A new exemption from the anti-circumvention provisions of section 1201 of the Digital Millennium Copyright Act (DMCA) for good-faith security research takes effect today in the United States.
Key points
- Researchers may circumvent technological protection measures to test lawfully acquired devices and software for security flaws.
- The exemption covers consumer devices, motorised land vehicles and certain medical devices.
- Research must be carried out in a controlled environment designed to avoid harm.
- Researchers must still comply with other laws, including the Computer Fraud and Abuse Act.
The exemption, granted in the Library of Congress’s 2015 rulemaking but delayed by a year, gives UK security testers and product teams working in the US more legal certainty.
Source: Section 1201 exemptions final rule, 80 FR 65944 (Federal Register)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
