2

Suppose a person creates a self-propagating computer worm that:

  1. does not modify or delete any of the victim's files
  2. rather displays a funny message to the user
  3. scans other computers and spreads itself and then
  4. self destructs without any harm.

Would that be a punishable offense? What are the applicable laws in this case?

Note that the worm self-propagates from the personal computer of the worm writer, so the writer of the worm does not personally infect the next computer.

Note that this question is purely for knowledge/information purposes.

Improve this question
1
  • 4
    Just because you don't think it does anything harmful, doesn't mean it's true. The worm you described would cost large companies millions to get rid of, both in man power and lost productivity.
    – Ron Beyer
    May 30, 2021 at 3:02

2 Answers 2

Reset to default
3

Illegal to write?

No.

Notwithstanding the First Amendment which would almost certainly make a law prohibiting it illegal, writing such things is an essential part of an IT security professional’s toolkit. You can’t protect against worms if you don’t know how they work.

Illegal to distribute on an unauthorised computer?

Absolutely.

This would be a clear breach of the Computer Fraud and Abuse Act.

Improve this answer
9
  • Just to be pedantic, the fact that there are useful applications, for doing something, does not (in itself) make it legal. But I do get that this part of the answer can be also seen as a motivation rather than as a justification for the legal regime being what it is.
    – grovkin
    May 30, 2021 at 15:47
  • @Dale M But the argument would be that the worm replicated itself, and the writer did not have to go ahead and distribute it himself. Would that be a sustainable argument?
    – nkvp
    May 30, 2021 at 16:29
  • 1
    If someone spent any time dealing with this, damage has been done.
    – Dale M ♦
    May 30, 2021 at 21:06
  • 2
    @nkvp the worm doesn't "copy itself" due to a decision that it makes. It's a software device. It does what it was designed to do. Whoever executed its 1st copy, or caused through subterfuge someone else to execute the 1st copy, would be the person responsible for the actions of all the subsequent copies.
    – grovkin
    May 30, 2021 at 23:22
  • 1
    "the worm did" is not an accurate statement. The worm is a device. Anything it does is done by whoever set it in motion. To use an analogy, a person who fires a gun never touches the person struck by the bullet. It doesn't mean that the bullet is responsible for the damage it causes while the person firing the gun is not.
    – grovkin
    Jun 1, 2021 at 14:20
1

This sounds a lot like the Morris Worm. One key difference is due to a programming error, the Morris Worm effectively performed a denial-of-service attack on any infected machine, having a major effect (quoting from Wikipedia):

The Internet was partitioned for several days, as regional networks disconnected from the NSFNet backbone and from each other to prevent recontamination whilst cleaning their own networks.

And the consequences:

Morris was tried and convicted of violating United States Code: Title 18 (18 U.S.C. § 1030), the Computer Fraud and Abuse Act in United States v. Morris. After appeals, he was sentenced to three years' probation, 400 hours of community service, and a fine of $10,050 plus the costs of his supervision. The total fine ran to $13,326, which included a $10,000 fine, $50 special assessment, and $3,276 cost of probation oversight.

Improve this answer
9
  • Morris Worm is not really useful as a precedent precisely because it had a bug which cause the worm to copy itself profusely. So it caused harm that the OP stipulated would not be caused by the worm that they were asking about. But I can't blame you for wanting to mention it as a useful historical note.
    – grovkin
    May 30, 2021 at 15:43
  • @grovkin It is more than a historical note. Morris sincerely believed that his worm would do no harm, but was mistaken. Any person releasing such a worm in the future would take the risk of being wrong, and could face prosecution for harm done but not intended, in addition to prosecution for unauthorized access even if no harm was done.
    – David Siegel
    May 30, 2021 at 16:21
  • @Eugene Styer Assuming that the worm caused no harm at all and was designed to not cause a DDOS attack, would that still be illegal? Is there a provision in the law that covers this scenario?
    – nkvp
    May 30, 2021 at 16:31
  • Some interesting read I just found - en.wikipedia.org/wiki/United_States_v._Morris_(1991)
    – nkvp
    May 30, 2021 at 16:56
  • @DavidSiegel if I remember my history, he didn't test. The worm was bugged and propagated profusely. The reason this can't serve as a precedent is that the OP is asking about a worm which would not propagate profusely and would only present a nuisance in a controlled and orderly manner. It would, as you suggest, and DaleM pointed out, be illegal. But it would be illegal despite a different fact pattern. Which is why the Morris Worm is not a good precedent.
    – grovkin
    May 30, 2021 at 23:25

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .