BIOS Files, Copyright, and the Law: The Real Rules Behind Emulation

“Is emulation legal?” is really two separate questions wearing one trench coat: is writing and distributing emulator software legal, and is obtaining and using the copyrighted files (BIOS images, game ROMs) that software needs to actually run something legal. The two questions have different, independently-settled answers, and most confusion about emulation’s legal status comes from conflating them.

Writing an emulator: settled by Sony v. Connectix

Sony Computer Entertainment, Inc. v. Connectix Corp., decided by the Ninth Circuit Court of Appeals in 2000, is the case most directly on point. Connectix built Virtual Game Station, a PlayStation emulator, which required repeatedly copying Sony’s copyrighted PlayStation BIOS during reverse engineering — the process of studying how the original hardware worked in order to reproduce its behavior independently, without copying Sony’s actual code into the finished product. The Ninth Circuit ruled that this intermediate copying, done for the purpose of understanding an interface well enough to build independent, interoperable software, was protected as fair use — reversing a lower court’s injunction against Connectix. The court also rejected Sony’s trademark tarnishment claim over the product. The ruling didn’t hinge on emulation being some special exception; it applied established fair-use reasoning about reverse engineering for interoperability to this specific case, with the emulator itself containing none of Sony’s copyrighted material in its final, shipped form.

That ruling does not cover ROM or BIOS distribution

This is the part that gets lost in casual summaries: Sony v. Connectix is about the legality of building an emulator through reverse engineering — it says nothing about the separate act of copying and distributing an actual copyrighted BIOS image or game ROM file to someone else. Distributing a copyrighted work you don’t own the rights to remains ordinary copyright infringement, entirely untouched by this precedent, regardless of whether the recipient intends to use it with an emulator. The clearest illustration of the practical consequences here is Nintendo’s 2018 lawsuit against the operators of the ROM sites LoveROMS and LoveRETRO, which Nintendo described as “built almost entirely” on unauthorized distribution of its copyrighted games — the sites went offline immediately after the complaint, and the operators ultimately agreed to a $12,230,000 judgment along with a permanent injunction and surrendering the domains to Nintendo. Nothing about that case involved the legality of emulator software; it was squarely about unauthorized distribution of copyrighted game files.

A narrow, specific exemption for institutional preservation

Separately, the U.S. Library of Congress’s triennial DMCA rulemaking has recognized a narrow exemption relevant to preservation specifically, first granted in 2018 and renewed through each subsequent three-year cycle: eligible libraries, archives, and museums may circumvent access controls to preserve video games that are no longer supported (for example, games that depended on a since-shuttered authentication server), strictly for preservation purposes. That exemption comes with real limits — no commercial purpose, and the preserved game may only be made available on the physical premises of the qualifying institution, not distributed publicly — so it addresses a specific institutional preservation scenario, not general public distribution or use. The physical-premises limit is not stale 2018 language: in its ninth triennial rulemaking, effective October 28, 2024 through October 28, 2027, the Copyright Office specifically denied a petition from the Video Game History Foundation and Software Preservation Network to expand the exemption to allow remote, off-premises access to preserved out-of-print games, so the on-site-only restriction remains current law.

The practical rule this adds up to

Building or using emulator software to run games you legitimately own is on solid legal ground, resting on the same reverse-engineering-for-interoperability reasoning Sony v. Connectix established. Obtaining copyrighted BIOS files or ROMs you have no rights to — even to use with a perfectly legal emulator — is a separate act that ordinary copyright law still governs, and the emulator’s own legality doesn’t extend to cover it. Dumping a cartridge or disc you personally own, as covered in ROM dumping and preservation, is the practical way this distinction plays out for an individual: the software is legal, and the file is legitimately yours because you created it yourself from hardware you own — a materially different situation from downloading someone else’s copy of the same file.

A rights matrix is more accurate than “legal or illegal”

This deep dive is about the general decision framework, not the Connectix event. Four artifacts can carry different rights: emulator source code, console firmware, game software, and circumvention keys or procedures. A license for one does not transfer rights in the others. Open-source emulator code can be lawful while a bundled proprietary BIOS is unauthorized; owning a game disc does not automatically authorize public distribution of its image.

For each artifact, record who supplied it, the license or ownership basis, whether access control was bypassed, what copies were made, and whether anything will leave the owner’s control. Private use, research, library access, publication, and commercial distribution are different acts. Jurisdiction matters, and a platform’s terms can create contractual questions separate from copyright.

Reverse engineering and distribution are separate analyses

Connectix and Sega concern intermediate copying needed to study functional interfaces and produce a new interoperable program. Their reasoning does not say that the protected code studied becomes freely distributable. A clean-room project strengthens evidence that the shipped implementation is original: one team documents behavior and interfaces, another writes code from that specification, and provenance records show what entered the deliverable.

Firmware dumping also needs precision. A personal dump can provide stronger provenance than an anonymous download, but ownership alone is not a universal statutory exception. Anti-circumvention rules can apply even when the intended downstream use would not infringe copyright. The U.S. Copyright Office issues limited, periodically renewed exemptions for specified classes and actors; those exemptions have conditions and do not create an unrestricted ROM-sharing right.

Preservation institutions need controls, not slogans

Libraries, archives, and museums should maintain accession records, hashes, physical-item identifiers, access restrictions, tool versions, and counsel-approved policies. Preserve raw evidence and conversion logs separately from public access copies. Review server-dependent works, authentication, and abandoned online components individually. A preservation mission supports important policy arguments, but it is not itself a blanket license.

For individuals, the conservative workflow is to use independently distributed emulator software, obtain firmware and game data only through a lawful path, retain proof of provenance, avoid public sharing, and follow current local law. Do not treat “the game is unavailable” or “the emulator needs it” as a legal conclusion.

Primary legal references: 17 U.S.C. §107 fair use — Cornell LII, 17 U.S.C. §1201 — Cornell LII, Ninth Circuit’s published Connectix opinion, U.S. Copyright Office Section 1201 rulemaking.

Related:

Sources: