On August 4, the Supreme People's Procuratorate disclosed Beijing's first criminal case involving the sabotage of an artificial intelligence model.
Notice published on the WeChat official account of the Supreme People's Procuratorate on August 4, 2026
A post-1990s algorithm engineer logged into the company's cluster, opened a folder belonging to another department, entered a command to forcibly delete all files and subdirectories in the current directory with the highest administrator privileges and without confirmation, and then left work. That folder contained several of the company's self-developed text-to-3D and rendering models, together with their training data. By the time operations staff discovered the anomaly, located his computer and terminated the process, the command had been running for more than 17 hours, approximately 89TB of data had been affected, the model training system's functions were paralyzed, and all R&D projects of that department were brought to a standstill.
The court sentenced him to five years and ten months in prison for the crime of sabotaging a computer information system, and additionally ordered him to pay the company more than RMB 204,000 in compensation. The first-instance trial was held in March of this year, and the second-instance trial in June dismissed the appeal.
This news has flooded the tech community over the past two days, with headlines almost all featuring 89TB. But if you run an AI company, or are preparing to move model training into your own data center, the number is not what you should be watching most closely.
Your company very likely has such a person too: someone with a cluster account, who knows exactly where the data is stored, and who has recently gone through an organizational restructuring. In the Beijing case, more than a month before the incident, the company had issued three notices requiring all employees to migrate development data from the old cluster to the new cluster, and expressly stated that access to the old cluster would no longer be available after the migration. All personnel in the department, including the individual concerned, replied "received" in the group chat. More than a month later, he still logged in using that same old account and password.
What is truly worth reading is the line that emerges when this case is placed alongside two other database-deletion cases.
How many years are imposed depends not on how much was deleted, but on how much it cost to fix
Under Chinese law, conduct such as deleting a database has a stable legal basis: Article 286 of the Criminal Law.
Article 286: Whoever, in violation of state regulations, deletes, modifies, adds to or interferes with the functions of a computer information system, causing the computer information system to fail to operate normally, if the consequences are serious, shall be sentenced to fixed-term imprisonment of not more than five years or criminal detention; if the consequences are especially serious, shall be sentenced to fixed-term imprisonment of not less than five years.
Whoever, in violation of state regulations, performs operations such as deletion, modification or addition on the data and application programs stored, processed or transmitted in a computer information system, if the consequences are serious, shall be punished in accordance with the provisions of the preceding paragraph.
The article itself provides only two tiers: one of not more than five years, and one of not less than five years. Which tier applies depends on whether the consequences are deemed "serious" or "especially serious." How these two terms are specifically measured is set out in a 2011 judicial interpretation issued by the Supreme People's Court and the Supreme People's Procuratorate.
Article 4: Where the functions, data, or applications of a computer information system are disrupted and any of the following circumstances exists, it shall be determined to be "serious consequences" as provided in Paragraphs 1 and 2 of Article 286 of the Criminal Law: (1) causing the main software or hardware of ten or more computer information systems to fail to operate normally; (2) deleting, modifying, or adding data stored, processed, or transmitted in twenty or more computer information systems; (3) obtaining illegal gains of 5,000 yuan or more, or causing economic losses of 10,000 yuan or more; (4) causing computer information systems that provide basic services such as domain name resolution, identity authentication, and billing for one hundred or more computer information systems, or that provide services to 10,000 or more users, to fail to operate normally for a cumulative period of one hour or more; or (5) causing other serious consequences.
Where the acts specified in the preceding paragraph are committed and any of the following circumstances exists, it shall be determined to be "especially serious consequences" of disrupting a computer information system: (1) the quantity or amount reaches five times or more the standards specified in Items (1) through (3) of the preceding paragraph; (2) causing computer information systems that provide basic services such as domain name resolution, identity authentication, and billing for five hundred or more computer information systems, or that provide services to 50,000 or more users, to fail to operate normally for a cumulative period of one hour or more; (3) disrupting the functions, data, or applications of computer information systems that provide public services in fields such as state organs or finance, telecommunications, transportation, education, medical care, and energy, thereby seriously affecting production and daily life or causing egregious social impact; or (4) causing other especially serious consequences.
