SIIA Audit Blog http://www.scottandscottllp.com/main/blogentry.aspx?blogid=174 2012-05-17T14:59:42.2108526Z en-US SIIA’s Corporate Content Anti-Piracy Program Continues Apace http://www.scottandscottllp.com/main/SIIA_Program_Continues_Apace.aspx?blogid=174 The Software & Information Industry Association (SIIA) is well known for contacting businesses regarding claims of copyright infringement based un unlicensed use of its members’ software. The audit process associated with those matters can be arduous, and fines payable to the SIIA at the conclusion of an audit can be, in some cases, crippling to a company’s bottom line. However, the SIIA does not limit itself to copyright claims related to software.

]]> 2011-09-06T15:17:38Z The Software & Information Industry Association (SIIA) is well known for contacting businesses regarding claims of copyright infringement based on unlicensed use of its members’ software. The audit process associated with those matters can be arduous, and fines payable to the SIIA at the conclusion of an audit can be, in some cases, crippling to a company’s bottom line. However, the SIIA does not limit itself to copyright claims related to software.

In a recent press release, the SIIA announced a settlement with a California building-contractor company that it had accused of internally copying and distributing to its employees a newsletter about California occupational health and safety, for which it had purchased only a single subscription. The inclusion or amount of any monetary penalty included among the settlement terms is not mentioned in the press release. However, in our experience the SIIA rarely releases any claim without requiring a targeted business to pay a significant fine. In addition, any kind of copyright-related investigation is almost always disruptive and costly to a business’ daily operations.

Notwithstanding the SIIA’s slickly pejorative labeling of such companies as content “pirates,” many business owners and managers simply are unaware of all of the implications of using or distributing original content that they purchase – be it newsletters or desktop software. In cases where content acquired from third parties is not clearly described in a written license agreement that company management has read and understands, it makes sense to consult with legal counsel before making assumptions about if and how that content may be accessed, copied, distributed, or incorporated with other company deliverables. And if the SIIA comes knocking with an audit demand, the very first call should be an attorney who is knowledgeable regarding the legal and strategic implications of acceding to that demand.

]]> SIIA Calls for More Flexibility in Cloud Security Requirements http://www.scottandscottllp.com/main/SIIA_Calls_for_More_Flexibility_in_Cloud_Security_Requirements.aspx?blogid=174 The Obama Administration announced last week that it is considering expediting cloud computing certification for federal agencies by relaxing some of the security requirements issued by the General Services Administration (GSA) in November of 2010. This apparently is a response to comments issued by, among others, the Software and Information Industry Association (SIIA), which argued that the one-size-fits-all approach to cloud security requirements issued by the GSA in November was impractical and outdated. “The SIIA’s point is that the nature of services offered by some cloud platforms is such that they do not require the highest level of security measures, and I tend to agree with them,” says Andrew Martin, technology and new media attorney with Scott & Scott, LLP. “Different sets of requirements for different categories of web-based solutions likely will help to avoid forcing vendors to integrate inefficient and unnecessary functionality into their products. Private-sector organizations should consider a similar service category-based technique when evaluating cloud vendors in order to promote efficiency during negotiations for the service.” For more information, please contact Mr. Martin at 800-596-6176 or amartin@scottandscottllp.com.

]]> 2011-02-25T17:03:55Z The Obama Administration announced last week that it is considering expediting cloud computing certification for federal agencies by relaxing some of the security requirements issued by the General Services Administration (GSA) in November of 2010. This apparently is a response to comments issued by, among others, the Software and Information Industry Association (SIIA), which argued that the one-size-fits-all approach to cloud security requirements issued by the GSA in November was impractical and outdated. “The SIIA’s point is that the nature of services offered by some cloud platforms is such that they do not require the highest level of security measures, and I tend to agree with them,” says Andrew Martin, technology and new media attorney with Scott & Scott, LLP. “Different sets of requirements for different categories of web-based solutions likely will help to avoid forcing vendors to integrate inefficient and unnecessary functionality into their products. Private-sector organizations should consider a similar service category-based technique when evaluating cloud vendors in order to promote efficiency during negotiations for the service.” For more information, please contact Mr. Martin at 800-596-6176 or amartin@scottandscottllp.com.

]]> Effective Dates in Software Audits Are Critically Important http://www.scottandscottllp.com/main/Effective_Dates_Critical_SIIA.aspx?blogid=174 Businesses that receive software audit demand letters from auditing entities such as the BSA or SIIA, or from software companies like Autodesk or Microsoft, often contend they cleaned up their network after receipt of the letter and should be released from any further obligation to conduct an audit or communicate with the auditor.  Audited business should keep in mind, however, that the auditing entities typically are focused only on the targeted businesses’ software license-compliance status as of the audit effective date – the date on the first letter those entities send to a targeted business.  The auditing entities usually will seek confirmation that the businesses were compliant on the effective date, and on no other date.

]]> 2011-01-18T11:15:29Z Businesses that receive software audit demand letters from auditing entities such as the BSA or SIIA, or from software companies like Autodesk or Microsoft, often contend they cleaned up their network after receipt of the letter and should be released from any further obligation to conduct an audit or communicate with the auditor.  Audited business should keep in mind, however, that the auditing entities typically are focused only on the targeted businesses’ software license-compliance status as of the audit effective date – the date on the first letter those entities send to a targeted business.  The auditing entities usually will seek confirmation that the businesses were compliant on the effective date, and on no other date.

