Welcome!

Open Source Authors: Carmen Gonzalez, Pat Romanski, Elizabeth White, Mark R. Hinkle, Phil Whelan

Related Topics: Open Source, Java, SOA & WOA, Virtualization

Open Source: Article

Buying Proprietary Software?

Protect your organization from open source surprises

Open source software has probably been the biggest driver of complex software solutions in the last decade. Access to a large variety of quality, peer-reviewed software has accelerated product development, reduced product introduction intervals and lowered the costs for producers of software and for those of us who leverage third-party software in our projects.

Many of us have heard about the trouble that organizations have come across when using open source improperly... remember Cisco/Linksys, Katzer, and the BusyBox chronicles? You may think that your organization is safe because you are buying proprietary software. However, if your software supplier unknowingly incorporated open source into its product, your organization may face unexpected legal and financial consequences arising from open source licensing obligations and the resulting intellectual property infringement claims. The good news is that there are various tools available at your disposal that can assist your organization in protecting itself from such open source surprises, such as contractual measures such as representations and warranties and indemnities; and extra-contractual tools such as software audits and a structured Open Source Software Adoption Process (OSSAP).

Some Basics About Commercial Contracts Relevant to Software Purchases
Commercial contracts include various provisions that protect and allocate risk among buying and selling parties. Among the most important are representations and warranties ("reps and warranties") and indemnities. Reps and warranties are assurances made by one party that are intended to provide certainty to the other party that relies on them. For example, a hypothetical software company ("Softco Supplier") may represent and warrant that it owns all of the intellectual property rights in the software it sells. If Softco Supplier does not in fact own all of the intellectual property rights in the software, the buyer ("Softco Buyer") has a right to claim damages for Softco Supplier's misrepresentation.

However, in many instances it is impossible for contracting parties to fully guarantee the accuracy of a statement. In these cases, parties opt to provide reps and warranties that are qualified by the knowledge of the party providing them. These types of reps and warranties can be problematic from the perspective of the party that seeks to rely on them. We will return to this in the following section, which specifically deals with the application of reps and warranties, and indemnities to open source.

Indemnities provide security against losses that are triggered by the occurrence of contractually specified events. Unlike reps and warranties, recovery from indemnities is not contingent upon whether a misrepresentation was made. In our example, if Softco Supplier (the "indemnitor") indemnifies Softco Buyer (the "indemnitee") for any intellectual property infringement claims against the software being sold, then in the event that such claims arise, Softco Supplier is obligated to compensate Softco Buyer for its losses.

Reps and Warranties vs. Indemnities in an Open Source World
In the software procurement context, it's important for buyers to determine whether open source code is incorporated into the software that is being purchased. The primary reason for this is that open source license obligations are binding. Failure to comply could have a diminishing impact on software value, as some open source cannot be mixed into products that have trade secret value. In addition, if a buyer purchases software without the knowledge that it includes open source, the buyer runs the risk of commercializing the product in a manner that violates the license that covers the open source code. This can leave the buyer exposed to costly intellectual property infringement claims.

The recent focus on open source reps and warranties and indemnification is linked to the growing instances of intellectual property infringement claims involving open source software. As courts in the United States, Germany and elsewhere have acknowledged the enforceability of open source licenses, notable violators have succumbed to costly settlements, and enforcement organizations such as the Free Software Foundation have become more aggressive in launching suits.

Because of the immense financial and legal implications of intellectual property infringement suits, a software buyer will often require its supplier to represent and warrant that the software being purchased does not contain any open source code. If open source is later discovered in the software, the buyer is entitled to seek damages from the supplier for the breach of the representation. However, as mentioned earlier, it's often difficult for contracting parties to fully attest to the accuracy of a representation. This situation arises in instances in which the contracting party experiences knowledge gaps. In these cases, a contracting party will seek to limit its liability by narrowing the representation to apply to the knowledge that it possesses. Taking our earlier example, if Softco Supplier had acquired code from a third party, or engaged in outsourcing of programming, it may not be positioned to fully attest to the fact that the software it sells does not contain any open source. As a result, Softco Supplier will represent and warrant that ‘to the best of its knowledge, open source is not incorporated into the product.' In this case, Softco Buyer is only entitled to damages if it can show that Softco Supplier knew that its representation was untrue at the time that it was made. If this fact cannot be established, Softco Buyer is left without a remedy for any losses arising from Softco Supplier's misrepresentation.

