Overview
A licence agreement (the ICA) was signed by IBM and Winsopia, a LzLabs subsidiary, for the use of IBM’s mainframe software and other products (the IBM Software) within the Winsopia enterprise, which is defined as Winsopia and its subsidiaries.
The ICA specifically forbade Winsopia from:
- unless specifically allowed by applicable law, reverse engineering, reassembling, or translating the IBM software in any other way; or
- transferring the IBM software outside of Winsopia’s UK business, subleasing, assigning, renting, or leasing it.
In order to compete with IBM, LzLabs developed and marketed its own mainframe software, dubbed the Software Defined Mainframe (SDM), using IBM programmes and outputs that Winsopia provided.
After growing suspicious, IBM asked for an audit to determine whether Winsopia was adhering to the ICA’s requirements. Because the request went beyond IBM’s contractual audit rights and attempted to impose unreasonable demands within unreasonable timeframes, Winsopia declined to comply.
Following that, IBM allegedly terminated the ICA and other relevant licence agreements. Winsopia contested whether the termination was lawful.
The claim
IBM filed a lawsuit, claiming that LzLabs and the other defendants had obtained that breach of contract from Winsopia’s actions, which violated the ICA’s prohibitions on transferring IBM code and reverse engineering licensed software. IBM requested an accounting of profits and/or damages, an injunction prohibiting further use of the IBM Software, and a declaration that it had properly terminated the ICA.
The defendants contended that Winsopia merely transferred customer applications, not IBM software, and did not reverse engineer IBM software. They defended the claim by arguing that, as authorised users, their actions were covered by the rights granted by Directive 2009/24/EC (the Software Directive), which is reflected in the CDPA 1988:
- When required, decompilation is done solely for interoperability, which means making other software compatible with it or another programme (CDPA 1988, Section 50B);
- observation, analysis, and testing of a computer program’s operation to ascertain its fundamental concepts and tenets (CDPA 1988, Section 50BA); and, unless the agreement specifies otherwise, for the purpose of error correction (CDPA 1988, Section 50C).
(collectively known as the Statutory Exceptions).
At the trial on liability, the court found that many of Winsopia’s actions – such as reverse engineering by disassembling IBM code, transferring IBM code fragments to LzLabs, and recreating IBM data structures – breached the ICA’s restrictions and did not fall under the permitted exceptions. However, some isolated activities were allowed under the interoperability exception.
Key issues
The court considered several key issues. This article focuses on the following:
- The key legal principles applicable under the Software Directive and CDPA 1988;
- Whether any of the alleged breaches fell within the Statutory Exceptions;
- Whether Winsopia’s actions were in breach of the ICA.
Was the Software Directive / CPDA 1988 engaged?
While this was not a claim for breach of copyright (as IBM benefited from a direct contractual claim under the ICA), the court did consider the application of the Software Directive/CPDA 1988 in the context of the interpretation of the ICA and the application of the Statutory Exceptions.
In particular, the CPDA 1988 stipulates that where a person has a contractual right to use a computer program, any contractual clause purporting to prohibit or restrict the interoperability and observation, study and testing Statutory Exceptions set out above shall be void.
While the issues of construction relating to the ICA were fact specific, the court held that:
- The ICA was to be construed against the factual matrix of the Software Directive, so as to avoid any conflict where possible.
- If it were impossible to construe the relevant provisions of the ICA in accordance with the provisions of the Software Directive, the conflicting provisions would be null and void.
In this case, the relevant clause of the ICA prohibiting acts of reverse engineering contained the proviso “unless expressly permitted by applicable law without the possibility of contractual waiver”. The court accordingly held that this indicated a common intention to read the words in the light of, and subject to the provisions of the Software Directive, including the Statutory Exceptions.
Key legal principles
The following fundamental legal precepts from the Software Directive and later case law were consulted by the court as it examined the issues: law:
- Programme expression is protected by copyright for computer programmes, but functionality itself is not.The source code, object code, and programme design—that is, the way the programme is created and designed—are specifically protected by copyright. It does not safeguard the concepts and tenets that underpin the programme’s operation, or the service that users anticipate from it.However, the author’s creativity is not just expressed in source code and object code; it is also expressed in other creative content. This would include the program’s author’s selection, arrangement, and fusion of words, figures, or mathematical ideas.
