Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
×
Patents

Open Source and Legal Protection 250

A nameless submittor sent in this issue on seeking legal protection for an eventual open source project of a reverse-engineered from published works. Here's the problem: the project implements what many have made clear to be proprietary information and trade secrets. What can one do to protect themselves from the eventual legal backlash when this project is finally made available to the public? Need an example of things that could go wrong with such a situation? Then one need not look farther than the DeCSS fiasco. Click the link below for the full submission.

"I'm in the middle of taking a current bastion of big science and making it open-sourced. I'm not going to say exactly what I'm working on right now but I'm alas confident that shortly after this codebase is released, I will be the target of numerous lawsuits by holders of patents and software patents. Although I am reverse-engineering everything from published work, it has been made clear to me that most of the implementation of the work is considered proprietary and the rest is considered trade secrets.

The field from which this work is drawn is currently in the hands of a minority of individuals, some of whom are scrambling to create startups based on their work. I have real ethical problems with their ongoing hoarding of valuable data and algorithms developed with public and defense money hence I am attempting to get their capabilities into the hands of any interested individual. Not everyone in the field acts this way, but enough do to make it a real issue with me and others.

So, my question is how do I cover my butt? After the DeCSS affair, I want to be ready for the attack lawyers before they come. Who knows, maybe they won't, but I've never gotten very far on optimism."

This discussion has been archived. No new comments can be posted.

Open Source and Legal Protection

Comments Filter:
  • by Anonymous Coward
    Here's the problem: the project implements what many have made clear to be proprietary information and trade secrets.

    Okay, I'm not a lawyer, but it is my understanding that trade secret protection applies to secrets that were stolen from a company that kept them secret. The standard for violation of trade secret protection is that the secrets must have been protected from the competition and the general public, and the people who acquired them must have made an effort to breech that secrecy. Determining how a product works by black box testing wouldn't qualify as a violation of trade secrets. Stealing confidential documents or getting one of their engineers drunk and recording the conversation would.
  • by Anonymous Coward
    This codebase has been written based on published specs?
    IANAL (of course), but I was under the impression that building software projects based on published specs isn't reverse engineering. Remember that Cringly PBS special? Didn't compaq build their original PC clone by having one engineer reverse engineer the PC BIOS, write out extensive specs, and have another engineer (w/ no knowledge of the work) build the new BIOS based on those specs?
  • Note how comprehensively this story has been trolled. Some people with vested interests are obviously trying to drown out the reasoned discussion necessary to establish organised resistance to the idiots in charge.

    I think trolling is becoming more coordinated.
  • by Anonymous Coward
    Wow -- so much for trade secrets -- this describes the algorithm for descrambling data on DVDs I wonder if it might make some impact in the california case.(it doesn't appear to cover authentication/key tables etc)
  • Publish it anonymously through the cypherpunks remailers and/or "www.freedom.net".

  • If the programmer is that concerned about it, then don't tell anyone who he is. Just release the code. There are plenty of places to upload the code to make it available to the public without having to stamp your name all over it.

    As we all see with this DeCCS deal, once its out there, there's no stopping it.
  • This seems like a very difficult proposition in our networked world. Has there ever been a service that facillitates true anonymous publishing of digital works?

    Sign up for a $GENERIC_FREE_HOMEPAGE account using a fake name. Afraid they might log your IP? Do it from a net cafe or something. Post anonymously to slashdot. Watch mirrors pop up around the world.
    %japh = (
    'name' => 'Niklas Nordebo', 'mail' => 'niklas@' . 'nordebo.com',
    'work' => 'www.sonox.com', 'phone' => '+46-708-405095'

  • Not to be a party-pooper, I've participated in discussions like this before after all, but the correct answer to the question, and the only one that should be offered, is GO SEEK THE ADVICE OF A LAWYER.

    There are lots of people out there that are educated or semi-educated in the ways of the law, but you shouldn't really take the word of lay people on something like this, which could potentially land you in a lot of heat.

    Hell, there are trained professionals out there who can't get it right, so why would anyone want to risk listening to this bunch. So go talk to someone who is a paid professional, and hope they know what they're doing.
  • As I understand the question, the author of the letter is not saying that he is planing on doing something illegal. He (or she?) is just afraid that others might try to harm him by trying to sue him, and he wants to be prepared for that. Every company accumulating a patent portfolio for defense purposes is doing exactly the same and nobody is calling that illegal.

    Face it, whether you are right or wrong doesn't really matter too much in such a case if your opponent has the resources to scare you away by intimidation.

    Chilli

  • As a side note, I find it troubling when people say 'this is a legal issue, only talk to lawyers about it.' The law is complicated, but information and thoughts regarding it should not be restricted to just 'the Sacred Priesthood.'


    That's very well put. However, in some parts, if you are not a lawyer and your are caught giving what would be considered legal advice, you can get in serious trouble. You certainly open yourself up for a law suit if you tell someone something is legal and it turns out that it isn't.

    I don't like all the questions of "can I do this or can I do that" that pop up on here from time to time. These folks should really be speaking to a lawyer because laws vary from region to region. Slashdot may be a good place to get help and advice on technical issues, but the law is not one of them.

    As far as restricting what gets posted on Slashdot, the Slashdot crew makes editorial choices about which submissions to post out of the hundreds that they receive in a day, so in essence the content is already restricted. I guess if they could add a filter (like the one for Jon Katz) to block me from viewing these articles, then that might be better.

  • As a Brit, I ask you...

    how can you patent for x=1 to x=20, y=x^2 (yep, as far as I can see that's an algorithm).

    How?! (see, question and exclamation, must be confused...)

    --Remove SPAM from my address to mail me
  • Anonymous release wouldn't accomplish the goals here:

    1. It would still be illegal for anyone else to release/share copies of the software, if it violated patents.

    2. What is open source if you can't distribute it openly?

  • I'm not a lawyer, and I don't have time to fully analyze a situation where I don't know enough of the controlling law. As a law student, however, I feel compelled to say:

    Don't do anything you think might get you in trouble until you've consulted a lawyer. When you do, remember that the lawyer will look for ways for you to accomplish what you want, but in the end the lawyer may turn out to be wrong. There is an element of risk here.

    The EFF may be able to point you in the direction of people who can help, or even provide a bit of help. But you should not, in any case, rely on what you have heard here. There are quite a few smart people posting here, but you should not rely on any lay advice. Even if some of them are attorneys, you are not in an attorney-client relationship with them, and should not rely on their advice.

    Even a preliminary consultation in this case might cost a few hundred dollars. That'll be a lot cheaper than tens of thousands, though.

    -TH
    Student, University of Minnesota Law School

  • As ESR noted in Magic Cauldron, software is inherently a service, not a manufactured product. I would note that the power to create, also carriers with it the power to destroy. As a sovereign individual, one theoretically has the right to dispose of the fruits of one's labor any way you desire, even to the point of giving it away. It may not make economic sense but then nobody said that people are completely rational.

