Chilling Effects
Home Weather Reports Report Receiving a Cease and Desist Notice Search the Database Topics
Sending
Topic HomeFAQsMonitoring the legal climate for Internet activity
Samuelson Law, Technology and Public Policy Clinic
 Chilling Effects Clearinghouse > Reverse Engineering > Notices > Websense incensed at the posting of their proprietary code Printer-friendly version

Websense incensed at the posting of their proprietary code

November 15, 2002

 

Sender Information:
Websense Inc.
Sent by: [Private]
[Private]
Delaware, USA

Recipient Information:
[Private]
ECSC Ltd.
Bradford, UK


Sent via: postal mail
Re:

Dear Mr. [private],

It has recently come to our attention that a website under your control contains
purportedly reverse-engineered source code that is the copyrighted property of Websense, Inc., a company organized under the laws of Delaware, USA. Our source code is also the proprietary information of Websense, Inc., proteced by trade secret law. The code appears to have posted by one of your employees, [private], at the following URL: http://people.ecsc.co.uk/~gianni/.

As you may know, Websense, Inc. is a publicly-traded leading provider of goods and services involving Internet content filtering and access management. Websense, Inc. has spent a great deal of time and money creating and developing our software products in order to promote and sell them throughout the world. We have developed a significant competitive advantage in the marketplace through the design of our proprietary product offerings.

As a publicly-traded company and the owner of the copyrighted and proprietary source code, we owe an important duty to our shareholders to protect our assets to the fullest, particularly our income-generating assets. For this reason, we must be alert to unauthorized use or copying of our source code, and to stop those who would reveal our proprietary information without our permission or otherwise lessen the value of intellectual property that we have spent millions of dollars to create.

Therefore, Websense, Inc. must inist that you agree to immediately stop disclosing Websense copyrighted and proprietary information and that you agree to immediately revise your web pages to remove all copies or references to Websense source code.

Finally, I expect that Cisco Systems, a business partner to both of our companies, feels similarly with respect to the diminuation of value of proprietary technology that is offered for sale to their customers. To this end, I intend to contact them to discuss our mutual problem.

We would prefer to resolve this matter amicably and without resort to formal legal action. We would appreciate your response within 5 days of the date of this letter. If you have any questions or wish to discuss this matter please do not hesitate to contact me. My direct telephone number [ ] is and my direct fax is [ ].

Sincerely,

[signed]

[private]
Vice President, General Counsel

 
FAQ: Questions and Answers

[back to notice text]


Question: Does this information apply in other countries too?

Answer: Chilling Effects is a United States organization and information on this website is based on U.S. law. Other countries' laws differ, often significantly, so you should not assume that the analyses presented here apply outside the United States. If you have further questions about non-U.S. law, we recommend contacting a lawyer in your jurisdiction.


[back to notice text]


Question: Is a cease-and-desist letter confidential?

Answer: There is ordinarily no expectation of privacy or confidentiality in a letter sent to an adversary. Unless you have made a specific promise of confidentiality beforehand, such as in a protective agreement or NDA, a letter demanding confidentiality doesn't bind you.


[back to notice text]


Question: Is reverse engineering legal?

Answer: Reverse engineering has long been held a legitimate form of discovery in both legislation and court opinions. The Supreme Court has confronted the issue of reverse engineering in mechanical technologies several times, upholding it under the principles that it is an important method of the dissemination of ideas and that it encourages innovation in the marketplace. The Supreme Court addressed the first principle in Kewanee Oil v. Bicron, a case involving trade secret protection over synthetic crystals manufacturing by defining reverse engineering as "a fair and honest means of starting with the known product and working backwards to divine the process which aided in its development or manufacture." [416 U.S. 470, 476 (1974)] The principle that reverse engineering encourages innovation was articulated in Bonito Boats. v. Thunder Craft, a case involving laws forbidding the reverse engineering of the molding process of boat hulls, when the Supreme Court said that "the competitive reality of reverse engineering may act as a spur to the inventor, creating an incentive to develop inventions that meet the rigorous requirements of patentability." [489 U.S. 141 160 (1989)]

Congress has also passed legislation in a number of different technological areas specifically permitting reverse engineering. The Semiconductor Chip Protection Act (SCPA) explicitly includes a reverse engineering privilege allowing semiconductor chip designers to study the layout of circuits and incorporate that knowledge into the design of new chips. The Competition of Contracting Act of 1984 allows the defense industry to inspect and analyze the spare parts it purchases in order to facilitate competition in government contracts.