Because computer networks may change rapidly, the auditors need to identify a moment in time for which they can ask the audited business, “Did you have all of the licenses for the software installed on your computers?”  If the answer is yes, the auditing entity will typically close its file.  If the answer is no, the auditing entity will claim the business engaged in copyright infringement on the effective date.  The business’ representation that it was compliant after the effective date has no bearing on whether the business engaged in copyright infringement on the effective date.  If the matter proceeds to a lawsuit, the auditor likely would claim that the business infringed its or its members’ copyrights on the effective date.

The auditing entity typically demands proof of purchase documentation that demonstrates the ownership of a sufficient number of licenses on or before the effective date.  Software purchased after the effective date is not relevant to the audit.  Locating, reviewing, and compiling the proof of purchase documentation is a collective effort that often requires coordination among various individuals and departments within an organization.  In addition, identifying and listing all of the software on the company’s computers as of the effective date may be made doubly difficult when computers contain large amounts of software irrelevant to the audit. It is also important to keep in mind that software environments change as computers are added, decommissioned, and rebuilt with the ebb and flow of HR turnover.

If you have been contacted by an auditing entity such as the BSA, the SIIA, or a software publisher, you should proceed with caution and should familiarize yourself with the typical process for such software audits.  Experienced counsel can help to guide you through that process and to avoid unnecessarily large expenses.

]]> Costly Software Audit Mistakes http://www.scottandscottllp.com/main/Costly_Software_Audit_Mistakes_SIIA.aspx?blogid=174 The Business Software Alliance (BSA) and the Software & Information Industry Association (SIIA) are organizations that represent software publishers seeking to enforce the copyrights in the products they publish.  In furtherance of this goal, these entities routinely send letters to businesses they believe may be infringing their members’ copyrights by failing to satisfy the requirements of applicable software license agreements.  In the letter, the BSA and SIIA request audits of all member software products installed on all computers and servers owned by the targeted businesses.

]]> 2011-01-18T11:10:31Z The Business Software Alliance (BSA) and the Software & Information Industry Association (SIIA) are organizations that represent software publishers seeking to enforce the copyrights in the products they publish.  In furtherance of this goal, these entities routinely send letters to businesses they believe may be infringing their members’ copyrights by failing to satisfy the requirements of applicable software license agreements.  In the letter, the BSA and SIIA request audits of all member software products installed on all computers and servers owned by the targeted businesses.

The audit process is lengthy and arduous and often is affected by costly mistakes.  One of those mistakes involves the use of an inadequate tool to conduct the kind of audit called for by the auditing entity. There are many ways a business may tackle the audit process.  It may hire a law firm that specializes in software audits to conduct the review, it may hire external IT consultants, or it may proceed with its own in-house software audit.  The BSA often suggests a number of tools to assist with a self-audit, sometimes including Novell, Symantec, Frontrange Solutions,  Belarc and Spiceworks. Many of those tools are available for little or no licensing fee, making them appear to be attractive alternatives.

However, if a company chooses to conduct a self-audit, it is essential to verify the results produced by the tool deployed prior to submitting any information to the BSA or SIIA.  Often, software audit tools are not sophisticated enough to discern between free trial software or remnants from previous installations and full installations of licensable software products within the scope of the audit.  Over-reporting can carry significant consequences, because each product mistakenly reported as a full version for which a business is unable to demonstrate license ownership typically entails a penalty at settlement based on the MSRP of that product.  The BSA then typically applies a multiplier for each product included in its settlement offer calculations.

For these reasons, it is important when conducting an in-house software audit to carefully look for any mistakes in the audit results and to ensure that those results accurately reflect what was installed as of the effective date of the audit requested by the BSA or SIIA.  If there is any doubt regarding the accuracy of those results, it is vital to seek the advice of a knowledgeable attorney or consultant prior to submitting any information to the auditing entity.

]]> Software Information Industry Association (SIIA) Settlement Agreement Provision Regarding Purchase of Software http://www.scottandscottllp.com/main/SIIA_Settlement_Agreement_Provision.aspx?blogid=174 Settlement Agreements with the SIIA, a trade association for the software and digital content industry, often contain provisions requiring the audited company to not only purchase software to satisfy licensing deficiencies it carries going forward after settlement, but also to purchase software from an “authorized reseller.” An authorized reseller is a vendor with permission to sell the software publisher’s products. Software publishers often publish lists of authorized vendors on their websites. Many audited companies looking to rectify past purchasing oversights by buying software from the first reputable vendor they locate may breach their SIIA settlement agreement if the agreement contained the provision requiring that all purchases must be made from an authorized reseller.

]]> 2011-01-18T11:08:23Z Settlement Agreements with the SIIA, a trade association for the software and digital content industry, often contain provisions requiring the audited company to not only purchase software to satisfy licensing deficiencies it carries going forward after settlement, but also to purchase software from an “authorized reseller.” An authorized reseller is a vendor with permission to sell the software publisher’s products. Software publishers often publish lists of authorized vendors on their websites. Many audited companies looking to rectify past purchasing oversights by buying software from the first reputable vendor they locate may breach their SIIA settlement agreement if the agreement contained the provision requiring that all purchases must be made from an authorized reseller. 

