Interoperability and Reverse Engineering Checklist: Clean Room, Documentation, Terms, and Circumvention

By Casey Scott McKay · 2024-05-16

A reverse engineering project is defensible or indefensible on decisions made in its first week, and none of them is doctrinal. This checklist runs the work in fifteen phases: scope the requirement, choose the acquisition path, analyze access controls, adopt the clean room protocol, run the specification team, run the gatekeeper review, isolate implementation, handle and destroy intermediate copies, run the parallel patent analysis, compare before release, assemble the release file, respond to a claim, run security research and repair variants, advise the incumbent, and make the program repeatable. Each box gives the reason, the authority, and the trap. Boxes marked as gates should clear before anyone touches the target. A worked program runs throughout.

IP and Technology > Information Technology | Checklist | Published 16 May 2024 - Updated 21 July 2025 | Casey Scott McKay - marksy.us

Summary. A reverse engineering project is defensible or indefensible on decisions made in its first week, and none of them is doctrinal. This checklist runs the work in fifteen phases: scope the requirement, choose the acquisition path, analyze access controls, adopt the clean room protocol, run the specification team, run the gatekeeper review, isolate implementation, handle and destroy intermediate copies, run the parallel patent analysis, compare before release, assemble the release file, respond to a claim, run security research and repair variants, advise the incumbent, and make the program repeatable. Each box gives the reason, the authority, and the trap. Boxes marked as gates should clear before anyone touches the target. A worked program runs throughout.

Keywords: scoping memorandum, acquisition path, license prohibition, preemption, access control analysis, circumvention exception, clean room protocol, specification team, implementation team, gatekeeper review, personnel attestation, transfer log, intermediate copies, destruction certificate, independent comparison, registration, freedom to operate, release file, security research, repair exemptions

How to use this checklist

| Phase | What it covers | |---|---| | 1 | Scope the requirement | | 2 | The acquisition path | | 3 | Access controls | | 4 | The clean room protocol | | 5 | The specification team | | 6 | The gatekeeper review | | 7 | Implementation | | 8 | Intermediate copies | | 9 | The parallel patent analysis | | 10 | Comparison and release | | 11 | The release file | | 12 | If a claim arrives | | 13 | Research and repair variants | | 14 | Advising the incumbent | | 15 | Making it repeatable |

Boxes marked [Gate] should clear before anyone touches the target.

The matter. A file converter for a competitor's proprietary format. Twenty-six weeks, sued two years later, resolved on summary judgment because the release file answered the access element.

Phase 1. Scope the requirement

[ ] [Gate] Name exactly what is needed.
- Why. A protocol, a file format, an interface specification, or an understanding of an algorithm. The narrower the answer, the smaller every subsequent exposure.
[ ] Ask whether it can be obtained without examining the target.
- Why. Published specifications, standards documents, vendor documentation, customer-held files, and observable network traffic. The cheapest reverse engineering is the kind that turns out not to be required.
[ ] Distinguish the format from the program.
- Why. Examining files a customer lawfully holds is not examining code, and it keeps most of the work outside the copying analysis.
[ ] Document the purpose.
- Why. Compatibility, migration, security research, repair, competitive analysis, or litigation support. Purpose bears on fair use and on whether the interoperability exception is available at all.
[ ] Write a one-page scoping memorandum, dated before any examination.
- Trap. A purpose articulated after the analysis, which reads as reconstruction.

Phase 2. The acquisition path

[ ] [Gate] Prefer the path without a prohibition.
- Why. Buying a product on the open market rather than downloading it under a license can remove the contract question entirely, and it is worth real cost and delay.
[ ] Where a licensed acquisition is unavoidable, analyze the prohibition.
- Authority. 17 U.S.C. § 301.
- Why. Enforceability varies by jurisdiction and by formation, and preemption is contested because a contract creates rights against a counterparty rather than against the world.
[ ] Note who accepted the terms.
- Why. A prohibition binds the party that agreed. A copy obtained without terms changes the analysis.
[ ] Confirm lawful acquisition.
- Authority. 17 U.S.C. § 109.
[ ] Preserve the acquisition record. Receipt, packaging, version, and terms if any.
[ ] For hosted targets, read the terms of service and assess the access statute.
- Authority. 18 U.S.C. § 1030.