Unlike reps and warranties, recovery from indemnities is not contingent upon whether a misrepresentation was made. Thus, if Softco Supplier indemnified Softco Buyer for open source infringement claims against the software, Softco Supplier would be obligated to fully cover the losses arising out of any such claims. In this case, it would be irrelevant whether Softco Supplier had knowledge of the presence of open source, as liability is triggered by the occurrence of the contractually specified event (the presence of open source) rather than the misrepresentation made by Softco Supplier.

Buyer's Duty
Another important distinction between reps and warranties and indemnities in our example is in relation to the duty imposed on Softco Buyer to mitigate its own loss. Common law imposes a requirement on parties relying on reps and warranties to take action to mitigate their own losses. In the context of open source reps and warranties, once a software buyer becomes aware that open source is embedded in the software, the buyer must take action to minimize its loss, for example by immediately replacing the code, or making the code freely available. In contrast, there is no parallel requirement for the beneficiaries of indemnities to mitigate their own losses.

Software Audit Can Minimize Exposure
Although open source reps and warranties and indemnities can provide software purchasers with remedies for losses arising from intellectual property infringement suits, they cannot shelter the buyer from being sued in the first place, or from experiencing the loss of goodwill in relation to litigation. As a result, reps and warranties and indemnities should not be regarded as due diligence replacements. Rather than taking the risk of open source surprises, software purchasers can engage resources (internal or external) that have the ability to analyze software to determine the presence of open source prior to executing the purchase.

A software audit entails code scanning aimed at detecting third-party and open source code. After the scanning stage, the purchaser is provided with an audit report detailing the identified code and associated license obligations. Performing such audits at the pre-purchase stage allows the buyer to understand whether the license obligations of the open source code are in line with the intellectual property policies of its organization, and if not, then the buyer is positioned to request the supplier to replace the code in question, or to engage an alternate supplier.

Software Audit in the Supply Chain
One of the contexts in which software audits are particularly beneficial is in the supply chain. Shortly after Cisco acquired Linksys in 2003, it was faced with an infringement suit relating to the use of GPL covered code in its router firmware. It turned out that the infringing chipset was provided to Linksys by Broadcom, which in turn outsourced the development to a third party. As a part of the settlement that was reached, Cisco was forced to make the infringing source code freely available on its website, appoint an open source compliance officer, and make a monetary contribution to the Free Software Foundation. As the Cisco case suggests, software audits can be a helpful tool at the pre-purchase stage when dealing with a supply chain context in which the immediate supplier has little control or knowledge over the code pedigree of the final product.

Review of Available Contractual Tools
Software purchasers have contractual tools (reps and warranties, and indemnities) at their disposal to protect their organizations from open source liabilities; however, it is important to remember that not all tools provide equal protection. While reps and warranties can provide the buyer with a remedy against misrepresentation, in instances where these assurances are qualified by the knowledge of the supplier, the buyer may be left without recourse. From this perspective, indemnities offer increased protection to software purchasers concerned about intellectual property infringement claims in relation to the use of open source.

Open source indemnities are also beneficial in comparison with reps and warranties, as they do not impose an obligation upon the party relying on them to take any action to minimize their own losses in the event of a breach.

Although open source reps and warranties and indemnities can provide software purchasers with means of recovery from intellectual property infringement claims, these contractual measures provide for an imperfect after-the-fact solution to a problem that lends itself well to management practices that would reduce the risk in the first place. Structured open source license management practices and software audits aimed at identifying third-party and open source code and ensuring open source compliance provide an optimal level of protection. These tools provide certainty regarding code pedigree, and enable software purchasers to avoid the negative consequences arising from intellectual property infringement suits.