Setting aside the provisions and looking only at the conclusions, there are just two thresholds. The company actually spent, on this matter,10,000 yuan, which is sufficient to meet the case-filing threshold; if it spent50,000 yuan, it jumps directly to the five-years-or-more bracket. The second threshold is five times the first; that is how it is calculated.
None of these standards has anything to do with data volume. The unit TB does not enter the sentencing formula. The Beijing case resulted in a sentence of five years and ten months not because of 89TB, but because the audited204,000 yuan or morewas already four times 50,000 yuan.
I put the accounts of the three cases side by side. This AI case in Beijing: 204,000 yuan or more. In the 2022 case of a Baidu employee deleting and altering a database, the economic loss determined was16,300 yuanand sentenced to nine months' imprisonment, suspended for one year. In the Shenzhen Futian case involving a departed employee who deleted Alibaba Cloud data, the court ultimately foundRMB 30,000, and sentenced the defendant to one year and four months' imprisonment. The gap between a suspended sentence and five years and ten months' imprisonment comes down to which side of the two thresholds these three figures fall on.
The two monetary thresholds and where the three cases landed
For the same deletion, the loss amount was revised once, and the sentence dropped from five years to one year and four months
The Shenzhen case illustrates the issue best. It is now a case included in the People's Courts Case Database, No. 2024-04-1-254-001.
The defendant left the company in April 2019. Out of dissatisfaction with his departure benefits, he used the company's Alibaba Cloud account credentials obtained during his employment to delete 1,300 images, approximately 4.7 GB, stored on the company's server backend, causing the partner's contestant images to fail to display. The company subsequently paid the partner RMB 30,000 in compensation.
At the first hearing, the procuratorate alleged economic losses of approximately RMB 400,000. The first-instance court accepted a valuation of RMB 200,000 and sentenced the defendant tofive yearsWhether RMB 400,000 or RMB 200,000, both exceed RMB 50,000 and fall within the "especially serious consequences" bracket, and five years is precisely the statutory minimum penalty for that bracket.
The defendant appealed. In May 2020, the Shenzhen Intermediate People's Court ruled to remand the case for retrial, stating plainly that the RMB 200,000 valuation "in essence derives entirely from the victim's statement and lacks objectivity," and that it was a "breach penalty amount" unilaterally determined by the victim company, constituting indirect loss and lacking "directness."
On retrial, the court recalculated the accounts. Bank transfer records showed that the company had actually transferred RMB 30,000 to the partner, and the legal representative of the victim entity himself admitted that no actual expenditure had been incurred in restoring and re-collecting those images. Apart from this RMB 30,000, no other supporting evidence could be produced. Accordingly, of the alleged RMB 400,000, only RMB 30,000 was recognized; for the same person and the same act of deletion, the retrial sentencedone year and four months, and the judgment took effect.
On the same set of facts, the loss amount was revised once, and the prison term dropped by nearly four years. This is how this type of case actually operates.
Look at the Baidu case from the other side. The individual concerned was a campus recruit born after 1995. Because he was unhappy that someone else took over his project, he privately built a tunnel connecting the company's internal network to the external network, and successively emptied, locked and modified several tables in the visualization project database; each time the company repaired the data, he deleted it again. Baidu commissioned a forensic appraisal institution to restore the data and paid RMB 16,300, supported by a special VAT invoice and an itemized fee schedule. On appeal, he argued that this sum was "not a necessary expense," and the second-instance court rejected the argument; he later applied for retrial on the ground that "the appraisal was commissioned only three months after the incident, so the expense should not count as economic loss," which was likewise rejected. All three attempts failed to persuade the courts, and what carried the day was that invoice.
On one side, a valuation of RMB 400,000 was rejected; on the other, RMB 16,300 stood firm on the strength of a single invoice. The lesson these two cases offer enterprises is the same sentence: losses you estimate yourself will not be accepted by the court, while money you actually paid out and that can be verified against documentary evidence cannot be escaped by a single cent.
Does an AI model count as a "computer information system"?
Return to the Beijing case. Before calculating the money, the procuratorial authority first had to resolve a question for which there was no domestic precedent: the deleted items were an AI model in training and training data—are these protected by Article 286 of the Criminal Law?
The object protected by the statutory provision is called a "computer information system." The definition of these five characters appears in the final article of the same judicial interpretation.
Article 11: "Computer information system" and "computer system" as used in this interpretation refer to systems with the function of automatically processing data, including computers, network equipment, communications equipment, automated control equipment, and the like.
The Dongcheng District Procuratorate's reasoning was as follows: an AI model is a system integrating hardware, software and data; R&D personnel interact with it through development platforms and terminal instructions; it automatically performs cleaning, training, parameter storage and inference on input data according to machine-learning algorithms, and can also learn and evolve from data on its own and develop capabilities beyond the preset code, thus meeting the definition of "having the function of automatically processing data."
The most important sentence comes later. According to the expert opinion in the demonstration organized by specially invited experts in the field of cybercrime designated by the Beijing Municipal People's Procuratorate, the model involved in the casealthough it had not yet been put into market operationHowever, the model training system itself had already been fully built and possessed the capacity for sustained, long-term automated processing of information. Once the training data was deleted, the data structure for model training was directly destroyed, and the training function could not operate normally. In June 2025, the Dongcheng District Procuratorate specifically convened an interdisciplinary seminar, at which experts in the fields of criminal law, computer science, and artificial intelligence technology unanimously endorsed this conclusion.
For AI companies, the weight of this single sentence is far greater than 89TB. From this case onward, a model that is still in training, not yet launched, not yet commercially deployed, and unknown to the outside world receives the same treatment under criminal law as a production server in operation.
Counting idle computing power as a loss makes the RMB 50,000 threshold easier to reach
The second breakthrough lies in the approach to calculating money. The same judicial interpretation also specifies what "economic loss" includes.
The "economic loss" referred to in this interpretation includes the direct economic loss caused to users by the criminal act of endangering computer information systems, as well as the necessary expenses incurred by users to restore data and functions.
In the Beijing case, the victim company engaged an accounting firm to conduct an audit, which reached a conclusion on two items: wages paid for labor due to this mattermore than RMB 160,000, and computing power resources consumed in restoring datamore than RMB 40,000The procuratorial authority held that the deletion caused the utilization rate of the cluster GPUs, which had originally been operating at full capacity, to instantly drop to zero; training was interrupted and computing power sat idle, and during the restoration period the cluster completely lost its core functions. Computing power is a core factor of production in AI training, and the computing power costs invested by the company to restore data and restart training, like labor costs, are costs that must be borne and should properly be counted as economic loss. The two items together totaled more than RMB 204,000, and the court supported the full amount.
Counting computing power as a loss is the legal innovation of this case, and the media have all highlighted this point. But if the ledger is laid out and examined, the computing power of more than RMB 40,000 is actually the smaller part, while the wages of more than RMB 160,000 are the larger part. How did these wages arise? The entire AI game department suspended all development activities, and all staff were devoted to rescuing the data, working for nearly 20 days.
Composition of the RMB 204,000 in the Beijing case
This structure is more disadvantageous for AI companies. A single deletion targeting a research and development cluster can hardly affect only one person or one project; it will most likely bring an entire R&D line to a halt. If a dozen algorithm engineers stop work for three weeks, their wages alone would be enough to exceed RMB 50,000, and the computing-power bills have not even begun to be counted.
In other words, the same act of deleting a database, if it occurs at a company that builds business systems, may remain in the "serious consequences" bracket, with compensation, a guilty plea, obtaining forgiveness, and a suspended sentence; if it occurs at an AI company, it will most likely cross in one step into "especially serious consequences," with a starting point of five years.
Moreover, once that line is crossed, it is very difficult to step back. A guilty plea, compensation, and obtaining forgiveness are all discretionary mitigating circumstances; they can only lead the judge to lean toward the lower end within the bracket of five years or more. To reduce the sentence below five years, there must be statutory mitigating circumstances such as voluntary surrender, meritorious service, or being an accessory, or approval must be sought from the Supreme People's Court. The defendant in the Beijing case argued from beginning to end that the deletion was "accidental," and the defense counsel insisted on a not-guilty defense. The case held three hearings and ultimately resulted in a sentence of five years and ten months, only ten months above the lower limit of that bracket.
