Regulations of the People's Republic of China on the Protection of Computer Information System Security

(1994年2月18日中华人民共和国国务院令第147号发布　根据2011年1月8日《国务院关于废止和修改部分行政法规的决定》修订)

(Issued by Decree No. 147 of the State Council of the People's Republic of China on February 18, 1994, and revised in accordance with the Decision of the State Council on Repealing and Amending Certain Administrative Regulations on January 8, 2011)

为了保护计算机信息系统的安全，促进计算机的应用和发展，保障社会主义现代化建设的顺利进行，制定本条例。

These Regulations are formulated to protect the security of computer information systems, promote the application and development of computers, and ensure the smooth progress of socialist modernization.

本条例所称的计算机信息系统，是指由计算机及其相关的和配套的设备、设施(含网络)构成的，按照一定的应用目标和规则对信息进行采集、加工、存储、传输、检索等处理的人机系统。

For the purposes of these Regulations, a computer information system refers to a human-machine system composed of computers and their related and supporting equipment and facilities (including networks), which processes information by collecting, processing, storing, transmitting, and retrieving data according to certain application objectives and rules.

计算机信息系统的安全保护，应当保障计算机及其相关的和配套的设备、设施(含网络)的安全，运行环境的安全，保障信息的安全，保障计算机功能的正常发挥，以维护计算机信息系统的安全运行。

The security protection of computer information systems shall ensure the security of computers and their related and supporting equipment and facilities (including networks), the security of the operating environment, the security of information, and the normal functioning of computer functions, so as to maintain the secure operation of computer information systems.

计算机信息系统的安全保护工作，重点维护国家事务、经济建设、国防建设、尖端科学技术等重要领域的计算机信息系统的安全。

The security protection of computer information systems shall focus on safeguarding the security of computer information systems in important areas such as state affairs, economic construction, national defense construction, and cutting-edge science and technology.

中华人民共和国境内的计算机信息系统的安全保护，适用本条例。

These Regulations apply to the security protection of computer information systems within the territory of the People's Republic of China.

未联网的微型计算机的安全保护办法，另行制定。

Measures for the security protection of microcomputers not connected to a network shall be formulated separately.

公安部主管全国计算机信息系统安全保护工作。

The Ministry of Public Security shall be in charge of the security protection of computer information systems nationwide.

国家安全部、国家保密局和国务院其他有关部门，在国务院规定的职责范围内做好计算机信息系统安全保护的有关工作。

The Ministry of State Security, the State Secrets Bureau, and other relevant departments of the State Council shall, within the scope of their duties as prescribed by the State Council, properly carry out the work related to the security protection of computer information systems.

任何组织或者个人，不得利用计算机信息系统从事危害国家利益、集体利益和公民合法利益的活动，不得危害计算机信息系统的安全。

No organization or individual may use a computer information system to engage in activities that harm the interests of the state, the collective, or the legitimate interests of citizens, nor may they endanger the security of computer information systems.

计算机信息系统的建设和应用，应当遵守法律、行政法规和国家其他有关规定。

The construction and application of computer information systems shall comply with laws, administrative regulations, and other relevant provisions of the state.

计算机信息系统实行安全等级保护。安全等级的划分标准和安全等级保护的具体办法，由公安部会同有关部门制定。

Computer information systems shall implement security classification protection. The standards for classification and specific measures for security classification protection shall be formulated by the Ministry of Public Security in conjunction with relevant departments.

计算机机房应当符合国家标准和国家有关规定。

Computer rooms shall comply with national standards and relevant state provisions.

在计算机机房附近施工，不得危害计算机信息系统的安全。

Construction near computer rooms shall not endanger the security of computer information systems.

进行国际联网的计算机信息系统，由计算机信息系统的使用单位报省级以上人民政府公安机关备案。

Computer information systems connected to international networks shall be reported by the user unit to the public security organ at or above the provincial level for registration.

运输、携带、邮寄计算机信息媒体进出境的，应当如实向海关申报。

The transportation, carrying, or mailing of computer information media into or out of the country shall be truthfully declared to the customs.

计算机信息系统的使用单位应当建立健全安全管理制度，负责本单位计算机信息系统的安全保护工作。

User units of computer information systems shall establish and improve security management systems and be responsible for the security protection of their own computer information systems.

对计算机信息系统中发生的案件，有关使用单位应当在24小时内向当地县级以上人民政府公安机关报告。

For incidents occurring in computer information systems, the relevant user unit shall report to the local public security organ at or above the county level within 24 hours.

对计算机病毒和危害社会公共安全的其他有害数据的防治研究工作，由公安部归口管理。

The prevention and research of computer viruses and other harmful data that endanger public social security shall be managed by the Ministry of Public Security.

国家对计算机信息系统安全专用产品的销售实行许可证制度。具体办法由公安部会同有关部门制定。

The state implements a licensing system for the sale of specialized products for computer information system security. Specific measures shall be formulated by the Ministry of Public Security in conjunction with relevant departments.

公安机关对计算机信息系统安全保护工作行使下列监督职权：

Public security organs shall exercise the following supervisory powers over the security protection of computer information systems:

(一)监督、检查、指导计算机信息系统安全保护工作；

(1) Supervise, inspect, and guide the security protection of computer information systems;

(二)查处危害计算机信息系统安全的违法犯罪案件；

(2) Investigate and handle illegal and criminal cases that endanger the security of computer information systems;

(三)履行计算机信息系统安全保护工作的其他监督职责。

(3) Perform other supervisory duties for the security protection of computer information systems.

