Can a programmer be liable if a customer commits a crime using their software? Is it true that if a programmer writes a program, sells the program to a customer and customer commits a crime with this program, the programmer might be found liable by the court? I was wondering as there are many Turing complete languages that allow one to make something illegal. Also, there are some robot cars, and if one calibrates them incorrectly, those can commit crimes. So can a programmer ever be liable if they have not done anything illegal with software, but the customer does?
Some jurisdictions have laws which make it illegal to create a software which is intended to commit crimes (usually computer-related crimes). For example, the German criminal law §202c StGB makes it illegal to create (or sell, convey, etc.) a program which has the purpose to commit crimes against the previous paragraphs 202a (stealing data) or 202b (intercepting data). The constitutional court later clarified that this law is only to be used against programs which serve no other purpose than to commit crimes and not against &quot;dual use&quot; tools which can also be used for legitimate purposes. So if one were accused of committing the crime of creating such a program, then a possible defense strategy could be to convince the court that they never intended for their program to be used to commit crimes.
A fundamental requirement of criminal culpability is intent. Based on the description this whole process is happening after a user has already had their phone seized. If a person was not aware of Signal's hidden files to damage the police's data forensics software, they will not have met the criminal intent requirement, either maliciously or under a criminal negligence theory. None of the prongs of CFAA are strict liability statutes (18 U.S. Code § 1030 &quot;Whoever having knowingly accessed a computer...&quot;), so that would not apply here. If we imagine a person that is aware of all the information from Signal about their app intentionally abusing Cellebrite's package and with intention to cause damage downloads Signal's malicious files to their phone, I think it's an open question whether or not they would be liable under the CFAA. Specifically, 18 U.S. Code § 1030(a)(5)(A) (emphasis mine) Whoever knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer; An argument on this could go both ways. On the one hand, the owner of the phone could be found to not have substantially caused the information to be transmitted to a protected computer, as the police were the integral cause for that in executing their warrant. On the other hand, this sort of file could be considered a digital &quot;booby trap,&quot; and booby traps are illegal for essentially this reason, that they have a foreseeable effect of causing harm to people who are lawfully inside a building without the owner's permission. In this case, the owner's trap was sprung by law enforcement but still placed by the owner in order to damage them.
Since there are cases where it is legal to break into a car, is it legal to publish a guide on how to break into a car online? It is legal to publish this guide. Indeed, it is legal to do so even if there are no cases where it is legal to do so. Does it need to have a disclaimer saying to comply with all applicable laws? No. Could the author be held responsible if someone uses the instructions to illegally break into a car? Generally not. I could imagine that there might be some very specific and exceptional fact pattern where it might, but that would be the rare exception. But see man sentenced to twenty-years in prison after pledging support to ISIS and uploading a bomb making video related to that pledge.
If you use the reviewer's code, or code derived from it (e.g. if you just changed a variable name) then they own the copyright on that part of the software. If the reviewer describes a solution which you implement, or if you re-implement the code from scratch while taking ideas and methods from the reviewer's code, then you own the copyright on that code. However if there are only a few ways to implement something in code then the code is not creative and hence cannot be copyrighted. For example the regular expression in the question you link to is (as far as I can tell) the only correct solution to the problem: any programmer addressing the problem will have come up with that RE. In this the position is akin to a database of phone numbers: while the collection may be copyright (depending on whether selection or arrangement required creativity), the fact that Alice Jones has the number 012345 is not copyrightable, and neither is the alphabetical arrangement of names. Where it gets messy is the boundary between the two. The requirement to detect 4 or more repeated digits in a credit card number could be implemented in a number of ways, but whether there are enough of these to qualify any particular solution as "creative" would be a matter of fact for a court to decide.
The EULA is in most jurisdictions a legally binding contract; there is plenty of case law that supports this. You can only be liable under a contract for breaching its terms and only to the extent that the other party suffers harm from that breach. Clearly, if you haven't read the terms then you are greatly increasing the chance that you will inadvertently breach them but not reading them would not, of itself, be a breach and I can't see what harm could flow anyway.
It depends on what you are selling to the enterprises. You could be selling just a licence to use the program, and retain all the rights on the source code. You could be selling the rights to the source code. For #1, the source code is yours and you can do what it pleases with it1. In fact many programs offer both an open-source licence (which usually forces the user to make its changes to the code publicly available) and a commercial one (which allows the user to keep the modifications of the source code for themselves). For #2, the source code is no longer yours so it is not up to you to decide what to do with it. 1I am assuming no other agreements imposing limits on those; for example that none of your contracts to your customers have a clause forbidding you from making the code available to the public.
There are two processes that go on all the time, and are generally considered legal: Encryption algorithms are attacked by cryptographers and weaknesses identified. In most cases this results in a gradual reduction of the work required to break the algorithm by a few orders of magnitude at a time. The history of SHA-1 is a good example of this. People identify security holes in software and follow responsible disclosure rules. This means that they notify the vendor and give them an opportunity to fix the bug before going public. Note that this is merely considered good practice; immediate publication would be legal too. Your scenario sits at the intersection of these two processes: an attack (process 1) which completely destroys the security of many systems (process 2). Responsible disclosure occupies a legal grey area: someone who finds a bug might have had to exploit it to at least some degree to demonstrate it, and there have been cases where vendors have used police or courts to retaliate. However this wouldn't apply to your scenario. In America the First Amendment makes it unconstitutional to use the legal system to stop people saying true things (copyright excepted, and untrue things are often legal too). If your Wunderkind lives in America then a widely published factual description of their solution would therefore be legal. Legal problems only start if they provide the details in secret to people they should reasonably suspect of intending to use them for crime.
If it's patented then it doesn't matter that you independently came up with it. Most software is not patented, though. Most developers do not even think about patents when writing code. In theory you could spend your time keeping up to date on software patents so that you avoid infringing. But this probably only makes sense for specialists who would want to read the latest patents in their field anyway. All software is protected by literary copyright, though. In this case they will try to prove that you did not independently created it, and did copy it. Whelan v. Jaslow in 1986 ruled that structure, sequence and organization of a computer program were protected by copyright. So you could be liable even if you did not just copy and paste sections of code. But even if you're worried the court would get things wrong and think you copied a program when you never even saw it in the first place, there is really nothing you can do about it.