Is it legal to use reverse engineering in IT?
Intellectual property

Is it legal to use reverse engineering in IT?

A lot of IT professionals face reverse engineering almost every day. After all, the process helps in learning, researching software and hardware, their constituent elements and principles of work. In some cases, reverse engineering is used to assess the level of game developers, etc. For those who first encountered the term – you can find a general information from Wikipedia.
In short, reverse engineering is legal, but subject to some conditions.

In this article I suggest discovering the legal side of the process. I will describe the basic principles of reverse engineering based on the results of US judicial precedents in Nintendo v. Atari, SEGA v. Accolade and Bowers v. Baystate technologies

One of the first cases of reverse engineering appeared when trying to bypass the protection of game consoles. For example, the companies such as SEGA, Nintendo were interested in being asked for a license, paid “console admission” fee and releasing games according to their conditions (and quite often – exclusively).
Game developers were not interested in this and were looking for ways to bypass access protection for game consoles since it was much more profitable to find “access to the system”, not to pay for a license and release games for all systems at once. Developers were engaged in disassembling the hardware, recovering and opening the code, studying components of protection systems, etc. Quite often, reverse engineering processes were successful and games became compatible with consoles.
Of course, there were some violations of rights and legal proceedings. Thanks to the “first reverses”, the courts have formed their positions on the principles of such process, which we use nowadays.

Atari Games Corp. v. Nintendo of America Inc.
975 F.2d 832 (Fed. Cir. 1992)
Nintendo developed 10NES program, which did not allow unauthorized video games to work on the game console.
Nintendo-10NES-Lockout-Chip. Image source.

Atari tried to find access to the console. For this, during reverse engineering, 10NES chips were removed and examined, the object code was copied and reproduced.
An interesting fact in the case – Atari received copies of the code from the US Copyright Office on the plea of another lawsuit, i.e. illegally for reverse engineering purposes.

Case: Sega Enterprises Ltd. v. Accolade, Inc.
977 F.2d 1510 (9th Cir. 1992)
SEGA limited game compatibility with its Genesis console (Sega Mega Drive), and also developed the trademark security system (TMSS). When the game cartridge was inserted into the system, the console microprocessor searched for the TMSS initiation code, which consisted of four data bytes – “S-E-G-A” letters. If Genesis system (Sega Mega Drive) found the TMSS initialization code in the right place, the game started on the console. Additionally, TMSS displayed “PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES LTD” on the screen.

Sega Genesis / Mega Drive. Image source
Sega Genesis / Mega Drive. Image source.

Accolade, using reverse engineering, made its video games compatible with Genesis. Accolade game developers also “found” the TMSS initiation code and found that it does not affect Genesis II compatibility with their games. But the developers suggested that this is a certain function for the future, as a result, it was decided to copy the TMSS code as well.
After SEGA’s new console – Genesis III – had been released, Accolade’s video games from TMSS also began to display a PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES LTD notification, which was contrary to the fact.
Accolade found a way out of the situation by placing information on the cartridge that the trademarks of the companies, as well as the rights, belong to different entities. See the inscription below:
information on the cartridge that the trademarks of the companies
Image source.

Principles that formed by the courts based on the cases:
the author does not receive exclusive rights “in general”, since copyright does not protect ideas, processes, operations. Or in other words – the very idea of preventing access to the console using a chip, the program is not protected;
patent law should be used to protect processes and methods;
reverse engineering is conscientious when “nature of a work” requires intermediate copying to understand ideas and processes, non-copyright elements;
• without reverse engineering of the object code, the work owner will actually have a monopoly on the functional aspects of the work that are protected by copyright;
• for legal reverse engineering, a copy of the work obtained lawfully should be used.
Similarly to Atari – Nintendo case, a code copy was obtained illegally, reverse engineering was recognized as violation of Nintendo’s rights.
And in SEGA – Accolade case, SEGA proved the possibility of “access” to the console without a 4-bit file with the TMSS initialization code. Thus, Accolade games could be compatible without the false notification “PRODUCED BY OR UNDER LICENSE FROM SEGA ENTERPRISES LTD”. But the court decided that the commercial operation of the functional code was indirect and had minimal impact.

And as early as in 1998, the United States adopted the Digital Millennium Copyright Act, which at the legislative level permits the reverse engineering of a copyright program in order to figure out how to make it interact (i.e. share information and use it) with other programs.

Is it possible to prohibit reverse engineering by contract?

Yes, the majority of licensing agreements prohibit reverse engineering. An example of restrictions from the PS4 license agreement is Section 2, Restrictions. U.S. case law comes down to the fact that contractual restrictions on the prohibition of reverse engineering are superior to the law.

This can be exemplified by Bowers v. Baystate Technologies case (320 F.3d 1317, Fed. Cir. 2003). Infringement of Bowers’s copyright to Designer’s Toolkit program, as well as license terms, cost Baystate $ 5,270,142. Since the company illegally used reverse engineering to create its Draft-Pak program. As the court concluded, the breaching party must weigh the benefits of breach against the arguably de minimus damages arising from merely discerning non-protected code.
But it is worth paying attention that, depending on the applicable law, case law, conditions for signing, reservations can be recognized as invalid and the law can prevail.

In Ukraine, software refers to copyright objects and reverse engineering (or decompilation) is permitted.
In case of reverse engineering, a copy of the software must be obtained lawfully. There are also a number of conditions. For example, the information required for compatibility with the other software should not be accessible from other sources. And the process is carried out only with that part of the program that is required to ensure compatibility. A complete list of conditions for reverse engineering, as well as the conditions for the legal use of software (other copyright objects) is given in the law.

Reverse engineering is permitted since copyright does not fully protect the object, for example, the “idea” to deny access to the game console. But each case should be considered individually – whether there was any violation of the owner’s rights using reverse engineering, whether the object was obtained on a legal basis, whether there were other tools for solving the tasks and the applicable law.
Nowadays, the majority of contracts contain a prohibition on reverse engineering (license agreements, contracts with IT professionals, NDA), and such standards will take precedence over the law in many countries. I recommend you to carefully consider what you sign and what obligations you undertake when developing IT products and in relations with the customers.

Serhii Barbashyn, attorney at law, managing partner at Trustme Law Firm