Li Yuchen | Inner Mongolia’s deep-sea fishing has learned hacking

img

夜幕下的阿尔善,或许鲜有人知其名。但在数字世界的另一端,一些代码和数据,正悄然改变着这个边陲小城的业绩。

故事要从遥远的北京说起,但核心的技术活,却烙印着浓厚的内蒙特色。

2022年11月27日,阿尔善分局的电脑里,已经静静躺着学力星球App的电子数据,用户信息、订单信息、分销奖励的检查结果:

一应俱全。

2022年12月19日,一份针对学力星球电子数据的分析报告,也已制作完成。

这一切,都发生在正式的跨省抓捕行动之前:

早了将近两个月。

同步录屏的视频,像一部粗剪的纪录片,不经意间记录下了某些:

先见之明。

在警方取证的电脑文件夹里,一系列文件的修改日期,清晰得令人不安。

从2022年6月,第一份沉甸甸的会员信息悄然落入阿尔善分局的电脑文件夹开始,到同年8月,那份记载着与福建美亚柏科合作细节的PPT也已各就各位。再到11月:

连学力星球App的核心代码都被一览无余。

直至12月,那些关于订单、分销奖励、用户数据处理的精细文档,连同那份洋洋洒洒、结论鲜明的电子数据分析报告,也已全部准备就绪。

这横跨半年的辛勤耕耘,确保了在正式收网之前,学力星球的几乎全部家底:

从用户到代码,从合作到账目都已被阿尔善分局提前尽收囊中。

这些时间节点,如同散落的珍珠,串联起一条隐秘的线。

学力星球的后台,在2022年8月、11月:

频遭黑客攻击,电子数据失窃,木马横行。

而几乎同期,警方的电脑中,针对用户订单、分销奖励的检查结果,已然生成。

如果数据来源合法,那么相应的《提取笔录》和《检查笔录》在哪里:

它们消失了。

《公安机关办理刑事案件电子数据取证规则》第三十三条规定得明明白白,网络在线提取或者网络远程勘验时,应当使用电子数据持有人、网络服务提供者提供的用户名、密码等远程计算机信息系统访问权限:

法律从未授权公安机关可以擅自侵入公司后台,窃取公司运营数据。

阿尔善分局首次合法提取学力星球电子数据的时间:

本应是2023年2月5日,抓捕任博等人之后。

控方也确实这么说了,他们在2023年2月4日抓捕任博等人次日,开始提取数据,制作《网络在线提取工作记录》。

但同步录屏视频,无情地否认了这个说法。

那么,这些先于抓捕就已存在的成果,究竟从何而来?逻辑的链条,似乎只指向两种可能。

一种,是阿尔善的办案人员自己撸起袖子:

绕过了所有该有的程序,直接获取并分析了那些躺在服务器里的数字。

另一种,则是远在福建的合作伙伴:

那家本该中立的司法鉴定中心,提前扮演了数据搬运工的角色,完成了数据的窃取与初步加工,再将这份厚礼呈送至阿尔善方面。

无论哪条路径,最终抵达的那个真相,都足够让人哑口无言。

侦查人员在法庭上坦承,对于电子数据提取,他们:

也不是都会,一边百度学习一边做。

这句话,轻描淡写,却分量千钧。

SQL查询语句,可不是百度一下就能精通的葵花宝典。它需要精准调用特定字段,而这背后是对企业数据库结构和业务逻辑的深度理解:

临时抱佛脚,怕是抱不住的。

那么,这些复杂的提取与分析,究竟是如何完成的?

同步录屏视频揭秘,实际操作者是福建美亚柏科司法鉴定中心的:

技术人员谢某敏。

视频中,谢某敏熟练地操作着,登录迅雷账号时使用的个人手机号,与支付宝验证时指向“谢*敏”的身份信息:

完全吻合。

更具戏剧性的是,这位谢某敏,正是那份《网络在线提取工作记录》上签字的:

见证人。

侦查人员王楠、李志刚当庭陈述:

谢某敏全程见证。

这见证二字,此刻显得意味深长。它实际上意味着,谢某敏在阿尔善分局现场:

全程参与了电子数据取证工作。

而通过学力星球后台查询,谢某敏的手机号,早在2022年6月24日,就已注册为:

学力星球会员。

这不仅与案件存在直接利益关联,也从侧面印证了,阿尔善分局与美亚柏科,在2022年8月4日前,确已接洽,并在此后完成了对学力星球的数据分析。

福建的那家美亚柏科,挂着司法鉴定中心的牌子。按照规矩,他们本该是:

