I'm making a malware software in my final thesis at the university. I won't use it ever, and it was made by educational and scientific purposes only. But my university will publish it, giving the opportunity for everyone to use it. If someone commit a crime with my software, can I get in trouble?

  • 1
    Was this a project set by your university, or did you select it yourself? Dec 7 '18 at 8:39
  • 1
    I selected it by myself, but they approved it.
    – user22189
    Dec 7 '18 at 9:06
  • Computer crime laws around the world vary a lot. What's legal in Nigeria might be illegal in Switzerland. Please add a tag appropriate to the jurisdiction you are in.
    – Philipp
    Dec 7 '18 at 13:45

my university will publish it, giving the opportunity for everyone to use it. If someone commit a crime with my software, can I get in trouble?

I would say "No" for three reasons. I will assume that you are in a jurisdiction of the U.S. or reasonably similar thereto.

First, the malware code is part of your thesis, which in turn is a prerequisite (already approved by the university) for graduation. If anything, the entity that would be knowingly broadcasting the material is the university, not you. Any liability in the vein of MCL 750.540f would fall on the university, as it knows better than you about the presumed "risks" as to whether third-parties might abuse your research.

In the context of a public university with its typical status of "arm of the state", it would be untenable if one arm of the state (the university) authorizes you to proceed, and subsequently another governmental agency prosecutes you once your thesis reaches completion.

Second, your thesis with all the source code therein expresses ideas which are protected by the First Amendment. A serious discussion of malware necessarily requires that these ideas be expressed in assembly code (often intertwined with excerpts in machine code) of the architecture for which it is devised. Anything short of that makes a discussion of malware meaningless because this topic depends so heavily on the particulars of the targeted family of processors.

Furthermore, the academic context evidences your pursuit of educational & scientific advancement rather than a direct or indirect intent to encourage criminal activity. A person whose ultimate purpose is to promote computer crimes has many alternatives which are quicker and more effective than enrolling in a university, pay tuition, and undergo years of academic study.

Third, (without minimizing your merits) it is doubtful that no solution could ever exist for the malware you devise, or that no one else from a "clandestine" setting would ever come up independently with an akin variant of that malware. Thus, publications of malware made with the openness and formalities of a university thesis are likelier to be viewed as a heads up to IT security companies about enhancements they might need to make on products & services they offer.


There's not much I can say without knowing where you're operating, but I would suspect the charges would fall on the party who used it, not the developer. Especially if you could prove your university sanctioned the project's creation and lack of ill intent. I know this isn't the place for opinions, but I could find no legal precedent here in the US, and I can't assume the cyber crime laws for any other country.