Is It Legal to Reverse Engineer Software? US and EU Rules

Often, yes. US courts have held that disassembling code to reach its functional elements can be fair use, and the DMCA has a narrow exemption for interoperability. EU law makes decompiling for interoperability a right that a contract cannot take away. For many US businesses the tighter limit is their own license agreement, which can forbid reverse engineering outright.

This is not legal advice; review your license agreement and MSA with counsel. We are engineers who do this work, not lawyers. The answer turns on your facts, your jurisdiction and the exact wording of your contracts.

Which laws decide whether reverse engineering is legal?

Five bodies of law apply, and the same activity can be lawful under one and a breach under another. Reverse engineering here means working out how software is built or how it talks to other systems, whether by observing its behavior, reading its data and traffic, or decompiling its code. A workable rule of thumb: it is usually lawful in the US unless your contract forbids it, you break a technical protection outside an exemption, you touch systems you are not entitled to access, or you ship the vendor's code.

Breach of contract is a civil matter, and copyright and DMCA disputes between businesses are usually civil suits. Criminal DMCA liability under 17 U.S.C. 1204 requires a willful violation "for purposes of commercial advantage or private financial gain." Patents sit outside this table: a clean, independently written implementation avoids copyright problems but can still infringe a patent on the method it implements.

What did Sega v. Accolade and Sony v. Connectix decide?

Both held that copying code during reverse engineering can be fair use when it is the only way to reach the program's functional elements and the finished product does not contain the original's protected code.

In Sega Enterprises v. Accolade, 977 F.2d 1510 (9th Cir. 1992), Accolade disassembled Sega Genesis games to learn the interface requirements for its own compatible cartridges. The court held that "where disassembly is the only way to gain access to the ideas and functional elements" of a program, and there is a legitimate reason for seeking that access, "disassembly is a fair use of the copyrighted work, as a matter of law."

In Sony Computer Entertainment v. Connectix, 203 F.3d 596 (9th Cir. 2000), the court held that copies of Sony's PlayStation BIOS made while building an emulator "were protected fair use," noting that the emulator "does not contain any of Sony's copyrighted material."

Fair use is decided case by case, these decisions bind only the Ninth Circuit, and both protect the study phase rather than a product that ships vendor code. In Google v. Oracle (2021), the Supreme Court held that Google's copying of roughly 11,500 lines of Java SE declaring code was fair use, while assuming without deciding that the code was copyrightable.

What does the DMCA interoperability exemption allow?

Section 1201(f) lets someone with a lawful right to use a program get around a technical protection measure, but only to identify what an independently created program needs in order to interoperate, and only for information not already readily available. Courts read it strictly, and it does not override a contract.

The DMCA prohibits circumventing "a technological measure that effectively controls access" to a copyrighted work, and separately prohibits trafficking in tools that do so. Encryption on a configuration file, a license-key check or an obfuscated handshake can count as an access control, depending on what it actually protects. 17 U.S.C. 1201(f) carves out reverse engineering on these conditions:

• You must have "lawfully obtained the right to use a copy" of the program.
• The circumvention must be "for the sole purpose of identifying and analyzing those elements of the program that are necessary to achieve interoperability of an independently created computer program with other programs."
• Those elements must not have been "previously ... readily available" to you. A published API spec makes this harder to meet.
• The acts must not themselves "constitute infringement."
• You may share the information or tools only "solely for the purpose of enabling interoperability," and only where that does not infringe or "violate applicable law other than this section."

The statute defines interoperability as "the ability of computer programs to exchange information, and of such programs mutually to use the information which has been exchanged." Getting records out of a vendor system so your own program can use them can fit that definition, though we have not found a court that has squarely said so. Removing a seat-count limit is much harder to describe that way.

The same section has two other permanent exemptions: 1201(g) for encryption research and 1201(j) for security testing, which requires "the authorization of the owner or operator" of the system tested.

In Davidson & Associates v. Jung, 422 F.3d 630 (8th Cir. 2005), affirming the 2004 district court decision often cited as Davidson v. Internet Gateway, the developers of bnetd, an emulator of Blizzard's Battle.net servers, lost their 1201(f) defense. The court held that their "circumvention in this case constitutes infringement," noting that the emulator never checked whether a game's CD key was valid or already in use.