案子立了之后,才出来敲敲边鼓,给点独立、客观的专业意见。

但规矩,似乎总有例外。

早在2022年的8月,当一切还未正式拉开序幕之时,这家本应是裁判员的机构,就已经悄悄地换上了运动员的行头,深度参与到:

犯罪线索的预制环节。

这已经不是简单的程序瑕疵了。

1

2023年2月4日,北京。

空气中还残留着春节的余味,来自内蒙古锡林浩特的警察,敲响了任博家的门。

学力星球App的创始人任博,被告知涉嫌组织、领导传销活动:

配合走一趟。

次日,学力星球的账户被冻结,公司停摆。内蒙古当地媒体上,案件性质已然定调:

特大网络传销案。

讽刺的是,就在几个月前,2022年10月,北京市朝阳区市场监督管理局对学力星球的类似举报:

给出了明确的处理结果。

经查,北京学力星球科技有限责任公司资质齐全,未发现公司存在拉人头分红、网络恶意传销违法行为,市民反映与实际不符……于是决定:

不予立案。

同样的商业模式:

换了个地方,就换了个定性。

庭审时,任博回忆起被带到北京高碑店派出所的情景,一位北京民警私下说:

你们这个构不成传销呀。

任博问,那怎么办。

北京民警答:

听安排。

结果,这一安排,任博就坐上了前往内蒙古锡林浩特的警车。

2

2024年6月14日,锡林浩特法院。

两位特殊的证人,出现在任博案的庭审现场。他们是某税务局的公务员,其中一位还是副局长、机关党支部书记。

那位副局长说,自从购买了学力星球会员,他几乎每天都点开视频看书学习,半年多,看了不少于120本书的视频课件。

另一位税务局职工则分享了一个故事。他有位同事,多年烟瘾难戒,自从在学力星球上看了些课件后,某天,把家里的一条软中华和零散香烟都销毁了,说:

要戒烟,听了学力星球的课后,感觉吸烟太不是个样。

学力星球被关停后,这位副局长甚至投诉举报了办案的锡林郭勒公安和检察院。他认为,对这样的平台进行打击是错误的。

庭审最后,他再次申请发言,情绪有些激动:

内蒙这地方,让人真的不敢有什么好的评价。

他指着办案的公安检察院,质问道:

学习有罪,大家怎么想?

学力星球,这款2022年快速扩张的应用,究竟做了什么?

会员费198元。任博和团队承诺,将平台利润的70%返还给用户,名曰奖学金。

一年时间,用户突破百万。

但在阿尔善分局眼中,这一切都是精心设计的骗局:

198元是门槛费,视频观看是拉人头,奖金分配是返利。

办案人员声称,学力星球有30多层层级。任博反驳,198元,即便全部拿出来奖励,也凑不够30级。

提审室里的对话,更令人不寒而栗。

你最好老实配合把钱交出来,不签认罪认罚,我们就让检察院给你判10年。

辱骂、威胁株连家属,成了家常便饭。

任博被关押的第一天,警察的开场白,简单粗暴:

你妈X的,不配合认罪认罚,我就刨你家祖坟,把你老婆和岳母全抓进来。

家人成了整个案件中反复出现的关键词,也是最锋利的威胁。

至于管辖权,解释同样巧妙:

因某用户的户籍在锡盟地区,他们便获得了管辖权。

It’s like an invisible net, cast precisely from the Inner Mongolian grasslands to Beijing, thousands of miles away.

When collecting evidence, the police seemed to focus not on the pyramid scheme itself, but on the advertising revenue in the company’s accounts.

A leaked conversation can well illustrate the problem:

Brothers, we’ve been working for half a year, and we only have three or four hundred thousand yuan in the account.

How much advertising revenue does your platform have? If you plead guilty and cooperate, we can help you withdraw the money.

Freezing accounts, privately transferring funds, even the money from e-commerce to help agriculture was transferred to the account of the Inner Mongolia case-handling unit.

3

To solidify the charges, the Xilinmeng Public Security Bureau and Procuratorate presented several pieces of evidence, user complaints.

But the identity of the complainants is intriguing. They are not real members, but relatives of the members.

An old lady, who reads for five hours a day and earns five hundred yuan from advertising revenue, is happy. As a result, she was reported for being involved in a pyramid scheme by her family.

The Chaoyang Branch of Beijing’s decision not to file a case was based on complete information such as business licenses and user agreements.

The rebuttal from the Inner Mongolia case-handling unit seemed somewhat thin. They found a Wang, a staff member from a grassroots industrial and commercial office, who vaguely stated:

There was not enough evidence at the time.

