New Jersey Settles With MIT Student Over Bitcoin Zombie Software Project

Bloomberg Law: Privacy & Data Security brings you single-source access to the expertise of Bloomberg Law’s privacy and data security editorial team, contributing practitioners,...

By Leslie A. Pappas

May 26 — A Massachusetts Institute of Technology student who developed mining software for the virtual currency Bitcoin agreed not to access computers in New Jersey without clearly notifying and obtaining consent from those using the computer, under a May 26 administrative settlement with the New Jersey Division of Consumer Affairs.

The settlement resolves allegations that Jeremy Rubin allowed Web developers to use his program—Tidbit—to gain access to computers in New Jersey without their owners' knowledge. The software could allow websites to take over the untapped processing power of computers to earn money by using it to mine for Bitcoins, the office of New Jersey Acting Attorney General John Jay Hoffman (R) said in a May 26 statement.

Rubin violated New Jersey's Computer Related Offenses Act and Consumer Fraud Act by providing code to Web developers without reviewing their privacy policies or ensuring they had controls in place, according to the attorney general's office.

The settlement consent order includes a $25,000 suspended monetary settlement, which will be vacated within two years if Rubin complies with the agreement.

“We do not believe Tidbit was created for the purpose of invading privacy,” Steve Lee, acting director for the Division of Consumer Affairs, said in the attorney general's statement. “However, this potentially invasive software raised significant questions.”

Student Project 

As a 19-year-old freshman, Rubin developed the software with three other students in 2013 for the Node Knockout Hackathon, a 48-hour programming competition sponsored by companies including Groupon and Joyent. The Tidbit team won the highest innovation score, according to the Node Knockout website.

In a March 2104 letter to Hoffman, 37 of M.I.T.’s faculty and teaching staff called the New Jersey investigation “an affront to our academic freedom” that would have a “chilling effect on teach and research.”

The settlement ends a “misguided investigation” without admission of guilty or liability, according to Hanni Fakhoury, senior staff attorney at the Electronic Frontier Foundation, which represented Rubin along with Frank Corrado of Barry, Corrado & Grassi PC.

“No Bitcoins were mined, nobody's privacy was invaded,” Fakhoury told Bloomberg BNA May 26, adding that the code was disabled after the two-day competition was over.

The settlement allows Rubin and other students to develop Tidbit or similar software in the future, as long as proper notice is given, Fakhoury said.

To contact the reporter on this story: Leslie A. Pappas in Philadelphia at

To contact the editor responsible for this story: Donald G. Aplin at

The consent order is available at


Request Bloomberg Law: Privacy & Data Security