After an SIIA settlement, the audited company must submit a list of software products together with the proof-of-purchase documentation for software it purchased after the date the SIIA sent its initial letter. If the company includes in its list of purchased software any products sold by vendors not authorized to sell an SIIA-member publisher’s software, the SIIA will require the audited company to repurchase the software from an authorized reseller. Companies that do not carefully investigate their vendors’ authorization to sell software may encounter significant unnecessary expenses in repurchasing identical software products. The inability to return most opened software makes purchasing software from unauthorized resellers even more risky.

If your company has been audited by the SIIA, you should contact counsel experienced in guiding companies through the audit matter process to help protect your company from unplanned expenses and unnecessary repurchase of software.

]]> Unpleasant Surprises In BSA & SIIA Software Audits http://www.scottandscottllp.com/main/Unpleasant_Surprises_SIIA.aspx?blogid=174 Many companies who comply with a demand by a software publisher or industry association (such as the BSA or the SIIA) for an internal software audit end up facing significant settlement demands after forwarding their audit materials to the other side. One of the reasons the settlement demands often are so high is the fact that the auditing entities frequently base their demands, in part, on the “unbundled” price of software suites. Thus, where a company may expect to pay a fine based on the MSRP of, for example, one undocumented installation Microsoft Office Professional 2007 ($679), it likely will end up receiving a settlement demand based on the combined MSRPs of each of the components of that undocumented suite: Word ($229), Excel ($229), PowerPoint ($229), Outlook ($110), Publisher ($169), and Access ($229), all totaling $1195. In a typical case these difference add tens of thousands of dollars to the amount in controversy.

]]> 2011-01-18T10:59:48Z Many companies who comply with a demand by a software publisher or industry association (such as the BSA or the SIIA) for an internal software audit end up facing significant settlement demands after forwarding their audit materials to the other side. One of the reasons the settlement demands often are so high is the fact that the auditing entities frequently base their demands, in part, on the “unbundled” price of software suites. Thus, where a company may expect to pay a fine based on the MSRP of, for example, one undocumented installation Microsoft Office Professional 2007 ($679), it likely will end up receiving a settlement demand based on the combined MSRPs of each of the components of that undocumented suite: Word ($229), Excel ($229), PowerPoint ($229), Outlook ($110), Publisher ($169), and Access ($229), all totaling $1195. In a typical case these difference add tens of thousands of dollars to the amount in controversy.

Another way in which publishers or auditing entities raise the amount in controversy in software audits is the attempt to assess separate “fines” for each allegedly infringing installation of a software product. Thus, a company reporting just ten undocumented installations of Office Professional 2007, with no other licensing shortfalls, may receive a settlement offer based on the combined, “unbundled” MSRPs of the component products totaling just shy of $12,000. Moreover, that is before the auditing entity applies any multipliers to that figure (yet another common tactic) or makes any assessments for their claimed legal fees, both of which factors may drive the opening settlement offer in the above example to $40,000 or more.

It is not difficult to see how owners of small to medium businesses who think that they have a handle on their financial exposure in a software audit matter often end up with truly unpleasant surprises after submitting audit materials to the BSA or SIIA that they may have believed would be negotiating on a more equitable basis.

If your business has been accused of software “piracy” and is responding to a software audit demand either from a software publisher like Autodesk or from the BSA or the SIIA, an experienced attorney can give you visibility into the process and help you avoid unpleasant surprises.

]]> Proof of License in SIIA Software Audits http://www.scottandscottllp.com/main/Proof_of_License_SIIA_Audits.aspx?blogid=174 Like all audits, success in a SIIA software audit depends less on what you own and more on what you can prove that you own. Although not required by law, the SIIA takes the position that a target company is out of compliance for each installation of SIIA member software products for which the target company cannot produce a dated proof of purchase. Many clients are dismayed to discover what does and does not constitute valid proof of purchase according to the SIIA.

]]> 2011-01-18T10:57:17Z Like all audits, success in a SIIA software audit depends less on what you own and more on what you can prove that you own. Although not required by law, the SIIA takes the position that a target company is out of compliance for each installation of SIIA member software products for which the target company cannot produce a dated proof of purchase. Many clients are dismayed to discover what does and does not constitute valid proof of purchase according to the SIIA.

Not Considered Valid Proof
1. Copies of Checks to Software Vendors
2. Dated Purchase Orders
3. Undated Software Licenses
4. Credit Card Statements Evidencing Software Purchases
5. Certificates of Authenticity
6. Media, Manuals, or Key-Codes
7. Invoices Bearing and Entity Name Other than the Entity Named in the SIIA’s Initial Letter

Valid Proof of Purchase
1. Dated Invoices in the Name of the Audited Entity
2. Soft Records (online account statements) from Recognized Resellers
3. Signed and Dated License Agreements
4. Soft Records from SIIA Member’s such as Microsoft Licensing Statements
5. Cash Register Receipts for Retail Sales where Product, Version, Quantity and Price Paid are Included.

Understanding how the SIIA analyzes software audit materials is critically important to achieving the most favorable outcome. In our experience, it is the most time consuming and difficult part of the process for clients to handle on their own.

Scott & Scott, LLP is not affiliated in any way with the SIIA.

]]> Software Piracy http://www.scottandscottllp.com/main/Software_Piracy_SIIA.aspx?blogid=174 Software piracy audits conducted by the BSA and the SIIA threaten small and medium sized businesses. As the economy tightens, software publishers such as Microsoft, Adobe, and Autodesk hide behind software piracy enforcement groups to pursue customers accused of installing more software on corporate computers than they have purchased licenses for.

