To: E_K_S who wrote (192608 ) 9/18/2015 9:30:54 PM From: Elroy Jetson Read Replies (2) | Respond to of 206086 Two months ago, the EPA opposed a measure that would help expose subversive code like the so-called “defeat device” software VW allegedly used by allowing researchers to legally reverse-engineer the code used in vehicles. - wired.com EPA opposed this, ironically, because the agency felt that allowing people to examine the software code in vehicles would potentially allow car owners to alter the software in ways that would produce more emissions in violation of the Clean Air Act. The issue involves the 1998 Digital Millennium Copyright Act (DCMA), which prohibits anyone from working around “technological protection measures” that limit access to copyrighted works. The Library of Congress, which oversees copyrights, can issue exemptions to those prohibitions that would make it legal, for example, for researchers to examine the code to uncover security vulnerabilities. In December of 2014, a group of security researchers proposed to do exactly this by seeking to add computer programs used in cars, trucks, and agricultural machinery to the list of DMCA exemptions. Having access to car controls would allow for “good-faith testing, identifying, disclosing, and fixing of malfunctions, security flaws, or vulnerabilities,” they argued, according to comments they submitted to the Federal Register . But examining software for security vulnerabilities can also potentially uncover other things a car maker wouldn’t want anyone to see, such as code designed to circumvent emissions testing. The Alliance of Automobile Manufacturers, an advocacy group that represents most of the world’s major automakers, including Volkswagen, opposed the DMCA exemption (.pdf), arguing it would create or exacerbate “serious threats to safety and security.” The EPA, surprisingly, also argued against the research exemptions, saying it was concerned drivers might hack their own cars to improve performance in ways that would violate federal controls. The irony is that VW was allegedly using its surreptitious algorithm to favor performance over fuel economy in a way that violated the Clean Air Act. And legalizing public access to the software used in the 482,000 VW cars now being recalled could possibly have revealed the alleged “defeat device” code earlier. As noted on Twitter by Thomas Dullien, a prominent security researcher and reverse engineer who goes by the handle Halvar Flake: “The VW case is an example why we need more liberal reverse engineering regulation. In a world controlled by code, RE creates transparency.”