    Given that the federal government has the guidelines that all tax-payer funded activities should be released to the public (a trade-off between economic security of the researchers in return for wide-spread public dissemination), it does raise some rather interesting questions about privatising the gains (through patents, etc) and publicising the risks (failures, prototypes, etc) with some claims that the cost of tertiary education is disproportunate to the value due to the inefficient commercialisation apparatus. However, public institutions do provide a valuable social role in fostering income mobility and providing career opportunities to the disadvantaged. In particular they can curb the role of excessive rent-seeking and monopolistic profits. For example, by releasing an open reference design or protocol, common standards can be established with companies motivated to sell additional value to demonstrate clear advantages (either direct, through support, ir indirect through warentees) over the the public version. In an economic sense, this is analogous to the Mum&Pop shop putting limits on the megastore as they can't afford to charge a big price differential while people have alternatives. Of course, if through anti-competitive measures they drive the Mum&Pop out of business, they can then go down the route of the corporate town (aka company store). In a similar way, public individual research & development (effectively what OpenSource is) can (given enough time and resources) replicate any private research (unless they're using some alien technology!).

    As to the legality of it, it comes down to a combination of juristictions which is ultimately a codification of individual and social beliefs. The US has a comparative advantage in high tech which means the goverance structure prefers to enact laws (especially property rights) that preserve and protects these advantages. From other countries' perspectives it leads to "unfair" situations such as AIDS drugs being unaffordable to people in Africa due to the drug companies wishing to preserve their market in the US. Given that the US has the military and financial clout to convince ... (OK bully) ... other countries, you can guess the outcome.

    What can one do? Depends on your belief system, if you want to go the Larry Wall approach and diffuse Perl, you can gain fame. If you want to go the Bill Gates approach you can have a chance of becoming rich (but also a good chance of being crushed by competitors, mauled by venture capitalists, and screwed by Wall Street). You cannot say that Perl and Windows can't coexist, they serve different needs. If you wish, you can establish a server in some countries which permits reverse-engineering for compatibility reasons (I believe Australia is one example) and then publicise it and let the world decide. You can publish it as a CD with source code under whatever copyright you wish. You can even forget about it and join the startup and try and make a living. Ultimately the choices one makes in life are individual and you can only act in concordance with your beliefs and values.

    If other people believe otherwise, then that is only a concern if they attempt to impose their values on you. Now whether the patent system and the associated heavy-handed branding and trademark protection is worth believing in as a system to promote innovation and invention is a different question. All I can say is that with umpteen legal variations and juristictions around the world, there is no reason to shift your work to another location where it can be protected under different laws. Some countries (e.g. Taiwan I believe) even refuse to accept certain interpretations of IP laws. Note that IANAL and there would be serious complications on the interactions of various laws (e.g. the US insists on taxing citizens on world-wide income). Perhaps one day somebody would create a special juristiction to accomplish your desires (OpenNation?) but until then, if you believe strongly enough in the sharing of ideas (as compared with products or provision of related services), you can blaze your own path much as Linus did.

    LL
  • Why not just release it anonymously, according to your question you are doing this since you feel it is wrong for a few individuals/companies to hold onto something this important and the general fact that software patients are bogus.
    If that is really the case just release it and take no credit for it. No one to sue, if it just shows up on a bunch of ftp servers around the world.
  • Technically you can do them yourself. You'll find most relevent stuff easily. There are many libraries that are used as depositories.
    (see http://www.uspto.gov/web/of fices/ac/ido/ptdl/ptdlib.htm [uspto.gov]) Chances are there's one nearby. Its actually rather interesting to sift through it all. Most of these libraries also have some kind of search engines too. Or if you want to do it from home look at http://www.patents.ibm.com/ [ibm.com]. If its a decent library they'll probably even have someone who can help you figure out how to do a search. Its not eaxactly easy, but nor is it rocket science. If you make a reasonable effort you'll probably find all of the relavent patents quickly. The $10,000 is for a professional lawyer or librarian or both to search thouroughly the entire patent database. You can probably restrict yourself to just the software stuff.
    -cpd
  • That wasn't the argument. The argument was on cost. I'll agree that programmers generally hate doing documentation, but this is more along the lines of reading the manual. Or searching the internet to see if anyone has done it before. Why would you reinvent the wheel? Its already done. Besides, go look at patents that were submitted 17 years ago (I think). These will be coming off patent protection, use those ideas, and implement free forms of that. Legal, easy, and probably useful.
    -cpd
  • Your post has a lot of good points, especially that even if the NSA can break PGP, as soon as they start to _use_ that capability the cat will be out of the bag and everyone will know it.

    BUT....

    you meant "source code to an algorithm that can factor large numbers INTO primes in linear time".

    Factoring primes is easy. I'm sure you knew that. But I would hate for anyone else to be confused - it's such a common mistake.

    Apparently, even Bill Gates (or more likely, his ghost writer) made this mistake in the first edition of "The Road Ahead".

    Torrey Hoffman (Azog)
  • We're not talking about "forcing" anyone to open-source their products... We're talking about reverse-engineering those products, and creating our OWN open-source clones... The whole damned computer industry is founded on this very basic ability/right; imagine where we'd be if no one were legally able to reverse-engineer IBM's PC BIOS, and create their own clones... Just because you create a product does NOT give you sole rights to all other products that behave like it, as well... No one is taking away anyone's freedom, as you claim, by reverse-engineering their products... There's absolutely nothing wrong (either legally, or morally/ethically, IMNSHO) with such reverse-engineering efforts... Without them, many useful products (eg: WINE, Samba, etc.) just wouldn't exist at all; in fact, the entire computer industry as we know it today wouldn't exist at all...
  • Third, release it anonymously.

    This seems like a very difficult proposition in our networked world. Has there ever been a service that facillitates true anonymous publishing of digital works?

    Idea: A PO box that accepts magnetic media and duplicates it to a network of automatic, unstructured, and uncontrolled mirrored web servers. The disk can get posted and then the mailer and media will be destroyed.


  • a) Stay down. Barring your own vanity, releasing something anonymously on the Internet is not that difficult. Put everything together nicely, and then send it to a mailing list or newsgroup on the subject through a Mixmaster or Cypherpunk mailing list. Leave spreading it to the power of the masses and of the Internet, by just creating it you have done enough.

    As DeCSS has shown us, just creating it is not enough. I agree with you that it is sometimes neccessary to be anonymous to speek freely, but something like this isn't exactly speech. The value of what this person is creating can only be realized if it is actually used, and as we've seen with the DeCSS case, the lawyers will go after everyone who uses the work, not just the creator. In a pure speech case (like the guy who posted Scientology's "secret" information) just getting the info out there is enough, because just knowing the info is what the whole case is about.

