A couple of weeks ago we looked at a change in the law that lets US car owners modify their on-board software. But what about drivers in Europe?
Global measures were introduced in 1996 to protect the works and rights of ‘digital authors’ such as computer programmers. The WIPO Copyright Treaty requires contracting parties – ie countries and organisations – to stop people bypassing technological measures such as encryption to tamper with copyrighted works in accordance with their legal system.
The WIPO measures were implemented in Europe via the EU InfoSoc Directive, which requires member states to provide ‘adequate legal protection against the circumvention of any effective technological measures’, if the person doing the circumventing does it ‘in the knowledge, or with reasonable grounds to know, that he or she is pursuing that objective’.
Circumvention rules in the UK
In the UK, circumvention of technical devices applied to computer programs is treated separately from circumvention of technological measures applied to other copyright works. With computer programs, the rules prohibit, for example, a commercial repair shop from using means to bypass protection or an individual from publishing an encryption key on the internet. The rules do not, however, stop someone circumventing technical devices so that they can modify their vehicle’s computer programs for personal use.
With other copyrighted works, the rules are broader and prohibit a person doing anything that knowingly circumvents technological measures (defined any technology, device or component that is designed to protect a copyrighted work other than a computer program). The law also prohibits people from selling devices and services designed to circumvent technological measures. There are ‘fair use’ exemptions which may, for example, permit research into a car’s security vulnerabilities. However, they would probably not extend to a keen mechanic modifying their own car to boost performance.
Furthermore, attempting to access vehicle computers could technically constitute a breach of the Computer Misuse Act. This makes it an offence for a person knowingly to cause a computer to perform a function with the intent of accessing programs or data without authorisation.
The German position
Although the German rules on circumvention and computer programs stem from the same European source, there are still local differences.
The German rules prohibit modification of a computer program. However, they may not prevent a vehicle owner from ‘hacking’ their own car for two reasons: the activity may not qualify as a ‘modification’, and an exemption may apply.
Unfortunately, there is no definitive interpretation of ‘modification’. Some argue that it requires an action affecting the substance of the program (eg changing the source code), while others think that intervening in program execution via external commands is sufficient. German courts have decided that the circumvention of hardware designed to prevent illegal copying is a ‘modification’. As such, some car ‘hacking’ actions may be interpreted as a modification while others, like simple changes to default program settings, may not. But none of this is certain.
The possible exemption is not that helpful either. It allows modifications ‘if they are necessary for the use of the computer program in accordance with its intended purpose’. However, not all modifications of vehicle software would be ‘necessary’ in this sense.
Furthermore, changes made according to a particular user’s wishes can be excluded by contract.
As with the UK law, German law also prohibits people from selling devices designed to circumvent technological measures which protect a computer program.
In relation to technological measures applied to copyrighted works other than computer programs, knowingly circumventing such measures without consent is generally unlawful. So if car manufacturers can successfully argue that vehicle systems include copyrighted works other than computer programs (for example, literary or artistic works), the copyright rules could prevent a vehicle owner from modifying their own car. In such cases, circumvention not committed for the personal private use only, eg by non-authorised repair shops, may even be criminal.
US clarity vs EU uncertainty
The US ruling provides some much needed clarity for the position of vehicle owners in the US – even if only for an initial three-year period.
But in Europe in general (and the UK and Germany in particular), the position is less clear.
Different rules apply to computer programs and other copyrighted works – with the possibility that vehicle systems could fall into both camps.
So until we get some more guidance from the courts, hacking cars – even for personal purposes – will remain a grey area.