Would open source programs that use encryption be illegal under this draft of the &quot;Compliance with Court Orders Act of 2016&quot; The U.S. congress has a draft for a bill that would require companies to fetch information from a device when requested by a court. A consequence of this is that many types of security technology become illegal for any company subject to U.S. jurisdiction. My question is, would this make open source software that uses encryption illegal? In particular, could open source developers be sued? Can a company that contributes to open source software be sued? If a company distributes open source software, can they be sued (such as the owners of gnupg.org or github.com (note that difference between the two))? If a phone maker puts open source encryption software in it, can they be sued? If a user installs open source encryption software on a phone, can the phone maker be sued? What if they downloaded it from a software center provided by the phone maker? I am specifically talking about the types of encryption that could lead a company to be sued. Note: I think I may be using the word "sue" incorrectly. Feel free to edit this question in order to make more sense legally.
Section 4, Definition 4 Covered Entity, emphasis added: The term "covered entity" means a device manufacturer, a software manufacturer, an electronic communication service, a remote computing service, a provider of wire or electronic communication service, a provider of a remote computing service, or any person who provides a product or method to facilitate a communication or the processing or storage of data. This definition seems extremely broad, and could be stretched to cover an answerer on Stack Overflow whose answer provided a method facilitating data processing, storage, or communication (which covers most software methods). So let's then look at what can be required of a covered entity: Section 3(a)(1), Requirement: ... a covered entity that receives a court order from a government for information or data shall provide such information or data to such government in an intelligible format or provide technical assistance as is necessary to obtain such information or data in an intelligible format or to achieve the purpose of the court order. Subsection 2 limits the scope so that a covered entity only has to provide data if the data was "made unintelligible by a feature, product, or service owned, controlled, created, or provided by the covered entity or by a third party on behalf of the covered entity." However, courts cannot effectively require people to do the impossible; if a programmer wrote a method that was used in an encrypted communication service that does not mean the programmer, lacking the encryption key, will be forced to break what they believe to be unbreakable encryption. The key here is in section 3(c), emphasis added: A provider of remote computing service or electronic communication service to the public that distributes licenses for products, services, applications, or software of or by a covered entity shall ensure that any such products, services, applications, or software distributed by such person be capable of complying with subsection (a). So if this bill were to become law, it would be the service provider who's responsible for making sure the government can get the intelligible information. The government could require e.g. the author of the encryption function, even if that person's not part of the service provider, to help break the encryption, but the responsibility for ensuring data accessibility lies with the service provider. The definition of service provider seems absent from at least what I can see of this bill, but it seems that a company selling a communications service to customers would very likely qualify, and a person/company who posted an answer on SO that was then picked up and integrated into something someone else distributed as part of a service, very likely would not.
Affirmative authority that this particular use (incorporation of the format of another program's textual data files into your own program) is protected is somewhat elusive in the US system; however there's a lot of observable evidence that reverse engineering data file formats without a license is widespread. My sense is that this would be analyzed under the same rubric as other kinds of reverse engineering and/or fair use. I'm sure there are others here who are better able to clearly and concisely explain that law than I am. However there may be limits — it seems Microsoft was able to prevent VirtualDub's use of the ASF format by patenting it. That said, it's hard to see how an unencrypted, unencoded ASCII data file file could be patentable (i.e. where the ASCII strings are the data, generated in response to user input, and the format is just their order and separators, etc). For the European arena, there is recent authority in SAS Institute Inc v World Programming Limited that the format of a program's data files are not protected by copyright when reverse engineered without the source code. The following is from the digest and application of the CJEUs decision by the English court that referred it, in its subsequent judgment: The judgment of the CJEU On 29 November 2011 Advocate General Bot delivered his Opinion on the questions referred... Questions 1-5 The Court dealt with these questions together. It interpreted this court as asking "in essence, whether Article 1(2) of [the Software Directive] must be interpreted as meaning that the functionality of a computer program and the programming language and the format of data files used in a computer program in order to exploit certain of its functions constitute a form of expression of that program and may, as such, be protected by copyright in computer programs for the purposes of that directive": see [29]. Having referred to recital (14), Article 1(1) and 1(2) of the Software Directive, Article 2 of the WIPO Copyright Treaty and Articles 9(2) and 10(1) of TRIPS, the Court went on: ... 39. [...] it must be stated that, with regard to the elements of a computer program which are the subject of Questions 1–5, neither the functionality of a computer program nor the programming language and the format of data files used in a computer program in order to exploit certain of its functions constitute a form of expression of that program for the purposes of Article 1(2) of Directive 91/250. 40. As the Advocate General states in point 57 of his Opinion, to accept that the functionality of a computer program can be protected by copyright would amount to making it possible to monopolise ideas, to the detriment of technological progress and industrial development. 41. Moreover, point 3.7 of the explanatory memorandum to the Proposal for Directive 91/250 [COM(88) 816] states that the main advantage of protecting computer programs by copyright is that such protection covers only the individual expression of the work and thus leaves other authors the desired latitude to create similar or even identical programs provided that they refrain from copying. 