    But in these cases we need to make it legal somehow, because the scientists who use this work are presumably not in a position to do so anonymously (after all, they must publish their results).


    Hopefully your option B wouldn't actually require martyrdom, merely lots of community support (both financial and otherwise).
  • Has there ever been a service that facillitates true anonymous publishing of digital works?

    www.freedom.net or
    www.zeroknowledge.com

    They claim complete anonymity, and their credentials look good.


    Kaa
  • Get a good business lawyer. Maybe try contacting the EFF or Software in the Public Interest(?) to locate a lawyer who would be willing to help cheap.

    You can get some legal protection by incorporating (like apache did). Unfortunately this takes some amount of money.

    As others said, Document document document. Keep an engineers notebook (stiched bining, numbered pages). These have a higher evidence value than a text file log because they make alteration difficult. One DOD project that I was involved with used these notebooks, not because the DOD wanted them. The lawyers for the company required them.

  • Legal precedents are wonderful things, but the new problem we are facing (or should I say -you- are: I live in Canada) is that much of the Digital Millenium Copyright Act is drafted -specifically- to overrule the common law in this area. As the DVD MPAA case shows quite clearly in my reading, the DMCA prohibits activities that were permitted by courts under the traditional copyright regime. This is why I'm pessimistic, at least about that specific case.
  • by Growler ( 30721 )
    Just one thing wrong with your little plan. I'm not giving you my invention. You need me to make your scheme work, and I'm not cooperating.

    Good day.
  • In which parts of the world are the patents active? Remember the RSA patent - covered the US but not Europe. If the patents are US only, consider getting Europeans to do the OSS work. If I recall correctly, you can't patent algorithms in the EU.

    It does seem to me that you're setting yourself up for much legal hassle. In the US, as I understand it (IANAL), patent disputes are heard before juries, making them a pain to fight and even more of a pain to win. The situation is different in the EU.

  • That would essentially mean to give up level 0 to the trollers and flamers. Actually, that's what happening. Have you noticed the immense increase in spamming /. gets nowadays? I used to browse at 0, but have since moved to 1, at the cost of missing some good ACs (hopefully moderators rate them up).

    I pity the newbies visiting /. for the first time...

    Something should be done about it. Ideas anyone?

    BTW: When I get moderator points, I try to exclusively moderate good posts up.
  • A copyright can be owned anonymously or pseudonymously; USC Title 17, Chapter 3, Section 302 [cornell.edu] discusses the copyright duration for anonymous works, for example
  • Haven't people ever thought to work within the system... (use your most whiny voice)

    I have reverse-engineered a few systems, and in every case, it was a measure of last resort, when working within the system didn't help. Reverse-engineering is a lot of work, and getting a working solution is usually cheaper.

    But if the vendor just tells you, that you are out of luck then it's time to get out the debuggers, the logic anaylizers and teh hex dumpers. The same happens if you need to import legacy data into the new system and the vendor provides no support.

    When buying a system, I expect the vendor to provide the minimum means to do with it what I need (or like). This usually means at least access to the documentation of all file formats and transmission protocols. If he doesn't, he witholds from his customers part of what they paid for:

    The possibility to get the maximum use out of the product.
  • First you will need to clarify what it is that you have reverse engineered. You mention both patents and trade secrets.

    If patents are involved you will have little or no protection, regardless of what you do. With a patent it doesn't matter how you 'discover' the technique or process. Whoever has the patent 'owns' the idea under US law. Unless you are willing to take them to court over it and can prove prior art, etc.

    If only trade secrets are invovled you are in much better shape. Assuming of course that you haven't broken any NDA you may have agreed to. If you were able to figure out a trade secret via publicly available information, and you can show this is the case, you will probably win out in the long run. You may well have a few years of court battles on your hands however.

    As for general protection make sure you have copies of ALL of you work and work related items, i.e. source code, notes, correspondance, etc.

    Also talk to a real lawyer. It is all fine and good to get comments here, but only a lawyer will be able to help you with all the details.
  • I'm at work, so in a real sense I'm not wasting my time. I'm getting paid about $20/hr to respond to some prepubescent, bunghole licking, needle dick moron. On the other hand, when I start my business next month I won't be at liberty to expend this sort of effort.

    BTW, ever read Freud?
  • I remember before the big security crackdown on government websites how easily accessable research information was. I used to have a link to a government storehouse for sourcecode and programs. About the same time that the government ordered the different agencies to increase security most of the source code was removed from goverment websites and much of it offerd on a pay to use basis. A lot of my tax money goes into funding reasearch in pubic learning institutions, yet the results of the reasearch is more often closed to the public and sold to the highest bidder (often big business). We, as the supporters of public institutions, deserve equal access to the fruits of our investment. Selling off the patents and copyrights only serves to benefit a few, while keeping it open would be a boon to all. Adding to the waste is the real possibility that selling intellectual rights to a corporation with limited resources and narrow-sighted goals actually hinders future developments by closing off pathways for other researchers and private entrepreneurs. I'd change the system if I could but unfortunately I can't afford to pay for big money, bribing, lobbyists to get my voice heard.
  • By the way, when you post on Slashdot it trapps tour IP, which is then cross-referenced to your domain.
  • I remember before the big secirity crackdown on government websites how easily accessalbe research information was. I used to have a link to a government storehouse for sourcecode and programs. About the same time that the government ordered the different agencies to increase security most of the source code was removed from goverment websites. A lot of my tax money goes into funding reasearch in pubic learning institutions, yet the results of the reasearch is more often closed to the public and sold to the highest bidder (often big business). We, as the supporters of public institutions, deserve equal access to the fruits of our investment. Selling off the patents and copyrights only serves to benefit a few, while keeping it open would be a boon to all. Adding to the waste is the real possibility that selling intellectual rights to a corporation with limited resources and narrow-sighted goals actually hinders future developments by closing off pathways for other researchers. I'd change the system if I could but unfortunately I can't afford to pay for big money, bribing, lobbyists to get my voice heard.

  • Congratulations, you have just discovered obscurity.

    Search for Mixmaster on google to learn about security, generally considered a lot smarter.

    -
    We cannot reason ourselves out of our basic irrationality. All we can do is learn the art of being irrational in a reasonable way.
  • > you are basically taking the research of others.. How do you think science works?? People BUILD UP from other people's problems and solutions. >.their discoveries, hard work, and insights... and stealing them. HOW do you steal an IDEA? The orginal person STILL has it ! I think you meant COPYING an idea. Patents protection the IMPLEMENTATION of an idea, not the idea itself. Proof: The law allows one to "clean room" reverse engineer. Cheers
  • Your only hope is to disguise your identity. Post your code through anonymous sources, remove all traces of your name for the system, etc. They can't sue you if they can't find you.
  • Too bad, we could have put them out of business at the government's expense...

