33

As Mikko Hypponen highlighted in a recent tweet, anti-Virus companies collect and store both samples of malicious software and samples of legitimate software:

enter image description here

This got me to thinking, what differentiates that from software piracy?

If I download the torrent for Adobe Photoshop CS then I am pirating that software - deemed by many countries to be illegal. If anti-virus software uploads that same copy of Adobe Photoshop CS to their servers for analysis then how is that any different?

It's possible that this is a moot point - software vendors understand and allow this particular type of 'piracy' or in certain countries this comes under "fair use".

But what about malware authors?

A piece of malware is just a piece of software and the author of that software is afforded the same rights as any software author. Could a malware author take the anti-virus company to court for 'pirating' their software? This doesn't just apply to software like the BlackHole Kit but what about state sponsored malware like Stuxnet?

So this is my question. Are anti-virus companies afforded special protection from copyright laws and if not could these be used against them, especially by corporate or state malware authors?

5
  • Do you know that F-Secure isn't licensed? Their corpus of clean Adobe files could come from the installation of Photoshop that their designers use.
    – user185
    Sep 28, 2012 at 12:35
  • Even still - if I own a company wide license for Adobe am I allowed to store and distribute the install files on a separate system? I'm not sure.
    – Andy Smith
    Sep 28, 2012 at 13:03
  • 2
    I wonder how many malware authors will show up in court to sue AV companies?
    – NULLZ
    Jun 7, 2013 at 15:25
  • copyright violation/unauthorized copying is not piracy. please do not imply that violating copyright and killing people are the same level of evil. Nov 17, 2017 at 7:27
  • @SargeBorsch Yeah but there are few digital crimes that make you feel so badass. I prefer the label "pirate" than "copyright infringer". If it's propaganda, it's pretty fun propaganda.
    – forest
    Mar 26, 2018 at 5:55

4 Answers 4

24

First, I would seriously question whether a malware author would ever bring suit against an antivirus vendor, since it would require admission of a serious crime. But let's suppose that the malware author has already been charged for creation and use of the malware and therefore has nothing to lose by fully admitting authorship.

Copying software for malware analysis seems like a textbook case of fair use (under U.S. law, anyway). Of course, U.S. fair use is a defense that is usable only once you already engaged in a lawsuit (and its parameters are notoriously vague), but let's indulge in a little armchair speculation about how such a lawsuit might resolve. To take the fair use criteria one by one:

  • Purpose and character of use: The use of the copy is legally transformative, which means that it creates something new, instead of merely attempting to recreate the original. Here, the analysts are producing a malware assessment based on the original software. They're not creating a copy just to have an extra copy; they use the copy to produce something novel. This factor heavily favors the analysts.

  • Nature of the copied work: The piece of malware is a published, creative work that rightfully enjoys copyright protection. This factor favors the malware authors.

  • Amount and substantiality: The analysts use the whole software in their analyses. This factor favors the malware authors.

  • Effect upon work's value: Virtually none, which favors the analysts. In fact, the work has little legitimate market, since its primary use is illegal. (While it may be the case that AV vendors reduce the value of malware by building defenses against it, this is not the same as harm caused by creating a substitute work. Wikipedia sumarizes it aptly: "Courts recognize that certain kinds of market harm do not oppose fair use, such as when a parody or negative review impairs the market of the original work.")

While factors #2 and #3 are in favor of the malware authors, the transformative use of the malware lends tremendous legal weight to the fair use argument in favor of the analysts. Only a judge can make a final ruling on fair use, but I suspect that a reasonable judge would rule in favor of copying malware for analytic purposes.

N.B.: This answer considers the legality of copying from a limited, copyright-only perspective. There are other statutes beyond copyright (e.g., ACTA, DMCA) that may be violated when copying malware or legitimate software without permission from the copyright holder. Even if a use is protected by fair use, the fair use defense protects against copyright infringement only, not other violations that may also occur during (or be necessary for) the act of a fair use.

(For example, you may want to include a few seconds of a movie in a video report for your cinematography class, but your copy of the movie only plays in a proprietary player that does not allow exporting snippets of the film. If you download a tool for circumventing the "no exporting of snippets" restriction of your player, then you have violated the DMCA, even though your ultimate goal was probably fair use.)

In short: the analysts' copyright infringement is probably legally defensible under fair use, but analysts may still be in violation of other statutes that are separate from traditional copyright.

