My understanding is that acts can be a breach of copyright and can result in being held liable in civil courts (a civil wrong?) without being criminal and result in being found guilty in criminal court (a crime?).

The BBC is reporting that the Intellectual Property Office (IPO) said on Tuesday that sharing passwords for online streaming services such as Netflix broke copyright law, and the IPO told the BBC it was both a criminal and civil matter.

What features of an act would be considered in determining if an act was criminal, as opposed to being purely a civil matter?

  • 1
    Not specific to the UK: Depends on the country, but financial gain is likely to make it criminal. Or if causing financial damage is the reason. The amount of copying might make a difference. On the other hand, "criminal" requires "proof beyond reasonable doubt". I might have written the password on a sticker on my TV, and you read it without me noticing.
    – gnasher729
    Dec 21, 2022 at 15:27
  • I had always thought the financial gain thing was the line, but I think this statement demonstrates that is not the case in the UK.
    – User65535
    Dec 21, 2022 at 15:29

2 Answers 2


In US copyright law, criminal copyright infringement is defined by 17 USC 506(1), which reads:

  1. In general.—Any person who willfully infringes a copyright shall be punished as provided under section 2319 of title 18, if the infringement was committed—

(A) for purposes of commercial advantage or private financial gain;

(B) by the reproduction or distribution, including by electronic means, during any 180-day period, of 1 or more copies or phonorecords of 1 or more copyrighted works, which have a total retail value of more than $1,000; or

(C) by the distribution of a work being prepared for commercial distribution, by making it available on a computer network accessible to members of the public, if such person knew or should have known that the work was intended for commercial distribution.

Note that there is a financial floor in subsection (B), that the infringing copies must have a retail value of $1,000 or more.

However, my understanding is that, as a matter of policy and not law, the US Department of Justice (DoJ) only brings charges of criminal copyright infringement where the infringement is both extensive and lasting, in effect there the accused has made infringement a business.

I am fairly sure that password sharing itself would not be copyright infringement under US law, but might well be a violation of the Computer Fraud and Abuse Act (CFAA). But using a shared password to access protected content without authorization might be infringement, if a copy of the content is made. Sharing a password knowing that it will be so used is probably a violation of the anti-circumvention provisions of the DMCA, which has been incorporated into Title 17, the US copyright law. But that normally leads to civil liability.


The criminal offence of copyright infringement is defined in section 107 of the Copyright, Designs and Patents Act 1988. Subsection (1) confirms that the offence is primarily addressed at infringement for profit.

A person commits an offence who, without the licence of the copyright owner—

(a) makes for sale or hire, or

(b) imports into the United Kingdom otherwise than for his private and domestic use, or

(c) possesses in the course of a business with a view to committing any act infringing the copyright, or

(d) in the course of a business —

(i) sells or lets for hire, or

(ii) offers or exposes for sale or hire, or

(iii) exhibits in public, or

(iv) distributes, or

(e) distributes otherwise than in the course of a business to such an extent as to affect prejudicially the owner of the copyright,

an article which is, and which he knows or has reason to believe is, an infringing copy of a copyright work.

According to the linked article, the IPO said "There are a range of provisions in criminal and civil law which may be applicable in the case of password sharing where the intent is to allow a user to access copyright-protected works without payment." This statement followed the removal of the (apparently embarrassing) guidance on password sharing from the IPO website.

The statement is probably best understood as an attempt to save face by focusing on the broad potential scope of the law. It is technically correct that the criminal offence "may be applicable" to password sharing, for example when it forms part of a business that profits from the knowing infringement of copyright. But the typical password sharer is unlikely to be committing a criminal offence, and even less likely to be charged with it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .