I'd like to possibly to my bachelor thesis in Computer Science by reverse engineering some IoT devices such as security cameras & smart locks.

The items will be purchased by myself (probably sponsored by the university) without any direct tie with the manufacturer & distributor of the product. They may be bought from third-party distributors (small shops) and we won't be signing any contract or agreement with any company.

The research will be done by myself and my peers. We'll follow responsible disclosure and report our findings to the companies making the products. After some time, the thesis should be published and made publicly available, assuming the vendor has delivered patches (though most people likely won't patch their stuff).

Could I be held to any terms of use or EULA for the product, even if I never agree to one (for instance, I will not click "Agree" in their mobile app)?

Unlike 21732, we won't be signing a EULA or any kind of agreement with the products' vendors.

Unlike 6852, we'll only publish security vulnerabilities found. We won't publish a derivative work.

  • I replaced the broad request for legal advice with a paraphrasing of your specific question in the title. Feel free to revise further if you like.
    – Ryan M
    Oct 2, 2020 at 8:03
  • If you happen to be in the EU, check the directive 2016/943 (protection of undisclosed know-how and business information (trade secrets) against their unlawful acquisition, use and disclosure) eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016L0943 and your national implementation of this directive. Oct 2, 2020 at 15:17


You must log in to answer this question.

Browse other questions tagged .