Is VirusTotal&#39;s business model violating copyright laws? For those not familiar, VirusTotal is a Google-owned site that allows anyone to upload any binary so it can be scanned by numerous anti-virus engines. Many third-party products also integrate the VirusTotal API so that binaries are automatically uploaded based on system scans. The way VirusTotal makes money is that they charge subscription fees so that other users can download the binaries that were uploaded. So my question is, doesn't this violate the copyright of the binary authors? Now, obviously malware authors are not going to claim ownership of their binaries but a lot of other non-malicious binaries get uploaded to VirusTotal. And because anti-virus engines are not perfect they will mark legitimate software as malware. When a binary is marked as malware, according to VirusTotal, it will send that sample to other third parties as part of a sharing program. In summary: VirusTotal allows anyone to upload any binary regardless of the EULA of the software. VirusTotal facilitates sharing of the binary again regardless of the EULA. VirusTotal profits off the uploaded binaries by charging a subscription fee. VirusTotal provides no recourse available when legitimate software is marked as malware, only to contact each individual anti-virus company to report the false positive. Putting aside the benefits of helping to identify malware, it seems to me that VirusTotal is in violation of copyright laws.
VirusTotal is no different than many internet companies which operate with user-supplied content (i.e. Facebook, Youtube, etc.), and they are no different in the way they protect themselves with a TOS that outlines all aspects of their use of any material contributed or licensed or sold. Their Terms of Service states that users must own the copyright for what they upload and give VirusTotal a license to use it and relicense it and profit from it. VirusTotal uses the &quot;safe harbor&quot; clause of the DMCA to limit their liability for illegal uploads and provide a recourse for users who claim a copyright violation of uploads. And VirusTotal clearly seek to limit their liability for their own service in the case of false positives by standard clauses that claim they &quot;do not warrant or guarantee that the services are accurate, reliable or correct.&quot; They're really no different than many internet companies; read the Terms of Service. It's a legally binding contract for all users, though some jurisdictions may limit some aspects of it.
Yes, it's illegal. 18 USC 1030 (a) (5) (A) [Whoever] knowingly causes the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer [shall be punished as provided in subsection (c) of this section]. &quot;Damage&quot; is defined at (e)(8) to mean &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;. Your proposed attack would certainly cause impairment to the availability of the Stack Exchange system and the data and information which it hosts. Whatever else you may think about the Stack Exchange terms of service, they certainly do not authorize any user or moderator to &quot;destroy the site&quot; in any sense such as you describe. It's not necessary for the TOS to explicitly say &quot;you may not do X&quot;; it's enough that they don't say that you may do it. To use a firewall analogy, it's &quot;default deny&quot;. &quot;Protected computer&quot; is defined in (e)(2) to mean, essentially, any computer that is used in or affects interstate commerce. Which means practically every computer that has ever accessed the Internet, and certainly includes Stack Exchange servers. So your proposed attack would include all the elements of a violation of this section. Such a violation is punishable by up to five years' imprisonment if it causes a loss of more than $5000 (see (4)(A)(i)(I)), which if such an attack were successful, it certainly would. Greater penalties are possible in certain circumstances. Even if the loss does not exceed $5000, or if the attack is merely attempted but without success, it is still punishable by one year imprisonment or a fine ((4)(G)(i)). There is nothing in the terms of service saying you will go to federal jail for destroying stack exchange. Irrelevant. It is not up to Stack Exchange Inc. or its TOS to determine who does or doesn't go to federal prison. Rather, it is up to Congress to determine what conduct deserves such punishment (as they did in 1984 by enacting this law), up to federal law enforcement and prosecutors to investigate and make a case against an alleged violator, and up to the federal courts to determine if the accused is guilty and how they should be punished.
