On July 28, 2026, the Kyoto Prefectural Police Cyber Investigation Division and Fushimi Police Station arrested a man from Sagamihara City on suspicion of sharing an NHK drama without authorization via "Nyaa," one of the world's largest torrent sites. The investigation's target was not a user who later received the file, but the alleged "first uploader"—the person said to have first released the complete data onto the P2P network. CODA announced that an analysis tool developed by the Japan Hacker Association contributed to obtaining information about the suspect. The organization also told TorrentFreak that the tool did not analyze activity inside the BitTorrent swarm itself. What clues connected an investigation to the long-elusive origin of distribution?
Division of Labor Between the Private Sector and Police in Tracking the First Uploader
The arrest concerns the alleged unauthorized sharing of data from the 2026 drama "Midnight Taxi" without the rights holder's permission. According to CODA, the man is suspected of having first distributed the complete data and posted a torrent file indicating its location on Nyaa. Kyodo News reported the man as Masakazu Ono, 56, and said he had admitted to the allegations, stating he "wanted to spread NHK's work around the world." No guilty verdict has been finalized, and the determination that he was the first uploader will also be examined in the criminal proceedings that follow.
The first uploader holds the complete file at the moment distribution begins. Users who join afterward receive the data piece by piece, then pass on the pieces they have obtained to other users. Because distribution can continue spreading without placing the video on a central distribution server, CODA has treated identifying the person who initiated distribution as a priority for countermeasures.
The investigation did not begin immediately before the arrest. With support from the Ministry of Economy, Trade and Industry, CODA began working to identify Nyaa's uploaders in fiscal year 2021. Using an analysis tool developed by the Japan Hacker Association, information related to the suspect was obtained, and Kyoto Prefectural Police identified the individual through their investigation. This represents a division of labor in which a private organization creates technical leads that police then connect to evidence in a criminal case.
What Do Indexes and Trackers Record?
Nyaa's public-facing page is not a server that distributes the video content itself. What can be searched is a torrent file containing information such as the file name and size. When a user loads that file into a BitTorrent client, it connects to a swarm—a group of participants exchanging the same file.
The tracker mediates these connections. Under BEP 3, BitTorrent's official specification, a tracker's response includes each participant's peer ID, IP address or DNS name, and port number. The client uses this list to communicate directly with peers holding pieces of the file. While a tracker does not hold the data itself, it does link which devices are participating in the same torrent.
However, a single tracker response alone does not reveal the personal identity of the first uploader. There remains a gap between the connection information specified by the protocol and proof that a particular person was the one who first introduced the complete data. When was the posted torrent examined, from what point in time, and against what information was it cross-referenced? While this announcement revealed the existence of an analysis process that bridges that gap, it did not disclose the actual procedure.
The Boundary Left by an Undisclosed Analysis Method
In its response to TorrentFreak, CODA explained that the analysis tool did not examine "activity within the BitTorrent swarm itself," but instead analyzed data movement passing through index sites and tracker sites. This, it said, differs from the conventional monitoring approach in which a rights holder joins the swarm and records IP addresses during file sharing—that is the extent of what has been disclosed.
Beyond that, nothing has been revealed. Neither the type of information the tool obtained nor the method used to cross-reference it with other information has been made public. CODA stated that it could not disclose specific analysis or investigative methods, citing the risk of adverse effects on future investigations and enforcement.
In its public-facing explanation of its international enforcement project, CODA describes a framework in which evidence is gathered through digital forensics and online profiling, with requests for disclosure of sender information made to CDNs and others as needed. However, this describes the project's general procedures. It has not been confirmed that the same disclosure process was used in this particular case. What has been confirmed is only the sequence: after the analysis tool obtained information about the suspect, Kyoto Prefectural Police's investigation handled the task of identifying the individual.
From Site Blocking to Targeting the Origin of Distribution
CODA states that Nyaa averaged approximately 30 million visits per month from July 2025 to June 2026, with roughly 50% of that traffic coming from Japan. Both figures are estimates from SimilarWeb, not actual user counts. Even so, these numbers point to a scale and international reach that make it difficult to stop distribution simply by shutting down the site.
The focus of countermeasures has shifted in stages. In 2019, CODA worked with Google to remove Nyaa's top page from Google search results. In materials submitted to the Agency for Cultural Affairs in January 2023, CODA explicitly stated its plan to build a monitoring system aimed at "identifying senders" with regard to Nyaa. In 2025, Kyoto Prefectural Police separately took action against three secondary uploaders connected to leech sites that directed users to torrent files on Nyaa.
This latest arrest fits within a trend in which countermeasures have expanded across different layers: the entry point to the site, users who re-share content, and the individuals who initiate distribution. Nyaa itself remains operational, and this single arrest has not stopped P2P distribution. Still, the fact that the origin of distribution via trackers can become the subject of long-term analysis changes the assumptions uploaders operate under. What should be verified through the criminal proceedings is not the undisclosed tool's name or speculative monitoring technology, but rather how the evidence was built to determine who first distributed the complete data.