or dissemination of obscene materials, and such acts constitute a crime, criminal liability shall be pursued in accordance with law. Where an actor, after activating an assisted-driving function, uses self-installed components to evade monitoring by the assisted-driving system, causing a road traffic accident, and such act constitutes a crime, criminal liability shall be pursued in accordance with law.
The key to this sentence is "constitute a crime." AI here is merely the instrument of the offense; whether or not it was used, one must return to Article 285 and match the conditions one by one. There are long-standing precedents of AI companies being convicted under this provision: a company in Changzhou operated an AI intelligent interaction platform, cracked the encryption algorithm of a certain community e-commerce App to forge requests, and also cracked a private-message interface to send advertisements directly to users on behalf of paying merchants, obtaining illegal gains of more than 6 million yuan; it was convicted of the crimes of illegally obtaining computer information system data and illegally controlling a computer information system and sentenced.
So what exactly does "without permission" mean? The clearest explanation comes from a museum ticket-grabbing case in Beijing. Liu and accomplices wrote ticket-grabbing software capable of automatically completing slider verification and grabbing tickets simultaneously through multiple threads; in one year they resold tickets and made more than 290,000 yuan, and at first instance Liu was sentenced to three years and six months. He fought from appeal all the way to a petition for retrial, never admitting "intrusion": on appeal, the defense said the reservation technology itself was lawful; in the petition, it was argued that slider verification merely distinguishes humans from machines and is human-machine recognition, not a security protection measure. The second-instance ruling of the Beijing No. 2 Intermediate People's Court has already explained this issue thoroughly:
Image slider verification and similar puzzle verification, clicking text in an image, CAPTCHAs, and the like are common system security protection measures, whose main purpose is to distinguish real human users from automated programs or bots, so as to prevent malicious automated attacks, including brute-force cracking, spam registration, crawler abuse, and scalper ticket-grabbing, thereby protecting system resources. When a user uses a reservation system platform, the scope of authorization is manual operation through the official Web end or App end; using ticket-grabbing software to avoid or break through security protection measures clearly exceeds the scope of authorization of the system platform and already constitutes "intrusion" in the sense of the Criminal Law.
The most important point in this passage is "manual operation." The license the platform grants each user is, by default, shaped as a person holding a phone, looking at it themselves and tapping it themselves. When a program taps on a person's behalf, as long as it still goes through the door the platform opened and passes the same verification, the nature does not change; once a program passes the verification code on a person's behalf, or simply bypasses the App and communicates directly with the server, it has stepped outside the scope of that license.
A hospital appointment registration case in Chongqing explains "illegal control" more plainly. A programmer, Liao Moumou, was commissioned to write appointment registration software, and the second-instance court found that he "without authorization bypassed the WeChat platform, spliced the relevant information into a URL, and directly sent data requests to the server of a certain hospital's appointment registration system to obtain responses from the server, which constitutes the act of 'illegal control' of a computer information system without authorization." So-called control does not require obtaining the backend password; making someone else's server act on instructions you have spliced together is enough.
By way of analogy. Having bought a movie ticket, you have the right to enter through the ticket gate, and if you ask a friend to queue and present the ticket for you, the cinema has no say in that; but climbing in through the fire exit, even with a genuine ticket in your pocket, is another matter. Of course, this analogy is not entirely accurate: climbing over the cinema wall will most likely get you escorted out by security, whereas the door bypassed on the computer system side is protected by criminal law, and once the amount crosses the threshold, it becomes criminal liability.
The user nodded, the platform did not, and the boundary is still crossed
Friends who build Agents, upon reading this, will most likely say: my product is authorized by the users themselves, the accounts belong to the users, and I am merely working on their behalf.
That argument has already been rejected more than once in the judgments in appointment-grabbing cases.
Yang Moumou of Longhua, Shenzhen, pre-filled the mobile phone numbers and passwords registered by the patients themselves into a program, bypassed the login window of the appointment registration website, and automatically logged in, automatically checked for available appointments, and automatically grabbed appointments, charging 50 to 250 yuan per appointment depending on the popularity of the doctor, and earning 24,570 yuan. The accounts were given by the patients, and the passwords were also given by the patients, yet the court still convicted him of the crime of illegally obtaining computer information system data and sentenced him to one year in prison, suspended for one year and six months.
In the HPV vaccine proxy-grabbing case in Ya'an, Sichuan, the authorization was even clearer. Chen Mouying sent a QR code to the client; the client scanned it, and the program obtained the client's login credentials; at the moment the vaccines were released, the script sent requests to the appointment platform at millisecond speed, continuously and in multiple threads. The client scanned the code themselves, and what they paid for was exactly this service. This case was sentenced to six years and six months in the first instance.
What a user can authorize you to do is only the permission he holds as an ordinary user: what he can see, you can see; what he can tap, you can tap; act in the way the platform designed for real people. He cannot give you a path that bypasses verification; that path never belonged to him in the first place. The Guangzhou Internet Court, in a prior conduct preservation ruling concerning an AI conversational robot, called this principle "dual authorization": for an intelligent agent to enter a third-party application and operate, both user authorization and platform authorization must be present. That was an unfair competition dispute, and the two judgments in Shenzhen and Ya'an show that in the criminal field, the conclusion is the same.
