Criminalization of the Creation of Computer Viruses

Japan passed legislation earlier this week to criminalize the creation of computer viruses. Considering the recent major public network hacks that have hit high profile e-commerce sites this is no major suprise. After all, these attacks frequently use computers that are compromised through virus infection.

My first reaction to this news was to think that surely intentionally distributing viruses is illegal, even if creating them is not. Suprisingly, after a brief search I was unable to locate any Canadian decisions where criminal charges were brought against someone who distributed or created a computer virus.

The criminal code does, however, provide some protection against people distributing viruses. Sections 326 and 342.1 (reproduced below) prohibit theft of  telecommunications services and unauthorized use of computers. Neither of these sections refer to viruses specifically but note that they do not require the accused to be sitting at a keyboard and mouse. Remotely obtaining a telecommunication service or computer service using a virus is likely sufficient. In addition to sections 326 and 342.1, section 430 prohibits "Mischeif in Relation to Data". Mischeif in relation to data includes some of the effects that a computer virus might have on data.

So why not prohibit creating computer viruses outright? My first guess is that the constitution prevents it. Creating computer viruses does not in itself cause any harm and  criminal offences that are not tied directly to harm are unlikely to stand up under the section seven of the Charter of Rights and Freedoms. The harm caused by viruses comes from their distribution. There are useful reasons to create viruses such as security research. If only criminals understand how to locate, probe and exploit security failures in software there is no hope that these threats can be eliminated.

What is the situation in your jurisdiction? Is it illegal to create viruses or only to unlawfully access computer and telecommunications services or damage data?


Sources:
Mainichi Daily News - Legislation criminalizing creation of computer viruses enacted
NHK News Web (Japanese)

Relevant Sections of the Criminal Code:
326. (1) Every one commits theft who fraudulently, maliciously, or without colour of right,

(a) abstracts, consumes or uses electricity or gas or causes it to be wasted or diverted; or

(b) uses any telecommunication facility or obtains any telecommunication service.

Definition of “telecommunication”

(2) In this section and section 327, “telecommunication” means any transmission, emission or reception of signs, signals, writing, images or sounds or intelligence of any nature by wire, radio, visual or other electromagnetic system.

342.1 (1) Every one who, fraudulently and without colour of right,

(a) obtains, directly or indirectly, any computer service,

(b) by means of an electro-magnetic, acoustic, mechanical or other device, intercepts or causes to be intercepted, directly or indirectly, any function of a computer system,

(c) uses or causes to be used, directly or indirectly, a computer system with intent to commit an offence under paragraph (a) or (b) or an offence under section 430 in relation to data or a computer system, or

(d) uses, possesses, traffics in or permits another person to have access to a computer password that would enable a person to commit an offence under paragraph (a), (b) or (c)

is guilty of an indictable offence and liable to imprisonment for a term not exceeding ten years, or is guilty of an offence punishable on summary conviction.

430....

(1.1) Every one commits mischief who wilfully

(a) destroys or alters data;

(b) renders data meaningless, useless or ineffective;

(c) obstructs, interrupts or interferes with the lawful use of data; or

(d) obstructs, interrupts or interferes with any person in the lawful use of data or denies access to data to any person who is entitled to access thereto.

The views expressed in this blog may not be consistent with those of McCarthy Tetrault LLP or its clients. The information provided here is for educational purposes only. Every legal issue is unique, please contact an expert if you think you might need legal advice.