When is applying reverse engineering techniques acceptable? [closed]

Question

You all know there are people out there that use reverse engineering techniques to do bad things; this ranges from being able to use paid software for free (cracker) to finding vulnerabilities that allow them to do what they want when they want without permission (hacker). Of course, there is also a good side to it; we can use this to protect software against such people, use it to learn from things.

But where does one know if he is allowed? How does one ensure he conforms to laws and licenses?

Software and services do not always list this in their license or come with a NDA, I don't know if the law explicitly states anything about this; so, this would leave one to often be clueless ...

1. whether he is allowed to reverse engineer.
2. whether he may use his findings, for which goals.
3. under which conditions he may or may not publish his results.

What to do when it is not stated? Does one have to explicitly ask it, or is their some rule on this?

It is wise to just ask; though a canonical answer would benefit the majority and spare out asking.

Answer 1

The answer, as in most things, is "it depends". Firstly, it depends on the country you are in, different countries have different rules with respect to reverse engineering.

Now in the United States reverse engineering is generally considered to be a legitimate form of discovery mainly due to the fact that it encourages innovation. There is legal precedence for reverse engineering being lawful:

• US Supreme Court - Kewanee Oil v. Bicron - 1974
• US Supreme Court - Bonito Boats. v. Thunder Craft - 1989

Most major companies do buy and reverse engineer products of competitors once they are available, my source for that is myself as I worked for a cell phone company that engaged in that exact practice. Typically speaking, if you buy a device you're free to do whatever you want with it; trade secret law only protects the owner of the secret from others improper acquiring of that secret (you don't break into someone else' place of work and take a prototype)

The scope of a NDA is totally different. If the company tells you about un-patented trade secrets, you can't disclose that information. Once the company patents the secret, it's no longer a secret (you don't even have to reverse engineer at that point, the details are available from the patent office)

As there is legal precedence to allow reverse engineering, you can publish your results. It happens all the time. When a company doesn't want you doing this, they put layers and layers of security in the code to protect it. Again... the cell phone company I worked for did this with the bootloader.

....that said, bypassing anticircumvention devices is a separate issue covered by section 1201 of the DMCA which forbids reverse engineering if it involves circumvention of a technological protection measure.

So if you want to learn how something works, if you want to make sure you have interoperability with a product, if you want to do encryption research or security testing... go for it. If you want to reverse engineer some software to make a key gen so people don't have to buy it... I would keep that to yourself.

Hope that helps.

Answer 2

The book Reversing: Secrets of Reverse Engineering by Eldad Eilam provides some guidance on the legality of reverse engineering within the United States. The book recommends seeking legal counsel before starting any "high risk" reversing project, and then gives the following sections as guidelines as high risk.

Interoperability

Using reverse engineering for interoperability purposes has been supported in the US judicial system. Accolade, A California-based game developer was sued by for copyright infringement in 1991 by Sony after reverse-engineering the Sega Genesis programming interface and publishing games for the Sega Genesis. Accolade won the court case because the Accolade games did not contain any of Sega's code and because of the public benefit resulting in the increased competition.

Competition

Reverse engineering may be considered illegal when used to steal code from a competing process.

Trade Secrets and Patents

Reverse engineering patented technology would not make sense since the patent information is already public. Trade secrets exist to protect developers in the case where a malicious employee may attempt to sell of a secret to a competitor. A product being a trade secret does not protect its the developer in cases where a competitor reverse engineers the product as long as the product is available on the open market and was obtained legitimately.

Digital Millennium Copyright Act

The DMCA legally protects copyright protection systems from circumvention. The DMCA does not apply to any other type of copyrighted software, and therefore many reverse engineering efforts will not be subject to rules and exceptions granted by the DMCA. The things that are explicitly prohibited under the DMCA:

• Circumvention of copyright protection systems
• Development of circumvention technologies. The book mentions specifically that a keygen would be a good example of a circumvention technology. But the book does not mention how tools use to create circumvention technologies (IDA Pro, for instance) are covered.

However, there are exceptions in which circumvention is allowed.

• Interoperability "reversing and circumventing DRM technologies may be allowed in circumstances where such work is needed in order to interoperate with the software product in question. For example, if a program was encrypted for the purpose of copy protecting it, a software developer may decrypt the program in question if that's the only way to interoperate with it."
• Encryption Research Circumvention is allowed so long as the protection technologies interfere with the evaluation of the encryption technology
• Security Testing Reversing and circumvention is allowed for the purpose of "evaluating or improving the security of a computer system"
• Government Investigation
• Regulation The DCMA allows for DRM technologies to be subvereted for the purposes of regulating the materials accessible to minors on the internet.
• Protection of privacy "Products that collect or transmit personal information may be reversed and any protection technologies they include may be circumvented."

License Agreement Considerations

With regard to the anti-reverse-engineering clauses found within software license agreements, Eilam says there is no single, authoritative answer and that it all depends on the specific circumstances of the reverse-engineering effort.

Wikipedia also has a section on the legality of reverse engineering which claims that "courts have found such contractual prohibitions to override the copyright law which expressly permits it; see Bowers v. Baystate Technologies"

It should be noted that Bowers v. Baystate Technologies established that license agreements can preempt fair use rights as well as expand the rights of copyright holders beyond those codified in US federal law.

Answer 3

It may also be worth considering how laws can be abused to pressure those engaged in reverse engineering to stop and withdraw their findings - the anti-circumvention provisions on the DMCA is often abused for this reason.

A great example is the factoring of the TI-83+ signing key - the intent wasn't to enable piracy, but TI used this claim to try and stop the research.

The EFF has documented a number of cases of such abuse - it's a disturbingly common tactic to stop researchers. Even in cases where you are fully within your rights, it's hard to fight an army of lawyers.

Answer 4

If you have a legal issue you consult with a lawyer. Even a lawyer will never ensure you of anything. They will provide legal advice based on precedent. If you want to explore the matter in depth you need to go to trial.

That said, and this is not legal advice, in the USA you are generally allowed to publish anything which is not covered under a agreement between you and another party stating that you will not do so and which is not classified information. This is because of your first amendment rights.