BitFlyer Sale Shines Light on Japan’s Security Failings

A $3 Trillion Industry

BitFlyer, one of Japan’s largest crypto exchanges, recently began negotiations with Japanese and overseas buyers regarding the sale of its business. As negotiations progressed, however, it was revealed just how far Japan lags the world in terms of economic security. The question is whether Prime Minister Kishida Fumio’s government can implement measures that will bolster Japan’s economic security and enable Japan to reestablish sovereignty over its data.

Around the world, quantitative easing performed by central banks in response to the COVID-19 pandemic has bolstered financial markets. In particular, cryptocurrencies, digital assets that exist in cyberspace, overcame their recent slump to rally significantly. According to cryptocurrency market website CoinGecko, as of November 9, 2021, the world’s cryptocurrency was worth over $3 trillion, with Bitcoin, the most traded cryptocurrency, trading for a record $67,000 per unit.

Cornering the Japanese Market

Cryptocurrency has also gained popularity in Japan, where trading volumes are increasing, and BitFlyer in particular boasts one of the highest trading volumes of any Japanese exchange. Rivalling Monex-owned Coincheck, BitFlyer is one of Japan’s leading exchanges and boasts more customers than any other Japanese exchange.

BitFlyer is the creation of Kanō Yūzō and Komiyama Takafumi, who at the time both worked for Goldman Sachs. Allowing customers to trade 13 different crypto currencies, including Bitcoin, BitFlyer also operates overseas. Kanō, who previously headed up BitFlyer Holdings, commands a major presence on the Japanese cryptocurrency market, having led the creation of and serving as director for the Japan Blockchain Association.

Kanō, also a major shareholder in BitFlyer, has led an unusual career that saw him switch from an engineering to a trading role within Goldman Sachs. He is an influential figure in the nascent industry, having lobbied Digital Transformation Minister Hirai Takuya to put in place a national blockchain strategy in October 2020. Around the autumn of that year, Kanō began considering a startup exit strategy that would see BitFlyer acquired by or merged into another company. In Japan cryptocurrency trading exchanges are required to register under the Payment Services Act and Cabinet Office order, but no restrictions are generally imposed on sale of these companies.

Looking into Huobi Japan?

Interest was expressed in BitFlyer by prospective buyers from both Japan and overseas. Sources say that while Kanō intended to sell for somewhere on the order of ¥100 billion, bids from major Japanese crypto finance brokerages were less than half of that. It was Huobi Japan—a subsidiary of the Chinese cryptocurrency exchange Huobi, one of the world’s largest in terms of both number of users and transaction volume—that made the highest bid, and therefore received preferential negotiating rights. Huobi Japan is headed by Chen Haiteng, a businessman who hails from China’s Fujian Province. Chen graduated from a Japanese university and served as the CEO of both a Japanese tech company and the Japanese subsidiary of China’s largest search engine, Baidu, before assuming his current role.

Huobi was established in Beijing in May 2013 by Li Lin, a computer engineer with a degree from Tsinghua University. Huobi immediately became China’s largest crypto exchange and reported a total groupwide transaction volume over 2 trillion yuan (approximately ¥35 trillion) in 2016. At one point, Huobi was the world’s largest crypto exchange, handling 60% of the world’s Bitcoin transactions.

In September 2017, however, the Chinese authorities suddenly announced a ban on cryptocurrency trading. Having long advocated cyber sovereignty and even preparing to issue a digital currency, the “e-yuan,” the authorities decided to banish cryptocurrency, which they saw as a violation of the sovereign right of the state to issue currency. The authorities did allow crypto exchanges to operate overseas, however, and Huobi subsequently moved its headquarters to Singapore before launching its Japanese, US and South Korean businesses in 2018. In November 2018, the Communist Party of China news site reported that the CPC had established a committee within one of Huobi’s Beijing-based subsidiaries, and that Li had made a speech to mark the event, thereby illustrating the ongoing close relationship between Huobi and the Chinese authorities even after restrictions were introduced.

Japanese Law Powerless Against Data-Sharing

In Japan, there are no restrictions on the trading of cryptocurrency on exchanges. Rather, the issue is the restrictions put in place by Huobi’s native China in 2017 and again in 2021, and the cyber security and data security laws enacted in the same years, respectively. Under these laws, data collected in China must generally be stored on servers located in China, and the transfer of data overseas is restricted. By contrast, Japan imposes no restrictions on the transfer of data overseas. In other words, if Huobi acquires BitFlyer, it will not be prevented from transferring the latter’s data to China.

Around the time of the negotiations between BitFlyer and Huobi, US President Donald Trump issued an executive order demanding that the US subsidiary of TikTok, a video-sharing app operated by Chinese-owned ByteDance, be sold to a domestic company, in response to suspicions that TikTok was sharing information with the Chinese government. While President Joe Biden subsequently annulled the order, investigations into TikTok continue, and the United States remains wary about China, which has made personal data collection a national policy. In contrast, the Japanese government did not attempt to impose restrictions on the BitFlyer sale negotiations because opinion within Japan’s Financial Services Agency was divided between a rapprochement camp that approved of the transaction, which it argued was not subject to legal restrictions, and hardliners who opposed the transaction and called for the invocation of the Foreign Exchange and Foreign Trade Act to stop it.

