Legal Reverse engineering of software

[syzygy]

Many are using the term RE (reverse engineering) improperly, thus confusing the issues. Legal RE is a process not a task. If you cut the process short and stop with the task, it is illegal.

There are two separate legality issues:
1) is it legal to perform the decompilation of the old program?
2) does the new program infringe the copyright on the old program?

For 2) the clean room process ensures that the new program does not infringe the copyright on the old program PROVIDED THAT the information passed between the two teams is free of any copyrightable elements of the old program. If the translation of the old decompiled code into natural language was done mechanically, the natural language version is probably not free of the copyright on the old program. More generally, this is a question of how broad the copyright on software is. I believe it is quite narrow (basically protecting only the expression in code), so that normally you will be fine.

If you DO cut the process short, e.g. by letting the same team do both the decompilation and the coding of the new program, you can still be fine. But now any copyrightable elements in the new program may be presumed to be copied from the old program. But this is still about the expression in code, not about the functionality. It is OK to copy functionality. So if you do cut it short, you have to be more careful, but you're not doomed to fail.

With Robbo/Ippo, those that reuse the decompiled source code are doing something illegal - here I mean grab Robbo/Ippo and use it as the starting point for your program and tweak it. If your RE process is tasks 1 and 2 skipping the rest, then it is illegal.

If you start with the decompiled source code and adapt that code, then you will most likely end up with a new program that infringes the copyright on the old. But if you only study the decompiled source code to extract ideas and (even detailed) functionality, you are fine from the point of view of copyright.

Given that nodoby has written a report on its inner workings, the rest can only read it for abstract ideas. Then they can come up with their own coding of those abstract ideas in their own programs which they started from scratch.

Agreed, but those "abstract" ideas can be quite detailed. Copyright does not protect the functionality of a program.

[syzygy]

That's the way it works in the US as well. If you use RE to look inside, writing it down and passing it on does NOT avoid legal problems. I think Charles is trying to describe "clean room" where you can take the program, but only give it input and look at the resulting output, and use THAT to write a new program. Once you look inside, you have gone too far if you make that information public.

No, in the US decompilation to discern unprotectable ideas is fair use. See Atari Games Corp. v. Nintendo of America Inc., 975 F.2d 832 (Fed. Cir. 1992).

The author does not acquire exclusive rights to a literary work in its entirety. Under the Act, society is free to exploit facts, ideas, processes, or methods of operation in a copyrighted work. See, e.g.,Feist, 111 S. Ct. at 1289-90 .To protect processes or methods of operation, a creator must look to patent laws. See Bonito Boats v. Thunder Craft Boats,489 U.S. 141 [9 USPQ2d 1847] (1989);Arrythmia Research, 958 F.2d at 1053 ;see also The Law & Business of Computer Software, Section 2.07 (D.C. Toedt III ed. 1991). An author cannot acquire patent-like protection by putting an idea, process, or method of operation in an unintelligible format and asserting copyright infringement against those who try to understand that idea, process, or method of operation. See, e.g., Feist, 111 S. Ct. at 1290 ; 17 U.S.C. Section 102(b) . The Copyright Act permits an individual in rightful possession of a copy of a work to undertake necessary efforts to understand the work’s ideas, processes, and methods of operation.

(...)

Thus, the Act exempts from copyright protection reproductions for “criticism, comment . . . or research.” These activities permit public understanding and dissemination of the ideas, processes, and methods of operation in a work:
The copyright holder has a property interest in preventing others from reaping the fruits of his labor, not in preventing the authors and thinkers of the future from making use of, or building upon, his advances. The process of creation is often an incremental one, and advances building on past developments are far more common than radical new concepts. See Lewis Galoob Toys, Inc. v. Nintendo, No. 91-16205, slip op. at 5843 [22 USPQ2d 1857] (9th Cir. May 21, 1992). Where the infringement is small in relation to the new work created, the fair user is profiting largely from his own creative efforts rather than free-riding on another’s work. A prohibition on all copying whatsoever would stifle the free flow of ideas without serving any legitimate interest of the copyright holder.

Note that the only way decompilation could be forbidden by copyright law is by it being a forbidden reproduction. The above clarifies that under US law these reproductions fall under the fair use exception.

[rvida]

Many are using the term RE (reverse engineering) improperly, thus confusing the issues. Legal RE is a process not a task. If you cut the process short and stop with the task, it is illegal.

There are two separate legality issues:
1) is it legal to perform the decompilation of the old program?
2) does the new program infringe the copyright on the old program?

For 2) the clean room process ensures that the new program does not infringe the copyright on the old program PROVIDED THAT the information passed between the two teams is free of any copyrightable elements of the old program. If the translation of the old decompiled code into natural language was done mechanically, the natural language version is probably not free of the copyright on the old program. More generally, this is a question of how broad the copyright on software is. I believe it is quite narrow (basically protecting only the expression in code), so that normally you will be fine.

