Is downloading leaked malware source code illegal [US]? I've seen similar questions regarding leaked data/malware, and from what I've seen, it appears that code, regardless of legality, is under copyright, and therefore shouldn't be possessed. But can the copyright holders sue without identifying themselves? Is it a risk with any significance? Also I saw that merely downloading also may be &quot;hacking&quot; under the Computer Fraud and Abuse Act (though presumably distributing is a larger offense/more likely to be pursued). So is downloading/possessing leaked source code illegal? Secondary question: Why does this differ from the legality of reversing source code (which is perfectly allowed unless the code is patented)?
Source code is protected by copyright, even if it is designed for an unethical or illegal purpose. Making a copy without permission is copyright infringement, as is distributing a copy without permission, unless an exception to copyright applies. In the US the primary exception is fair use. Whether a use constitutes a fair use or not depends on the detailed facts, including the nature and purpose of the use, and the plausible effect on the market for the protected work. The question does not contain enough information for even a rough fair use analysis. It is generally not unlawful to create malware, only to use it to access a computer or network without permission, or to do other unlawful acts. Thus the copyright holder could sue without implicating him- or herself in a crime. However, damages would probably depend largely on the commercial value of the program, and if the only plausible use was criminal, the legitimate value might be quite low. Possessing an unauthorized copy of a work is not a crime, nor is it infringement. The maker and distributor of an unauthorized copy commits infringement, but the recipient does not. Whether unauthorized access and downloading is a crime under the CFAA depends on the factual details. Many things that might technically be crimes under the CFAA are not prosecuted. That is a matter for the relevant prosecutor to determine.
There is no loophole because a work released in object code form only — without the Corresponding Source — is not released under GPLv3, even if you say it is. GPLv3 only requires them to also provide whatever source came with it False. Providing the Corresponding Source is compulsory (§6 as pointed by @cHao). If they do not have access to it, it means the work has not been released under GPLv3.
The website owner brings in an expert programmer who testifies that the user cannot have gotten to a certain part of the site (or download, etc.) without having clicked to accept the terms of service, and that this document they're holding is a true and correct copy of the terms of service as of that date. That's evidence in favor of the site, and an adverse party has to have stronger evidence in order to overcome it. If the person didn't save a copy of the terms themselves, they'll have a hard time on this. Then the other party's attorney tries to discredit the programmer by asking questions like "how do you know there are no bugs in the software which could have allowed somebody to reach this without agreeing to the terms of service" etc. Apparently, some sites don't require users to click indicating agreement. If the company has significantly changed the site, terms of service, etc. since the time the user registered, and doesn't keep any copies of old versions around, and admits this, they'll have a hard time enforcing an agreement (as they can't produce a copy of it). If the user kept a copy, the user might be able to present that. It's up to the finder of fact to decide what to believe and how much weight to give the various witnesses' testimony.
Both Bob and Charles are liable for infringement in the US. The fact that Charles had no idea that Bob was an infringer is not a defense, but it mitigates the statutory damages consequences for him. Either party can negotiate with Alice after the fact for a license, and Alice can grant either party but not the other permission to copy. The terms of the license that Alice gives Bob could either allow CCo reposting, or some more restrictive redistribution right. If the license requires a notice prohibiting further redistribution and Bob omits that notification, Bob will have breached the terms of the license in omitting the notification, so we're back to square 1. If Alice fails to specify a no-redistribution notification condition on Bob's reposting, Alice may have granted an implied license to the world, a matter which has to be determined by the courts.
Being or not being open source makes fairly little difference in trademark law. If a commercial firm (Yoyodyne, say) had used the name &quot;Portable Network Graphics&quot; and the abbreviation &quot;PNG&quot; in trade, and taken such further steps as would be needed to protect it in the relevant countries, that firm would have a protectable trademark. Note that in some countries, a trademark must be registered to have any protection at all (much of the EU follows this rule). In others, use in commerce can offer some protection even without registration (the US follows this rule). Had this happened (in an alternate reality) Yoyodyne could have sent a cease and desist letter when open source developers started using the mark. If the devs did not cease, Yoyodyne might have obtained an injunction, or damages for trademark infringement, or both. They could also have issued a takedown notie to the site hosting the project. But had Yoyodyne failed to defend the mark effectively and allowed it to become generic, Yoyodyne might have lost all rights to it. Also, had Yoyodyne ceased to use it in trade for a significant period, they might have lost rights. This is a place where the different laws in different countries might lead to different results. Note that &quot;Portable Network Graphics&quot; is rather descriptive, and not particularly distinctive. Descriptive marks, like &quot;Tasty Pizza&quot; generally get weaker protection, while more distinctive marks, such as &quot;LuAnn's Tastee Pizza&quot; are more strongly protected, in general. Again this depends on the country, and the specific facts. In general the first to use, or to register a mark, gets the rights. When one entity is the first to use, but a different one is first to register, things can get confusing, and results will be different in different countries. Note that a Cease and Desist letter is not a legal requirement. It is a threat of possible future legal action, and often an offer to avoid such action if the recipient does as the sender requests. The recipient can comply with the letter, wait for court action, or try to make some sort of compromise deal. Open source projects, as other answers suggest, often choose to comply.
Unless you have a legally valid IP right related to the specification that statement is meaningless. When a software license is granted it is based on the copyright of the code. The copyright of the spec. just stops people from copying the spec - it does not protect the information in it. You can restrict copying of the spec. under copyright, you can make up a name for the spec (like USB or Bluetooth) and get a trademark and only allow the trademark use in limited cases(doesn’t stop implementation of the spec), or get a patent that would be necessarily infringed if something complying with the spec was created and used, sold, made, etc. or you can keep it secret and only show it to people who contractually agreed with your terms.
If the tool circumvents Windows' copy protection (which is a computer question, not a legal one, but I cannot imagine a circumstance in which this isn't access-circumvention), then it is a violation of 17 USC 1201, which forbids &quot;circumvent[ing] a technological measure that effectively controls access to a work protected under this title&quot;. It is both illegal to use, and to &quot;manufacture, import, offer to the public, provide, or otherwise traffic&quot; in such a program.
When the question is "Can I be sued for..." there can't ever be a really useful answer, because anyone can be sued for just about anything. The suit may be tossed as pointless early in the process, but it can be filed. That said, could there be a valid ground of suit against a developer for creating a scraper? Possibly. Scraping a site could be against the site's TOS. It could be largely a way of committing copyright infringement. It could be unlawful in some other way. For most sites, scraping is not unlawful. Google does it all the time. If there is no legitimate use for the scraper, or very nearly none, so that any user is likely to be acting maliciously and unlawfully, and if the developer knows this, or any reasonable developer should know this, then the developer could possibly be found liable for the illegitimate actions of those who use the scarper. If there is a legit use for the scraper, or the developer would plausibly think that there is, then such development is not illegal, and a successful suit against the developer is unlikely.