Creating and spreading malware

Malware is software written to cause harm, such as damaging a device or corrupting files. Creating it and deliberately spreading it are both criminal offences, but the law treats them in different ways.

Creating malware

Writing malware can be treated as making an article for use in computer misuse. The offence is committed by producing the tool, not only by using it. For example, if you write a program that scrambles every document on a computer so its owner cannot open them, you have created malware. It does not need to have damaged anything yet: making a tool that is designed for computer misuse, intending it to be used that way, is enough.

Intentionally spreading malware

Deliberately distributing malware is also an offence. Spreading it on purpose is treated as unauthorised modification under the Computer Misuse Act 1990, because once the malware runs it changes data, programs or settings on someone else's system without their permission. Sending an infected game mod to a friend, uploading it to a shared cloud folder or copying it onto a school network drive on purpose are all examples of intentional spreading.

Intention is the key difference. If your own device picks up an infection and the malware copies itself to your contacts without you knowing, you have not intentionally spread it — the person who released the malware is responsible. Accidental infection is not the same as deliberately passing malware on.

Why it is treated seriously

Malware can corrupt data or damage a computer system. It might wipe a folder of coursework, change figures in a spreadsheet or stop a device from starting up. Because the harm can be serious and hard to undo, the law treats creating and intentionally spreading malware as criminal offences.