  • The biggest problem, probably, is that the companies could sue you whether or not they thought they could win, to frighten you into submission. Assuming you live in the US of A where everyone has the God given right to sue anyone else, there is nothing you can do to prevent this, only fight and win.

    I was wondering about this one. Large corporations sue with the expectation that the individual will run out of money. What would happen if they had to sue a hundred (or a thousand)different people, each putting up a small defense. (admittedly this would take alot of potential martyrs, but Gahndi succeded in the end, didn't he?) How long could they last? Are public defenders available for such cases?

  • If the law permits corporations to send police to drag away 15-year-old geeks for trumped-up and bogus crimes, why should we honor those parts of it?
  • The copying isn't the illegal part. It's the distribution of copies that is illegal. I can copy a CD or DVD perfectly legally. If I then give that copy to someone else who hasn't paid for the right to own a copy of that work, I've broken the law.

    This means you can only do what the owners WANT you to do. This means no copying, no broadcasting, and yes, even no playing.

    Can you cite an instance where a license of this sort has been upheld in court as taking precedent over an individual's right to fair use? I've not heard of one, and until I do, I won't consider such licenses to be legal or enforceable.

  • It's much more legal if you do that with a lock that you own.

  • Well, you can always represent yourself, can't you? Plead that the corporation is trying to scare you into submission with the prospect of a costly trial.

    Somehow, I suspect that the main difference between that and a summary judgement would be the number of days you have toi take off from work/school.

    Until the law takes into account that in today's world, civil courts can be nearly as effective as criminal court at depriving an individual of freedom, and that furthermore, they allow any entitity with money to do it (rather than just the government in the case of criminal court), the best bet is stay anonymous or hope you can get an attourney to work pro bono or for a percentage of a countersuit.

  • The guy asking the question wants to release something legally to the community (meaning: allowing others to use it without being prosecuted because they use some dirty stuff that some 31337 d00dz have spread all over the net).

    The problem is, the way the courts allow themselves to be abused these days, even if you do something that is legal, moral, and ethical, if it is inconvieniant to people and corperations with plenty of money, you can still be dragged through legal mud for years and face ruinous legal bills. It is entirely possable to have the court find in your favor every single time (initial case, appeals, additional and closely related suits etc) and end up loosing more money than it would have cost to settle in the first place. Eventually, you might well face one more suit and have no resources left to fight a summary judgement. For all practical purposes, a civil court decision can be bought. In such a case, it may be best to be anonymous and avoid all of that.

    That is a perfect example of something that is legally acceptable even though it is ethically and morally reprehensable.

  • How long could they last? Are public defenders available for such cases?

    Unfortunatly, no. The right to an attourney only applies to criminal court.

  • It might be a good idea to do a traceroute to the first remailer and make sure the packets aren't leaving a long trail through untrusted sources, such as satellites. See if you can route it via ground through trusted small ISP's that aren't an obvious portal to the NSA and FBI. Make sure at least the first remailer rotates the logs quickly or has no logs at all.

    If the traceroute has a long way, such as 20 hops to the first remailer and, say *.maryland.core.gov or something comes up in the route, you are in deep trouble!
  • "I don't really care if it's legal or not in their home country, I think it's morally wrong to force our opensource ideals onto companies by tactics slashdot would raise holy hell about if the rolls were reversed."

    Your opinion has been registered. Fortunately, there are alternative concepts of "morality" and "ethics" that are out there today. The standard set of morals that would lead you to believe that what the person asking the question in this article was doing is wrong is not the root of the way that everybody thinks about things.

    Economics is morality, and morality is economics. They're essentially indistinguishable, and this is one of those examples where it's a bit more evident than in other places.

  • The freenet team (check it out at SourceForge [sourceforge.net] is working on such a solution, you post stuff totally anonymously, and once injected in the network, nobody is able to remove it, it's cached all over the place, but nobody knows exactly where...
  • no, you aren't purchasing a LICENSE to anything. you're purchasing recorded medium with a chunk of data on it, which you are allowed (by law, not by any license) to play, listen to, enjoy, make backup copies of, etc. you are also not allowed (by law, not by any license) to redistribute copies.

    at least that's the case with CDs. I don't see any reason why DVDs would be any different.

  • What are the published works you are 'reverse engineering' from? If they are patents, then you are probably in trouble. If they are journal articles, then I don't think you'll have any trouble. They could be prior art to disqualify the patents.



  • Put it into public domain BEFORE they patent it. Than, the fact that it was developed with government money protects you. It may not be withdrawn from public domain for reasons other than security. Even one percent of government monet is enough to put the project under this status.

    In btw this is one of the additional protections on linux besides GPL. Have a look at the ethernet drivers.

    After it has been patented the situation becomes much more difficult. There is a number of patents floating around that have actually been developed with government money (mostly in biology, pharmacology, chemistry, etc). And US government seems reluctant to chase the offenders. I do not know the reasons for the reluctance but it is quite likely that US legal system protects the offender in this case.

    So my suggestion is Hurry. IANAL of course...
  • I know it ain't this way anymore, but once upon a very long time ago, it used to be law that the results of research paid for with taxpayer dollars were public domain; unpatentable and uncopyrightable. Anybody who wanted to make a buck off the technology was free to create an added-value package using it (e.g., MatLab [mathworks.com]). The demolition of this policy, allowing university and corporate researchers to take proprietary ownership of technology developed with OUR TAX DOLLARS (e.g., RSA [rsasecurity.com]) is one of the biggest betrayals of the public trust by the U.S. government in recent times.
  • why do people believe they have the right to decompile and start distributing someone else's hard work?

    Most people around here do not believe they have that right. Implementations should be protected, and only pirates would argue against that. But there is apparently still some debate about whether or not the ideas and mathematics -- upon which implementations are based -- should be protected. When certain parties try to use "idea protection" (like software patents and the DMCA) to inhibit competing implementations and interoperability, then we have a problem.

    Forcing a company to release source code really isn't freedom, it sure seems me like strong-arm mafia tactics by snotty brats.

    I agree. But that's not what this is about. For example, nobody really wants to "force" Microsoft to release their media player's source code, or to force Xing to release their DVD player's source code. We just want the specs for the media formats that these programs play. And that is the right that we demand: the specs for data formats and protocols. If you're going to send or sell me files, then they simply must be in an understandable format. Since the specs are unavailable, disassembling and reverse-engineering an existing implementations is what we have to resort to, so that we can infer the specs and start to make independant implementations. It's not pretty, but sometimes it's the only way. Congress understood the importance of that right, which is why even the highly-restrictive DMCA protects the right of reverse engineering. Unfortuantely, they didn't understand open source so now the right of distributing the knowledge gained by reverse engineering is now in danger.

