The Coinhive Mining Incident

2022年1月20日、最高裁判所において、Coinhive事件は逆転無罪判決となりました。これまでの皆様のご支援に深く感謝申し上げます。

— 一般社団法人日本ハッカー協会 (@JapanhackerA) January 20, 2022

Today in the Japanese software development community, the hottest news is without doubt the “Coinhive Incident.” This legal battle originated from a website operator embedding a cryptocurrency mining script on their website, which began mining whenever visitors loaded the page. This act was prosecuted as the “Creation of Unauthorized Computer Commands” (often referred to as the computer virus crime), kicking off a lengthy series of legal proceedings.

The reason this case is so important for developers is that, as web developers, we are on the front lines of interacting with users. As long as you have a domain and a server, anyone around the world can freely browse the web pages you write. However, this accessibility also comes with risks. As a developer, the idea that the code you write could somehow inexplicably be ruled criminal is terrifying.

Developers generally have higher levels of education, earn relatively comfortable incomes, and are typically law-abiding citizens with no criminal record. “Going to court” is never an option they imagined in life, nor would they ever picture themselves being arrested by the police, having their homes searched, and seeing the tools of their trade seized. Furthermore, when facing police investigations and depositions, inexperienced individuals can easily make statements detrimental to themselves out of sheer nervousness—or naively assume that as long as they explain things reasonably, the police will understand, only to end up digging a deeper hole. In Taiwan, suspects have the right to meet with legal counsel and have their lawyer present during depositions; in Japan, however, you have to face the police alone, elevating the pressure to another level.¹

Even if you are ultimately found not guilty, the financial costs and the physical and emotional exhaustion of going to court, consulting attorneys, and paying legal defense fees are more than enough to upend your life.

Case Overview

The defendant operated a website that received around 30,000 monthly visits. He thought he could embed a mining script to generate revenue and help cover the operational costs of running the site. The service he used was called Coinhive. It provided a mining script that website operators simply inserted into their web pages, which would execute automatically whenever users visited.

To briefly explain the principle behind mining: when a cryptocurrency transaction is broadcast, miners must compute and verify whether to validate the transaction. This computation involves solving mathematical problems, which typically requires substantial computational power. Once a calculation is successfully completed, the miner receives a small amount of cryptocurrency as a reward. Since anyone with a CPU can perform these calculations, executing a JavaScript script in the browser allows a website to leverage visitors’ CPU resources for mining. Naturally, compared to dedicated mining rigs and GPUs, the returns from this method are negligible. According to the court judgment, the defendant made only about 800 Japanese yen in profit.

Subsequently, the defendant was prosecuted. He was initially acquitted in the first instance (district court), but was then found guilty on appeal at the Tokyo High Court. Finally, today, the Supreme Court handed down a final acquittal,² and the written judgment is available online.

While visitors were not informed in advance about the presence of the mining program—which ran contrary to their intent—the method of utilizing a user’s computer to a certain extent without prior consent was judged to be fundamentally similar to online advertising. “It falls within socially acceptable bounds,” concluded the unanimous opinion of all five justices. However, the Supreme Court did not grant blanket permission for such conduct in general; rather, the acquittal was limited strictly to the circumstances of this case. If the underlying purpose is malicious, criminal liability could still apply.

Original text: 閲覧者があらかじめこうしたプログラムの存在を知らされていなかった点は、閲覧者の意図に反するとしたが、事前同意がないまま利用者のパソコンを一定程度使うという手法そのものはネット広告と同様と判断。「社会的に許容しうる範囲内だ」と結論づけた。5人の裁判官の全員一致だった。 もっとも最高裁は、一般論として同種行為を許容したのではなく、今回の事件に限って無罪と判断したにとどまる。利用目的などが悪質なら刑事責任を問われる可能性はありそうだ。

Excerpted from Nikkei³

Key Legal Issues

The central debate throughout the trial revolved around the legitimacy of the conduct—specifically, whether it met the statutory requirements of being “unauthorized” and running contrary to “user intent” (Article 168-2 of the Penal Code: Creation of Unauthorized Computer Commands, etc.).⁴

An electromagnetic record giving an unauthorized command to cause a computer to operate in a manner contrary to the user’s intent or not to operate in accordance with such intent.

Although the statute specifies “unauthorized,” what defines an action as “unauthorized” cannot be determined solely by the contents of the code. Instead, it must be assessed based on the context of the incident, the actual impact on users, and other surrounding circumstances.

