The Right to Disassemble
On reverse engineering, the democratisation of making, and the uncomfortable positions of those who design for a living.
There is a particular satisfaction in understanding how something works by taking it apart. Not metaphorically. Literally. The cracked-open DVD player on the kitchen table. The router with its firmware exposed. The fitness tracker whose Bluetooth protocol someone, somewhere, decided to document on a forum at two in the morning because they were curious and had a weekend to spare. This is reverse engineering in its most basic form: the act of working backwards from a finished thing to the principles that made it possible.
For most of human history, this was simply called learning.
The word “reverse engineering” implies a hierarchy, an original act of engineering followed by its inversion. But that framing misses something important. In practice, reverse engineering is less about undoing someone else’s work and more about acquiring knowledge that was never offered freely in the first place. It is, fundamentally, an epistemic project: a refusal to accept the sealed object as the final word.
I’ve been thinking about this a great deal lately. Not because the practice is new (it isn’t), but because the tools enabling it have become so accessible, so remarkably frictionless, that the conversation has shifted from the technical to the political. Who gets to know how things work? Who decides what remains legible and what stays opaque? And what does it mean that the answers to these questions are being rewritten, largely without noise, by a distributed community of hobbyists, hackers, researchers, and the simply curious?
The Aura of the Closed System
In 1935, Walter Benjamin wrote about what happens to a work of art when it becomes reproducible. His essay Das Kunstwerk im Zeitalter seiner technischen Reproduzierbarkeit made the argument that mechanical reproduction strips an artwork of its “aura”: that quality of singularity, of being bound to a particular place and moment in time. The original painting has an aura; the postcard of it does not.
Benjamin’s argument is usually read as a farewell, a lament for something lost. But it was also, and perhaps more importantly, a recognition of political possibility. When the aura dissolves, the object is democratised. It escapes the cult, the institution, the gatekeeper. It becomes available to people who would never visit the gallery.
Proprietary technology has its own kind of aura. The sealed device, the deliberately hidden firmware, the closed API: these are aura in a different sense. They create distance between the artefact and the people who use it. They say: this is not yours to understand, only to consume. The aura here is not mystical but contractual, maintained through legal mechanisms. As a deliberate opacity designed to protect market position rather than any genuine creative claim.
Reverse engineering is what happens when that aura dissolves.
And like Benjamin’s reproducibility, it is both a loss and a liberation. The manufacturer loses control of the narrative. The user gains the possibility of understanding, and from that, agency.
What Is Actually Happening
It is worth being specific, because “reverse engineering” covers a surprisingly broad spectrum of practice.
At one end, there is hardware teardown: the physical disassembly of products to understand their component architecture. iFixit has made this into a small institution, publishing repairability scores and documenting the internal layout of consumer electronics with the seriousness of a museum catalogue. The Apple Vision Pro received a repairability score of four out of ten. The Framework laptop, designed from the outset to be opened, repaired, and upgraded, scored ten. The difference is instructive: one manufacturer built a sealed experience, the other built a relationship with the person who would own it.
In the middle, there is firmware and software analysis: the examination of binary code, network traffic, and communication protocols to understand how devices behave. It is also how independent developers build open-source alternatives to proprietary ecosystems, which transforms commodity hardware into home media systems, runs on knowledge extracted through exactly this kind of work.
At the other end, there is the reverse engineering of AI systems: red-teaming, probing for failure modes, attempting to reconstruct training data or decision logic from model outputs. This is perhaps the newest and most disputed territory, given that the systems in question are becoming infrastructure.
What has changed is not the practice but the tooling. Ghidra, the reverse engineering framework released by the NSA in 2019 and freely available as open-source software, gave hobbyists access to capabilities that previously required expensive commercial software. Large language models have compressed the learning curve further: someone who would previously have needed months of study to begin reading disassembled code can now get explanations, annotations, and contextual help in real time. The gap between curiosity and capability has narrowed to something approaching a weekend project.