If you DO cut the process short, e.g. by letting the same team do both the decompilation and the coding of the new program, you can still be fine. But now any copyrightable elements in the new program may be presumed to be copied from the old program. But this is still about the expression in code, not about the functionality. It is OK to copy functionality. So if you do cut it short, you have to be more careful, but you're not doomed to fail.

The "clean room" thing has no legal meaning. It is just a process commonly used in the industry when they want to be 100% sure that no copyright infringement could happen. Even then, I wonder whether it is not just "smoke and mirrors" for the public (+lawyers) and in reality the whole job is done by the same team...

[rvida]

I have been a bit fast when translating Charle's "reverse engineering" into "decompilation" (or disassembly), which are two different notions (although Charles' post focus on disassembly).

For practical purposes it is pretty much unprovable which approach was used in the RE process. Same knowledge can be obtained by "observing" (under a debugger) as by "disassembling".

[rvida]

So Richard Vida was legal to decompile Houdini because he was satisfying his personal curiosity. As long as he is not using the decompiled code directly he is also legally improve Critter with ideas he found in Houdini???

I consulted an attorney skilled in IP matters (cost me a lot of €). I don't speak legalese, but in natural language I learned that

1) there is nothing wrong with RE of any legally purchased software (even if the EULA explicitly forbids RE - it is not yet established whether the EULAs are legally enforceable)
2) publishing the "Robodini" binary was a copyright infringement (all Houdini code that is not already present in the public domain Robolitto, and no prior art can be shown, is (c) by Robert Houdart).
3) most common cases of copyright infringements are solved by sending a so-called "cease-and-desist" letter, and when the (soon to be) accused party complies, there is no lawsuit. Omitting this procedure makes the courts very reluctant.
4) In the light of rampant software piracy (fully functional cracked Houdini can be easily obtained at well-known file sharing sites), the "crippled" Robodini probably can not damage Houdini sales at all.

[geots]

Many are using the term RE (reverse engineering) improperly, thus confusing the issues. Legal RE is a process not a task. If you cut the process short and stop with the task, it is illegal.

Legal Process of RE:
1) Hire a software engineer to disassemble and decompile a binary executable.
2) The same engineer learns from this decompiled code.
3) The same engineer writes a paper/book in a human spoken language (such as English, French, Dutch, German ...) on what is in the program and how it works without including any code at all.
4) The same engineer is now removed from the project completely.
5) The paper/book is now given to another engineer or team of engineers that do not have any access to the first engineer and they don't have any access to the decompiled/disassembled code.
6) The engineer/team reads and learns from the paper/book description of how the original program works to get an understanding of how it works.
7) The new engineer/team creates a completely new program based on that understanding of how the old program works without ever seeing any of the decompiled or disassembled code.

That is it in a nutshell.

With Robbo/Ippo, those that reuse the decompiled source code are doing something illegal - here I mean grab Robbo/Ippo and use it as the starting point for your program and tweak it. If your RE process is tasks 1 and 2 skipping the rest, then it is illegal.

Given that nodoby has written a report on its inner workings, the rest can only read it for abstract ideas. Then they can come up with their own coding of those abstract ideas in their own programs which they started from scratch.

Sorry, but it is totally false (at least in EU). The RE of a software is only allowed in two, limited, cases:

1- if you are a customer (not a competitor), with a valid license of the program. Then you are allowed to decompile it in order to understand it and satisfy your curiosity. You are totally forbidden to disclose your findings. (So your 3rd, 5th, 6th and 7th point are totally illegal).
2- for interoperability: if you are a competitor and need to interface your own program with the other program (and this is only allowed IF this other program is not documented enough).

The poor engineer you hired would be in jail very fast. And you too. Just like you can't hire a hit-man. Or more exactly you can, but this is illegal.

That's the way it works in the US as well. If you use RE to look inside, writing it down and passing it on does NOT avoid legal problems. I think Charles is trying to describe "clean room" where you can take the program, but only give it input and look at the resulting output, and use THAT to write a new program. Once you look inside, you have gone too far if you make that information public.

Bob, please tell me your opinion of this: "Yours truly"- who is really the reason this post was made anyway, took Strelka 5.5 when it came out and did not agree with a database of moves of some type that was in it. Supposedly according to him it was not right for Yuri to put it in there. I am not arguing the point of whether it was right or wrong on Yuri's part- don't misunderstand me. But he took Strelka 5.5- went in it and removed the part that offended him, then gave it back to someone and said it was "ok to use now." Personally, I think that was about as bad as it gets. If you don't like it- ignore the engine. Even if you were asked to do it by someone- I see no case where a person has the right to go into another man's work and remove anything. Am I looking at it wrong? For the most part- I mean morally right or wrong- because no one is going to institute and pay for a huge lawsuit. It won't happen. So stick with "morally".