12
  • 3
    I personally can go with this, but in the USA fair use is only something that can be discovered through lititgation. You have to go to trial to find out. Without a trial, you're skirting legality at best. Further, fair use is something you plead AFTER YOU ADMIT TO COPYRIGHT VIOLATION. It's not usable up front. Sep 28, 2012 at 14:09
  • 1
    @BruceEdiger Yes, I completely agree. Until a malware author steps forward and brings a case against an AV vendor (hah), we'll never have definitive case law on the issue. As I said in my answer, we can merely speculate how such a fair use defense might be made and assessed by a hypothetical judge.
    – apsillers
    Sep 28, 2012 at 15:03
  • 2
    @BruceEdiger Malware is an open ended term that at least in my mind includes adware and spyware. There are several instances in the past 5 to 10 years where adware companies have unsuccessfully sued anti virus companies for detecting their "software".
    – stoj
    Sep 28, 2012 at 15:42
  • 1
    We're not discussing detecting malware, we're discussing possession of a huge amount of copies of software, possibly in contravention of international treaties, like ACTA. In the USA since 1976, and elsewhere since the Berne Convention was ratified, any intellectual property is automatically copyrighted by the creator. It strikes me that most of the posters here are arguing good intent, but most copyright law does not allow the consideration of intent or state of mind. Mere possession is illegal. Sep 28, 2012 at 16:59
  • @BruceEdiger I'm only considering intent inasmuch as it's a component of the "purpose and character" fair use factor. That said, fair use is strictly a copyright infringement defense; it does not apply to laws that are outside the domain of pure copyright (e.g., ACTA). I'm afaid I don't know the provisions of ACTA well enough to offer any specific speculation in that arena; I'll research it. In the meantime, I have offered a provisional edit about legal concerns beyond traditional copyright infringement.
    – apsillers
    Sep 28, 2012 at 17:11
5

Because there is no illegality in analyzing pirated software. It's illegal to use it and illegal to spread it. It might even be illegal or against EULA to edit software (cracking it often edits some files or binaries).

Also your second comment is a bit weird. Software normally comes with a license you need to accept explicitly or implicitly when using software. It should be readily available to anyone on request. That's rather problematic with Stuxnet since no-one will ever say "Hey I wrote that piece of software that was able to destroy your Nuclear plant and refineries". There is no such thing as an official corporate/state malware author, because no one in their right mind will openly say "I build operational malware for a living". The only place that may openly advertise this, is academics or researchers.

While malware authors in principle would get the same rights, you can't say that it's illegal to analyse it. Software authors do not hold the same rights as for instance artists (writers, painters,...).

But just having it and analyzing it is in principle not illegal as far as I'm aware.

EDIT:

Also this is a legal matter, so the biggest factor will be the intent of the person obtaining the software.

10
  • 1
    So let's say I seed an Adobe Photoshop CS torrent but never install it. How does this compare to F-Secure automatically grabbing the installer and spreading it around their network of analysts? You say they never "use" it but will they not execute the software in sandboxes? That may well just be a Virtual Machine, how is that different from me executing it?
    – Andy Smith
    Sep 28, 2012 at 9:41
  • 4
    The point I'm trying to make is that in some cases "analysis" and "use" are no different. Also it isn't the EULA that protects a piece of software - it's copyright law.
    – Andy Smith
    Sep 28, 2012 at 9:49
  • 1
    Do not forget that law and rights are not binary but often very interpretable. Sep 28, 2012 at 9:52
  • 3
    You guys need to look into the "intent" issue. In newer laws in the USA, "intent" (or "mens rea") is often very explicitly LEFT OUT of consideration. Just doing something, copying a file or even possession, is enough to make you guilty. The DMCA does this sort of thing, as do a lot of the more recent copyright laws. Sep 28, 2012 at 14:06
  • 2
    »no one in their right mind will openly say "I build operational malware for a living"« of course there are some who will. FinFisher, Digitask,... Oct 12, 2012 at 10:52
2

It shouldn't be an issue.

Yes, if you buy Photoshop and upload parts of it to a company server, that's copyright infringement. But AV companies don't need to copy the entirety of Photoshop and keep it. Developers can install a legitimate instance of Photoshop on a single machine. Once they've analysed it, they can store the analysis instead. E.g. hashes of all the files, which might be used to identify Photoshop files and check for potentially malicious modifications. There will be grey areas - and the Photoshop EULA will claim that any deep analysis is illegal - but they're not black enough to be really worrisome.

With malware - yes, we can assume that any creative work is copyrighted, and without a license you have no right to copy it. IANAL. However, in order to obtain damages the malware author would have to claim authorship of it in court. For black software, this would usually be undesirable. And there are legal concepts like "clean hands" - if the software was installed illegally, then I suspect objecting to AV activities would be laughed out of court.

I think I can contrive some darker grey areas. Consider an expensive penetration-testing tool which is "stolen" and incorporated into a "malicious attack tool". Security companies want to analyze the attack tool, but they may have to infringe the copyright of the pen-testing tool in order to use it... but I think it's a much narrower problem than your concern.

0

It classes as fair use for research purposes according to the DMCA. However you should note that in practice this law tends to only really apply to large companies, independent researches or even ones linked to large universities are running the risk of being sued for doing the exact same thing.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .