Research Chilling Effects

Software manufacturers often use EULAs, terms of service, and legal threats under laws like the Computer Fraud and Abuse Act and DMCA Section 1201 to prohibit reverse engineering, penetration testing, or independent analysis of their products.

These restrictions are framed as protecting intellectual property, but they also block independent researchers and customers from finding product defects before attackers do.

A manufacturer confident in its product security has little reason to fear outside scrutiny.

Discussion prompts

• What does your organization's EULA or terms of service say about independent security testing of your products?
• Would you rather a product defect be found by a researcher or by an attacker?
• How would removing legal barriers to research change your incentive to find and fix product defects before shipping? (see C-12, C-14)