The law regarding reverse engineering in the computer software and hardware context is less clear, but has been described by many courts as an important part of software development. The reverse engineering of software faces considerable legal challenges due to the enforcement of anti reverse engineering licensing provisions and the prohibition on the circumvention of technologies embedded within protection measures. By enforcing these legal mechanisms, courts are not required to examine the reverse engineering restrictions under federal intellectual property law. In circumstances involving anti reverse engineering licensing provisions, courts must first determine whether the enforcement of these provisions within contracts are preempted by federal intellectual property law considerations. Under DMCA claims involving the circumvention of technological protection systems, courts analyze whether or not the reverse engineering in question qualifies under any of the exemptions contained within the law.


[back to notice text]


Question: What kind of proof is necessary to show the copying of a computer program?

Answer: Courts determine whether or not copying occurred, rather that the independent creation of a program, by comparing the two programs for evidence of copyright infringement. The determination of copyright infringement is done through an analysis of whether there exists a "substantial similarity" between the initial work and the product of the reverse engineering effort. Making such a determination can be quite complicated in the software context since different parts of the computer code may be similar due to the industry standards of the overall structure and user interface of programs as well as their compatibility requirements. In order to prove a claim of copyright infringement, the burden is on the initial work's owner to show that the defendant had access to the original code.


[back to notice text]


Question: What is reverse engineering?

Answer: Reverse engineering is the general process of analyzing a technology specifically to ascertain how it was designed or how it operates. This kind of inquiry engages individuals in a constructive learning process about the operation of systems and products. Reverse engineering as a method is not confined to any particular purpose, but is often an important part of the scientific method and technological development. The process of taking something apart and revealing the way in which it works is often an effective way to learn how to build a technology or make improvements to it.

Through reverse engineering, a researcher gathers the technical data necessary for the documentation of the operation of a technology or component of a system. In "black box" reverse engineering, systems are observed without examining internal structure, while in "white box" reverse engineering the inner workings of the system are inspected.

When reverse engineering software, researchers are able to examine the strength of systems and identify their weaknesses in terms of performance, security, and interoperability. The reverse engineering process allows researchers to understand both how a program works and also what aspects of the program contribute to its not working. Independent manufacturers can participate in a competitive market that rewards the improvements made on dominant products. For example, security audits, which allow users of software to better protect their systems and networks by revealing security flaws, require reverse engineering. The creation of better designs and the interoperability of existing products often begin with reverse engineering.


[back to notice text]


Question: What is the difference between source code and object code?

Answer: Source code is the category of computer language instructions that is most frequently written and read by software programmers. A computer cannot generally run a program in source code form though. The source code is translated, with the use of an assembler or compiler, into a language form that contains instructions to the computer known as object code. Object code consists of numeric codes specifying each of the computer instructions that must be executed, as well as the locations in memory of the data on which the instructions are to operate.

While source code and object code are commonly referred to as different classes of computer language, these terms actually describe the series of transformations a program goes through when being converted from a higher level language more easily comprehensible to humans to the lower level language of computer operations.


[back to notice text]


Question: What kinds of things are copyrightable?

Answer: In order for material to be copyrightable, it must be original and must be in a fixed medium.

Only material that originated with the author can support a copyright. Items from the public domain which appear in a work, as well as work borrowed from others, cannot be the subject of an infringement claim. Also, certain stock material might not be copyrightable, such as footage that indicates a location like the standard shots of San Francisco in Star Trek IV: The Voyage Home. Also exempted are stock characters like the noisy punk rocker who gets the Vulcan death grip in Star Trek IV.

The requirement that works be in a fixed medium leaves out certain forms of expression, most notably choreography and oral performances such as speeches. For instance, if I perform a Klingon death wail in a local park, my performance is not copyrightable. However, if I film the performance, then the film is copyrightable.

Single words and short phrases are generally not protected by copyright, even when the name has been "coined" or newly-created by the mark owner. Logos that include original design elements can be protected under copyright or under trademark. Otherwise, words, phrases and titles may be protected only by trademark, however.


[back to notice text]


Question: What elements of a computer program are copyrightable?

Answer: Section 102(b) of the Copyright Act provides that:

"in no case does copyright protection for an original work of authorship extend to any idea, procedure, process, system, method of operation, concept, principle, or discovery, regardless of the form in which it is described, explained, illustrated, or embodied in such work."

