This article is from the Computer viruses FAQ, by David Harley D.Harley@icrf.icnet.uk, George Wenzel gwenzel@telusplanet.net and Bruce Burrell bpb@umich.edu with numerous contributions by others.
**********************************************************************
The material in this section has no formal legal standing. It consists
of several persons' attempts to interpret and clarify the legal
issues, and cannot possibly be authoritative. If you want bona-fide
legal advice, seek a qualified lawyer.
This section hasn't been updated in a good while, and isn't likely
to be in the near future, so it can't possibly be more than a rough
guide to the issues.
**********************************************************************
Overview
- --------
It isn't possible to deal briefly with all the relevant legislation in
one country, let alone all of them. In the USA, local statutes may be
much more rigorous than federal legislation, which is, arguably, more
concerned with computers in which the government has an interest than
it is with those belonging to individuals.
In many countries, writing of viruses is not an offence in itself,
whereas in others, not only is this not the case, but distribution,
even the sharing of virus code between antivirus researchers is,
at least technically, also an offence.
Once a virus is released 'into the wild', it is likely to cross
national boundaries, making the writer and/or distributor answerable
for his/her actions under a foreign legal system, in a country
he/she may never have visited.
Where virus writing and distribution may not apply locally in a
particular case, the individual may nevertheless be subject to
civil action: in other words, where you may be held to have
committed no offence, you may still be sued for damage.
Some of the grounds on which virus writing or distribution may be
found to be illegal (obviously I'm not stating that all these grounds
will apply at all times in all states or countries!) include:
* Unauthorized access - you may be held to have obtained unauthorised
access to a computer you've never seen, if you are responsible for
distribution of a virus which infects that machine.
* Unauthorized modification - this could be held to include an infected
file, boot sector, or partition sector.
* Loss of data - this might include liability for accidental damage as
well as intentional disk/file trashing.
* Endangering of public safety
* Incitement (e.g. making available viruses, virus code, information
on writing viruses, and virus engines)
* Denial of service
* Application of any of the above with reference to computer systems or
data in which the relevant government has an interest.
Since the law does vary widely from country to country (and even
within countries), it is entirely possible for one to break
the law of another country, state, province, or whatever, without ever
leaving your own, and since extradition treaties do exist, perhaps it's
best to assume that any act that might be construed as being or causing
wilful and malicious damage to a computer or computer system could
get you a roommate with undesirable tendencies and no social graces. :)
The best advice to give to any one contemplating a possibly illegal act
would be to contact their local Crown Prosecutor, Crown Attorney,
District Attorney, or whatever label the local government prosecutor
wears. Acting on the advice of one's own attorney doesn't render one
immune from prosecution, and the cost of defence can be high, even if
successful.
An extremely biased opinion is that very often attorneys attempt to
provide the answer they believe the client wishes to hear, or give an
opinion in areas where they have no real expertise. Prosecutors, on
the other hand, tend to look at a particular action in the light of
whether a successful prosecution can be mounted. If the local Crown
Prosecutor were to suggest that something was a Bad Thing, I should be
extremely nervous about doing it. :)
 
Continue to: