Reverse engineering for security research Is it legal to reverse engineer a closed source application in order to check how secure it is if: the software came preinstalled on the device (i.e. I have not signed an EULA) I have signed an EULA that forbids reverse engineering I have seen a lot of renowned experts reverse engineer popular software and publish details on their flaws and their inner workings on conferences. Is this legal ? (I am particularly interested in EU law)
As you have agreed, by contract, not to reverse engineer the product, technically it would be a "breach of contract" to do so, assuming such terms are enforceable where you live (or wherever the EULA selects as the choice of forum).
In my opinion, you are totally free to publish the information. There are two areas of law that can be cosidered - private and public law. In the private law area, you can be liable for revealing trade secrets, but only if you agreed to keep them by a contract. Trade secrets do not exist by themselves (there are minor exceptions, eg. in competition law, but those do not concern us), they must be protected by contracts. Another private limitations, like libel laws, won't apply here. This is not uncommon, but not in cars - you can find clauses like these in software license agreements. Then there is the public area. Is there any regulation, any policy of the state, that prevents you from publishing it? I am not aware you whole legal code of your state, but I doubt there is. It would be a harsh limitation of freedom of speech. Even if the modification could lead to illegal effect (like, modifying toy weapon to kill by rising its power...) it would be only illegal under very rare circumstances. To conclude it - freedom of speech can be limited only if there is sufficient public interest to do so, and I don't see any.
Yes and no. [note, the following is all written about US law. In other jurisdictions laws are, of course, different (though usually not drastically so.)] In the US there are (at least) three different bodies of law that might apply to code: copyright, patents, trade secrets. Copyright covers original expression. Anything you write is automatically, immediately protected under copyright. The copyright applies to the code itself, and anything "derived" from that code. It's up to the courts to decide exactly what "derived" means. One case that's long been viewed as a landmark in this area is Gates Rubber v. Bando Chemicals. The Court of Appeals for the tenth Circuit decision includes a section titled: "The Test for Determining Whether the Copyright of a Computer Program Has Been Infringed." Note that you can register a copyright, and that can be worthwhile, such as helping recover some damages you can't otherwise. Patents are quite different from copyrights. Where a copyright covers expression of an idea, a patent covers a specific invention. Rather than being awarded automatically, a patent has to be applied for, and awarded only after the patent office has determined that there's no relevant prior art to prevent it from being awarded. A patent, however, covers things like somebody else independently discovering/inventing what's covered by the patent. A trade secret could (at least theoretically) apply to some process or procedure embodied in the code. A trade secret mostly applies to a situation where (for example) you're trying to form an alliance with some other company, and in the process tell them things you don't tell the general public. If you've identified the fact that what you're telling them is a trade secret, and they then tell a competitor (or the general public, etc.) or more generally use that information in any way other than the originally intended purpose, it could constitute a trade secret violation. As a side-note: patents and copyright fall under federal law, so they're basically uniform nation-wide. Trade secrets mostly fall under state law, so the exact details vary by state. Absent a reason to believe otherwise, I'd guess your interest here is primarily in copyright infringement. The key here would be showing that one piece of code was derived from the other. That is, it specifically would not apply in a case where there were only a limited number of ways of doing something, so anybody who wanted to do that had to use one of those ways. Since this would not indicate actual derivation, it would not indicate copyright violation.
I'm assuming that you are not seeking to change the license, and so it will remain GPLv3. As long as you've built on the original software, that license still applies. You also need to keep the previous copyright notices, including the names of the original people. Assuming that, everything you're doing is legal, which is what's on topic here. There is some etiquette around forks (which is what you're doing), which would be on topic at the Open Source Stack Exchange. I'm puzzled by your desire to have a different license text. You can't change the license from GPLv3, so that has to stay the same. (If the original has GPLv3 "or, at your option, any later version", you can drop the any other version text if you like.)
Written down computer code is subject to copyright. If you do not have the permission of the owner to copy it you are breaching their copyright unless your use constitutes fair use/dealing.
Of course you have to follow the license. You seem to have a license that doesn't allow distribution and want to know if giving copies to the Dutch or Chinese branch of your company is distribution. First, you should not make that decision. Your company's lawyers should do that. Second, such distribution is with some licenses perfectly legal if you distribute the software with source code. That's a business decision which you or your manager or his/her manager... can make. Such questions (whether giving a copy to your Dutch branch is distribution) often don't have an answer that is yes or no but maybe - if you went to court, would a judge say that it is distribution? The answer is quite clearly "maybe". So unless you can find a safe way, there is a risk. Again, your lawyers will assess the risk.
Such clauses are called "copyright assignment", "invention assignment", and/or "works for hire" clauses, partly depending on the clause's intent and wording. They're pretty common in employment contracts for software development and some creative positions. Frankly, the clauses don't actually do much, at least in the US -- copyright law already recognizes the concept of works made for hire (which belong to the employer), and claims too far beyond that are often rejected if they aren't obviously related to company business. With that said, your hypothetical programmer's painting is safe unless it depicts, say, the contents of an email from the CEO. :) Even if the clause technically entitles the employer to claim ownership, the employer has no legitimate interest in doing so. Likewise, that app created outside work is safe as long as it is created using no company resources and is unrelated to the employer's business. If the app is obviously related, that's where things get hairy.
The companies really need to speak to an IP lawyer as this question is seeking specific advice which this site is loathe to give out for fear of compouding issues. The answer would depend on the license agreements and enforceability in various jurisdictions. According to https://social.msdn.microsoft.com/Forums/vstudio/en-US/0368d7ee-0eb3-4e3e-a143-4410969a15bb/eula-for-vs2010?forum=vssetup Microsoft says you cant rent out the software - but this applies to the "Pro" version - I could not find anything on the "Premium" version - so most likely Microsoft to have some clam. The flipside is how enforceable this EULA is - and this would probably vary from jurisdiction to jurisdiction. It would be a very, very good idea to speak to a lawyer before letting Microsoft come onto the premises - as "inviting them" to do this is almost certainly not going to improve the Asians company's case and will allow Microsoft to go fishing further and make it easier for them to expand on and collect evidence should they decide to pursue the matter.