I've seen similar questions regarding leaked data/malware, and from what I've seen, it appears that code, regardless of legality, is under copyright, and therefore shouldn't be possessed. But can the copyright holders sue without identifying themselves? Is it a risk with any significance? Also I saw that merely downloading also may be "hacking" under the Computer Fraud and Abuse Act (though presumably distributing is a larger offense/more likely to be pursued). So is downloading/possessing leaked source code illegal?

Secondary question: Why does this differ from the legality of reversing source code (which is perfectly allowed unless the code is patented)?

1 Answer 1


Source code is protected by copyright, even if it is designed for an unethical or illegal purpose. Making a copy without permission is copyright infringement, as is distributing a copy without permission, unless an exception to copyright applies. In the US the primary exception is fair use. Whether a use constitutes a fair use or not depends on the detailed facts, including the nature and purpose of the use, and the plausible effect on the market for the protected work. The question does not contain enough information for even a rough fair use analysis.

It is generally not unlawful to create malware, only to use it to access a computer or network without permission, or to do other unlawful acts. Thus the copyright holder could sue without implicating him- or herself in a crime. However, damages would probably depend largely on the commercial value of the program, and if the only plausible use was criminal, the legitimate value might be quite low.

Possessing an unauthorized copy of a work is not a crime, nor is it infringement. The maker and distributor of an unauthorized copy commits infringement, but the recipient does not. Whether unauthorized access and downloading is a crime under the CFAA depends on the factual details. Many things that might technically be crimes under the CFAA are not prosecuted. That is a matter for the relevant prosecutor to determine.

  • Many types of malicious software are self propagating. You could very easily come in possesion of a copy without copying the source code. This may further complicate the matter.
    – Neil Meyer
    Mar 19, 2022 at 17:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .