CFAA covers this. Its a crime to

  > knowingly [cause] the transmission of a program, information, code, or command, and as a result of such conduct, intentionally causes damage without authorization, to a protected computer;

Where one of the definitions of “protected computer” is one that is used in interstate commerce, which covers effectively all of them.

It seems like the backdoor creates the potential to "cause damage" but doesn't [provably?] cause damage per se?

The author of the backdoor doesn't themselves "[cause] the transmission of a program ...". Others do the transmission.

Seems weak, unless you know of some precedent case(s)?

The malicious author caused the transmission of the release tarball to GitHub and the official project site. This act was intentional and as a direct result other computers were damaged (when their administrators unknowingly installed the backdoored library).

You’ve got to be joking if you’re saying that this wouldn’t be an open and shut case to prosecute. It’s directly on point. Law isn’t code, any jury would have zero trouble convicting on these facts.

Hello fellow "law isn't code" traveller. (my least favorite engineer habit!)

The back door is damage. The resulting sshd is like a door with a broken lock. This patch breaks the lock. Transmitting the patch caused intentional damage.

Law isn't code. If someone finds precedent, there will be a way to argue it doesn't cover this specific scenario. They call this conversational process "hypos" in law school, and this fundamental truth is why you never hear of a lawyer being stumped as to how to defend a client.

Ultimately, the CFAA will get it done if it gets that far, armchair lawyering aside.

To pressure test this fully, since this can be caricatured as "we can punish degenerate behavior as needed", which isn't necessarily great: it's also why there's a thin line between a authoritarian puppet judiciary and a fair one.

It is like opening the door of a safe and letting someone else rob the money inside.

This is way beyond "moral level".

CFAA covers distribution of malicious software without the owners consent, the Wire Fraud Act covers malware distribution schemes intended to defraud for property, Computer Misuse act in the UK is broad and far reaching like the CFAA, so this likely fall afoul of that. The GDPR protects personal data, so there's possibly a case that could be made that this violates that as well, though that might be a bit of reach.

In which case the defense will claim, correctly, that this malware was never distributed. It was caught. "Attempted malware distribution" may not actually be a crime (but IANAL so I don't know).

Folks who run Debian SID or Fedora testing may disagree.

If more than one person was involved, it'd presumably fall under criminal conspiracy. Clearly this was an overt act in furtherance of a crime (unauthorized access under CFAA, at the least).

The criminal conspiracy laws don’t apply to the organizations that write this kind of code, just like murder laws don’t.

Sure they do. Getting the perpetrator into your jurisdiction is the tough part.

Putin is, for example, unlikely to go anywhere willing to execute an ICC arrest warrant.

Nah, the CIA assassinates people in MLAT zones all the time. The laws that apply to you and I don’t apply to the privileged operators of the state’s prerogatives.

We don’t even know that this specific backdoor wasn’t the NSA or CIA. Assuming it was a foreign intelligence service because the fake name was asian-sounding is a bit silly. The people who wrote this code might be sitting in Virginia or Maryland already.

> Virginia or Maryland

Eastern Europe, suggest the timestamp / holiday analysts. https://rheaeve.substack.com/p/xz-backdoor-times-damned-time...

Note that while “Eastern Europe” has firm connotations with countries of which some are known for having corrupt autocracies, booming shady businesses, and organized crime and cybercrime gangs in varying proportions, the time zone mentioned also covers Finland, from which the other author is supposed to be.

Eastern Europe - 25th? Not 24th?

> The people who wrote this code might be sitting in Virginia or Maryland already.

Sure, that’s possible. They will as a result probably avoid traveling to unfriendly jurisdictions without a diplomatic passport.

>They will as a result probably avoid traveling to unfriendly jurisdictions without a diplomatic passport.

First of all, it's not like their individual identities would ever be known.

Second, they would already know that traveling to a hostile country is a great way to catch bullshit espionage charges, maybe end up tortured, and certainly be used as a political pawn.

Third, this is too sloppy to have originated from there anyways—however clever it was.