What is the definition of computer virus by law?The definition seems to be broad

The definition is very problematical. It looks like it was drafted by someone who had talked to a programmer but not really understood what they heard.

1. It tries to cover all malware under the heading of "virus". This isn't much of a problem because most laymen confuse the two anyway, but its not a good thing.

2. It is ambiguous due to the collection of "and" and "or" clauses. The computer world has conventions for disambiguating this stuff (akin to the rules for "3+4*5"), but I don't believe English does.

Trying to read it in the most sensible way, it seems to say that a "virus" is something that

• Damages performance of a computer resource, OR
• Attaches itself to another resource AND operates when some event takes place in that resource.

If this reading is correct then cookies are not viruses under this definition, as they neither damage performance or "operate" in any sense. They are merely read and written.

A program that sets itself to autostart is arguably falling under the second part of the definition; it attaches itself to another resource (the Windows list of autostart programs) and operates when some event takes place in that resource (Windows executes that list of programs).

However a bigger problem is the definition of "computer contaminant":

• (i) ―computer contaminant means any set of computer instructions that are designed–
  • (a) to modify, destroy, record, transmit data or programme residing within a computer, computer system or computer network; or
  • (b) by any means to usurp the normal operation of the computer, computer system, or computer network

Paragraph (a) clearly covers any program at all, with the possible exception of programs that never write any data (its not clear what "record" might mean in this context).

As @Studoku's answer says, the question of whether this is illegal depends on the permission of the owner. So it seems that this law says that amost all programs are "viruses" or "contaminants", but that only some of these are illegal. This is the Humpty-Dumpty school of legal drafting.

"Permission" is a very grey area in much of computer law because it depends on the intent of the owner, but so much of what a computer program does happens out of sight of the owner that they may not have an identifiable intent regarding any particular action performed by the program. If an otherwise honest program adds itself to the start-up list without asking first, does that make it illegal? If the owner only forms an opinion after the fact then its unclear, to say the least. This is similar to the "authorisation" issues in the US Computer Fraud and Abuse Act.