Governmental Monitoring in Japan - PRISM Scandal?

As the PRISM scandal struck the U.S., there is a controversy over whether or to what extent the government may monitor private activities especially the ones online. The scandal is also widely broadcasted in Japan and last Tuesday, my friend (who is an associate professor at Chuo University) was interviewed live by a Japanese TV show. In Japan, there are two important issues regarding governmental monitoring of private activities.

First, there is a famous scandal of Tokyo Metropolitan Police Department Public Security Bureau. In late 2010, the bureau’s documents on alleged “terrorists” were somehow uploaded to a peer-to-peer network. What struck the Japanese society, especially foreigners residing in Japan, was that the police regarded the Muslim community in Japan as an organization in close connection with terrorists.  After the documents were disclosed, many protests occurred and finally, the police admitted that the information in the documents was the police information. This scandal reminded us how close and constant the police are monitoring us.

Second, another issue is the amendment of the Code of Criminal Procedure in 2011 (introduction of the Article 197-3) by which the police may ask information companies for the preservation of the data of a certain individual. This means that the police may ask for Facebook to preserve the communication log between User A and User B for 30 days and Facebook would have the obligation to comply with the request. Some opponents of the amendment called this a “cyber monitoring law.” 

It is difficult to tell whether it is a cyber monitoring law or not but one thing that is certain is that what this amendment enabled the police to ask is the preservation of past data not the retention of current and future data.  This means that currently the degree of the privacy invasion by the 2011 amendment is not very wide and strong. But we need to be careful about (1) whether the police may abuse the new authority to ask for retention and (2) whether the government will amend the code further to enable the police to ask for preservation, which would be more problematic than mere retention.

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.

Journalist "Cracker" and CFAA

The hottest issue of the Japanese ICT field is the "cracking" conducted by a journalist of a reputable news service. The journalist was gathering news on the high-profile fake blackmail case which I previously posted. Somehow, the journalist guessed the password of the suspect's web-mail account and browsed the inbox and other folders. As you may recall from my previous post, the Japanese version of the CFAA criminalizes the usage of fraudulently obtained ID/passwords and according to the Ministry of Internal Affairs and Communications, this password guessing was the most frequently used method of unauthorized access in 2008. So, it is likely that the conduct of the journalist is a prima facie CFAA violation. The question is whether the journalist's conduct can somehow be justified.

On this issue, the Supreme Court held that the freedom of news gathering for the news report deserves sufficient protection in light of the spirit of the (Japanese version of) First Amendment, in In Re Subpoena against RKB Mainich Broadcast Co., 23-11 Keishu 1490 (November 26, 1969). However, that does not mean that anything journalists do would be justified.

I already posted on one old case where a journalist who had a sexual relationship with a government official to obtain secret information was convicted. Further, in another old case, a journalist received a piece of important evidence from a criminal group and eventually burned it up (allegedly, to avoid being confused as a group member). The prosecutor accused him and he was convicted in People v. Doe, 703 Hanrei-Jiho 121 (Urawa District Court, September 27, 1972). The court stated that it was regretful that the journalist approached the information source without consideration and made intimate connections which resulted in him assisting the criminal group.

Relatively recently, two new cases were held. Although they do not directly deal with typical journalists, they are somewhat relevant. One case is an environmental protest group case. Group members, who wanted to investigate and report allegedly unlawful whale-hunting stole a piece of whale meat. Although they argued that it was necessary information gathering, the court did not buy the argument. The court held that even an investigation for public interest cannot be justified unless conducted so as not to invade other people's freedom and rights, and convicted them. This was an unreported case of Sendai High Court on July 12, 2011.

Another case is that a journalist approached a doctor who was appointed as an expert on a high-profile criminal case and had some secret documents of the case. The doctor lent her the documents and later she wrote a book using the information. Both the journalist and doctor were arrested but only the doctor was prosecuted and later convicted. Nara District Court stated although more deliberate and careful review was necessary in the case of journalist, as the doctor accused was only an information source, the level of scrutiny is different and was thus denied justification. People v. Doe, 2048 Hanrei-Jiho 135 (Nara District Court April 15, 2009). The conclusion of denying justification is affirmed by the Supreme Court in People v. Doe, 66-44 Keishu 405 (Feb 13, 2012).