Phase 3. Access controls

[ ] [Gate] Determine whether a technological measure controls access.
- Authority. 17 U.S.C. § 1201.
- Why. If none, the analysis is simpler. If one exists, everything changes.
[ ] If present, work the interoperability exception specifically.
- Why. It permits a person who lawfully obtained the right to use a program to circumvent solely to identify and analyze elements necessary for interoperability with an independently created program, to the extent otherwise permitted under copyright law.
[ ] Note its limits.
- Trap. Lawful acquisition required; limited to an independently created program rather than a substitute; only what is necessary; and information shareable only for interoperability.
[ ] Check the other exceptions.
- Why. Encryption research, security testing, and the temporary triennial exemptions covering diagnosis, maintenance, and repair.
[ ] Calendar exemption expiry where reliance is planned.
[ ] Note the trafficking prohibition separately.
- Why. Broader than the conduct prohibition, and it reaches tools even where the underlying circumvention would be permitted.
[ ] Document the conclusion with its technical basis rather than assuming it.

Phase 4. The clean room protocol

[ ] [Gate] Adopt it in writing before anyone touches the target.
- Trap. A protocol adopted afterward reads as remediation, and the whole value of the structure is the documented absence of access.
[ ] Define two teams, a specification team and an implementation team.
[ ] Separate them physically or logically, with distinct systems, repositories, and access controls.
[ ] [Gate] Appoint counsel as gatekeeper.
- Trap. An engineer in the role, optimizing for a clearer specification, which is exactly the pressure that pushes expression across the boundary.
[ ] Prohibit communication outside the protocol, expressly, including verbal.
[ ] Take personnel attestations.
- Why. Each implementation team member attests to no prior exposure; each specification team member acknowledges the constraints.
[ ] Establish the transfer log format with date, document, and reviewer.
[ ] Establish the question channel.
- Why. Implementation questions routed through the gatekeeper, answered in writing, and logged.

Phase 5. The specification team

[ ] Document function, not expression.
- Why. What the target does, under what conditions, with what inputs and outputs. Not how its code is organized.
[ ] Understand what is unprotectable.
- Authority. 17 U.S.C. § 102(b).
- Why. Ideas, procedures, processes, systems, and methods of operation, plus material dictated by efficiency or external constraints and expression merged with idea.
[ ] Keep the team small.
- Why. Every additional person is an additional person who saw the target.
[ ] Version the specification, so the record shows what implementation received and when.
[ ] Track every copy made, where it lives, and who has access.

Phase 6. The gatekeeper review

[ ] Read every draft, not a sample.
- Why. The artifacts that sink these projects are single lines.
[ ] Look for the six categories.
- Why. Verbatim code, near-verbatim pseudocode, identifiers from the target, literal text such as error messages, structural descriptions carrying design choice, and arbitrary constants with no functional justification.
[ ] Apply the functional test.
- Why. Could a competent engineer, told only the requirement, have arrived at this independently? If yes, probably functional. If no, probably expression.
[ ] [Gate] Record what was removed and why.
- Why. The redaction log is affirmative evidence of the discipline and worth as much as the specification.
[ ] Escalate close calls rather than deciding alone, and record the reasoning.

Phase 7. Implementation

[ ] Confirm no implementation team member had prior exposure.
- Trap. In a small company where everyone has seen the target, there is no implementation team and the clean room is nominal. Hiring or contracting for that side is a real option; pretending is not.
[ ] Build from the specification alone.
[ ] Route every question through the gatekeeper, in writing.
[ ] Preserve repository access logs.
[ ] Resist relaxing separation under schedule pressure.
- Trap. A separation abandoned at month six is worse than none, because the protocol documents a discipline the record will show was not maintained.

Phase 8. Intermediate copies

[ ] Minimize the copying.
- Authority. 17 U.S.C. § 106; 17 U.S.C. § 107.
- Why. Copy only what is necessary and only for as long as the analysis requires. The excuse depends on fair use.
[ ] Note the essential-step provision where the company owns a copy.
- Authority. 17 U.S.C. § 117.
- Why. It applies to owners of copies and does nothing for a licensee of a hosted service.
[ ] [Gate] Destroy the intermediate copies when the analysis is complete, with a certificate identifying what was destroyed and when.
[ ] Do not ship any copied expression.
- Why. The permission covers learning, not incorporating.