Regarding the issue of unauthorized use: to the general public, mining scripts feel intrusive. Having your CPU resources co-opted without permission naturally feels unpleasant. However, looking at the judgment (as referenced in the excerpt above), the defendant intentionally throttled the CPU usage rate. The judgment also noted that running scripts without notifying users happens in online advertising as well. Therefore, although this behavior may be unwelcome, it did not cause actual harm to users or unlawfully harvest their personal data, and the script stopped executing immediately the moment the browser tab was closed.

Furthermore, regarding whether it ran contrary to “user intent”: the defense argued that although users were not informed of the mining script beforehand, tools like Google Analytics and online advertisements routinely run without obtaining explicit user consent. In web browsing, this is a widely accepted practice. Therefore, mining scripts should also be considered within acceptable bounds. If failing to notify users were enough to warrant a criminal conviction, then virtually every developer out there would be guilty.

Additional Context

1. The Coinhive Mining Script

The defendant’s original intention was to remove advertisements from the website and replace them with the Coinhive mining script as a source of revenue to offset operational expenses. An interesting detail here is that Coinhive once updated its script and terms of service, changing them to require user consent before mining could begin. However, the defendant was unaware of this announcement and continued using the legacy script. The defendant also received a direct message on Twitter advising him to implement a consent notice because running it without one was in a legal gray area. Finding the implementation of user consent too cumbersome, the defendant simply removed the mining script altogether. (The script was deployed for about a month and a half in total.)

2. Police Search and Depositions

In February of the following year, the defendant was contacted by the police. One day, they raided his home unannounced and began searching the premises without providing an initial explanation, seizing his phone and computer. During interrogations, they applied high-pressure intimidation tactics demanding that he reflect on his wrongdoing.⁵ The prosecutor initially proposed a summary order (known in Japanese as 略式起訴, a summary indictment) with a fine of 100,000 yen. However, the defendant refused to accept it, which escalated the matter into a formal trial. Yet, considering travel expenses and attorney fees, the total cost of fighting the case far exceeded 100,000 yen.

The difference between a summary procedure and a formal trial is that in a summary procedure, the court reviews the case solely based on the prosecutor’s paperwork without holding hearings or giving either party a chance to speak; straightforward matters like overdue utility bills can wrap up in tens of minutes. In contrast, a formal trial requires appearing in court, featuring back-and-forth arguments between the defense and prosecution just like in legal dramas, and takes a considerably longer time to conclude.

3. Petitions for Appeal and Opinion Letters

The defendant was found guilty on second-instance appeal. To appeal further to the Supreme Court, a special appeal procedure was required. A major challenge with this was that the Supreme Court primarily reviews whether there were errors in the application of the law, rather than re-examining the facts of the case, and new evidence cannot be submitted.

To secure a hearing for the appeal, the defendant and his defense counsel worked with the Japan Hacker Association⁶ to collect opinion letters from software engineers across the country, attempting to convince the Supreme Court to take up the case.

Conclusion

As web developers, we constantly experiment with new technologies to sharpen our technical understanding and expertise. However, for most police officers, prosecutors, and judges, computers are outside their domain of expertise. They may not possess comprehensive technical knowledge and might prematurely brand something as “criminal” simply due to a lack of understanding. The general public, too, may assume guilt because they don’t understand the underlying mechanics. As evidenced by the recent surge in cryptocurrency scams, computer-related legal cases will only become more common, and developers will be the first to bear the brunt.

Most police officers, lawyers, and judges do not have deep insights into this field, and the technical depth required poses a significant hurdle during legal proceedings. Police officers often misunderstand technical explanations given by defendants during depositions (such as confusing a <head> tag with an HTTP header⁷). Without a resilient mindset, a developer can easily break down. Coupled with the typical developer demeanor—honest, deferential to authority—it is easy to be led by the nose during police questioning, signing statements that work against them and making it nearly impossible to overturn the narrative later. Reading this news is a valuable prompt for developers to reflect on: if this ever happened to you, how would you handle it?

Postscript

After sharing this article in a front-end development community,⁸ some of the comments and reactions were rather disappointing. However, they also made me realize that this domain is indeed a gray area, prone to sharp disagreements and controversy. Furthermore, framing the issue from a legal perspective in a technical community easily led discussions to lose focus—it was a learning experience for me. My original motivation was that most developers have probably never considered the possibility of having the police knock on their door, let alone having to go to court and fight a legal battle. I thought exploring how a developer should respond to such a situation was worthwhile, and given that this was major news in Japan, it felt worth sharing.

Comments like “this kind of defense is disgusting” made me wonder: is this really how people communicate with their colleagues on a daily basis? Since the tone in the group had devolved to the point where constructive discussion was impossible and would only lead to flame wars, I refrained from commenting further. There were, however, a few thoughtful comments from a user-experience standpoint, arguing that actions like this should always require user notification, and expressing concern over the harm or impact such practices could have on internet culture.

Additionally, both the original report and the court judgment repeatedly mentioned that the defendant deliberately throttled CPU usage to a level that would not be noticeably disruptive to users (the judgment noted 50%, which is admittedly still fairly intensive). While there was no concrete empirical data presented regarding the actual operational impact, whether the disruption was significant is quite subjective. The court’s view was that the impact was not severe. If someone insists on applying a general rule (“the CPU fan starts screaming”) to an exception (“the defendant actively throttled the CPU”), there is not much I can say.

The Legal Perspective

I want to add some further context from a legal point of view. Someone commented: “Stealing someone else’s resources to mine crypto and get rich—how is that not a crime?” This sentiment actually highlights several misconceptions.

First, as stated in both the original report and the judgment, the ruling does not declare that all mining is legal; rather, in this specific case, the conduct fell within socially acceptable bounds. The text also notes that the defendant intentionally tuned the parameters to prevent the CPU from running at full blast. Yes, mining scripts carry a generally negative public perception, but does that rise to the level of criminal liability? That is a question that must be evaluated on a case-by-case basis.

The defendant originally wanted to eliminate advertisements and replace them with a mining script to offset the operational costs of running the website. Removing ads in favor of mining = website operator gains revenue = funds are used to maintain and improve the site = user experience improves. This was intended to indirectly benefit users, and the initial motive was well-meaning. Although CPU usage increased, to me, this is a question of proportionality. Whether an act constitutes a crime depends on intent, proportionality, context, and actual impact, rather than taking things out of context and crying criminal the moment mining is mentioned. Furthermore, the defendant did not make a fortune from mining.

Another issue lies in statutory definitions. In Japan, the crime of “Creation of Unauthorized Computer Commands, etc.” has very ambiguous definitions. Terms like “unauthorized use” and “contrary to user intent” are relatively vague, leaving substantial room for controversy. Some argue that such ambiguous statutes are prone to abuse. The fallout from this vagueness is evident: this lawsuit took three to four years to finally reach a conclusion. For an ordinary person, spending three to four years under the cloud of suspected criminality, facing skepticism from colleagues and neighbors, and enduring the scrutiny of those around you is pure torment.

From the comments, it is also apparent that some developers could use a stronger grasp of basic legal concepts. Before discussing whether someone committed a crime, you must first define which specific law was violated and what its statutory elements are, rather than judging guilt based on personal “feelings.” Developers, of all people, should possess a deeper understanding of the underlying principles. After all, wouldn’t you clarify the spec before writing a feature?

The User Perspective

Some pointed out that any behavior that deviates from user expectations should require disclosure. While this is considerate in principle, looking at the endless barrage of cookie consent banners across the web makes me wonder: is this really what users want? You visit a site, first it asks about cookies, then it asks if ads are okay, then whether mining is okay, and if you say no, you cannot use the site? Another question is: does asking for permission magically make everything acceptable?

My own blog contains neither ads nor mining scripts, because I feel the trade-off in user experience is far too steep. But I support advertising. Many developers who build sites for free rely on ad revenue to keep their services running. That is why I do not use AdBlock, and I subscribe to YouTube Premium to support creators without ads.

Personally, I also strongly dislike mining scripts. Even though we have entered an era of surplus computing power, having someone freely run their workloads on your CPU is still off-putting. However, I believe it is crucial to distinguish between poor optics, ethical concerns, and actual criminal behavior. People often conflate them, because demanding a “death penalty for everything” requires no critical thinking.

I do not want mining scripts to become mainstream, but I believe exploring new monetization models that move away from banner ads—allowing websites to sustain operations over the long haul while maintaining a solid user experience—is a positive development (such as SocialFi, LikeCoin, Buy Me a Coffee, etc.). As developers, this is something we should welcome. Standing on the front lines of the web, our technical expertise should help us see the underlying nature of how things work, rather than judging them purely on gut feeling.

Coinhive shutting down was, in part, proof that this business model simply was not viable. Aside from consuming too much CPU power and suffering from low user acceptance, browser-based mining efficiency is abysmal. Running through a browser and a JavaScript runtime environment (though Coinhive reportedly used WebAssembly) pales in comparison to running dedicated mining rigs at home, or simply serving honest banner ads to generate revenue.