The DMCA (the well-known Digital Millennium Copyright Act) has changed and it seems that penetration testing is now legal... Under conditions... With a year's delay, the US Congress published on Friday an updated list of exceptions to the Digital Millennium Copyright Act's prohibitions regarding the circumvention of digital controls.
These exceptions relate to section 1201 of the DMCA and describe the circumstances under which some may access, copy, and manipulate copyrighted digital content without fear of infringement.
Since 2003, the process of enacting new DMCA regulations has taken place every three years. But “the Congressional Copyright Office has unlawfully and unreasonably delayed it,” according to Kit Walsh, an attorney with the Electronic Frontier Foundation (EFF).
According to Walsh, opponents of the law's exceptions expressed concern about the consequences that could arise from the legality of reverse engineering, which led the Copyright Office to delay these exceptions for a year.
The exceptions concern:
The use of copies and streaming video in educational and documentary contexts.
The use of electronic literary works in conjunction with assistive technologies.
Jailbreaking phones and tablets to enable interoperability or the removal of unwanted software.
Attempts to hack into car software. Attempts to
access non-functional video games.
Attempts to bypass 3D printer material controls.
Attempts by patients to access data from their personal medical devices.
Attempts to reverse-engineer software for security research.
“The new temporary exemption is a big win for security researchers and for consumers who will benefit from increased security checks on the products they use,” said Aaron Alva, Tech Policy Fellow at the Federal Trade Commission.
Of course, security researchers should continue to stay away from cyber fraud and abuse of the law. In addition, the terms of the exemption specify that reverse-engineering or deobfuscating code should be “carried out in a controlled environment to avoid any harm to individuals or the public.”
Furthermore, any information obtained from such activity should be used to promote the security of the device on which the code was executed or the safety of the people using the device. The results of this research should be preserved in a manner that avoids facilitating copyright infringement.
“So if someone meets all the requirements, this temporary exemption allows them to test whether a connected toaster could burn your bagel after a third-party intervention remotely,” Alva said. “But, of course, it doesn’t allow anyone to steal your toaster, hack into your neighbor’s toaster, or burn toasters.”
For its part, the EFF would prefer to see the entire DMCA rulemaking process collapse.
“Section 1201 of the DMCA, and the entire rulemaking process, create unconstitutional restrictions on speech, and they must be struck down by a court or fixed by Congress,” Walsh said.
