If a developer writes a program, for example a password cracker or a code decipher, and it is used illegally, will the developer or the user get punished? A password cracker could be used, for example, if you forgot your email password, and that is perfectly legal. But you could also use the password cracker to hack into someone else's account. Same deal for a code decipher (it could be used legally or illegally.) So my question is: if a user uses a program illegally, is the user or the developer punished? Is there something a developer can do (like put a user agreement that states you should not use it illegally?)
The simple answer is yes. There's a famous case that illustrates this: A&M Records, Inc. v. Napster, Inc., 239 F.3d 1004 (2001).
A number of record companies successfully sued Napster for infringing their various intellectual property rights.
Essentially, the finding came down to the fact that:
- Napster's program (of the same name) allows for the exchange of copyrighted material, and Napster had actual knowledge that specific infringing material was available using its system, and that it did not remote the material (by blocking access to the system or otherwise).
- Napster did not police the index of files that they maintained, and so were liable for vicarious infringement.
The longer answer to your question is it depends. Based on the Napster precedent, it seems it would depend (at least) on whether:
- the program may have legitimate uses
- you are aware that it can be used for illegal purpose
- you have a means of monitoring the activity
- you have a means of restricting use of the program
- you financially benefit from the activities of the users
Many developers will include some warning about using the software only for legal purposes. I don't think such a warning has ever been tested, and even if it were, it's unlikely to make a difference if the clear purpose of the software is to perform illegal acts.
Taking your example of a password cracker.
A developer writes the code to crack password protected Word documents.
The developer uses it to crack their own Word documents. No problem.
The developer posts it on the internet for download. Free or paid. Thinks it might be useful for others to use. No problem.
The developer get contacted by someone. That someone says, "we want to use your software to crack passwords on files which we don't have permission access to. Is that OK with you"? Developer says, "Sure". Developer has a problem. We're moving into the territory of a "common design" to commit a tort. Also known as a conspiracy. That is, two or more people are cooperating to commit an unlawful act.
The developer get contacted by someone else. That someone else says, "We need some changes done to your software so that we can go off and hack passwords to files which we don't have permission to access. Can you do the work? Developer says, "Sure". Developer makes the changes. Developer is now up the creek. Properly. The developer knows that what s/he does will be used to commit a tort. And probably a crime.
This is an application of the principles of "common design".
If you infringe someone else's copyright by yourself, it's a tort. If you cooperate with others to infringe another person's copyright, you're jointly and severally liable with those others for the copyright infringement if you facilitate the infringement.
Napster is a different class of case.
Everyone knew what Napster was used for, to such a level that courts were persuaded that it was effectively an engine to infringe copyright.
As I recall, Napster did nothing to distance itself from unlawful use of its software (see number 4 above). In fact - Napster hosted the central index which was required for the engine to find and serve files to those who wanted them.
So how easy is it to use your program to recover my lost email password? Have you ever checked that it is actually a possibility? Are you marketing it for this purpose, does it have working instructions for recovering lost email passwords? How many sales did you make for that purpose?
"Are there legal uses" wouldn't look for hypothetical uses, but for real, practical ones. Your example doesn't look practical. Do people who fix others' computer problems buy your software, people who make money by removing malware from customers' computers? Substantial sales to such legitimate companies might make an argument. But your hypothetical on its own will not protect you.