Reverse engineering vs illegal hacking: Difference between revisions
revamped entirely Tag: 2017 source edit |
Sentence case |
||
| (12 intermediate revisions by 10 users not shown) | |||
| Line 1: | Line 1: | ||
This addresses the widespread | This article addresses the widespread, harmful misconception that breaking a digital lock or modifying software behavior is '''always''' ''"illegal hacking".'' In truth, U.S. law, while flawed, draws a clear line between lawful reverse engineering & criminal activity. | ||
Companies often exploit this confusion to suppress ownership rights, discourage commonplace repair, and interrupt interoperability under the guise of protecting security or intellectual property. The following information will clarify legal distinctions, correct the narrative, and explain why reverse engineering your own device to restore or preserve its functionality is not, and should never be deemed, a crime. | |||
In this article, "hack" or "illegal hacking" is used interchangeably for illegally hacking, or "to get into someone else's computer system without permission in order to do something illegal" ([https://dictionary.cambridge.org/dictionary/english/hack#cald4-1-3 Hack | Cambridge Dictionary]). This should not be confused with the slang "hack" that describe the act of tinkering or modifying a device (like "a hackable laptop"). | |||
==What section 1201 is for== | ==What section 1201 is for== | ||
'''Section 1201 of the Digital Millennium Copyright Act''' (DMCA), passed in 1998, prohibits the circumvention of ''"technological protection measures"'' (TPMs) used to control access to copyrighted works. It also prohibits the distribution of tools designed primarily for circumvention. | '''Section 1201 of the Digital Millennium Copyright Act''' (DMCA), passed in 1998, prohibits the circumvention of ''"technological protection measures"'' (TPMs) used to control access to copyrighted works. It also prohibits the distribution of tools designed primarily for circumvention. | ||
What makes Section 1201 controversial is that it penalizes circumvention '''regardless of whether any copyright infringement occurred'''. In other words, even if you just want to modify or fix a product you legally own, you may still be in violation if the manufacturer | What makes Section 1201 controversial is that it penalizes circumvention '''regardless of whether any copyright infringement occurred'''. In other words, even if you just want to modify or fix a product you legally own, you may still be in "violation" if the manufacturer practices overreach with DRM. | ||
To soften this, Congress allowed for temporary exemptions reviewed every three years by the Library of Congress. These exemptions currently include | To soften this universal approach of limiting consumer rights, Congress allowed for temporary exemptions to be reviewed every three years by the Library of Congress. These exemptions currently include limited instances of repair, diagnosis, security research, accessibility, and jailbreaking of phones. However, the process is cumbersome, narrow in scope, and inconsistently applied. | ||
==Legal | ==Legal reverse engineering vs. illegal Hacking== | ||
Contrary to what some CEOs & PR departments have said, '''reverse engineering is legal in many contexts''' - especially when done for purposes of interoperability, repair, research, or personal use. | Contrary to what some CEOs & PR departments have said, '''reverse engineering is legal in many contexts''' - especially when done for purposes of interoperability, repair, research, or personal use. | ||
===What | ===What counts as legal reverse engineering=== | ||
The U.S. legal system has repeatedly upheld the right to reverse engineer in certain contexts, particularly when the intent is to enable interoperability or understand how something works. Notable court decisions include: | The U.S. legal system has repeatedly upheld the right to reverse engineer in certain contexts, particularly when the intent is to enable interoperability or understand how something works. Notable court decisions include: | ||
| Line 48: | Line 50: | ||
*Good faith security research under DMCA exemptions | *Good faith security research under DMCA exemptions | ||
===What | ===What constitutes illegal hacking=== | ||
Illegal hacking, by contrast, involves: | Illegal hacking, by contrast, involves: | ||
| Line 72: | Line 74: | ||
