Is Selling Malware a Federal Crime?

Congress enacted the Computer Fraud and Abuse Act (CFAA) to impose criminal penalties for a variety of computer misuse offenses. One provision, 18 U.S.C. §1030(a)(5)(A), criminalizes hacking and the use of malicious software (“malware”) by making it a crime to transmit code (i.e., malware) with “intent to cause damage.” Today, § 1030(a)(5)(A) fails to adequately police the black market for malware. The United States Department of Justice has recently used the statute to combat these markets by prosecuting hackers who sold malware. This Note argues that § 1030(a)(5)(A) is ill suited to combat the sale of malware for two reasons. First, certain types of malware do not fit under the CFAA’s definition of “damage.” Second, selling malware does not necessarily satisfy the statute’s “intent” element. Ultimately, the black market for malware needs to be policed, and Congress must amend the CFAA’s outdated elements to deal with the dangers of malware attacks on our increasingly connected society.