First, context: the original reddit thread [1] that kicked this off indicated that this malware included was intended to extract passwords from Chrome ("Chrome

First, context: the original reddit thread [1] that kicked this off indicated that this malware included was intended to extract passwords from Chrome ("Chrome Password Dump") and that it was active and likely had the needed permissions as the installer would generally be run with administrative level access rights. So the issues are that malware was placed onto users' systems at all, its capabilities, whether and to what extent data was exfiltrated, and how any exfiltrated data was stored or used. In terms of jurisdiction, the company seems to be incorporated out of Delaware (though I may have mis-searched there), but employs EU nationals residing in the EU. At least one of them seems to be in England, and thus subject to at least both the Computer Misuse Act of 1990 and the Data Protection Act of 1998, which in turn ties in more generally to the 1995 EU Data Protection Directive (which has further been implemented in other countries). Multiple levels of their actions would definitely fall under the CMA and if they actually gathered anything the DPA would kick in also. All of the actions they are known to have performed and may have performed are illegal in most first world jurisdictions. You cannot install malware even if it's not used. It's extra offense to use it, worse to take any data off, to store that data, and further to use it in anyway. Vigilantism is not generally considered at all acceptable by developed governments worldwide. In the USA, precedent for this sort of thing appears to exist already in the form of major examples like the 2005 Sony BMG rootkit situation. Sony's malware prompted actions at the state and federal levels as well as multiple class action lawsuits. The FTC brought charges under Section 5a of the Federal Trade Commission Act and Sony was forced to settle. The FTC chair at the time stated that "Installations of secret software that create security risks are intrusive and unlawful." [2] Really, this sort of thing is just crazy dumb to even attempt in this day in age, it's genuinely surprising that developers could still think that it wouldn't open them up to massive potential trouble particularly in the EU. That's not to say anyone will necessarily go after them, as always that's a matter of discretion at the governmental level and at the civil level whether anyone cares to devote the resources to it, but there is plenty of cause to at least make a go of it and it's not clear that they recognize that. Legitimate developers just don't install malware on peoples' computers, period. That they may be bad people isn't any defense at all. Furthermore, bugs of course can happen. Even if it's not intended to be activated, it may do so, or may open the way to later malicious use by a 3rd party. The original developer who was responsible for it being there can be expected to be liable. Surreptitious actions in general should be a real red flag: if you have to hide it from your users and it affects anything but your own software, think twice. Then think three or four more times after that too. EULAs (or any contract in general) cannot overrule higher level non-exempted law requirements and will not provide protection against civil or criminal enforcement. ----- 1: https://www.reddit.com/r/flightsim/comments/7yh4zu/fslabs_a320_installer_seems_to_include_a_chrome/ https://www.reddit.com/r/flightsim/comments/7yh4zu/fslabs_a3... 2: https://web.archive.org/web/20070929111043/https://www.consumeraffairs.com/news04/2007/01/ftc_sony_bmg.html https://web.archive.org/web/20070929111043/https://www.consu...