UK dev loses ownership claim on forensic software he said he wrote in spare time and licensed to employer
- Reference: 1613543173
- News link: https://www.theregister.co.uk/2021/02/17/md5_software_lawsuit/
- Source link:
Michael Penhallurick claimed he had worked on the “virtual forensic computing" (VFC) software at home and in his free time while being employed by MD5, and that he retained copyright ownership over the software and had merely licensed it to the company.
[1]
MD5, however, claimed that writing the software has been a fundamental part of Penhallurick's employment – and what it paid him £5,000 a month for – and as a result of that and other factors, such as agreements he signed, it owns the code.
The software is used mostly by police forces, and allows investigators to extract files from a seized hard drive and view them in a virtual machine, thereby avoiding altering any evidence on the drive.
[2]
The Intellectual Property Enterprise Court, in London, England, [3]decided in favor of MD5 , with Judge Richard Hacon noting a contract the company and Penhallurick had signed effectively gave MD5 ownership rights to the software it released and sold.
For his part, Penhallurick – a former South Yorkshire Police officer – said his employment contract concerned his expertise on forensics and he was initially employed on that basis. According to him, he was employed “to assist with forensic case work supplied to MD5 by police forces and his primary duties were to carry out forensic computer investigations, prepare witness statements, attend court and give evidence.” He also noted that he spent a lot of time working on the software on his home computer, at home, and in his spare time.
MD5 meanwhile argued that Penhallurick's duties “were more flexible and extensive than this," the judge noted: "MD5 further says that if Mr Penhallurick created any VFC software before the start of his employment it formed no part of the VFC software created for MD5.”
A contract's a contract
The reality, the judge decided, was that everyone was aware that Penhallurick was working on the VFC software, that he created multiple versions of it with improvements and enhancements, and that MD5 was selling these builds to people, paying the programmer a cut of sales.
Penhallurick started work on VFC in 2005, based on research he carried out during an MSc degree at Cranfield University in the three years prior, having learned of VMware and its virtualization tools in 2001.
When he met the owners of MD5, he outlined the manual method he used to pull files and observe them in a virtual environment, and agreed with MD5 to develop software that would automate the task, which he did. He joined the biz at the end of 2006, and by the next year, MD5 was selling VFC to customers.
Looking for a new IT job? This week's list includes roles for software engineers, DC managers, cloud experts and support specialists [4]READ MORE
But there was a clear disparity between the two sides over who would ultimately own the software. MD5 felt it had full ownership and was paying Penhallurick a salary and cut of sales in payment; Penhallurick felt he ultimately remained the owner of the software. That disparity led to a contract in 2008 that Penhallurick and MD5 signed under which Penhallurick was given a bonus of 7.5 per cent of annual VFC sales by MD5. A further agreement in 2011 increased the bonus to 10 per cent – Penhallurick felt these payments were a license royalty rather than a bonus.
Crucially, although Penhallurick insisted he had licensed his software to MD5, it emerged during the case's proceedings that no evidence of such a license agreement existed. Meanwhile, the end-user license agreement bundled with the application noted that MD5 was the licensor, and Penhallurick had approved its wording.
Although the judge noted that none of the contracts had been put together by lawyers, leaving dangerous ambiguities that ultimately led to the lawsuit, he felt it was clear from the various bits of paperwork signed over the years that MD5 had engaged the programmer to produce and update the software, and that the company owned the copyright from the first official version.
It all fell apart after Penhallurick resigned in 2016 and then, in January 2018, when MD5 stopped paying him for the code. The dispute clearly grew rancorous, with MD5 accusing Penhallurick of leaving the company with a third version of the software with certain functions cut out, and Penhallurick allegedly telling third parties that MD5 has no rights over the software.
But those disputes are largely brushed off in the court’s decision, published on Monday this week following a hearing in July, which ruled that MD5 owns the released and sold software, had paid Penhallurick for it, and that was that.
[5]
Which should be a salutary lesson to all software developers: if you're working on a personal project, check your employment contract and employee rights to ensure your work doesn't ultimately belong to your boss. ®
Get our [6]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YCz3TGDV6wOKO@eb4uby5AAAABc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YCz3TGDV6wOKO@eb4uby5AAAABc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[3] https://www.bailii.org/ew/cases/EWHC/IPEC/2021/293.html
[4] https://www.theregister.com/2021/02/12/jobs_for_all/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_software/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YCz3TGDV6wOKO@eb4uby5AAAABc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://whitepapers.theregister.com/
Isn't that what the "productive weekend" you have right after your last day of employment is for??
