1

Suppose a person creates a self-propagating computer worm that:

  1. does not modify or delete any of the victim's files
  2. rather displays a funny message to the user
  3. scans other computers and spreads itself and then
  4. self destructs without any harm.

Would that be a punishable offense? What are the applicable laws in this case?

Note that the worm self-propagates from the personal computer of the worm writer, so the writer of the worm does not personally infect the next computer.

Note that this question is purely for knowledge/information purposes.

1
  • 3
    Just because you don't think it does anything harmful, doesn't mean it's true. The worm you described would cost large companies millions to get rid of, both in man power and lost productivity. – Ron Beyer May 30 at 3:02
3

Illegal to write?

No.

Notwithstanding the First Amendment which would almost certainly make a law prohibiting it illegal, writing such things is an essential part of an IT security professional’s toolkit. You can’t protect against worms if you don’t know how they work.

Illegal to distribute on an unauthorised computer?

Absolutely.

This would be a clear breach of the Computer Fraud and Abuse Act.

9
  • Just to be pedantic, the fact that there are useful applications, for doing something, does not (in itself) make it legal. But I do get that this part of the answer can be also seen as a motivation rather than as a justification for the legal regime being what it is. – grovkin May 30 at 15:47
  • @Dale M But the argument would be that the worm replicated itself, and the writer did not have to go ahead and distribute it himself. Would that be a sustainable argument? – nkvp May 30 at 16:29
  • I see the below part of the law may be applicable: (5) (A) knowingly causes the transmission of a program, information, code, or command,..., intentionally causes damage without authorization, to a protected computer; (B) intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage; or (C) intentionally accesses a protected computer without authorization..., causes damage and loss. If the worm does not cause 'damage' to the system and only displays a popup, would this apply? How does one define damage? – nkvp May 30 at 16:43
  • 1
    If someone spent any time dealing with this, damage has been done. – Dale M May 30 at 21:06
  • 2
    @nkvp the worm doesn't "copy itself" due to a decision that it makes. It's a software device. It does what it was designed to do. Whoever executed its 1st copy, or caused through subterfuge someone else to execute the 1st copy, would be the person responsible for the actions of all the subsequent copies. – grovkin May 30 at 23:22
1

This sounds a lot like the Morris Worm. One key difference is due to a programming error, the Morris Worm effectively performed a denial-of-service attack on any infected machine, having a major effect (quoting from Wikipedia):

The Internet was partitioned for several days, as regional networks disconnected from the NSFNet backbone and from each other to prevent recontamination whilst cleaning their own networks.

And the consequences:

Morris was tried and convicted of violating United States Code: Title 18 (18 U.S.C. § 1030), the Computer Fraud and Abuse Act in United States v. Morris. After appeals, he was sentenced to three years' probation, 400 hours of community service, and a fine of $10,050 plus the costs of his supervision. The total fine ran to $13,326, which included a $10,000 fine, $50 special assessment, and $3,276 cost of probation oversight.

9
  • Morris Worm is not really useful as a precedent precisely because it had a bug which cause the worm to copy itself profusely. So it caused harm that the OP stipulated would not be caused by the worm that they were asking about. But I can't blame you for wanting to mention it as a useful historical note. – grovkin May 30 at 15:43
  • @grovkin It is more than a historical note. Morris sincerely believed that his worm would do no harm, but was mistaken. Any person releasing such a worm in the future would take the risk of being wrong, and could face prosecution for harm done but not intended, in addition to prosecution for unauthorized access even if no harm was done. – David Siegel May 30 at 16:21
  • @Eugene Styer Assuming that the worm caused no harm at all and was designed to not cause a DDOS attack, would that still be illegal? Is there a provision in the law that covers this scenario? – nkvp May 30 at 16:31
  • Some interesting read I just found - en.wikipedia.org/wiki/United_States_v._Morris_(1991) – nkvp May 30 at 16:56
  • @DavidSiegel if I remember my history, he didn't test. The worm was bugged and propagated profusely. The reason this can't serve as a precedent is that the OP is asking about a worm which would not propagate profusely and would only present a nuisance in a controlled and orderly manner. It would, as you suggest, and DaleM pointed out, be illegal. But it would be illegal despite a different fact pattern. Which is why the Morris Worm is not a good precedent. – grovkin May 30 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.