Code Confidential

Seminar on Software Piracy Risks and Strategies

We were in San Francisco at The Palace Hotel last week for a private luncheon and seminar on software piracy risks and strategies.

The hour long session focused on:

• V.i. Labs’ software piracy research for high value applications
• Aggregate results and data from our deployed customers using piracy detection and reporting
• New features and benefits in CodeArmor Intelligence 2.0 which give ISVs the ability to identify and report on unlicensed use of software

Our guests included representatives from various software vendors who are responsible for licensing, compliance or piracy efforts, and their feedback was overwhelmingly positive - especially the aggregate data and revenue recovery results from our deployed customers.

While it does seem odd to blog about an event and not include any photos of the audience, we do, of course, respect their privacy given the nature of the topics discussed.

Given their response to the information presented, we are happy to schedule private briefings with qualified software vendors to review this new material - just email me at mgoff [at] vilabs.com.

- Michael

New Version of CodeArmor Intelligence, Real Data, and New Piracy Research

Today we announced CodeArmor Intelligence 2.0 - here's a short three minute video that Vic did covering some of the aggregate data our deployed customers have shared with us along with highlights on some of the new features (including dynamic notification capabilities and enhanced data collection and reporting):

We also announced the latest report in our Piracy Risk Assessment research series. Part 2 focuses on "Software Piracy Distribution Channels and Networks" and is available today (Part 1 focused on Crack Releases and Piracy Enablement Approaches). Part 3 of the series will assess the trends and overall piracy activity levels for specific software markets using metrics based on piracy group activity.

- Michael

V.i. Labs Software Piracy Risk Assessment Report - July 2009

We have been continuing to gather and analyze data on software piracy since we issued our first reports last summer and are ready to issue the first part of our Software Piracy Risk Assessment Report.

The first installment is a detailed review of crack releases and piracy enablement approaches. Tampering or bypassing the embedded license enforcement is a key enabler of piracy. Most high value applications have adopted third party licensing systems to enforce software entitlements for their customer base.

We reviewed 83 separate piracy group distributions of cracked software that were released between 2007 and 2009 from 39 Independent Software Vendors (ISVs). These high value applications have an average list price exceeding $4,000 (USD) per user seat and are used for Architecture Engineering and Construction (AEC), Computer Aided Design (CAD), Computer Aided Machine (CAM), Computer Aided Engineering (CAE), Electronic Design Automation (EDA), Product Lifecycle Management (PLM), and other specialized engineering and scientific modeling and analysis.

Interestingly, the top five piracy groups (out of 212) contributed 59% of the cracked releases in the study.

All of the pirated software releases used a crack mechanism or other approach to tamper with license enforcement and enable illegal use. However, there was a great range in terms of how well documented the cracks were and the level of expertise required to configure the crack. Three general approaches were used (click image to enlarge):

• Binary patches (52% / 43 releases)
• Key maker (36% / 30 releases)
• Vulnerability (12 % / 10 releases)

The analysis also revealed that the piracy groups and the reverse engineering talent they recruit can tamper with a variety of hardware and software based licensing systems to enable overt piracy. Strengthening licensing using hardware dongles or tamper resistant licensing may be useful prevention for overuse within a licensed customer environment, but it should not be viewed as a defense against overt piracy.

To learn more about the results of the research, the complete report is available for download here.

- Vic

Fighting Piracy on the High Seas: Offense vs. Defense

My colleague, Vic DeMarines, will be speaking on a panel at DAC (Design Automation Conference) on Tuesday, July 28. The panel, Fighting Piracy on the High Seas: Offense vs. Defense, is going to be led by the EDA Consortium's anti-piracy chairman Scott Baeder. EDAC has put together a fun video promoting the panel - check it out!

- Michael

Forbes: The Inevitability Of Internet Pirates

Andy Kessler has an interesting commentary on piracy on Forbes.com titled, "The Inevitability Of Internet Pirates."

While he focuses mostly on "music, TV shows, movies and, as it's known on the Web, pr0n," his comments apply to pirated software as well (emphasis added):

"Like it or not, the Web is and will remain the Wild West....Plus, it is so easy to create a Web service to download copyrighted material that, like that arcade game Whac-A-Mole, if you take one culprit down with your mallet another five pop up in the next few nanoseconds. Sad but true, there is not much anyone can do."

The availability of pointers to pirated materials on Pirate Bay (or even Google) enable piracy - they make it too easy to find and download software and copyrighted content. Kessler offers an alternative approach that we agree with and have been advocating as well: new business models.

"So make all the legal arguments you want. No matter what court decisions are rendered and no matter what laws are passed, copyright infringement is going to happen. So these folks should stop suing their customers and lobbying for more laws and instead come up with new business models that pirates can't follow them into."

While the examples he cites relate more to copyrighted content than software, it is crucial for software vendors to consider new business models for recovering revenue lost to pirated use. In the case of software vendors that can sometimes mean pursuing legal channels to recover revenue from the businesses that are actually using unlicensed applications - but first you have to be able to identify who those businesses are. Regular readers of Code Confidential will recall that we are proponents of piracy business intelligence as a means of identifying these businesses.

Once a vendor has this information, it can decide on the best approach - whether it is direct sales or legal contact with an infringing organization, building partnerships in a given region or industry, or an altogether new business model for addressing the issue.