User authorization covers only the official entrance; bypassing verification and connecting directly to the server crosses the criminal red line
For the same appointment grabbing, why are there three different charges
If these ticket-grabbing and appointment-grabbing cases are examined together, it becomes apparent that the charges are not uniform. The Beijing museum case, the Shenzhen Longhua case, and a venue ticket-grabbing case in Jing'an, Shanghai, were all charged as the crime of illegally obtaining computer information system data; the Chongqing appointment-grabbing case was charged as the crime of illegally controlling a computer information system; and the Ya'an vaccine case was charged as the crime of destroying a computer information system.
The difference lies in how the courts characterize the same technical act. If it is said that you obtained data within the system, such as remaining tickets and inventory, that is "obtaining"; the Beijing second-instance court even held that successfully grabbing a ticket is itself obtaining the system's service response and inventory status data. If it is said that you caused the server to act on requests you assembled, that is "control." If it is said that you substituted your own program for the official front end, preventing the system from operating as originally designed, that is "destruction." The exact words of the Ya'an court were that the inability to operate normally "includes both a complete inability to operate and an inability to operate in the manner originally designed." The crime of destruction originates in Article 286, paragraph 1, of the Criminal Law:
Whoever, in violation of state regulations, deletes, modifies, adds to, or interferes with the functions of a computer information system, causing the computer information system to fail to operate normally, and the consequences are serious, shall be sentenced to fixed-term imprisonment of not more than five years or criminal detention; if the consequences are especially serious, shall be sentenced to fixed-term imprisonment of not less than five years.
Charges may also change during the course of proceedings. In the Chongqing case, the procuratorate prosecuted for destruction, while the court convicted for control. The Ya'an case was the exact reverse: the procuratorate initially prosecuted for illegal obtaining of data, and the defendant signed a plea of guilty and acceptance of punishment, with a sentencing recommendation of three to four years; later, the procuratorate changed the charge to destruction, the defendant did not plead guilty, the plea was withdrawn, and the final sentence was six years and six months. The sentencing ranges for the two crimes differ: under Article 285, especially serious circumstances carry three to seven years, while under Article 286, especially serious consequences start at five years; changing the charge can make a considerable difference in sentence.
Therefore, Lei's current "illegal control" is only the characterization at the investigation stage; at the prosecution and trial stages, it may be maintained or may change. The statement in the notice that the appointment system was "cracked" — whether this specifically involved bypassing verification, forging requests, or exploiting a system vulnerability — has not yet been disclosed. It is precisely these details that determine the charge.
Program-based appointment grabbing may fall under three charges: obtaining data, illegal control, and destroying a system
Illegal gains exceeding 5,000 yuan are sufficient to meet the criminal threshold
The "serious circumstances" in the provisions are defined by the 2011 judicial interpretation of the Supreme People's Court and the Supreme People's Procuratorate:
Article 1: Whoever illegally obtains computer information system data or illegally controls a computer information system and falls under any of the following circumstances shall be deemed to have "serious circumstances" as provided in Article 285, paragraph 2, of the Criminal Law: (1) obtaining identity authentication information for online financial services such as payment settlement, securities trading, or futures trading in ten or more sets; (2) obtaining identity authentication information other than that specified in item (1) in five hundred or more sets; (3) illegally controlling twenty or more computer information systems; (4) illegal gains of five thousand yuan or more, or causing economic losses of ten thousand yuan or more; (5) other circumstances of a serious nature.
Whoever commits the acts specified in the preceding paragraph and falls under any of the following circumstances shall be deemed to have "especially serious circumstances" as provided in Article 285, paragraph 2, of the Criminal Law: (1) the quantity or amount reaches five times or more the standards specified in items (1) to (4) of the preceding paragraph; (2) other circumstances of an especially serious nature.
The first three items concern stealing accounts and controlling botnet machines, which are generally not applicable to appointment-grabbing cases; what actually applies is item (4):Illegal gains of 5,000 yuan, or causing the other party losses of 10,000 yuanthat is enough. When the amount reaches five times that threshold—that is, illegal gains of RMB 25,000 or losses of RMB 50,000—the conduct falls within "especially serious circumstances," and the sentencing range jumps to three to seven years.
The case in Jing'an, Shanghai, can be compared. He worked as a "ticket grabber" at a ticket-scalping studio, using files provided by others to bypass the time restrictions of a venue's ticket-purchase mini-program and enter the order form page early to grab tickets. He earned RMB 14,733 over 10 months and was sentenced to seven months' imprisonment with a one-year suspension. The profit reported in Lei's case was more than RMB 10,000, roughly the same order of magnitude. Yang in Shenzhen earned RMB 24,570, only RMB 430 short of the RMB 25,000 especially-serious threshold. For per-order ticket-grabbing services charging a few dozen yuan per order, a few hundred orders cross the line.
