united-states criminal-law hacking
Is it legal to create a program intended to gain unauthorized access?
<p>If I make a program which is unquestionably intended for other people to use to gain unauthorized access to a network, but I do not use the program myself except on my own network for testing, have I committed a crime? Can I be charged with cooperating to commit a crime?</p>

<p>18 USC 1039(a)(9) states (italics added) that whoever </p>

<blockquote>
  <p>knowingly uses, <em>produces</em>, traffics in, has control or custody of, or
  possesses hardware or <em>software</em>, knowing it has been configured to
  insert or modify telecommunication identifying information associated
  with or contained in a telecommunications instrument so that such
  instrument may be used to obtain telecommunications service without
  authorization</p>
</blockquote>

<p>"shall, if the offense affects interstate or foreign commerce, be punished". I would imagine that whatever your program does to gain access, that satisfies the requirements of this statute.</p>

<p>18 USC 1030(a)(5) also criminalizes producing a program that damages a computer. You might think that simply looking does not cause damage. DOJ has a <a href="https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ccmanual.pdf" rel="nofollow">different view</a>, observing p. 46 that "In the wake of seemingly minor intrusions, the entire computer system is often audited, for instance, to ensure that viruses, back-doors, or other harmful codes have not been left behind or that data has not been altered or copied". They note that this theory has not been applied to criminal cases. If you work alone, there is no conspiracy, but if you conspire with Smith to gain illegal access to a computer, you would have run afoul of 18 USC 371.</p>
