Japan's Supreme Court rules cryptojacking scripts are not malware
- Reference: 1642748284
- News link: https://www.theregister.co.uk/2022/01/21/japan_supreme_court_cryptojacking_not_malware/
- Source link:
Tokyo High Court ruled against the defendant, 34-year-old Seiya Moroi, on charges of keeping electromagnetic records of an unjust program. That unjust program was Coinhive, a "cryptojacking" script that mines for Monero by pinching some CPU cycles when users visit a web page that includes the code. Moroi ran the code on his website.
Coinhive has been blocked by [1]malware and antivirus vendors as it slows down other processes, increases utility bills, and creates wear and tear on your device. But in many ways Coinhive's Javascript code acts no differently to advertisements.
[2]
Moroi [3]posted to a site promoting his UX and UI design business to offer his side of the story, including reference to Chapter XIX-2 of the Japanese Penal Code:
Article 168-2 (1) A person who, without legitimate grounds, creates or provides any of the following records including electronic or magnetic records for the purpose of using them for executing commands on another person's computer is punished by imprisonment for not more than 3 years or a fine of not more than 500,000 yen:
(i) electronic or magnetic records that give unauthorized commands to prevent a computer from performing functions in line with the user's intention or have it perform functions against the user's intention;
(ii) beyond what is set forth in the preceding item, records including electronic or magnetic records in which unauthorized commands referred to in the same item are described.
(2) The same applies to a person who, without legitimate grounds, uses electronic or magnetic records set forth in item (i) of the preceding paragraph for the execution of commands on another person's computer.
His interpretation of the Chapter disputes that he ran Coinhive on other people's equipment "against the user's intention" (which he takes to be equivalent to "without their permission"), because if running JavaScript is an unwelcome intrusion then myriad services such as Google Analytics must also be illegal. He's kind of side-stepping the "legitimate grounds" part there.
He also argued that he revealed the presence of Coinhive, so was not acting deceptively. Nor did Moroi intend to profit from his efforts – he just wanted to keep up with tech trends.
[4]
[5]
He also argued that his efforts didn't really make any money; the script yielded less than ¥1,000 ($8.79) – a sum so paltry it was hard to cash out of Monero.
That experience was typical. In 2018, researchers [6]found that cryptojacking paid on average just $5.80 a day.
[7]
Moroi's post, which is quite a screed, reveals that he could have paid a fine of ¥100,000 ($880) in February 2020, but instead chose to fight on this hill, as a matter of principle.
[8]COVID-19 was a generational opportunity for change at work – and corporate blew it
[9]I own that $4.5bn of digi-dosh so rewrite your blockchain and give it to me, Craig Wright tells Bitcoin SV devs
[10]Privacy is for paedophiles, UK government seems to be saying while spending £500k demonising online chat encryption
[11]APNIC: Big Tech's use of carrier-grade NAT is holding back internet innovation
[12]Google sours on legacy G Suite freeloaders, demands fee or flee
In their ruling, the justices deliberating [13]defined [PDF] malicious software as a program that "behaves differently from what an ordinary user recognizes, and is unacceptable from the perspective of maintaining the social functions of a personal computer."
"Mining itself, which is the content of the behavior of this program code, is a work to ensure the reliability of temporary currency, and it is difficult to say that it is not socially unacceptable," wrote the judges.
The fact that no user PCs were inconvenienced also swayed the judges.
Moroi [14]tweeted :
Thanks to your late report, we have been acquitted by the supreme court today. I feel that it is the result of the power of Mr. Hirano, the teachers of the defense team, Mr. Takagi who took on witnesses in the first instance, the hacker association, the people who submitted the written opinion, and the many people who supported me. thank you very much!
Japanese authorities did not like the decision.
"It is regrettable that the prosecutor's allegation was not accepted, but since it is the judgment of the Supreme Court, I will take it seriously," said the chief of the Supreme Public Prosecutor's Office, Seiji Yoshida.
[15]
The case seems to have outlasted Coinhive itself – the tool was [16]discontinued in March 2019 due to it being, according to the company, no longer economically viable.
By the way, crypto mining is something The Reg [17]would never do … more than once a year. ®
Get our [18]Tech Resources
[1] https://www.malwarebytes.com/cryptojacking
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YeqScZw@DRgK1kqjndgEUAAAAME&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://doocts.com/en/3403.html?lang=en
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeqScZw@DRgK1kqjndgEUAAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeqScZw@DRgK1kqjndgEUAAAAME&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2018/08/30/cryptojacking_pays_poorly/
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YeqScZw@DRgK1kqjndgEUAAAAME&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2022/01/19/covid_working_culture_column/
[9] https://www.theregister.com/2022/01/19/craig_wright_bitcoin_sv_high_court_sueball/
[10] https://www.theregister.com/2022/01/20/no_place_hide_campaign_anti_e2ee_ukgov/
[11] https://www.theregister.com/2022/01/20/ipv4_nats_slow_ipv6_transition/
[12] https://www.theregister.com/2022/01/20/google_sours_on_g_suite/
[13] https://www.courts.go.jp/app/files/hanrei_jp/869/090869_hanrei.pdf
[14] https://twitter.com/moro_is/status/1484148194250756102
[15] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YeqScZw@DRgK1kqjndgEUAAAAME&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[16] https://www.theregister.com/2020/03/17/cryptojacking_coinhive/
[17] https://www.theregister.com/2017/04/01/invisible_bitcoin_paywall/
[18] https://whitepapers.theregister.com/
Re: "crypto mining software is not malware"
It wasn't theft. People who visited his website knew this happened. As with most websites and cookies: continuing to use the site is an implicit consent.
Re: "crypto mining software is not malware"
If you can’t know he has crypto mining software until you visit the site and it activates on page loading with no permission query then isn’t that a different situation.
If I put a notice on my site saying you agree to pay me £10 on landing on the page and £10 every minute you stay on the page (ignoring practicalities of collection FTM), and you have no way to know that until you visit so I’ll always collect £10 from people enticed to my site, IANAL but that seems unenforceable as a contract.
Re: "crypto mining software is not malware"
"If I put a notice on my site saying you agree to pay me £10 on landing on the page and £10 every minute you stay on the page (ignoring practicalities of collection FTM), and you have no way to know that until you visit so I’ll always collect £10 from people enticed to my site, IANAL but that seems unenforceable as a contract."
Absolutely, but in this case what is being taken isn't cash but CPU cycles. Maybe not that many people are explicitly aware of it, but having a website execute code on your computer without your 'a priori' knowledge of the details (and taking the visit to the website as implicit consent) is the way the internet works. That's why one should be wary about clicking on random links to unknown sites.
It's true that the code being executed is in the website owner's interest and not yours, but as the article points out, this is literally identical to what ads / trackers do (actually worse, since this guy had a notice on his website that he's using the crypto mining software, while trackers are invisible).
Re: "crypto mining software is not malware"
When I was still using my iPad Air 2, visiting such a page would cause Safari to freeze, and the iPad to overheat, so it is definitely malware in my book.
Re: "crypto mining software is not malware"
Crypto mining is stealing capacity and energy, something you have to pay for, so it is stealing something of worth.
Definitely malware as is google analytics.
Sue the police
This "The desktop PC was returned after deletion of all data including OS at a later date." absolutely shows the incompetence of the police.
Theft of electricity?
I would have thought that "Theft of electricity", a convenient charge traditionally used to nail phone-tappers in the UK when nothing else would stick, had more chance of success. Maybe there's nothing similar in Japanese law.
"crypto mining software is not malware"
Okay, in the absolute, it isn't malware as such because it does not take over the computer and attempt anything else, fine.
It is still theft, though. It is using someone else's resources without their knowledge or consent.
So he should not get off scott-free.