How to calculate the restaurant's losses is a separate question. The judicial interpretation provides a specific definition of "economic loss":
"Economic loss" as used in this interpretation includes the direct economic loss caused to users by the criminal act of endangering a computer information system, as well as the necessary expenses incurred by users to restore data and functions.
How much business the store lost due to 50,000 invalid numbers may not be directly included; money actually spent on repairing the system and installing additional protections can be.
The police notice also contains half a sentence: where the circumstances are relatively minor, the person will be detained and fined. Falling short of the criminal threshold does not mean there is no consequence.
For automated products, write authorization boundaries into the code
First, teams building appointment-booking, ticket-grabbing, or Agent products. Working backward from the judgments above, there are several lines in the technical path that must not be crossed:
- Use only the platform's official interfaces, open platform, or channels for which written authorization has been obtained; do not use reverse-engineered interfaces.
- When encountering CAPTCHAs, slider verification, or time locks, stop and return the matter to the user to handle personally; do not perform automatic recognition.
- Do not decrypt or forge request signatures, and do not concatenate parameters into a URL to connect directly to the other party's server.
- Set a hard cap on request frequency, close to the pace of real human operation.
- User authorization should be made revocable, and the entire execution process should be logged.
One more point on the last item: logs can prove that the user consented, but they cannot prove that the platform consented. What actually matters is the first four items; logs are merely evidence that can clarify matters if something goes wrong.
Next, consider the developers and technical service providers who take orders to write scripts. Liao in Chongqing merely wrote code at another party's request and received a maintenance fee of RMB 40,000 per year; he did not himself grab queue numbers, yet he was still convicted of the crime of illegally controlling computer information systems and sentenced to three years' imprisonment with a three-year suspension. Article 285 of the Criminal Law also contains a paragraph specifically targeting tool providers:
Whoever provides programs or tools specially used for intruding into or illegally controlling computer information systems, or knowingly provides programs or tools to others who are carrying out illegal or criminal acts of intruding into or illegally controlling computer information systems, if the circumstances are serious, shall be punished in accordance with the provisions of the preceding paragraph.
Before accepting an order, it is the bare minimum to ask clearly what the other party intends to do with it.
Finally, there is the party whose numbers are being grabbed: restaurants, hospitals, ticketing platforms, and the service providers that build queue-number and appointment systems for them. The Beijing second-instance court recognized sliders and CAPTCHAs as security protection measures, which is good for you: once verification is in place, that gate exists in law. Keep access logs and records of abnormal requests on a routine basis, and keep evidence of the money spent on closing vulnerabilities and adding protections; these will be useful when reporting to the police, and whether the RMB 10,000 loss threshold is met also depends on these materials.
Automation itself is not a crime. The question is whether a program bypasses the gate the platform has set for real people, and several judgments have already made very clear where that gate lies.
If you are working on appointment-booking, automated-ordering, or Agent-type products and want to review your technical pathway against these judgments, you are welcome to talk with me.
Reference Sources
- The Beijing News Shell Finance, "Popular Sushi Restaurant Sees Over 50,000 Queue 'Empty Numbers' in Nearly a Month? Someone Is Actually Doing This Behind It," October 16, 2026
- Kankan News Knews, "Scalpers Target Popular Restaurants, Use AI-Made Software to Grab Over 50,000 Queue Numbers," October 16, 2026
- Criminal Law of the People's Republic of China (2023 Amendment), National People's Congress
- Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in the Handling of Criminal Cases Endangering the Security of Computer Information Systems (Fa Shi [2011] No. 19)
- Opinions of the Supreme People's Court on the Lawful Trial of Cases Involving Artificial Intelligence Disputes (Fa Fa [2026] No. 10), September 7, 2026
- Criminal Ruling of the Beijing No. 2 Intermediate People's Court (2025) Jing 02 Xing Zhong No. 260; Notice of Review of Petition (2026) Jing 02 Xing Shen No. 40
- Criminal Ruling of the Chongqing No. 5 Intermediate People's Court (2025) Yu 05 Xing Zhong No. 719
- Criminal Judgment of the People's Court of Longhua District, Shenzhen, Guangdong Province (2025) Yue 0309 Xing Chu No. 1121
- Criminal Judgment of the People's Court of Mingshan District, Ya'an, Sichuan Province (2023) Chuan 1803 Xing Chu No. 123
- Criminal Judgment of the People's Court of Jing'an District, Shanghai (2025) Hu 0106 Xing Chu No. 593
- Supreme People's Procuratorate and People's Procuratorate of Tianning District, Changzhou, "Severing the Profiteering Chain of Illegal Data Acquisition," June 3, 2025
- Guangzhou Internet Court Ruling on Conduct Preservation in a Network Unfair Competition Dispute Involving AI Agents (public report)
Authors of this article:Lü Yinghui, a lawyer at Mankun (Shenzhen) Law Firm. Graduated from China University of Political Science and Law, with nearly ten years of deep engagement in the legal industry, and previously worked at a court in Shenzhen. Focuses on legal services in the new-generation economy, with extensive practical experience and deep insights in fields such as Web3 and artificial intelligence. Account across all platforms: Lao Lü Talks New Money; you are welcome to follow.
