2

Following the question about "How to set-up a lab for reversing a mass transit ticketing system?", I would like to know what are the legal issues about setting up such a lab.

It seems clear that, depending on the country (or the continent: America/Europe), you might encounter a few problems just looking at such system. But, is there ways to work around or just to not get caught ? And, what is really really strictly forbidden ?

5

The first law is, "Don't reverse what you don't own". When you pirate software, and then reverse it you do something that will bite you in the ass.

United States

In the United States even if an artifact or process is protected by trade secrets, reverse-engineering the artifact or process is often lawful as long as it is obtained legitimately. Patents, on the other hand, need a public disclosure of an invention, and therefore, patented items do not necessarily have to be reverse-engineered to be studied. (However, an item produced under one or more patents could also include other technology that is not patented and not disclosed.) One common motivation of reverse engineering is to determine whether a competitor's product contains patent infringements or copyright infringements. The reverse engineering of software in the US is generally a breach of contract as most EULAs specifically prohibit it, and courts have found such contractual prohibitions to override the copyright law which expressly permits it; see Bowers v. Baystate Technologies. Sec. 103(f) of the DMCA (17 U.S.C. § 1201 (f)) says that if you legally obtain a program that is protected, you are allowed to reverse-engineer and circumvent the protection to achieve interoperability between computer programs (i.e., the ability to exchange and make use of information). The section states: (f) Reverse Engineering.—

  1. Notwithstanding the provisions of subsection (a)(1)(A), a person who has lawfully obtained the right to use a copy of a computer program may circumvent a technological measure that effectively controls access to a particular portion of that program for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs, and that have not previously been readily available to the person engaging in the circumvention, to the extent any such acts of identification and analysis do not constitute infringement under this title.
  2. Not withstanding the provisions of subsections (a)(2) and (b), a person may develop and employ technological means to circumvent a technological measure, or to circumvent protection afforded by a technological measure, in order to enable the identification and analysis under paragraph (1), or for the purpose of enabling interoperability of an independently created computer program with other programs, if such means are necessary to achieve such interoperability, to the extent that doing so does not constitute infringement under this title.
  3. The information acquired through the acts permitted under paragraph (1), and the means permitted under paragraph (2), may be made available to others if the person referred to in paragraph (1) or (2), as the case may be, provides such information or means solely for the purpose of enabling interoperability of an independently created computer program with other programs, and to the extent that doing so does not constitute infringement under this title or violate applicable law other than this section.

  4. For purposes of this subsection, the term 「interoperability」 means the ability of computer programs to exchange information, and of such programs mutually to use the information which has been exchanged.

European Union

Article 6 of the 1991 EU Computer Programs Directive allows reverse engineering for the purposes of interoperability, but prohibits it for the purposes of creating a competing product, and also prohibits the public release of information obtained through reverse engineering of software. In 2009, the EU Computer Program Directive was superseded and the directive now states:[29] (15) The unauthorised reproduction, translation, adaptation or transformation of the form of the code in which a copy of a computer program has been made available constitutes an infringement of the exclusive rights of the author. Nevertheless, circumstances may exist when such a reproduction of the code and translation of its form are indispensable to obtain the necessary infor­mation to achieve the interoperability of an indepen­dently created program with other programs. It has therefore to be considered that, in these limited circum­stances only, performance of the acts of reproduction and translation by or on behalf of a person having a right to use a copy of the program is legitimate and compatible with fair practice and must therefore be deemed not to require the authorisation of the right­holder. An objective of this exception is to make it possible to connect all components of a computer system, including those of different manufacturers, so that they can work together. Such an exception to the author's exclusive rights may not be used in a way which prejudices the legitimate interests of the rightholder or which conflicts with a normal exploitation of the program.

Source:Wikipedia

Conclusion

Anyway, reversing a ticketing system will most probably be seen as illegal as there is nothing to gain expect from free travel exploitation. If you represent a university you might get this done legally.

  • Your answer is not really clear to me. Basically, what you say is that there is no way to make it in such way that you are not doing something "illegal" ? – perror Jun 30 '13 at 15:17
  • Do you own the software? Are you allowed to crack it open? Reverse Engineering is a grey area in the law, and a lot of times in Reverse Engineering as well as in security research the legality gets determined by the lawyer you have (basically due to the fact that there are often no (clear) laws in the IT). Anyway, reversing a ticketing system will most probably be seen as illegal as there is nothing to gain expect from free travel exploitation. If you represent a university you might get this done legally. – Stolas Jul 1 '13 at 6:20
  • My point was about the fact that your answer is mostly quotation from the Wikipedia without any explanation or any sort of conclusion. Try to be more explicit next time. – perror Jul 1 '13 at 7:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.