Aspectos Eticos De La Ingenieria Inversa

An Overview of the Legality and Ethics of Reverse Engineering Software

December 11, 2003

2

Abstract This paper reviews the ethical and legal aspects of reverse engineering software. The review includes current U.S. law on the legality of software reverse engineering, including recent laws passed to discourage the practice. The paper also discusses ethical considerations of reverseengineering and its potential benefits and harms to businesses. And finally, there is a review of examples of projects that used reverse engineering to build interoperability with other software. Resources include current law, periodicals, books, websites, and legal cases and opinions. Several large reverse-engineering projects are also discussed. These resources discuss the issues, views, and trendsof reverse engineering software.

3

Introduction In the early 1980s, IBM was the leader in the growing personal computer (PC) industry, having almost the entire market share because they owned the copyright to the IBM BIOS. The BIOS links a PCs hardware with the operating system, and whoever controls the BIOS controls the computer. Enter Compaq Corporation, which spent over $1 million toreverse engineer the IBM BIOS and sell the first IBM-compatible PC clone. Compaq sold 53,000 units in their first year of business, and they had invented a new market. Soon after, they pushed IBM and Packard Bell out of the home PC market altogether (Compaq Computer Corporation). This is just one example of how reverse engineering has changed the PC market over the years. Reverse engineering isdefined as copying the functionality of computer hardware or software without copying the actual piece of hardware or software. Usually this is done without any knowledge of the interior workings of the hardware and software, and reverse engineers have to guess at how the internals are implemented by observation and guesswork. In most cases, copyright law in the United States protects this practicebecause it is allowable to copyright how something does something, not what it does. In software terms, programmers can examine what data go in and out of a program, and therefore try to figure out how the data is changed. However, programmers cannot decompile a piece of software and copy the source code into their own programs because that would violate copyright law. Reverse engineering is adiscipline that has been around for some time, most notably in the 1970s and 1980s when companies were scrambling to make sure their computers were compatible with their competitors. To legally reverse engineer the IBM chip in the early 1980s, Compaq had to first “find engineers who had not had anything to do with IBM to write a specification of exactly what the chip should do by examining the chipsproduced by IBM. Then new engineers where brought in

4

to develop the chip” (Compaq Computer Corporation). This is also called “clean room” reverse engineering, because it does not break any copyright laws since neither team collaborated. Reverse engineering is a practice not only used to achieve interoperability but also to update legacy software applications. Legacy software is often writtenin older languages that may or may not have the source code present, good documentation, or the original developer around. However, “… most product lines start with legacy systems that need to be updated to enable them to interact as well-defined components. Although it is possible to update legacy systems through reverse engineering, these techniques are costly” (Bergey et al., 1999). The goal ofthis paper is to provide an overview of the legal and ethical aspects of reverse engineering, as well as well-known stories and examples.

5

Legal Aspects of Reverse Engineering In the United States, there has been much talk of the legality of reverse engineering software since the passage of the Digital Millennium Copyright Act of 1998 (DMCA). However, case precedence has ruled in favor...