ose of good faith testing, investigating, or
correcting, a security flaw or vulnerability, with the authorization of
the owner or operator of such computer, computer system, or computer
network.

(2) Permissible Acts of Security Testing. Notwithstanding the provisions
of subsection (a)(1)(A), it is not a violation of that subsection for a
person to engage in an act of security testing, if such act does not
constitute infringement under this title or a violation of applicable
law other than this section, including section 1030 of title 18 and
those provisions of title 18 amended by the Computer Fraud and Abuse Act
of 1986.

(3) Factors in Determining Exemption. In determining whether a person
qualifies for the exemption under paragraph (2), the factors to be
considered shall include-

(A) whether the information derived from the security testing was used
solely to promote the security of the owner or operator of such
computer, computer system or computer network, or shared directly with
the developer of such computer, computer system, or computer network;
and

(B) whether the information derived from the security testing was used
or maintained in a manner that does not facilitate infringement under
this title or a violation of applicable law other than this section,
including a violation of privacy or breach of security.

(4) Use of Technological Means for Security Testing. Notwithstanding
the provisions of subsection (a)(2), it is not a violation of that
subsection for a person to develop, produce, distribute or employ
technological means for the sole purpose of performing the acts of
security testing described in subsection (2), provided such
technological means does not otherwise violate section (a)(2).

(k) Certain Analog Devices and Certain Technological Measures.

(1) Certain Analog Devices.

(A) Effective 18 months after the date of the enactment of this chapter,
no person shall manufacture, import, offer to the public, provide or
otherwise traffic in any-

(i) VHS format analog video cassette recorder unless such recorder
conforms to the automatic gain control copy control technology;

(ii) 8mm format analog video cassette camcorder unless such camcorder
conforms to the automatic gain control technology;

(iii) Beta format analog video cassette recorder, unless such recorder
conforms to the automatic gain control copy control technology, except
that this requirement shall not apply until there a