2022.01.20

2020 (A) 457

Keishu Vol. 76, No. 1

Judgment concerning a method of determining whether a program code falls under "electronic or magnetic records that give unauthorized commands to prevent a computer from performing functions in line with the user's intention or have it perform functions against the user's intention" referred to in Article 168-2, paragraph (1) of the Penal Code

Case charged for storage of an electronic or magnetic record that gives unauthorized commands

Judgment of the First Petty Bench, quashed and decided by the Supreme Court

Tokyo High Court, Judgment of February 7, 2020

1. It is reasonable to consider that a program is found to have the nature of being against a user's intention as referred to in Article 168-2, paragraph (1) of the Penal Code (the requirement of "preventing a computer from performing functions in line with the user's intention or having it perform functions against the user's intention" is satisfied) in the case where functions actually performed by the program differ from functions that general users should recognize in relation to the program. In finding functions that general users should recognize, it is necessary to take into account the name given to the program, the content of explanations about the functions of the program, possible methods of using the program, etc., in addition to the content of the functions of the program. It is reasonable to consider that the nature of giving unauthorized commands as referred to in the same paragraph is found (the requirement of giving "unauthorized" commands is satisfied) in relation to socially unacceptable programs from the perspective of protecting the trust of society in general in data-processing by a computer and protecting the social functions of computers. In determining whether a program has the nature of giving unauthorized commands, it is necessary to take into account whether the functions of the program have any influence on the capabilities of a computer and data-processing by a computer, the degree of such influence, the methods of using the program, etc., in addition to the content of the functions of the program.

2. Under the circumstances held in the judgment (see the text of the judgment), such as the circumstance where a mechanism of having viewers' computers perform mining as the method of gaining profits from a website has not been acknowledged by general users, it cannot be said that general users should recognize the functions of a program code that uses website viewers' computers to have them perform cryptocurrency mining without the consent of the viewers. Therefore, the program code is found to have the nature of being against the user's intention as referred to in Article 168-2, paragraph (1) of the Penal Code (the requirement of "preventing a computer from performing functions in line with the user's intention or having it perform functions against the user's intention" is satisfied). However, under the following circumstances held in the judgment (see the text of the judgment), the program code cannot be considered to be socially unacceptable and is not found to have the nature of giving unauthorized commands as referred to in the same paragraph (the requirement of giving "unauthorized" commands is not satisfied): [i] the influence of the functions of the program code on the capabilities, etc. of a viewer's computer did not go beyond a certain degree of use of the central processing unit while the viewer is viewing the website; although the power consumption of the computer was slightly increased and the processing speed was reduced, the degree of the influence was not so large that the viewer noticed those changes; [ii] a mechanism for a website operator to gain profits from the viewing of the website by viewers is important for the distribution of information via the website, and the same program code was used as such profit-making mechanism; in addition, even when comparing the program code with advertisement display programs that are socially accepted as such mechanism, the program code does not significantly differ from them in terms of the influence on the capabilities, etc. of a viewer's computer, and it is also similar thereto in terms of the method of use, etc.; and these points can be considered to be within the socially acceptable range. Therefore, the program code is not found to be an electronic or magnetic record that gives unauthorized commands.

(Concerning 1 and 2) Article 168-2, paragraph (1) and Article 168-3 of the Penal Code

Penal Code

(Making of Electronic or Magnetic Records Containing Unauthorized Commands)

Article 168-2(1) A person who, without legitimate grounds, creates or provides any of the following records including electronic or magnetic records for the purpose of using them for executing commands on another person's computer is punished by imprisonment for not more than 3 years or a fine of not more than 500,000 yen:

(i) electronic or magnetic records that give unauthorized commands to prevent a computer from performing functions in line with the user's intention or have it perform functions against the user's intention;

(ii) beyond what is set forth in the preceding item, records including electronic or magnetic records in which unauthorized commands referred to in the same item are described.

(Acquisition of Electronic or Magnetic Records Containing Unauthorized Commands)

Article 168-3 A person who, without legitimate grounds, acquires or stores records including electronic or magnetic records set forth in the items of paragraph (1) of the preceding Article for the purpose referred to in the same paragraph is punished by imprisonment for not more than 2 years or a fine of not more than 300,000 yen.

The judgment in prior instance is quashed.

The appeal to the court of second instance is dismissed.

Of the reasons for final appeal stated by the defense counsel, HIRANO Takashi, the argument of a violation of Article 21, paragraph (1) and Article 31 of the Constitution on the grounds that the phrase "unauthorized commands to prevent a computer from performing functions in line with the user's intention or have it perform functions against the user's intention" referred to in Article 168-2, paragraph (1) of the Penal Code is vague and unclear lacks a premise as it cannot be said that the same phase is unclear. Other reasons, including the arguments of violation of the Constitution and violation of a judicial precedent, are substantially arguments of a mere violation of laws and regulations and an erroneous finding of facts. None of these reasons constitutes any of the reasons for a final appeal as referred to in Article 405 of the Code of Criminal Procedure.

However, as a result of the Court's examination by its authority in consideration of the defense counsel's arguments, the judgment in prior instance should inevitably be quashed pursuant to Article 411, items (i) and (iii) of the Code of Criminal Procedure for the following reasons.

No. 1 Outline of the case and facts

1. The gist of the charged fact of this case (after the change of the count) is as follows: "The accused is the operator of an internet website 'X.' The accused attempted to acquire rewards by causing the central processing unit of computers used by viewers of X to perform calculations, such as work to approve the transaction records of a cryptocurrency, Monero, without the consent of the same viewers, and for the period from October 30 to November 8, 2017, for the purpose of executing commands on another person's computer, without legitimate grounds, the accused put and stored in a file that constitutes X on a server computer a program code which is an electronic or magnetic record that gives unauthorized commands (hereinafter referred to as the "Program Code") that causes computers used by viewers of X to access a server computer. A program code installed on the server computer commands the central processing units of the abovementioned computers to perform the aforementioned calculations, without the consent of the viewers, and causes them to acquire the same program code. By doing so, the accused stored an electronic or magnetic record that gives unauthorized commands to have a computer perform functions against the user's intention."

Under the relevant mechanism, calculations, such as work to approve the transaction records of a cryptocurrency (crypto-asset), are performed to ensure the credibility of the cryptocurrency, and the cryptocurrency is issued as rewards to a person who provided the capabilities of a computer for such calculations. The act of acquiring a cryptocurrency by performing calculations, such as approval work, is called "mining." At the time of this case, a web service called Coinhive that uses viewers' computers to have them perform mining without the viewers' consent (hereinafter referred to as "Coinhive") had been provided by a provider called Coinhive Team (hereinafter referred to as "Coinhive Team") as a source of income for the website.

In this case, the accused was charged with the crime of storage of an electronic or magnetic record that gives unauthorized commands in relation to the act of storing the Program Code in a server computer for the purpose of introducing a mechanism of mining by Coinhive as X's source of income. The major issue is whether the Program Code falls under "electronic or magnetic records that give unauthorized commands to prevent a computer from performing functions in line with the user's intention or have it perform functions against the user's intention" referred to in Article 168-2, paragraph (1) of the Penal Code (hereinafter referred to as the "Provisions") (hereinafter the requirement of "preventing a computer from performing functions in line with the user's intention or having it perform functions against the user's intention" is referred to as the "nature of being against the user's intention" and the requirement of giving unauthorized commands is referred to as the "nature of giving unauthorized commands").

2. According to the findings of the judgment in first instance and the judgment in prior instance, as well as the case records, the facts of this case are as follows.

As of September 2017, the accused was operating a website, "X," which is designed to share information about pieces of music that were created by using voice synthesizing software.

Coinhive is a web-based service for which provision was started by Coinhive Team in September 2017. The content of the service was as follows: Coinhive Team provides the operator of a registered website (hereinafter referred to as a "registerer") with a program code designed to acquire a program code (hereinafter referred to as the "Program") that executes mining, in which the Program causes the central processing unit of computers used by website viewers for viewing the website to perform calculations, such as approval work to add transaction records to the transaction ledger of a cryptocurrency, Monero, without the same viewers' consent, and the registerer can acquire the cryptocurrency as rewards if such calculations succeed; 70% of rewards is distributed to the registerer and Coinhive Team acquires the remaining 30%; if a registerer installs the aforementioned program code on his/her website, mining is executed by computers of website viewers and the registerer can acquire the distribution of rewards.