    That right is important to freedom, and you're going to hear a lot of screaming around here whenever it is endangered..

    Slashdot sure brings itself into a huge fit when a mention of the GPL being violated, now where is our moral outrage that someone is wanting advice on a premeditated violation of someone else's license.

    You are implying that there's a double-standard here. But there isn't. If someone were to copy GPL'ed code into a closed-source implementation, that would be a copyright violation and you can bet your ass that there would be an uproar. But if someone were to study that code to understand how it works, or to understand the format of the data that it manipulates, and then they were to write their own closed source implentation that is based upon that knowledge, there would be no "moral outrage" at all. Yeah, I bet a few people might question the business sense of whoever does this (i.e. trying to sell a product that competes with an already existing open source product) but that's another issue.


    ---
  • If the author is in a country where reverse engineering has been made illegal [...]
    the author could find a friendly party in a safe country and have them take credit for the release.

    That could be a good idea, indeed. However, the most important advice (document everything) will then become very tricky. The ghost author will have to explain how he has acquired the information, written the code, and so on. The ghost author will also need one or several friends who can testify that he has found all this by himself.

    Nevertheless, finding a friendly party in a country that allows reverse-engineering might be a good solution for people living in the USA or in other countries that have stupid restrictions on reverse-engineering. Alas, even European countries are now modifying their laws to prohibit reverse-engineering because of the pressure from several big companies.

  • *IANAL*

    Put simply, your best chance here is probably to have had a previous case on a similar subject decided in your favor. If the companies see that they can crush open-source projects like DeCSS they'll get bolder and do it as a standard business practice.

    If however, DeCSS beats the DVDCCA and MPAA, most specifically if they beat them in a very public and somewhat humiliating manner, you may well see the companies thinking about who they sue before they sue.

    Even better, if the Judge's ruling in one of these cases were to actually address the issue of reverse engineering and either implicity or explicity allow it you stand in very good shape.

    So you stand to lose a lot with the DeCSS case, keep this in mind. Write editors of newspapers asking them to give fair and balanced coverage, organize a protest where it will get noticed by the media, and above all, BE POLITE! Don't do anything that would make everyone think we're a bunch of law-breaking freaks who deserve to what we get. This battle will be fought much more in the court of public opinion than any particular jurisdiction.
  • I'm not judging you in any way, but something seems very clear to me.

    If what you are doing is illegal, why should you be able to simply use 'open source' as a shield?


  • Why? Code is code, period.
    All software should be free.
    Who cares if it's in binary.. it's *STILL* instructions that are understood by a computer, and I have every moral right in the world to read those instructions and translate them into whatever language I want.
  • This won't help if the author lives in the US.
    The US Govt will still say 'americans found it, americans can get ahold of it, and this guy is an american, therefore, he must abide by american law'
  • We shouldn't, and I'm not debating that.
    What I am debating is.. If you *know* what you are doing is illegal, Open Source is not a shield.
    What Jon did in the DeCSS fiasco, he thought he was allowed to do, and at best, it's a grey-area thing right now. He did not set out to commit a crime.
    If you are stating that you want to reverse-enginner something, and you believe what you are going to do is illegal, and you want to challenge that in court, that's up to you.


    And you know what's missing from the law? Retribution for misuse of the law. By one right, Jon was accused of some heavy crime, and was arrested for it. By the same token, if it turns out there was no heavy crime, and any part of the clam was bad..... someone should pay.

  • Yes. The community should support what is ethically right.

    I guess I read the question more along the lines of 'I know what I am doing is blatantly illegal. How can Open Source protect me?'.

  • (admittedly off-topic, but hopefully still worthwhile ;)

    This appears to be a fairly popular tactic now for people without the skills to do something constructive with their time.

    Perhaps the moderation system should adapt to handle it. I propose that moderators not lose points for marking trolling posts like this, but not actually lower the score of the post until a certain number of moderators have rated the post as a troll. Perhaps 3.

    With the current system, I'm sure that this could be handled simply by increasing the number of points available in the system, granting moderation more frequently, and allowing moderators to (as this "enlightening" series of posts states) waste points putting the smack-down on the richly deserving. But this really goes against the spirit of moderation, which is to spend as many points as possible elevating good posts. Simply cleaning up is a waste of moderator time and cheapens the responsibility of it.

    Another option would be to let it ride and tell people to read at 1+. The downside here is that we could miss insightful AC posts, and links to comments from other news sources will still be loaded with trash (BTW, I love the idea of defaulting to posts to be ordered descending by score to make Slashdot more presentable to the rest of the community).

    Allowing moderators to strike down large groups of posts after several moderators have decided they are pointless trash would go a long long way towards quickly cleaning up messes like this.

    - StaticLimit
  • If I was getting paranoid, I know what I'd do. Put on a cap and dark glasses then head off on foot at a busy time of day. Make sure I'm wearing very anonymous clothing and not carrying anything. That way, I'm harder to track by CCTV.

    Next, go to a net cafe, paying with cash. Open a webmail account with fake details - not exactly tricky - and use that to submit it to as many different servers as I could think of. But don't do anything else or it's easier for someone to establish a usage pattern and identify you. DEFINITELY don't log in to any other services...

    Finally, go. Flush the cache on your machine manually, take all media with you and go. But go via a park (or somewhere else secluded with plenty of cover) and remove a top layer of clothing - say, cap, glasses and jacket. Dump these in bushes or wherever and go home.

    Would that be secure enough for most people?

    Greg
  • Although this is not what you want to hear, there really is only one meaningful answer to this question. Get ready!

    In other words, talk to a full-blooded lawyer about the question before you release. Have materials and papers ready, being ready to ambush the ambushers with motions and declarations before the ex parte and rush TRO hearings. Have all your ducks in a row, to the extent you do have a legal defense, and make certain that you don't overstep or lose on a technical glitch.

    The only way to do this right is to have a lawyer, whom you have retained for your particular problems. If money is an issue, you may have to find someone willing to do it pro bono, which may be possible if the cause is worthy. This may require some shopping, and I'd be pleased to help guide you to finding such a person working in your jurisdiction.

    But do this ALL UP FRONT, with a clear sense of what you are doing and why you are doing it. In a recent thread, slashdotters lambasted the legal system for moving too quickly. Count on it to move quickly, too quickly, once you release. In the meanwhile -- YOU CONTROL -- when that happens. So be ready for the deluge, before it descends upon you.

    Although its not what you want to hear, the only way to be ready, legally speaking, is to be ready, legally speaking.
  • One thing I always prefer, is diversity, for exactly the objections you have. It seems you don't really object to any of these methods except to say none of them do the total job. I will always argue that multiple funding methods are needed - that's usually the best way to deal with a broad problem space.

