Cisco, ISS, Michael Lynn and Black Hat sign legal accord

The dispute between Cisco, Internet Security Systems, the Black Hat conference and a former ISS security expert - who Wednesday at the show revealed information related to hacking Cisco routers - reached a point of legal settlement Thursday.

More: Cisco nixes conference session on hacking IOS router code
Furor over Cisco IOS router exploit erupts at Black Hat
Researcher at center of Cisco router-exploit controversy speaks out
Forum: Who's right?

Michael Lynn, who had hired high-tech defense lawyer Jennifer Grannick as his attorney as he faced legal action Wednesday from his former employer ISS and Cisco, Thursday agreed to sign a court injunction. The injunction requires him to return any materials or disassembled code related to Cisco and never to discuss the materials related to the presentation he gave at the Black Hat conference on July 27.

That talk, which he gave in spite of a prohibition from ISS, and after a request by Cisco for it to be canceled on Monday, pulled him into a legal whirlwind. Cisco and ISS on Monday decided it was premature to release sensitive information related to how unpatched Cisco routers can be hacked and were furious when the main researcher who had uncovered the exploits defiantly spoke out on the topic.

The agreement, signed by all parties, also requires Black Hat to never disseminate a video made of Lynn’s presentation on July 27 and to deliver to Cisco any video recording made of Lynn.

According to the injunction Lynn is also forbidden from “unlawfully disassembling or reverse engineering Cisco code in the future… [and] using Cisco decompiled code currently in his possession or control for any purpose.”

These restrictions raise the issues of when security research crosses the line from the side of altruistic or responsible hacking to breaking the law, experts say.

“Reverse engineering on its own is legally OK,” says Lee Bromberg, senior partner for Bromberg & Sunstein, a Boston law firm specializing in electronic intellectual property litigation. But there are several exceptions. “If in doing this, you violate a patent, you’re still violating a patent. If you are violating a copyright, you’re violating a copyright,” he says.