There's a scenario that's been rattling around in my brain for a while. Consider the following example.

Josh, at Widgets Tech, goes to the internet and finds some code (GizmoLibrary) licensed MIT, and uses it in their code. A year or two go by, and GizmoLibrary has become deeply intertwined with almost every section of Widgets Tech's codebase. Abruptly, Widgets Tech gets an angry email from Gadget Corp. Turns out, the person who put GizmoLibrary on the internet had no authority to do so, and Gadget Corp (the owners of the code) have no intention of letting anybody else use their proprietary code, paid or otherwise. Widgets Tech doesn't have the resources to rewrite their whole codebase from scratch; if GizmoLibrary goes away, they're going under.

What happens? It doesn't seem like Widgets Tech has done anything wrong - they had no way of knowing that code was improperly licensed. It seems bad for Gadget Corp to be able to pull the plug on them. (And indeed, it seems like there's a possibility of abuse, here - "accidentally" post code where a competitor might find it, then pull it from them, costing days of work or more. A little tricky to pull off, but I don't doubt that more complex shenanigans have occurred.) On the other hand, Gadget Corp does own the code, and in theory they can decide who gets to use it. Is there any clear ruling on this? Let's assume United States, since that's where I live.

  • How does Gadget Corp find out about this? Is Widgets Tech itself doing fully open source work? Or did they share some code with a customer connected with Gadget Corp who noticed something odd and squawked to a contact at Gadget? Or else, did Gadget Corp, for some reason, reverse engineer Widgets Tech binaries and found some similarities to their GizmoLibrary? – Kaz May 12 at 22:59
  • @Kaz Dunno - doesn't seem like it should affect the outcome, aside from Gadget Corp possibly committing a crime. Perhaps Widgets Tech made a comment in a blog post, perhaps GizmoLibrary communicates with some servers and Gadget Corp just put 2 and 2 together, perhaps they discovered the leak and looked at download logs or something. – Erhannis May 13 at 2:13

You are right in your assessment: Widget Tech has a problem as it will need to replace the illegally-used library with something else. It may not be eligible for damages if you cease to do so immediately as it was acting in good faith. But they have no recourse to demand a license or release of the code or continued use of it. Neither company has done something wrong, if the code by Gadget Corp was released by a 3rd party under a wrong license, e.g. through a hack or so.

In some jurisdictions it will even be criminal to wilfully release your own code under a "wrong" license (possibly under a different identity) to only claim later that you didn't do so and someone else put it on the Internet in malice under a wrong license.

A court might also consider how long and publicly visible your code was on the Internet if you (Gadget Corp) claim that the code was released without your permission. Yet you as user might also be required to do some minimum sanity check on the eligibility and authenticity of the library you use (thus taking an MIT library from a hackerz forum known to be source for leaked data and sources might not be in your own interest as a foundation for your crucial product). Otherwise one might argue that Widget Tech did not do their due diligence in research to see whether they built on / used stolen intellectual property (you may not trade with obviously stolen items either).

  • Comments are not for extended discussion; this conversation has been moved to chat. – MadHatter May 11 at 7:26
  • 2
    How much "due diligence" is required? If they see an open source license in the online repo, do they have to contact someone to find out if that's the correct license? ISTM that if this costs Widget Tech money, they should be able to sue the person who fraudulently posted the code. – Barmar May 11 at 15:07
  • 3
    IANAL. Yet the 'how much' likely is to be decided by a court. Yet if you receive it under a license, you usually can assume it being valid unless you get reason to doubt the honesty of the offer / license statement (which you regularily don't have) – planetmaker May 11 at 17:04
  • 2
    The last sentence seems to make the analogy clearest... it seems little different from if someone stole an item and then sold or gave it away. The recipient isn't in trouble for having it, but they have to give it back if the person can prove it was theirs. The recipient benefited from the time they had it at least. And both the person that was stolen from and the recipient are out likely quite a bit overall from the whole process :-( – JeopardyTempest May 11 at 21:40
  • 2
    The analogy that makes sense to me is if you buy a Rolex in a jewelry store, you'd have no reason to doubt its provenance. But if someone tries to sell you one cheaply on the street, you would have reason to suspect it's counterfeit or stolen, and should be wary. The question then arises: is a random github repo more like a store or the street? – Barmar May 12 at 14:50

Other answers deal well with your principal question, but the secondary deserves a little attention, though it's easier to deal with.

And indeed, it seems like there's a possibility of abuse, here - "accidentally" post code where a competitor might find it, then pull it from them, costing days of work or more

In practice, this comes down to the licence as presented in this "accidentally posted" copy. Either it has none, in which case Widgets Tech knows perfectly well that it has no rights to use the library. Or Gadget Corp published it alongside a licence declaration that permits re-use, in which case Gadget Corp, being the rightsholder, has indeed distributed a freely-licensed copy, and thus Widgets Tech is well within its rights to use the library as described.