    But, like I said before, the patent system discourages alternate funding systems, so I would like to see it go.
  • ...what would happen? Well, firstly, everyone could start selling all the still-protected drugs really cheaply, since virtually all the costs come from research and clinical trial costs. So, you could buy a box of Viagra for $5, or whatever. I just wanted to point that out first.

    Second, all the bio-tech start-ups and research departments shut right down. No company on earth could afford to spend that kind of money unless a government supported monopoly was the reward.

    Third, there will be a lot of scientists out of work who would very much like to still be working.

    Those scientists still want to do research for reasonable salaries (say $60-200k). Some would do it for less, of course, but I doubt many would reject these salaries (cause i don't believe there are many scientists out there doing it for the stock options and the getting rich part).

    So, what those scientists need, is spending money. A software tax is an interesting idea. The basic plan is fund it with public money. This would be fine. I personally wouldn't like delegating the choice of what which research projects to fund, but this would be an improvement over the current patent system.

    The typical argument against public (tax) funding is that it's inefficient and will cost a lot. Here's where I bring up point 1: do you have any idea how much we'll save in health costs? I don't, but I bet it's a handsome amount. Health insurance costs would come down, significantly. Medicare and Medicaid would cost less to administer. In the public funding system, our money would go directly to research, bypassing patent and court costs. Strikes me as more efficient. And, all scientific findings would be public domain (even those no one would have wanted to patent before). Another bonus.

    There are other ways to fund as well. Charities get money - scientific foundations could be formed which receive donations. That way, people could choose which projects they fund. Probably not enough people are educated enough to go straight to this, but some sort of hybrid could probably be worked out. ie, whatever you donated to a foundation could be subtracted from your research tax.

    Socialist, you say? Maybe so. Do you think there's no place for socialistic concepts? The biggest argument against socialism is that the government can never allocate resources as efficiently as the market. I happen to agree very strongly with this argument, so I would prefer a more chaotic system than having our legislators "legislate" where the funding goes. I would prefer that each individual gets to "vote" for their favorite research foundation. That way, the allocation of research funding could change very quickly to meet the demands of the people. Currently, Michael J. Fox has to go before congress to try and work out increases for Parkinson research. With my way, he could go directly to the people and it would happen immediately, according to the people's desires.

    But, I don't think any other funding model could work or be put into place so long as Patents are around. Patents make any other source of funding something only a fool would choose to do since you'll be paying for those government supported monopolies either way. Get rid of patents, then we'll be open to other possibilities.
  • I just wanted to pick on one little bit of your post (which otherwise was quite good :-)

    If we did not have laws protecting IP then there would be no incentive to create works and/or new products.

    This is simply untrue. There are usually at least two motivations to invent something - one is economic, and the other is the joy/satisfaction of doing the thing itself. Thousands of open-source coders should have clue'd us in to that by now. For scientific research, this is even more true. The problem is, how do we fund research, not how can we profit from it. Given money, there will be more than enough people who will do research regardless of whether they can sell a product as a result. Patent law is unnecessary - what's necessary is a new funding model.
  • My scope started out at the level of getting rid of all patent protection. My original post was a simple complaint when someone suggested the only reason people will invent/innovate is for economic rewards based on patent protection. I suggested that actually, people would be happy to invent/innovate for merely a salary.

    I was suggesting patent law serves the purpose of a funding model, but is actually an incentive model (subtle difference, but important). That distinction leads me to suggest that if we could come up with a realfunding model, we could do away with patents. That is why I talked about bio-tech - because it is an example of an industry that really would go away if patent law disappeared (without a replacement). I was trying to take on the most difficult area. Open-source software is much easier - it's here, despite patent law.

    You also point out that currently we are doing pretty good having both open and closed source. That's great, I agree. The more various funding models we can have, the better. But the patent model discourages competing models, unfortunately. A company can make much more money through the government protected monopoly than almost any other way. The playing field is not level with that incentive out there.

    Open-source software gets around this because the cost of development is very small. It would still be improved by the addition of a funding solution, though. I personally like Co-Source's funding model. I think that method gets at your objection that open-source has limited output in many areas. Developers there are asked to develop solutions, and are paid for the work they do, not for the output. ie, the output is forever free, there is simply a one-time charge for the work to produce it.

    In my opinion, a co-source model needs to be combined with a tech support model using similar means. Consumers of open-source ought to be able to make an open request for tech support, deliverable by whatever person(s) or agency out there willing to take on the job. I've even described a business model based on the idea of making all the developers "out there" potential employees, paid on a per-job or per-service basis. The customers of the fantasy business would pay a subscription cost, which would give them any number of "points" to spend, asking questions, requesting software or service. Developers in the forum that answered the questions, or developed the software, or who actually visited the customer to solve the problem would be the recipients of real money, based on the number of points the customer assigned to the request.

    Example:
    Customer has a problem mass installing linux on all their employee desktops. They send in a question to the business' website asking for help/suggestions/code for doing this. They assign 100 points to the successfull completion of this request. A develop "somewhere" reads this request, gets more info from the client, and writes a brief script to solve their problem. The customer is happy and grants the developer the 100 points. The business pays out money to the developer based on the points they've accumulated.
  • I agree with most of your post - particularly where you talk about the economic benefits of an open knowledge system versus the patent system. If you examine all the economic costs involved, I think it becomes clear that patents are not efficient. Problem is, many of the patent costs are hidden, whereas we're talking about making those costs very apparent. I think that's a good thing to, but it means it's harder to sell it to people.

    I do disagree with one point, however - that of your "award" system. I don't like award systems. They inherently favor small, cheap solutions to problems, whether or not that's the best way. Who would undertake to build a brand new operating system based on an award system? Who would risk drug development based on the possibility of getting an award, but having to foot the bill in the meantime?

    I think the reason you chose an award system, and this public body, are to create a valid way of determining who is deserving of funding. But, as I said in another post, I prefer a more dynamic way of determining who gets funded. Let the people decide individually. You can still have a public body that generates a list of valid projects if you like, to protect against fraud. But, the point is, projects get funded up front, and money is free to switch projects when people choose to do so.
  • About the shrink wrap license -- do they attempt to get around the "I bought it second-hand at a garage sale" defense ? I.E., does the license deny you the right to re-sell the DVD player or mandate that you keep the license intact when you transfer it ?

    Not that I think that these shrink-wrap licenses are ever going to stand up in a higher court. But they do give the big money a tool to harass people with until they can afford to appeal up to an educated judge.

    Could one of the people who actually bought one of these devices post the text of the claimed license ?

  • Now, the incentive to innovate is created by a public body that is independant of the government, perhaps even with its own democratically elected committee.

    Sounds like a prime target for corruption.

  • > Factoring primes is easy. I'm sure you knew
    > that. But I would hate for anyone else to be
    > confused - it's such a common mistake.

    Yes I know....slip of the fingers.

