Pay the Devil in Bitcoin: The Creation of a Cryptocurrency and How Half a Billion Dollars of It Vanished from Japan (Kindle Single)

by Jake Adelstein

  Karpelès, a Japanophile, may have been expected to behave like a good Japanese suspect and confess to the charges against him—even if he hadn’t committed any crime—so they could close the case. That’s what innocent people had done in another big cybercrime case. That case, ironically, had also involved a portly computer geek with a fondness for cats.

  The difference here was that the geek might actually be innocent.

  CHAPTER SEVEN

  PRESUMED GUILTY UNTIL PROVEN GUILTY

  Ask yourself this: If Mark Karpelès had 650,000 BTC stored away somewhere, why hadn’t he run off to a desert island like Roger Ver? He could have been living it up in South America or somewhere with a new passport and a new life instead of rotting in a Japanese holding cell. If he was guilty, why did he work so closely with the Japanese police and give them access to all his data? Why not erase the data before going bankrupt and get away with being charged with a relatively minor offense?

  This strategy had worked brilliantly for the head of Incubator Bank of Japan several years before.

  Incubator Bank of Japan filed for bankruptcy in September 2010 at the Tokyo District Court after overexpanding and engaging in a number of allegedly illegal transactions, which resulted in it being closed down. The collapse could have rocked the foundations of Japan’s finance system, but the media downplayed it. It was the country’s first bank failure in seven years, and also the first case since the government limited the deposit guarantee to ¥10 million. Incubator Bank had excessive liabilities of ¥180.4 billion.

  Takeshi Kimura, the chairman of the bank, ordered records to be destroyed as he got wind of the Financial Services Agency (FSA) getting ready to launch an investigation. He was found guilty of obstructing an FSA inspection and given a suspended one-year prison term. He never even served time in jail. It was a case that proved that if you’re well connected and eliminate evidence, you may get away with being charged for a much lesser crime.

  Karpelès could have tried a similar tactic. He could easily have wiped out almost all the transaction records and all the data in the servers, leaving little to investigate except for banking records. He didn’t. He gave the data to cybercrime experts and the police, and he personally tried to figure out what had happened.

  Kim Nilsson, the cybersecurity pro who has now spent several years looking at the Mt. Gox problem, isn’t sure who created Willy, the trading bot that may have generated huge losses for Mt. Gox, but he is sure that there was a massive theft of bitcoins—perhaps several thefts—which the Japanese police have failed to fully investigate.

  He agreed to answer our questions for the book, but on condition that we vetted the results with him, to make sure there were no misunderstandings and because he was still involved in the case.

  This is the discussion that took place:

  Q: Do you have an idea of the scale of the theft?

  A: It’s counted in the hundreds of thousands of bitcoins. It started in autumn 2011, and continued throughout 2011 and 2012. In 2013 it slowed down, mainly because Mt. Gox was empty of bitcoins.

  Q: Did the theft occur through a bot or hacking?

  A: We can’t be one hundred percent certain, but probably someone hacked Mt. Gox and in one way or another got access to the private keys.

  Q: Where the hacking comes from is very difficult to figure out in this day and age. Do you have any idea where it was from? Is it even possible to say geographically?

  A: Many people online like to speculate that maybe Mark Karpelès took all the bitcoins himself, but I doubt he would have carefully siphoned off money in this fashion when he could have just spent it directly. Mt. Gox was compromised by hackers on several occasions [as shown by the leaks of internal data], so it’s to be expected that hackers were behind the running theft as well. As for their location, that’s just one of many things that has to be deduced indirectly from the available evidence.

  Q: When will you be able to definitely find out where the bitcoins went?

  A: Figuring that out, in terms of the blockchain, isn’t very hard. Let’s imagine that a thousand bitcoin addresses were used to receive the stolen bitcoins. Identifying the thousand addresses is the relatively easy part [given that you have enough data]. The tricky bit is identifying who owns the addresses.

