HR 905 Introduced – Computer Code Copywrite Transfer

Earlier this month Rep. Farenthold (R,TX) introduced HR 905, the You Own Devices Act. This bill address some of the copywrite issues related to software used to operate equipment.

Software Copywrite Issues

The bill amends 17 USC 109, “Limitations on exclusive rights: Effect of transfer of particular copy or phonorecord”. It adds a new paragraph (f) to the section. That paragraph addresses the transfer of certain computer programs.

The first provision codifies the legal transfer of the software that “enables any part of a machine or other product to operate” {§109(f)(1)} when that machine or product is legally sold or otherwise transferred.

The second provision addresses software updates. It specifies that the right to receive any software changes related “in whole or in part to security or error correction” {§109(f)(2)} is transferred along with any transfer of the equipment that the software operates.

The third provisions prohibits the retention of a copy of the software when a party transfers the equipment and/or software to another party.

Moving Forward

Farenthold is a member of the House Judiciary Committee (the committee to which this bill was assigned for consideration) so there is a decent possibility that this bill could be considered in committee. There may be some opposition to the update provisions of this bill from some software vendors, so it is unclear at this point if there would be enough support in the House for the bill to allow it to be considered under suspension of the rules. It is unlikely that this bill would make it to the floor of the House under a rule.

If the bill were considered in the House, I suspect that it would pass.

Commentary

I think that this bill could end up being important for security researchers. The first provision allowing that legally buying software operated equipment automatically includes the legal transfer of the copy of the operation software precludes a vendor from threatening to prosecute researchers for illegally accessing the software.

The second provision means that when a researcher finds a vulnerability in a piece of control system software and the vendor issues an update or patch, the researcher is entitled to obtain a copy of that patch or update as long as he owns a piece of equipment that uses that software to operate. This would make it easier for the researcher to determine the efficacy of the fix.

One software related copywrite issue that is not addressed in this bill is the legal right to modify software used to operate a piece of equipment.

Bills Introduced – 02-07-17

With both the House and Senate in session there were 133 bills introduced yesterday. Of those six may be of specific interest to readers of this blog:

HR 905 To amend title 17, United States Code, to provide that the first sale doctrine applies to any computer program that enables a machine or other product to operate, and for other purposes. Rep. Farenthold, Blake [R-TX-27]

HR 923 To repeal the Cybersecurity Act of 2015. Rep. Amash, Justin [R-MI-3]

HR 935 To codify an office within the Department of Homeland Security with the mission of strengthening the capacity of the agency to attract and retain highly trained computer and information security professionals, and for other purposes. Rep. Jackson Lee, Sheila [D-TX-18]

HR 940 To secure communications of utilities from terrorist threats, and for other purposes. Rep. Jackson Lee, Sheila [D-TX-18]

HR 945 To codify the objective of Presidential Policy Directive 21 to improve critical infrastructure security and resilience, and for other purposes. Rep. Jackson Lee, Sheila [D-TX-18]

HR 955 To require the Director of National Intelligence to conduct a study on the feasibility of establishing a Cyber Defense National Guard. Rep. Jackson Lee, Sheila [D-TX-18]

It looks like HR 905 would allow the purchaser of ICS software or firmware to sell or transfer that software without permission of the vendor; see 17 USC 109. This may be an interesting bill.

HR 923 is likely a repeat of HR 4350 introduced in the 114^th Congress. The House leadership killed that bill by referring it to eight separate committees for consideration; no action was taken in any of the committees.

HR 935 looks to be a repeat of HR 53 introduced in the 114^th Congress; no action was taken on HR 53.

It looks like HR 940 is new legislation. If it contains specific mention of control system security, it will be covered in this blog.

I will be watching HR 945 for mention of cybersecurity, chemical facility security and/or chemical transportation security.

It looks like HR 955 will be a repeat of HR 60 in the 114^th Congress; no action was taken on that bill.