Phase 9. The parallel patent analysis

[ ] [Gate] Run it from month one, not at release.
- Authority. 35 U.S.C. § 271.
- Why. A clean room addresses copying and does nothing about patents, and independent development is no defense.
[ ] Scope the search to the interoperable function, not to the field.
[ ] Chart the claims that matter, and design around where the cost is modest.
[ ] Check declared-essential patents where a standard is involved.
[ ] Consider an opinion where exposure warrants it.
- Authority. 35 U.S.C. § 298; 35 U.S.C. § 282.

Phase 10. Comparison and release

[ ] [Gate] Run an independent comparison before release.
- Why. A reviewer engaged by counsel comparing the shipped product against the target for artifacts. Nobody wants this and it is the last chance to find something.
[ ] Look for striking similarities.
- Trap. Identical comments, shared typographical errors, dead code paths, and arbitrary constants. Each is worth more to a plaintiff than any amount of general resemblance, and teams have shipped them accidentally.
[ ] Register the resulting work.
- Authority. 17 U.S.C. § 411; 17 U.S.C. § 504.
[ ] Preserve provenance metadata where applicable.
- Authority. 17 U.S.C. § 1202.

Phase 11. The release file

Assemble it at release, not when a complaint arrives.

[ ] The scoping memorandum, dated before any examination.
[ ] The acquisition record, including terms if any.
[ ] The access control analysis.
[ ] The clean room protocol, dated before the work started.
[ ] Personnel attestations and assignment records.
[ ] The specification, with version history.
[ ] The transfer log and the gatekeeper's redaction record.
[ ] The question-and-answer log.
[ ] The independent comparison result.
[ ] The destruction certificate.
[ ] The freedom-to-operate analysis.
[ ] Understand why it matters.
- Why. In a copying case the elements are access and substantial similarity, and filtration removes most apparent similarity in a compatibility product. That leaves access, and the file is the answer to it.

Phase 12. If a claim arrives

[ ] Preserve immediately, with a litigation hold reaching the engineering organization on day one.
[ ] Lead with access.
[ ] Understand the filtration analysis.
- Authority. 17 U.S.C. § 102(b).
- Why. Abstraction, filtration, and comparison, with unprotectable material removed before anything is compared.
[ ] Engage the expert early.
- Authority. Fed. R. Evid. 702.
[ ] Check the plaintiff's registration and its timing.
- Authority. 17 U.S.C. § 411; 17 U.S.C. § 505.
[ ] Assess fair use for any intermediate copying.
[ ] Watch for the added claims.
- Why. Breach of the license prohibition, circumvention, trade secret misappropriation under 18 U.S.C. § 1836, and patent infringement. The copyright defense reaches none of them.

Phase 13. Research and repair variants

Security research

[ ] Document the research purpose before starting.
[ ] Limit the scope to a specific hypothesis on a specific version.
[ ] Test only systems you own or are authorized to test.
[ ] Follow a coordinated disclosure protocol.
[ ] Watch the trafficking prohibition, because publishing a proof of concept is a different act from performing the research.
[ ] Do not exfiltrate data.
- Trap. The single most common way a defensible research project becomes indefensible.

Repair and aftermarket

[ ] Read the current exemption text rather than a summary, and calendar the renewal.
[ ] Distinguish the permitted conduct from the tools.
[ ] Check state right-to-repair statutes and their unresolved interaction with the federal provisions.
[ ] Read dealer and service agreements, which bind by contract regardless of what reverse engineering law permits.
[ ] Note that independent derivation is proper means.
- Authority. 18 U.S.C. § 1839(6).
[ ] Document the acquisition of every device examined.

Phase 14. Advising the incumbent

[ ] Explain that trade secrecy will not hold.
- Authority. 18 U.S.C. § 1839(6).
- Why. A secret embodied in a distributed product is defeated by lawful reverse engineering, expressly.
[ ] Register the copyrighted works.
[ ] Build the patent position years earlier.
- Why. Independent development is no defense, which makes a patent the only right that reliably excludes a compatible product.
[ ] Understand the limits of contract.
- Why. It reaches counterparties only, and does nothing against a competitor who bought on the open market.
[ ] Weigh access controls against their cost.
- Why. A real barrier, at reputational and increasingly regulatory cost in repair-adjacent contexts.
[ ] Check standards commitments.
- Why. A patent declared essential and committed to licensing cannot be used to exclude an implementer.
[ ] Consider licensing the compatibility.
- Why. The right answer more often than incumbents initially accept, and it converts a competitor into a licensee.

Phase 15. Making it repeatable

[ ] Write the standing protocol, with a template, a specification style guide, an attestation form, and a transfer log format.
[ ] Name the gatekeeper function, not a person, with a named backup.
[ ] Set the trigger so a product manager can apply it without asking.
[ ] Train the engineering organization on two facts.
- Why. That examining a competitor's product with intent to build is a legal event, and that informal examination before that call destroys the defense.
[ ] Build the intake into the product kickoff template.
[ ] Maintain a register of programs, with target, acquisition path, protocol version, personnel, and release file location.
[ ] Debrief after each program, and revise the protocol.
[ ] Review annually, because the circumvention exemptions turn over on a triennial cycle and repair legislation is moving.

Phase 16. What kind of target you have

The protocol is constant; the analysis shifts with what is being examined. Run the boxes for whichever applies.

A physical product

[ ] Confirm nothing is being copied, so the copyright analysis does not arise.
[ ] Note that teardown and measurement are expressly permitted.
- Authority. 18 U.S.C. § 1839(6).
[ ] Treat Phase 9 as the whole of the legal work.

Embedded firmware

[ ] Note that extraction involves copying, which restores the copyright analysis.
[ ] Check whether extraction defeats a protection mechanism.
- Authority. 17 U.S.C. § 1201.
[ ] Note that purchasing the device supplies lawful possession, not a right to circumvent.

Packaged software

[ ] Confirm ownership of the copy, which makes the essential-step provision available.
- Authority. 17 U.S.C. § 117.
[ ] Run the full fair use analysis on the intermediate copies.

A hosted service

[ ] Note that no vendor code is copied, which removes most of the copyright question.
[ ] Read the terms of service, which almost always prohibit the analysis.
[ ] Assess the access statute.
- Authority. 18 U.S.C. § 1030.

Network traffic

[ ] Prefer this route where available.
- Why. Observing communications to document a protocol is analysis rather than copying, and the protocol is a method of operation outside copyright.
- Authority. 17 U.S.C. § 102(b).

Files a customer holds

[ ] Obtain written permission from the customer.
[ ] Prefer this route where it is sufficient.
- Why. Examining documents produced by the target is not examining the target's code at all.

Code produced in litigation

[ ] Read the protective order for prosecution bars and for use restrictions that survive the case.
- Trap. Using material obtained under a protective order in a product development effort, which is a contempt problem rather than a copyright one.

Phase 17. Staffing and cost

[ ] Keep the specification team small.
- Why. Every additional person is an additional person who saw the target.
[ ] [Gate] Confirm the implementation pool is genuinely uncontaminated.
- Why. In a small company where everyone has seen the target, there is no implementation team. Hiring or contracting for that side is a legitimate expense; pretending is not.
[ ] Fund the gatekeeper properly.
- Why. Counsel with enough technical fluency to recognize an artifact, reading every document rather than sampling.
[ ] Budget the independent reviewer.
[ ] Budget the patent work from month one.
[ ] Budget the schedule honestly.
- Why. Clean rooms are slower. The specification team cannot simply hand over what it learned, and the implementation team cannot ask informal questions.
[ ] Compare the incremental cost against the alternative.
- Why. The gatekeeper's time, some duplicated engineering, the independent review, and a few weeks of schedule — against litigating the access element without a file.

Phase 18. Failure modes, collected

[ ] No scoping memorandum, so the purpose is articulated after the analysis.
[ ] The target downloaded under a prohibition when it could have been purchased.
[ ] The access control question never asked.
[ ] The protocol adopted after the work started.
[ ] An engineer moved between teams.
[ ] Verbal communication outside the protocol, which nobody logs and everybody remembers at deposition.
[ ] An engineer as gatekeeper.
[ ] Identifiers, error text, or code fragments in the specification.
[ ] Structural description carrying design choice rather than functional requirement.
[ ] Intermediate copies retained with no destruction record.
[ ] No independent comparison before release.
[ ] Striking similarities shipped. An identical comment, a shared typo, a dead code path, an arbitrary constant.
[ ] The patent analysis run at release.
[ ] A rulemaking exemption relied on without tracking its expiry.
[ ] The release file assembled when the complaint arrives, by people reconstructing events from memory.
[ ] Separation relaxed at month six under schedule pressure, undoing everything.
[ ] The company's own resulting work never registered.
- Authority. 17 U.S.C. § 411.