- Michael

eWeek - How to Combat Software Piracy: From Reaction to Revenue Recovery

My fellow blogger, Vic, wrote an article for eWeek's Knowledge Center:

"As someone who has spent a lot of time discussing piracy with the ISV community and researching the piracy scene, I believe what a software vendor does to combat piracy is directly proportional to its knowledge of the piracy scene motivations and its own piracy activity trends. In fact, you can group how software vendors respond to piracy into three stages: Denial, Reaction and Realization.

Let's explore each of these stages in some detail..."

Read the whole article here and if you like it, please Digg it!

- Michael

InishTech and Microsoft Software Licensing and Protection Service

Microsoft has finally spun off their Software Licensing and Protection Services (SLPS) technology:

"In a connected world, software developers of all kinds need the ability to protect their code, license their software, and track the performance and profitability of their products. To fill that need, a new Irish company called InishTech is embarking on a worldwide business venture using software protection and licensing technology developed by Microsoft."

This technology was based on an earlier acquisition of Israel based Secure Dimensions SecureLM technology. You can read more about the history of SLPS here. Late last year, Microsoft announced that no new customer orders would be accepted and then we later heard through the grapevine that most of the Microsoft SLPS team would move on. This was part of a larger reduction in force and streamlining effort going at Microsoft. When I spoke with one of the former SLPS product leads in April, he expressed how difficult it was to integrate into the Microsoft ecosystem and in many ways they were like any other independent vendor trying to partner with Microsoft.

From a V.i. Labs perspective, SLPS is a licensing system, and as we do for customers using Acresso, IBM, Nalpeiron, Reprise Software, SafeNet, and Uniloc, we offer value on top of SLPS to protect sensitive IP within .NET applications and provide Piracy Business Intelligence: 

• IP protection - While there is overlap with the SLPS code protection component, CodeArmor Software Protection for .NET offers a more scalable protection for whole assemblies. The SLPS protection technology is best focused on license methods because its virtualization technology is performance intensive.
• Piracy business intelligence – Provides piracy detection and reporting functionality that is embedded within the application operates separately from licensing to help ISV’s recover revenue from unlicensed use.

So I think it's great news that SLPS has a home and can operate independently - software developers/vendors need more options for software licensing for their .NET applications. One thing I hope that improves with the spinoff is the positioning of the solution. Microsoft had marketed this as an anti-piracy solution, a position that I considered not current or accurate. Many of the legacy licensing players have evolved their positioning based on customer reaction and focused their solutions on overuse and compliance.

Essentially, they made sure that their sales people were not positioning licensing as protecting against or combating “overt” piracy – piracy enabled via reverse engineering. SLPS in no different and although their code protection is innovative, it should be positioned as a way to harden the license functions' resistance to tampering and not a solution for stopping piracy.

- Vic

Report from Mass Technology Leadership Council's unConference

A few of us from V.i. Labs attended the Mass Technology Leadership Council's spring unConference this past Friday.

If you're unfamiliar with an "unConference," MassTLC defined it as, "a facilitated, face-to-face, and participant-driven conference centered around a theme or purpose, in this case, the future of software and the Internet." We proposed and facilitated a session on "Brainstorming New Strategies for Growing License Revenue in this Economy."

We had about 15 people in the session with folks from software vendors and (interestingly) law firms. Here are some of the ideas that we discussed (the first two came from us):

• Find ways to identify "customers" you don't know about (businesses that were overtly pirating your software)
• Identify the customers you do know about, but that aren't paying you what they should be (businesses that are exceeding the number of licenses they've paid for)
• Use flexible licensing - make it easy to buy the way customers want to buy (features-based licensing to drive increased use)
• Change your packaging model to let customers adopt features that would otherwise have seemed cost prohibitive - "pick and choose" features
• Adopt "super aggressive" software release cycles - continue to push new features to customers
• Use social networking/social media to enable your user community to vote on new features and announce these new features in a very visible way

As an aside, I was interested to hear one of the attorneys note that "attorneys are among the bluntest and most expensive implements available" when it came to growing license revenue from piracy. The attorney noted that it is "rare that it makes sense to sue people" and that threshold for deciding to pursue a case was around the $2 million mark.

All in all, the whole unConference was a great experience with great people sharing ideas and experiences they are clearly passionate about. We'd love to hear from other attendees in the comments - let us know if you were in our session and what you thought!

- Michael

BSA: Manufacturing Industry Has Highest Reports of Software Piracy in U.S.

The Business Software Alliance (BSA) reported the top 10 U.S. Industries with the highest reports of software piracy yesterday:

"The Top 10 industries most cited in confidential software piracy reports to BSA by actual informants in 2008 were:"

1. Manufacturing
2. Sales/Distribution
3. Service (general category)
4. Financial Services
5. Software Development
6. IT Consulting
7. Medical
8. Engineering
9. School/Education
10. Consulting

This list is based on actual reports received by the BSA of infringements in the United States - not a survey. It still surprises me when I hear software vendors say that piracy "isn't a big problem" for them and that infringing companies "wouldn't pay for the software anyway."

If manufacturing is the #1 infringing industry in the United States (and they use high value software to design, test and build their products), it seems that software vendors really need to determine the true scope of their piracy problem and identify the businesses they can recover revenue from.

Finding Software Pirates with CodeArmor Intelligence and Google Maps

Today we announced the latest version of CodeArmor Intelligence that adds integration with Google Maps and enhanced gateway server filtering that uses rules to modify, delete or log data before sending it to the reporting interface. It uses regular expressions to create rules to focus on what data gets reported or selectively exclude certain data based on geography.

Let us know what you think in the comments!

- Michael