A Designer’s Discomfort
Here is where I find myself in an uncomfortable position, and I might as well be honest about it.
I work at the intersection of strategy, design, and innovation. I spend considerable time helping organisations build products and systems that are coherent, intentional, and, yes, commercially viable. Part of that work involves making choices about what to reveal and what to protect. Intellectual property is a legitimate concept in the world I operate in. The idea that a company might invest years and significant resources into developing something, and then wish to defend that investment, does not strike me as obviously wrong.
And yet.
When I look at the downstream effects of closed systems: the mountains of e-waste from devices that could not be repaired, the dependency on proprietary ecosystems that creates structural vulnerability, the concentration of knowledge in institutions that have every incentive to keep it concentrated. I find the case for openness increasingly difficult to dismiss as naïve.
The industrial design tradition I came from has always contained this tension. The Bauhaus wanted to dissolve the boundary between art and manufacture, between designer and craftsperson. The notion that good design should be available to everyone, not just those who could afford commissioned work, was politically radical at the time. It is worth remembering that what feels like common sense today was once a contested position.
Reverse engineering is one contemporary expression of that same impulse. When someone tears down a medical device to understand why it costs four thousand euros when its components cost sixty, or when an independent developer rebuilds a discontinued router firmware to extend its useful life by a decade, they are participating in a tradition of democratisation that design has always, in its better moments, claimed to value.
The discomfort is that I believe both things at the same time. I believe in the legitimacy of intellectual investment and the value of protected design. And I believe in the right of people to understand the objects they depend on. These positions are not easily resolved.
On Bad Actors and the Availability of Knowledge
The conversation about reverse engineering almost always arrives, eventually, at the same concern: what about the people who use this knowledge to do harm?
It is a fair question. The same understanding of a network protocol that allows a security researcher to identify a vulnerability also allows an attacker to exploit it. The same firmware analysis that helps a repair technician fix a device can, in principle, inform an attack. The democratisation of capability is not discriminating about who receives it.
But this framing has a flaw, and it is worth examining carefully.
The assumption embedded in the worry about bad actors is that the knowledge in question was previously unavailable to them, that opacity was providing genuine security. In practice, this is rarely true. Sophisticated attackers, criminal organisations, state-level actors: these groups have always had access to the resources and expertise necessary to analyse systems they wanted to compromise. The history of cybersecurity is littered with vulnerabilities that were being actively exploited in the wild long before any public researcher documented them.
What changes when knowledge becomes widely accessible is not the threat model for high-capability adversaries. What changes is the opportunity for low-capability defenders. The independent security researcher who can now audit the firmware on their home router. The small hospital that can afford to hire someone who learned vulnerability assessment through open-source tools rather than a hundred-thousand-euro certification programme. The journalist in a politically sensitive environment who can verify whether their device is behaving as expected.
Lowering the barrier to knowledge is not the same as increasing harm. It is more accurate to say it shifts the imbalance. Previously, sophisticated attackers operated against unsophisticated defenders. As the tools for understanding spread, the defenders get better too.
This is not a complete answer. The lowering of the threshold does create genuine risks in specific domains (biosecurity, critical infrastructure, weapons) where the consequences of a single bad actor are devastating rather than merely damaging. These cases warrant specific, targeted responses. But they should not be allowed to dominate the entire conversation about knowledge access, which is what tends to happen when the argument is made at its most general level.
The Political Economy of Opacity
There is a reason closed systems are the default, and it is worth being clear-eyed about what that reason is.
It is not primarily security. Most proprietary systems are not more secure than their open equivalents; in many cases, the opposite is true, because the security-through-obscurity model fails catastrophically when the obscurity is eventually pierced, which it reliably is. The security argument is frequently deployed as a political argument rather than a technical one.
It is not primarily quality. The assumption that closed systems produce better products than open ones is hard to sustain in an era where the operating system running most of the world’s servers is Linux and the browser engine underlying most of the world’s web is open-source.
