united-states copyright
Is downloading leaked malware source code illegal [US]?
<p>I've seen similar questions regarding leaked data/malware, and from what I've seen, it appears that code, regardless of legality, is under copyright, and therefore shouldn't be possessed. But can the copyright holders sue without identifying themselves? Is it a risk with any significance? Also I saw that merely downloading also may be &quot;hacking&quot; under the Computer Fraud and Abuse Act (though presumably distributing is a larger offense/more likely to be pursued). So is downloading/possessing leaked source code illegal?</p>
<p>Secondary question: Why does this differ from the legality of reversing source code (which is perfectly allowed unless the code is patented)?</p>

<p>Source code is protected by copyright, even if it is designed for an unethical or illegal purpose. Making a copy without permission is copyright infringement, as is distributing a copy without permission, unless an <em><strong>exception to copyright</strong></em> applies. In the US the primary exception is <em><strong>fair use</strong></em>. Whether a use constitutes a fair use or not depends on the detailed facts, including the nature and purpose of the use, and the plausible effect on the market for the protected work. The question does not contain enough information for even a rough fair use analysis.</p>
<p>It is generally not unlawful to create malware, only to use it to access a computer or network without permission, or to do other unlawful acts. Thus the copyright holder could sue without implicating him- or herself in a crime. However, damages would probably depend largely on the commercial value of the program, and <strong>if</strong> the <strong>only</strong> plausible use was criminal, the legitimate value might be quite low.</p>
<p>Possessing an unauthorized copy of a work is not a crime, nor is it infringement. The maker and distributor of an unauthorized copy commits infringement, but the recipient does not. Whether unauthorized access and downloading is a crime under the CFAA depends on the factual details. Many things that might technically be crimes under the CFAA are not prosecuted. That is a matter for the relevant prosecutor to determine.</p>