The mechanism of mining by Coinhive was as follows: if a viewer views a website on which the aforementioned program code is installed, the viewer's computer is automatically connected to a server computer, in which the Program is installed, by a command of the same program code, and the Program is read into the computer and the computer is commanded to perform mining; based on that command, the central processing unit of the viewer's computer performs calculations, and the calculation results are sent to the same server computer; mining ends if the viewer finishes viewing the website.

On September 21, 2017, for the purpose of gaining profits from viewers' viewing of X, the accused registered with Coinhive, installed a program code created by writing a site key allocated to the accused in the provided program code (hereinafter the created program code is referred to as the "Program Code") in X on the server computer, and put and stored it in a file that constitutes X for the period of the charged fact of this case. At the time of this case, a mechanism of having viewers' computers perform mining as the method of gaining profits from a website had not been acknowledged by general users. The accused stored the Program Code without establishing a system to obtain viewers' consent in relation to the performance of mining while they are viewing the website, and without giving any explanation about mining or indicating that mining is being performed.

In the Program Code, the accused set the value that adjusts the usage rate of the central processing unit of a viewer's computer at 0.5. In the case of this value, if mining is executed, the power consumption of a viewer's computer is slightly increased and the processing speed of the central processing unit thereof is reduced. However, the processing speed is not drastically reduced, and the degree of these influences is not so large that the viewer notices them. In addition, these influences were not significantly different from those of advertisement display programs that are widely executed on general websites (hereinafter referred to as "advertisement display programs").

No. 2 Judgment in first instance and judgment in prior instance

1. In the judgment in first instance, the court determined as summarized below in relation to whether the Program Code falls under electronic or magnetic records that give unauthorized commands, and acquitted the accused.

(1) It is reasonable to determine whether a program has the nature of being against the user's intention based on the capabilities of the program that are supposed to be generally recognized. X neither provided any explanation about mining nor possessed design functionality to obtain viewers' consent in relation to the performance of mining while they are viewing X. In addition, a mechanism of having viewers' computers perform mining as the method of gaining profits from a website had not been acknowledged by general users, and in light of the degree of load that is put on a computer by mining, it can be said that general users never notice the execution of mining. Taking these points into account, it cannot be said that general users should recognize the Program Code's capabilities to have computers of viewers of X perform mining. Therefore, the Program Code is found to have the nature of being against the user's intention.

(2) It is reasonable to determine whether a program has the nature of giving unauthorized commands in consideration of circumstances, such as usability and necessity for the operator and viewers, etc. of the website and influences and adverse effects on users, from the perspective of whether the content of the capabilities of the program is socially acceptable. In consideration of the following facts, it cannot be said that the Program Code had not been socially accepted nor is found to have the nature of giving unauthorized commands: [i] profits gained by the operator from the execution of the Program Code are beneficial to viewers in some aspects as they can be the sources of funds for the maintenance and improvement of the quality of the website; [ii] a reduction in the processing speed of viewers' computers, etc. caused by the execution of the Program Code is not so different from that caused by advertisement display programs, etc. and occurs only while viewers are viewing the website.

2. The public prosecutor filed an appeal to the court of second instance and alleged that the judgment in first instance contains an erroneous interpretation and application of the Provisions and an erroneous finding of facts. The judgment in prior instance determined as summarized below in relation to whether the Program Code falls under electronic or magnetic records that give unauthorized commands and ruled that the judgement in first instance erred in the interpretation of the Provisions and erroneously found facts. Based on this ruling, the judgment in prior instance quashed the judgment in first instance and sentenced a fine of 100,000 yen to the accused.

(1) Whether a program has the nature of being against the user's intention should be normatively determined based on the capabilities of the program that are supposed to be generally recognized from the perspective of whether the capabilities can be evaluated as not being against the general users' intention. Regarding a program that is not planned to be executed by a general user after he/she recognized its capabilities, the program should be found to have the nature of being against the user's intention in the case where it can be normatively evaluated that a general user does not permit the program to be used without his/her recognition of its capabilities in light of the content thereof.

