Hypothetical conflict - incorrectly licensed code

Question

There's a scenario that's been rattling around in my brain for a while. Consider the following example.

Josh, at Widgets Tech, goes to the internet and finds some code (GizmoLibrary) licensed MIT, and uses it in their code. A year or two go by, and GizmoLibrary has become deeply intertwined with almost every section of Widgets Tech's codebase. Abruptly, Widgets Tech gets an angry email from Gadget Corp. Turns out, the person who put GizmoLibrary on the internet had no authority to do so, and Gadget Corp (the owners of the code) have no intention of letting anybody else use their proprietary code, paid or otherwise. Widgets Tech doesn't have the resources to rewrite their whole codebase from scratch; if GizmoLibrary goes away, they're going under.

What happens? It doesn't seem like Widgets Tech has done anything wrong - they had no way of knowing that code was improperly licensed. It seems bad for Gadget Corp to be able to pull the plug on them. (And indeed, it seems like there's a possibility of abuse, here - "accidentally" post code where a competitor might find it, then pull it from them, costing days of work or more. A little tricky to pull off, but I don't doubt that more complex shenanigans have occurred.) On the other hand, Gadget Corp does own the code, and in theory they can decide who gets to use it. Is there any clear ruling on this? Let's assume United States, since that's where I live.

Answer 1

You are right in your assessment: Widget Tech has a problem as it will need to replace the illegally-used library with something else. It may not be eligible for damages if you cease to do so immediately as it was acting in good faith. But they have no recourse to demand a license or release of the code or continued use of it. Neither company has done something wrong, if the code by Gadget Corp was released by a 3rd party under a wrong license, e.g. through a hack or so.

In some jurisdictions it will even be criminal to wilfully release your own code under a "wrong" license (possibly under a different identity) to only claim later that you didn't do so and someone else put it on the Internet in malice under a wrong license.

A court might also consider how long and publicly visible your code was on the Internet if you (Gadget Corp) claim that the code was released without your permission. Yet you as user might also be required to do some minimum sanity check on the eligibility and authenticity of the library you use (thus taking an MIT library from a hackerz forum known to be source for leaked data and sources might not be in your own interest as a foundation for your crucial product). Otherwise one might argue that Widget Tech did not do their due diligence in research to see whether they built on / used stolen intellectual property (you may not trade with obviously stolen items either).

Answer 2

Other answers deal well with your principal question, but the secondary deserves a little attention, though it's easier to deal with.

And indeed, it seems like there's a possibility of abuse, here - "accidentally" post code where a competitor might find it, then pull it from them, costing days of work or more

In practice, this comes down to the licence as presented in this "accidentally posted" copy. Either it has none, in which case Widgets Tech knows perfectly well that it has no rights to use the library. Or Gadget Corp published it alongside a licence declaration that permits re-use, in which case Gadget Corp, being the rightsholder, has indeed distributed a freely-licensed copy, and thus Widgets Tech is well within its rights to use the library as described.

Answer 3

What you are referring to is called Contributory Infringement. Yes, Widget Tech (and possibly Josh himself) are liable for their use of the proprietary code.

The case you are describing (exciting narrative BTW), is indeed rather complicated and would definitely pay out for the lawyers involved. The most probable outcome of such a scenario would be

• the person who put GizmoLibrary on the internet gets fired and sued
• Gadget Corp accepts the fact that they can't fully undo the damage, makes the best of it and Widget Tech buys a proper licence from Gadget Corp
• Josh gets in a lot of trouble and will think twice before using software he finds on the internet

Answer 4

This is most likely a disclosure of a Trade secret which, even in the USA, does not have the same level of legal protection in every state. Until the moment of disclosure, Gadget Corp considered the code commercially valuable because no-one else had access to it, and they also very likely took reasonable efforts to keep the code secret. These reasonable efforts might include IP/nondisclosure clauses in employment contracts, but there's no universal definition of "reasonable efforts".

Immediately after the code was disclosed, Gadget Corp have lost that trade secret. They haven't lost the right to prosecute the employee who disclosed it, though: the case of Biswamohan Pani might be a good example. Pani used Intel's secret information while being on both Intel and AMD's payroll simultaneously. AMD, who might have benefited from the information that Pani stole, were not prosecuted or (as far as I can tell) made to pay damages to Intel.

There's also the issue of how Gadget Corp might find out that Widgets Tech is using 'their' code. Sure, receiving a legal letter from Gadget Corp is likely to trigger an immediate code review at Widgets Tech. As long as the code wasn't clearly marked for a limited purpose as belonging to Gadget Corp or got from a source that Widgets Tech might reasonably assume was illegitimate, this would be very hard to prove. If Widgets Tech were feeling particularly cocky, they might respond by citing Arkell v. Pressdram …

It's not unknown for a trade secret owner to neither confirm or deny the loss of their proprietary information. Consider Yum! Brands non-response to the discovery of the original KFC secret recipe: would they really wish to confirm that someone else could make their product, and that they were lax in preserving secrets crucial to shareholder value?

Any actions and results would very much depend on the advice of both company's legal counsels and their boards' appetite for risk. But I wouldn't want to be the (former?) employer who leaked the code.