5 ms·

If I buy a Bluetooth SmartLock, is it illegal for me to to attempt to open my own lock without the key to see if the product actually works?

by Drakim 8y ago

ikeboy 8y ago
Probably, it isn't trying to protect anything copyrighted. Ask a lawyer to be sure
- Drakim 8y ago
  Wouldn't the software inside the lock be copyrighted?
  - delinka 8y ago
    But you're not trying to access the software, you're trying to unlock the lock. DMCA concerns itself with copyrighted works behind some protection mechanism: technically, if you're accessing the lock's firmware, discover it's encrypted, then attempt to decrypt it, you're violating the DMCA. In addition, if you publish the decrypted software, you're infringing copyright. In either case, these are probably not CFAA violations.
Meist1 8y ago
Depends on the lock and the method of attack you are using - CFAA violations are usually tied to 18 USC §1030 (4) (https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030), which only apply to "protected computer[s]" A computer is protected (18 USC §1030(e)(2)) in generally one of three circumstances - i) Used exclusively by a financial institution; ii) Used exclusively by the US Gov't; or iii) Affects foreign commerce or communication [usually interpreted to mean connected to the Internet] Therefore, if you are using a non-internet connected device (i.e. Bluetooth or NFC only), it's unlikely to be a violation of the CFAA. NOT LEGAL ADVICE, SEEK YOUR OWN LICENSED ATTORNEY
tptacek 8y ago
Almost certainly not (if the lock somehow phones home to a central server and your research involves subverting the server, you could have problems, but no lock I know of works that way). While it might not be illegal to mess with a lock you've purchased, it could be unlawful, in the sense that you might be violating a contract that you agreed to when you purchased the lock. So while I would stake money on you not getting arrested for doing that work, I wouldn't bet against you getting sued, which is a far more common occurrence. Researchers getting arrested: rare. Researchers getting sued: a little less rare (still pretty rare).
- PurpleBoxDragon 8y ago
  Such one sided contracts where there was never a possibility of negotiation need to be tossed out. This applies to the EULA of a smart lock to a lease agreement with some super corporation located in a different state. Such contracts can only be consensual when involving two entities of similar power.
  - tptacek 8y ago
    This is pretty silly. All sorts of valid contracts are non-negotiable. You have an option: return the device for a refund.
    - marcosdumay 8y ago
      In a Democracy, one can not resign fundamental rights in a contract. Not in one you get to read before signing, and definitively not in one you can only read after signing. You can agree to some punishment (like in an NDA). But if it's in a level that would destroy your life, it ought to be illegal again. And every time you agree for some punishment for exercising a fundamental right, you must gain something proportional to the right taken, otherwise it ought to be illegal again. It's impossible to have a democracy if most of the population is slave due to some contractual clause.
- delinka 8y ago
  And further, if you're doing this on your own and never publish anything, it's not like Bluetooth Locks, Inc knows what you're up to and just magically serves you with a lawsuit.

If I buy a Bluetooth SmartLock, is it illegal for me to to attempt to open my own lock without the key to see if the product actually works?

by Drakim 8y ago

If I buy a Bluetooth SmartLock, is it illegal for me to to attempt to open my own lock without the key to see if the product actually works?

ikeboy 8y ago

Probably, it isn't trying to protect anything copyrighted. Ask a lawyer to be sure

Drakim 8y ago
Wouldn't the software inside the lock be copyrighted?
- delinka 8y ago
  But you're not trying to access the software, you're trying to unlock the lock. DMCA concerns itself with copyrighted works behind some protection mechanism: technically, if you're accessing the lock's firmware, discover it's encrypted, then attempt to decrypt it, you're violating the DMCA. In addition, if you publish the decrypted software, you're infringing copyright. In either case, these are probably not CFAA violations.

Meist1 8y ago

Depends on the lock and the method of attack you are using - CFAA violations are usually tied to 18 USC §1030 (4) (https://www.law.cornell.edu/uscode/text/18/1030 https://www.law.cornell.edu/uscode/text/18/1030), which only apply to "protected computer[s]" A computer is protected (18 USC §1030(e)(2)) in generally one of three circumstances - i) Used exclusively by a financial institution; ii) Used exclusively by the US Gov't; or iii) Affects foreign commerce or communication [usually interpreted to mean connected to the Internet] Therefore, if you are using a non-internet connected device (i.e. Bluetooth or NFC only), it's unlikely to be a violation of the CFAA. NOT LEGAL ADVICE, SEEK YOUR OWN LICENSED ATTORNEY

tptacek 8y ago

Almost certainly not (if the lock somehow phones home to a central server and your research involves subverting the server, you could have problems, but no lock I know of works that way). While it might not be illegal to mess with a lock you've purchased, it could be unlawful, in the sense that you might be violating a contract that you agreed to when you purchased the lock. So while I would stake money on you not getting arrested for doing that work, I wouldn't bet against you getting sued, which is a far more common occurrence. Researchers getting arrested: rare. Researchers getting sued: a little less rare (still pretty rare).

PurpleBoxDragon 8y ago
Such one sided contracts where there was never a possibility of negotiation need to be tossed out. This applies to the EULA of a smart lock to a lease agreement with some super corporation located in a different state. Such contracts can only be consensual when involving two entities of similar power.
- tptacek 8y ago
  This is pretty silly. All sorts of valid contracts are non-negotiable. You have an option: return the device for a refund.
  - marcosdumay 8y ago
    In a Democracy, one can not resign fundamental rights in a contract. Not in one you get to read before signing, and definitively not in one you can only read after signing. You can agree to some punishment (like in an NDA). But if it's in a level that would destroy your life, it ought to be illegal again. And every time you agree for some punishment for exercising a fundamental right, you must gain something proportional to the right taken, otherwise it ought to be illegal again. It's impossible to have a democracy if most of the population is slave due to some contractual clause.
delinka 8y ago
And further, if you're doing this on your own and never publish anything, it's not like Bluetooth Locks, Inc knows what you're up to and just magically serves you with a lawsuit.