February 12, 2010

Chinese Antivirus Giant "Rising" Bribe Officials to Eliminate Competition

Liu Xu (right) to pick Tian Yakui (left) up from prison. Picture from Ynet

Rising Antivirus, or Rui Xing (瑞星) as Chinese call it, is one of the largest anti-virus software companies in China, with over 500 employees and more than 50 million Chinese home users.

Eastern Micropoint (微点主动防御软件), on the other hand, is a still a start-up, unremarkable except for the 2005 allegations that it released several malware to the internet.

The connection between these two? Yu Bing, former director of Beijing Cyberpolice in charge of internet security (北京市公安局公共信息网络安全监察处). On February 4, 2010, Yu bing was tried by Beijing No. 1 Intermediate People's Court (北京市一中院) on charges of graft amounting to 14 million yuan as well as deliberate framing and persecution of Eastern Micropoint.

IT Companies Locked in Vicious Competition

If roots are traced far back enough, Eastern Micropoint is actually related to Rising Antivirus. Its owner Liu Xu (刘旭), known as "China's No. 1 expert in antivirus software" and a member of the 863 Program, was Rising's senior director and principal engineer before 2003. Its deputy director Tian Yakui (田亚葵) was formerly Rising's vice president and Director of Oversea Sales before March 2004.

Troubles for Liu Xu and Tian Yakui began after the two left Rising to found Eastern Micropoint in January 2005. Their research and development focused on novel technology that utilizes behavioral analysis to counter computer virus. Namely, it provides protection without having to examine real virus samples, and the product was set to launch in July 2005. If successful, Eastern Micropoint would be poised to gain significant market shares.

Beginning July 2005, Beijing police cyber security department subjected Eastern Micropoint to a series of "inspections." The reasons for these inspections varied from "evaluation of antivirus software companies" to "internet security routine check up." Eastern Micropoint employees, including top management and R&D division, were repeatedly summoned. July 21 of same year, inspectors confiscated company computers and sent them Rising Antivirus. The same computers hosted much of Eastern Micropoint's core technology.

In addition to frequent summons and inspections, Liu Xu received two "suggestions" from Yu Bing, who was director of Beijing Cyberpolice at the time: either sell his start-up to Rising or go back to his home province Fujian.

Liu Xu ignored Yu Bing. And luckily for Eastern Micropoint, all the important files were properly encrypted prior to the computer confiscation.

On August 30, police arrested Tian Yakui, accusing him of undermining computer information systems and stealing trade secrets. The Beijing cyberpolice released details of the arrest to the public, claiming they cracked the first case of "malicious and intentional spreading of computer virus." The announcement gained much attention at the time.

The Falsification of a Crime

Liu Xu frequently uses the word "persecution" to describe his experiences from four years ago.

An exact account of what had transacted was given by Zhang Pengyun (张鹏云) and Qi Kun (齐坤), both of whom are recently convicted and sentenced for their involvement in the wrongdoing.

In August 2005, Yu Bing ordered deputy directors Zhang Pengyun and Qi Kun to evaluate damages due to computer virus infections at two Beijing companies, Si Mai Management Consulting Firm (麦特管理顾问有限公司) and Jian Qiao Securities Company (健桥证券公司). Zhang Pengyun did not think there was enough evidence to make a case against Easten Micropoint, but Yu told him: "Do as I tell you, or you will be going down."

As a result, Zhang Pengyun and Qi Kun had to search for virus samples inside company computers. To prove that the virus originated from Eastern Micropoint, Yu Bing's department proclaimed that Tian Yakui's notebook sent 4 viral programs to the World Wide Web through a ADSL connection. Taking the case one step further, Yu Bing organized an "expert team" that purposefully excluded any employees from Rising. Yet the eventual arrest warrant for Tian Yakui was based on charges unconfirmed by experts.

An accounting firm, Zhong Run Hua (中润华), was hired to assign costs. It priced the Rising virus database at several thousands of millions RMB, a figure that Yu Bing lowered to a more plausible 60 million. Also, every infected computer was assessed for damage and reported as 100,000 yuan financial loss per equipment.

Yu Bing asked one of the companies Jiang Min (江民) for materials to build his criminal case. When the deputy director Yan Shaowen (严绍文) replied he did not know how to write the report, Yu Bing told Zhang Pengyun to write a template document that Yan Shaowen then copied and signed.

Once Yu had enough evidence, cyberpolice took the case to the media, accusing Eastern Micropoint of intentionally spreading virus on the internet. The cyberpolice claimed that Micropoint's unlawful conduct was brought to their attention by multiple antivirus Beijing companies, and after criminal investigation, it was determined that Micropoint seriously threatened online security and caused significant economic loss.

On September 6, 2005, cyberpolice requested National Antivirus Product Testing and Certification Center not to approve Eastern Micropoint's new product.

Fighting Back

To escape further persecution, Liu Xu decided to move the R&D team to Fuzhou. The team took the train to Xiamen but secretly got off before reaching the city. After two bus transfers, they arrived in Fuzhou at midnight undetected.

One of the employees in the team was Cui Suhui (崔素辉), a 23-year-old recent college graduate from Hebei province. Because he was also on the Wanted List, Cui had to live the next several years in hiding. During this time period, he was jobless and did not even dare to join his family for Chinese New Year celebrations.

Liu Xu and others never gave up. Using their real names, the team continuously reported Yu Bing's misconduct to the government. Finally in July 2008, Beijing Ministry of Supervision launched an official probe. Meanwhile Eastern Micropoint's name was cleared: the ADSL connection, one of the evidence used to implicate Tian Yakui, was never connected; in addition, Tian's notebook only contained 3 virus specimens, all of which unactivated.

On November 20, 2007, 11 months after his arrest, Tian Yakui was released from prison. Beijing Haidian Procuratorate decided not to press any charges. Eastern Micropoint received its product certification in February 2008.

Tian Yakui has aged years due to the imprisonment. "High tech products face intense time to market pressure. 3 months is enough to impact product success, let alone 3 years." Tian told a reporter on February 4. Because of unlawful tactics on Yubing and Rising's part, Eastern Micropoint directly suffered 30 million yuan loss. The company's indirect financial loss exceeds thousands of millions.

Rising Antivirus, with its now severely tainted image, will not comment on the case. It is keeping silence as the management wait for the verdict on Yu Bing. Rising's executive vice president Zhao Sizhuang (赵四章) has been arrested on charges of bribery.

Yu Bing had escaped to South Africa earlier but returned to China in September 2008 under advice from Supreme People's Procuratorate. He was arrested on September 18 on charges of corruption, bribery and abuse of power.

Yu Bing pleaded "Not Guilty" at the beginning. Two hours into the trial, however, he admitted to all corruption and bribery charges.

It was said that Yu Bing accepted bribes from four companies, all of them related to internet. Rising alone gave him 4.20 million yuan.

http://it.people.com.cn/GB/42891/42893/10965942.html (北京网监处数人落马 瑞星微点案两败俱伤)
http://it.people.com.cn/GB/42891/42893/10941551.html (中国杀毒业第一假案:瑞星420万行贿官员嫁祸对手)


  1. "Rising Antivirus, with its now severely tainted image, will not comment on the case. It is keeping silence as the management wait for the verdict on Yu Bing. Rising's executive vice president Zhao Sizhuang (赵四章) has been arrested on charges of bribery." I agree to this author regarding this matter.

    Arn ofAkron Tax Attorney Help

  2. The cyberpolice claimed that Micropoint's actionable conduct was brought to their absorption by assorted antivirus Beijing companies.

    Norton 360 for small business


Veggie Discourse - Blogged