Huobi’s Failings Revealed

For its part, the Financial Services Agency investigated Huobi Japan over failings in its internal controls after multiple employees blew the whistle on the company’s noncompliant personal identification procedures.

However, Huobi Japan was itself born out of another Japanese crypto exchange called BitTrade, which became a wholly owned subsidiary of the Huobi group in September 2018. Possibly in recognition of the fact that foreign companies have taken over Japanese crypto companies in the past, and by way of concession to Japan’s economic relationship with China in the form of trade and other activity, the Financial Services Agency eventually gave its tacit approval to BitFlyer’s negotiations with Huobi, thereby increasing the likelihood that the personal data of Japanese cryptocurrency traders would be leaked to China.

Ultimately, the negotiations between Huobi and BitFlyer fell through, and ironically, the Chinese side was to blame. During negotiations, the Chinese authorities investigated Huobi. China tightened controls on crypto exchanges in 2020, citing the need to prevent money laundering and fraud. While Huobi wanted the negotiations to be suspended until after the Chinese authorities had finished their investigation, BitFlyer refused to cooperate with the request, causing the negotiations to founder.

In September 2021, China announced an across-the-board ban on the mining of cryptocurrency, including mining by Chinese entities that took place outside China. The Chinese government said it would freeze accounts created with Huobi and other exchanges in Chinese territory. While the Chinese authorities’ data sovereignty policy increased the risk that the personal data of Japanese cryptocurrency users would be divulged, the restrictions imposed on crypto assets by those same authorities ultimately removed that risk. Later, though, the vulnerability of Japan’s data sovereignty would be revealed.

While BitFlyer subsequently negotiated with other prospective Japanese and overseas buyers, the recovery of the cryptocurrency market meant that it was unable to reach agreement on price. As a result of this happy coincidence, the feared efflux of user data has not materialized.

When I contacted BitFlyer corporate relations, I was told that the company could not comment on the matter. Huobi Japan, meanwhile, said it would respond to my query if necessary, but failed to make any response by the deadline.

Rethinking Economic Security

In the October 31, 2021, Japanese general election, the ruling Liberal Democratic Party maintained its majority and Kishida Fumio’s gamble to dissolve the Diet immediately after being appointed prime minister paid off. Kishida will now set about implementing his own policies, the centerpiece of which is an economic security package. Based on a framework of preventing state of the art technologies from being divulged and responding to cyber-attacks from overseas, the policy aims to extend the focus of security from the diplomatic and military spheres to the economy.

In May 2021, a group created by Kishida during his time as LDP chair to advocate for the “Creation of a New International Order” announced its interim report, which identified energy, communications, transport, maritime logistics, finance, and medicine as five key industries. The report pledged that the government would maintain and bolster Japan’s strategic autonomy and maintain, enhance, and acquire “strategic indispensability.” Put simply, the group wants to address Japan’s current overreliance on other nations and bolster the nation’s international presence and dominance. It goes without saying that this is a response to the conflict between the United States and China over international political matters and concern about the expansion of Chinese economic hegemony. The team is headed up by House of Representatives member Kobayashi Takayuki, who was recently appointed minister for economic security, a new portfolio created by Prime Minister Kishida. This shows just how seriously Kishida takes economic security. However, as was revealed by the BitFlyer sale negotiations, the Japanese government’s attitude and response to the issue of economic security has fallen far short of what is needed.

FSA Liaising with Government Agency

An Asahi Shimbun scoop on the privacy arrangements of the Line messaging service won it the 2021 Japan Newspaper Publishers and Editors Association prize for revealing that Line was storing users’ data on South Korean servers that were accessible to Chinese contractors. Admitting that it had failed to adequately explain to its users that it stored information on overseas servers and had been careless in its handling of that information, Line stated that it would transfer the data from the Korean servers to equipment located in Japan. In fact, around seven years before the Asahi article came out, the magazine Facta published an article revealing that that South Korean intelligence agencies intercepted Line’s communications and stored the information it collected in Europe, and that the Japanese authorities were aware of this fact. Therefore, despite already knowing that Line stored data overseas, the Japanese government had continued to ignore the issue.

The BitFlyer sale has finally made the Japanese government take economic security seriously, as was exemplified by the creation of a forum for the exchange of information by the Financial Services Agency and other government entities. These authorities, responding to the risks associated with the transfer of personal data overseas, this year began a series of rotating, regular forums. In recent years, Japan’s government agencies have increased their focus on issues of economic security, including business technologies and research findings and the divulgence of personal data, and the BitFlyer sale encouraged this new round of activity involving the FSA.

In Europe, digital sovereignty has rapidly become a major political issue, and there is a growing sentiment that the proper management of information is a matter of national interest. At the moment, the Kishida administration’s policy on economic security tends to focus on the outflow of Japanese technologies. But be it management of personal data, restrictions on server locations, or restrictions on foreign capital, Japan has as good as relinquished its sovereignty over data. Perhaps this is just another example of the COVID-19 pandemic revealing Japan’s digital disadvantage.

(Originally published in Japanese. Banner photo © Pixta.)