The circuits also disagree on whether a 1201 claim must connect to infringement. The Federal Circuit in Chamberlain v. Skylink (2004) required a "reasonable relationship" between the circumvention and a right the Copyright Act protects. The Ninth Circuit declined to adopt that requirement for 1201(a) claims in MDY Industries v. Blizzard (9th Cir. 2010, amended 2011).

Do the triennial DMCA exemptions cover business software?

Mostly not. The temporary exemptions the Librarian of Congress grants every three years cover specific device classes and good-faith security research, not interoperability with business software in general. A broad industrial equipment repair exemption was turned down in 2024.

The ninth rulemaking ended with a final rule effective October 28, 2024 (89 Fed. Reg. 85437). Its software classes in 37 C.F.R. 201.40(b) cover app interoperability on smartphones, smart TVs, voice assistants and routers; repair of consumer devices, medical devices, vehicles and retail-level commercial food preparation equipment; vehicle operational data; and good-faith security research, which the rule says is not a safe harbor from the CFAA. The exemptions lift only the ban on circumvention itself, not the ban on trafficking in tools.

For manufacturers, the important denial was Proposed Class 5, a Public Knowledge and iFixit petition to allow repair of commercial and industrial equipment that the Justice Department's Antitrust Division and the FTC supported. The Register recommended only the food-preparation class and declined "a broader class of software-enabled commercial and industrial devices" for lack of a sufficient record. The tenth rulemaking is under way: petitions were due August 24, 2026, and renewed exemptions will run from October 2027 to October 2030.

Can a license agreement ban reverse engineering?

In the US, generally yes. Federal appeals courts have enforced no-reverse-engineering clauses as ordinary contract terms, even where the same work would have been fair use. Most commercial licenses we review contain some version of this clause, so it is often the constraint that decides what a project can do.

In Bowers v. Baystate Technologies, 320 F.3d 1317 (Fed. Cir. 2003), the court applied First Circuit law and held that "the Copyright Act does not preempt or narrow the scope of" a contract claim based on a shrink-wrap license that prohibited reverse engineering. Judge Dyk dissented, arguing that state law enforcing such clauses is preempted. The Eighth Circuit reached the majority's result in Davidson: "By signing the TOUs and EULAs, Appellants expressly relinquished their rights to reverse engineer."

Versata v. Ford is a recent example. Ford's 2004 agreement said "in no event shall Ford disassemble, decompile or reverse engineer the Software," according to a Law360 article by Crowell & Moring attorneys, and defined reverse engineering to include studying the software's behavior in response to inputs. After Ford replaced Versata's configuration software with its own, a 2022 jury found Ford breached the agreement, including by reverse engineering the software for its own commercial use and by disclosing confidential information, and awarded $82,260,000 on the contract claim. The trial judge cut that award to $3. The Federal Circuit's 2026 opinion reinstated the $82,260,000 award and ordered a new trial on trade secret damages.

Read your clause closely. Some ban only decompiling; others, like Ford's, reach black-box observation. A carve-out for what applicable law permits matters far more in the EU than in the US.

Is reverse engineering a trade secret violation?

Not by itself. The Defend Trade Secrets Act says "improper means" "does not include reverse engineering, independent derivation, or any other lawful means of acquisition." Reverse engineering done in breach of a contract that prohibited it is less settled.

18 U.S.C. 1839(6) lists theft, bribery, misrepresentation, breach of a duty to maintain secrecy and espionage as improper means. A 2020 Fish & Richardson summary describes two federal courts applying their own states' trade secret statutes and reaching opposite results. A Texas court let a misappropriation claim proceed on the theory that reverse engineering is proper only when nothing, including a contract, prohibits it. A California court held that a EULA cannot expand the statutory meaning of improper means, leaving the licensee facing only a contract claim.

Where does the CFAA fit after Van Buren?

The CFAA matters when reverse engineering reaches a computer you may not be authorized to use, such as a vendor's cloud API. Van Buren v. United States (2021) limited "exceeds authorized access" to entering parts of a system that are off limits to you, not misusing access you already have.

In Van Buren, decided 6 to 3, the Court called this "a gates-up-or-down inquiry": a person either can or cannot access a system, or certain areas within it. A footnote left open whether the gates must be technical or can also be set by "limits contained in contracts or policies."

Analyzing software on your own servers, or traffic between your own systems, rarely raises CFAA questions. Against a vendor's hosted service, the question becomes whether you were entitled to reach that part of the system at all. Getting around authentication, IP blocks or other technical barriers on someone else's server is the clearest case to take to counsel first.