公安机关发现影响计算机信息系统安全的隐患时，应当及时通知使用单位采取安全保护措施。

When public security organs discover hidden dangers affecting the security of computer information systems, they shall promptly notify the user unit to take security protection measures.

公安部在紧急情况下，可以就涉及计算机信息系统安全的特定事项发布专项通令。

The Ministry of Public Security may, in emergency situations, issue special orders on specific matters concerning the security of computer information systems.

违反本条例的规定，有下列行为之一的，由公安机关处以警告或者停机整顿：

Anyone who violates the provisions of these Regulations and commits any of the following acts shall be warned or ordered to suspend operations for rectification by the public security organ:

(一)违反计算机信息系统安全等级保护制度，危害计算机信息系统安全的；

(1) Violating the security classification protection system for computer information systems and endangering the security of computer information systems;

(二)违反计算机信息系统国际联网备案制度的；

(2) Violating the registration system for international networking of computer information systems;

(三)不按照规定时间报告计算机信息系统中发生的案件的；

(3) Failing to report incidents occurring in computer information systems within the prescribed time;

(四)接到公安机关要求改进安全状况的通知后，在限期内拒不改进的；

(4) After receiving a notice from the public security organ requiring improvement of security conditions, refusing to make improvements within the time limit;

(五)有危害计算机信息系统安全的其他行为的。

(5) Other acts that endanger the security of computer information systems.

计算机机房不符合国家标准和国家其他有关规定的，或者在计算机机房附近施工危害计算机信息系统安全的，由公安机关会同有关单位进行处理。

If a computer room does not comply with national standards and other relevant state provisions, or if construction near a computer room endangers the security of the computer information system, the public security organ shall handle the matter jointly with the relevant units.

运输、携带、邮寄计算机信息媒体进出境，不如实向海关申报的，由海关依照《中华人民共和国海关法》和本条例以及其他有关法律、法规的规定处理。

If the transportation, carrying, or mailing of computer information media into or out of the country is not truthfully declared to the customs, the customs shall handle the matter in accordance with the Customs Law of the People's Republic of China, these Regulations, and other relevant laws and regulations.

故意输入计算机病毒以及其他有害数据危害计算机信息系统安全的，或者未经许可出售计算机信息系统安全专用产品的，由公安机关处以警告或者对个人处以5000元以下的罚款、对单位处以1.5万元以下的罚款；有违法所得的，除予以没收外，可以处以违法所得1至3倍的罚款。

Anyone who intentionally inputs computer viruses or other harmful data to endanger the security of computer information systems, or sells specialized products for computer information system security without permission, shall be warned by the public security organ and fined not more than 5,000 yuan for an individual or not more than 15,000 yuan for a unit; if there is illegal income, in addition to confiscation, a fine of one to three times the illegal income may be imposed.

违反本条例的规定，构成违反治安管理行为的，依照《中华人民共和国治安管理处罚法》的有关规定处罚；构成犯罪的，依法追究刑事责任。

Anyone who violates the provisions of these Regulations and constitutes a violation of public security administration shall be punished in accordance with the relevant provisions of the Public Security Administration Punishments Law of the People's Republic of China; if a crime is constituted, criminal liability shall be investigated according to law.

任何组织或者个人违反本条例的规定，给国家、集体或者他人财产造成损失的，应当依法承担民事责任。

Any organization or individual that violates the provisions of these Regulations and causes damage to the property of the state, the collective, or others shall bear civil liability according to law.

当事人对公安机关依照本条例所作出的具体行政行为不服的，可以依法申请行政复议或者提起行政诉讼。

If a party is dissatisfied with a specific administrative act taken by a public security organ in accordance with these Regulations, it may apply for administrative reconsideration or initiate administrative litigation according to law.

执行本条例的国家公务员利用职权，索取、收受贿赂或者有其他违法、失职行为，构成犯罪的，依法追究刑事责任；尚不构成犯罪的，给予行政处分。

If a public servant executing these Regulations abuses his power, extorts or accepts bribes, or commits other illegal or dereliction of duty acts that constitute a crime, criminal liability shall be investigated according to law; if a crime is not constituted, administrative sanctions shall be imposed.

本条例下列用语的含义：

The meanings of the following terms in these Regulations are:

计算机病毒，是指编制或者在计算机程序中插入的破坏计算机功能或者毁坏数据，影响计算机使用，并能自我复制的一组计算机指令或者程序代码。

Computer virus refers to a set of computer instructions or program codes that are compiled or inserted into computer programs to destroy computer functions or damage data, affect computer use, and can self-replicate.

计算机信息系统安全专用产品，是指用于保护计算机信息系统安全的专用硬件和软件产品。

Specialized products for computer information system security refer to specialized hardware and software products used to protect the security of computer information systems.

军队的计算机信息系统安全保护工作，按照军队的有关法规执行。

The security protection of computer information systems of the military shall be implemented in accordance with the relevant military regulations.

公安部可以根据本条例制定实施办法。

The Ministry of Public Security may formulate implementing measures in accordance with these Regulations.

本条例自发布之日起施行。

These Regulations shall come into force as of the date of promulgation.