When are computer viruses illegal?
<p>Is it legal to create and send someone a computer virus if it doesn’t damage their computer? For example if a computer virus just spies on a persons screen, is that illegal?  I red on a <a href="https://www.quora.com/Why-dont-government-make-it-illegal-to-send-viruses" rel="nofollow noreferrer">Quora</a> question that computer viruses aren’t illegal because it’s too subjective to say "a program that messes up a computer is considered a virus". I imagine the surrounding activities, like stealing credit card information when they type it into a website, are the illegal part. </p>

<p>I heard of some viruses that only mess up other viruses, so does a virus have to damage a computer? </p>

<p>Laws against such actions are not stated in terms of popular and fluid concepts like "computer virus", they are stated in terms of clear concepts like "unauthorized access". There are federal and state laws against this. <a href="http://www.ncsl.org/research/telecommunications-and-information-technology/computer-hacking-and-unauthorized-access-laws.aspx" rel="nofollow noreferrer">This web site</a> lists and links to all of the state laws on the matter. There is also a <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" rel="nofollow noreferrer">federal law</a>: a detailed legal analysis by DOJ is given <a href="https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ccmanual.pdf" rel="nofollow noreferrer">here</a>. There are some limits to federal jurisdiction, for example "protected computers" include "computers  used  in  or  affecting  interstate  or  foreign  commerce or communication". The term "affecting interstate  or  foreign  commerce or communication" is widely used in federal law, and can be used to prohibit <a href="https://en.wikipedia.org/wiki/Wickard_v._Filburn" rel="nofollow noreferrer">growing feed</a> for your own animals. Anything that you "send" clearly affects interstate commerce (the internet is internationally connected). <a href="https://www.law.cornell.edu/uscode/text/18/1030" rel="nofollow noreferrer">18 USC 1030(a)</a> says</p>

<blockquote>
  <p>Whoever ... (2) intentionally accesses a computer  without  authorization or  exceeds  authorized    access,    and    thereby 
  obtains...(C) information from any protected computer</p>
</blockquote>

<p>Essentially, a computer connected to the outside world is protected.</p>

<p>The key here is "without authorization". If you authorize MS to report back stuff about your computer, that is not unauthorized. It may not be possible to use their product without giving such authorization, in which case you can use a different product that doesn't require that you grant authorization. There is also the possibility that some software producer has technically violates the law because they think that it's okay for <em>them</em> to access the computer as long as they do no harm. Typically, people are not aware that they have granted software publishers access to their computer.</p>

<p>The concept of "harm" is pretty much irrelevant to computer-crime criminal law. It would be relevant, though, if a plaintiff were to sue someone for sniffing around their computer: then you'd have to show that you were damaged.</p>

criminal-law internet