criminal-law civil-law hacking hypothetical computer-misuse-act
Under US law, is it illegal to write a self propagating computer worm
<p>Suppose a person creates a self-propagating computer worm that:</p>
<ol>
<li>does not modify or delete any of the victim's files</li>
<li>rather displays a funny message to the user</li>
<li>scans other computers and spreads itself and then</li>
<li>self destructs without any harm.</li>
</ol>
<p>Would that be a punishable offense? What are the applicable laws in this case?</p>
<p>Note that the worm self-propagates from the personal computer of the worm writer, so the writer of the worm does not personally infect the next computer.</p>
<p>Note that this question is purely for knowledge/information purposes.</p>

<h2>Illegal to write?</h2>
<p>No.</p>
<p>Notwithstanding the First Amendment which would almost certainly make a law prohibiting it illegal, writing such things is an essential part of an IT security professional’s toolkit. You can’t protect against worms if you don’t know how they work.</p>
<h2>Illegal to distribute on an unauthorised computer?</h2>
<p>Absolutely.</p>
<p>This would be a clear breach of the <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" rel="nofollow noreferrer">Computer Fraud and Abuse Act</a>.</p>

<p>This sounds a lot like the <a href="https://en.wikipedia.org/wiki/Morris_worm" rel="nofollow noreferrer">Morris Worm</a>.  One key difference is due to a programming error, the Morris Worm effectively performed a denial-of-service attack on any infected machine, having a major effect (quoting from Wikipedia):</p>
<blockquote>
<p>The Internet was partitioned for several days, as regional networks
disconnected from the NSFNet backbone and from each other to prevent
recontamination whilst cleaning their own networks.</p>
</blockquote>
<p>And the consequences:</p>
<blockquote>
<p>Morris was tried and convicted of violating United States Code: Title
18 (18 U.S.C. § 1030), the Computer Fraud and Abuse Act in United
States v. Morris. After appeals, he was sentenced to three years'
probation, 400 hours of community service, and a fine of $10,050 plus
the costs of his supervision. The total fine ran to $13,326, which
included a $10,000 fine, $50 special assessment, and $3,276 cost of
probation oversight.</p>
</blockquote>