Best,

george

[Gusev]

The "clean room" thing has no legal meaning.

In the U.S., it might, considering the precedent of Computer Associates v. Altai, http://en.wikipedia.org/wiki/Computer_A ... Altai_Inc.:
In 1988, CA discovered Altai's use of the CA ADAPTER code and brought an action for copyright infringement and trade secret misappropriation against Altai. In response, Altai ordered a clean room rewrite of the copied portions of the code to be performed by eight programmers who had no knowledge or involvement with the previous OSCAR code. This new program was released as OSCAR 3.5.
...
In the appeal, CA disputed the district court's finding that the OSCAR 3.5 did not have substantial similarity to CA's ADAPTER. They claimed that the district court did not apply a proper test that took into consideration the copying of non-literal elements of computer software. They claimed that despite the clean room rewrite, there was substantial similarity in the structures of ADAPTER including flow charts, inter-modular relationships, parameter lists, macros, and services obtained from the operating system.

[bob]

That's the way it works in the US as well. If you use RE to look inside, writing it down and passing it on does NOT avoid legal problems. I think Charles is trying to describe "clean room" where you can take the program, but only give it input and look at the resulting output, and use THAT to write a new program. Once you look inside, you have gone too far if you make that information public.

No, in the US decompilation to discern unprotectable ideas is fair use. See Atari Games Corp. v. Nintendo of America Inc., 975 F.2d 832 (Fed. Cir. 1992).

The author does not acquire exclusive rights to a literary work in its entirety. Under the Act, society is free to exploit facts, ideas, processes, or methods of operation in a copyrighted work. See, e.g.,Feist, 111 S. Ct. at 1289-90 .To protect processes or methods of operation, a creator must look to patent laws. See Bonito Boats v. Thunder Craft Boats,489 U.S. 141 [9 USPQ2d 1847] (1989);Arrythmia Research, 958 F.2d at 1053 ;see also The Law & Business of Computer Software, Section 2.07 (D.C. Toedt III ed. 1991). An author cannot acquire patent-like protection by putting an idea, process, or method of operation in an unintelligible format and asserting copyright infringement against those who try to understand that idea, process, or method of operation. See, e.g., Feist, 111 S. Ct. at 1290 ; 17 U.S.C. Section 102(b) . The Copyright Act permits an individual in rightful possession of a copy of a work to undertake necessary efforts to understand the work’s ideas, processes, and methods of operation.

(...)

Thus, the Act exempts from copyright protection reproductions for “criticism, comment . . . or research.” These activities permit public understanding and dissemination of the ideas, processes, and methods of operation in a work:
The copyright holder has a property interest in preventing others from reaping the fruits of his labor, not in preventing the authors and thinkers of the future from making use of, or building upon, his advances. The process of creation is often an incremental one, and advances building on past developments are far more common than radical new concepts. See Lewis Galoob Toys, Inc. v. Nintendo, No. 91-16205, slip op. at 5843 [22 USPQ2d 1857] (9th Cir. May 21, 1992). Where the infringement is small in relation to the new work created, the fair user is profiting largely from his own creative efforts rather than free-riding on another’s work. A prohibition on all copying whatsoever would stifle the free flow of ideas without serving any legitimate interest of the copyright holder.

Note that the only way decompilation could be forbidden by copyright law is by it being a forbidden reproduction. The above clarifies that under US law these reproductions fall under the fair use exception.

My context was copyright. I believe, and have been told previously, that if you RE something that is copyrighted, and you publish the thing, that's a problem. It would appear to not matter whether you publish the raw ask, the derived C, or a textual translation describing exactly what the code does. If one can REALLY translate a source to a text explanation, then one should be able to take a book, translate it to a different language, and avoid the literal translation issue. I don't see how that can happen, legally.

I suppose it might depend on the definition of "idea" vs something larger...

[bob]

Many are using the term RE (reverse engineering) improperly, thus confusing the issues. Legal RE is a process not a task. If you cut the process short and stop with the task, it is illegal.

Legal Process of RE:
1) Hire a software engineer to disassemble and decompile a binary executable.
2) The same engineer learns from this decompiled code.
3) The same engineer writes a paper/book in a human spoken language (such as English, French, Dutch, German ...) on what is in the program and how it works without including any code at all.
4) The same engineer is now removed from the project completely.
5) The paper/book is now given to another engineer or team of engineers that do not have any access to the first engineer and they don't have any access to the decompiled/disassembled code.
6) The engineer/team reads and learns from the paper/book description of how the original program works to get an understanding of how it works.
7) The new engineer/team creates a completely new program based on that understanding of how the old program works without ever seeing any of the decompiled or disassembled code.

That is it in a nutshell.