]]> 2011-01-18T10:51:51Z  Software piracy audits conducted by the BSA and the SIIA threaten small and medium sized businesses. As the economy tightens, software publishers such as Microsoft, Adobe, and Autodesk hide behind software piracy enforcement groups to pursue customers accused of installing more software on corporate computers than they have purchased licenses for. If your company has been accused of software piracy, here’s what you should do:

  • Hire an Attorney – BSA and SIIA have experienced software piracy attorneys working for them, you should too.
  • Preserve Evidence – do not uninstall or change computer configurations until an accurate inventory of in-scope computers has been gathered.
  • Avoid Knee-Jerk Purchases – a natural but counterproductive response to a software piracy audit is to run out and purchase software. I advise my clients to avoid making purchases until a complete inventory and case assessment has been completed.
  • Maintain Confidentiality – client prepared audit materials and related documentation may be discoverable in a lawsuit. We conduct attorney-supervised audit reports protected by attorney-client and attorney work-product privileges.
  • Condition Audit Disclosure – software piracy audit materials should only be disclosed after an appropriate agreement regarding confidentiality and non-use of the information has been signed by the software piracy enforcement agency.
  • Estimate Software Piracy Fines – always review the draft audit materials with your attorney before they are produced to make sure everyone is clear on the potential financial exposure involved. Our software piracy fine calculators are available at: BSA Fine Calculator and SIIA Fine Calculator
  • Argue Software Piracy Legal Issues – there are many legal issues involved in software piracy audits including what constitutes infringement, who has the burden of proof, how damages should be calculated, what constitutes proof of ownership and many others. We vigorously argue these legal points in an effort to reduce software piracy settlement demands.
  • Negotiate Non-Monetary Terms – software piracy audit settlement agreements are incredibly one-sided and unfair to the targets. I advise my clients to carefully consider important issues like future audit obligations, confidentiality of the settlement terms, the nature and scope of the release being offered.
  • Focus on Your Business – the only way to be successful in a software piracy audit is to continue to stay focused on running your business and taking care of your clients.

If you have been accused of software piracy please call Scott & Scott, LLP for a free consultation.

]]> Suing the Informant in SIIA Audits http://www.scottandscottllp.com/main/Suing__Informant_SIIA_Audits.aspx?blogid=174 The targets of SIIA audits frequently believe that they know who reported them to the Software & Information Industry Association. Justifiably angry, they want to know what legal recourse they have against the informant. Because the informants are frequently out of work, having been fired by the target, I advise my clients about the number one rule governing litigation: never sue poor people. Legally speaking, the most probable cause of action against an informant in a SIIA audit would be based upon a breach of an employment agreement containing a confidentiality provision. We have frequently assisted clients in drafting letters to former employees presumed to be the informant, forcefully reminding them of their confidentiality obligations, but have come short of advising clients to file suit against a presumed informant.

]]> 2011-01-18T10:44:49Z The targets of SIIA audits frequently believe that they know who reported them to the Software & Information Industry Association. Justifiably angry, they want to know what legal recourse they have against the informant. Because the informants are frequently out of work, having been fired by the target, I advise my clients about the number one rule governing litigation: never sue poor people. Legally speaking, the most probable cause of action against an informant in a SIIA audit would be based upon a breach of an employment agreement containing a confidentiality provision. We have frequently assisted clients in drafting letters to former employees presumed to be the informant, forcefully reminding them of their confidentiality obligations, but have come short of advising clients to file suit against a presumed informant.

Scott & Scott, LLP is not affiliated in any way with the SIIA.

]]> Cooperation or Litigation: SIIA Audit Strategy http://www.scottandscottllp.com/main/Cooperation_or_Litigation_SIIA.aspx?blogid=174 If your company has received a letter from the SIIA requesting a software audit, you are probably wondering whether you should cooperate or tell the SIIA to pound sand. I advise my clients to cooperate but to do so in a manner that will not jeopardize their legal position in the event that cooperation does not result in an acceptable out-of-court settlement. This advice is predicated on the fact that business clients almost universally seek a resolution that has the lowest total costs and the most predictability. In SIIA audits, these costs are software licensing fees, fines payable to the SIIA, attorney’s fees, organizational impact, and the potential damage to brand associated with negative publicity. In my experience, a properly handled BSA audit can always be resolved for a lower total cost through cooperation than through litigation.

]]> 2011-01-18T10:40:20Z If your company has received a letter from the SIIA requesting a software audit, you are probably wondering whether you should cooperate or tell the SIIA to pound sand. I advise my clients to cooperate but to do so in a manner that will not jeopardize their legal position in the event that cooperation does not result in an acceptable out-of-court settlement. This advice is predicated on the fact that business clients almost universally seek a resolution that has the lowest total costs and the most predictability. In SIIA audits, these costs are software licensing fees, fines payable to the SIIA, attorney’s fees, organizational impact, and the potential damage to brand associated with negative publicity. In my experience, a properly handled SIIA audit can always be resolved for a lower total cost through cooperation than through litigation.

