united-states
Is infecting your own files illegal? How does this differ from a more aggressive form of DRM?
<p>I'm here from the <a href="https://security.stackexchange.com/questions/148811/could-youtube-downloaded-videos-be-infected-by-youtube">infosec se</a> where we're currently discussing if it is possible for Youtube to infect the files on their servers with malware. My question is - <strong>Is it illegal for them to do this?</strong> What if they used their own malicious code? How does this differ from a DRM solution? </p>

<p>For anyone wondering what the point of this might be - it would be to discourage users from downloading videos illegally from youtube. </p>

<p>Knowingly causing damage to 10 or more computers belonging to other people is a felony under the <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" rel="nofollow noreferrer">Computer Fraud and Abuse Act (CFAA), 18 U.S.C. 1030</a>.</p>

<p>I can't be sure of the answer under US <em>computer-specific</em> law, but I can suggest some important legal themes that may arise under general law.</p>

<p>The issue might (in legal terms) be analogous to booby trapping a store you own, in case an intruder comes in. In English law, at least, you are liable for foreseeable harm suffered by persons entering your property, <em>even if they don't have permission to enter</em>. (I'm not sure how much that principle still applies in US law but the basic legal principle probably does still exist and is relevant)</p>

<p>That is, if you set up an Indiana Jones style death-trap in your shop's back-room, on the basis "Anyone who is killed by it shouldn't have been there anyway!", you'd most likely still be found guilty of murder (or some other legal form of culpable killing), the justification wouldn't suffice.</p>

<p>I suspect a similar legal position would apply to deliberate malware of your own computer systems - the principle "volenti non fit injuria" (roughly meaning, a volunteer can't claim in law for a resulting injury) wouldn't help you, because they wouldn't have been a true "volenti" (they consented by their action to the reasonably foreseeable risks of usual tech intrusion but did not consent to the risk of deliberate malware waiting for them.</p>

<p>If you put a sign on the website <em>"Our servers contain malware, do not intrude other than at your own risk"</em> or similar, that might free you from direct liability. </p>

<p>But if your malware harms other parties, you'd still probably be liable for that harm since it's a foreseeable consequence  of keeping malware on your server in an unsafe way, and not deleting them on sight.</p>

<p>Specific computers-related laws would probably be very specifically worded. For that, you'd best get an answer from someone who knows US computer law. But again, foreseeability and reasonable care if you keep malware, could be important. </p>

<p>(A possibly-significant corroborative indicator is that, although piracy is a major source of computer loss, very very few software companies meet it by booby-trapping their software.)</p>