With Robbo/Ippo, those that reuse the decompiled source code are doing something illegal - here I mean grab Robbo/Ippo and use it as the starting point for your program and tweak it. If your RE process is tasks 1 and 2 skipping the rest, then it is illegal.

Given that nodoby has written a report on its inner workings, the rest can only read it for abstract ideas. Then they can come up with their own coding of those abstract ideas in their own programs which they started from scratch.

Sorry, but it is totally false (at least in EU). The RE of a software is only allowed in two, limited, cases:

1- if you are a customer (not a competitor), with a valid license of the program. Then you are allowed to decompile it in order to understand it and satisfy your curiosity. You are totally forbidden to disclose your findings. (So your 3rd, 5th, 6th and 7th point are totally illegal).
2- for interoperability: if you are a competitor and need to interface your own program with the other program (and this is only allowed IF this other program is not documented enough).

The poor engineer you hired would be in jail very fast. And you too. Just like you can't hire a hit-man. Or more exactly you can, but this is illegal.

That's the way it works in the US as well. If you use RE to look inside, writing it down and passing it on does NOT avoid legal problems. I think Charles is trying to describe "clean room" where you can take the program, but only give it input and look at the resulting output, and use THAT to write a new program. Once you look inside, you have gone too far if you make that information public.

Bob, please tell me your opinion of this: "Yours truly"- who is really the reason this post was made anyway, took Strelka 5.5 when it came out and did not agree with a database of moves of some type that was in it. Supposedly according to him it was not right for Yuri to put it in there. I am not arguing the point of whether it was right or wrong on Yuri's part- don't misunderstand me. But he took Strelka 5.5- went in it and removed the part that offended him, then gave it back to someone and said it was "ok to use now." Personally, I think that was about as bad as it gets. If you don't like it- ignore the engine. Even if you were asked to do it by someone- I see no case where a person has the right to go into another man's work and remove anything. Am I looking at it wrong? For the most part- I mean morally right or wrong- because no one is going to institute and pay for a huge lawsuit. It won't happen. So stick with "morally".



Best,

george

I have not even thought of such a case. The entire computer chess community seems to have gone on a "low ethics diet" of late. The minute you start arguing about whether something is technically legal, totally ignoring ethical considerations, things have gone badly wrong.

I'm happy to stick with my code and continue work on it, without having to resort to such...

[CRoberson]

No, in the US decompilation to discern unprotectable ideas is fair use. See Atari Games Corp. v. Nintendo of America Inc., 975 F.2d 832 (Fed. Cir. 1992).

The author does not acquire exclusive rights to a literary work in its entirety. Under the Act, society is free to exploit facts, ideas, processes, or methods of operation in a copyrighted work. See, e.g.,Feist, 111 S. Ct. at 1289-90 .To protect processes or methods of operation, a creator must look to patent laws. See Bonito Boats v. Thunder Craft Boats,489 U.S. 141 [9 USPQ2d 1847] (1989);Arrythmia Research, 958 F.2d at 1053 ;see also The Law & Business of Computer Software, Section 2.07 (D.C. Toedt III ed. 1991). An author cannot acquire patent-like protection by putting an idea, process, or method of operation in an unintelligible format and asserting copyright infringement against those who try to understand that idea, process, or method of operation. See, e.g., Feist, 111 S. Ct. at 1290 ; 17 U.S.C. Section 102(b) . The Copyright Act permits an individual in rightful possession of a copy of a work to undertake necessary efforts to understand the work’s ideas, processes, and methods of operation.

(...)

Thus, the Act exempts from copyright protection reproductions for “criticism, comment . . . or research.” These activities permit public understanding and dissemination of the ideas, processes, and methods of operation in a work:
The copyright holder has a property interest in preventing others from reaping the fruits of his labor, not in preventing the authors and thinkers of the future from making use of, or building upon, his advances. The process of creation is often an incremental one, and advances building on past developments are far more common than radical new concepts. See Lewis Galoob Toys, Inc. v. Nintendo, No. 91-16205, slip op. at 5843 [22 USPQ2d 1857] (9th Cir. May 21, 1992). Where the infringement is small in relation to the new work created, the fair user is profiting largely from his own creative efforts rather than free-riding on another’s work. A prohibition on all copying whatsoever would stifle the free flow of ideas without serving any legitimate interest of the copyright holder.

Note that the only way decompilation could be forbidden by copyright law is by it being a forbidden reproduction. The above clarifies that under US law these reproductions fall under the fair use exception.

There is a really specific statement that gets to the point, so I'll requote it.

... Where the infringement is small in relation to the new work created, the fair user is profiting largely from his own creative efforts rather than free-riding on another’s work. ...

The infringement is not small when your program starts with a copy of the other program and you tweak it! A decompiled/disassembled copy is still a copy and you are "free-riding" on another's work.
The infringement is small when you write you own code and later add in the reuse of a few ideas.