Most importantly, cooperation does not preclude litigation in the future if the SIIA is unreasonable in its approach to settlement. In other words, you can always go to court if the out-of-court, lower total cost approach is not satisfactory. However, we have seen audit targets and other lawyers make several mistakes that actually detriment their legal position during negotiations with the SIIA. The two critical success factors to properly handling a SIIA audit or making sure that the information gathered during the process, which would not otherwise be discoverable in a court proceeding, is protected by attorney work-product and attorney client privileges. In addition, no information should be provided to the SIIA unless and until the SIIA agrees that the information is governed by Federal Rule of Evidence 408 and therefore will not be admissible in court if an out-of-court resolution is not reached with the SIIA. The only time I have deviated from this advice has been where the audited entity was not a viable going concern and the principal(s) were judgment proof. If you have been contacted by the SIIA, you should contact an experienced attorney to assist you with strategy.

]]> The Importance of the “Audit Effective Date” in SIIA Audits http://www.scottandscottllp.com/main/Importance_of_Audit_Effective_Date_SIIA.aspx?blogid=174 One of the first things I ask a prospective client is: What is the date on the initial letter you received from the SIIA? The date on the initial in a SIIA letter is often referred to as the Audit Effective Date. This date is important for many reasons. I like to tell my clients that a SIIA audit measures a snap-shot in time – what SIIA member software was installed on the company’s computers as of the Audit Effective Date. Once you have an accurate inventory of what was installed on the Audit Effective Date the next step is to determine what proofs of purchase are available to establish purchases prior to the Audit Effective Date.

]]> 2011-01-18T10:37:24Z One of the first things I ask a prospective client is: What is the date on the initial letter you received from the SIIA? The date on the initial in a SIIA letter is often referred to as the Audit Effective Date. This date is important for many reasons. I like to tell my clients that a SIIA audit measures a snap-shot in time – what SIIA member software was installed on the company’s computers as of the Audit Effective Date. Once you have an accurate inventory of what was installed on the Audit Effective Date the next step is to determine what proofs of purchase are available to establish purchases prior to the Audit Effective Date.

When a SIIA audit matter is settled, the target is required to certify that the audit results provided during the course of negotiations are true and correct as of the Audit Effective Date. For this reason uninstalling software that was installed on the effective date, or purchasing software products after the effective date have no impact on the SIIA’s calculation of fines in SIIA audits. It is critical to obtain an accurate inventory of the software installed on the target company’s computers as quickly as possible following receipt of the initial letter from the SIIA. Failure to understand the importance of the Audit Effective Date, has caused companies to go on software buying sprees in response to a SIIA audit and to report results to the SIIA reflecting the software installed on a date after the Audit Effective Date. I believe that both of these strategies are mistakes that should be avoided.

Scott & Scott, LLP is not affiliated in any way with the SIIA.

]]> Unbundling Software Suites in SIIA Audits http://www.scottandscottllp.com/main/Unbundling_in_SIIA_Audits.aspx?blogid=174 One of the most controversial tactics the SIIA uses when calculating its settlement demands is its practice of unbundling software suites such as Microsoft Office and Adobe Creative Suite. Unbundling occurs when the target of a SIIA audit is unable to provide acceptable proof of purchase for one or more installation of a software suite.

]]> 2011-01-18T10:34:28Z One of the most controversial tactics the SIIA uses when calculating its settlement demands is its practice of unbundling software suites such as Microsoft Office and Adobe Creative Suite. Unbundling occurs when the target of a SIIA audit is unable to provide acceptable proof of purchase for one or more installation of a software suite.

The effect of unbundling is to dramatically and artificially inflate the monetary component of a SIIA settlement because the SIIA calculates its fine based upon the MSRP of each component part of the software. In a SIIA audit involving Microsoft Office for example, the SIIA unbundles the suite by separating Microsoft Outlook, Microsoft Word, Microsoft Excel, Microsoft PowerPoint, and Microsoft Access and then calculates its proposed fine on the basis of the MSRP of each component. This practice results in a proposed fine per installation of approximately $2,000 for a product with a market price ranging from $150 to $350, depending on the version.

In my opinion, the SIIA’s practice of undbundling is completely contrary to law because the software suites of SIIA member publishers are compilations under the copyright law and therefore constitute a single work for purposes of calculating statutory damages for infringement. The U.S. Copyright Act 17 U.S.C. § 101(c) defines a compilation as follows:

A "compilation" is a work formed by the collection and assembling of preexisting materials or of data that are selected, coordinated, or arranged in such a way that the resulting work as a whole constitutes an original work of authorship. The term "compilation" includes collective works.”

The statutory damages provision of the U.S. Copyright Act 17 U.S.C. § 504(c) provides in pertinent part that:

For the purposes of this subsection, all the parts of a compilation or derivative work constitute one work.

Federal court’s have also interpreted these provisions to preclude recovery of statutory damages for the component parts of a compilation. For example, in XOOM v. Imageline, the Court of Appeals for the Fourth Circuit only made one statutory damage award for each compilation of electronic clip art, even though each compilation included thousands of works because “[a]lthough parts of a compilation or derivative work may be ‘regarded as independent works for other purposes[,]’ for purposes of statutory damages, they constitute one work.” XOOM v. Imageline at 285, citing H.R. Rep. No. 94-1476, at 162 (1976).

