What happens if stolen software is published as Open Source?

Question

This is not a real world issue, at least for me. It is more about a thought experiment from a talk that I once had with a friend:

Let's say that Acme develops closed source software for their own business and there are some sort of industrial secret on that code.

At Acme, one of their staff members, Han Solo, is about to be fired. Knowing that, he grabs some of the Acme's code and saves it in a pen-drive or something like that.

After leaving the company, he decides to publish Acme's code at some Open Source hosting (like GitHub or SourceForge), adding some Open Source license with the intent of damaging Acme's business. Acme does not notices this soon enough, and many people then have downloaded the code, modified it, forked it and improved it as any successfully Open Source software.

Some day, Han's plan starts to work, and Acme starts to lose money and customers who do not want to pay for their software anymore, since there is an Open Source alternative that does exactly the same as Acme's code does and it is easily found in the internet for free.

Acme would likely sue Han Solo, and Han Solo would be found guilty. But now we come to the question: What would happen with the now Open Source leaked code? The Open Source project is the fruit of a crime, and it is in fact stolen software that was Open Sourced. Should/could Acme try to hunt down wherever it is hosted and close it again (which is very unlikely to work)? What Acme could/would/should do to the community that uses the project?

Answer 1

I have done a thorough IP review on my own project in 2007. You can find some info about this project in this slide deck: Startup Legal and IP. I encountered many situations that are similar to what you describe, although none of them were "criminal." These are some examples.

Example 1: code that was proprietary to SUN, later open source by SUN under a friendly license.

In my project, I was using code originally developed at SUN. Some classes of th source code contained comments sections saying This code is confidential and proprietary information of Sun Microsystems, Inc. etc. The code as a whole was released, also by SUN, under a friendly sample license. In short: the code was released with the best of intents, but it accidentally contained conflicting information referring to the original, more strict license.

Verdict of the IP lawyers: it's better to be safe than sorry. I had to remove the code.

Example 2: The RC4 algorithm used to be a trade secret. Then it was anonymously published.

I used the code that implemented the algorithm that was anonymously published. It was considered as part of the public domain, so I was allowed to continue to use it. However, I used a parameter named RC4_ENCRYPTION, and although it was OK to use the code, I was not allowed to use the name RC4 in a parameter name because the name RC4 was trademarked.

Verdict of the IP lawyers: as I was using the Alleged RC4 algorithm, I had to change the name of the parameter to ARC4_ENCRYPTION.

Example 3: IntHashtable by ACME versus IntHashtable from Apache.

I was using the IntHashtable class from ACME.com. This class mentioned: This class is 90% based on JavaSoft's java.util.Hashtable. Because JavaSoft's class wasn't available under a friendly license, I was not allowed to use that class. However, I found an IntHashtable class in Apache-commons that was 99% similar to ACME's IntHashtable.

Verdict of the IP lawyers: as the IntHashtable class from Apache was available under the ASL, I was allowed to use it. I replaced the ACME class by the Apache class. It was 99% similar, but the former wasn't acceptable from a legal point of view, whereas the second got the approval from the lawyers.

Example 4: I used a Quick-and-Dirty XML Parser example from a JavaWorld article.

I didn't read the fineprint that said:

All contents of JavaWorld, including text, programs, applets, source code, and images are copyrighted and owned by IDG or the copyright holder specified, all rights reserved. No material may be reproduced electronically or in print without written permission.

In this situation, JavaWorld was like your ACME company, and I was like your Han, although I had no criminal intentions: I was just ignorant. I took copyrighted code from a magazine example, and I released it as open source software. I should have asked permission before I did this.

Verdict of the IP lawyers: ask and get permission. This was a no-brainer. Permission was granted immediately, both by JavaWorld and the author of the article and the code sample.

Summarized:

In your example, Han is doing something that is not allowed: he is publishing copyrighted work as if it were open source software. He can be sued and he will have to pay for all the damages that arise from distributing the code as open source software.

If somebody else, for instance Luke, downloads that software and starts using it, he is doing so in good faith. Usually, Luke won't be sued (or if he's sued, he'll win because he can prove that he didn't know he was doing anything wrong), but this doesn't mean that Luke can continue using that software. Acme can demand that he either stops using the software, or that he gets a license. I'm pretty sure that Luke can also sue Han for the damages, for instance if Luke suddenly has to start paying Acme for his use of the software.

In my case, I removed some code from my code base entirely (see example 1), I made small adjustments (see example 2), I refactored my code (see example 3) or I asked and received permission (see example 4). There is no general rule. It depends from case to case.

Morale: Don't use open source software of which the origin is shady. Try to establish a business relationship with the open source vendor distributing the code. That way, you are protected against situations like this.

Answer 2

Han never had copyright on the code. He was unable to license it to anybody. He claimed he gave people a license anyway, but this wasn't true, since he couldn't.

All derivative works who thought they had a license to do what they were doing, didn't have a license to do so at all. Han said he gave them a license to the work, but he was lying.

The copyright is owned by Acme, and nobody else. You can't license software you don't own. You can't sub-license software you don't have a license for in the first place (even though you thought you had).

Also, he shot first.

Answer 3

There is legally no such thing as "industrial secret", but there are trade secrets. If Han Solo publishes code that contains trade secrets, then he is likely going to jail. Publishing trade secrets when you have no right to do so is criminal.

However, most if the time the copying of source code is just plain old copyright violation, whether there are any secrets in the code or not. Depending on exactly what Han Solo is doing, it can be criminal or not. Even it's not criminal he can be sued for damages. By slapping on for example a GPL license and making everyone believe that they have the right to copy (so totally honest people will copy the code, not just copyright infringing lowlives) he maximises the damage and therefore the amount of money that he would have to pay.

For people copying the code in the belief that it is for example GPL licensed, Han Solo's action creates a legal nightmare. First, they are liable for copyright infringement even though they don't know they have done anything wrong. Second, the copyright holder can order them to remove the source code, which will cause them all kinds of problem.

Summary: If you really want everyone to hate you, then distributing proprietary code illegally under GPL is an excellent way of achieving your goal.