Creating Viruses: Understanding Criminal Law And Bioethics

Creating a computer virus is not explicitly illegal, but distributing one is. The transmission of a virus that causes damage without authorization to a protected computer is a crime under the 1994 Federal Computer Abuse Act. The law specifically states that the transmission and resulting damage must be intentional. A conviction can result in a prison sentence of up to ten years and a substantial fine. Each state has its own computer laws that can be applied toward computer crimes, and civil actions can be taken against malicious code writers even if they are found innocent of criminal charges. The hard part for law enforcement is tracking down the perpetrator and proving malicious intent.

Characteristics and Values of laws broken when creating a virus

Explore related products

Consolidated laws of New-York : Penal law: 2025 edition

$30

Criminal Element Control: Countering conduct violations restoring societal calm and stability.

$29.99

Herbal Remedies & self Care for Common colds, Flu, virus

$9.99 $26.95

Art of Computer Virus Research and Defense, The

$44.88 $54.99

Malwarebytes Premium | Amazon Exclusive | 18 Months, 2 Devices | Windows, Mac OS, Android, Apple iOS, Chrome [Online Code]

$39.99

Malware Development for Ethical Hackers: Learn how to develop various types of malware to strengthen cybersecurity

$47.97 $54.99

Creating a virus is not illegal, but infecting someone else's computer with it is

Creating a computer virus is not inherently illegal, and there are no laws specifically prohibiting the act of crafting a virus. However, the story changes when it comes to infecting someone else's computer with that virus. Transmitting a virus that causes damage to another person's computer system is where the line of legality is crossed.

The distinction is crucial: while developing a virus may not be illegal, using it to infiltrate and harm others' computer systems is a criminal offence. This distinction is reflected in various laws and legal precedents around the world. For example, the 1994 Federal Computer Abuse Act in the United States specifically criminalises the "transmission" of a virus that "causes damage without authorisation to a protected computer". This transmission and the resulting damage must be intentional, and a conviction can result in severe penalties, including a ten-year prison sentence and substantial fines.

Similarly, in the United Kingdom, the Computer Misuse Act of 1990 has been used to prosecute individuals who create and spread computer viruses. Christopher Pile, also known as the Black Baron, was the first person arrested in the UK for writing computer viruses. He pleaded guilty to 11 charges and was sentenced to 18 months in prison under this Act.

The challenge for law enforcement lies in tracking down the perpetrators and proving malicious intent. With the constant onslaught of hacking attempts and the international nature of the internet, it can be difficult for authorities to investigate and prosecute every case. However, when a malicious attack gains significant media attention or poses a severe threat to critical infrastructure, the authorities are more likely to intervene.

It's worth noting that the legal consequences of distributing a computer virus can be severe, impacting an individual's reputation and future prospects. A criminal record resulting from such an offence can make it challenging to find employment, especially in reputable companies. Therefore, it is essential to understand the legal implications and potential penalties associated with infecting others' computer systems with a virus.

Explore related products

Practical Malware Analysis: The Hands-On Guide to Dissecting Malicious Software

$47.69 $59.99

Evasive Malware: A Field Guide to Detecting, Analyzing, and Defeating Advanced Threats

$42.42 $69.99

MAoS - Malware Analysis on Steroids: Fighting Malware to the Death - Real-World Threats and Reverse Engineering Tactics

$50

Malwarebytes Premium + Privacy VPN bundle | 1 Year, 4 Devices | Windows, Mac OS, Android, Apple iOS, Chrome [Online Code]

$92.99

Learning Malware Analysis: Explore the concepts, tools, and techniques to analyze and investigate Windows malware

$52.46 $54.99

Norton 360 Deluxe 2025, Antivirus software for 5 Devices with Auto-Renewal – Includes Advanced AI Scam Protection, VPN, Dark Web Monitoring & PC Cloud Backup [Download]

$24.99 $89.99

The transmission of a virus that causes damage is a crime under the 1994 Federal Computer Abuse Act

While it is not strictly illegal to create a computer virus, it is a crime to transmit one that causes damage. This is a federal offence under the 1994 Computer Abuse Act. The law makes causing intentional damage using malicious mobile code a criminal act. If an individual writes or distributes rogue code that causes damage to someone else’s computer system, they can be charged. The challenge for security experts is to identify the perpetrator and prove malicious intent.

The 1999 case of David L. Smith, the author of the Melissa virus, demonstrates the law's application. Smith was arrested and charged with several federal and state crimes. He was sentenced to prison and ordered to pay fines and restitution. The Melissa virus caused tens to hundreds of millions of dollars in damage, which included the cost of cleanup and potential monetary loss.

The State of Pennsylvania has also taken steps to address this issue by enacting a law that imposes prison terms of up to seven years, a $15,000 fine, and restitution for those convicted of intentionally spreading a computer virus. Christopher Pile, the creator of the Pathogen, Queeg, and Smeg viruses, was another early example. In 1995, he pleaded guilty to 11 charges and was sentenced to 18 months in prison under the UK's Computer Misuse Act of 1990.

However, the enforcement of these laws can be challenging due to the high volume of hacking and malicious code distribution occurring daily. The international nature of the internet also complicates the legal process, as not all countries have the same priorities or resources dedicated to addressing computer crimes. Despite these challenges, the transmission of a damaging virus remains a serious offence, and those who engage in such activities can face significant legal consequences.

Explore related products

Mastering Malware Analysis: A malware analyst's practical guide to combating malicious software, APT, cybercrime, and IoT attacks, 2nd Edition

$47.97 $54.99

The Art of Mac Malware, Volume 2: Detecting Malicious Software

$39.99 $59.99

Rootkits and Bootkits: Reversing Modern Malware and Next Generation Threats

$39.34 $49.95

Practical Binary Analysis: Build Your Own Linux Tools for Binary Instrumentation, Analysis, and Disassembly

$51.83 $59.99

Malware Data Science: Attack Detection and Attribution

$43.82 $59.99

Black Hat C++: Reverse Engineering, Malware Development, and Privilege Escalation with Modern C++

$8.99 $26.5

The law states that the transmission and damage caused must be intentional

Creating a computer virus is not inherently illegal. However, the transmission of a virus that causes damage "without authorization to a protected computer" is a crime under the 1994 Federal Computer Abuse Act. This law specifically states that the transmission and resulting damage must be intentional. The penalties for such an act include a ten-year prison sentence and a substantial fine. A less severe version of this crime, characterized by "reckless disregard" for the damaged computer, can result in a one-year jail sentence.

The challenge for law enforcement lies in tracking down the perpetrators and proving malicious intent. Despite the high frequency of hacking and the distribution of malicious code, the number of investigations and prosecutions remains low. This is because most cases do not garner enough media attention or pose a significant threat to critical infrastructure. However, when a case does attract media attention, the perpetrators can face serious consequences. For example, David L. Smith, the creator of the Melissa virus, was arrested and charged with multiple federal and state crimes.

The civil and criminal penalties for creating and distributing computer viruses vary across different states and countries. In the United States, civil actions can be taken against writers of malicious code, even if they are found innocent of criminal charges. Additionally, writers of malicious code can be found guilty if the "recovery damage" exceeds $1,000, which includes the costs of cleanup and any potential monetary losses. In the United Kingdom, the Computer Misuse Act of 1990 resulted in an 18-month prison sentence for Christopher Pile, the author of the Pathogen, Queeg, and Smeg viruses.

It is important to note that the creation and distribution of computer viruses can have significant financial implications for the perpetrators. The damages caused by these viruses can reach billions of dollars, far exceeding the resources of most virus creators. Additionally, a criminal record can have long-lasting effects, damaging reputations and making it challenging for individuals to find employment.

While the exact laws and penalties vary, it is clear that the intentional transmission of computer viruses that cause damage is illegal in many jurisdictions. The consequences of such actions can be severe, including prison sentences, fines, and civil judgments. Therefore, it is crucial for individuals to prioritize protecting themselves from viruses and engaging in legal online activities.

Explore related products

Malware Analyst's Cookbook and DVD: Tools and Techniques for Fighting Malicious Code

$55.14 $59.99

McAfee Total Protection 2025 5-Device | AntiVirus Software 2025 for PC, Secure VPN, Password Manager, Identity Monitoring | 1 Year Subscription Auto-Renewal

$19.99 $119.99

Evading EDR: The Definitive Guide to Defeating Endpoint Detection Systems.

