While the old generation of traffickers were still queuing up in the morning to seize the source of the hospital’s expert accounts, the new generation of traffickers had already "planned thousands of miles away," using a computer and a mobile phone to achieve "three seconds and one" with the help of new computer technology. "Swipe" high-speed number grab.
This new type of cybercrime in the field of medical resources has attracted the attention of the public security organs.
In 2018, there were reports from the masses. On the "Jingyitong" registration platform, some well-known hospitals were "snatched" as soon as they were released. The number of back-end visits increased sharply, and patients could not register normally through this channel.
After investigation, a criminal gang that used malicious software to bypass the normal verification mechanism to illegally seize the source of the account gradually emerged.
Add 2000 yuan to the most difficult expert account
Mr. Huang, who lives in Chaoyang District, Beijing, knows how difficult it is to call the expert account of Beijing Tongren Hospital.
Because the eye disease has not been cured for many years, Mr. Huang wants to find an expert from Tongren Hospital to completely solve the eye problem.
However, whether it is to get up early to go to the hospital to line up or make an appointment on the "Jingyitong", whenever the source of the expert number is released, there will always be three characters "full appointment" waiting for him.
Until August 2018, Mr. Huang encountered a trafficker when he was registered on a regular account at Tongren Hospital. The other party said that he could register an expert account. Mr. Huang left his contact information in doubt.
A few days later, Mr. Huang contacted the other party to help register, and gave him the registration requirements, identity information and "Jingyitong" medical card number.
Unexpectedly, the other party quickly linked him to a well-known expert number in Tongren Hospital on August 18.
On the day after seeing the illness, Mr. Huang transferred 300 yuan to the other party's WeChat account as the cost of the "scalper".
Later, whenever he needed to go to an expert clinic, Mr. Huang would register through a number dealer and pay a certain fee.
Like Mr. Huang, many patients who need to register an expert number know that there is a dealer who can register an expert number in Beijing Hospital.
Although the patient had never seen the trafficker himself, he knew from the conversation that the other party was a middle-aged man with a foreign accent.
The man's name is Gao Mofei, from Henan, born in 1987.
Although he is not very old, he has been a trafficker who has been in major hospitals in Beijing for many years.
In recent years, with the severe crackdowns by the public security, health and other related departments and the transformation of registration methods, the "business" of traffickers has gone from bad to worse.
In order to escape the police attack, many offline traffickers can only leave the city and return to their hometowns, but some are not reconciled and continue to engage in illegal operations.
"I heard that you can spend money to customize the number-grabbing software for'Jingyitong'. At that time, I was moved." Gao Mofei, who returned to his hometown in Zhoukou, Henan, felt that he could rely on this "new business opportunity". This software has revived the number trafficker business.
On the Internet, Gao found a software studio in Guangdong and ordered the number-grabbing software for "Beijing Medical Communication" from Li Moushan, the head of the studio, at a price of 6,000 yuan.
"The function of the software is to input the patient information that needs to be registered into the software in advance. The software can automatically refresh every three seconds. If the number is scheduled, it will display'appointment successful', if not, it will keep the number appointment." Gao said.
Once the software is installed, where do the "customers" come from?
"The main source of contacting me for registration is my former customers and others introduced them." Gao said.
In addition to old customers, old customers and new customers, plus other customers of the number of vendors, various sources have brought infinite business opportunities to Gao, and the number of vendors' business has grown.
During this period, Gao Moufei also partnered with the "offline" Zang Mouda and Ji Moushan who had been acquainted for many years, and the shares were divided after the transaction was completed.
According to Ji Moushan, in the past, there were only two hanging in a day in the queue, but now you can grab four in a day with the software. The most difficult expert number can be increased by 2,000 yuan, and the general number can be increased by about 200 yuan.
From Beijing Tongren Hospital, Beijing Cancer Hospital to Beijing Xuanwu Hospital, etc., the registered "footprints" of Gao Mofei, Zang Mouda and Ji Moshan line far away from their hometowns have spread all over Beijing's major hospitals.
In just half a year, Gao Mofei used illegal number-grabbing software to grab more than 590 experts and ordinary number sources from the “Beijing Yitong” hospitals, with an average monthly profit of about 10,000 yuan, and a total profit of about 50,000 yuan. .
The chain of illegal number grabbing was cut off
On August 7, 2018, the police from the police station of the Dongcheng Branch of the Beijing Municipal Public Security Bureau arrested a man who reselled the source of phone numbers during an operation against traffickers around Tongren Hospital. He admitted on the spot the illegal act of reselling the source of doctors’ medical records.
According to this person, several personnel used computer software to seize the registration resources of Tongren Hospital for a long time, and then resell the seized account source to the traffickers, and then the traffickers increased the price and reselled them to the patients.
This behavior seriously disrupted the normal order of treatment in the hospital.
According to this, the Criminal Investigation Detachment of Dongcheng Sub-bureau started its investigation.
At the same time, the network security department of the Beijing public security organ immediately launched an investigation into the situation and discovered a criminal group that used malicious software to bypass the normal verification mechanism to illegally seize the source of the account.
After careful investigation, on January 10, 2019, the police arrested Gao Mofei and other major criminal suspects in Henan, Shanxi, Yunnan and other places.
On April 15, in Jieyang, Guangdong, the police arrested four suspects including Li Moushan, the person in charge of a software company that illegally produced and spread the malware, and detained them for the crime of damaging computer information systems.
