Dear viewer, these subtitles were generated by a machine via the service Trint and therefore are (very) buggy. If you are capable, please help us to create good quality subtitles: https://c3subtitles.de/talk/1290 Thanks!
[Music]
a welcome to our next talk our next two
speakers are Stefan Becker and Stefan
collage Stefan Becca holds a master in
IT security and is a research assistant
and PhD candidate at the embedded
security group at a rural university boo
Holmes hosts guts Institute for IT
security Stefan kalasa
is also a PhD candidate at raw
university since 2017 at the institute
for international law of peace and armed
conflict Stefan passed his first legal
State Exam in 2014 and is now among
other roles a legal adviser to the
project legal implications in Hardware
reverse engineering in cooperation with
the host guts Institute the tool will
talk about the potential legal
implications of a new trade secret which
has been introduced in Germany in 2010
so let's give warm welcome and applause
- Stefan Becca and Stefan kalasa
yeah hello from my side thank you very
much for being here actually I have to
say that the time of the day is a bit
late for a lawyer but I think it's just
the beginning for everyone here so I
think we are Stefan and Stefan and we
want to talk to you about some
reflections on the new
reverse-engineering law that has
actually has come into place this year
so it's kind of a brand new law and the
implications for reverse engineering is
actually quite huge now as a little
disclaimer we are not giving you a like
an in-depth legal analysis because it's
not possible every case differs every
case is different situation for example
and in law all the details count so that
means that we can only give you a broad
overview about the developments about
the law in general and then we will give
you a little bit of a guideline maybe in
the end to be to be on the safe side of
course you might be challenged by some
lawyers or some lawsuits but in the end
I can really say that you shouldn't
worry too much in this regard and first
also a little apology for the
translators and interpreters because
legal terminology is always really hard
to translate so we're appropriate I will
just use the German and the English
version vice-versa
and yeah let's start okay hello and
welcome from my side as well so the
question is why are we actually here and
the answer is it's my fault so I watched
last year's talk may have left a direct
Galatz who knows if it's portion from
some researchers from three different
universities who reverse-engineer the
software which claim to provide absolute
security and of course they didn't
believe in it and then after like pre
publishing they are the paper about
their research they got a lot of legal
trouble first of all they got the
declaration to see
desist I had to look this up with Alice
exactly wrong in German from the company
and producing the software which if they
would have signed it would have been
yeah the same as an employment ban for
them because it wouldn't allow them to
possess tools for D compilation and I
like to install either program their
computers so of course they didn't sign
this declaration and then the whole
thing went in front of the court yeah
this was in total like more than one
year of personal legal trouble for them
but in the first instance of the court
there was already a settlement where the
company then paid for for the legal fees
and the researcher said okay like the
next time we go through the responsible
disclosure process but the question
which arose for for us as a research
group as a merit a security research
group is what the legal situation of
researchers utilizing reverse
engineering engineering and here in
Europe or in Germany actually is so I
want to give you some background about
the research history at my group at the
embedded security group at Royal
University which now move to the new Max
Planck Institute in boham so we have a
long long history on like reversing
embedded devices such as smart cards or
electronic locking systems or even like
satellite phones and more recently we
are taking a deep look into into
hardware and to chips and we apply
reverse engineering on the one hand to
to understand like the the reversing
process and to do research about the
reversing process itself and on the
other hand and we want to understand
better if we can do malicious
manipulations to hardware such as
hardware organs
yeah and thankfully we also have like an
interdisciplinary and
research graduate school where which is
where Stefan comes into place
so there we we have people from other
disciplines who who yeah think about IT
security and even better we also have
lawyers there who understand a lot of
security so we approached Stefan to give
us some legal counsel on a research
project project which I will introduce
very briefly so this is about how to
reverse engineering and we deal with
proprietary chips
yeah which are protected by a lot of
patents and what we want to do is like
reverse engineering so we D capsulated
we do images of it and then we want for
example to extract a netlist or to
extract some some high-level description
yeah and we want to know if this process
is legal so could you answer that
question for me well it's a bit
difficult but I can try so first of all
he came to me that question and given
that I am I like this I peel or
computation law for example it's not
exactly my core area but I was really
intrigued by your question and then I
dig into the topic and now I came up
with the answer and actually I can say
clearly and definite it depends so let's
look at the relevant areas of law so we
don't unfortunately have one book or one
code of law that we can begin su that
gives us the definite answer so we have
different areas of law such as
intellectual property law for example
and competition and trade secret law
intellectual property law again has some
different sub branches some kind of
trades as a kind of a patent law for
example we have copyright laws and so
forth so the legal situation is a bit
