How do the anti-circumvention provisions affect security testing?
The DMCA permits circumvention that is conducted in the course of testing security systems if it is otherwise legal under the law. [1201(j)] Security testing is defined in the DMCA as “obtaining access, with proper authorization, to a computer, computer system, or computer network for the sole purpose of testing, investigating or correcting a potential or actual security flaw, or vulnerability or processing problem.” [1201(j)(1)] In determining whether this exception is applicable, the DMCA requires the court to consider whether the information derived from the security testing was used solely to improve the security measures or whether it was used to facilitate infringement. The DMCA also permits the development, production or distribution of technological means for the sole purpose of circumvention devices for the sole purpose of performing permitted acts of security testing.
