I'm here from the infosec se where we're currently discussing if it is possible for Youtube to infect the files on their servers with malware. My question is - Is it illegal for them to do this? What if they used their own malicious code? How does this differ from a DRM solution?

For anyone wondering what the point of this might be - it would be to discourage users from downloading videos illegally from youtube.

  • 1
    "If I kill a murderer, does my crime not count?" Just because people aren't allowed to download videos from youtube, that doesn't mean that youtube is allowed to punish them. They can't take the law on their hands.
    – user10528
    Commented Jan 19, 2017 at 16:17
  • 2
    @P.Ktinos "If someone drinks household products, with a mention that it is toxic and die, is it my fault ?"
    – Xavier59
    Commented Jan 19, 2017 at 16:56
  • 1
    You need to clarify - do you mean infect the files that users are expected to download (web pages, videos)? Or infect files they aren't expected to access (server code, non user and internal-only files)
    – Stilez
    Commented Jan 22, 2017 at 13:02
  • @Stilez - My bad! I meant files that were strictly back-end only and that should never be exposed to the user, unless the user willingly violates the ToC.
    – thel3l
    Commented Jan 22, 2017 at 15:48

2 Answers 2


I can't be sure of the answer under US computer-specific law, but I can suggest some important legal themes that may arise under general law.

The issue might (in legal terms) be analogous to booby trapping a store you own, in case an intruder comes in. In English law, at least, you are liable for foreseeable harm suffered by persons entering your property, even if they don't have permission to enter. (I'm not sure how much that principle still applies in US law but the basic legal principle probably does still exist and is relevant)

That is, if you set up an Indiana Jones style death-trap in your shop's back-room, on the basis "Anyone who is killed by it shouldn't have been there anyway!", you'd most likely still be found guilty of murder (or some other legal form of culpable killing), the justification wouldn't suffice.

I suspect a similar legal position would apply to deliberate malware of your own computer systems - the principle "volenti non fit injuria" (roughly meaning, a volunteer can't claim in law for a resulting injury) wouldn't help you, because they wouldn't have been a true "volenti" (they consented by their action to the reasonably foreseeable risks of usual tech intrusion but did not consent to the risk of deliberate malware waiting for them.

If you put a sign on the website "Our servers contain malware, do not intrude other than at your own risk" or similar, that might free you from direct liability.

But if your malware harms other parties, you'd still probably be liable for that harm since it's a foreseeable consequence of keeping malware on your server in an unsafe way, and not deleting them on sight.

Specific computers-related laws would probably be very specifically worded. For that, you'd best get an answer from someone who knows US computer law. But again, foreseeability and reasonable care if you keep malware, could be important.

(A possibly-significant corroborative indicator is that, although piracy is a major source of computer loss, very very few software companies meet it by booby-trapping their software.)


Knowingly causing damage to 10 or more computers belonging to other people is a felony under the Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030.

  • I am allowed to cause damage to my own computer right? I can infect it with my own programs. How id it my problem if someone else opens a file on my PC without my permission and infects their system? Is this still my fault? @PKtinos
    – thel3l
    Commented Jan 20, 2017 at 1:30
  • What is the legal standard for knowingly? Is it enough to know that a possibility of something happening exists given a third party agent facilitates this?
    – DRF
    Commented Jan 20, 2017 at 9:50
  • You forgot: "... in the U.S. only." While YouTube is a US company and this would apply to them, it's worth noting that it may not apply (and other laws may apply) to other file hosts not in the US.
    – Stilez
    Commented Jan 22, 2017 at 13:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .