Ethics and Reverse Engineering

Introduction

While working at a large information technology company over the past two summers, I have been involved with the hard disk drive group of the semiconductor division. One of the products that this group designs is the read channel chip. This chip communicates between the computer and the disk. This is a very competitive area in the semiconductor business, because the demand for computer performance has increased (and continues to increase) exponentially over the past decade. One common practice that I have heard discussed more than once is to use reverse engineering to see what the competitors are doing. This involves taking a microscopic picture of the chip as it is laid out in silicon, and try to work backwards to the transistor and system levels. The accuracy and amount of information that can be deduced varies, but it is certainly possible to obtain system level designs. In my four years at MIT, I have never been involved in any classroom discussion regarding reverse engineering, except for Real World Ethics. I find it peculiar that such a common practice in the engineering world does not even merit a discussion in academic realm, except specifically in ethics classes.

Scenario 

SCSI, an industry standard system for connecting devices (like disks) to computers, provides a vendor ID protocol by which the computer can identify the supplier (and model) of every attached disk. Company C makes file servers consisting of a processor and disks. Disks sold by C identify C in their vendor ID. Disks from other manufacturers can be connected to C's file servers; however, the file server software performs certain maintenance functions, notably prefailure warnings based on performance monitoring, only on C-supplied disks. Company P decides to compete with C by supplying cheaper disks for C's file server. They quickly discover that while their disks work on C's file servers, their disks lack a pre-failure warning feature that C's disks have. Therefore, the CEO of P directs the engineer in charge of the disk product to “find a solution to this problem.” Using reverse engineering, the engineer discovers that by changing the vendor ID of the P disks, the C file servers will treat P disks as C disks. P incorporating this change into its product and advertises the disks as “100% C-compatible.”

Representatives of C charge P with forgery; they are convinced that, whether or not P's practice is illegal, it clearly violates industry-wide ethics. P justifies its action on the grounds that the favored treatment of C's disks by C's servers is unfair and monopolistic. Moreover, they argue that using C's vendor ID isn't forgery, since it doesn't mislead people: P's disks are clearly labeled as coming from P. Their action only misleads C's software.

Scenario-Based Interview Questions

• Is anything illegal or unethical happening in this scenario?
• If you found yourself in a similar situation, where would you go for advice?
• Would you feel comfortable with that course of action?
• What is your company's policy on reverse engineering?
• How realistic is this scenario? Have you encountered similar situations in which you were unsure of what was “the right thing to do?”

Interview 1, the Supervisor

1. Is anything illegal or unethical happening in this scenario?

This is unethical. Company P is representing itself as Company C to the computer system performing maintenance. If problems were to develop with the Company P drive, it would be probable that the Computer System Support at the Customer Company would telephone the Company C for help or make a complaint. In many cases the drives are not visible to the user, so if the computer tells the user the drive is from Company C then the user will believe it. In my opinion, Company P is representing itself as Company C -- that is clearly unethical.

2. If you found yourself in a similar situation, what would you do?

This company has an ethics office and a legal department. In addition to consulting them, I would also talk to my manager and colleagues. All managers at all levels are subject to the strict ethics policy. CEO or no CEO, unethical behavior is not tolerated.

3. Do you feel comfortable with that course of action?

The company ethics policy has proven extremely useful here. When I consider some problems at other companies (e.g., bribery, racism, dishonest billing practices and poor customer service.), I know that here these problems are explicitly defined as unacceptable and to my knowledge have not happened here without severe consequences. Thus I would follow the ethical policy since in the long term it serves the both company's and the customers' best interest.

4. What is your company's policy on reverse engineering?

Reverse engineering is used to investigate a competitor's product and learn about it so that we can design and market a superior product. Care is taken not to copy the circuits or knowingly infringe competitors patents.

5. How realistic is this scenario? Have you encountered something similar where you were unsure of what was the 'right thing to do?

This is realistic. I have only experienced the reverse engineering part of this scenario.

Interview 2, the New Employee

1. Is anything illegal or unethical happening in this scenario?

I really am not sure. I don't know a lot about the legality. I assume there are strict rules about this type of business. P justifying its actions based upon anti-trust does not hold water because if they felt that way they should have taken it up with the justice department first. I think the crux of the legal issue is whether a “vendor” is proprietary. This I don't know.