It is, most honestly, about control. Control over upgrade cycles and planned obsolescence. Control over the service and repair market. Control over data generated by devices in use. Control over the competitive landscape. These are legitimate business interests, in the narrow sense that businesses are entitled to pursue them, but they are not interests that coincide with those of the people who use the products in question.
When the European Union moved to mandate repairability standards and the right to repair across product categories, it was making a political judgment that the interests of users and the environment outweighed the interests of manufacturers in maintaining this control. The reaction from industry was predictable. So was the reaction from people who had been waiting years for exactly this judgment.
Reverse engineering has always been one of the ways this negotiation happened in the absence of formal rights. It was an improvised solution to a fundamental imbalance. What is changing now is that the informal practice is being formalised: legally through right-to-repair legislation, technically through the proliferation of tools that make the practice available to a much wider population.
Two Laws, One Screwdriver
The European Union’s Right to Repair Directive, which came into force in 2024, is a deceptively modest document. It requires manufacturers of certain product categories (smartphones, tablets, laptops, domestic appliances) to make spare parts available at reasonable prices, to provide repair information to independent workshops, and to extend legal guarantees for repaired devices. It also, notably, prohibits manufacturers from using software locks or contractual barriers to prevent repair.
On paper, this is sensible consumer and environmental policy. In practice, it runs straight into the foundations of how modern technology companies protect their intellectual property.
The conflict is not accidental. It is structural. And it deserves to be examined more carefully than the press coverage of the Directive typically allows.
The IP framework governing technology products is layered and extensive. There is copyright, which protects software code and, increasingly, the firmware embedded in physical hardware. There are design rights, which protect the aesthetic and functional form of products. There are patents, which protect specific technical solutions. There are trade secrets, which protect undisclosed information about how systems work. And there are database rights, which protect the compilation of diagnostic and calibration data that repair requires.
Together, these create a legal architecture that, regardless of what the Right to Repair Directive says about your right to fix your washing machine, can make it practically illegal to obtain the knowledge necessary to do so. The Directive grants a right; IP law withdraws the means. The gap between them is where independent repair businesses live, and it is an uncomfortable place.
The tension becomes sharpest around software and diagnostics. Modern products: cars, agricultural equipment, medical devices, consumer electronics. They are increasingly computers that happen to have a physical shell. Repairing them is, in large part, a software problem. Understanding what is wrong requires running diagnostic software. Replacing a component often requires recalibrating or reprogramming firmware. In many cases, the physical repair is trivial; the software authorisation is not.
John Deere (sorry guys! I love your brand!) made this visible to more people when farmers in the United States began documenting that their own tractors, machinery they had purchased outright and for which they held the title, could be rendered inoperable by a software lock if serviced by an unauthorised dealer. The tractors were theirs. The software that ran them, and the diagnostic tools needed to service them, were not. Deere’s position was legally coherent: the firmware was copyrighted, the diagnostic system was proprietary, and using either without authorisation constituted infringement.
This is not an exception. It is the logical endpoint of treating software as a licensed service layered on top of a physical product, rather than as a component of something the customer has purchased. Apple uses exactly the same architecture through its parts pairing system, which digitally ties components to specific devices. A screen replacement on certain iPhone models triggers a warning and limits functionality, unless the part is registered through Apple’s system. The physical part fits. The software says no.
The EU Directive attempts to address this by prohibiting software-based barriers to repair when they have no technical justification. But “technical justification” is precisely where the disagreement lives. Manufacturers argue, with some sincerity, that parts pairing exists to verify component authenticity and prevent counterfeit parts from compromising safety or security. Critics argue that this is largely an excuse: that the same outcomes could be achieved through mechanisms that do not restrict independent repair. Both positions contain genuine technical arguments. The question of which argument should prevail is not technical at all. It is political.
What makes this particularly difficult is that the Right to Repair framework and the IP framework are built on fundamentally different premises about what the object of protection should be. IP law protects the creative and inventive work that went into producing something. Right to repair legislation protects the user’s relationship with the physical thing they own. These are not inherently opposed, but the way both frameworks have evolved has created a collision zone in which the IP claim is used to override the ownership right.