This principle that copyright protects the expression of an idea but not the idea itself is fundamental to copyright law. Commonly referred to as the "idea/expression dichotomy," this distinction is particularly complicated in the context of computer programs. A software program must include many elements of computer code that are external to its particular use in order to function properly, including the specifications of the of the operating system, the computer on which the program runs, compatibility with other programs, and other widely accepted standards. These functional elements of a software program as well as those aspects of the software code that are in the public domain are considered ideas not protected by copyright law.


[back to notice text]


Question: What is a trade secret?

Answer: A trade secret is business information that is the subject of reasonable efforts to preserve confidentiality and has value because it is not generally known in the trade. Such confidential information will be protected against those who obtain access through improper methods or by breach of confidence. Infringement on a trade secret is a tort and a type of unfair competition. Every alleged infringement of a trade secret involves two main issues: (1) whether there is valuable and secret business information; and (2) whether this defendant used improper means to obtain that information.


[back to notice text]


Question: Does trade secret protection of information contained within a product restrict reverse engineering?

Answer: Increasingly, manufacturers protect the know-how behind their software and electronics through the use of trade secret protection. This form of protection is attractive since the kinds of information that trade secrets is very broad and can include "any formula, pattern, device or compilation of information which is used in one's business, and which gives him an opportunity to obtain an advantage over competitors who do not know or use it." [Restatement of Torts, ?757] Among other factors, the status of a trade secret depends on the efforts undertaken by the owner to maintain the secrecy of the information. Since there is no time limitation on its enforceability, trade secrets can potentially provide eternal protection for software. Trade secrets terminate and become public domain information if they are publicly disclosed for any reason, however, including the widespread publication of the information on the Internet. Reverse engineering and independent discovery of the technical information within a product s are considered legally viable means of ending another's trade secret, provided that the product is obtained lawfully. Trade secret misappropriation is found when the trade secret is used or disclosed through "improper means," which includes illegal conduct or conduct that violates a generally accepted standard of commercial morality. The explicit prohibition on reverse engineering is therefore not the only licensing provision one must consider in determining whether reverse engineering will be considered legitimate. For example, a common cause of action in a trade secret case involving an anti reverse engineering contract provision is the duty of confidentiality. Depending on the facts of the case, the court must determine whether the confidentiality required in regards to the information was established by marking those specific parts as proprietary or as restricted technical information and informing employees working with such information of their duty to preserve its confidentiality. The disclosure of such information to a third party may be considered trade secret misappropriation and may create liability for both the party which disclosed the information and the party who received it.


[back to notice text]


Question: What is vicarious liability?

Answer: Vicarious liability, a form of indirect copyright infringement, is found where an operator has (1) the right and ability to control users and (2) a direct financial benefit from allowing their acts of piracy. User agreements or Acceptable Use Policies may be evidence of an operator's authority over users. The financial benefit may include a subscription fee, advertising revenues, or even a bartered exchange for other copyrighted. Under the doctrine of vicarious liability, you may be found liable even if you do not have specific knowledge of infringing acts occurring on your site.


[back to notice text]


Question: When is a company deemed "publically traded"?

Answer: A publically traded company is one which trades stock on any of the stock exchanges such as the NASDAQ or New York Stock Exchange. Any member of the public can buy and sell shares of the company stock.


[back to notice text]


Question: What is fair use?

Answer: Copyright law seeks to promote the production and distribution of creative works by conferring property rights on authors. The principle of fair use serves to mediate between these property rights and the constitutional rights of public access and free speech embodied in the First Amendment. Fair use serves an important social function by allowing for the use of parts of creative works for the sake of criticism, commentary, and reporting.

To decide whether a use is "fair use" or not, courts consider:

  1. the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit education purposes;
  2. the nature of the copyrighted work;
  3. the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and,
  4. the effect of the use upon the potential market for or value of the copyrighted work.[17 U.S.C. 107(1-4)]

The principles of fair use are invoked when the transaction costs associated with gaining authorization from copyright owners to make use of works is too burdensome in reasonable circumstances. Fair use also permits the reproduction of art and information for the private, noncommercial sharing of those works. Fair use allows for market competitors to use copyrighted works in ways that allow them to extract the public domain aspects of those works in order to develop innovative products.


[back to notice text]


Question: What kind of proof is necessary to show the copying of a computer program?

Answer: Courts determine whether or not copying occurred, rather that the independent creation of a program, by comparing the two programs for evidence of copyright infringement. The determination of copyright infringement is done through an analysis of whether there exists a "substantial similarity" between the initial work and the product of the reverse engineering effort. Making such a determination can be quite complicated in the software context since different parts of the computer code may be similar due to the industry standards of the overall structure and user interface of programs as well as their compatibility requirements. In order to prove a claim of copyright infringement, the burden is on the initial work's owner to show that the defendant had access to the original code.


[back to notice text]


Question: What "copying" of computer programs is permitted under copyright law?

Answer: Copyright law protects any work, including computer software, that is "fixed in a tangible medium of expression" and which contains a "modicum of originality." While making a copy of an orginal work generally constitutes copyright infringement, the very nature of computer software requires the making of a copy of original elements every time a program runs. In order to solve this problem, Congress included specific exemptions within copyright law outlining the permitted uses of a computer program.

Section 117 of the Copyright Act provides that:

[I]t is not an infringement for the owner of a copy of a computer program to make or authorize the making of another copy or adaptation of that computer program provided:


    1. that such a new copy or adaptation is created as an essential step in the utilization of the computer program in conjunction with a machine and that it used in no other manner, or


    2. that such new copy or adaptation is for archival purposes only and that all archival copies are destroyed in the event that continued possession of the computer program should cease to be rightful.



[back to notice text]


Question: What is "intellectual property"?

Answer: Intellectual property refers to the rights one has in the product of one's intellect. This includes copyright (rights in creative expression)and patents (rights in inventions, discoveries, methods, compositions of matter, etc.) which are granted by article I, section 8 clause 8 of the US Constitution which gives Congress the power to "To promote the Progress of Science and useful Arts, by securing for limited Times to Authors and Inventors the exclusive Right to their respective Writings and Discoveries."

Related rights include trademark (rights in the names one uses to identify one's goods and services), trade secret (confidential business practices), unfair trade practice, passing off, trade libel, false advertising, misappropriation. Laws protecting most of these rights exist at both the state and federal level. "Proprietary rights" is just a general term meaning "one's own rights."


[back to notice text]


Question: What does a request to "cease and desist" mean?

Answer: A request to cease and desist is basically asking the party to immediately stop the infriging behavior and then permanently refrain from it.


[back to notice text]


Question: Why does a web host or blogging service provider get DMCA takedown notices?

Answer: Many copyright claimants are making complaints under the Digital Millennium Copyright Act, Section 512(c)m a safe-harbor for hosts of "Information Residing on Systems or Networks At Direction of Users." This safe harbors give providers immunity from liability for users' possible copyright infringement -- if they "expeditiously" remove material when they get complaints. Whether or not the provider would have been liable for infringement by materials its users post, the provider can avoid the possibility of a lawsuit for money damages by following the DMCA's takedown procedure when it gets a complaint. The person whose information was removed can file a counter-notification if he or she believes the complaint was erroneous.

Question: What does a service provider have to do in order to qualify for safe harbor protection?

Answer: In addition to informing its customers of its policies (discussed above), a service provider must follow the proper notice and takedown procedures (discussed above) and also meet several other requirements in order to qualify for exemption under the safe harbor provisions.

In order to facilitate the notification process in cases of infringement, ISPs which allow users to store information on their networks, such as a web hosting service, must designate an agent that will receive the notices from copyright owners that its network contains material which infringes their intellectual property rights. The service provider must then notify the Copyright Office of the agent's name and address and make that information publicly available on its web site. [512(c)(2)]

Finally, the service provider must not have knowledge that the material or activity is infringing or of the fact that the infringing material exists on its network. [512(c)(1)(A)], [512(d)(1)(A)]. If it does discover such material before being contacted by the copyright owners, it is instructed to remove, or disable access to, the material itself. [512(c)(1)(A)(iii)], [512(d)(1)(C)]. The service provider must not gain any financial benefit that is attributable to the infringing material. [512(c)(1)(B)], [512(d)(2)].


Question: What are the provisions of 17 U.S.C. Section 512(c)(3) & 512(d)(3)?

Answer: Section 512(c)(3) sets out the elements for notification under the DMCA. Subsection A (17 U.S.C. 512(c)(3)(A)) states that to be effective a notification must include: 1) a physical/electronic signature of a person authorized to act on behalf of the owner of the infringed right; 2) identification of the copyrighted works claimed to have been infringed; 3) identification of the material that is claimed to be infringing or to be the subject of infringing activity and that is to be removed; 4) information reasonably sufficient to permit the service provider to contact the complaining party (e.g., the address, telephone number, or email address); 5) a statement that the complaining party has a good faith belief that use of the material is not authorized by the copyright owner; and 6) a statement that information in the complaint is accurate and that the complaining party is authorized to act on behalf of the copyright owner. Subsection B (17 U.S.C. 512(c)(3)(B)) states that if the complaining party does not substantially comply with these requirements the notice will not serve as actual notice for the purpose of Section 512.