As of now the information is scarce, and as a result, I cannot say whether the acts of a journalist "hacker" are justifiable. But three things can be said. First, prosecutors seem to respect the freedom of the press when they exercise their discretion on whether to accuse a suspect. So, there is a possibility that the prosecutors will decide not to accuse the journalist, like in Nara's secret document case. Second, once a journalist is accused, the chance of acquittal might not be very large considering the courts' attitude in two old cases. Third, the defense should focus on the distinction Nara District Court made (and Sendai High Court might have made implicitly) between real journalists and others (such as information sources or activist groups). The defense counsel can emphasize the fact that the journalist belongs to a reputable news service but, as I said, I am not sure whether this line of argument acquits the journalist. 

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.

Manipulation of User Created Contents

The user created contents are, especially in the context of reviews or comments of products or services, becoming more and more important. Before deciding which restaurant to go to, we check Yelp reviews and may also google the name of the restaurant to find user reviews on the restaurants. Many people seem to feel that user created contents are more reliable than the advertisements that companies create.

However, that is not always true. One of the most famous American examples of this sort is the Amazon paid review scandal where some review writers seemed to have received money for positive reviews.

Similar manipulation of a user created contents scandal happened twice last year. Around the beginning of the year, one famous review site for restaurants similar to Yelp called "Taberogu" was attacked by the mass media because more than thirty entrepreneurs offered to make up a positive review in Taberogu for restaurants and get paid in return. Japanese mass media called this technique "stealth marketing" (named after stealth aircraft).

Also, some famous entertainers in the Japanese show-biz world recommended an auction service on their blog, saying they could successfully bid for precious goods at a surprisingly low price. It would not have been problematic if they had actually successfully bid for the goods, but at the end of the year, it was revealed that they never engaged in bidding and just posted a fake picture of the auction site about winning the bid and received a lot of money in return. These stealth marketing scandals cast doubt on the assumption that user created contents are more reliable than company ads.

According to the amended guidelines by the Consumer Affairs Agency on the Act against Unjustifiable Premiums and Misleading Representations on B to C advertisement online, a substantial manipulation of the ranking by paying for positive reviews is likely to be a "fraudulent representation" prohibited by the Act. Also, it is likely that advertising through blogs by the auction site stating that people can buy things cheaply when they actually cannot would also constitute a fraudulent representation. But this is a matter of where to draw the line. It is difficult to say that all paid reviews are a "fraudulent representation." One example that is unlikely to be a "fraudulent representation" is if users are asked to upload a review of whatever contents (irrespective of positive, neutral, or negative) and promise to give them a discount in return. Where we should draw the line? This is a difficult issue to be clarified by the accumulation of court opinions.


DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.

Is Aaron's Law necessary in Japan?

After Aaron Swartz's death, a congressman proposed "Aaron's Law." One of the main points is to clarify and limit the ambiguous and extensive prohibition of the Computer Fraud and Abuse Act ("CFAA"). It is not the purpose of this post to explain US v. Nosal or other relevant cases of the CFAA in detail. Rather, this post will discuss the question of whether Japan needs to amend its equivalent CFAA.

The Act on the Prohibition of Unauthorized Computer Access (the "Act") is the Japanese equivalent of the CFAA. The basic concept of the Act is to ban two types of "unauthorized computer access". 

The first type is misuse of fraudulently obtained ID/password (or other authentication information). A typical example is that A obtains B's ID and password by social engineering (fraudulently) and uses B's ID and password to access an Internet site protected by access control function (namely, the password authentication function). Article 2(4)(i) of the Act.

The second type is making use of the security hole. If there is a security hole, an originally impossible access to a computer (because of the access control function) becomes possible by the insertion of special information or a command. Such access is also prohibited by the Act. Article 2(4)(i) and (ii) of the Act.

I believe that compared to the CFAA, the prohibited acts of the Act on the Prohibition of Unauthorized Computer Access is more limited and clearer. The requirement of "fraudulently obtained" authentication information plays a significant role in the password misuse type unauthorized access. Let's say that Company A employs B. And B is an authorized administrator of Company A's server which is password protected. As an administrator, B obtains IDs and passwords of users of the site. What happens, if one day, B changes her mind and decides to make use of the IDs and passwords and obtain the information stored in the server for an evil purpose (perhaps B decided to quit company A and wanted to search for "useful" information for when she goes to a competitor company)? That is not a violation of the Act because B did not "fraudulently" obtain the IDs and passwords at the time B obtained them. Although that conduct might be a violation of the Unfair Competition Prevention Act which protects trade secrets, that is a different law. The Japanese version of the CFAA will not criminalize users of the sites protected by the access control functions as long as they are using their ID/password they originally lawfully (or at least non-fraudulently) obtained.