According to Zhang Hongming, the undertaker of the case and the prosecutor of the Dongcheng District Procuratorate in Beijing, the defendant Li Moushan and other four people produced a number-grabbing software for the "Jingyitong" registration platform in a company in Jieyang City, Guangdong Province in 2018. The software was sold to the defendant Gao Mofei at a price of 6000 yuan.
Subsequently, the defendant Gao Moufei illegally used the number-grabbing software to seize a large number of the registration resources of Tongren Hospital and other hospitals for profit. The defendants Ji Moushan and Zang Mouda provided Gao Moufei with registration requirements and shared the illegal income.
From July 2018 to January 2019, Gao Moufei used the software to grab more than 590 numbers from Tongren Hospital and other hospitals, which seriously disrupted the normal order of medical treatment in the hospital.
After identification, the number-grabbing software has the function of adding data to the computer information system.
In addition, the number trafficker Guo Mouhua customized the "Jingyitong" number grabbing software to the defendant Weng Moufeng in April 2019 to seize the number source of the top three hospitals such as Tongren Hospital, and the software was sold at a price of 12,000 yuan. Sold to the defendant Zhao Moulong.
Later, Zhao Moulong used the number-grabbing software to illegally seize the number source of Tongren Hospital and other Class-A hospitals from April to May 2019, and illegally earned more than 5,000 yuan.
On July 11, 2019, the Dongcheng District Procuratorate filed a public prosecution with Gao Mofei, Ji Moshan, Zang Moda and others for the crime of damaging computer information systems.
On August 19, 2019, the Dongcheng District Court sentenced three defendants to the crime of damaging computer information systems, and sentenced defendant Gao Moufei to one year and six months in prison; sentenced defendant Zang Mouda to ten months in prison; sentenced The defendant Ji Moushan was in prison for nine months.
Afterwards, five number-grabbing software producers and number traffickers Zhao Moulong and Guo Mouhua were convicted and punished by the Dongcheng District Court for the crime of damaging computer information systems.
Break through the identification of new types of cybercrime
Zhang Hongming introduced that the trafficker is a piece of "psoriasis" that has long plagued the order of diagnosis and treatment in hospitals, and has seriously violated the rights of the majority of patients to receive fair registration and equal treatment in high-quality hospitals.
Since the criminal law does not clearly stipulate such behavior as a crime, it is difficult to use criminal means to severely crack down. Traffickers often return to their old professions soon after being administratively punished and continue to suffer.
"In the investigation stage, the public security organs put forward preliminary opinions on the crimes of gathering crowds to disturb public order, and the crime of creating disturbances. After discussion and research, based on the evidence clues that have been obtained, they believe that the case does not conform to the crimes of gathering crowds to disturb public order and provoking disturbances. The criminal constitution of the crime should consider the application of Article 285 of the Criminal Law to illegally obtain computer information system data or Article 286 of the crime of destroying computer information systems, and accordingly point out the direction for subsequent investigations." Zhang Hongming further explained.
In the review stage of the case, through the professional appraisal of the number-grabbing software and the precise capture and comparison of the access data of the "Jingyitong" system, the undertaker finally determined that this type of behavior is essentially illegal use of malware, bypassing the " The normal access process of the "Jingyitong" program uses frequent refresh access to seize the number source. In essence, it uses illegal methods to illegally add relevant patient data in the "Jingyitong" database in order to seek the result of successful registration. Profit from this.
Therefore, his behavior violates relevant national laws and regulations, and adding operations to data and application programs stored, processed, or transmitted in the computer information system should be determined as a crime of damaging the computer information system.
"As a case of using brushing software to seize expert accounts for profit, this case has the characteristics of a series of new cyber crimes." According to Zhang Hongming, unlike traditional phone traffickers, the criminal perpetrators in this case used a computer and mobile phone. It can be remotely controlled, online transactions, and established WeChat groups and other criminal information sharing channels, making this type of crime more harmful and difficult to detect than traditional snatching behavior.
"In the process of handling the case, we discovered that traffickers have the characteristics of gangs, close connections between upstream and downstream crimes, and huge illegal interests." Zhang Hongming said, therefore, it is necessary to expand the results of the battle based on the existing evidence, severely punish upstream and downstream crimes, and achieve "elimination of evil" Effect.
After Gao Mofei and others were suspected of sabotaging the computer information system and entered the review and prosecution process, the Dongcheng District Procuratorate continued to guide the public security organs to supplement evidence, and at the same time track down the upstream crimes-criminal suspects who made number-grabbing software for traffickers and continued to dig for criminal clues , To find out if other dealers use similar software to grab the number.
Based on this, the task force strictly investigated the facts in the process of handling the case and expanded the results. By requesting the public security organs to supplement investigations and supplementing investigations by themselves, the starting point was a three-person number trafficker looting case, and subsequent pursuit and prosecution software production A number of merchants and other number dealers have cut off an industrial chain of "customized software-sales software-number grabbing-dissemination software-number grabbing".
"In recent years, the upward trend of cybercrime cases has become increasingly significant, and new types of cases have emerged one after another." Zhang Hongming said that cybercrime cases involve many technical issues, such as difficulty in obtaining evidence and complex charges.
Therefore, on the one hand, for major, difficult, and complex cyber-attack criminal cases, the procuratorial agency can timely intervene in the investigation to guide the collection of evidence, work with the public security agency to study the direction of the investigation, and provide legal opinions on collecting and fixing evidence; on the other hand, handle the case Prosecutors also need to further improve their own standards and enrich relevant knowledge.
"Fangyuan" reporter Liu Ya, correspondent Mao Shoujia
(Title design: Zhao Lirong)