The key difference is ownership & scope: Reverse engineering stays within the boundary of what you own. Hacking crosses into systems that you don't. | The key difference is ownership & scope: Reverse engineering stays within the boundary of what you own. Hacking crosses into systems that you don't. | ||
==Current DMCA | Hacking, in most cases, ''involves'' doing reverse engineering. Companies usually use this to mislead ill-informed people into believing both are illegal hacking. Reverse engineering alone is ''not'' hacking. | ||
==Current DMCA exemptions (2024-2027)== | |||
The Library of Congress granted sweeping new exemptions in October 2024 that greatly | The Library of Congress granted sweeping new exemptions in October 2024 that greatly expanded repair rights:<ref>{{cite web |url=https://www.federalregister.gov/documents/2024/10/28/2024-24563/exemption-to-prohibition-on-circumvention-of-copyright-protection-systems-for-access-control |title=Exemption to Prohibition on Circumvention of Copyright Protection Systems for Access Control Technologies |publisher=Federal Register |date=October 28, 2024}}</ref> | ||
*'''Vehicle telematics data | *'''Vehicle telematics data''': Owners can now circumvent software locks to access, store, and share their vehicle's operations and diagnostic data. | ||
*'''Commercial food preparation equipment''': New exemption for retail-level restaurant equipment repair ''(addressing the McDonald's ice cream machine problem)''<ref>{{Cite news |last=Bowman |first=Emma |date=November 3, 20245:00 AM ET |title=A new copyright rule lets McDonald's fix its own broken ice cream machines |url=https://www.npr.org/2024/11/02/g-s1-31893/mcdonalds-broken-ice-cream-machine-copyright-law |work=NPR}}</ref> | *'''Commercial food preparation equipment''': New exemption for retail-level restaurant equipment repair ''(addressing the McDonald's ice cream machine problem).''<ref>{{Cite news |last=Bowman |first=Emma |date=November 3, 20245:00 AM ET |title=A new copyright rule lets McDonald's fix its own broken ice cream machines |url=https://www.npr.org/2024/11/02/g-s1-31893/mcdonalds-broken-ice-cream-machine-copyright-law |work=NPR}}</ref> | ||
*'''Consumer devices''': Renewed exemptions for smartphones, tablets, smart TVs, | *'''Consumer devices''': Renewed exemptions for smartphones, tablets, smart TVs, and IoT devices. | ||
*'''Medical devices''': Continued exemption with FDA support, concluding it wouldn't "necessarily | *'''Medical devices''': Continued exemption with FDA support, concluding that, contrary to claims otherwise, it wouldn't "necessarily and materially jeopardize" device safety.<ref>{{cite web |url=https://iamers.org/2024/07/fda-issues-letter-supporting-continuation-of-dmca-exemption-for-repair-of-medical-devices/ |title=FDA issues letter supporting continuation of DMCA exemption for repair of medical devices |publisher=IAMERS |date=July 2024}}</ref> | ||
*'''Jailbreaking''': Expanded to cover smartphones, smart TVs, voice assistants, | *'''Jailbreaking''': Expanded to cover smartphones, smart TVs, voice assistants, and routers for installing alternative software. | ||
These exemptions require that circumvention be a ''"necessary step"'' for the permitted purpose | These exemptions require that circumvention be a ''"necessary step"'' for the permitted purpose and cannot facilitate access to other copyrighted works. | ||
==Narrowing | ==Narrowing computer hacking laws== | ||
The Supreme Court's 2021 decision in '''Van Buren v. United States''' fundamentally changed how courts interpret the Computer Fraud & Abuse Act (CFAA).<ref>{{Cite web |title=VAN BUREN v. UNITED STATES | The Supreme Court's 2021 decision in '''Van Buren v. United States''' fundamentally changed how courts interpret the Computer Fraud & Abuse Act (CFAA).<ref>{{Cite web |title=VAN BUREN v. UNITED STATES | ||
| Line 99: | Line 103: | ||
The Ninth Circuit applied this framework in '''hiQ Labs v. LinkedIn''' (2022), finding that scraping publicly accessible data doesn't violate CFAA since there are ''"no gates to lift or lower"'' on public websites.<ref>{{Cite web |title=HIQ LABS, INC. V. LINKEDIN CORPORATION, No. 17-16783 (9th Cir. 2022) |url=https://law.justia.com/cases/federal/appellate-courts/ca9/17-16783/17-16783-2022-04-18.html}}</ref> | The Ninth Circuit applied this framework in '''hiQ Labs v. LinkedIn''' (2022), finding that scraping publicly accessible data doesn't violate CFAA since there are ''"no gates to lift or lower"'' on public websites.<ref>{{Cite web |title=HIQ LABS, INC. V. LINKEDIN CORPORATION, No. 17-16783 (9th Cir. 2022) |url=https://law.justia.com/cases/federal/appellate-courts/ca9/17-16783/17-16783-2022-04-18.html}}</ref> | ||
==Futurehome example | ==Futurehome example== | ||
In May 2025, Norwegian smart home company Futurehome was acquired out of bankruptcy. The new owners, FHSD Connect AS, introduced a mandatory subscription model: customers had to pay an annual fee of 1,188 NOK (approx. $117 USD) or lose access to basic functionality like the mobile app, automation, & local APIs - even though those features were previously included in the one-time purchase price.<ref>{{cite web |url=https://www.tek.no/nyheter/nyhet/i/alMe04/rasende-kunder-opplever-smarthjem-utpressing |title=Rasende og fortvilte Futurehome-kunder: – Oppleves som utpressing |website=Tek.no |access-date=2025-07-14 |language=nb}}</ref> | In May 2025, Norwegian smart home company Futurehome was acquired out of bankruptcy. The new owners, FHSD Connect AS, introduced a mandatory subscription model: customers had to pay an annual fee of 1,188 NOK (approx. $117 USD) or lose access to basic functionality like the mobile app, automation, & local APIs - even though those features were previously included in the one-time purchase price.<ref>{{cite web |url=https://www.tek.no/nyheter/nyhet/i/alMe04/rasende-kunder-opplever-smarthjem-utpressing |title=Rasende og fortvilte Futurehome-kunder: – Oppleves som utpressing |website=Tek.no |access-date=2025-07-14 |language=nb}}</ref> | ||
| Line 128: | Line 132: | ||
=="Illegal Hacking" as a legal conclusion== | =="Illegal Hacking" as a legal conclusion== | ||
Using words like "hacking" to describe legitimate reverse engineering is not a legal conclusion. Section 1201 of is written in a way that can make even normal ownership behavior sound suspicious. Courts have repeatedly ruled that '''reverse engineering, when done for lawful purposes, is protected'''. | Using words like "hacking" to describe legitimate reverse engineering is not a legal conclusion. Section 1201 of the DMCA is written in a way that can make even normal ownership behavior sound suspicious. Courts have repeatedly ruled that '''reverse engineering, when done for lawful purposes, is protected'''. | ||
==Key | ==Key legal principles== | ||
Courts now apply clear principles distinguishing lawful reverse engineering from illegal hacking: | Courts now apply clear principles distinguishing lawful reverse engineering from illegal hacking: | ||
'''Protected | '''Protected activities include:''' | ||
*Lawfully acquiring software or hardware | *Lawfully acquiring software or hardware | ||
*Analyzing it without circumventing authentication | *Analyzing it without circumventing authentication | ||
| Line 152: | Line 156: | ||
==Conclusion== | ==Conclusion== | ||
Reverse engineering | Reverse engineering should not be a crime. Owning a product should mean controlling it. Efforts to restore, understand, or interoperate with devices you legally bought is not "hacking" - it is a cornerstone of innovation, user freedom, and the right to repair. | ||
The legal landscape has evolved dramatically through decisions like '''Google v. Oracle''' (2021) affirming API reimplementation as fair use | The legal landscape has evolved dramatically through decisions like '''Google v. Oracle''' (2021) affirming API reimplementation as fair use<ref>{{Cite web |title=GOOGLE LLC v. ORACLE AMERICA, INC. | ||
CERTIORARI TO THE UNITED STATES COURT OF APPEALS FOR | CERTIORARI TO THE UNITED STATES COURT OF APPEALS FOR | ||
THE FEDERAL CIRCUIT | THE FEDERAL CIRCUIT | ||
No. 18–956. Argued October 7, 2020—Decided April 5, 2021 |url=https://www.supremecourt.gov/opinions/20pdf/18-956_d18f.pdf}}</ref>. | No. 18–956. Argued October 7, 2020—Decided April 5, 2021 |url=https://www.supremecourt.gov/opinions/20pdf/18-956_d18f.pdf}}</ref>. | ||
The October 2024 DMCA exemptions represent the largest repair rights | The October 2024 DMCA exemptions represent the largest repair rights expansion so far. Combined with Van Buren's limitation of CFAA liability, these create lots of legal space for legitimate reverse engineering to be considered legal. | ||
==References== | |||
<references /> | <references /> | ||
[[Category:Common terms]] | |||