internet
A computer &quot;virus&quot; that only spreads (no payloads) - Is it illegal?
<p>Let's say that someone makes a computer virus. The only thing the virus does is email itself to random emails. Upon someone opening the virus, it is emailed from their computer to other random emails as well, thus making the virus spread.</p>

<p>Let's also say that the virus does <strong>not</strong> use the personal email of the infected user to spread itself, instead it uses emails provided in an online database that it has access to. The target emails it gets emailed to are randomly generated on the victim's end, and have nothing to do with his actual contacts.</p>

<p>This virus does nothing but spread. No payloads, no information stealing, nothing else.</p>

<p>Would that be classified as a virus, and the creator of it as a criminal? Would his punishments be as severe as the author of a harmful virus?</p>

<p>The question whether something is a virus vs. something else is not a legal question, so if you really care about "virus" in programmer's lingo, this is the wrong place to ask. Since you're here, I assume you <em>do</em> want the legal answer. There is no law against creating or distributing a "virus". There <em>is</em> a law criminalizing unauthorized access of a computer system.</p>

<p><a href="https://www.law.cornell.edu/uscode/text/18/1030" rel="nofollow noreferrer">18 USC 1030</a> makes it a federal crime to knowingly access a "protected" computer without authorization, or exceeding authorized access. A protected comuter includes one "which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States", which is to say, any computer or cell phone capable of communication. It is not necessary that there be any loss resulting from such access: simple unlawful access is a crime, which can garner a prison term in the 10-20 year range. <a href="http://www.ncsl.org/research/telecommunications-and-information-technology/computer-hacking-and-unauthorized-access-laws.aspx#Hacking" rel="nofollow noreferrer">States also have laws</a> against such actions. <a href="http://app.leg.wa.gov/RCW/default.aspx?cite=9A.90&amp;full=true#9A.90.030" rel="nofollow noreferrer">Washington's law</a>, where it is called "computer trespass" (milder punishment). </p>

<p>Regardless of whether or not the use is harmful, any unauthorized use of someone else's computer hardware I would assume to be illegal.</p>

<p>In the UK this would come under the Computer Misuse Act 1990</p>

<blockquote>
  <p>The Computer Misuse Act is designed to protect computer users against wilful attacks and theft of information. Offences under the act include hacking, unauthorised access tocomputer systems and purposefully spreading malicious and damaging software (malware), such as viruses.  </p>
</blockquote>

<p>Source: <a href="https://www.sqa.org.uk/e-learning/ITLaw01CD/page_03.htm" rel="nofollow noreferrer">https://www.sqa.org.uk/e-learning/ITLaw01CD/page_03.htm</a></p>

<p>I assume most countries will have similar laws.</p>

<p>Regards your question about the severity of the punishment. That would be down to a judge and I'm unaware of any such case to use as precedent so one could only speculate. </p>
