2

I am interested in US law as well as European law, and curious about international/other countries law, if applicable.

It is generally accepted that if you somehow find a private key (let's assume by reverse-engineering for now), you can't publish it. For example, this question takes it as a given.

However, I don't see what exactly in the law prevents from doing so. If you are given a piece of hardware or software that contains the key, it actually seems to me that there is nothing to prevent the key from being redistributed?

As far as I know copyright requires the material to be a creative work, with some originality. While the originality could be argued, I am not sure the creative work part would held. Moreover, it is well established that facts are not copyrightable. Can't a key be considered a fact?

The key can certainly not be patented, but it can be considered a trade secret. As this trade secret was not acquired trough unlawful means (such as an NDA breach), couldn't it be disclosed?

I am interested in legal precedents on the matter as well, if you know of any.

0

3 Answers 3

1

You shouldn't redistribute the key if you know a person will use it to crack the software.

These are a few subsections from the law in the UK.

This section applies where— (a)effective technological measures have been applied to a copyright work other than a computer program; and (b)a person (B) does anything which circumvents those measures knowing, or with reasonable grounds to know, that he is pursuing that objective. (2)This section does not apply where a person, for the purposes of research into cryptography, does anything which circumvents effective technological measures unless in so doing, or in issuing information derived from that research, he affects prejudicially the rights of the copyright owner.

From Section 296ZA of the Copyright, Designs and Patents Act 1988 (http://www.legislation.gov.uk/ukpga/1988/48/section/296ZA)

There will definitely be something like this forbidding circumvention of measures to the US as well.

There might be some EU legislation that has stuff about cryptography. That will probably be your last resort if you can't find much else.

If you're using this private key and redistributing it for criminal intent, well then. This might be another problem. You may be allowing others to intercept the data in what the key is used for. Regulation of Investigatory Powers Act 2000 might be relevant for you.

2

I know of no law that bans disclosure of private encryption keys.

This news article: Lawsuit Dropped Against DVD Copy-Protection Hack deals with acquittals both in Europa (Norway) and the USA in high profile cases where people were charged with distributing such keys.

(I most jurisdictions, using such keys to gain unlawful access to secret or copyrighted materials, is illegal - but that is something else.)

0

The Digital Millennium Copyright Act (“DMCA”), codified in part in 17 U.S.C. § 1201, makes it unlawful to circumvent technological measures used to prevent unauthorized access to copyrighted works, including copyrighted books, movies, video games, and computer software.

(Source)

The Defend Trade Secrets Act of 2016 provides for civil and criminal penalties at the federal level for obtaining trade secrets (which are intentionally protected secrets with business value) unlawfully. Every U.S. state has some kind of parallel state law protections for trade secrets.

Reverse engineering an encryption key is not inherently theft of a trade secret, nor is it inherently a means to gain access to copyrighted material, but there are often circumstances where it would be.

This kind of conduct would usually be prohibited by the Computer Fraud and Abuse Act (“CFAA”). 18 U.S.C. § 1030. Strictly speaking, this law is only triggered when the key is actually used without authorization, and not when it is disclosed, however.

There are also parallel state crimes such as Colorado Computer Crime Act. C.R.S. § 18-5.5-102. Mere disclosure of the encryption key, if the key isn't actually used, however, also isn't a crime under this statute.

Depending on the circumstances, other non-computer specific crimes might be implicated (e.g., extortion if someone threatened to disclose the key unless they received something of value or the victim refrained from doing something lawful, or theft, if this was used to take, for example, crypo-currency without permission of the owner).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .