The Security Conference That Got a Police Visit

On the afternoon of October 24, 2026, at the West Bund Art Center in Shanghai, a mainstream consumer drone sat locked inside a geofence on the GEEKCON 2026 stage. Judges had used GPS spoofing to ground it, and its official controller could not make it take off. A contestant, without touching the device, used an undisclosed vulnerability to seize full control and force the drone past the no-fly restriction. The audience applauded. Then someone called the police.

Police arrived at the perimeter of the venue. The event was interrupted. Contestants and judges were taken away to assist the investigation. That afternoon’s anti-drone hacking demonstration was canceled.

GEEKCON’s predecessor was GeekPwn, founded in 2014. Over twelve years it attracted more than 30,000 security researchers, and Apple, Tesla, and Android had all been broken on this stage. Vendors came and went. The devices broken changed batch after batch. No company had ever called the police because its product was demonstrated being cracked on stage. This time, the company that called was a leading Chinese drone manufacturer, citing “illegal hacker teaching and incitement to crack.” The reporting company has not been officially named, and the police have not issued a formal notice. In the circulated on-site information and industry discussion, the indications are clear enough.

The incident matters less because of who called the police. It matters because a twelve-year industry understanding was unilaterally torn open in one afternoon.

What happened on stage and what happened in court

The GEEKCON challenge “Runaway Drone” worked like this: the organizer provided a real device. Judges first set the stage as a no-fly zone and locked the drone at the system level. Contestants had ten minutes to seize control without touching the device, using an unknown vulnerability, and force it to take off. The demonstration took place in a closed, controlled environment with judges supervising throughout. Vulnerability details were not disclosed to the public. The name of the company that made the cracked device was not disclosed either. After the event, vulnerabilities were submitted in a targeted way by the organizing committee to vendors and competent authorities for remediation. The rule the organizers repeated was simple: find vulnerabilities, give them to vendors, not to the public.

Black-market actors take another path. In June 2026, the Shenzhen Longgang District People’s Court sentenced a man surnamed Hu to eight months in prison for illegally controlling computer information systems. He cracked drone flight control systems and sold them for profit. In a case in Minhang, Shanghai, the same year, a suspect used “repair and debugging” as cover to provide paid cracking services at 500 to 1,500 yuan per device, making more than 20,000 yuan in illegal gains. These acts share a feature: the cracking was for sale, the lifting of restrictions was to let drones fly illegally, and the profit came from breaking the security mechanism itself.

The two may overlap in technical actions, but they sit at opposite ends of the legal spectrum. The event demonstration aims to let vendors see a vulnerability before black-market actors exploit it. Black-market cracking aims to profit from the vulnerability itself. The first returns the vulnerability to the defense side. The second turns it into a commodity. Treating the first as the second eliminates the legality of finding a vulnerability before the bad guys act.

The police report punishes discovery

The most direct consequence of the police report does not fall on the contestants and judges who were taken away. After assisting the investigation, they will most likely return to their daily research. What changed is quieter and more lasting.

Security researchers reporting vulnerabilities to vendors has never been a legal obligation. It rests on an informal exchange. Researchers contribute time and skill. Vendors gain a remediation window. Researchers gain industry reputation, bounties, or simply the professional confirmation that they got there before the black market. This exchange has no contract and no enforcement power. It depends entirely on both sides defaulting to the same rules. A vendor that calls the police sends a signal to every potential reporter: if you hand me a vulnerability according to the rules, I may turn around and use legal means against you.

Phoenix Net wrote that the direct consequence is that “in the future, no security researcher will be willing to proactively report vulnerabilities to this vendor.” The tech blogger “Happy Duck” put it more bluntly the day of the event: in the future, vulnerabilities “will just be sold on the black market, or people will find them and say nothing, waiting for black-market and gray-market actors to discover and use them, harming users, and that’s that.”

A vulnerability is a form of supply. If vendors will not take it, the market will price it. The difference is who sets the price. White hats become black-market sellers.

The legal foundation of a twelve-year understanding

If this were only a conflict between industry custom and one company, the matter would be simpler. The rules challenged by the police report are not merely a circle’s customs.