complex and the potential consequences
could be also severe if you get involved
with one of those laws because
sometimes you have only civil procedures
that will well that we have to face
means that you have to pay maybe damages
or compensation for loss of profit etc
and this number of euros is really or
kanga really high for that thank God we
have no punitive damages unlike in the
US for example but also more importantly
sometimes you have criminal procedures
or criminal charges that's you might be
threatened with if you infringe for
example with semiconductor laws and
that's why the question of is it legal
or not is not just a simple question of
yeah probably or most likely but is
actually a serious one so let's look at
the first act of law this is the
semiconductor Protection Act and yes
that exists because we have a law in
Germany for everything also for
semiconductors and the main idea is
actually it's parallel more or less to
the patent law the semiconductor Act
wants to protect three-dimensional
structures of microelectronics
semiconductor products and it is not my
invention actually to phrase it like
that but it is the legal definition of a
topography that I took from the law so
if you look into the law yourself it's
not really long so you can just read it
at night for example as a good night
lecture and you might always you will
always find where to poverty and it is
unfortunately this kind of definition so
here the idea is that the topography is
protected but only the topography as
such so only this three-dimensional
structure of microelectronics
semiconductor products that also means
that information that is stored on that
like firmware or any kind of other
information is not protected by this act
so it's not protected actually by the
registration and the basic rule is
simple you must not reproduce one of the
topographies so if you do that if you
reverse a New York for example ants
put it together again and try how it
works is actually prohibited like per se
under the basic rule that's pretty
unfortunate because it's exactly what we
want to do well we have a fortunate
Clause that gives you an exception
actually so the exception is found again
this is a legal terminology Section six
paragraph two number two and there it
says that reproductions of the
topography for the purposes of analysis
of education are not protected so that
means simply as a kind of background
that's of course you want to protect the
intellectual property but at the same
time you have the freedom of research
protected under our Constitution for
example and that means that there must
be some kind of exception for
researchers for universities for
Institute's that serve the aim of of
knowledge at the apartment of knowledge
on making the product even better or
closing security gaps or something like
that so for researchers we have this
exception clause and actually under the
semiconductor Protection Act at least
you're fine for that okay
there are sentences arguing with the
Constitution is always a good way it is
actually it is now let's go to the
second law that could come into play
let's say you don't have the
semiconductor act in place you might be
involved with a patent act with a patent
protected projects products which is not
sometimes in protected by one single
pattern of a several patents at the same
time and here again the idea of the law
is simple they want to protect the
technically innovative invention the
intellectual property and again here the
basic rule is simple you must not
unauthorized use the product the product
is protected by the patents so if you
have an authorization it is fine if you
don't have a legal per se definite
authorization to use it you must not do
so quite simple but again here this is
actually apparently to the semiconductor
Act we don't have an
solute protection but the pattern is not
protected against actions for
experimental purposes now here again the
wording differs and for lawyers the
wording is always really important but
again the backgrounds of that is that
you want to protect actually research
you want to protect the ones that's
don't want to use the knowledge that
they gained for maybe bring a
competitor's product or two to use its
per se like against the other company
but actually you just want to make maybe
the product safer or want to debug it or
maybe find any kind of malware on it so
for that you have exception clause and
also in the jurisprudence this term of
experimental purpose is usually widely
interpreted so it is for everything that
has to do with gaining new knowledge on
a technical uncertainty so whenever
maybe because there's a patent you have
to describe when you register your
patents how your product works in quite
details but it's for example there is a
may be a legal uncertainty somewhere and
you can just dig into that problem and
do research and that's and for that also
maybe infringe the patent so that is
fine
so also under the Patent Act you're fine
AB it's different was at least the
situation under trade secret law and
that is the main law that has changed
also that's why we do this talk actually
first of all the idea of trade secrets
comes with a competition law that's
anything that is protected in a kind of
like the fact or the you were for
example and that can be used against a
competitor in unfair use for example
there is protection to do not to use the
secret now how now so what you what is
prohibited is actually the the accretion
or the acquisition of a secret know-how
in order to use it against a competitor
and most likely in an unfair way that's
why also the former unfair competition
act comprised these rules and especially
in section 72 it was said that
it's generally prohibited to use any
kind of trade service so why am i
affected on this I think I'm not a
competitor or of the hardware vendors
and the hardware manufacturers that is
absolutely true but at the same time
what the law wants to make sure is that
the law that the trade secret is
actually protected in a most absolute
way so especially how right now not
maybe not so much again with regard to
