Some software police tactics are questionable

July 28, 2006
by Robert J. Scott, Special contributor

Over the past several years, software trade associations like the Business Software Alliance ("BSA") and the Software & Information Industry Association ("SIIA") have aggressively pursued businesses all around the nation, accusing businesses in all industries of software piracy. In many cases, the BSA and the SIIA claim that a company cannot produce proofs of purchase for all the copies of software it has installed on its network. Many of the tactics employed by the BSA and the SIIA are designed to reward the person who installed the software and punish the business that trusted its IT department to do its job.

The BSA and the SIIA saturate local radio advertising with promises of rewards to employees who initiate investigations against their employers. During the course of the investigation, neither the SIIA or the BSA will identify the source or sources of its information. In many instances, companies terminate a person in their IT organization because that person was not as diligent as he or she should have been at installing only licensed software. While the companies are trying to become compliant, they receive a letter from the BSA or the SIIA requesting a self audit. The BSA and the SIIA rarely dismiss an investigation because the companies were trying to become compliant when the audit was initiated. The BSA will even accept anonymous reports of software piracy.

There appear to be no mechanisms in place at the BSA or the SIIA to ensure that the person who installed the unlicensed software is not rewarded. When a company determines that its IT personnel were not properly monitoring the level of the company's software compliance, it often terminates the personnel responsible for ensuring compliance. The disgruntled former employee has all the information necessary to make a report to the BSA or SIIA and get rewarded if the company has to pay a fine. Both the BSA and the SIIA make it very easy for these vindictive ex-employees to initiate a report of software piracy.

 

Reports can be made by completing an online form or calling a local piracy hotline. One a report of software piracy has been made, it is a difficult, time consuming, and expensive process to resolve.

The rewards to the confidential informants can be significant. The BSA and SIIA both offer rewards of up to $200,000 for reports of software piracy. The SIIA maintains a form specifically designed to capture information about businesses around the nation who cannot demonstrate proof of ownership for all the software on their computer networks. The SIIA receives about 150 reports per month about these companies.

According to the SIIA, it evaluates whether the informant knew the number of computers, the type of software installed on the network, and whether management authorized installation of unlicensed software. Obviously, anyone familiar with the computer network at a company could answer the first two questions, and there are often few ways to determine whether the answer to question three is credible. The company has no input as to whether the trade associations initiate an audit after receiving a report of piracy from a former employee. Once the investigation has been commenced, the company puts itself in legal jeopardy by refusing to cooperate.

Management must be proactive if it wants to avoid potential liability for unlicensed software. It is incredibly easy for those in IT departments to provide information necessary to initiate a software investigation. Management must take the initiative and independently ensure that it is compliant with all its software licenses in order to minimize the risk that it would be unsuccessful in a surprise audit by the BSA or SIIA.