In the US, I suspect a prosecutor would successfully gain a conviction against the bot's operator. This verdict would be repeated several times over a dozen years before any judge or jury ever tried to see it another way. And, IMHO, the only other way this could possibly result in anything other than trouble for the operator is if these bots were not only self-replicating, but also self-funding. They'd have to earn funds, open bank accounts, start VPS accounts, etc, and bombard lots of innocent people with illicit goods before any court would entertain the idea that no human was responsible.