No evidence of a license
"Crucially, although Penhallurick insisted he had licensed his software to MD5, it emerged during the case's proceedings that no evidence of such a license agreement existed"
Yep, crucial.
Re: No evidence of a license
"...was paying Penhallurick a salary and cut of sales in payment"
"Penhallurick resigned in 2016... in January 2018 ... MD5 stopped paying him for the code."
That looks like evidence of some sort of agreement at one time. Though maybe not what you would call a "licence" agrement
A smart man but not a wise one.
teach them how to use dd
anyone can create a clone from a device using dd
I would hope that most forensics teams would know and use dd rather than some commercial toolset that would be trivial to subvert with a aggrieved principle author...
the mind boggles
Re: teach them how to use dd
If you think DD works on every and all devices with storage, I have some bad news for you.
British Law is pretty vicious on this
Most contracts have an IP "duration" clause that basically means there is no such thing in law as "spare time". If you built anything of any interest during the period you were employed, then your employer can claim it is theirs and will almost always win in a British court, even if what you created was of only very limited relationship to your day-job e.g. "runs on a computer and makes money".
Best thing is to ask for an explicit exclusion from those clauses for anything you do in your spare time or risk being sued. For software developers this is a very real likelihood as I understand it.
Re: British Law is pretty vicious on this
Correct, same on the continent actually. I know of employees asking and getting exemptions for developing software in their spare time that was completely unrelated to the business of the company they work for. In this case, that would be hard.
Re: British Law is pretty vicious on this
Not in Germany, as far as I know. I mean, companies may well try to push for this, but generally 69b (programs written during employment belong to the employer) is limited to programs written "in furtherance of one's (work) tasks or orders of the employer". So while the judgment in this case would indeed have been made the same way, it does not apply to unrelated work, even when made during the period of employment. Avoid writing your private software at work, avoid using it at work, and you should be fine.
Note: this only applies barring other agreements in your contract.
You only release once??
The reality, the judge decided, was… that he created multiple versions of it with improvements and enhancements….
It says that as though that's relevant and implies that it's an indicator that he was doing this as part of his employment. Do they really think that people doing spare-time development never update their software products?!?
Re: You only release once??
You're reading a summary of the judge's summary of the evidence. It's possible that those changes were discussed with his employers or the need for them came to light in cases he handled during his employment. Remember two things about judges when reading a case report: they've seen and heard all the evidence and they've got where they are by being smart and experienced.
"Which should be a salutary lesson to all software developers: if you're working on a personal project, check your employment contract and employee rights to ensure your work doesn't ultimately belong to your boss."
Check it before you sign it.
Previous employer tried to issue me a contract that was not just restricted to software. Any copyrightable work had to be offered to the company for first refusal. The contract looked like a cut/paste/edit job from a generic HR book.
As a serious amateur photographer I could take a few hundred pictures a week. Every single one of which is immediately copyrightable, even if just a holiday snap. I pointed this out to HR and the contract was amended (before signing).
The process for submitting your off-time works to the legal team was not geared up for bulk submissions and would have taken up my entire working week, every week.
That would have been really funny though - You're paying me, but to fulfil my contract I can't actually do any work...
I don't do much development now, but I am pretty sure the company I work for retains copyright on anything developed by company employees, using company facilities and on company time. I did used to do a fair amount of development work, both in and out of work, and while I do retain the copyright on anything I've developed on my own facilities in my own time, I consider anything developed during work time to be owned by my employer.
That said, everything I have developed during work time has been specifically designed for the needs of my employer, so I doubt anyone outside my company would be interested in the software *anyway*. Hell, most of it was developed for specific projects within the company, so isn't even in use within the company anymore.
" Which should be a salutary lesson to all software developers: if you're working on a personal project, check your employment contract and employee rights to ensure your work doesn't ultimately belong to your boss. "
RTF... Contract.
Seriously. And the agreements you signed on the side. I actually contacted legal of the new employer before signing. Fortunately I'm mostly doing development on 1) code that is not interesting to most, there's maybe five people in the world using it 2) was largely developed in a previous job before I signed up with this company and 3) has always been licensed under the GPL. Legal agreed that they now know about this, and are ok with it, still got the email archived.
Any (completely) new (I guess commercially viable, I'm not running any old Lego Mindstorms program past them, when I finally buy one) project, even if I develop it in my spare time, would need to be run past the company, who could call dibbs on it and claim it as their property. Again, I signed up to this, knowing and accepting it, and they know that I do FOSS stuff, which they cannot claim as their own.