Japan's Supreme Court rules cryptojacking scripts are not malware

A man found guilty of using the Coinhive cryptojacking script to mine Monero on users' PCs while they browsed the web has been cleared by Japan's Supreme Court on the grounds that crypto mining software is not malware. Tokyo High Court ruled against the defendant, 34-year-old Seiya Moroi, on charges of keeping electromagnetic …

[Pascal Monett]

"crypto mining software is not malware"

Okay, in the absolute, it isn't malware as such because it does not take over the computer and attempt anything else, fine.

It is still theft, though. It is using someone else's resources without their knowledge or consent.

So he should not get off scott-free.

[Sabot]

Re: "crypto mining software is not malware"

It wasn't theft. People who visited his website knew this happened. As with most websites and cookies: continuing to use the site is an implicit consent.

[adam.c]

Re: "crypto mining software is not malware"

If you can’t know he has crypto mining software until you visit the site and it activates on page loading with no permission query then isn’t that a different situation.

If I put a notice on my site saying you agree to pay me £10 on landing on the page and £10 every minute you stay on the page (ignoring practicalities of collection FTM), and you have no way to know that until you visit so I’ll always collect £10 from people enticed to my site, IANAL but that seems unenforceable as a contract.

[jmch]

Re: "crypto mining software is not malware"

"If I put a notice on my site saying you agree to pay me £10 on landing on the page and £10 every minute you stay on the page (ignoring practicalities of collection FTM), and you have no way to know that until you visit so I’ll always collect £10 from people enticed to my site, IANAL but that seems unenforceable as a contract."

Absolutely, but in this case what is being taken isn't cash but CPU cycles. Maybe not that many people are explicitly aware of it, but having a website execute code on your computer without your 'a priori' knowledge of the details (and taking the visit to the website as implicit consent) is the way the internet works. That's why one should be wary about clicking on random links to unknown sites.

It's true that the code being executed is in the website owner's interest and not yours, but as the article points out, this is literally identical to what ads / trackers do (actually worse, since this guy had a notice on his website that he's using the crypto mining software, while trackers are invisible).

[Gordon 10]

Re: "crypto mining software is not malware"

And CPU cycles are energy and energy is money.

Just because others are getting away with it doesn't have any bearing on whether he should. besides its arguable that a constant drain is much more material that. a brief ad load. I expect load when I interact with a web page. I dont expect load if I'm not interacting.

[davidp231]

Re: "crypto mining software is not malware"

"And CPU cycles are energy and energy is money."

So.... Windows Update is malware in that case? I mean that hogs 100% of the CPU and almost all your bandwidth.

[Falmari]

Re: "crypto mining software is not malware"

@Gordon 10 “Just because others are getting away with it doesn't have any bearing on whether he should.”

What others do does have a bearing. When what others do is not deemed to break the law and it can be shown what he is doing is no different.

[Anonymous Coward]

Re: "crypto mining software is not malware"

It is ILLEGAL to read this sentence.

Go to jail now.

[katrinab]

Re: "crypto mining software is not malware"

When I was still using my iPad Air 2, visiting such a page would cause Safari to freeze, and the iPad to overheat, so it is definitely malware in my book.

[Chris G]

Re: "crypto mining software is not malware"

Crypto mining is stealing capacity and energy, something you have to pay for, so it is stealing something of worth.

Definitely malware as is google analytics.

[John Brown (no body)]

Re: "crypto mining software is not malware"

Exactly. The very definition of cryptocurrency is converting energy to cash. Hence why in many parts of the world it's simply no longer economic to even try to "mine" it any more except on an industrial scale or by "stealing" electricity, either as per the article or b y actual criminal by-passing of metering systems.

As for the $5.80 per day, that sounds good to me. It's a more than the pay rise I've just been offered!!

[Sabot]

Sue the police

This "The desktop PC was returned after deletion of all data including OS at a later date." absolutely shows the incompetence of the police.

[Detective Emil]

Theft of electricity?

I would have thought that "Theft of electricity", a convenient charge traditionally used to nail phone-tappers in the UK when nothing else would stick, had more chance of success. Maybe there's nothing similar in Japanese law.

[The Mole]

Re: Theft of electricity?

The difference is that with phone tappers there was physical electricity flowing from A to B. There was a positive charge they could charge you for so to speak.

In this case there is no direct flow of current. It may induce extra electricity to be used by your device, a tiny amount of packets may flow up the phone line (or fibre optic cable) but that's immaterial. You're into the realms of saying that if someone triggers your PIR security light then they owe you for the electricity.

Ultimately if you go to a website you run the risk of them having an animated gif, large jpeg, autoplaying video, ad tracking or other javascript code. Trying to distinguish legally from a poorly written site using excess CPU cycles, through ads and tracking scripts to other more dubious operations would be near impossible and ripe for political abuse