    Anyway...you know what I meant :)

    Slashdot needs a new posting system that scans
    a post, and posts what the author meant instead
    of what he typed. It will solve alot of problems.
  • Why?

    All that an evesdropper would be able to tell is
    that you sent an email through remailer A.

    Since it is encrypted, they would first need
    to break the encryption (IDEA or RSA...I doubt it)
    Just to find out what the second remailer is.
    and then it has to be broken again to get the
    next step.

    Since noone knows what you are sending prior to
    it reaching the final remailer, there is no reason
    for them to suspect anything and go through the
    effort. (and breaking the encryption of PGP is
    most probably very hard work...even for the NSA)

    Even if the NSA themselves could break PGP
    easily and decode every message going to every
    remailler....they would gain nothing and lose
    alot by admitting to the fact that they can...
    so it wont matter anyway.

    That is of course unless you are releaseing
    source code to an algorithem that can factor
    large primes in linear time. Then you can expect
    to arouse their attention.

    anyway... 6 hops through remailers in at least
    3 differnt countries should do the trick.
  • Why go through the trouble?

    Find encrypting anonymous remailers. Get their
    public keys.... encrypt the message a few times
    over with them....
    then bounce it through 6-10 of them, all in
    differnt countries, then into a mail to usenet
    gateway.

    Is this still viable? I havn't checked out
    anonymous remailers in years but...I would
    imagine that tracing back to you would be nearly
    impossible if done right.

    Too bad annon.penet.fi is gone. (am I the only
    one still lamenting their demise? whats it been
    4 years now?)
  • Perhaps the general idea is simple, but the implementation is quite a nightmare. It's much like saying "Well, we'll just set up a government that passes laws and distributes money in a way we'll all find acceptible".

    Sure, it's complex. But I don't see that it's any more arbitrary than "Lets make some random laws and rely on people to sue each other all the time and hope that everything just works out".

    It's an ambitious enterprise certainly. But it's worth the effort because the potential rewards are enormous.

    Don't forget that patents and intellectual property are articficial constructs. They were created at a time when information was scarce and economic progress was paramount.

    Now, technology has brought us to a state where information could be made free and the sum of human knowledge could be harnessed for everbody's mutual advantage. How sad then that antiquated laws remain, stifling the economy and providing little more than a way for businesses to stab each other in the back and extort monopoly power.

    "Now, the incentive to innovate is created by a public body that is independant of the government, perhaps even with its own democratically elected committee. Its role is to reward those who create useful innovations with hard cash awards."

    Consider what this would entail, particularly if we're talking on the scope you seem to be. Lets just consider software development - who decides who gets what out of the myraid of potential developers? I could go on for awhile here, but I'll limit this post to direct responses.

    Quite easy. New products get registered and published. Anyone is free to take them up, package them and sell them. Over the next yaer or two, surveys are done on the uptake of different types of products. Awards are given to creators based on how well used the products are, with a modifiying factor for the type and complexity of software.

    I don't think that is particularly hard to administer. With reasonable data gathering a fairly small team of people could distribute awards to a whole industry. If people get missed out, you can always give them an award later when the true potential of their idea/product is realised. A democratically elected steering committee can stamp out abuses, but I think these would be relatively few since the process would be open to public scrutiny.

  • Since I graduated in economics, the issue of incentives to innovate has always been a fascinating subject to me. I have never been happy with the concept of "ownership" of an idea, but as a practical person I see the need to guarantee that the important innovations actually occur. Some people seem to think that patents are in some way neccessary to create innovation. This is demonstrably untrue. People have been programmed to regard ideas as property, but this is a lie perpetuated by a combination of inertia and vested interests. If you look at the issue with an open mind, you can see that there is in fact no need for intellectual property at all. So what is the solution? There are many good ones, but I think my solution is relatively simple and effective. All ideas / algorithms / techniques are to beconsidered public knowledge. This has big economic benefits, since it ensures competitive markets and guarantees that the benefits of science will be utilised to the maximum extent, which is *not* the case when you are restricted by patents. Now, the incentive to innovate is created by a public body that is independant of the government, perhaps even with its own democratically elected committee. Its role is to reward those who create useful innovations with hard cash awards. Awards are only given if an innovation is a proven success, i.e. people take it up and use it effectively in the market. In a way, the award is meant to reflect what the inventor would have been able to earn under a patent system. Note that the product could be produced by anyone, not necessarily the inventor, which is a good thing because the market will now be competitive, driving economic growth and further innovation. Funding for the awards will come out of general taxation. This is the fairest solution, since innovations now benefit society and the economy as a whole. I would estimate that this would be a fairly small addition to the tax burden, which would be more than compensated by greater economic progress. The award system will undoubtably cost money to set up and run effectively, but will probably still be cheaper than the current patent system, if you include all the legal expenses paid by firms. Biggest bonus of all is that since all ideas are now free, innovation and research can occur much faster without being encumbered by other people's patents, the need to patent your own ideas or any of the frightful legal wrangling that currently occurs. Of course, there are a lot more complicated economic arguments behind all this. But I'm pretty convinced any country that adopted this model would surge ahead of the rest of the world in technological and economic development. Not only does it have practical economic advantages, I think it is also philosophically more elegant and more morally justifiable in terms of freedom.
  • Since I graduated in economics, the issue of incentives to innovate has always been a fascinating subject to me. I have never been happy with the concept of "ownership" of an idea, but as a practical person I see the need to guarantee that the important innovations actually occur.

    Some people seem to think that patents are in some way neccessary to create innovation. This is demonstrably untrue. People have been programmed to regard ideas as property, but this is a lie perpetuated by a combination of inertia and vested interests. If you look at the issue with an open mind, you can see that there is in fact no need for intellectual property at all.

    So what is the solution? There are many good ones, but I think my solution is relatively simple and effective.

    All ideas / algorithms / techniques are to beconsidered public knowledge. This has big economic benefits, since it ensures competitive markets and guarantees that the benefits of science will be utilised to the maximum extent, which is *not* the case when you are restricted by patents.

    Now, the incentive to innovate is created by a public body that is independant of the government, perhaps even with its own democratically elected committee. Its role is to reward those who create useful innovations with hard cash awards.

    Awards are only given if an innovation is a proven success, i.e. people take it up and use it effectively in the market. In a way, the award is meant to reflect what the inventor would have been able to earn under a patent system. Note that the product could be produced by anyone, not necessarily the inventor, which is a good thing because the market will now be competitive, driving economic growth and further innovation.

    Funding for the awards will come out of general taxation. This is the fairest solution, since innovations now benefit society and the economy as a whole. I would estimate that this would be a fairly small addition to the tax burden, which would be more than compensated by greater economic progress.

    The award system will undoubtably cost money to set up and run effectively, but will probably still be cheaper than the current patent system, if you include all the legal expenses paid by firms.

