The Infinite Alert Loop Incident

This article is translated from Wikipedia and shared under the CC BY-SA 3.0 License.

Introduction

Although this incident took place in Japan, I feel similar situations could easily happen in Taiwan as well. The definition of computer-related crimes is often ambiguous and can easily be weaponized for frivolous prosecutions. As a developer, I believe this is an important case to understand. This article is meant purely as a case study and in no way encourages any malicious behavior that interferes with user operations.

Incident Overview

In March 2019, the Hyogo Prefectural Police searched the home of a female junior high school student and referred two men to prosecutors on suspicion of attempted provision of unauthorized computer commands (illicit computer commands) after they posted links containing mischievous code to an online bulletin board. On March 25, the Japan Hackers Association began crowdfunding legal and attorney fees for the two men, raising a total of 7 million yen from 553 donors. On May 29 of the same year, prosecutors decided to suspend prosecution (deferred indictment) for both men. There were no actual victims in this case.

According to one of the men, the prosecutor argued: “On certain mobile phone models, once the link is clicked, it might become impossible to close the screen, or it might require repairs or seeking professional help, thus violating the ‘contrary to intent’ criterion under computer virus laws.” The prosecution maintained its stance regarding the charge of “provision of unauthorized computer commands.”

Upon learning of this, the defense attorneys from Yokohama Park Law Office representing the two men criticized the prosecution. They argued that suspending prosecution was an attempt to muddy the waters by taking the stance that “a crime was committed, but we’ve chosen not to prosecute this time,” adding: “Although prosecutors believed it was an offense, they chose to suspend prosecution due to the specific circumstances—because as legal professionals, had they not done so, they would have faced severe public backlash.”

The Code

The code in question was the following JavaScript snippet:

for ( ; ; ) {
  window.alert("　∧_∧　ババババ\n（ ・ω・)=つ≡つ\n（っ ≡つ=つ\n`/　　)\n(ノΠＵ\n何回閉じても無駄ですよ～ww\nm9（＾Д＾）プギャー！！")
}

window.alert takes a specified string and displays a modal dialog with an OK button. Clicking the OK button closes the dialog. Because this code runs in an infinite loop, as soon as the dialog is closed, another one appears immediately. This behavior persists until the user closes the browser tab.

Because window.alert blocks other operations until the dialog is dismissed, the script cannot cause any actual damage or crash the browser. Therefore, it does not qualify as a “browser crasher” (bra-kura), but rather as a “prank script.”

For most desktop browsers, simply closing the tab stops the script. Furthermore, modern browsers offer a “Prevent this page from creating additional dialogs” checkbox once an alert pops up more than once, which effectively halts the infinite loop.

Reactions

This incident provoked widespread backlash and discussion both in Japan and internationally.

On March 5, 2019, Smiley Kikuchi (a Japanese comedian) tweeted under the assumption that a cybercrime had indeed taken place: “A seventh-grade girl was able to commit a cybercrime so casually, treating it like a game. How can adults put a stop to such a reality?” His tweet was met with an avalanche of criticism.

Later, he reposted a screenshot of an explanatory tweet by Hiromitsu Takagi (a prominent Japanese cybersecurity researcher) with the username blurred out, commenting: “Arguing on Twitter that this isn’t a crime doesn’t hold water” and “Everyone must take responsibility for their own actions,” igniting yet another backlash. The next day, in an effort to calm the controversy, he tweeted: “The Hyogo Prefectural Police and the courts are already handling the case. If prosecutors and the court determine that this was a false accusation, I am willing to apologize directly to the three defendants.” He eventually deleted all related tweets.

On March 6, 2019, JavaScript creator Brendan Eich tweeted that Netscape 4 had already allowed users to break out of infinite JavaScript loops a full decade before Chrome’s first release, stating: “I’ll be expert witness at trial. This is not a virus, it should not be a crime, and if the browser did not let the user regain control, jail the browser maker :-P.” On March 9, the Electronic Frontier Foundation (EFF) also tweeted that “an infinite loop is not a crime.”

Thread: https://t.co/zc1qz7OLx8

I'll be expert witness at trial. This is not a virus, it should not be a crime, and if the browser did not let the user regain control, jail the browser maker :-P.

— BrendanEich (@BrendanEich) March 9, 2019

On March 8, in protest against the police’s actions, a developer published the original code on GitHub with the explicit goal of getting arrested, naming the repository lets-get-arrested. When interviewed by NETIB-NEWS about this repository, the Hyogo Prefectural Police Cybercrime Division responded: “Could they say something like that with a straight face to their own children?”

Additional Notes and Personal Thoughts

Looking at this incident, it becomes obvious that the definition of “provision of unauthorized computer commands” is so vague that it creates an enormous amount of legal gray area. In this particular case, turning a client-side infinite loop in a browser into a criminal offense is frankly absurd.

On a side note, the issues in the aforementioned lets-get-arrested repository are quite hilarious—the sarcasm is razor-sharp.

For instance, someone opened an issue asking how to actually get arrested in Japan. He recounted that during a trip to Roppongi, he saw four heavily intoxicated individuals crossing the street. One of them, walking right down the middle of the road, was honked at by a taxi, whereupon he flew into a rage, kicked the taxi, and threw a massive fit in the middle of traffic. A police car arrived, but the officers did essentially nothing and simply left without making any arrests.

The repo’s author replied: “Yes, in Japan, writing an infinite loop is a far more serious crime than kicking a taxi or throwing a tantrum in the middle of the street.”