&quot;Reverse Engineering&quot; a plain text file format If a file output from a non-open source program is stored in plain text. What legal implications are there for building a parser to read that file into my program? Is there any legal distinction between one that is plain text vs binary vs encrypted?
Affirmative authority that this particular use (incorporation of the format of another program's textual data files into your own program) is protected is somewhat elusive in the US system; however there's a lot of observable evidence that reverse engineering data file formats without a license is widespread. My sense is that this would be analyzed under the same rubric as other kinds of reverse engineering and/or fair use. I'm sure there are others here who are better able to clearly and concisely explain that law than I am. However there may be limits — it seems Microsoft was able to prevent VirtualDub's use of the ASF format by patenting it. That said, it's hard to see how an unencrypted, unencoded ASCII data file file could be patentable (i.e. where the ASCII strings are the data, generated in response to user input, and the format is just their order and separators, etc). For the European arena, there is recent authority in SAS Institute Inc v World Programming Limited that the format of a program's data files are not protected by copyright when reverse engineered without the source code. The following is from the digest and application of the CJEUs decision by the English court that referred it, in its subsequent judgment: The judgment of the CJEU On 29 November 2011 Advocate General Bot delivered his Opinion on the questions referred... Questions 1-5 The Court dealt with these questions together. It interpreted this court as asking "in essence, whether Article 1(2) of [the Software Directive] must be interpreted as meaning that the functionality of a computer program and the programming language and the format of data files used in a computer program in order to exploit certain of its functions constitute a form of expression of that program and may, as such, be protected by copyright in computer programs for the purposes of that directive": see [29]. Having referred to recital (14), Article 1(1) and 1(2) of the Software Directive, Article 2 of the WIPO Copyright Treaty and Articles 9(2) and 10(1) of TRIPS, the Court went on: ... 39. [...] it must be stated that, with regard to the elements of a computer program which are the subject of Questions 1–5, neither the functionality of a computer program nor the programming language and the format of data files used in a computer program in order to exploit certain of its functions constitute a form of expression of that program for the purposes of Article 1(2) of Directive 91/250. 40. As the Advocate General states in point 57 of his Opinion, to accept that the functionality of a computer program can be protected by copyright would amount to making it possible to monopolise ideas, to the detriment of technological progress and industrial development. 41. Moreover, point 3.7 of the explanatory memorandum to the Proposal for Directive 91/250 [COM(88) 816] states that the main advantage of protecting computer programs by copyright is that such protection covers only the individual expression of the work and thus leaves other authors the desired latitude to create similar or even identical programs provided that they refrain from copying. 42. With respect to the programming language and the format of data files used in a computer program to interpret and execute application programs written by users and to read and write data in a specific format of data files, these are elements of that program by means of which users exploit certain functions of that program. 43. In that context, it should be made clear that, if a third party were to procure the part of the source code or the object code relating to the programming language or to the format of data files used in a computer program, and if that party were to create, with the aid of that code, similar elements in its own computer program, that conduct would be liable to constitute partial reproduction within the meaning of Article 4(a) of Directive 91/250. 44. As is, however, apparent from the order for reference, WPL did not have access to the source code of SAS Institute's program and did not carry out any decompilation of the object code of that program. By means of observing, studying and testing the behaviour of SAS Institute's program, WPL reproduced the functionality of that program by using the same programming language and the same format of data files. 45. The Court also points out that the finding made in paragraph 39 of the present judgment cannot affect the possibility that the SAS language and the format of SAS Institute's data files might be protected, as works, by copyright under Directive 2001/29 if they are their author's own intellectual creation (see Bezpecnostní softwarová asociace, paragraphs 44 to 46). 46. Consequently, the answer to Questions 1–5 is that Article 1(2) of Directive 91/250 must be interpreted as meaning that neither the functionality of a computer program nor the programming language and the format of data files used in a computer program in order to exploit certain of its functions constitute a form of expression of that program and, as such, are not protected by copyright in computer programs for the purposes of that directive." Regarding the idea that the user has rights to access their output of a program held in a proprietary data file format there is some additional discussion in the that might be helpful in paragraphs 48 - 62 (of the CJEU opinion), discussing the right of a licensee to 'study and observe' the 'underlying' 'ideas and principles' of a program to accomplish 'acts of loading and running necessary for the use of the computer program.'