The Provisions on the Management of Network Product Security Vulnerabilities, effective in September 2021, encourage reporting vulnerabilities to product providers in Article 6. Article 7 requires vendors, after learning of a vulnerability, to verify it immediately and submit it to the Ministry of Industry and Information Technology’s vulnerability sharing platform within two days. Article 9 specifically regulates the release of vulnerability information through competitions and other means. GEEKCON-style controlled demonstration, targeted reporting, and no disclosure of details is a vulnerability governance path accommodated or even encouraged by the regulatory framework. The event’s years of not disclosing vendor identities is practical. It leaves vendors a remediation window so the vulnerability loses value for exploitation before it is made public.

Internationally, coordinated vulnerability disclosure has moved from best practice to institutionalization. Google Project Zero has enforced a 90-day disclosure deadline since 2015. When the deadline arrives, details are published whether or not the vendor has fixed the flaw. If a patch is ready within the deadline, users get an additional 30 days to complete updates. In July 2026, CISA, NSA, Japan’s JPCERT/CC, the Netherlands’ NCSC-NL, and the UK’s NCSC jointly released coordinated vulnerability disclosure guidance. It requires vendor policies to include safe harbor provisions: researchers who act in good faith and follow disclosure policies should not face legal action. The same guidance criticized silent patching and one-size-fits-all NDAs, saying they damage trust and prevent the industry from learning from vulnerabilities.

The reporting vendor is fighting more than a circle’s customs. It is fighting vulnerability governance infrastructure supported by regulatory rules, international consensus, and twelve years of practice. That infrastructure is not perfect. It exists because of a judgment verified again and again: it is safer for the defense side to see vulnerabilities first than for no one to see them at all.

What was solved and what was left behind

Cybersecurity expert Tan Xiaosheng wrote a widely quoted line in a WeChat Moments post: “Not solving the problem itself, but solving the person who found the problem, has become the ‘best practice’ of many companies, how sad.” The line is sharp because it points to a structural inversion. By using the police, the vendor appears to handle a security incident. In fact it handles the most harmless link in that incident: discovery.

On the description page for “Runaway Drone,” the organizer wrote that the challenge demonstrates “how software security flaws affect the actual behavior of drones” and reveals “the close connection between the security of smart device systems and real-world security.” A drone being seized on a controlled stage is, if the vendor is present, an early warning. The same thing can happen outside the stage. The only variable is whether the person controlling it has malicious intent. The police report turned that warning into a legal risk. The technical flaw the warning pointed to was not fixed because of the report.

The event closed as scheduled that evening. Its theme was “The Last Human Hacking Contest?” The organizers had intended to discuss AI’s impact on the security industry. Before AI made a move, humans pressed pause on the public role of human hackers. The coincidence is not funny. It points to a practical question. When a vendor’s first reaction to a vulnerability slides from fixing to assigning blame, and when the person who finds a vulnerability must assess legal risk before speaking, the security ecosystem degrades from common defense to individual risk avoidance. The cost of risk avoidance does not disappear. It passes down the chain and lands on every ordinary person who uses these devices.

Leave a remediation window, or leave fear

The GEEKCON storm will pass. Those taken away will return. The agenda will continue. The next event will most likely be held. But one thing has changed irreversibly. The next time a security researcher finds a vulnerability that could be exploited by the black market in a drone, a phone, or any internet-connected device, he will think a little more before reporting it. That extra second of thinking is the legacy of the police report.

The security industry is fragile because its effectiveness depends on something no rule can enforce: discoverers being willing to speak. The law can punish people who exploit vulnerabilities. Regulators can require vendors to report vulnerabilities. No rule can force a researcher to give what he has found to a vendor rather than to silence. The channel depends on trust. Trust takes twelve years to build and one afternoon to destroy.

A leading company that calls the police may have its own compliance considerations, public-opinion pressure, and legal judgment. One criterion remains clear. A security decision is advisable if it makes the next vulnerability more likely to be fixed rather than more likely to be hidden. The police report did not make any vulnerability easier to fix. It made the next person who finds one less willing to speak.

Event founder Wang Qi asked on stage, “For whom are these people finding vulnerabilities?” The answer appears in GEEKCON’s twelve years of rules, in the articles of the Provisions on the Management of Network Product Security Vulnerabilities, in Google Project Zero’s 90-day countdown, and in the coordinated disclosure guidance released by cybersecurity agencies of four countries. People who find vulnerabilities are fighting for time. Time that could have been used for remediation. Time for the user who has not yet been targeted by the black market.

Those who take that time away leave the problem to everyone.