2

I observed behavior from certain Avast security products, where the products will scan other computers/devices in an internal network for security vulnerabilities.

I noticed that the behavior from this was very similar to actual intrusion attempts, until I found the behavior was related to Avast.

Would a user of the product be legally liable or committing a crime by connecting to a network that is not theirs, and their antivirus product automatically scans the devices in that network (which do not belong to the user of the Avast product) for security vulnerabilities?

2
  • It would be a question of intent. Did I intend to find vulnerable devices, or did I not even think about this? And why am I looking for vulnerable devices?
    – gnasher729
    Commented Apr 12, 2022 at 23:02
  • @gnasher729 In the US, the prosecution would need to prove more than intent to find vulnerabilities. It would need to prove at least an attempt to access without authorization, and either an attempt to obtain information without authorization, or to access a computer with restricted data, or commit fraud, or any of several other offenses, See my answer. Commented Apr 12, 2022 at 23:38

2 Answers 2

1
+100

It should be noted that in the document linked to in the question, Avast states that its Network Inspector scans operate in two different modes, "Home" and "Public". The document states:

Each time you run a Network Inspector scan, you are prompted to select if the network you are currently connected to is Home or Public. Network Inspector scans for different issues and offers different solutions depending on the network type, so it is important to select the correct option:

  • Home: Scan a private network that you own (such as your home network).
  • Public: Scan a network that you do not own. This may be a public Wi-Fi network, or a work or school network that is managed by a separate network administrator.

The document does not detail what scans are different on a "Home" network, but it might well be that scans which would constitute unauthorized invasions are not run on "public" networks.

CFAA

In the US, anti-hacking l;aw is largely included in the The Computer Fraud and Abuse Act of 1986 (CFAA), which has been codified at 18 U.S. Code § 1030The CFAA has been amended several times since 1984, each time broadening its reach.

Section 1030 prohibits unauthorized access to a "protected computer" under any of several conditions, and also prohibits unauthorized obtaining of information from a "protected computer".

Protected Computer

Section 1030 (e)(2) defines "protected computer:

(e) (2) the term “protected computer” means a computer—
(e) (2) (A) exclusively for the use of a financial institution or the United States Government, or, in the case of a computer not exclusively for such use, used by or for a financial institution or the United States Government and the conduct constituting the offense affects that use by or for the financial institution or the Government;

(e) (2) (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States; or

(e) (2) (C) that—
(e) (2) (C) (i) is part of a voting system; and
(e) (2) (C) (ii)
(e) (2) (C) (ii) (I) is used for the management, support, or administration of a Federal election; or
(e) (2) (C) (ii) (II) has moved in or otherwise affects interstate or foreign commerce;

Originally only subsection (e)(2)(A) was part of the CFAA, and the act onloy applied to computers owned or used by the US Federal government, or by banks and simialr financial institutions. The addition of subsections (e)(2)(B) and (e)(2)(C) has broadened the scope of the CFAA significantly. The development of the internet, so that almost all data on the internet has traveled or is likely to travel across state lines, means that almost every computer with an internet connection can be regarded as a "protected computer" under the CFAA, including most cell phones. The CFAA has thus become a general anti-hacking act.

Offenses

Section 1030 defies several offenses, which I summarize here: unauthorized disclosure of information obtained from a protected computer (subsection (a)(1)); obtaining information from a protected computer without proper authorization (subsection (a)(2)); unauthorized access to certain protected computers (subsection (a)(3)); fraud, that is using unauthorized access to commit fraud, further any fraudulent scheme, or fraudulently obtain any benefit or thing of value (subsection (a)(4)); transmitting malware (subsection (a)(5)(A)); causing damage, whether recklessly or not (subsections (a)(5)(B) & (a)(5)(C)); selling passwords and access codes (subsection (a)(6)); transmitting ransomware or threats to damage a protested computer or interfere with its operation (subsection (a)(7)).

Each of these subsections has limiting language, and applies only when [emphasis added]:

  • [(a)(1)] having knowingly accessed a computer without authorization or exceeding authorized access and and by means of such conduct having obtained information that has been determined by the United States Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations, or any restricted data, as defined in paragraph y. of section 11 of the Atomic Energy Act of 1954, with reason to believe that such information so obtained could be used to the injury of the United States, or to the advantage of any foreign nation

It seems unlikely that merely connecting a device with an Avast Security product installed will constitute "knowing access" or will result in obtaining such protected or restricted data, but if it does, one can avoid criminal liability under (a)(1) simply by nt disclosing any such data to any third party.

  • [(a)(2)] Intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains— (A) information contained in a financial record of a financial institution, or of a card issuer as defined in section 1602(n) [1] of title 15, or contained in a file of a consumer reporting agency on a consumer, as such terms are defined in the Fair Credit Reporting Act (15 U.S.C. 1681 et seq.

It seems even less likely that merely connecting a device with an Avast Security product installed will constitute "intentional access" or will result in obtaining such financial data. Note that data must be obtained by a perso0n con constitute a violation of (a)(2).

However (a)(2)(C) also prohibits obtaining:

information from any protected computer;

This is the potentially broadest subsection. It contains no intent element, and no restriction on which computers it applies to. Even so, it applies only if information is in fact obtained (or under a later subsection there is an attempt to obtain information).

  • [(a)(3)] intentionally, without authorization to access any nonpublic computer of a department or agency of the United States, accesses such a computer of that department or agency that is exclusively for the use of the Government of the United States or, in the case of a computer not exclusively for such use, is used by or for the Government of the United States and such conduct affects that use by or for the Government of the United States; ...

Again, It seems unlikely that merely connecting a device with an Avast Security product installed will constitute intentionally accessing a computer owned or used by the US Federal Government

  • [(a)(4)] knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value,

It is very hard to see how merely connecting a device with an Avast Security product installed will constitute acting with intent to defraud, nor how it will allow the person connecting the device to obtain anything of value fraudulently.

  • [(a)(4)(A)] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

  • [(a)(4)(B)] intentionally accesses a protected computer without authorization, and as a result of such conduct, recklessly causes damage;

  • [(a)(4)(C)] intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.

Aside from subsection (a)(2)(C), all the listed offenses require "knowing" or "intentional" action. Even (a)(2)(C) requires proof that the accused intentionally accessed a protected computer without authorization. I am inclined to doubt that merely connecting a device with a publicly sold security product installed would be held to constitute intentional access to other computers on that network, and such intent would need to be proved beyond a reasonable doubt, just as any other element of any crime.

0

If its just seeing what ports are open, what services are running, that's all publicly available that your computer is collecting and analyzing. It isn't accessing the computer, it just sends a request to the computer.

1
  • Thats not what its doing. Commented Apr 19, 2022 at 19:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .