What is the definition of computer virus by law?The definition seems to be broad According to the Indian IT Act we cannot place computer virus(which includes cookies) without user permission but does that mean we need to take permission even for placing nessecary cookies? According to the IT Act the definition of computer virus as given here says that it is any information that executes itself as soon as another program is started. Now many apps are set to autostart with windows. (iii) &quot;computer virus&quot; means any computer instruction, information, data or programme that destroys, damages, degrades or adversely affects the performance of a computer resource or attaches itself to another computer resource and operates when a programme, data or instruction is executed or some other event takes place in that computer resource; Also, several websites deploy cookies and they too fall under this definition as provided here. Now the definition made there makes it seem many websites accessible in India are illegal. How is it possible? Is it really the definition made. (This is not legal advice) My question here is according to the definition many things including cookies and other daily b software become illegal which is not the case in India. How am I misinterpreting the definition? It is true that by taking permission this can be avoided but some cookies are necessary for the function of the website without consent so do we have to take permission for even necessary cookies?
It's possibe to cover auto-starting apps and cookies under the definition. I'm not convinced and could argue against that but I don't think it matters. The tiny extract you linked isn't a law. It is a definition. It does not say &quot;these things are illegal&quot;. For that, we have to zoom out a little. Section 43 includes the offense in question (emphasis mine): If any person without permission of the owner or any other person who is incharge of a computer, computer system or computer network... introduces or causes to be introduced any computer contaminant or computer virus... So back to the question. Could Steam be considered a virus? Maybe. Is it illegal? No. On the other hand, if I were to gain access to your computer and download Steam, yes that could be an example of breaking that law.
If there's a reason to believe that your machine has data that would be relevant to a lawsuit, then yes, it is subject to inspection under Fed. R. Civ. P. 34: A party may serve on any other party a request ... to produce and permit the requesting party or its representative to inspect, copy, test, or sample the following items in the responding party's possession, custody, or control: ... any designated documents or electronically stored information—including writings, drawings, graphs, charts, photographs, sound recordings, images, and other data or data compilations—stored in any medium from which information can be obtained either directly or, if necessary, after translation by the responding party into a reasonably usable form. So if there's a lawsuit where there becomes a question about what you downloaded from the network, then it's quite plausible that your device could be demanded or subpoenaed. But that's not the same thing as &quot;forfeiting&quot; your device. The normal procedure in such a case would be that the agency's lawyers would notify you of the demand, and you would take your device to an ESI expert, who would make a digital image of the device's hard drive. The parties would then fight about what portions of that image they are allowed to access, but you would have your device again while that was going on.
18 U.S. Code § 2252 defines a crime and punishment for knowingly transporting, or reproducing for distribution by any means, visual depictions involving the use of a minor engaging in sexually explicit conduct. Here are some sample jury instructions that rephrase this and give definitions for each of these terms. Here are some others (at p. 469). This law review article discusses the knowledge requirement of this statute. It would be an easy argument that the operators of the intermediary nodes do not have the requisite knowledge of the material flowing over their networks and computers to be implicated by section 2252, especially when they are broken down into chunks that can only be re-assembled at the destination. United States v. Kuchinski, 469 F.3d 853 (9th Cir. 2006) is an example of a case where a defendant was found to not have the requisite knowledge of child pornography that was found in his browser's cache folders. These were complete files, no assembly required. However, the court said: where a defendant lacks knowledge about the cache files, and concomitantly lacks access to and control over those files, it is not proper to charge him with possession and control of the child pornography images located in those files An IPFS user has no more knowledge of the pieces being passed through their computer than this defendant did of his cache (unless of course they are the source or destination).
This could be a violation of 18 USC 1030 (and a crime). A number of things go into requirements for conviction under this law. First, it has to be a computer, which is defined as an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device Any printer that I have encountered in the past 40 years counts as &quot;a computer&quot;. Second, (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—...(C) information from any protected computer; It is highly likely that the person printing has to receive some information from the printer, and respond accordingly so you have your &quot;obtains information&quot; element. Maybe not useful information, but information nevertheless. It also has to be a protected computer, (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States Well, a computer connected to the internet is a protected computer, see US v. Trotter, 478 F.3d 918. Also, the access must be &quot;without authorization or exceeds authorized access&quot;. The law doesn't explain with &quot;without authorization&quot; means, but the latter is defined as to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter If the law were stated in terms of &quot;prohibited access&quot;, meaning &quot;express denial of permission&quot;, and if the computer owner had set the computer to &quot;prohibited access&quot; by default (password protected), there would be no issue -- accessing the computer is prohibited. &quot;Unauthorized&quot; can also mean &quot;has not been explicitly authorized&quot;, i.e. lacking any indication one way or the other. Every computer access is initially unauthorized, until authorization is granted; and re-trying a login after mis-typing a user name (and being denied access) is not a violation of this law. There does not appear to be case law that addresses the status of computers just left open to the public, and whether using a computer that is so exposed constitutes &quot;unauthorized access&quot;. Also, it is not clear that the defendant in this case has &quot;obtained information&quot;, since with printing, information flows into the computer. There is also a clause about recklessly causing damage, but I don't see what damage would result (&quot;damage&quot; is defined as &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;), and how printing would be &quot;reckless&quot;. It seems somewhat unlikely that this would be deemed to be a crime, though if you experiment, you could be on the cutting edge of new case law.
This is a developing area within the law. In the United States, 18 U.S.C. § 1030 (Computer Fraud and Abuse Act) governs. However, the law is broadly written. This means creative prosecutors can and do win federal criminal cases by arguing the law should apply. Whether violating a website's terms of service should be considered a federal crime subject to the Act has been a subject of hot debate. In United States v. Nosal, 676 F.3d 854 (9th Cir. 2012), the 9th Circuit decided violations of use should be considered breaches rather than crimes. However, the district court refused to dismiss some charges against Nosal when the case was returned, and a jury conviction resulted in a prison sentence. At least three different circuits have arrived at other interpretations of the CFAA. Draft legislation (H.R. 2454 and S. 1196) would limit the scope of the CFAA by excluding TOS violations, however, it hasn't been adopted as of this writing. That CAPTCHA breaking violates website terms of service isn't really in question. For example, see U.S. v. Lowson, 10-cr-114, U.S. District Court, District of New Jersey (Newark) in which the judge brought a criminal case to which two defendants plead guilty to wire fraud, one plead guilty to misdemeanor computer crimes, and a fourth went on the lam. But does for-profit CAPTCHA solving violate U.S. law? Given the state of the law, one could make a case either way. Given the industry's reputation, serious questions about intended use, and questionable labor practices, that's a significant risk.
Disclaimer: Not a lawyer or even living in US. I try to write the answer under US law. Other countries law may differ. Make sure you consult a lawyer in your jurisdiction. Here is my understanding of the individual examples: You don't need permission legally, because you are only accessing your own account and your own information. You are the only one damaged by the intrusion and therefore, nobody can really file a lawsuit against you. This is often used by security researchers when the subjects are uncooperative. That being said, if it is an actual pentesting client, you may want to refrain from it regardless. You don't need a permission to modify hardware you own. This is completely legal and not considered an attack. It would qualify as an upgrade, such as replacing a component in your laptop. You are allowed to do that. You should have a permission here. This is an intentional penetration test and you should have permission to do this. The same as 3. This is an intentional penetration test and you should get a permission. Though if you logout immediately and don't mess with the interface, it may not be illegal on the basis that you did not cause any damage or steal any information, or it may be illegal under some circumstances. It may also be impossible to prove that you did not do anything while there.
The relevant Maryland statute is MD. Criminal Law Code Ann. § 9-307 (2021), subsection (a): A person may not destroy, alter, conceal, or remove physical evidence that the person believes may be used in a pending or future official proceeding with the intent to impair the verity or availability of the physical evidence in the official proceeding. Note &quot;that the person believes&quot; and &quot;with the intent to.&quot; If you have no reason to think it might be necessary in an official proceeding, you aren't violating this section. If you delete the data unintentionally or for some other reason, then you also probably are not violating the section. (I say &quot;probably&quot; because I'm sure there's some sort of provision for negligence or willful disregard for the evidential value of something you should know has evidential value.) As a practical matter, no copyright lawsuit or criminal trial (and criminal trials over copyright infringement are very rare) is going to depend on the browser history of the defendant's friend. What if my computer has major software issues and the only viable solution is delete everything and reinstall from scratch; am I stuck with a worthless broken computer because reinstalling things from scratch would delete evidence of a crime? If you know of evidence on the hard drive that would be destroyed, you can copy it somewhere else before deleting and reinstalling. Federal law is similar: it requires knowledge and intent. 18 USC 1519: Whoever knowingly alters, destroys, mutilates, conceals, covers up, falsifies, or makes a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States or any case filed under title 11, or in relation to or contemplation of any such matter or case, shall be fined under this title, imprisoned not more than 20 years, or both.
The site's owners would likely be immune from any civil action based on its users' conduct, under Section 230(c)(1) of the Communications Decency Act: No provider or user of an interactive computer service shall be treated as the publisher or speaker of any information provided by another information content provider. The users, though, could still face liability. Although it would be libel rather than slander (because it is published rather than spoken), any damaging falsehoods could be actionable. The emotional distress component would also be a possibility, but it would probably be a tougher case. The laws vary from jurisdiction to jurisdiction, but generally speaking an emotional-distress case requires really outrageous behavior and and very serious emotional damage.