The strange thing is that this Wang staff member was the one who caused the Xue Li Xingqiu to be repeatedly registered as an abnormal business status due to work errors.

A vague memory of a grassroots staff member thus overturned the official conclusion of the capital’s regulatory authorities.

The trial scene of the Xilinhot Court further staged the spectacle of the art of duplication.

Ren Bo’s defense lawyer pointed out that the investigators Li and Mao:

Appeared in two different provinces at the same time on two occasions, completing multiple evidence collection tasks.

From 16:38 on February 5, 2023, to 20:49 on the same day, Li and Mao appeared together in Langfang, Hebei Province.

From 18:12 on February 5, 2023, to 0:54 on February 11, the investigators Li and Mao carried out online electronic data extraction in the Criminal Police Brigade Office of the Arshan Branch of the Xilin Gol League Public Security Bureau.

In other words, on the evening of February 5, 2023, these two police officers:

Were in Langfang, Hebei Province at 16:38, and at 18:12, they instantly moved back to Xilin Gol League, Inner Mongolia.

Not only that, at 1:20 a.m. on February 10, 2023, they appeared in Chaoyang District, Beijing, for an out-of-town investigation.

The defense attorney lamented:

Unless they have the ability to teleport.

The presiding judge signaled the lawyer to continue. The lawyer’s request for the investigators to appear in court to explain was rejected.

When investigator Li finally appeared in court, in response to the defense lawyer’s question about whether the actual usage of the Xue Li Xingqiu APP by users had been verified, Li replied:

I have never opened the APP.

When asked about the existence of the payment vouchers provided by the witnesses, he replied:

See the record.

When asked why they appeared in different provinces at the same time, he still said:

It’s in the case file, I don’t know.

The defense lawyer pressed, since you don’t know, why do you know it’s in the record?

The answer was still those fixed phrases.

The defense lawyer requested the court to retrieve the content of the books to prove their public welfare and cultural value, but was rejected.

The lawyer was puzzled:

You haven’t even read the name of the book, and you can determine that it is a pyramid scheme?

4

On the court screen, the core interface of Xue Li Xingqiu was displayed. The advertising module design is eye-catching, and clicking on it can earn points, which can be exchanged for cash or to purchase membership cards.

The defense pointed out that the platform operates through advertising revenue and membership fees, and the core is not to recruit people, but is based on advertising revenue sharing:

Reading incentives.

A defendant said in the interrogation:

Encouraging users to read and consume advertisements is our core value.

This sentence was excerpted by the prosecutor and became the key basis for arguing its “strong inducement” in the indictment.

Encouraging users to read also became a crime.

Data shows that in 2022, Xue Li Xingqiu distributed more than 7 million yuan in revenue to users, and the total video and book playback time exceeded 1 million hours. Membership fee revenue accounted for less than 20% of the company’s total revenue.

The prosecution emphasized: a 38-tier membership structure, 1.7 million registered users, and 180,000 paying members. Each new member becomes a Xue Li expert through a 198 yuan annual card, and the referrer receives a 20% commission, and the commission ratio can be increased upon upgrading.

A publicly displayed membership recommendation description was described as a scam by the prosecution, while the defense called it an honest business agreement.

Ren Bo calmly stated in court:

We encourage users to read and have never promised a fixed income.

All of this is evidenced by code. Technical verification can clarify it.

But the Inner Mongolia Public Security Bureau seems to prefer to use testimonies to pile up ironclad evidence.

On the seventh day of the trial, the court played a pre-recorded video of the prosecution’s witness testimony.

The witness first stated that he benefited from recruiting people, but then said, “The Xue Li Xingqiu App did not force anyone to recommend members.”

The logical contradiction triggered the defense lawyer’s on-the-spot questioning.

The collegiate bench allowed the prosecution witnesses to appear in court before the trial. But in the following days, these witnesses:

Lost contact collectively.

Some refused to answer the court’s phone calls, some refused to receive the court’s notices, and some directly played hide-and-seek.

The court sent people to their homes, but to no avail. Ultimately:

None of the prosecution’s 18 witnesses appeared in court.

In stark contrast, the defense’s 14 witnesses appeared in court as scheduled.

From civil servants to workers, they clearly stated their experience of using the App, the advertisements could be viewed or not, the duration was limited, reading was voluntary, and the exchange of points for cash was not mandatory.

A contest of testimonies, only one side was present. Someone said:

If you don’t participate, you won’t lose.