Phase 19. When not to proceed

[ ] When the information is published.
- Why. Where a standard, a vendor specification, or public documentation supplies what is needed, reverse engineering adds risk and no information.
[ ] When the acquisition path is closed.
- Why. The target available only under a prohibition, in a jurisdiction likely to enforce it, with the client as counterparty.
[ ] When circumvention is unavoidable and no exception fits.
- Why. The conduct prohibition is independent of infringement and the trafficking prohibition is broader still.
[ ] When the patent position is bad.
- Why. Where the interoperable function is claimed and no design-around exists, the copyright discipline is beside the point.
[ ] When the implementation pool is contaminated and cannot be supplemented.
[ ] When the schedule will not tolerate the separation.
[ ] When licensing is available and affordable.
- Why. The most commonly overlooked answer. An incumbent that would license the compatibility converts a six-month legal exercise into a contract negotiation, and it is worth asking before assuming the answer is no.
[ ] Write the decision down either way.

Phase 20. Standards implementation

Where a standard governs, the whole shape of the work changes and most of this checklist does not apply.

[ ] Obtain the published specification.
- Why. No reverse engineering is required, because the standards body published what an implementer needs.
[ ] Identify declared-essential patents.
- Why. Participants typically declare patents they believe essential and commit to license them on defined terms. That commitment is what makes implementation possible.
[ ] Assess the licensing commitment's scope.
- Why. Whether it binds successors, what constitutes a compliant offer, and whether injunctive relief is available are all contested and all matter to an implementer.
[ ] Distinguish reproducing the specification from implementing it.
- Why. Standards documents are copyrighted works, and reproducing the text is a different act from building what it describes.
[ ] Read the certification program terms.
- Why. Compatibility logos are trademarks requiring a license and compliance with a certification program. A product may be fully compatible and still barred from saying so.
[ ] Budget the effort toward patent licensing and certification rather than toward technical analysis.

Phase 21. The one-page decision framework

Before any examination begins, answer these seven questions in writing.

[ ] What exactly do we need?
- Why. A protocol, a file format, an interface specification, or an understanding of an algorithm. The narrower the answer, the smaller every exposure.
[ ] Can we get it without examining the target at all?
- Why. Published specifications, standards documents, customer-held files, observable traffic, and vendor documentation.
[ ] How will we acquire the target, and what terms attach?
- Why. This determines whether the contract question exists at all.
[ ] Are there access controls?
- Authority. 17 U.S.C. § 1201.
[ ] Will we copy anything?
- Authority. 17 U.S.C. § 107.
[ ] Who will build the product?
- Why. If anyone who examined the target will also implement, there is no clean room and access is conceded.
[ ] What patents cover this?
- Authority. 35 U.S.C. § 271.
[ ] Date it before the work starts.
- Why. Every failure in this checklist is a project where this page did not exist.

Phase 22. The gatekeeper's working rules

The role decides more outcomes than any other, and it benefits from a written set of rules the gatekeeper applies consistently.

[ ] Nothing crosses without review. No exceptions for urgency, seniority, or a document that is "obviously fine."
[ ] Review within a stated turnaround, because a gatekeeper who becomes a bottleneck is a gatekeeper who gets bypassed.
[ ] Strip identifiers by default. Variable names, function names, class names, file names, and constants observed in the target. If the specification needs a name, invent one.
[ ] Strip literal text. Error messages, prompts, log strings, and comments.
[ ] Describe behavior, not implementation. "The system retries three times at increasing intervals" is behavior. "The retry loop increments a counter and doubles a delay variable" is implementation.
[ ] Question every number. A value with no functional justification is either arbitrary, in which case it is expression, or it is dictated by the format, in which case it should be described as a requirement rather than as an observation.
[ ] Question every ordering. A sequence required by the format is functional. A sequence chosen by the target's designers is not.
[ ] Log every removal with a reason, because the log is affirmative evidence of the discipline.
[ ] Escalate anything genuinely close to a second reviewer, and record the reasoning.
[ ] Do not answer implementation questions yourself. Route them to the specification team in writing so the record shows who knew what.
[ ] Keep a running list of what the implementation team has asked, because a pattern of questions probing at expression is a signal worth acting on.
[ ] Say no more often than feels comfortable.
- Why. The cost of an over-strict specification is engineering time. The cost of an under-strict one is the case.