the old law but with the new law any
kind of person could come could could
reveal actually this kind of trade
secrets and any kind of person any kind
of natural person could be the infringer
in theory at least and especially this
is this area of law has been awarded a
lot of attention lately because
sometimes you have now some kind of
information some kind of maybe even
firmware or something like that that is
not protected by the patent or that is
not protected by the semiconductor Act
or something like that so the IP law
falls sometimes short and then what can
come into play is simply trade secrets
also with regard to the distinction of
course we're normally and the patent law
for example you need to disclose all the
information that you have and the trade
secret actually gives you the
opportunity to just keep the secrets and
not to disclose anything regarding
that's kind of information so there's a
different mechanism of protection and
regarding that we had an e regulation
adopted in 2016 already and it's quite
detailed actually a quite et regulation
under the EU and the time limit because
it's a regulation so it needs to be
adopted and to transfer it international
domestic law by the Member States that
time limit for adoption and for
transferring that regulation was June
2018 and Germany decided not to play
with the rules and not to stick with the
deadline but it finally adopted the
domestic law and April 29th a bit later
but better later than never because now
we have quite a harmonized rules on the
trade secrets and that is important
because
you used to have a quite diverse
situation in France and UK Italy and
Germany so sometimes some certain things
are protected in one state but not in
the other so especially when you work in
EU environments and not just locally in
Germany that is really handy so the
trade secret X usually it was a bit of a
difficulty to define actually what is a
trade secret and that has been an issue
for decades I were to say now it is
defined as information that is not
generally known among all really
accessible to persons within the circles
that normally deal with the kind of
information in question also legal
terminology sorry for that then the
information must be subject to
reasonable steps to keep the secret and
there must be a legitimate interest to
keep the secret usually that interest is
simply the secrecy of being a commercial
value for example now the problem here
is already what is the trade secret for
reverse engineers because especially we
have this requirements of information
that subject to reasonable steps to keep
the secrets but again reasonable is an
indefinite terminology and definite word
so here we need some clarification and
actually if we look back into the
history already under the old law it was
not really I tell some kind of
comparable approach to it and we can
look back for example to 1935 - the rice
direct where there was a shoe press case
involved or she flies in person in
German and the idea was that a
competitor of that producer produced
that shoe press actually wanted to
acquire the shoe press for a cheaper
price but the competitor declined and
then they just tried to reverse engineer
the cheapest and to reverse-engineer
there the hardware the mechanism of how
that worked and then so finally the the
case ended up in from the court and the
court decided several issues and first
of all its kind of try to define what is
the trade secret and what is actually
reasonable steps to keep that
information secrets or else
didn't end up really lucky because again
it decided that it depends on the
reasonable amount of time that you need
to do the reverse engineering process or
the reasonable effort that you put into
the reverse engineering so in the end we
don't really clear with what is actually
reasonable or not but at least for our
case when you deal with how that with
chips for example computer chips to
Hardware reverse it it's I think most
likely very time-consuming and costly so
that's can be regarded as a trade secret
per se for that purpose so in general
for reverse engineers it always depends
on the simplicity or easiness of the
universal acts but in the end at least
for the hardware reversing on chips that
will certainly be met I think now we
have the prohibition maybe a bit more
broadly constituted than before so trade
see Whitman not must not be acquired
through unauthorized access to relevant
documents subject to the control of the
trade secret owner some kind of spines
for example prohibited and for any other
immoral conduct and actually immoral
conduct sounds a bit weird in that
perspective sometimes but also in this
superest case the court had to decide
whether this reverse engineering was in
the end immoral or not and he decided
that yes it was so here again actually
we we had the question of his reverse
engineering per se immoral conduct or
not but the good aspect is right now
that we have a new rule that's point out
that actual reverse engineering at least
under trade secret act is legal or is
lawful because right now we have a
specific rule that says the acquisition
of trade secrets is lawful by the means
of observations studied disassembly or
testing which means reverse engineering
and the product that's in other
requirements the product has to be made
available to the public actually that's
the most important alternative here that
phrase
whenever actually the goods or the
product is on the market publicly
available then it is available to the
public so everybody can buy it and then
you can do research on on reverse
engineering for example this might be a
bit different when for example certain
companies are being made the offer for
example to to pretest certain kind of
products that might be a bit different
there but at least as soon as it's
publicly on the markets purchasable for
everyone or by everyone then it is
subject to section 3 so that's actually
the very good news so in the end I would
say that's we have first of all a good
idea right now that intellectual
property law protects actually vs.
engineering so it is not against it and
we have competition trade secret law
that at least right now specifically
allows for it and that also allows for
another debate that actually exists
amongst lawyers because certainly this
is true for hardware universe
engineering if you do software reverse
engineering it might be a bit different
because you might you're subject to the
Copyright Act for example so there are a
bit different rules sometimes also the
main idea that reverse engineering is
not prohibited per se that is also true
but here also when it comes to hardware
plus firmware then you might end up
sometimes with software and with
Copyright Act it might be a bit
difficult but again also the main idea
is that reverse engineering is true or
is is lawful and wherever you there is
an uncertainty right now people or the
lawyers say that whenever is there's
uncertainty in the intellectual property
law side with regard to reverse
engineering then it must be also
interpreted as legal because we have now
the specific Clause in the
new trade secret laws actually that law
is quite important for reverse
engineering right now and it's also a
good actually a highlight I would say in
the future debates of IP law and related
fields so in general the outlook is
quite good I would say so in the end as
a guideline for research it is actually
quite simple because first of all keep
calm and do your research so you don't
be afraid of any lawyers that will come
up I mean certainly some lawyers will
try and maybe they will succeed in some
cases but usually overall again
they shouldn't then what the law does
not provide for actually but we should
do is follow the responsible disclosure
process in general with regards to the
trade secret Act for example it does not
really differentiate between the reverse
engineering act per se so the
information that you gain out of the Act
and what you do afterwards with that
information so to say in terms of
research you want to publish it in a
journal for example so is that allowed
or not well it's not clearly set so in
the in the code but because we don't
have this kind of distinction in the
code it's most likely also legal because
we have now this general panel allowance
in the know-how law so to say so in
general it's most likely also legal if
you just publish it in a journal but
nevertheless to be on the very safe side
you should follow a responsible
disclosure process and also you have
made some good experiences for that
Safari yeah recently in our group we
made some some good experiences with
responsible disclosure so a colleague of
mine found like a hardware vulnerability
where like millions of devices are
affected which will be in the market
probably for at least 10 or 20 more
years and then like those big companies
those hardware manufacturers and they
have mechanisms in place to disclose
responsibly and the experience my
colleague made was
that he got like really like you got an
answer within just two days from the
company and they asked for a technical
write-up then they needed a little more
time to confirm this technical write-up
actually
and afterwards on the one hand they they
sent the vulnerability to their
customers under NDA you know they didn't
disclose how it actually works but they
told the customers okay there is a
vulnerability in our products and on the
other hand right now we are coordinating
like the publication of the paper and
the publication of the vulnerability
together with the company so like some
of those like bigger companies have
mechanisms in place I don't know how it
is for you know like small German meter
stunts they might never answer to your
responsible disclosure but nonetheless
and then you should do it and you should
give them some time at least before you
before you publish and just in case
maybe you end up in an emergency
situation that you maybe get a nice
letter in your mailbox and it's from an
opposing attorney that tries to sue you
for example then also keep calm and just
ask a lawyer because first of all if
maybe you're threatened by your
horrendous some that you should pay or
something like that don't be afraid of
that first of all because if you go to a
to a lawyer and just ask him for a first
time of advice this per se so the costs
of the lawyer per se they are not super
high actually they also covered by law
so it's it must not be higher than 190
not 190 euros plus tax and so that is
also a good site and then in the end
also because you have a quite a good law
on your side if you do how to reverse
engineering then if you win the case for
example then also the opponent the
losing
actually pays all the fees for the
lawsuit so that's also a good part of
course it doesn't solve all the problems
because especially certain areas are not
very clear in terms of jurisprudence
they also have to maybe yeah
discover this law but at the same time
also and I think that's also point that
we could take from the last year's talk
was that the judge even though they
