Federal Appeals Court Gets It: Fair Use Protects Security Research Tools

In a refreshingly direct opinion, the Eleventh Circuit Court of Appeals has ruled that creating and selling virtualization software for security research is a fair use. Along the way, it provides a kind of master class in applying copyright’s fair use doctrine to functional works like computer programs.

Here’s how the case came about: Corellium, the defendant, created a software platform that simulates an iPhone, allowing developers and researchers to test Apple’s iOS operating system for vulnerabilities without having to get permission from Apple or pay for the privilege of finding flaws in the system. Corellium’s platform lets researchers peer closely into the workings of iOS in ways that can’t be done on an actual iPhone. Apple sued for copyright infringement, and lost in district court on fair use grounds. Apple appealed. EFF, along with Public Knowledge and a number of security experts, filed an amicus brief supporting Corellium.  We explained that the public can’t protect itself from security flaws if independent testers aren’t allowed to find them—or if Apple gets to control who can do research.

The court begins by calling out the purpose of copyright: the “utilitarian goal” of stimulating the production of new works. This is a necessary rebuke to ongoing efforts to frame copyright’s limited but lengthy monopoly as a kind of natural right or reward. After all, the Constitution defines copyright’s purpose as promoting progress. Fair use serves this purpose by giving follow-on creators the ability to build on what has come before.

Turning to the merits, the court concludes that while Corellium’s use is clearly commercial, it is also (moderately) transformative because it adds features that are designed to serve the needs of researchers, rather than consumers. Apple had argued that Corellium might integrate consumer-oriented features down the line; the court rightly declined to speculate about these hypothetical

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.