Writing even this software wouldn’t have been illegal. It’s mentioned in the indictment as a concrete act in furtherance of a conspiracy, part of the technical abstraction of prosecuting a conspiracy in US law.
What is illegal is stealing from banks, and conspiring to steal from banks—and so they’ll show communication, an illegal agreement, and concrete acts in support of the conspiracy. If they weren’t pretty sure they could persuade a jury of those, they wouldn’t have gotten this far.
There are also some devices it’s illegal to build—bombs, for example, and other devices whose only or nearly-only purpose is illegal. Some software is included there, including software whose only purpose is illegal wiretapping.
That makes it legal to write and exchange proofs of concept for vulnerabilities, but you have to be really careful not to make the PoC too pointy.
In Germany, even the act of writing[1] software whose purpose is to access data without authorization[2] or intercept data transmissions intended for someone else[3] is a felony.
The Washington post has an article[1] talking about this. It looks like the FBI did some digging to come up with the charges. Counts 2 through 4 are related to
violations of 18 U.S.C. 2512 [2] which criminalizes making, selling, or advertising for sale illegal wiretapping devices. That's pretty interesting because as far as I know it would be a first to categorize malware as such a "device".
Except that a handgun's primary purpose is just that; it's a pretty blunt tool. But software can have many purposes, even if it is security related: research, practice, proof-of-concept, curiosity, ...
We better hope they have some real evidence beyond just some random code; if mere possession is enough, they can throw all of us security people in jail, together with anybody who has any DRM circumvention or file-sharing software and whatnot. Seems any computer could contain something to detain just about anybody if twisted around enough.
I guess only the future will bring clarity if this is gross overreach or if they really have substantial evidence that he is both the source and had the intent.
A gun's primary purpose is not to kill a human being by default.
A gun is designed to fire bullets, the bullet is designed to inflict intended levels of damage upon the target of choice. A single gun can have ammunition that ranges from no damage whatsoever to any target up to beyond lethal to a living target.
In other words, your gun's primary purpose is what you decide it is.
What about someone who manufactures guns and knowingly sells them to street gangs without registering them? That's closer to what Hutchins is alleged to have done.
What is also amazing is that the American activity and responsibility in this mess is unpunished. Objectively, the victims of WannaCry should trial America and request a repair.
While I do appreciate and support the backpressure on illegal activities on the internet to make it a safe place, it should also apply to state activity.