  • 5
    I thought that part of the question was talking about a situation where Gadget Corp covertly arranges for the code to be posted under an open license, while covering up the plan so that they can later claim it was an unauthorized leak. – David Z May 12 at 1:10
  • @DavidZ ooh, that's an interesting line of thought. I must confess I hadn't read it in that light, and if you read what the OP has to say in the chat (follow comment under the question), you may think (as I do) that the OP hadn't written it that way either. You want to write an answer covering that eventuality? – MadHatter May 12 at 16:15
  • Ah gotcha. I guess it wasn't entirely clear in the question. TBH I don't really trust my amateur legal knowledge to come up with a proper answer to that. Though if I were to speculate, if this came up in court it would either be known to the court that Gadget Corp ordered the release, or it would not be, and in either case an analogous situation with no covert activity involved is covered in the existing answers (yours and planetmaker's respectively), so that answer might not be substantially different anyway. – David Z May 12 at 16:55
  • I tend to imagine that a court would be deeply unimpressed upon discovering that the plaintiff deliberately offered the license and then pretended it was unauthorized. Judges tend to use rather incensed language like "fraud on the court" if you do that sort of thing. – Kevin May 13 at 1:13

What you are referring to is called Contributory Infringement. Yes, Widget Tech (and possibly Josh himself) are liable for their use of the proprietary code.

The case you are describing (exciting narrative BTW), is indeed rather complicated and would definitely pay out for the lawyers involved. The most probable outcome of such a scenario would be

  • the person who put GizmoLibrary on the internet gets fired and sued
  • Gadget Corp accepts the fact that they can't fully undo the damage, makes the best of it and Widget Tech buys a proper licence from Gadget Corp
  • Josh gets in a lot of trouble and will think twice before using software he finds on the internet
  • 4
    On the last point, do you mean that Josh would get in legal trouble, or just in trouble with their employer? – bob May 11 at 17:42
  • 1
    "the person who put GizmoLibrary on the internet gets fired and sued" That I think is the really important point, since there's obviously a substantial body of precedent relating to an employee making unauthorised representations on behalf of their employer. – Mark Morgan Lloyd May 13 at 20:17
  • @bob As I mentioned in "possibly Josh himself", it is possible that Josh may actually get into legal trouble. But since Josh was legitimately acting in the name of his company and never intended to violate anyone's copyright, he should be relatively safe. This would change if Widget Tech decided to turn against Josh and try to get him to pay for the damage which I think is unlikely because it's not promising. Also Josh might be the only on at Widget Tech who actually knows the code and how to repair the damage. – eeucalyptus May 14 at 9:53

This is most likely a disclosure of a Trade secret which, even in the USA, does not have the same level of legal protection in every state. Until the moment of disclosure, Gadget Corp considered the code commercially valuable because no-one else had access to it, and they also very likely took reasonable efforts to keep the code secret. These reasonable efforts might include IP/nondisclosure clauses in employment contracts, but there's no universal definition of "reasonable efforts".

Immediately after the code was disclosed, Gadget Corp have lost that trade secret. They haven't lost the right to prosecute the employee who disclosed it, though: the case of Biswamohan Pani might be a good example. Pani used Intel's secret information while being on both Intel and AMD's payroll simultaneously. AMD, who might have benefited from the information that Pani stole, were not prosecuted or (as far as I can tell) made to pay damages to Intel.

There's also the issue of how Gadget Corp might find out that Widgets Tech is using 'their' code. Sure, receiving a legal letter from Gadget Corp is likely to trigger an immediate code review at Widgets Tech. As long as the code wasn't clearly marked for a limited purpose as belonging to Gadget Corp or got from a source that Widgets Tech might reasonably assume was illegitimate, this would be very hard to prove. If Widgets Tech were feeling particularly cocky, they might respond by citing Arkell v. Pressdram

It's not unknown for a trade secret owner to neither confirm or deny the loss of their proprietary information. Consider Yum! Brands non-response to the discovery of the original KFC secret recipe: would they really wish to confirm that someone else could make their product, and that they were lax in preserving secrets crucial to shareholder value?

Any actions and results would very much depend on the advice of both company's legal counsels and their boards' appetite for risk. But I wouldn't want to be the (former?) employer who leaked the code.

  • 3
    Most source code is protected by copyright, not by trade secrets. – Mark May 11 at 23:13
  • 1
    If the source is not intended to be published, then it seems likely that trade secrets law may well apply. Though I'm no lawyer, I don't see a reason that both copyright and trade secret may be relevant here. – Toby Speight May 12 at 14:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.