Permissions, ledgers, and timing: an action checklist for AI companies
The first item is to implement permission revocation at the system level. In the Beijing case, the company gave notice three times and all employees replied "received," but the account for the old cluster was never deactivated, and the individual concerned could still log in more than a month later. A "received" in a group chat may, in civil and labor disputes, prove that you gave notice, but in a criminal case it can only prove that the other party "knew he had no permission"; it cannot block a single instruction. For job transfers, departures, and cluster migrations, account deactivation and key rotation must have a checklist, designated executors, and an audit trail.
The second item is to establish defenses for high-risk instructions. A forced recursive deletion ran for a full 17 hours before anyone discovered it; during that time there was no secondary confirmation, no alert for abnormal operations, and no separation of permissions between the backup and production clusters. If any one of these three had been in place, the 89TB would not have been entirely lost.
The third item is to build a ledger first after an incident occurs. The company in the Shenzhen case could not produce vouchers for the cost of restoring data, and the alleged RMB 400,000 was reduced to only RMB 30,000; the Beijing company engaged an accounting firm to conduct an audit and clearly calculated the idle-time wages and computing-power consumption, and the more than RMB 204,000 not only became the basis for sentencing but also was fully recovered through a criminal incidental civil compensation award. Whether you can produce a third-party audit report, invoices from an appraisal institution, bank transfer records, and timesheets and payroll records for the idle period depends on how well you ordinarily maintain your financial and operations records.
A word on timing as well. The Beijing company terminated the employment relationship on the day after the incident and did not report the matter to the police until more than a month later. Dismissal and criminal reporting are two independent chains; once the person has left, whether the logs, devices, and operation records under his name are still in your hands is no longer entirely up to you. Evidence preservation should be completed before the act of terminating the employment relationship.
Finally, back to that 89TB. It is frightening enough, but it produces no legal effect in court; what actually established the sentence of five years and ten months was an audit report stating more than RMB 204,000. How much data was deleted is a technical fact; how much money was spent fixing it is the legal fact.
AI companies are accustomed to measuring their assets by parameter count, data volume, and computing-power scale, but criminal law recognizes only one thing: the money you actually paid out for it. Keeping this account clear in ordinary times is the only preparation that can still be made in time on the day an incident occurs.
Those with related legal needs, such as how to put permission revocation and high-risk operation policies into writing, or how to fix the loss calculation methodology after a company's database is deleted so that it holds up, are welcome to talk with the author.
Reference sources
- The WeChat official account of the Supreme People's Procuratorate disclosed on August 4, 2026 Beijing's first criminal case involving damage to an artificial intelligence model, as reported by Procuratorate Daily
- Jiemian News, "Programmer Sentenced to Five Years and Ten Months for Deleting Company AI Training Data to 'Do Private Work'", Beijing Dongcheng District People's Procuratorate, April 22, 2026, "Safeguarding New Quality Productive Forces" group interview event
- Criminal Judgment No. (2021) Jing 0108 Xing Chu 1653 of the Beijing Haidian District People's Court; Criminal Ruling No. (2022) Jing 01 Xing Zhong 140 and Criminal Notice No. (2022) Jing 01 Xing Shen 30 of the Beijing First Intermediate People's Court
- Case included in the People's Courts Case Database, "Luo XX Case of Damaging a Computer Information System", inclusion No. 2024-04-1-254-001; Criminal Judgment No. (2020) Yue 0304 Xing Chu 664 of the Futian District People's Court of Shenzhen, Guangdong Province; original first instance No. (2019) Yue 0304 Xing Chu 1908 and original second instance No. (2020) Yue 03 Xing Zhong 977
- Article 286 of the Criminal Law of the People's Republic of China
- Interpretation of the Supreme People's Court and the Supreme People's Procuratorate on Several Issues Concerning the Application of Law in Handling Criminal Cases Endangering the Security of Computer Information Systems (Fa Shi [2011] No. 19), full text on the official website of the Supreme People's Court
Author of this article:Lyu Yinghui, a lawyer at Mankun (Shenzhen) Law Firm. A graduate of China University of Political Science and Law, with nearly ten years of deep experience in the legal industry and prior work at a Shenzhen court. Focused on legal services in the new-generation economy, with extensive practical experience and deep insights in fields such as Web3 and artificial intelligence. Account across all platforms: Lao Lyu Talks New Money; you are welcome to follow.