- Copying or altering the source code is not covered by the Statutory Exception that allows a legitimate user to observe, examine, and test how a programme operates.This exception reflects the preceding principle: reproducing functionality does not infringe copyright, whereas reproducing/adapting the underlying source code to replicate the functionality does. A lawful user (such as a licensee) is therefore entitled to observe the output of a program in response to a given input in order to determine its behaviour and reproduce the same functionality in another program. They are not, however, entitled to gain access to the source or object code of the computer program and reproduce the expression of the intellectual creation of the copyright owner;
- The Statutory Exception permitting decompilation by a lawful user where necessary for the purpose of interoperability as subject to the legitimate interests of the copyright owner. Accordingly, a lawful user of a computer program is entitled to decompile and/or reproduce that part of the program known as the interface, described in Article 6 of the Software Directive as the logical and physical interconnection and interaction required to permit all elements of software and hardware to work with other software and hardware and with users in all the ways in which they are intended to function. If, however, the source code or object code is used to create another computer program that is substantially similar in its expression, such conduct is likely to constitute partial reproduction in breach of copyright.
The parties focused on the extent to which the Software Directive grants a lawful user of licenced software the right to reverse engineer an interface, as well as the definition of an interface in that context.is meant by an interface. However, the court ultimately held that the key issue was not whether an interaction could be described as an interface, but whether the specific code was a “expression” (rather than just ideas or principles) for the purposes of applying the testing Statutory Exception or “information necessary to achieve interoperability” for the purposes of applying the interoperability Statutory Exception.
The court acknowledged that the Software Directive is written in very general language, and thus its application to any given set of facts necessitates a thorough examination of the technical and factual context in which the issue is to be resolved.
Application of Legal Principles to Facts
IBM’s position on the breach was that Winsopia used or permitted the use of IBM mainframe software for the purpose of developing the SDM and/or reverse engineering parts of the IBM mainframe software.
The court noted that the prohibited actions under the ICA (reverse assembly, reverse compilation, other translation, or reverse engineering of IBM software programmes) lacked a common definition in the computer science community. But generally speaking, the experts concurred on the following descriptions:
- Reverse assembly is the process of reconstructing assembly code from binary object code using a tool;
- Decompiling is the process of re-creating a program’s high-level language source code from its binary object code using a tool;
- Changing the code’s language or form while maintaining its meaning is known as translation;
- Reverse engineering is the process of testing or examining an application’s internal components or operations to determine how it was created and/or how it operates.
After carefully examining each alleged breach, the court concluded that most of Winsopia’s actions constituted violations of the ICA, even though a small number of them were covered by the interoperability Statutory Exception.
Interestingly, the judge determined that Winsopia’s violations “could not be described as isolated errors; their nature and extent, and the duration over which they occurred, are indicative of deliberate and systematic disregard of the terms of the ICA.” Additionally, the court determined that Winsopia had concealed its relationship with LzLabs when it entered into the ICA, that LzLabs had obtained Winsopia’s violation of the ICA, and that the defendants had engaged in an unlawful means conspiracy to reverse engineer the IBM software in order to create and sell its own replacement.
Important lessons learnt
There is no unrestricted right to reverse engineer computer programs in the UK, without the copyright owner’s authorisation. This case demonstrates that the UK courts are not afraid to find companies in breach of licence agreements (and copyright legislation) and will interpret the Statutory Exceptions in the Software Directive / CDPA 1988 narrowly.
In particular:
- The exception under Article 5(3) allowing “observation, study and testing” of the functioning of a program by a lawful user to determine its underlying ideas and principles does not extend to reserve engineering, copying, or adapting source code or object code where there is a reproduction of the expression of the copyright author’s own intellectual creation.
- Decompiling or reproducing an interface for interoperability purposes under Article 6 is subject to the Berne 3-step test and if the code is used to create another computer program substantially similar in its expression, there is a risk of copyright infringement.
Where proprietary software and systems, like IBM’s, are available on the market, IT companies engaged in alternative software and system development should think about how to maintain “clean room” procedures and internal codes of conduct regarding separation.arding separation are adhered to. The ruling highlights the strict scrutiny that courts will use when evaluating licensee rights under the Software Directive and when interpreting a software licence that restricts some or all aspects of reverse engineering in cases where these protocols and practices fail.
The fact that large mainframe software licensors like IBM will vigorously defend their intellectual property rights when confronted with a licensee that refuses to cooperate with audit requests and apparent breaches is further supported by this expensive and intricate case involving numerous experts.
When attempting to rely on the statutory exceptions, licensees should carefully consider the requirements and principles of the Software Directive/CDPA and should comply with audit requests.
It’s possible that LzLabs will appeal the case.
info@lawdit.co.uk