More Stories By Diana Marina Cooper

Diana Marina Cooper obtained a BA in Politics and Governance and a MA in Globalization Studies. She is currently a JD Candidate (2013), and is pursuing a concentration in Law and Technology. Follow Diana @Diana_M_Cooper

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


@ThingsExpo Stories
The Internet of Things (IoT) is going to require a new way of thinking and of developing software for speed, security and innovation. This requires IT leaders to balance business as usual while anticipating for the next market and technology trends. Cloud provides the right IT asset portfolio to help today’s IT leaders manage the old and prepare for the new. Today the cloud conversation is evolving from private and public to hybrid. This session will provide use cases and insights to reinforce the value of the network in helping organizations to maximize their company’s cloud experience.
SYS-CON Events announced today that Aria Systems, the recurring revenue expert, has been named "Bronze Sponsor" of SYS-CON's 15th International Cloud Expo®, which will take place on November 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Aria Systems helps leading businesses connect their customers with the products and services they love. Industry leaders like Pitney Bowes, Experian, AAA NCNU, VMware, HootSuite and many others choose Aria to power their recurring revenue business and deliver exceptional experiences to their customers.

SUNNYVALE, Calif., Oct. 20, 2014 /PRNewswire/ -- Spansion Inc. (NYSE: CODE), a global leader in embedded systems, today added 96 new products to the Spansion® FM4 Family of flexible microcontrollers (MCUs). Based on the ARM® Cortex®-M4F core, the new MCUs boast a 200 MHz operating frequency and support a diverse set of on-chip peripherals for enhanced human machine interfaces (HMIs) and machine-to-machine (M2M) communications. The rich set of periphera...