A creative prosecutor could probably come up with a raft of charges. But you could start with the federal wiretapping statute, 18 USC 2511, and the anti-hacking statute, 18 USC 1030. Here is an indictment brought in 2012 under the anti-hacking statute against someone who distributed and used this kind of software. Depending on the facts and the jurisdiction, this may also constitute the tort of intrusion on privacy or seclusion, a tort recognized by the Restatement (Second) and actionable in many jurisdictions. The most common test is whether the invasion would be "offensive to a reasonable person." And no, contrary to the commenter's view, a "click to accept" license is not a get out of (literal) jail free card here. Courts interpret adhesion contracts liberally to favor the signer, and outrageous terms hidden in small print are not guaranteed to be enforceable, especially if the software is clearly designed to trick people into installing it. The license terms might even hurt you, by providing evidence of your intent to use the software for perving rather than its ostensible use. This is not an exhaustive list, and there may be additional state-level statutes that apply. Bottom line: yes, this is clearly illegal, and the courts will be reluctant to let you trick people into getting away with it.
What happened is that you created a legal mess. You are obviously on the hook for copyright infringement. The maintainers of the project will scramble to replace your code with newly written code. They will likely ask your company which code they are complaining about - that puts your company into the problematic situation that they shouldn't identify code that isn't theirs, that it will be hard to sue for infringing code when they didn't give the project maintainers a chance to fix it, and that everything they identify will be replaced. Since it is your actions that caused the trouble, anyone suffering damages from your actions can sue you.
Go to the Source If you follow the Legal link at the bottom of the page and read the terms of service, among other things, it says (my emphasis): 1. Access to the Services Subject to the terms and conditions of this Agreement, Stack Exchange may offer to provide the Services, as described more fully on the Network, and which are selected by Subscriber, solely for Subscriber’s own use, and not for the use or benefit of any third party. ... Subscriber certifies to Stack Exchange that Subscriber is an individual (i.e., not a corporate entity) at least 13 years of age. ... 2. Network Content ... The Network is protected by copyright as a collective work and/or compilation, pursuant to U.S. copyright laws, international conventions, and other copyright laws. Other than as expressly set forth in this Agreement, Subscriber may not copy, modify, publish, transmit, upload, participate in the transfer or sale of, reproduce (except as provided in this Section), create derivative works based on, distribute, perform, display, or in any way exploit, any of the Content, software, materials, or Services in whole or in part. Subscriber may download or copy the Content, and other items displayed on the Network for download, for personal use, provided that Subscriber maintains all copyright and other notices contained in such Content. From time to time, Stack Exchange may make available compilations of all the Subscriber Content on the Network (the “Creative Commons Data Dump”). The Creative Commons Data Dump is licensed under the Creative Commons Attribution Share Alike license. By downloading The Creative Commons Data Dump, You agree to be bound by the terms of that license. Any other downloading, copying, or storing any Content for other than personal, noncommercial use is expressly prohibited without prior written permission from Stack Exchange, or from the copyright holder identified in such Content's copyright notice. In the event You download software from the Network, the software, including any files, images incorporated in or generated by the software, and the data accompanying the software (collectively, the “Software”) is licensed to You by Stack Exchange or third party licensors for Your personal, noncommercial use, and no title to the Software shall be transferred to You. Stack Exchange or third party licensors retain full and complete title to the Software and all intellectual property rights therein. 3. Subscriber Content You agree that all Subscriber Content that You contribute to the Network is perpetually and irrevocably licensed to Stack Exchange under the Creative Commons Attribution Share Alike license. You grant Stack Exchange the perpetual and irrevocable right and license to use, copy, cache, publish, display, distribute, modify, create derivative works and store such Subscriber Content and to allow others to do so in any medium now known or hereinafter developed (“Content License”) in order to provide the Services, even if such Subscriber Content has been contributed and subsequently removed by You. ... Consequences Under Clause 1 Subscribers to Stack Exchange must be individuals (natural persons in legalese). The proprietor of LearnHub.org are unlikely to be an individual and are therefore not a Subscriber under the terms of use. Under Clause 2, everything on Stack Exchange is copyright and some things are trade marked as well. The copyright for posts vests in the Subscriber and is licenced to SE (CC BY-SA 3.0) or vests in SE directly as the creator. Clause 8.1a. of CC BY-SA 3.0 requires SE to grant a licence to any recipient of a distribution (e.g. on a web site) on the same terms. For this reason the limitations on the copyright in Clause 2 can only apply to those items where copyright vests in SE directly; not to the content of the Subscriber posts. Assuming that it is only Subscriber posts that they are reproducing then they either need to: Comply with CC BY-SA 3.0 and attribute the work as required by that licence; what they have put up does not on the face of it do that because: They are referring to an earlier version of the licence Attribution under 3.0 is detailed in Clause 4.c. and this doesn't meet the criteria. Have been licenced by the original copyright holder; which seems unlikely. Meet the fair use criteria; attribution would not be required but would certainly be polite. Fair use turns on the specific facts of the case - on the face of it they could put forward a credible argument that their use is fair use. Complications Jurisdiction matters here; copyright laws are not uniform across the world. For example, Australian copyright has a much more limited "fair use" concept than the US and also creates a "moral copyright" of the author that exists independently of the copyright of the owner. For signatories to the Berne Convention; the country of origin for simultaneously published works (which online posting is) and therefore the law applying is the country that gives the shortest term of protection. The convention is annoyingly silent of what that means if there is more than one qualifying "Country of Origin"; this leaves scope for litigants to try to apply the most favourable domestic law that could be applicable and the case could be brought in any of several jurisdictions. This is the stuff that makes lawyers rich!
If you change a single character, that's clearly a partial copy. Copyright protection has a limited extent, however. The protected work must be original and not obvious. For example, there are only so many ways to write a function that computes the average of two numbers, so the copyright owner of one body of code cannot claim infringement by the author of a second body of code simply because they both have a function float Average(float a, float b) { return (a + b) / 2; } A surefire way to avoid infringing copyright is to specify the function of the code and then have someone who has never seen the code write it from scratch. This is sometimes called clean-room engineering. Otherwise, there is no way to answer your question definitively. If you create a modified copy of the code (a "derived work" in copyright terminology), there is no strict formula available to evaluate the extent of the infringement. It comes down to a case-specific analysis of the facts by a judge. Depending on the jurisdiction, which you have not specified, there may be specific laws or judicial precedent that guide the judge, but the determination will still require a specific analysis of the facts. For example, if the alleged infringer raises these arguments, the judge would have to determine how obvious the code is, or whether the copyright claimant even owns the copyright to the code.
It isn't true that modern encryption necessarily makes messages indistinguishable from random noise. However, let's assume that this is true, for the sake of your question. It depends on how the statute is written, but a reasonable one would not make it a crime to send random noise. It could be enforced by proving that you did the encryption, and then sent what you encrypted across a communication channel. They could have undercover operatives waiting to be sent encrypted material. The encryption system that a user chooses to use might not be as secure as advertised (making it very easy to distinguish from noise if you know its weakness). If all the government had was access to the communication channel and listened there, then you're right, it would be hard to prove and enforce, but they have access to more than that.
This could be a violation of 18 USC 1030 (and a crime). A number of things go into requirements for conviction under this law. First, it has to be a computer, which is defined as an electronic, magnetic, optical, electrochemical, or other high speed data processing device performing logical, arithmetic, or storage functions, and includes any data storage facility or communications facility directly related to or operating in conjunction with such device, but such term does not include an automated typewriter or typesetter, a portable hand held calculator, or other similar device Any printer that I have encountered in the past 40 years counts as &quot;a computer&quot;. Second, (2) intentionally accesses a computer without authorization or exceeds authorized access, and thereby obtains—...(C) information from any protected computer; It is highly likely that the person printing has to receive some information from the printer, and respond accordingly so you have your &quot;obtains information&quot; element. Maybe not useful information, but information nevertheless. It also has to be a protected computer, (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States Well, a computer connected to the internet is a protected computer, see US v. Trotter, 478 F.3d 918. Also, the access must be &quot;without authorization or exceeds authorized access&quot;. The law doesn't explain with &quot;without authorization&quot; means, but the latter is defined as to access a computer with authorization and to use such access to obtain or alter information in the computer that the accesser is not entitled so to obtain or alter If the law were stated in terms of &quot;prohibited access&quot;, meaning &quot;express denial of permission&quot;, and if the computer owner had set the computer to &quot;prohibited access&quot; by default (password protected), there would be no issue -- accessing the computer is prohibited. &quot;Unauthorized&quot; can also mean &quot;has not been explicitly authorized&quot;, i.e. lacking any indication one way or the other. Every computer access is initially unauthorized, until authorization is granted; and re-trying a login after mis-typing a user name (and being denied access) is not a violation of this law. There does not appear to be case law that addresses the status of computers just left open to the public, and whether using a computer that is so exposed constitutes &quot;unauthorized access&quot;. Also, it is not clear that the defendant in this case has &quot;obtained information&quot;, since with printing, information flows into the computer. There is also a clause about recklessly causing damage, but I don't see what damage would result (&quot;damage&quot; is defined as &quot;any impairment to the integrity or availability of data, a program, a system, or information&quot;), and how printing would be &quot;reckless&quot;. It seems somewhat unlikely that this would be deemed to be a crime, though if you experiment, you could be on the cutting edge of new case law.
You are creating a derivative work. You are only allowed to do this if the library comes with a license that allows this. If you want to give your derivative work to anyone else, copying it is copyright infringement unless the license allows it. Copying the derivative work and attaching a different license is most likely to be copyright infringement. And if people receive a copy with an open source license that is not justified and rely on it, that’s creating one unholy legal mess for everyone involved and can be massively more expensive than plain copyright infringement. No license means you don’t have permission to do anything with it, not creating derivative work, not distributing it, and certainly not publish it with an open source license.