  Nilsson has gigabytes of data and documents that show Mt. Gox was hacked and bitcoins were stolen. But for the sake of argument, let’s suppose it was all a ruse—that Karpelès was pretending to seek the real culprit to cover his own guilt. To refute this, a special agent working with Homeland Security told us in August 2016:

  I believe that the majority of the hacks took place while Mark Karpelès was moving the bitcoins into cold storage. It’s an ongoing investigation that involves US jurisdiction so I’m limited in what I can say, but there was a flaw in the process and in the system he used to store the bitcoins. Now it could be argued that Karpelès should have realized what was going on and that his failure to do so is incredibly negligent—perhaps even criminally negligent. That doesn’t change the fact that he was a victim of a group of very skilled hackers. He’s the victim, not the criminal, and that’s something the Japanese police should be more focused on. And they aren’t. They could get to the truth if they wanted to or if they were willing to cooperate with the US government.

  Federal law enforcement agencies in the United States are very interested in the Mt. Gox case, but not because they want to clear the good name of Mark Karpelès; they believe the non-Japanese hackers who looted Mt. Gox have done the same to other exchanges in US jurisdiction. In addition, they are almost certain the stolen bitcoins were laundered by a mysterious entity known as the Keyser Söze of bitcoin money laundering. They asked the Japanese authorities for the full database of Mt. Gox to further their own investigations. Their request was refused.

  Unfortunately, the Japanese justice system seems to be designed less to uncover the truth than to convict someone once they have been formally prosecuted.

  Japan’s criminal justice system has a stunning 99 percent conviction rate (which gives an ironic twist to the lucky “1 percent”). Their success could be because their police and prosecutors are just wonderfully efficient. But six years after an effort at major reforms began, it’s clear that those statistics have less to do with efficiency than forced confessions, trumped-up charges, professional judges’ lack of sound judgment, and prosecutors’ misconduct.

  Japan’s prosecutors are also notorious for junking cases that aren’t pushovers, one reason why more than half of the men arrested for sexual assault or rape aren’t ever prosecuted. Out of those cases, 53 percent never go to trial.

  On May 21, 2009, Japan introduced a modified jury into the courtroom, in what’s known as the lay-judge system. It was supposed to encourage reform and, according to Japan’s Ministry of Justice, deepen the citizenry’s understanding of the law.1

  Well, the verdict is in, and the majority’s opinion is this: for all practical purposes, Japanese courts operate on the principle of “presumed guilty until proven guilty.”

  Even if you are actually lucky enough to get a lay-judge trial and be found innocent, your innocence may last only until the prosecution appeals.

  Double jeopardy? No problem in Japan, where the prosecution not only can appeal a not-guilty verdict but almost always does.

  Under this new system, in cases that might result in the death penalty or other severe punishment, six lay judges are chosen from among thousands of eligible candidates of voting age to sit with three professional judges. At least one professional judge must agree with the lay judges, and a simple majority is required to determine the verdict.

  According to Japan’s Supreme Court, as of the end of March 2014 the lay-judge system had sentenced 6,396 people. Thirty-four of the defendants brought to trial were found not guilty, meaning precisely 99.468 percent were convicted.

  Defenders of the system say this may not be as bad as it sounds. They point to a recent Supreme Court deci
sion that told prosecutors they could no longer appeal a not-guilty ruling unless they had good reason to. “It reinforced the idea that the system is supposed to work as ‘innocent until proven guilty,’” says Hiroshi Shidehara, a defense lawyer and member of the Japan Federation of Bar Association’s Lay Judge System Board.

  “I think it has made prosecutors less likely to challenge lay judge decisions.

  “Up till now, in 90 percent of the cases where a defendant has been found not guilty, the prosecution kept appealing until they got their standard guilty verdict,” says Shidehara. To the best of his knowledge, there were only four or five instances where lay judge not-guilty verdicts had been overturned successfully.

