Would it be legal to change the functionality of your own software to do something apparently malicious if fullly documented?

Question

This topic came up when discussing the infamous left-pad disaster from awhile back. To give a brief summary the author of a small package hosted on the npm repository that numerous other packages had (indirect) dependencies on decided to remove his package in protest of the repositories policies. The result was that a significant number of highly important programs and packages all failed overnight when the dependency they all required could no longer be found.

We were wondering, purely hypothetically, could the developer have done something more malicious legally. Let's say, purely hypotehtically, that instead of removing the left-pad software he instead changed it so that it now did some bizzare or malicious behavior, like trying to remove everything from the computer (which the browser should prevent), or giving the wrong response 1/5 of the time (which would be allowed and would be much harder to trace the root issue to.

Assuming the individual fully documented the change and new behavior when he updated his source code then this package would still be doing exactly what it reported to do, and as such arguably anyone who downloaded the package would thus be choosing to run whatever bizzare apparently-malicious behavior he had added to the code. In reality the nature of how package dependencies work means that most people wouldn't know they had a dependency on the package, much less read the documentation to know that this package their unaware of now does something malicious.

Legally, if a develop tried something like this with a package would they be guilty of a crime? Or is it within the developers legal rights to change a package to do whatever he chooses, so long as documented, and thus fall under some 'buyer beware' clause where it's their fault they didn't realize the package had new functionality?

for now I'll narrow this down to focusing on US law, since I believe that's where the original author of the package lived.

Answer 1

The following list of the grounds on which virus creation or distribution may be found to be illegal: from this source

• Unauthorized access - you may be held to have obtained unauthorized access to a computer you have never seen, if you are responsible for distribution of a virus which infects that machine.

• Unauthorized modification - this could be held to include an infected file, boot sector, or partition sector.

• Loss of data - this might include liability for accidental damage as well as intentional disk/file trashing.

• Endangering of public safety

• Incitement - includes making available viruses, virus code, information on virus creation, and virus engines.

• Denial of service

• Application of any of the above with reference to computer systems or data in which the relevant government has an interest.

As soon as your programmer alters the function left-pad to be malicious it is essentially a virus, and your example includes unauthorized access, modification, and loss of data. The fact that he tells you it will now do these things doesn't make it any less illegal. Think someone walking into a bank and saying "This is a robbery." Great. Still illegal.

However, doing something bizarre may not be illegal, like the April Fools' prank by Google, which resulted in users being unable to respond to email conversations ("Drop the Mic" if I remember correctly.) It might still open the programmer to liability if it caused damages and he knew this was a possibility. (I think Google did end up facing lawsuits over their prank.)

Great rule of thumb: If an act is intentional and is meant to cause harm, it's probably illegal.