Code Confidential

Relying on Anonymous Tipsters to Confront Software Piracy?

Ars Technica has an interesting article about a company accused of software piracy that has sued the anonymous tipster claiming defamation. The DC Court of Appeals has allowed the case to proceed with instructions to the trial judge on the guidelines to apply when determining whether to reveal the identity of the anonymous tipster. The case highlights the importance of vetting sources and having solid evidence before pursuing businesses using pirated software.

"The case started with an anonymous complaint submitted to the Software & Information Industry Association, which (much like the Business Software Alliance), allows anyone to finger institutions for using pirated software. In this case, the person who submitted the complaint suggested that a company that makes software for the Defense Department, Solers, Inc., was engaged in piracy. The SIIA sent Solers a threatening letter, suggesting it undertake an audit of its compliance and return the results.

Solers argued that it was in compliance, and requested the identity of the John Doe who had turned it in. When the SIIA declined to identify him, the company filed a complaint, alleging that the anonymous tip amounted to defamation, and that it interfered with the company's ability to do business. As part of the suit, Solers subpoenaed the SIIA, demanding it turn over all the information it had on John Doe. The SIIA went to court in an attempt to quash the subpoena. The presiding judge agreed, but Solers appealed, leading to the current decision.

...

In short, the plaintiff [Solers] has to provide evidence that its claims are reasonable and the identity of the defendant [the anonymous tipster] is needed before the suit could continue. The defendant should also be given the opportunity to attempt to block his or her unmasking in court."

This is a great example of one of the big challenges that ISVs have when trying to recover revenue from businesses using their software without paying for it. In many cases, ISVs rely on someone to "drop a dime" and report the infringement. After that, there is a request/demand/court order for a software license audit that the accused infringing business often challenges (as happened in the Solers case).

Beyond the additional time and steps required to address these challenges, the accused business will likely challenge the motives of the tipster (especially if it is a "disgruntled ex-employee"), distracting attention from the underlying claims and issues at hand. Interestingly, Ars Technica used a picture of the mask from "V for Vendetta" to illustrate its article.

It seems like a better solution for ISVs (and the SIIA and BSA) is to have evidence of infringement before confronting or accusing a business of using its software illegally. Faced with detailed data showing actual and continued use of unlicensed applications, the accused business loses its ability to delay and distract by shifting the focus to the anonymous tipster.

That is the benefit of piracy business intelligence - it's automatic software auditing that lets the ISVs know when their applications are being used unlicensed and who is using them.

- Michael

Goldman Sachs Code Theft - Mitigating the Risks

Software Protection is not the panacea for code theft issues like the one that occurred with Goldman Sachs. In fact, this case is very similar to the 2004 insider code theft of Cisco’s IOS code. However, outside of just stronger access control and perimeter security measures, these threats do suggest a closer look at how to securely share valuable IP contained within code in a distributed and rapid software development process.

Although there are few details in terms of the development platform of the application and the exact access the alleged thief had, organizations should consider a few options to mitigate the risk of theft of sensitive IP within code:

• If managed code is involved, protect it - If the development language is managed (Microsoft .NET or Java), code obfuscation and encryption most be used. Even once the applications are compiled, it is only partially compiled into an intermediate language which is easily decompiled into source code representation. Another alternative is to place the sensitive IP into an unmanaged component to minimize exposure.
• Create protected APIs - If the software development process requires the use of outsourced development partners or contractors, create an application programming interface that contains the sensitive IP within compiled application components versus sharing the source. Although this would obviously require additional work by the organization, an API option that uses compiled binaries allow more options to use software protection and harden the API against reverse engineering.
• Embed threat detection and reporting – Add threat detection and reporting mechanisms (sometimes referred to as phone home systems) to the application itself. This approach can be used to continuously test for tampering or installation in unauthorized networks, and if a threat exists, notifies the owning organization in real-time. This presumes that the enterprise application (or in the context of this discussion a protected API) is designed to be deployed within specific networks, data centers or hosting partner networks.

Gartner's Neil MacDonald blogged about this news ("Security No-Brainer #7: If You Have Intellectual Property Embedded in Software, Protect it") and Gartner's "Hype Cycle for Cyberthreats (2006) coined a term for the emergence of software IP threats as enterprise code reverse engineering (“Definition: Enterprise code reverse engineering is reverse engineering of enterprise application
code for the purposes of targeting vulnerabilities or stealing intellectual property.”).

We believe as general perimeter, application, and physical security improves, hackers, foreign governments and competitors will increasingly turn to reverse engineering tactics to access valuable software IP or alter it for malicious purposes. In these threat scenarios software protection and threat detection reporting can play an important role in mitigating these risks.

- Vic

Wall Street Journal: Firm Alleges Code Theft in Web Filter

This article in the Wall Street Journal illustrates the paradox that exists with doing business in China. On the one hand, their weak enforcement of intellectual property (IP) rights has resulted in high piracy rates for years with numerous examples of reverse engineering cases, but on the other hand, China is a tremendous business opportunity for U.S. software vendors that cannot be ignored.

 The numbers illustrate these issue:

• There are an estimated 15,000 software vendors in China
• China graduates more than 100,000 programmers each year (NPR)
• Packaged software revenues in China are expected to exceed $9B (Gartner)

Software developers and vendors should be worried about their software IP in China. Software protection or tracking usage through piracy business intelligence approaches may give vendors a way to proceed with caution when there is valuable software IP at stake.

- Vic