Major Crackdown Reveals Secrets of China’s Black Market in Stolen Personal Data

It’s no secret that the personal information of millions of Chinese citizens is stolen, shared, and sold online. But working in the stolen personal information business got a bit harder last week, when Chinese police launched a nearly-nationwide crackdown that resulted in the arrest of more than 1,700 suspects. The police also uncovered 38 “sources of information,” 161 stolen data platforms and organizations, and 611 illegal investigation companies.

Apparently, the market works something like this: “sources” acquire personal information through a variety of means which might include hacking and phishing. But actually, many “sources” are government workers who have access to citizens’ personal information because of their positions, and sell it to make some money on the side. These people rarely approach online information sales platforms directly, so the information is usually transferred via an intermediary, perhaps a friend of the source, who then sells it to an ‘information platform.’ Sources generally make relatively little, often just a few dollars per person, though it varies based on the person in question and the quality and type of information.

Once these online ‘information platforms’ have the info, it is generally sold to private investigation companies at a significant markup (around $80-$300). The investigation companies then sell this information to clients, sometimes as part of a larger information package and often at huge markups. In an interview with a reporter from the Beijing Morning Post, a representative from the Beijing police said that certain pieces of high-value information were sold for as much as 60,000 RMB (about $9,500), although most went for much less than that.

Of course, this crackdown hasn’t eliminated the dangers of having one’s personal information stolen, and the police say that reports of stolen information are rare and difficult to trace because generally the victims have no idea the theft has even occurred. Given that a good portion of the information is initially leaked by government sources, there’s also no way to really avoid the risk. Being careful to avoid phishing scams and viruses can certainly help, but if a local official with access to your data decides he’d like to line his pockets a little, there’s not much you can do about it.

So, uh, I guess we’d better hope the police do a good job of staying on top of this and cracking down on the trade in illegal personal information.

[Beijing Morning Post via Sina Tech]