ended up with a with an agreement but
the judge actually mentioned that the
case against the our colleagues was
quite weak
so Indians I think they wouldn't have
won the case I think the the opponent
attorneys wouldn't have won the case but
it would have looked really good for the
researchers so as a summary it's
actually a good point that security
research overall is taken into a broad
consideration by lawmakers that also
holds true for other areas we have a
different regulation that specifically
deals in the recital with the permission
of of the pattern or the copyright law
infringement for example if you do
research on encryption or something or
decryption so there also if it's regard
to cyber security those kind of aspects
the research on that is usually largely
protected by now in several instances
where that was mentioned so overall it
shouldn't look so bad of course that's
not guarantee like in in front of courts
in the law and on the high C you're in
God's hands so you never know of course
but if you follow the guidelines
actually and if you just keep calm there
shouldn't be so much of a problem thank
you very much thanks for your legal
advice
[Applause]
yes thank you reference the fan and we
actually have a few minutes for your
questions yeah maybe there are some I
suppose if you have one question please
just use the microphones here and one
two three and we start with question for
microphone two please I am thanks for
your talk I wanted to know what if I
develop tools for reverse engineering
and I want to sell them or release them
in my some way liable or should I be
scared so selling so maybe selling it to
come like in general on the markets not
just to other no in general no because
if in the end always the one who does
the research or the reverse engineering
actually it's supposed to display or or
declare that their research or they act
what I doing is for the purpose of
research so whenever they use maybe your
tool that you used for for maybe your
totally solid grounds for a different
purpose then it's up to them actually
that they may be infringed patent law
whatever but the reverse engineering
product per se should not be any
collection thanks and Mike number three
please hello yes thank you for your talk
as well I was wondering if vendor
specifically states in their terms of
services the disassembling reverse
engineering and decompiling of the
proper product is not allowed is that
something that this talk did you just
gave is a superseding like is a yeah how
strong are the terms of service in a
legal way
excellent question um in general always
what you want to do of course if let's
say the law prohibits a certain act then
you want to buy an individual contract
just prohibit that behavior
and it happens quite frequently
especially in the general terms of
agreements now you mentioned
decompilation so if it's regarding
software it might be a problem if you
really decompile software because that's
actually not reverse engineering that is
allowed like that's what I said
software is a bit different sometimes
but if you have a clause that says you
must not reverse engineer basically or
you must not study or like the law for
example phrased it this this clause is
most likely not will not uphold in court
because if it's a general term of
agreement the court can decide on the
lawfulness on this kind of general term
so not if it's an individually discussed
contract as if it's like this general
terms of agreement and then the court
must also decide whether some kind of
clause is against a basic legal idea and
right now with regard to the trade
secret law it says really clearly that
reverse engineering must be allowed
so when then it infringes with that
really clearly stipulated rule actually
then also that general term agreements
would not hold up in court and such but
again with regard to software that
there's sometimes some kind of
exceptions so with especially regard to
D compilations so that might be a bit
different but that's the general thing
all right thanks and we go to Mike
number two please
yeah hello so you talked mostly about
Hardware reverse engineering but often
what you do when your Hardware reverse
engineer something is you extract some
data from from inside the chips and then
you end up with a sequence of bits and
and those bits usually encode a computer
program so the rest of the reverse
engineering then is deals with software
so you didn't talk about the computer
programs directed by suppose that's
relevant here as far as I remember that
that one has some it allows you to do
some things but it's very strict about
publishing
so for instance publishing the result
the information that you gain through
the compilation in the cases where
you're allowed to decompile so I'm
wondering if that if you're the moment
you start analyzing the bitstream that
you've extracted if you're done in
software land already or if you can use
the hardware yeah now's excellent
question and you're also discussing that
a bit beforehand yeah if you end up with
software that could be preferred by the
Copyright Act
so we have a list Gazette's and there
you have one rule also that this kind of
basic reverse engineering is allowed but
you also have another rule that says you
must not decompile so in the sense if
you just translate your or produce some
kind of source code in total or
completely there would be regardless the
compilation and that is only legal if
you want to enhance interoperability
with different systems if you don't do
that actually then it's it's a bit
problematic and most likely prohibited
so but on the other hand if you do maybe
some kind of black box testing so not
decompile the the whole code but maybe
use only more specific areas or black
box testing then also this kind of
reverse engineering on that part is not
regarded as the compilation so then
you're also out of that rule and then
also again it holds true that's reverse
engineering is legal so it depends on
the exact circumstances actually yes um
I have one question to our signal angel
do we have any questions for into it ok
well so then we go over to Mike one
please in your answer to the first
question you said that if someone used a
tool that was originally meant for some
other benign purpose and used to reverse
engineer something the tool maker would
be a not liable so what if the two
makers specifically said okay this tool
can be used to reverse engineer XYZ I
never done this but I could think
I think it might work but this is a good
not be liable
well you must in the end the one who you
mean the one who who does in the end the
reverse-engineering the person who makes
the tool not the personal reverse
engineers well if that tool is if the
lately is also potentially a perfect
legally tool to use reverse engineering
and then the other person just miss uses
it or abuses it that is actually totally
fine at that point even if you say you
can break the law with that
well you shouldn't do so just I would
never say that without of course I mean
don't get yourself into even the
discussion of the trouble so just avoid
any kind of that and only like state and
stipulate that you're doing it for
research and half reverse engineering or
just engineering general like thank you
you understate sanction is saying we
have one last question I assume from mic
number two yeah
so I will use this for two questions so
as a researcher I can i'm allow
generally allowed to we engineer
products which is good news so first how
does anything change it changes if I
make this documentation publicly
available so I reengineering art where
that only falls on the Palin law and now
I publish these design files for free on
the free license on the Internet is that
legal
and also here's a little discussion
because it is clearly legal if that
information is part of intellectual
property law there is one discussion
that says this kind of information is
also some kind of know-how protections
also in the direction of a trade secret
more or less if you interpret it and
that's not completely clear yet but most
likely it is actually also intellectual
property and no know-how protection so
if you maybe have this
how's way of infringing on the patent
rights and then you publish it in the
journal or something like that that's
most likely is also legal in that regard
but there is this internal discussion
actually amongst the lawyers whether
it's know-how or whether it's simply
intellectual property action well I
could publish it on github and then link
in my paper to that is that still legal
well in general I would say yes without
liability here but yeah and second how
do I qualify as a researcher I mean can
I do the research just by myself and
claim I am a researcher and just doing
it for the matter of science whatever I
clarify your science yeah so throughout
the different areas of law you have
really broad terminology in that regard
so of course you're on the perfectly
safe side if you work with an
institution like a university or an
institute something like that if you do
it completely privately it would well
there was another exception clause that
if you do that simply for private
purposes but that would include that you
don't publish anything if you just do it
for the research at least you must state
what kind of expectations you have to
acquire new knowledge or maybe to solve
a kind of a mechanical problem or
something like that so you cannot just
broadly state that I'm doing research
whatever that is but I'm doing research
but you need then at least to specify
what is your expectation your finding so
what you want to do actually want you
want to cheat with it and then but it
could be also it can be regarded as
research as such that yeah cool thanks
and that wraps it up unfortunately we're
running out of time and let's all say
thank you again
- it's definitely current staff and
philosopher they talk and let's give
them a warm round of applause
[Applause]
[Music]