I'm not sure what the draft is really about.

State AGs have broad powers to conduct investigations in the public interest. They issue subpoenas in the course of those investigations, to parties out of state as well as in-state. There's nothing unusual about those actions here. The motion to quash the subpoena failed; that decision could have been appealed and might have been overturned, but probably not. So the party subpoenaed, after exercising its right to due process, complied. There is no evidence presented that the subpoena in some way terminated the project. We are hardly short of crypto-mining malware in the world right now. Some of my clients at SFLC who develop cryptocurrencies like Monero find that surreptitious mining produces a large part of their monetary base.

So what has this nearly decade-old instance of one AG subpoena to one software project got to teach us about anything? The next draft could be improved by more legal context and a clear focus not on an incident but on an issue.

Restricting Personal Rights to Protect Privacy

-- By Hiroyuki Tanaka - 11 Mar 2022

Cryptojacking

Tidbit Case

In December 2013, a month after Hackathon, the New Jersey Attorney General's office issued a sweeping subpoena to Rubin and Tidbit. The subpoena sought for all information in regard to Tidbit, including but not limited to, all documents concerning Tidbit’s source codes, control logs and installation logs, as well as the Bitcoin accounts and wallet addresses associated with Tidbit. Rubin resisted, and moved to quash the subpoena, but in the end, the superior court of New Jersey Essex County concluded to give a green light for the State to investigate Tidbit under the necessity of protecting personal privacy. It stated that “the Court is mindful… of the State’s concerns that this tool could also be subject to abuse and misuse.” This decision virtually compelled Rubin to enter into a consent order in May 2015, ending New Jersey's investigation of Tidbit. Soon after this order, Tidbit was demolished.

Investigation Rights

The first issue is the State’s absolute discretion granted to investigate codes on the internet. The rationale of the State of New Jersey was to seek “information as to whether there may be violations of the privacy rights of New Jersey citizens and whether Tidbit can be used as a vehicle to hijack consumer’s computers.”

However, Tidbit was merely a “proof of concept” and was never implemented. Even if it were actually implemented as the State of New Jersey argued, the operation of Tidbit was apparently minimal since the subpoena was issued immediately after the Hackathon. Moreover, the purpose of Tidbit was useful and legitimate rather than subject to abuse and misuse, which the State of New Jersey even agreed by admitting that, nothing “evidences an inherently improper or malicious intent or design” by Rubin or Tidbit. Lastly, there was nothing technologically distinguishable between Tidbit and online advertisements as they both operate in a similar manner, and even in those days online advertisements could be found everywhere on internet. Overall, the danger of Tidbit violating personal privacy seems to have been extremely abstract.

Therefore, the rationale to protect New Jersey consumers’ privacy ironically functioned as a justification to restrict nation’s rights, with no actual cause.

Scope of Investigation

The problem of allowing state laws to restrict out-of-state residents’ rights, is its potential width of the scope. Different state laws altogether virtually can form an unlimited surveillance system across the nation. This surveillance network can be expanded globally too, with each country imposing a restriction of its own. For example, cryptojacking in Japan is criminalized in general.

Conclusion

• #Set ALLOWTOPICVIEW = TWikiAdminGroup, HiroyukiTanaka
• #Set DENYTOPICVIEW = TWikiGuest

Note: TWiki has strict formatting rules for preference declarations. Make sure you preserve the three spaces, asterisk, and extra space at the beginning of these lines. If you wish to give access to any other users simply add them to the comma separated ALLOWTOPICVIEW list.