Is it legal to reverse engineer software in the EU?

Yes, within limits that a contract cannot narrow. The EU Software Directive (2009/24/EC) lets a lawful user observe and test a program and, under strict conditions, decompile it for interoperability. Article 8 voids contract terms to the contrary.

Article 5(3) lets a person entitled to use a program "observe, study or test the functioning of the program in order to determine the ideas and principles which underlie any element of the program" while loading, displaying, running, transmitting or storing it. That covers most black-box analysis.

Article 6 allows decompilation when it is "indispensable to obtain the information necessary to achieve the interoperability of an independently created computer program with other programs." The person must be a licensee or someone authorized to act for one, the information must not already be readily available, and the work must be confined to the parts needed for interoperability. Article 6(2) bars using the information for other purposes, passing it on unless needed for interoperability, or using it to build a program "substantially similar in its expression."

Article 8 provides that "any contractual provisions contrary to Article 6 or to the exceptions provided for in Article 5(2) and (3) shall be null and void." That is the main difference from US law: an EU licensee keeps the right to decompile for interoperability even if the license says otherwise. These rights are written for a person entitled to use a copy of the program, so a SaaS customer who never receives one may have a weaker claim to them.

Top System v. Belgian State (C-13/20, 6 October 2021), which interpreted the 1991 directive that 2009/24 codified, involved a Belgian public agency that decompiled part of a licensed application to fix a malfunction. The Court of Justice held that under Article 5(1) a lawful acquirer may decompile all or part of a program to correct errors affecting its operation, without meeting the Article 6 conditions, but only as far as necessary and in compliance, where appropriate, with the conditions in the license (Stibbe summary). Article 5(1) is not on Article 8's list, so a license can regulate error correction more than interoperability work. Cuatrecasas reads the judgment as letting a license set how errors are corrected without excluding every possibility of correcting them.

Which reverse engineering techniques carry the most legal risk?

Reading your own database or parsing your own exports carries the least risk and mostly raises contract questions. We use this ranking to decide what goes to counsel; it is not a legal conclusion.

Using an AI model for the decompiling or protocol analysis does not change which laws apply, but pasting decompiled vendor code or confidential documentation into a hosted AI service may count as disclosure under a confidentiality clause, one of the breaches found against Ford.

Most of our legacy system modernization work sits in the first four rows. For an ISP's undocumented SOAP/WSDL CRM API that two earlier teams had given up on, the method in our legacy API reverse engineering case study was to enumerate the services, probe them, validate responses against schemas and wrap the result in an abstraction layer, all of it interface observation. Our guide to legacy system integration and reverse engineering covers the engineering side; related articles cover getting EHR data out under the information blocking rules, the limits of the JobBOSS² API, and reading SEG-Y files, whose format is a published standard.

What to check before a reverse engineering project starts

Collect the contracts, find the clauses on reverse engineering, data and access, and have counsel approve the plan. This is the order we follow with clients:

1. Gather the contract stack: EULA, MSA, order forms, statements of work, support terms and hosted service terms. Later documents often override earlier ones.
2. Search them for "reverse engineer," "decompile," "derivative," "direct database access," "confidential" and "contractor," and note any carve-out for what applicable law permits.
3. Find the data ownership clause and any exit or transition assistance clause. A clause that says you own your data and the vendor must export it is often the strongest footing for the work.
4. Confirm that contractors acting for you count as permitted users if an outside firm will do the work. EU Article 6 explicitly covers someone authorized to act for a licensee.
5. Ask the vendor in writing for documentation or an API, and write down the interoperability purpose. A refusal supports the "not readily available" conditions in 1201(f) and Article 6, and sometimes the vendor says yes.
6. Note whether the system is installed on your hardware or hosted by the vendor. Hosted systems bring in the CFAA and may weaken the EU rights that attach to a copy.
7. Rank the planned techniques against the risk table, and flag any step that breaks encryption, defeats a license check or sends vendor material to an outside AI service.
8. Keep vendor code out of your product. Record findings as interface specifications, and where the risk justifies it, keep people who studied decompiled code apart from those writing the new implementation. Crowell's Ford article recommends a similar wall when a license ends.
9. Check the governing law clause, and have counsel review the plan before any decompiling or circumvention begins.

For a first step, pull the license, the MSA and the latest order form for the system you most want to integrate with, and read the reverse engineering clause next to the data ownership clause. If they leave room and you want a second opinion on the technical plan, talk to us.