The case fell into a strange circle:

The witnesses did not appear in court, and the investigators relied on the case files;

But the authenticity of the case files was difficult to confirm because the witnesses did not appear in court.

In court, the prosecution accused Xue Li Xingqiu of having an unclear flow of funds, attempting to use a:

4,000 yuan video production fee bank statement to prove the hidden funds in the company’s operations.

The defense pointed out that this payment was a normal expense paid by the company to a third-party supplier, and the accounts were clear.

5

On December 25, 2024, the third-floor courtroom of the Xilinhot City Court:

The spectator seats were empty.

There were no isolation barriers, and no seats were reserved. Everyone could only attend the hearing through the video in another conference room.

The trial lasted less than half an hour, and the judge once wanted to skip the investigation stage directly, which was objected to by the lawyers on the spot.

In the afternoon, a detective captain in charge of extraction and questioning appeared in court.

In response to the defendant’s questions, this investigator repeatedly used one sentence to prevaricate:

This has nothing to do with the matters I am appearing in court for.

All attempts to pursue the questions were gently blocked by this sentence.

The lawyer raised questions related to the legality of the investigation, and he first asked:

Is this related to the matters I need to explain in court today?

Then, he refused to continue answering.

Time was turned back to May 22, 2024, the third day of the trial.

The dispute over jurisdiction was the focus of the defense.

Lawyer Hu Jian pointed out that the so-called jurisdictional connection point Zhao, not only did not have actual investigation activities:

Not even the most basic evidence collection.

Another lawyer was more straightforward:

This is just a hunting pretext.

Ren Bo’s arrest process was mentioned again. He was taken away as soon as he returned home to Beijing. The police in Gaobeidian said that it did not constitute a pyramid scheme, and in the blink of an eye, he was sent to Inner Mongolia.

Another defendant, Zhao Liang, added that when he was first taken to the Gaobeidian police station in Beijing, the plainclothes police officers from Xilinmeng said to him:

Our Arshan case is too small. Cases like Beijing Gaobeidian, there are hundreds a month, which is great, and there are opportunities for training.

Being scolded, Zhao Liang stood up and angered the Inner Mongolian police. Seeing that they were about to start, the Beijing police came in to appease.

A possible beating was avoided, but Zhao Liang was still sent to Inner Mongolia.

6

Where the police car that drove to Xilinhot went later, we don’t know. Perhaps, it is still running on the vast land:

Looking for the next jurisdictional connection point.

Or perhaps, it is more often parked quietly in a certain courtyard, because the new fishing method is no longer so dependent on the rolling of the wheels.

The progress of technology is rapid. In the past, casting the net had to go to the ocean, and it still took some effort to travel; now, a few lines of code, a technical cooperation, can quietly sneak into the system thousands of miles away, and pack up the data and take it away, as if:

Taking something from a pocket.

Hacker attacks sound like a story from another world, seemingly separated from law enforcement by tens of thousands of miles. But when it is combined with the traditional techniques of deep-sea fishing, it gives rise to a disturbing evolution.

Look, the investigators who are studying Baidu while doing their work, and the technicians who are witnessing the whole process and actually operating it, aren’t they also a part of this evolution:

They may not understand the full power of the tools in their hands, and they may not intend to delve into their origins, but they have only completed the instructions.

Thus, the decision not to file a case in Beijing Chaoyang became a major online pyramid scheme case in Arshan, Inner Mongolia. Thus:

The key results of evidence collection, which should have started after the arrest, have long been quietly lying in the computer of the case-handling unit.

Therefore, those teleporting investigators, and those prosecution witnesses who have collectively disappeared, have all become indispensable characters.

The old fishing net may still show its material and mesh. The new fishing net is invisible, woven from data streams, and you don’t even know when it was cast or when it was retrieved.

This is no longer simply summarized by the four words of profit-seeking law enforcement:

When deep-sea fishing evolves to the point where remote theft can be carried out without bloodshed, and when the dignity of the law needs to be maintained by searching Baidu while doing it, what we see may be a deeper sorrow.

The invisible hand is still stretching out, but its tentacles have become more hidden and more efficient. And those who are entangled by the tentacles, whether they are the real prey or something else, I am afraid it is difficult to tell for a while.

After all, the wheels of history roll forward, but sometimes, we can’t tell whether it is moving forward or drawing a more exquisite circle in place. And inside and outside the circle, it is still those familiar and unfamiliar stories that are constantly being staged.

Written on May 10, 2025


Discover more from 自由档案馆

Subscribe to get the latest posts sent to your email.