The Program Code has the capabilities to have computers of viewers of X perform mining, and it does not plan to indicate the fact that mining is performed by the viewing of the website. Viewers of the website are not expected to acquire rewards arising from mining. In general, website viewers are considered to have approved the execution of programs that are necessary for viewing, but mining by the Program Code is not necessary for viewing. In addition, although mining by the Program Code puts certain load on viewers' computers, no profit is given to the viewers. Website viewers are not guaranteed the opportunity to know that their computers are used by mining and the opportunity to refuse to perform mining.

The Program Code such as this one gives no benefit to users but is only intended to make profits by using users' computers without their permission. It is thus clear that general users do not accept the Program Code. Therefore, the conclusion of the judgment in first instance that found that the Program Code has the nature of being against the user's intention is justifiable.

(2) The requirement of having the nature of giving unauthorized commands is intended to exclude the following case from the subject of regulation: where even a program that has the nature of being against the user's intention may be socially accepted from the perspective of the protection of trust in the program and appropriate data-processing by a computer, when considering advantages and disadvantages of the use of the program by a person who is assumed to be a user and whether there is a reminder of disadvantages that program users may suffer.

The Program Code causes certain disadvantages to viewers while it gives no benefit to them. In addition, the Program Code makes no indication, etc. of disadvantages. Therefore, it has no reason for being socially accepted from the perspective of the protection of trust in the program. Moreover, the Program Code uses viewers' computers for the benefit of a person other than viewers without their permission while they are viewing X. Therefore, it also cannot be considered to be socially accepted from the perspective of appropriate data-processing by a computer.

The judgment in first instance denies that the Program Code has the nature of giving unauthorized commands by citing circumstances mentioned in [i] and [ii] in 1. above. However, regarding [i], such benefit should not be realized by having users accept the execution of a program against their intention without their noticing it. Regarding [ii], advertisement display programs are generally executed in association with viewing and the execution results are also displayed, and they significantly differ from the Program Code in that point. Therefore, they are not suited for comparison with the Program Code. In addition, the major issue of this case is that the relevant program is a program by which a computer is used against the intention of the user of the computer. Therefore, even if a reduction in processing speed, etc. is at a level that is unnoticeable for the user, that fact does not affect whether the Program Code has the nature of giving unauthorized commands.

For the reasons described above, when mainly considering the capabilities of the Program Code, the Program Code is found to have the nature of being against the user's intention and the nature of giving unauthorized commands.

No. 3 The Court's decision

1. The provisions on crimes related to electronic or magnetic records that give unauthorized commands are intended to punish the creation, provision, storage, etc. of a program that gives unauthorized commands that are against the intention of computer users and are socially unacceptable based on certain requirements, for the purpose of protecting the trust of society in general that a program for data-processing by a computer will never give "unauthorized commands to prevent a computer from performing functions in line with the user's intention or have it perform functions against the user's intention" and also protecting the social functions of computers, in response to the situation where malicious programs that are executed on computers against the intention of their users have caused damage to society and have become a serious problem.

In light of such purport of the Provisions and interests to be protected thereby, it is reasonable to consider the nature of being against the user's intention and the nature of giving unauthorized commands of a program as follows.

That is, it is reasonable to consider that a program is found to have the nature of being against the user's intention in the case where functions actually performed by the program differ from functions that general users should recognize in relation to the program. In finding functions that general users should recognize, it is necessary to take into account the name given to the program, the content of explanations about the functions of the program, and possible methods of using the program, etc., in addition to the content of the functions of the program.

In addition, it is reasonable to consider that the nature of giving unauthorized commands is found in relation to socially unacceptable programs from the perspective of protecting the trust of society in general in data-processing by a computer and protecting the social functions of computers. In determining whether a program has the nature of giving unauthorized commands, it is necessary to take into account whether the functions of the program have any influence on the capabilities of a computer and data-processing by a computer, the degree of such influence, the methods of using the program, etc., in addition to the content of the functions of the program.

2. The functions of the Program Code are to use viewers' computers to have them perform mining while viewers are viewing X.

In light of the actual situation where advertisement display programs are widely executed on general websites as mechanisms for website operators to gain profits from viewers' viewing of their websites, it can be said that general users can assume the possibility of execution of a program that uses viewers' computers to a certain extent while viewers are viewing a website and causes the operator of the website to gain profits.

However, when considering whether it can be said that general users should recognize the functions of the Program Code as such program, the following circumstances are found: X was neither designed to obtain viewers' consent in relation to the performance of mining while they are viewing the website nor gave any explanation about mining or indication that mining is being performed; a mechanism of having viewers' computers perform mining as the method of gaining profits from a website had not been acknowledged by general users. According to these circumstances, it cannot be said that general users should recognize the functions of the Program Code, and the Program Code is thus found to have the nature of being against the user's intention.

3. The Program Code was stored in viewers' computers by the operator of X, the accused, without viewers' consent for the purpose of having the computers perform mining with the aim of gaining profits from viewers' viewing of X.

Certainly, as held by the court of prior instance, mining by the Program Code puts a certain load on viewers' computers without viewers' consent, and viewers cannot acquire any reward related to the mining. Nevertheless, viewers are not guaranteed the opportunity to know the execution of mining and the opportunity to refuse the execution of mining. A more appropriate method of use, etc. could be adopted from the perspective of trust in the program.

However, influences on the capabilities of a computer and data-processing by a computer, which are important circumstances in light of interests protected by law mentioned in 1. above, did not go beyond a certain degree of use of the central processing unit of viewers' computers while viewers are viewing X. In addition, regarding the degree of use, although the power consumption of viewers' computers was slightly increased and the processing speed of the central processing unit thereof was reduced, it is found that those changes were not so large that viewers noticed them.

Moreover, a mechanism for a website operator to gain profits from viewers' viewing of the website is important for the distribution of information by the website. The accused used the Program Code as such mechanism for gaining profits. In addition, even compared with advertisement display programs that are socially accepted as such mechanism, the Program Code is not found to significantly differ from them in the influences on the capabilities of viewers' computers and data-processing thereby. The Program Code is also similar to advertisement display programs in the method of use, etc. wherein the Program Code is executed without the prior consent of viewers of the website and uses their computers to a certain extent while they are viewing the website. These points can be considered to be within the socially acceptable range.

Furthermore, the content of the functions of the Program Code, mining, itself is a mechanism for ensuring the credibility of a cryptocurrency, and it cannot be said to be socially unacceptable.

In consideration of the content of the functions of the Program Code, the influences of the functions of the Program Code on the capabilities of a computer and data-processing by a computer, and the method of using the Program Code, etc. as mentioned above, the Program Code cannot be considered to be socially unacceptable and is not found to have the nature of giving unauthorized commands.

4. As mentioned above, the Program Code is found to have the nature of being against the user's intention but is not found to have the nature of giving unauthorized commands. Therefore, the Program Code cannot be found to be an electronic or magnetic record that gives unauthorized commands.

The judgment in prior instance should be considered to have seriously erred in the finding of facts as it erred in the interpretation of electronic or magnetic records that give unauthorized commands and did not appropriately take into account circumstances that should be taken into account in determining whether the Program Code falls under such records. These facts have clearly influenced the judgment, and it is found that it would be clearly contrary to justice if the judgment in prior instance were not quashed.

Accordingly, the judgment in prior instance is quashed pursuant to Article 411, items (i) and (iii) of the Code of Criminal Procedure. According to the aforementioned consideration, the judgment in first instance that denied that the Program Code falls under electronic or magnetic records that give unauthorized commands and acquitted the accused can be upheld. The appeal to the court of second instance filed by the public prosecutor alleging an error in the interpretation and application of the Provisions and an erroneous finding of facts is dismissed pursuant to the proviso to Article 413 and Articles 414 and 396 of the Code of Criminal Procedure as it is groundless in conclusion. The Court unanimously decides as set forth in the main text of the judgment.

Public Prosecutors, KIYONO Kenichi, KOGA Emi, and YAMAUCHI Yoshimitsu, attended the trial.

Justice YAMAGUCHI Atsushi

Justice MIYAMA Takuya

Justice YASUNAMI Ryosuke

Justice OKA Masaaki

Justice SAKAI Toru