42. With respect to the programming language and the format of data files used in a computer program to interpret and execute application programs written by users and to read and write data in a specific format of data files, these are elements of that program by means of which users exploit certain functions of that program. 43. In that context, it should be made clear that, if a third party were to procure the part of the source code or the object code relating to the programming language or to the format of data files used in a computer program, and if that party were to create, with the aid of that code, similar elements in its own computer program, that conduct would be liable to constitute partial reproduction within the meaning of Article 4(a) of Directive 91/250. 44. As is, however, apparent from the order for reference, WPL did not have access to the source code of SAS Institute's program and did not carry out any decompilation of the object code of that program. By means of observing, studying and testing the behaviour of SAS Institute's program, WPL reproduced the functionality of that program by using the same programming language and the same format of data files. 45. The Court also points out that the finding made in paragraph 39 of the present judgment cannot affect the possibility that the SAS language and the format of SAS Institute's data files might be protected, as works, by copyright under Directive 2001/29 if they are their author's own intellectual creation (see Bezpecnostní softwarová asociace, paragraphs 44 to 46). 46. Consequently, the answer to Questions 1–5 is that Article 1(2) of Directive 91/250 must be interpreted as meaning that neither the functionality of a computer program nor the programming language and the format of data files used in a computer program in order to exploit certain of its functions constitute a form of expression of that program and, as such, are not protected by copyright in computer programs for the purposes of that directive." Regarding the idea that the user has rights to access their output of a program held in a proprietary data file format there is some additional discussion in the that might be helpful in paragraphs 48 - 62 (of the CJEU opinion), discussing the right of a licensee to 'study and observe' the 'underlying' 'ideas and principles' of a program to accomplish 'acts of loading and running necessary for the use of the computer program.'
Your code is considered free speech (Bernstein v. United States) and you have allowed the use of the code via the MIT license. Since the application of your code is very generic and is not specifically targeting anyone. You probably are not criminally liable. This is simply writing a "Proof of Concept" for security testing purposes. That same way Metasploit, Nessus, and Nmap have actual exploit code but are considered tools of the trade. Now if you go around using your spyware on non consenting victims. You might get a visit from some people with guns and badges that have 3 letters on them.
We can't really know until the ruling is made. The Supreme Court might issue a ruling that encompasses all software APIs, or may predicate its ruling on this more specific situation, e.g. that because Oracle's library is so extensive its structure can be copyrighted even if that does not necessarily mean that any individual function signature can be copyrighted. They could also decide based on something unrelated to the heart of the copyright question - skimming through the petition for a writ of certiorari, they could make a decision based on the original implied license from Sun, for example. Hopefully their decision will answer the copyright question of function declarations completely, but it isn't required to.
In general this is protected by the first amendment. It is not in general a problem describing how one can one can do something illegal. But there are special cases to be careful with. You might want to do some research into the limits on free speech. It would be hard to provide an answer that fully covers all your different cases and you would need to be more specific about what illegal activity you want to describe. In describing how to do something illegal, you might accidentally share information that you are not allowed to share. When you post things online, this can be considered as publishing or exporting. Therefore certain export restrictions might apply. Also, It is illegal to publish bomb making manuals, with the knowledge or intent that this information be used to commit a federal crime of violence. See https://www.law.cornell.edu/uscode/text/18/842. There are restrictions on publishing material relating to cryptography without having an export license. Granted, this isn't necessarily related to publishing things that are illegal, but just to give an idea about how publishing/exporting knowledge can causes problems. See https://en.wikipedia.org/wiki/Export_of_cryptography_from_the_United_States ITAR (International Traffic in Arms Regulations) sets restrictions on what you can publish about arms. What you publish can't be “directed to inciting or producing imminent lawless action.” See for example https://en.wikipedia.org/wiki/Brandenburg_v._Ohio. One might imagine that you could get into trouble if someone interprets what you do as inciting or producing a lawless action. It might sound obvious, but you want to make sure that you have the right to share the information that you have. The information that you are providing might be copyrighted in some way.
There is also the part that says &quot;except as expressly permitted by law&quot;. In the USA, you are allowed to run the software. This means the operating system making the copy that transfers the software from your hard drive to the RAM of the computer, and all necessary changes there. And this includes modifications to relocate the software, or to protect it against certain attacks by hackers, and I'm confident that Apple checked that it includes translating x86 machine code to ARM machine code and store the translated copy together with the original. Similar things have been done already around 2000 or so, and no software manufacturer has ever complained.
It is not necessary to design anything (program design is outside the scope of Law SE, anyhow). It is legal to pay a person to encrypt your drive with BitLocker. It is legal to instruct them, as part of the contract, to not reveal the key to you, until you complete your contractual obligation (paying the fee that constitutes your consideration under the contract). The contract could immunize the encryptor against liability for the drive-owner wising up moments after enter is pressed.
It doesn't work like that! If the code is not properly licensed, you can not acquire a license for it. If you don't have a license, you can not use it. Usage without a license is copyright infringement and not allowed: the copyright is with the author, and only the author may make derivates or copies or allow them to be made by licensing it. You do not gain copyright by fixing a licensing error - in fact, you commit copyright infringement if you do not have a license, and providing wrong copyright management information is illegal under 17 USC 1202