There is a term for this in legal scholarship: “IP creep.” (No not derived from scuba diving I think…) The steady expansion of intellectual property rights into domains they were never intended to govern. Copyright was designed to protect creative expression, not to control who may service a product. Patent law was designed to reward and disclose inventions, with a time-limited monopoly that expires precisely so the knowledge can enter the public domain. The use of these instruments to prevent repair and reverse engineering represents a departure from their original purpose, one enabled by the increasing software content of physical products and exploited by companies with both the incentive and the legal resources to push the interpretation as far as it will go.
The EU’s Directive is a partial fix, but it is operating against a global IP framework in which European legislation has limited reach. A manufacturer can comply with the letter of the Directive in European markets while structuring its global software architecture in ways that make compliance technically hollow. The spare part arrives; the activation code does not.
None of this is resolved. The Directive is a beginning, not an endpoint. The legal battles over its interpretation are already beginning, in Brussels and in the national courts that will eventually rule on specific disputes. What is clear is that the right to disassemble something, to understand and repair it, is not simply a matter of physical access. It is a matter of whether the knowledge required to act on that access can be obtained and used without legal risk. At the moment, the answer is: sometimes, in some jurisdictions, under certain conditions, provided you are careful about how you document what you find.
That is not a right. It is a tolerance.
What Benjamin Would Have Made of It
I think Benjamin would have recognised this moment.
He was writing at a time when new reproductive technologies (photography, film, the printing press at industrial scale) were unsettling established cultural hierarchies. The gatekeepers of the time had genuine concerns: about quality, about context, about the loss of something irreplaceable in the wide and free circulation of images. Some of those concerns were legitimate. And yet the broader movement (the dissolving of the aura, the democratisation of cultural production and consumption) was, in his reading, more politically significant than any individual loss.
What we are watching with reverse engineering is the dissolution of the technological aura. The sealed device is losing its mystique, not to nihilism but to knowledge. The proprietary system is being opened not to steal it but to understand it. And understanding, at sufficient scale, changes the terms of the relationship between the people who make technology and the people who live with it.
This does not resolve the tensions. It does not answer the question of how to reward genuine innovation without creating permanent monopolies on knowledge. It does not specify exactly where the line sits between legitimate protection and illegitimate opacity. These are political and legal questions that will be contested for years.
But it does clarify what is at stake. The question is not whether reverse engineering is moral or immoral, safe or dangerous. The question is what kind of relationship between people and their technological environment we want to build.
A Partial Resolution
I said earlier that I believe two things simultaneously: the legitimacy of protected design and the right of people to understand the objects they depend on. I don’t think this tension fully resolves, and I’ve become somewhat suspicious of anyone who claims it does.
What I’ve arrived at, for now, is something like this: the default should be legibility. Products that touch critical aspects of people’s lives (their health, their safety, their communication infrastructure) should be comprehensible by default. Protection should be an exception that requires justification, not a baseline that requires no defence.
This is not a position without costs. There are things that become harder in a world of radical legibility: certain forms of competitive advantage, certain business models that depend on uneven access to information. These are real costs. They are also, in my judgment, worth paying.
The designer in me wants objects that are honest about themselves. That communicate their logic, invite engagement, and respect the intelligence of the people who use them. The sealed box, the opaque system, the device that refuses to be understood: none of these are design achievements. They are design failures dressed in legal protection.
Reverse engineering, in this reading, is not an attack on design. It is a demand that design live up to its own stated values.
The people staying up until two in the morning to document a Bluetooth protocol are not adversaries of the people who built the device. They are, in a real sense, the intended audience: the ones curious enough to want to understand how it actually works. The right response is not to make it harder for them. It is to wonder why the original designers didn’t make it easier.
Ivo Jeukens founded The Hybrid Consultancy, a design strategy and strategic design consultancy, based in Amsterdam.