§ 433 — Exception — testing of security flaws, etc., of computer

433.—(1) A person may circumvent an access control measure by doing an act in relation to a protected copy if —(a)

the act is done for the sole purpose of testing, investigating or correcting a security flaw or vulnerability of a computer;

(b)

the act is done in good faith;

(c)

the act is done by or with the authority of the owner of the computer;

(d)

the act is not a rights infringement in relation to the protected copy; and

(e)

the act does not violate any written law other than this Act.

(2) A person may deal in a circumventing device if —(a)

the device is used only in circumstances to which subsection (1) applies; or

(b)

at the time of dealing, the person does not know and could not reasonably have known that the device will be used in any other circumstances.

(3) A person may deal in a circumventing service if —(a)

the service is performed only in circumstances to which subsection (1) applies; or

(b)

at the time of dealing, the person does not know and could not reasonably have known that the service will be performed in any other circumstances.

(4) In this section, “computer” includes a computer system and a computer network.

—(1) A person may circumvent an access control measure by doing an act in relation to a protected copy if —(a)

the act is done for the sole purpose of testing, investigating or correcting a security flaw or vulnerability of a computer;

(b)

the act is done in good faith;

(c)

the act is done by or with the authority of the owner of the computer;

(d)

the act is not a rights infringement in relation to the protected copy; and

(e)

the act does not violate any written law other than this Act.

(2) A person may deal in a circumventing device if —(a)

the device is used only in circumstances to which subsection (1) applies; or

(b)

at the time of dealing, the person does not know and could not reasonably have known that the device will be used in any other circumstances.

(3) A person may deal in a circumventing service if —(a)

the service is performed only in circumstances to which subsection (1) applies; or

(b)

at the time of dealing, the person does not know and could not reasonably have known that the service will be performed in any other circumstances.

(4) In this section, “computer” includes a computer system and a computer network.