of a lawfully acquired motorized land vehicle or marine vessel such as a personal automobile or boat, commercial vehicle or vessel, or mechanized agricultural vehicle or vessel, except for programs accessed through a separate subscription service, when circumvention is a necessary step to allow the diagnosis, repair, or lawful modification of a vehicle or vessel function, where such circumvention is not accomplished for the purpose of gaining unauthorized access to other copyrighted works. Eligibility for this exemption is not a safe harbor from, or defense to, liability under other applicable laws, including without limitation regulations promulgated by the Department of Transportation or the Environmental Protection Agency.
(14) Computer programs that are contained in and control the functioning of a lawfully acquired device that is primarily designed for use by consumers, when circumvention is a necessary step to allow the diagnosis, maintenance, or repair of such a device, and is not accomplished for the purpose of gaining access to other copyrighted works. For purposes of this paragraph (b)(14):
(i) The “maintenance” of a device is the servicing of the device in order to make it work in accordance with its original specifications and any changes to those specifications authorized for that device; and
(ii) The “repair” of a device is the restoring of the device to the state of working in accordance with its original specifications and any changes to those specifications authorized for that device. For video game consoles, “repair” is limited to repair or replacement of a console’s optical drive and requires restoring any technological protection measures that were circumvented or disabled.
(15) Computer programs that are contained in and control the functioning of a lawfully acquired medical device or system, and related data files, when circumvention is a necessary step to allow the diagnosis, maintenance, or repair of such a device or system. For purposes of this paragraph (b)(15):
(i) The “maintenance” of a device or system is the servicing of the device or system in order to make it work in accordance with its original specifications and any changes to those specifications authorized for that device or system; and
(ii) The “repair” of a device or system is the restoring of the device or system to the state of working in accordance with its original specifications and any changes to those specifications authorized for that device or system.
(16)(i) Computer programs, where the circumvention is undertaken on a lawfully acquired device or machine on which the computer program operates, or is undertaken on a computer, computer system, or computer network on which the computer program operates with the authorization of the owner or operator of such computer, computer system, or computer network, solely for the purpose of good-faith security research.
(ii) For purposes of paragraph (b)(16)(i) of this section, “good-faith security research” means accessing a computer program solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability, where such activity is carried out in an environment designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices or machines on which the computer program operates, or those who use such devices or machines, and is not used or maintained in a manner that facilitates copyright infringement.
(iii) Good-faith security research that qualifies for the exemption under paragraph (b)(16)(i) of this section may nevertheless incur liability under other applicable laws, including without limitation the Computer Fraud and Abuse Act of 1986, as amended and codified in title 18, United States Code, and eligibility for that exemption is not a safe harbor from, or defense to, liability under other applicable laws.
(17)(i) Video games in the form of computer programs embodied in physical or downloaded formats that have been lawfully acquired as complete games, when the copyright owner or its authorized representative has ceased to provide access to an external computer server necessary to facilitate an authentication process to enable gameplay, solely for the purpose of:
(A) Permitting access to the video game to allow copying and modification of the computer program to restore access to the game for personal, local gameplay on a personal computer or video game console; or
(B) Permitting access to the video game to allow copying and modification of the computer program to restore access to the game on a personal computer or video game console when necessary to allow preservation of the game in a playable form by an eligible library, archives, or museum, where such activities are carried out without any purpose of direct or indirect commercial advantage and the video game is not distributed or made available outside of the physical premises of the eligible library, archives, or museum.
(ii) Video games in the form of computer programs embodied in physical or downloaded formats that have been lawfully acquired as complete games, that do not require access to an external computer server for gameplay, and that are no longer reasonably available in the commercial marketplace, solely for the purpose of preservation of the game in a playable form by an eligible library, archives, or museum, where such activities are carried out without any purpose of direct or indirect commercial advantage and the video game is not distributed or made available outside of the physical premises of the eligible library, archives, or museum.
(iii) Computer programs used to operate video game consoles solely to the extent necessary for an eligible library, archives, or museum to engage in the preservation activities described in paragraph (b)(17)(i)(B) or (b)(17)(ii) of this section.
(iv) For purposes of this paragraph (b)(17), the following definitions shall apply:
(A) For purposes of paragraphs (b)(17)(i)(A) and (b)(17)(ii) of this section, “complete games” means video games that can be played by users without accessing or reproducing copyrightable content stored or previously stored on an external computer server.
(B) For purposes of paragraph (b)(17)(i)(B) of this section, “complete games” means video games that meet the definition in paragraph (b)(17)(iv)(A) of this section, or that consist of both a copy of a game intended for a personal computer or video game console and a copy of the game’s code that was stored or previously stored on an external computer server.
(C) “Ceased to provide access” means that the copyright owner or its authorized representative has either issued an affirmative statement indicating that external server support for the video game has ended and such support is in fact no longer available or, alternatively, server support has been discontinued for a period of at least six months; provided, however, that server support has not since been restored.
(D) “Local gameplay” means gameplay conducted on a personal computer or video game console, or locally connected personal computers or consoles, and not through an online service or facility.
(E) A library, archives, or museum is considered “eligible” if—