Similarly, in WB Music Corp. v. RTV Communications Group, 445 F.3d 538 (2d Cir. 2006) the Court of Appeals for the Second Circuit interpreted 17 U.S.C. § 504(c) and discussed the distinction between compilations authorized by the copyright holder that constitute “one work” for statutory damages purposes and collections of separate works compiled by the defendant and never authorized by the copyright holder. Because the software suites implicated in SIIA audits involve separately copyrighted works included in a compilation authorized by the copyright owners, section 504(c) applies and prohibits the award of statutory damages for the component parts of the suite.

Scott & Scott, LLP is not affiliated in any way with the SIIA.

]]> A New Definition of Software Piracy http://www.scottandscottllp.com/main/New_Definition_of_Software_Piracy.aspx?blogid=174 What is software piracy? Like many politically charged phrases, the definition of software piracy is influenced by your financial interests and your viewpoint. The Software & Information Industry Association recognizes several types of piracy, including, softlifting (installing a single licensed copy of software on several machines), unrestricted client access, hard-disk loading, OEM piracy, commercial use of non-commercial software, counterfeiting, CR-R piracy, internet piracy, manufacturing plant sale of overruns, and renting.

]]> 2011-01-18T10:32:32Z What is software piracy? Like many politically charged phrases, the definition of software piracy is influenced by your financial interests and your viewpoint. The Software & Information Industry Association recognizes several types of piracy, including, softlifting (installing a single licensed copy of software on several machines), unrestricted client access, hard-disk loading, OEM piracy, commercial use of non-commercial software, counterfeiting, CR-R piracy, internet piracy, manufacturing plant sale of overruns, and renting.

The Software & Information Industry Association specifically includes unintentional business overuse in its definition of software piracy as follows:

“Softlifting occurs when a person purchases a single licensed copy of a software program and loads it on several machines, in violation of the terms of the license agreement.”


Armed with this definition of software piracy, the Software & Information Industry Association pursues global “anti-piracy” campaigns that include the targeting of many small to medium sized companies. The Software & Information Industry Association accuses these companies of engaging in software piracy and threatens them with litigation unless they voluntarily undergo a self audit. In my experience, the vast majority of the companies targeted by the Software & Information Industry Association are not pirates under anyone’s definition, they have merely failed to maintain financial records related to software purchases that no one, including the software companies, ever told them they were required to keep. In addition, the targets of Software & Information Industry Association audits are not pirates because they never intended to violate software licenses or copyright laws.

Scott & Scott’s Definition of Software Piracy

“Software Piracy is the distribution of counterfeit software and/or use or distribution of authentic software constituting the intentional violation of intellectual property laws.”

Our definition of software piracy differs from that used by the Software & Information Industry Association in that our definition adds emphasis to counterfeiting and expressly excludes the unintentional over deployment of software by end users. Piracy implies theft which under the law requires intent. Any definition of software piracy that includes unintentional over deployment should be rejected. The definition used by the software industry and the Software & Information Industry Association improperly characterizes software owners as thieves because they have been, at most, negligent in the management of their software assets and documents. 

Scott & Scott, LLP is not affiliated in any way with the SIIA.

]]> When to Buy vs. Uninstall in SIIA Audits http://www.scottandscottllp.com/main/Buy_vs_Uninstall_SIIA_Audits.aspx?blogid=174 One of the most common mistakes I encounter in SIIA audits is what I call the post-effective date software buying spree. The buying spree occurs in response to a letter from the SIIA’s attorneys requesting a self audit. Many clients are discouraged to learn that software purchases made after the date of the SIIA’s initial letter have no impact in a SIIA audit matter. For this reason, I advise my clients against scrambling to acquire software in response to a SIIA audit.

]]> 2011-01-18T10:29:23Z One of the most common mistakes I encounter in SIIA audits is what I call the post-effective date software buying spree. The buying spree occurs in response to a letter from the SIIA’s attorneys requesting a self audit. Many clients are discouraged to learn that software purchases made after the date of the SIIA’s initial letter have no impact in a SIIA audit matter. For this reason, I advise my clients against scrambling to acquire software in response to a SIIA audit.

The first thing a target of SIIA audit needs to do is preserve the evidence of SIIA member software products installed on the company’s computers as of the audit effective date. Second, the software installed needs to be reconciled against proof of purchase information to determine whether there is gap between licenses owned and software installed. Third, a decision needs to be made regarding whether to purchase or uninstall any unlicensed software. The SIIA audits only those products installed as of the audit effective date, and accepts only proofs of purchase dated on or before that date.

I advise my clients that regardless of what was installed on the audit effective date, they only need to purchase software licenses for products that they need to use going forward. Although it will not resolve past liability, companies may choose to uninstall unlicensed SIIA member products at the conclusion of the audit matter, rather than purchase unnecessary software simply because it was installed on the effective date. At the conclusion of a SIIA matter, the target must certify that it has come into compliance through the combination of buying and\or uninstalling. 

Scott & Scott, LLP is not affiliated in any way with the SIIA.

]]> SIIA Audit Timeline http://www.scottandscottllp.com/main/SIIA_Audit_Timeline.aspx?blogid=174 One of the top ten questions asked by my clients is “How long does the SIIA self-audit process take from start to finish?” Of course I give the standard lawyer answer: it depends. Here are the steps to a typical SIIA audit.

]]> 2011-01-18T10:18:17Z One of the top ten questions asked by my clients is “How long does the SIIA self-audit process take from start to finish?” Of course I give the standard lawyer answer: it depends. Here are the steps to a typical SIIA audit.

Preparation of Audit Materials (3 to 6 months)

A SIIA audit is a request, under threat of litigation, to compile a listing of all SIIA member software products installed on the audited entity’s computer network as of the Audit Effective Date. The Audit Effective Date is the date on the SIIA initial letter requesting an audit. The first step in preparing this information is conducting an automated inventory of the software products installed on all computers owned or leased by the target company. Once an accurate inventory of the SIIA member software products is completed, the next step is to reconcile the software inventory information with proofs of purchase dated prior to the audit effective date. While there are various ways to prove ownership of a software license, typically an invoice is considered the best evidence of ownership in a SIIA audit. In the typical case, the inventory and reconciliation process takes three to six months.

Secure a Confidentiality and Federal Rule of Evidence 408 Agreement (1 week)

With very limited exceptions, we advise the targets of SIIA audits to cooperate with the self-audit process but to do so in a way that does not compromise their position in the event that an out of court settlement is not possible. We do not disclose any information to the SIIA until it signs an agreement regarding the confidentiality of the information disclosed and specifically limiting the SIIA’s ability to introduce the information as evidence in court. In the typical case, the SIIA will sign our standard agreement within one week.

SIIA Analyzes Self-Audit Materials and Makes a Settlement Demand (3 to 6 months)

After the self-audit materials are submitted by the target of a SIIA audit, the Software & Information Industry Association typically takes three to six months to respond. The SIIA’s response provides its interpretation of the self-audit materials and applies a formula for its initial settlement proposal. The SIIA’s formula for calculating fines is generally three times the unbundled full retail price of the software products installed on the target’s computers plus $3,500 for SIIA’s attorney’s fees. In many instances, the SIIA’s settlement proposal is substantially more than the target may have expected due to differences of opinion regarding what constitutes valid proof of ownership. In our experience, the SIIA usually takes three to six months to make substantive response following the submission of the self-audit materials.

Negotiation of Monetary and Non-Monetary Terms of Settlement (6 to 24 months)

After the SIIA makes its initial settlement demand, there are various monetary and non-monetary terms that need to be negotiated. The obvious material term in every SIIA audit negotiation is the amount of any monetary amount to be paid to the SIIA for alleged past infringement. The most significant non-monetary issue is whether the SIIA will agree to a confidentiality provision. Such provisions require the SIIA to keep the existence and details of the audit confidential and preclude the SIIA from issuing a press release. Other non-monetary provisions include future obligations such as certifications of compliance, adoption of a software code of ethics, and production of additional proofs of purchase to the SIIA for purchases made after the audit effective date. The length of the negotiation process differs from case to case but generally lasts between six months and two years.

Scott & Scott, LLP is not affiliated in any way with the SIIA.

]]> Court Rules SIIA May be Required to Disclose Identity of Informant http://www.scottandscottllp.com/main/SIIA_May_be_Required_to_Disclose_Identity.aspx?blogid=174 In Solers, Inc. v. Doe, 2009 WL 2460862 (D.C. 2009), Solers, Inc. (“Solers”) filed an action against “John Doe” defendant, alleging defamation and tortious interference with prospective advantageous business opportunities based on a report to the SIIA alleging that Solers was using unlicensed software.  Solers served a subpoena on the SIIA to learn the informant’s identity. The Superior Court granted SIIA’s motion to quash the subpoena and dismissed the action for failure to state a claim. However, on appeal the District of Columbia Court of Appeals vacated the order and remanded the case to the Superior Court, holding, among other things, that a court should apply a five-step test when presented with a motion in a defamation action to quash or to enforce a subpoena which seeks the identity of a defendant who speaks anonymously over the Internet.  This decision represents a significant development for businesses accused of copyright infringement based on reports of informants to software trade associations regarding alleged software copyright infringement. At least one court now recognizes the necessity, in some cases, of permitting businesses to learn the identity of a confidential informant in a trade association software audit.

]]> 2009-09-03T12:01:23Z In Solers, Inc. v. Doe, 2009 WL 2460862 (D.C. 2009), Solers, Inc. (“Solers”) filed an action against “John Doe” defendant, alleging defamation and tortious interference with prospective advantageous business opportunities based on a report to the SIIA alleging that Solers was using unlicensed software.  Solers served a subpoena on the SIIA to learn the informant’s identity. The Superior Court granted SIIA’s motion to quash the subpoena and dismissed the action for failure to state a claim. However, on appeal the District of Columbia Court of Appeals vacated the order and remanded the case to the Superior Court, holding, among other things, that a court should apply a five-step test when presented with a motion in a defamation action to quash or to enforce a subpoena which seeks the identity of a defendant who speaks anonymously over the Internet.  This decision represents a significant development for businesses accused of copyright infringement based on reports of informants to software trade associations regarding alleged software copyright infringement. At least one court now recognizes the necessity, in some cases, of permitting businesses to learn the identity of a confidential informant in a trade association software audit.

The case began in May of 2005 when Solers filed a complaint against “John Doe” alleging one count of defamation and one count of tortious interference with prospective advantageous business opportunities. The complaint requested injunctive relief, compensatory damages, and punitive damages. Solers then issued a subpoena to SIIA seeking production of all documents related to the identity of Doe, Doe's initial report and his ensuing correspondence with SIIA, and all documents believed to be “evidence” of Solers' alleged copyright infringement. SIIA, which is not a party to the underlying suit, filed objections to the subpoena, and, in response, Solers moved to enforce the subpoena. SIIA then filed a motion to quash.  The Superior Court asked Solers to demonstrate financial or economic harm so that it could withstand a motion to dismiss on its claim of defamation. Solers was unable to identify any financial or economic harm at that time without the informant’s identity and the content of the informant’s report. The court dismissed the suit in its entirety for failure to state a claim upon which relief can be granted.

