Why the DMCA’s security research exemption just got broader

Auditing the third-party code that ships inside your software has become a core part of maintaining a secure supply chain. But for researchers working in the US, the DMCA’s anti-circumvention rules have long created a source of legal uncertainty. The act’s prohibition on bypassing technological protection measures (TPMs) includes an exemption for “good faith” security research, yet what qualified under that label was never precise enough to prevent nagging questions about liability—what some in the industry have called fear, uncertainty, and doubt (FUD).

The US Copyright Office has now responded. In its latest triennial rulemaking, it not only clarified the boundaries of the security research exemption but also dropped a condition that previously tied DMCA immunity to compliance with unrelated laws. For developers who probe dependencies or deobfuscate third-party code, the new guidance provides a clearer legal footing.

How the exemption evolved

The Copyright Office runs a public process every three years to consider new or revised exemptions to Section 1201 of the DMCA. This cycle, two proposals sought to expand the scope of security research. One, submitted by J. Alex Halderman and colleagues, argued for brighter lines around the existing exemption—specifically, that it should not be contingent on researchers having complied with other laws. The other, from the Software Freedom Conservancy, pressed for privacy investigation to be explicitly recognized as “good faith” security research.

Supporting comments, including from GitHub, emphasized the role such research plays in modern software quality and the threat of supply chain attacks. The final rule reflects those arguments.

Key changes in the final rule

Security research is read broadly

The Office’s interpretation of the exemption is now explicitly expansive. In its recommendations, it states that the exemption is “not limited to specific subjects or issues within security flaws or vulnerabilities,” and concludes that privacy-focused investigation was already covered—even without an explicit mention of privacy research. That wider reading should give developers more confidence when testing, deobfuscating, or reverse engineering third-party components to uncover and fix a broad range of issues.

Compliance with other laws no longer a precondition

The more consequential shift concerns how the exemption interacts with the rest of the US legal code. Previously, if research otherwise qualified as good faith security research but ran afoul of a separate statute—the Computer Fraud and Abuse Act (CFAA) has been invoked in such disputes—the DMCA exemption could be lost. The Office has removed that requirement. Researchers are now exempt from DMCA anti-circumvention liability even if their activity technically violates another law. As with any legal gray area, researchers should still assess whether their work is permissible under other statutes, but Section 1201 can no longer be leveraged as a backdoor to punish them for it.

The final rule also extends circumvention rights in a few adjacent areas. Jailbreaking routers and TV streaming devices is now permitted, TPM circumvention is allowed for diagnosis, maintenance, or repair of many consumer devices, and researchers may circumvent protections to investigate potential open source license violations. The full list appears in the published final rule.

Unresolved gaps

The updates are not a total fix. The exemptions still do not cover distributing tools that enable circumvention, even when the underlying research activity itself is lawful. And under the triennial process, exemptions expire unless renewed; the next rulemaking cycle is expected within three years. The Copyright Office has made renewal easier administratively, but the temporary nature of these protections remains a structural limitation.

What it means for your security work

The revised rule acknowledges how central vulnerability research is to modern software engineering. With a broadened exemption that no longer hinges on unrelated legal compliance, developers have more room to inspect third-party code, probe for flaws, and follow up on findings—without the question of DMCA liability hanging over the work. The remaining gaps around tool distribution and the temporary nature of exemptions still warrant attention, but for day-to-day security research, the Copyright Office has eliminated much of the previous ambiguity.