2. If you found yourself in a similar situation, what would you do?

I would first check with my management ladder, for I am but a lonely man on the bottom! I know that my company has extensive legal support to answer these types of questions and I would not hesitate to get expert advice if I was at all unsure. Under no scenario would it be worth, for the company, taking the risk of acting illegally or unethically.

3. Would you feel comfortable with this course of action following that methodology?

I have never had any formal education on engineering ethics. It is what I would feel comfortable with.

4. What is your company's policy on reverse engineering?

I believe it is acceptable to use reverse engineering. But using what we have found is illegal.

5. How realistic is this scenario? Have you encountered something similar where you were unsure of what was the 'right thing to do?' I have encountered a similar situation and relied upon my manager's knowledge of the situation to decide if it was legal and ethical. Ultimately, I did not use any of the information I found to so I don't think I have been anywhere near the gray area.

Interview 3, the Undergraduate

1. Is anything illegal or unethical happening in this scenario?

While I am not sure about the exact legality of this situation, there is definitely an ethical conflict. P's argument is completely bogus. They are whining that C's practice of developing a drive is partial to their own disks. They claim that it is monopolistic. That would imply that C already "owns" the market, and that the only way for P to get into the game is to make media. There is nothing stopping P from making their own drives, which would be partial to their own disks, thus providing them with the same benefits. They could then compete by making their drives cheaper to use by selling cheaper disks. If this is not an option for them, they should license the ID number to some other arrangement so to be completely C-endorsed.

2. If you found yourself in a similar situation, what would you do?

I guess I would turn to my lawyer, if the situation was in one of commerce like this. If it turns out to be a judgment call (rather than a legal issue), I guess I would look at the situation a lot more closely. First, I would see if there is a way to work around this with the other company. Could I afford to go to battle with the other company in the marketplace? Is this something worth that kind of all-out commitment? Are there alliances I can make elsewhere to squash the competition? Should I sell something else instead?

3. Would you feel comfortable with that course of action?

I guess it is a textbook answer, but it is probably the only path to take.

4. What is your company's policy on reverse engineering?

This question was not applicable, as the undergraduate was not employed in a software or hardware development position.

5. How realistic is this scenario? Have you encountered something similar where you were unsure of what was the 'right thing to do?'

This scenario is completely realistic. As computers become more prevalent, the distinction between what is own able is going to get more and more difficult. Is an interface, or a look, property, thus subject to copyrights, etc.? If something is invented that becomes an industry standard (CD-ROMs), can the media still remain under laws that make it monopolistic? One solution to this same type of problem was developed by the pharmaceutical industry. After 7 years of an exclusive patent for a drug, it becomes open to anybody else who wants to make it. Something similar may happen in the computer industry.

Methods

In reflecting on who to interview, I decided to concentrate mainly on company employees at this firm, as there is an established policy which was covered in our readings. I interviewed three people: my immediate supervisor; a new employee; and an undergraduate who works in a computer consulting job on campus. I was unable to interview one of my professors due to a mix up in scheduling.

Discussion

The scenario discussed seemed to be very relevant according to all of the interviewees. It brought up some interesting points about what is actually property and what can be owned. The last interviewee brought up some interesting points comparing the scenario with similar problems in the pharmaceutical industry. The motivation for this project is to explore the issues surrounding reverse engineering. If you discover something which an opponent has done and been successful with, how much freedom do you have to use this knowledge and does it matter how much or how detailed the knowledge is? Is there a clearly defined demarcation of what is permissible and what is not? In the course readings, I discovered an interesting strategy for dealing with ethical gray areas. This strategy, which is called the “newspaper test,” is used at Texas Instruments. This strategy simply asks the employee to consider the question, “How would this look in the newspaper?” As TI is very much a large part of Texan industry, bad publicity could damage the company reputation severely. This simple test encourages engineers to consider how the average person would perceive his or her actions. Would it cause a loss of respect for the company?

Conclusions

Both company employees agreed that reverse engineering was a valid practice; however, they agreed it must be done in with care. Learning from what others have done is a valid method, but copying what they have done is dishonest. This issue arises mostly on the system level, where understanding of what competitors have done actually means something. Engineers do not photograph and the enlarge pictures of silicon chips to copy every exact detail. In the long run this practice would be silly; by the time you've figured out what the competitor has done, his next generation of chips will be out, and you'll be left behind. However, if there is an architectural question, such as whether to use one function twice, or have to different functions used once, understanding what your opponents have been able to make work becomes vital information.