On appeal, the court established that speech on the Internet must be protected as any other speech but that such protection is limited. The right to speak anonymously, on the Internet or otherwise, is not absolute and does not protect speech that otherwise would be unprotected. Tests from other jurisdictions evaluating free speech rights in Internet defamation claims did not satisfy the court’s desire to fairly evaluate Solers’ interest in pursuing its defamation claim, SIIA’s interest in protecting Doe’s identity and, more generally, free speech rights for Internet communication. The court opted instead to develop a hybrid tests based on tests from other jurisdictions faced with the same issue.

When presented with a motion to quash (or to enforce) a subpoena seeking the identity of an anonymous defendant, the D.C. Court of Appeals stated that a court should:

(1) Ensure that the plaintiff has adequately pleaded the elements of the defamation claim,

(2) Require reasonable efforts to notify the anonymous defendant that the complaint has been filed and the subpoena has been served,

(3) Delay further action for a reasonable time to allow the defendant an opportunity to file a motion to quash,

(4) Require the plaintiff to proffer evidence creating a genuine issue of material fact on each element of the claim that is within its control, and

(5) Determine that the information sought is important to enable the plaintiff to proceed with his lawsuit. The court’s test does not require a separate balancing test at the end of the analysis, nor does it require a showing that the plaintiff has exhausted alternative sources for learning the information.

SIIA argued the court’s test would have a chilling effect on informant reports and that such speech would disappear. The court dismissed SIIA’s claims as hyperbole and stated that the test takes SIIA’s concerns into account.

The court determined that Solers need not demonstrate entitlement to judgment in its favor at this stage in the proceedings. Rather, Solers merely must show that it has a viable claim of defamation.  In other words, Solers must show that there is a genuine issue of material fact on each element of the claim that does not depend on knowledge of the defendant's identity. The court vacated the judgment of the Superior Court and remanded the case to give Solers an opportunity to present evidence supporting its claim of defamation.

This case, though not a carte blanche for businesses seeking to obtain the identity of informants who reported the business to the SIIA, BSA, or other software auditors, may prove helpful in recovering damages against informants who breached employment or confidentiality agreements signed with the business.  Alternatively, as in Solers’ case, business may elect to file defamation or interference with contract claims against the informants.

If you have been contacted by a software trade association alleging that your business engaged in copyright infringement, you should contact counsel experienced both in resolving software audit matters and pursuing other forms of relief to which you may be entitled.

]]> SIIA’s Corporate Content Anti-Piracy Program a New Cause of Concern for Small-to-Medium Businesses http://www.scottandscottllp.com/main/siia_anit_piracy_program.aspx?blogid=174 Last month, the Software & Information Industry Association (SIIA) announced the first major settlement reached by its Corporate Content Anti-Piracy Program (CCAPP). (You can read the SIIA’s press release here.) The settlement was reached with Knowledge Networks, Inc. (KNI), a market research firm based in Menlo Park, California, with fewer than 500 employees nationwide. The SIIA accused KNI of copyright infringement arising out of KNI’s internal distribution to its employees of written content authored by SIIA members, such as the Associated Press, Reed Elsevier, and United Press International, without securing licenses to copy the content.  

]]> 2008-08-13T10:33:13Z

Last month, the Software & Information Industry Association (SIIA) announced the first major settlement reached by its Corporate Content Anti-Piracy Program (CCAPP). The settlement was reached with Knowledge Networks, Inc. (KNI), a market research firm based in Menlo Park, California, with fewer than 500 employees nationwide. The SIIA accused KNI of copyright infringement arising out of KNI’s internal distribution to its employees of written content authored by SIIA members, such as the Associated Press, Reed Elsevier, and United Press International, without securing licenses to copy the content. The SIIA learned about the content distribution through a confidential tip from an informant who later received a $6,000 reward from the SIIA. In order to resolve the matter, KNI eventually agreed to pay the SIIA $300,000 and to send its employees to an SIIA-approved “Certified Content Rights Manager” course.

This chain of events – anonymous tip, followed by allegations, negotiation, and, eventually, settlement for money damages – is very similar to what typically occurs in software audit cases initiated by the SIIA, the Business Software Alliance, and some software publishers. What is perhaps more troubling about the SIIA’s new focus on “corporate content” is how small-to-medium businesses, many of whom are completely unaware that any of their actions might constitute copyright infringement, nevertheless could find themselves the targets of SIIA-initiated “content audits.” These companies may be subject to substantial settlements, and become the subject of a widely disseminated press release regarding corporate “piracy.” It appears that a company could targeted if an employee copied and pasted copyrighted text and then hit the “Send” button on an internal e-mail.

It is certainly important to develop and maintain awareness of the content that your employees are distributing internally within your organization. However, if your business has been accused of corporate content “piracy” by any industry association like the SIIA, it is equally important that you consult with an attorney who can provide some insight into the legal arguments and strategies typically employed in similar matters.

 

]]>