The Internet of Things (IoT) is making everything it touches smarter – smart devices, smart cars and smart cities. And lucky us, we’re just beginning to reap the benefits as we work toward a networked society. However, this technology-driven innovation is impacting more than just individuals. The IoT has an environmental impact as well, which brings us to the theme of this month’s #IoTuesday Twitter chat. The ability to remove inefficiencies through connected objects is driving change throughout every sector, including waste management. BigBelly Solar, located just outside of Boston, is trans...
SYS-CON Events announced today that Matrix.org has been named “Silver Sponsor” of Internet of @ThingsExpo, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Matrix is an ambitious new open standard for open, distributed, real-time communication over IP. It defines a new approach for interoperable Instant Messaging and VoIP based on pragmatic HTTP APIs and WebRTC, and provides open source reference implementations to showcase and bootstrap the new standard. Our focus is on simplicity, security, and supporting the fullest feature set.
Predicted by Gartner to add $1.9 trillion to the global economy by 2020, the Internet of Everything (IoE) is based on the idea that devices, systems and services will connect in simple, transparent ways, enabling seamless interactions among devices across brands and sectors. As this vision unfolds, it is clear that no single company can accomplish the level of interoperability required to support the horizontal aspects of the IoE. The AllSeen Alliance, announced in December 2013, was formed with the goal to advance IoE adoption and innovation in the connected home, healthcare, education, aut...
SYS-CON Events announced today that Red Hat, the world's leading provider of open source solutions, will exhibit at Internet of @ThingsExpo, which will take place on November 4–6, 2014, at the Santa Clara Convention Center in Santa Clara, CA. Red Hat is the world's leading provider of open source software solutions, using a community-powered approach to reliable and high-performing cloud, Linux, middleware, storage and virtualization technologies. Red Hat also offers award-winning support, training, and consulting services. As the connective hub in a global network of enterprises, partners, a...
The only place to be June 9-11 is Cloud Expo & @ThingsExpo 2015 East at the Javits Center in New York City. Join us there as delegates from all over the world come to listen to and engage with speakers & sponsors from the leading Cloud Computing, IoT & Big Data companies. Cloud Expo & @ThingsExpo are the leading events covering the booming market of Cloud Computing, IoT & Big Data for the enterprise. Speakers from all over the world will be hand-picked for their ability to explore the economic strategies that utility/cloud computing provides. Whether public, private, or in a hybrid form, clo...
Software AG helps organizations transform into Digital Enterprises, so they can differentiate from competitors and better engage customers, partners and employees. Using the Software AG Suite, companies can close the gap between business and IT to create digital systems of differentiation that drive front-line agility. We offer four on-ramps to the Digital Enterprise: alignment through collaborative process analysis; transformation through portfolio management; agility through process automation and integration; and visibility through intelligent business operations and big data.
Be Among the First 100 to Attend & Receive a Smart Beacon. The Physical Web is an open web project within the Chrome team at Google. Scott Jenson leads a team that is working to leverage the scalability and openness of the web to talk to smart devices. The Physical Web uses bluetooth low energy beacons to broadcast an URL wirelessly using an open protocol. Nearby devices can find all URLs in the room, rank them and let the user pick one from a list. Each device is, in effect, a gateway to a web page. This unlocks entirely new use cases so devices can offer tiny bits of information or simple i...
The Transparent Cloud-computing Consortium (abbreviation: T-Cloud Consortium) will conduct research activities into changes in the computing model as a result of collaboration between "device" and "cloud" and the creation of new value and markets through organic data processing High speed and high quality networks, and dramatic improvements in computer processing capabilities, have greatly changed the nature of applications and made the storing and processing of data on the network commonplace.
The Internet of Things (IoT) is going to require a new way of thinking and of developing software for speed, security and innovation. This requires IT leaders to balance business as usual while anticipating for the next market and technology trends. Cloud provides the right IT asset portfolio to help today’s IT leaders manage the old and prepare for the new. Today the cloud conversation is evolving from private and public to hybrid. This session will provide use cases and insights to reinforce the value of the network in helping organizations to maximize their company’s cloud experience.
Things are being built upon cloud foundations to transform organizations. This CEO Power Panel at 15th Cloud Expo, moderated by Roger Strukhoff, Cloud Expo and @ThingsExpo conference chair, will address the big issues involving these technologies and, more important, the results they will achieve. How important are public, private, and hybrid cloud to the enterprise? How does one define Big Data? And how is the IoT tying all this together?
TechCrunch reported that "Berlin-based relayr, maker of the WunderBar, an Internet of Things (IoT) hardware dev kit which resembles a chunky chocolate bar, has closed a $2.3 million seed round, from unnamed U.S. and Switzerland-based investors. The startup had previously raised a €250,000 friend and family round, and had been on track to close a €500,000 seed earlier this year — but received a higher funding offer from a different set of investors, which is the $2.3M round it’s reporting."
The Industrial Internet revolution is now underway, enabled by connected machines and billions of devices that communicate and collaborate. The massive amounts of Big Data requiring real-time analysis is flooding legacy IT systems and giving way to cloud environments that can handle the unpredictable workloads. Yet many barriers remain until we can fully realize the opportunities and benefits from the convergence of machines and devices with Big Data and the cloud, including interoperability, data security and privacy.
All major researchers estimate there will be tens of billions devices - computers, smartphones, tablets, and sensors - connected to the Internet by 2020. This number will continue to grow at a rapid pace for the next several decades. Over the summer Gartner released its much anticipated annual Hype Cycle report and the big news is that Internet of Things has now replaced Big Data as the most hyped technology. Indeed, we're hearing more and more about this fascinating new technological paradigm. Every other IT news item seems to be about IoT and its implications on the future of digital busines...
Cultural, regulatory, environmental, political and economic (CREPE) conditions over the past decade are creating cross-industry solution spaces that require processes and technologies from both the Internet of Things (IoT), and Data Management and Analytics (DMA). These solution spaces are evolving into Sensor Analytics Ecosystems (SAE) that represent significant new opportunities for organizations of all types. Public Utilities throughout the world, providing electricity, natural gas and water, are pursuing SmartGrid initiatives that represent one of the more mature examples of SAE. We have s...
The Internet of Things needs an entirely new security model, or does it? Can we save some old and tested controls for the latest emerging and different technology environments? In his session at Internet of @ThingsExpo, Davi Ottenheimer, EMC Senior Director of Trust, will review hands-on lessons with IoT devices and reveal privacy options and a new risk balance you might not expect.
IoT is still a vague buzzword for many people. In his session at Internet of @ThingsExpo, Mike Kavis, Vice President & Principal Cloud Architect at Cloud Technology Partners, will discuss the business value of IoT that goes far beyond the general public's perception that IoT is all about wearables and home consumer services. The presentation will also discuss how IoT is perceived by investors and how venture capitalist access this space. Other topics to discuss are barriers to success, what is new, what is old, and what the future may hold.
Swiss innovators dizmo Inc. launches its ground-breaking software, which turns any digital surface into an immersive platform. The dizmo platform seamlessly connects digital and physical objects in the home and at the workplace. Dizmo breaks down traditional boundaries between device, operating systems, apps and software, transforming the way users work, play and live. It supports orchestration and collaboration in an unparalleled way enabling any data to instantaneously be accessed on any surface, anywhere and made interactive. Dizmo brings fantasies as seen in Sci-fi movies such as Iro...