In 2012, there was a reform of the Act to make it more strict. However, the definition of "unauthorized computer access" remained unchanged. Some of the amendments are: (1) the maximum penalty for unauthorized computer access of one year imprisonment and a five hundred thousand yen fine (around $5,000) was increased to a three-year imprisonment and a million yen (around $10,000) and (2) the fraudulent acquisition of ID/passwords (such as through phishing) itself became criminalized. 

Because of this, I think that this point perhaps might be relevant in Japan.  However, Professor Lawrence Lessig argued that the "corruption" of the legislative system was the cause of the problematic laws such as the CFAA and other laws, and that the corruption problem should be changed by Aaron's Laws. I think that this point perhaps might be relevant in Japan.

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.

Japanese High Profile Cyber-Criminal was Arrested

The most high-profiled cyber-crime in Japan last year was the "fake" blackmail case, which framed many innocent people. Several people were arrested by the police for sending threatening emails. One assistant director of animation films was not only arrested but also accused of sending an email threatening a massive killing. Before conviction, however, it was revealed that these emails were sent by a special computer virus. All those arrested were released and the prosecutor revoked the accusation to the assistant director.

What is important for the virus writer was that he (or maybe she) sent announcement emails to the mass media, claiming that the Japanese police were incompetent and couldn't tackle with cyber-crime. Also, the perpetrator even sent a puzzle to the police, saying that if the police could solve it, they would get a clue of the suspect. The police solved the puzzle and went to the designated place where they found a cat with a choker ring on which an SD card was attached. These scenes have been broadcasted by the media again and again and the Japanese people were horrified by the unknown and terrible computer virus.

On February 10, the police announced that they had arrested a 30 year old man in Tokyo as the suspect of the cyber-crime. According to the media, the clue was on the SD card. The message on the card said: "My life was ruined by the false charge." The police claims that the arrested person had actually been convicted of sending a threatening message regarding the conflict between the users of a bulletin board, called "2ch", and Japanese major record company, Avex, about unlicensed usage by Avex of a character loved by 2ch users called "Mona."

As the arrested seems to be claiming his innocence, it is not clear at this stage whether he is the real cyber-criminal. However, what I found most important regarding this case is that the Japanese police forced many people to make false confessions during the interview. Most of the arrested framed by the virus writer eventually "confessed" to sending threatening emails. However, this was not true. The reason they confessed was because of the police's strong pressure during the interview. Although I admit the unique nature of Japanese criminal law which makes confessions important (such as the emphasis on the state of a criminal's mind), I think that the lesson of this case for the police is to reflect on themselves and refrain from applying too much pressure during an interview.

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.

Isamu Kaneko - Japanese Aaron Swartz?

The tragic suicide of Aaron Swartz invoked a controversy over many issues including the ambiguity of the CFAA.

In Japan, there was a possibly comparable case called People v. Isamu Kaneko, or "Winny Case." Isamu Kaneko is a programmer who has a doctoral degree from Ibaraki University and was selected as a member of Exploratory IT Human Resources Project by the Information-technology Promotion Agency, Japan (IPA). As a programmer, he released a very innovative software in 2002 called Winny.


Winny is a P2P file sharing software which solved some of the problems the existing software had. (As the existing software was called win"MX", the software was called win"NY" using following letters of the alphabet.) The most innovative point is that Winny worked purely peer to peer. That means that Winny does not need any central server containing the information of the clients. Old P2P software had central servers and they often crashed, resulting in huge system failures. Without them, Winny network is very stable and reliable.

However, after Dr. Kaneko uploaded the software, it was welcomed by many Japanese Internet users who wanted to share video clips or music files with others. Of course, like Napster, most of such files are shared without authorization of rights holders. What happened is that the police found Dr. Kaneko as the symbol of the evil of copyright infringement and arrested him. In 2004, he was accused of the "assistance" of copyright infringement. Note that in Japan, although there is no general "conspiracy" crime, mental or physical "assistance" of an actual crime constitutes a crime.

The case continued for six years. After he was found guilty in the first instance court in Kyoto (December 13rd, 2006), he was found not guilty in Osaka High Court (October 8th, 2009). In Japan, the prosecutor may appeal to the judgment of an acquittal. The prosecutor appealed to the Supreme Court and on December 20th, 2011, the court rendered a 4 to 1 split judgment whereby the majority opinion affirmed the Osaka High court's acquittal. (We have a double jeopardy principle, but it is understood that the principle works only after the final and binding judgment.)

The majority opinion found that what he did was objectively an assistance to copyright infringement. However, Japanese criminal law requests subjective intent of committing a crime of assistance. As Dr. Kaneko did not recognize that "not exceptional percentage of users" were using Winny for copyright infringement, he was barely acquitted.

There are some criticisms. One is that the threshold for the crime of providers of neutral tools should be higher. Some contend that Winny can be used for both lawful and unlawful purposes like a knife. In a crime-filled neighborhood, not an exceptional percentage of buyers of knifes would use them as tools for crimes. According to the Supreme Court's standard, the knife seller would be guilty of assistance crime in this hypothetical. The opponents to the majority opinion contend that the threshold to find a tool provider to be guilty should be very high.

I am personally interested in another aspect of the case. From the arrest in 2004 and until acquittal in 2011, Dr. Kaneko needed to concentrate on defending the case, not on programming. That 5 years might have enabled him to develop other innovative software. This means that the prosecution itself might have deterred innovation. Considering Dr. Kaneko's case and Aaron Swartz case it may be safe to say that the prosecution should be decided with utmost caution when it comes to the leading-edge conduct of innovative people, considering the potential long-running damage to the society.

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.

Criminalization of Unauthorized Downloading

One news from Japan that surprised foreign technology lawyers was that Japan criminalized unauthorized downloading by individual users.

Recently, Japanese copyright law is becoming stricter and stricter. The illustrative issue is a strong measure for unauthorized downloading.  Before 2010, only those who uploaded the copyrighted materials were infringing copyrights (subject to both civil and criminal liability). This means that it was not illegal just to download such unauthorized materials for private usage.

Reflecting the decrease of sales of CDs and DVDs, there is strong lobbying to prevent unauthorized downloading.  As a result, in 2010, unauthorized downloading was "illegalized." But at that time, downloaders only faced civil liability, not criminal liability.

However, on October 1st 2012, the amended Copyright Act was enacted, which mainly criminalizes unauthorized downloading.

One thing to note is that not every kind of downloading is criminalized. The five prongs for the crime of unauthorized downloading are:(1) knowingly conducted (in contrast to "negligently")(2) digital recording (in contrast to mere "streaming") of (3) recorded works (in contrast to "mere text or picture") (4) which are provided to the public for value (in contrast to "provided for free") and (5) are automatically transmitted to the public infringing copyright (i.e., illegally uploaded to the Internet).

Prong 1 means that negligence (or even gross negligence) is not sufficient to establish criminalization.

Prong 2 means that watching 'Japanimation' with fansabs through Youtube or other streaming sites is not likely to be criminalized.  (You don't have to be worried about caching under the interpretation of the Japanese government.) 

Prong 3 means that the unauthorized downloading of comics or novels is not likely to be criminalized.

Prong 4 means that they criminalize only the downloading of unauthorized works which compete with CD, DVD, or commercial downloading services (like iTunes). Downloading TV shows, in general, is not criminalized (because they can be viewed for free in general).


Prong 5 means that receiving copyrighted work through email attachments is not criminalized.

Further, according to Article 123 Section 1, the crime of unauthorized downloading is an offense subject to prosecution only on complaint from the victim (rights holder). See the possible effect of TPP on complaint requirement in my another blog article: "TPP's Effect on the Fanzine Environment"

There might be some arguments on the criminalization of unauthorized downloading. Some may see this to be narrowly tailored to respect the freedom of the Internet considering the above restraints. Others criticize the sudden introduction, saying that the government did not show the change in circumstances in the last two years which necessitates criminalization (i.e., the government did not show any empirical evidence that
illegalization was not enough).

I believe that the evaluation of the criminalization depends largely on how it is enforced by the police and prosecutors. Until now, there has been no case. The first criminal case of unauthorized downloading would be a
good touchstone to evaluate the newly enacted amendment.

DISCLAIMER: "IT Law issues in Japan" only provides general information about Japanese information technology law and does not, under any circumstances, constitute legal advice. You should first obtain the advice of professional legal counsel who is qualified in Japan before acting or refraining from acting based on this blog.