  The late, great defense lawyer Makoto Endo said to me (Jake Adelstein) in 1994 over drinks that criminal trials in Japan are “absurdist farces that all end with the same last word: guilty. The prosecution is good. The judges are their deputies. The accused is a bad character who should be punished. Occasionally, one of the actors flubs his lines so badly that a not-guilty verdict results or a judge engages in a surprise act of moral conscience that changes the whole ending of the play. These mishaps are rare.”

  To back this up, a former Supreme Court judge has written that judges who regularly give not-guilty verdicts are liable to be sidelined or sentenced to preside over courts in remote parts of the country.

  When Japan had a standard jury system, from 1928 until it was suspended in 1943, the conviction rate was around 82 percent. After the war, the system was never revived, and the new system, in which verdicts were determined by professional judges, ensured that the wheels of justice turned with little or no resistance.

  Another noted defense attorney, Hiroyuki Kawai, calls criminal cases in Japan “hostage trials.” He explains that from the time you are arrested, including the forty-eight hours you may spend in police custody, you can be held for a total of twenty-three days—and you are not guaranteed the right to see a lawyer. Your lawyer may not be present during interrogations. Your lawyer might also fail to inform you of your right to remain silent.

  Meanwhile, suspects are routinely interrogated for up to eight hours a day, loosely recorded by the police. Suspects have no access to clocks. It is a breeding ground for false confessions.

  “The accused is routinely denied bail and held in confinement—unless they confess,” said Kawai in an interview. “If they don’t confess, they are assumed to be susceptible of destroying evidence that would convict them, which presumes that they’re guilty in the first place. If they do confess, then later plead innocent, the judge is unlikely to believe that the confession was coerced—and they are almost sure to be found guilty.” He also notes that if a lawyer is actually unable to meet with a client, building an effective defense is next to impossible.

  In reality, the prosecution has all the cards and is not even obliged to show all the evidence it possesses to the defense. According to David T. Johnson, an expert on the subject and author of The Japanese Way of Justice: Prosecuting Crime in Japan, there have been several cases in which prosecutors concealed critical evidence that would have exonerated the accused, but such conduct is not considered indictable.

  There has been at least one case of a prosecutor tampering with evidence to convict the accused.2 Another former prosecutor, after resigning from office, published a book in which he apologized for browbeating innocent people into making false confessions and noted that he had been educated during his training to believe that “yakuza and foreigners have no rights.”3

  In March 2014, former boxer Iwao Hakamada was released from prison after spending forty-five years on death row. The court finally accepted DNA test results submitted by his lawyers that strongly suggested investigators had fabricated evidence. One of the original judges in the first trial admitted in 2007 that he believed Hakamada was innocent, but the judge was overruled by the two senior judges on the panel and forced to submit a guilty verdict. He resigned seven months later.

  In 2003, I (Jake Adelstein) asked a functionary of the Chiba District Public Prosecutor’s Office about its refusal to accept evidence from the Belgian police that might exonerate a foreigner, Nicholas Baker, accused of drug smuggling. The response was a look of bafflement. “Why would we want new evidence that might weaken our case, when we already have enough to convict him?” he said.

  This was standard prosecution thinking: it wasn’t about justice, but about winning or saving face. Sometimes it also resulted in the guilty going free. A detective in the Criminal Investigation Department of the Osaka Prefectural Police admitted that generally the prosecution only took on a case if victory was certain. So if the accused didn’t confess, the police would drop the case, and it didn’t even go to trial. “This means that smart criminals who know the system get off.”

  A good example of how unjust the system can be—and the danger of both police investigations gone bad and a process that prizes confessions over evidence—can be found in a case with some similarity to that of Mark Karpelès. This also involved an expert hacker, a cat, and some innocent people.