Section 512(d)(3), which applies to "information location tools" such as search engines and directories, incorporates the above requirements; however, instead of the identification of the allegedly infringing material, the notification must identify the reference or link to the material claimed to be infringing.


Question: Does a service provider have to follow the safe harbor procedures?

Answer: No. An ISP may choose not to follow the DMCA takedown process, and do without the safe harbor. If it would not be liable under pre-DMCA copyright law (for example, because it is not contributorily or vicariously liable, or because there is no underlying copyright infringement), it can still raise those same defenses if it is sued.


Question: How do I file a DMCA counter-notice?

Answer: If you believe your material was removed because of mistake or misidentification, you can file a "counter notification" asking the service provider to put it back up. Chilling Effects offers a form to build your own counter-notice.

For more information on the DMCA Safe Harbors, see the FAQs on DMCA Safe Harbor. For more information on Copyright and defenses to copyright infringement, see Copyright.


[back to notice text]


Question: Does a cease and desist letter recipient have a duty to remove materials alleged to infringe copyright?

Answer: The cease and desist letter gives its recipient ("you") notice that someone is claiming something you've done or something on your site infringes a copyright. If the materials that are the subject of the notice are in fact infringing, then you do have a duty to remove them, although there may be statutory provisions (DMCA Safe Harbor) that protect you from a lawsuit if the materials were posted by someone else. You may have to give the poster notice of the complaint.

If you do not believe that the materials are infringing, or if you believe that you are making fair use of the materials, you may choose to take the risk of not removing the materials, but a lawsuit might follow in which the complainer tries to prove they they are right and you are wrong. If the accuser obtains a court order, then you must take down the materials.


[back to notice text]


Question: What are the possible penalties for copyright infringement?

Answer: Under the Copyright Act, penalties for copyright infringement can include:

  1. an injunction against further infringement -- such as an order preventing the infringer from future copying or distribution of the copyrighted works
  2. impounding or destruction of infringing copies
  3. damages -- either actual damages and the infringer's profits, or statutory damages
  4. costs and attorney's fees

A copyright owner can only sue for infringement on a work whose copyright was registered with the Copyright Office, and can get statutory damages and attorney's fees only if the copyright registration was filed before infringement or within three months of first publication. (17 U.S.C. 411 and 412)


[back to notice text]


Question: What if I need to contact an attorney?

Answer: This website is meant as an aid to help you decipher Cease and Desist notices so you can make informed decisions about your course of action. If, after reading this, you think the C&D you received might have some merit, or you think you might engage your opponent in battle even if the C&D is, in your opinion, baseless, consultation with an intellectual property attorney is always a good idea. You can find an intellectual property attorney at www.martindale.com or by calling your state or local Bar Association and asking for a referral.


[back to notice text]


Question: How likely is copying to be found (by a court) and what are the possible remedies?

Answer: As mentioned in the legal introduction (see "Is there an infringement?"), a plaintiff must meet certain requirements in order to show that a FanFic author copied protected expression. In order to prove copying, it must be shown that the fan fiction author copied the work (either through direct or indirect evidence), and some of the copied elements are protected and that the "audience" of the work would also find similar elements. Since FanFic authors generally do not deny that characters and settings are borrowed ("copied"), as seen in their disclaimers, it is likely that copying will be found. Then you must raise the defense of fair use.

What happens if I lose the case? If the court finds that you unlawfully copied, it has several possible options. First, and most likely, an injunction could be granted to prevent the author from publishing and distributing the FanFic. The infringing materials could even be destroyed. The court also has the power to award monetary damages. The amount of damages would depend on the lost revenue suffered by the copyright owner and possible profits earned by the FanFic author. Generally, the loss of revenue is rare since FanFic does not draw audiences away from the original; rather, FanFic often serves to enhance sales of the original work. And if FanFic is not for profit, then it is unlikely that the author will have any profits to report. Since there is seldom lost revenue and profits, plaintiffs will often go for "statutory damages." This award can be between $200 (innocent infringement) and $100,000 (willful infringement) for each work infringed.


Topic maintained by Samuelson Law, Technology and Public Policy Clinic

Topic Frequently Asked Questions (and Answers)
Chilling Effects Clearinghouse - www.chillingeffects.org
disclaimer / privacy / about us & contacts