The DOJ publishes legal guidance on prosecuting computer crimes [1], which includes this relevant passage: > An attacker need not directly send the required tr

The DOJ publishes legal guidance on prosecuting computer crimes [1], which includes this relevant passage: > An attacker need not directly send the required transmission to the victim computer in order to violate this statute. In one case, a defendant inserted malicious code into a software program he wrote to run on his employer's computer network. United States v. Sullivan, 40 Fed. Appx. 740 (4th Cir. 2002) (unpublished) [2]. After lying dormant for four months, the malicious code activated and downloaded certain other malicious code to several hundred employee handheld computers, making them unusable. Id. at 741. The court held that the defendant knowingly caused transmission of code in violation of the statute. Id. at 743. The CFAA is notoriously broad, which is probably why Pfefferkorn didn’t feel the need to undertake a detailed analysis of exactly how it prohibits the deployment of a targeted exploit which would “undetectably alter previous reports, compromise the integrity of future reports (perhaps at random!), or exfiltrate data from the Cellebrite machine.” [1] https://www.justice.gov/sites/default/files/criminal-ccips/legacy/2015/01/14/ccmanual.pdf https://www.justice.gov/sites/default/files/criminal-ccips/l... [2] https://www.anylaw.com/case/united-states-v-sullivan/fourth-circuit/02-28-2002/tYJVPmYBTlTomsSB8cc0 https://www.anylaw.com/case/united-states-v-sullivan/fourth-...