  The Japanese police launched an investigation into a series of death threats made by a hacker, starting in the summer of 2012.4 The lone cyber malcontent posted the threats on various Japanese websites and sent e-mails warning of violent attacks.

  The investigation led to four false arrests and a major loss of face.

  At the beginning of July 2012, the police made their first arrest: a nineteen-year-old student attending Meiji University in Tokyo. His prosecutor was the same as Karpelès’s, Mr. Hatsumata.

  In the same month, the true hacker posted on the Osaka City website: “There will be a massacre in Osaka’s pedestrian paradise. I will run over people with a truck, stab some at random, and then kill myself.”

  The post resulted in the arrest of an anime creative director who was indicted even though he continued to profess his innocence. By the end of September, the Tokyo Metropolitan Police Department (TMPD), along with the Osaka, Mie, and Fukuoka police, had arrested two more people in connection with the threats.

  Seven months into the investigation, in February 2013, they finally seemed to catch the right guy.

  A joint investigation task force, led by the TMPD, arrested Yusuke Katayama, a thirty-year-old IT worker, on the charge of forcible obstruction of business. He had allegedly posted a threat on the popular Internet bulletin board 2channel in August 2012, saying that a mass murder would take place at a manga convention in Tokyo.5 This caused chaos and disrupted the event. Katayama apparently used a virus to take over an innocent man’s computer to post the message. He was suspected of committing at least three other similar crimes. Via his lawyer, he denied the charges. Although the FBI presented evidence that linked Katayama to a US server used in the crimes, with four mistaken arrests weighing on their shoulders the police proceeded with due caution.

  By this stage, the search had given the lone hacker national attention as he made a fool of the country’s law enforcers and challenged them to catch him with clues, taunts, false leads, and cryptic riddles.

  His undoing seems to have been a final puzzle he set, which was hidden in the collar of a cat on one of Japan’s islands.

  At first, the police had no idea they’d been arresting innocent people. Everything changed, however, in October 2012, when e-mails claiming responsibility for the crimes were delivered first to Yoji Ochiai, a lawyer in Tokyo, and then to Tokyo Broadcasting System, as well as other media. The messages stated, “I am the real culprit,” and were sent from a man using the name Oni Koroshi (“Demon Killer”). Oni Koroshi is also the name of several different brands of sake, including one cheap version much loved by the police (and reporters) and sold in packs for one hundred yen (about one dollar) in convenience stores. The e-mails contained details of how the crimes had been committed, which only the culprit could have known. Demon Killer discussed the way he had spread a Trojan horse virus (in Japan sometimes called a “remote-control virus”) vi
a online bulletin boards and then remotely controlled the host computers to post the death threats.

  In his e-mail to Ochiai, he said his motive was not to enjoy seeing innocent people put in jail but “solely to trap the police and prosecutors and expose their failings to the world.” He insisted that he always had intended to confess to the crimes, in due time, and save those who had been wrongly accused. He chose Ochiai because he happened to see the lawyer on TV.

  The revelations in October began a cat-and-mouse game between Demon Killer and the police. The e-mails were made public, and by the eighteenth of the month, Yutaka Katagiri, chief of Japan’s National Police Agency (NPA), publicly admitted that there might have been several false arrests. A day later, a new joint investigation task force was set up to get to the bottom of the crimes. By December, all four individuals who had been apprehended were cleared of all charges. On December 12, the NPA offered a reward of up to ¥3 million (approximately $36,000 at the time) for information leading to an arrest.

  According to NPA sources, the cybercrime squads in each police department had determined the IP addresses of the computers used to make the threats, but hadn’t gone further to see if the machines had been affected by viruses or had malicious software installed that would make them platforms for cybercrime. According to the Mainichi newspaper, none of the detectives initially investigating the case even knew of the existence of remote-control viruses.

  Demon Killer, aware of the police department’s inability to effectively conduct a cyberinvestigation, taunted them in e-mails to the press and even direct messages saying, “Thanks for playing with me.”