Under US law, is it illegal to write a self propagating computer worm

Question

Suppose a person creates a self-propagating computer worm that:

1. does not modify or delete any of the victim's files
2. rather displays a funny message to the user
3. scans other computers and spreads itself and then
4. self destructs without any harm.

Would that be a punishable offense? What are the applicable laws in this case?

Note that the worm self-propagates from the personal computer of the worm writer, so the writer of the worm does not personally infect the next computer.

Note that this question is purely for knowledge/information purposes.

Answer 1

Illegal to write?

No.

Notwithstanding the First Amendment which would almost certainly make a law prohibiting it illegal, writing such things is an essential part of an IT security professional’s toolkit. You can’t protect against worms if you don’t know how they work.

Illegal to distribute on an unauthorised computer?

Absolutely.

This would be a clear breach of the Computer Fraud and Abuse Act.

Answer 2

This sounds a lot like the Morris Worm. One key difference is due to a programming error, the Morris Worm effectively performed a denial-of-service attack on any infected machine, having a major effect (quoting from Wikipedia):

The Internet was partitioned for several days, as regional networks disconnected from the NSFNet backbone and from each other to prevent recontamination whilst cleaning their own networks.

And the consequences:

Morris was tried and convicted of violating United States Code: Title 18 (18 U.S.C. § 1030), the Computer Fraud and Abuse Act in United States v. Morris. After appeals, he was sentenced to three years' probation, 400 hours of community service, and a fine of $10,050 plus the costs of his supervision. The total fine ran to $13,326, which included a $10,000 fine, $50 special assessment, and $3,276 cost of probation oversight.