Disclaimer: IANAL, the following is just my research up to now.
I understand that in many jurisdictions, reverse engineering - and especially decompilation of software without explicit permission from the vendor are a gray zone or outright forbidden. The usual understanding seems to be that reverse engineering or decompilation constitutes creating a copy of the software, and therefore infringes on copyright.
However, there are usually some exceptions, for example:
- In EU law, the exception is usually to ascertain interoperability of the software (with some caveats) (see Directive 2009/24/EC — the legal protection of computer programs)
- Under US law, there is the fair use doctrine (cf. Sega vs. Accolade (977 F.2d 1510))
On the other hand, the Australian Copyright Amendment (Computer Programs) Bill 1999 specifically mentions "security testing and correcting a security flaw" as an exception where copyright is not infringed.
Under which (other) jurisdictions is reverse engineering and decompilation for security purposes explicitly legal?
