The race to apprehend online criminals never ends

As a powerful typhoon swept toward Manila and dengue fever spread through the Philippine capital, Chinese police officer Jia Xiaoliang knew his team had little time.

Their authorization lasted only 10 days. They had no law enforcement powers in the country and had to work through diplomatic channels, Interpol and local police. Somewhere in the city were two suspects accused of directing a malware operation targeting online merchants in China.

After several days of surveillance and coordination, the two men were captured in September 2024 and returned to China. The operation marked the first overseas repatriation of Interpol Red Notice fugitives conducted by cyber police from Heilongjiang province.

"We wanted people to know that hiding abroad does not put anyone beyond the reach of the law," said Jia, deputy director of the cybersecurity police sub-bureau of the Daqing Public Security Bureau.

The case began in 2023, when malware disguised as order documents spread among e-commerce businesses. Once an infected file was opened, criminals could remotely control a victim's computer and use it to conduct fraudulent transactions.

Police arrested 14 suspects in China and seized more than 70 malware samples. Some of the people recruited to distribute the files were unemployed women who were paid each time a recipient clicked on a file. Jia said while they had broken the law, some had also been manipulated and arresting them would not eliminate the source of the crime. His team spent more than a year gathering evidence against the two alleged ringleaders before requesting Interpol Red Notices.

The case was later named one of China's eight major cases involving the fight against hacker crimes in 2024.

Strong governance

For Jia, it reinforced a lesson learned over two decades in policing — solving cases is essential, but preventing the next one requires stronger governance. On Wednesday, he was named a national outstanding member of the Communist Party of China.

Jia, 44, joined the police force in 2005, when smartphones and WeChat did not exist and cybercrime was far less sophisticated. He initially maintained equipment on the police intranet before joining preparations for Daqing's cyber police unit in 2006.

The small team handled everything from inspecting internet cafes and extracting electronic evidence to investigating criminal cases.

With little experience to draw on, Jia studied cases from across the country, researched judicial decisions and consulted other government departments.

"Once one loophole is closed, another method appears," he said.

That habit of identifying emerging risks helped him uncover the criminal use of SIM box equipment, known in China as "cat pools", in 2018. The devices can control large numbers of mobile phone cards and were widely used in telecom fraud, online gambling and paid online manipulation.

Jia organized a team to study the equipment and the criminal network behind it. Their work led to China's first case targeting software used to control such devices in 2019.

In another landmark investigation in 2020, Jia suspected criminals were hijacking domain name system — or DNS — traffic after discovering that the same internet link redirected users to different overseas gambling websites depending on the network they used. Investigators later found that routers in the core equipment rooms of a telecommunications operator had been compromised.

After more than three months of investigation, police arrested 21 suspects, including 17 employees of the operator, and seized more than 52 million yuan ($7.6M).

It became China's first case involving DNS traffic hijacking through the core equipment room of a city-level telecommunications operator.

Knowledge of law

Jia said technical expertise alone is not enough for cyber police officers. They must also understand the laws governing the crimes they investigate.

"Without understanding the law, an officer may notice suspicious activity but fail to recognize it as criminal," he said.

That approach proved critical in another major investigation in 2020, when job seekers across China began receiving fraudulent phone calls shortly after submitting resumes online. Jia led an investigation spanning 29 provincial-level regions and 237 cities. His team spent three months examining 1,691 leads before uncovering a criminal chain involving resume theft, personal information trafficking, online traffic manipulation and fraud.

A coordinated operation led to the arrest of 181 suspects, the closure of 17 websites and the recovery of more than 15 million pieces of personal information.

The case was featured on China Central Television's annual March 15 consumer rights program and prompted recruitment platforms and regulators to strengthen risk controls and data protection.

For Jia, that broader response mattered as much as the arrests.

"At first, I thought that once I solved a case, arrested the suspects and saw them sentenced, the job was done," he said. "Later, I realized we could never arrest everyone."

The cost of investigating cybercrime is high, while new offenders can quickly replace those who are detained. Prevention and governance must therefore go hand in hand with law enforcement, he said.

That philosophy has also shaped Jia's work as a deputy to the 14th National People's Congress, to which he was elected in 2023.

Drawing on frontline experience, he submitted a proposal in 2024 calling for a unified national online identity authentication platform, arguing that weaknesses in online identity systems were facilitating account trading, fraud and personal information leaks.

Jia later participated in system testing, and an appointment application used by the Daqing Science and Technology Museum became the first pilot connected to the platform. In July 2025, six central authorities implemented national rules governing the public online identity authentication service.

As an NPC deputy, Jia has submitted more than 20 motions and suggestions on issues including online violence, the protection of minors, cybersecurity legislation and the regulation of unmanned aircraft. Several have been reflected in legislation, policy documents or government research.

He now encourages younger officers to study artificial intelligence before criminals exploit it on a larger scale. Technical expertise, he said, must be matched by a strong sense of mission.

"Do not wait until retirement and look back thinking a case could have been taken one step further," he said. "Do not leave regrets in your career."

For Jia, that extra step increasingly means looking beyond the suspect on a screen to the system that allowed the crime to occur. The goal is not only to solve more cases, but also to prevent more people from becoming victims.

yangzekun@chinadaily.com.cn