$47.35 $59.99

Hands on Hacking: Become an Expert at Next Gen Penetration Testing and Purple Teaming

$24.99 $45

Assembly Programming for Malware Analysis: Malicious Software Development and Malware Analysis with Assembly (Assembly Programming Language: for Beginners, ... Computer Architecture, for Cyber Security)

$9.99 $25.97

Norton 360 Premium 2025, Antivirus software for 10 Devices with Auto-Renewal – Includes Advanced AI Scam Protection, VPN, Dark Web Monitoring & PC Cloud Backup [Download]

$29.99 $99.99

A conviction can result in a 10-year prison sentence and a substantial fine

Creating a computer virus is not inherently illegal, but using it to infect and damage someone else's computer system is. In the United States, several federal and state laws explicitly prohibit the creation and distribution of computer viruses, with penalties including prison terms and substantial fines. For instance, the State of Pennsylvania has enacted legislation that imposes a prison sentence of up to seven years, a $15,000 fine, and restitution for those found guilty of intentionally spreading a computer virus.

The challenges lie in tracking down the perpetrators and proving malicious intent. However, when a virus attack gains significant media attention or poses a severe threat to critical infrastructure, law enforcement agencies can devote resources to identifying and prosecuting the responsible individuals.

The consequences of a conviction for creating and distributing a computer virus can be severe. In addition to potential prison sentences, individuals may face substantial financial penalties. The financial impact of a computer virus can be extensive, including the costs of cleanup, data loss, and system restoration. In some cases, the damages caused by widespread malicious code can reach tens to hundreds of millions of dollars.

The legal consequences for creating and distributing a computer virus vary depending on the jurisdiction. Each state in the United States has its own computer laws, which can be applied to computer crimes. Additionally, international laws come into play due to the global nature of the internet. However, the enforcement of these laws can be challenging, as not all countries prioritize addressing computer-related crimes to the same extent.

It's important to note that the creation and distribution of a computer virus can result in both criminal and civil liabilities. Even if an individual is found innocent of criminal charges, civil actions can still be brought against them under specific laws, such as the act mentioned in the source. This act allows civil judgments against writers of malicious code, regardless of whether their programs caused damage, as long as the "recovery damage" exceeds a specified threshold, typically a monetary value.

The case of David L. Smith, the creator of the Melissa virus, illustrates the potential consequences. Smith was arrested and charged with multiple federal and state crimes, facing jail time and potentially substantial fines. While the exact details of his sentence are not mentioned in the source, the fact that his case gained media attention likely contributed to the law enforcement response and the pursuit of legal action.

Explore related products

Norton 360 Deluxe 2025, Antivirus software for 3 Devices with Auto-Renewal – Includes Advanced AI Scam Protection, VPN, Dark Web Monitoring & PC Cloud Backup [Download]

$19.99 $74.99

Black Hat Programming in C++: Build Malware, Shellcode, and Offensive Tools for Hackers and Security Researchers

$7.99 $23

The Android Malware Handbook: Detection and Analysis by Human and Machine

$45 $49.99

Black Hat Scripting with C++: Create Stealth Malware, Inject Code, and Build Offensive Tools for Red Team Operations

$24

The Art of Mac Malware, Volume 1: The Guide to Analyzing Malicious Software

$43.71 $49.99

Malware Analysis Techniques: Tricks for the triage of adversarial software

$42.14 $54.99

In the UK, the Computer Misuse Act of 1990 was used to sentence a virus creator to 18 months in prison

In the UK, the Computer Misuse Act of 1990 was used to sentence a virus creator, Christopher Pile (aka 'the Black Baron'), to 18 months in prison. Pile pleaded guilty to 11 charges, including writing the Pathogen, Queeg, and Smeg viruses.

The Computer Misuse Act (CMA) was introduced in 1990 to address the growing issue of cybercrime and computer misuse. It has been amended several times to keep up with the evolving nature of cybercrime and the increasing sophistication of attacks. The CMA criminalizes unauthorized access to computer material, intentional impairment of computer operations, and the creation or distribution of tools used in computer misuse offences. It also addresses the collection, processing, and storage of personal data, reflecting the importance of data protection in the digital age.

The CMA has been a significant piece of legislation in combating cybercrime in the UK, with its provisions being utilized to prosecute various offenders. For example, in 2019, a 19-year-old named Gareth Crosskey pleaded guilty to offences under Sections 1 and 3 of the CMA by accessing someone's Facebook account and attempting to extort them. He was sentenced to 6 and 12 months' custody for the respective offences.

Despite its contributions, the CMA has faced criticism for its initial hasty introduction, which led to challenges in proving intent and differentiating between less severe and more serious computer-related crimes. There have been ongoing calls for reform to ensure the law remains effective and relevant in the rapidly evolving cyber landscape.

In addition to the CMA, other laws and acts may come into play when dealing with the creation and distribution of computer viruses. These can include federal and state laws, as seen in the case of the Melissa virus, where the author was charged under multiple jurisdictions.

Frequently asked questions