Limits on manufacturers’ establishing digital rights management mechanisms on products sold for commercial purposes
19.3.2024
Question for written answer E-000826/2024
to the Commission
Rule 138
Patrick Breyer (Verts/ALE)
In a recent case[1], security researchers, hired by a railway company to fix a series of Polish electric multiple units that refused to move a few days after arriving at an ’unauthorised’ service company, found that the train manufacturer (NewAg) had placed a series of ‘lock-up mechanisms’ designed to ‘kill power to the train and break a train’s compressors if certain conditions were met’. More specifically, the trains were designed to be locked if they were detected to be at independent repair centres or competitors’ rail yards, based on specific GPS coordinates embedded in their code. By contrast, an additional condition was set, whereby the lock could be easily disabled if a train was located at the manufacturer’s rail yard. In more peculiar cases, a mechanism was set to deactivate a train on a specific calendar date or if it sat idle for a certain number of days as this would be considered an ’infringement of copyright to the vehicle control system’ and would trigger civil and criminal liability.
In the light of these recent findings and on the basis of existing EU legislation, what limits does EU law place on manufacturers disabling products sold for commercial use?
Submitted:19.3.2024
- [1] https://www.404media.co/polish-hackers-explain-exactly-how-they-fixed-trains-that-the-manufacturer-bricked/.