Disclaimer: I'm not a lawyer. This advice may be materially inaccurate. What does redistribution mean? Redistribution means you have somehow caused the software to make its way to another person. Things that probably count as distribution: Placing the file on a public website. Printing the binary in hex onto paper and giving that paper to someone else. Putting the file onto a USB drive and handing it to someone. Putting the file onto your own computer, then giving that computer to someone else. Putting the file onto a shared network drive. Things that probably don't count as distribution: Copying the files onto your own computer(s) Compiling the program Placing the program on your phone. Printing out the source code on paper, but not sharing it. As a practical matter, I recommend ensuring that BSD license accompanies any instances of the software, even if you don't intend to distribute those instances. If you don't distribute it, then nobody will see it. If you &quot;inadvertently&quot; distribute the software, then including the license means you are in compliance. Should you include the license in the exe or in the same folder: The specific clause is: Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. Including the license in the exe (e.g., via some sort of credits menu) is typically fine. I'll note that this is the approach used by Chrome (help-&gt;about chrome has a link to &quot;other open source software&quot; which includes these licenses). This approach works well for software which makes use of an installer, since users probably won't be looking in the install folder. Including the license in the folder adjacent to the exe is also typically fine. If your application does not have an install process (e.g., installed via xcopy deployment), then this approach works well, since users will easily be able to find the license. If your software is sold in a physical box, then printing out the license and including that license inside the box also works. What if I violate the license by not including the BSD terms? If you violate the license, you are subject to a lawsuit for copyright violation. What happens next depends on how the copyright owners wishes to proceed: Some copyright owners will sue. The actual results/penalties for such a violation will depend on a variety of factors. Some copyright owners will ask you to comply with the license. If you respond by apologizing and then complying, that's as far as it will go. Some copyright owners will ask you for money (with threat of lawsuit). I would expect this result if the copyright owners offers a dual-licensing scheme (i.e., where you can pay the copyright owner to exclude the acknowledgement).
Yes. The license itself is really just one sentence long, and states explicitly that this is allowed. Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
It doesn't make a difference if the product is free or commercial use, if it's initiated by a company or an individual. What you are considering would be a &quot;derivative work&quot; and without explicit permission from the copyright holder, it is considered a violation.
Not having immediate access to the source doesn't preclude a finding of copyright infringement. If you have seen the source material, subconscious infringement can happen. However, in this example, both the short phrases doctrine and the merger doctrine would likely prevent the is_prime function from having copyright. Words and short phrases are not individually copyrightable, so the name would be free to take. Regarding the implementing code, if it isn't an exact copy (i.e. copy and paste), courts will apply the abstraction-filtration-comparision test. They may find that you took the selection and arrangement of instructions from the original source, albiet using different names. That selection and arrangement would probably be considered a substantial similarity and, if not for the merger doctrine, infringement. However, given the limited number of ways to express the prime-detection algorithm means that the expression of that idea has merged with the idea, and thus is not protected by copyright. (Or in some jurisdictions, merger is a defence to infringement rather than a bar to copyrightability).
Sure, you can. But if you, from the US, contract with and pay someone outside the US and then use the results of that effort - the reverse-engineered code, either directly in violation of copyright or to find workarounds - within the US, you may not be culpable in a criminal sense (depending on different jurisdictions and trade/IP agreements), but you certainly would be liable in a civil sense. If the US based software developer (I assume a US-based software company, as you said "outside the US") tracks you down, they can open a civil action against you for any damages they want to claim, including theft of IP, loss of profits, EULA violations, and on and on, because you posses and are using reverse engineered code. How much money do you have to lose?
Such clauses are called "copyright assignment", "invention assignment", and/or "works for hire" clauses, partly depending on the clause's intent and wording. They're pretty common in employment contracts for software development and some creative positions. Frankly, the clauses don't actually do much, at least in the US -- copyright law already recognizes the concept of works made for hire (which belong to the employer), and claims too far beyond that are often rejected if they aren't obviously related to company business. With that said, your hypothetical programmer's painting is safe unless it depicts, say, the contents of an email from the CEO. :) Even if the clause technically entitles the employer to claim ownership, the employer has no legitimate interest in doing so. Likewise, that app created outside work is safe as long as it is created using no company resources and is unrelated to the employer's business. If the app is obviously related, that's where things get hairy.