Phase 23. Making it repeatable

[ ] Write the standing protocol, with a template, a specification style guide, an attestation form, and a transfer log format.
[ ] Name the gatekeeper function, not a person, with a named backup.
[ ] Set the trigger so a product manager can apply it without asking counsel first.
[ ] Train the engineering organization on two facts.
- Why. That examining a competitor's product with intent to build something compatible is a legal event requiring a call to counsel, and that informal examination before that call is what destroys the defense.
[ ] Build the intake question into the project kickoff template.
[ ] Maintain a register of programs, with target, acquisition path, protocol version, personnel, and release file location.
- Why. Two years later this is what tells you which project a complaint concerns.
[ ] Debrief after each program, and revise the protocol from what it found.
[ ] Review annually, because circumvention exemptions turn over on a triennial cycle and repair legislation is moving.

Outcome. The company bought the retail box rather than downloading under a prohibition, documented the absence of access controls, worked primarily from customer-held sample files rather than from code, adopted the protocol before any examination, and had counsel remove three artifacts from the specification. The independent comparison found nothing. Sued two years later, the case turned on access; the release file answered it; the matter resolved on summary judgment. The incremental cost of the discipline was the price difference between a download and a box, counsel's gatekeeper time, the independent review, and two weeks of schedule.

Key Authorities at a Glance

| Authority | Proposition | Phase | |---|---|---| | 17 U.S.C. § 102(b) | Ideas, procedures, and methods unprotected | 5, 12 | | 17 U.S.C. § 106 | Reproduction; intermediate copies | 8 | | 17 U.S.C. § 107 | Fair use; copying for analysis | 8 | | 17 U.S.C. § 109 | First sale; lawful acquisition | 2 | | 17 U.S.C. § 117 | Essential step and archival copies | 8 | | 17 U.S.C. § 301 | Preemption; contractual prohibitions | 2 | | 17 U.S.C. § 411 | Registration as a precondition | 10, 12 | | 17 U.S.C. § 504 | Statutory damages | 10 | | 17 U.S.C. § 505 | Fees | 12 | | 17 U.S.C. § 1201 | Circumvention; interoperability exception | 3 | | 17 U.S.C. § 1202 | Copyright management information | 10 | | 18 U.S.C. § 1030 | Computer access; hosted targets | 2 | | 18 U.S.C. § 1836 | Trade secret civil action | 12 | | 18 U.S.C. § 1839(6) | Reverse engineering not improper means | 13, 14 | | 35 U.S.C. § 271 | Patent infringement; no independence defense | 9 | | 35 U.S.C. § 282 | Defenses | 9 | | 35 U.S.C. § 298 | Advice of counsel | 9 | | Fed. R. Evid. 702 | Expert filtration and comparison | 12 |

The five things people get wrong

One: they start examining before anyone writes a protocol. A clean room adopted after the work began is nominal, because the specification team already includes people who will implement and the implementation team already includes people who saw the target. Access is conceded in fact whatever the paper says.

Two: they download the target under a license prohibiting the work. The same product was frequently available for purchase on the open market, and the price difference is trivial against removing the contract question entirely.

Three: they put an engineer in the gatekeeper role. Engineers optimize for a clear specification, which is precisely the pressure that pushes identifiers, error text, and structural detail across the boundary from function into expression.

Four: they never ask whether an access control is present. 17 U.S.C. § 1201 prohibits circumvention independent of infringement, the exceptions are narrow, and a project that skipped the question rather than answering it has an unexamined claim waiting.

Five: they run the patent analysis at release. A clean room does nothing about patents, independent development is no defense under 35 U.S.C. § 271, and a design-around that would have cost little in month one costs a redesign in month twenty-five. See Running a Reverse Engineering or Interoperability Program.