If I buy a Bluetooth SmartLock, is it illegal for me to to attempt to open my own lock without the key to see if the product actually works?
A computer is protected (18 USC §1030(e)(2)) in generally one of three circumstances - i) Used exclusively by a financial institution; ii) Used exclusively by the US Gov't; or iii) Affects foreign commerce or communication [usually interpreted to mean connected to the Internet]
Therefore, if you are using a non-internet connected device (i.e. Bluetooth or NFC only), it's unlikely to be a violation of the CFAA.
NOT LEGAL ADVICE, SEEK YOUR OWN LICENSED ATTORNEY
While it might not be illegal to mess with a lock you've purchased, it could be unlawful, in the sense that you might be violating a contract that you agreed to when you purchased the lock. So while I would stake money on you not getting arrested for doing that work, I wouldn't bet against you getting sued, which is a far more common occurrence. Researchers getting arrested: rare. Researchers getting sued: a little less rare (still pretty rare).
You can agree to some punishment (like in an NDA). But if it's in a level that would destroy your life, it ought to be illegal again. And every time you agree for some punishment for exercising a fundamental right, you must gain something proportional to the right taken, otherwise it ought to be illegal again.
It's impossible to have a democracy if most of the population is slave due to some contractual clause.
And if the law is followed, you never will know of one.
That is the problem.
I've spent the last 13 years doing this kind of work, and bumped into a lot of remote servers I don't own on assessments of devices. There've been a lot of times where I wished I could go further, but never a time where I accidentally got sucked into hacking someone else's computer by dint of probing my own device.
Locks are generally a let the buyer beware kinda proposition. It's up to me to decide if this lock is good enough to protect the tools in my shed.
If i'm explicitly forbidden from investigating that - i think the manufacturer should be required to say how much of your losses they'll cover when the lock fails. Obviously the current state of affairs is _none_ and i can't lawfully tell if the lock sucks or not.
We'd all be better off if lock makers were forced to choose. either i can pick my own lock (evaluate my own risk) or advertise how much insurance comes with the purchase of the lock (evaluate risk for me).
(i fully appreciate the world does not work this way. I'm just asserting it would be better for everyone if it did.)
A quick intuitive verification for this claim: when you buy an E&O insurance as a technologist they'll ask a lot of stupid questions (in the sense that you'll be offended they have to even ask) but they don't ask "Do you do security research?" because the underwriters believe the risk and hazard to be actuarially immaterial.
>This Policy does not cover any loss, damage, cost, claim or expenses, whether preventative, remedial or otherwise, directly or indirectly arising out of or relating to: (a) the calculation, comparison, differentiation, sequencing or processing of data involving the date change to the year 2000 or any other date change, including leap year calculations, by any computer system, hardware, programme or software and/or any microchip, integrated circuit or similar device in computer equipment or non-computer equipment whether the property of the Insured or not; or (b) any change, alteration or modification involving the date change to the year 2000 or any other date change, including leap year calculations, to any such computer system, hardware, programme or software and/or any microchip, integrated circuit or similar device in computer equipment or non-computer equipment, whether the property of the Insured or not. This Clause applies regardless of any other cause or event that contributes concurrently or in any sequence to the loss, damage, cost, claim or expense.
In either case, these are probably not CFAA violations.