    Biggest bonus of all is that since all ideas are now free, innovation and research can occur much faster without being encumbered by other people's patents, the need to patent your own ideas or any of the frightful legal wrangling that currently occurs.

    Of course, there are a lot more complicated economic arguments behind all this. But I'm pretty convinced any country that adopted this model would surge ahead of the rest of the world in technological and economic development. Not only does it have practical economic advantages, I think it is also philosophically more elegant and more morally justifiable in terms of freedom.

  • Yeah, the award system is more geared towards tangible things like patents, innovations and copyrighted works. It's a big thank-you from society for those who make the world a better place.

    For things like ongoing drug research, it might be better to focus on funding practical scientific research through universities and suchlike. Getting research grants beforehand is certainly much less risky for innovators.

    Still, I think the main beauty of the award system is that it virtually eliminates potential corruption and uncertainty about the value of a project. Awards are only given for things which are a proven success, at which point the innovator has certainly shown themselves to be deserving.

    Ultimately, I guess that the exact nature of funding would be somewhat dependant on the nature of the field being researched. You'd also need a transitional period as these new systems are introduced, although I think this could be managed quite easily provided the long term objectives are always bourne in mind.
  • What's ironic here is that the standard practice of government you just described is often frowned upon by corporations: it's "not invented here", so we don't touch it. And of course, I mean the very corporations that benefit from IP developed under government contract.
  • Well, the DVD trials will be a landmark trial. Soon we will see where the land lies, and no matter the outcome, it will certainly set a precedence. Hopefully in the direction of free speech and thought, but unfortunately it's too early to tell.

    In either case, what you'll need to worry about is what restrictions were put on the material you used. The problem with the DVD issue is that they use a shrink wrapped licence stating that you can't reverse engineer it, but as long as nothing like that applies (in which case you'd have to fight that what you're doing is covered by laws making it legal), what you need to worry about are the usual trouble spots in reimplemantation. Is it clean? Can you document that you at no time used unlawfully attained information? Did you have access to any information for which you're bound to NDAs? Etc.

    The biggest problem, probably, is that the companies could sue you whether or not they thought they could win, to frighten you into submission. Assuming you live in the US of A where everyone has the God given right to sue anyone else, there is nothing you can do to prevent this, only fight and win.

    -- Eythain

  • > Open Source needs a Legal Defense Fund of some kind ...

    Hey! That's a terrific idea!

    Let's create one. I'm willing to contribute ... after all, I make money off Linux, and not being a programmer don't have any opportunity to contribute. But I know fundraising and non-profits.

    I can, at this time, donate:

    1. Web hosting space and e-mail (on Pacbell.net)

    2. Small amounts of cash after tax day.

    3. 4 years of non-profit expertise.

    But, of course, this requires Open Source community participation. Who else is interested?

    This is serious. Please reply to agliodbs@pobox.com with "OSLDF" in the subject line.

    -TheFuzzy (Josh Berkus)

  • All ideas are built upon a layer of previous ideas. An example is that crypto grew out of mathematics; tools build tools build tools, and things fall out along the way that we use.

    This individual is working from the idea that someone else came up with, just like millions of others have before him. Making the claim that he's 'stealing' anything without the evidence of wrongdoing seems to be a hallmark of the (in)justice system of the U.S. where guilty until proven innocent seems to hold sway..

    If this individual is gleaning information from articles and trade papers he's not stealing; he's availing himself of freely available information to take an idea, whether patented or a 'trade secret' (oxymoron if I ever heard one), to a further level, or along a different path to reach the same result. Much akin to building a homemade skateboard; you know someone patented the idea, but are you really going to hurt their business by 'rolling your own'? If you try to sell the resulting product is one thing, but creating something for yourself, IMHO, cannot be a crime.

    I for one am glad that there are individuals like this in society who are willing to step up and make ideas happen, even in the face of the extremely juvenile patent law system of the U.S.; juvenile in the sense that it is not sufficent to deal with the current state of intellectual property, and has no provisions to give a clear cut reach to law regarding trade secrets.

  • Third, release it anonymously.

    That people have to release useful, open codes anonymously in order to avoid terrible corporate punishment is a very sad thought.

    I should hope that I would have more sense, but I would be very tempted to release such codes with my name on them. To me, the support of the hacker community is worth the price of corporate crackdown. Then there's that whole ego thing a la esr.
  • by dattaway ( 3088 ) on Tuesday February 01, 2000 @05:09AM (#1316320) Homepage Journal
    Anonymous internet access? May I recommend wireless lan with the usual 2.4GHz IEEE 802.11, signal unencrypted, and default settings. I leave it as such and anyone in my town can park their car in the neighborhood with their laptop and use it (ssh is your friend.) Someday it will be abused and I'll have to lock it, but its there and I'm sure many other people have their links in the open too.
  • by Alan Shutko ( 5101 ) on Tuesday February 01, 2000 @04:14AM (#1316321) Homepage
    One thing I've been trying to wrap my head around lately is, why do people believe they have the right to decompile and start distributing someone else's hard work?


    US Law gives us that right.


    The law differentiates certain protections. Copyright protects an expression of an idea. But the ideas in a work are unprotected, and reverse engineering is allowed as a way to retrieve those unprotected ideas, so long as you don't infringe on their copyright by copying the expression.


    This isn't a new concept. Society doesn't recognize a permanent right of creators to keep their ideas secret. You have a right to try to keep it secret (trade secret, aka don't tell anyone without contracts), or you can release it fully in exchange for temporary protection (patents).

  • by trance9 ( 10504 ) on Tuesday February 01, 2000 @02:20AM (#1316322) Homepage Journal
    First, release it from a country where the patents and trademarks do not apply. You might have to do some digging to figure that out. At the very least, that confuses the jurisdictional issues. Second, release it to the public domain. Third, release it anonymously. If you don't have the resources to fight the legal battles (and it sounds like you don't; and it also sounds like you might lose them) then the best thing you can do is simply make it available to those who might have the resources, or who might be in a better position to win the battles. For example, it might turn out that European users will be able to make use of your software, whereas U.S. users may not. Obviously since you haven't said what you are doing, I don't know :-)
  • by FreeUser ( 11483 ) on Tuesday February 01, 2000 @05:04AM (#1316323)
    Third, release it anonymously.

    Bad advice. If the intent of the author is to release something to the community, then he probably wants to be sure that it would be possible for others to use his work. Releasing the code or documentation anonymously would not help anyone, because they would have to prove that the original information was obtained legally, which would be impossible if it comes from an anonymous source.


    If the author is in a country where reverse engineering has been made illegal (probably at the behest of Software and Media Mogules such as Microsoft, the RIAA, MPAA, and DVD Forum), then he or she is probably not in a position to take on the overfunded lawyers of these organizations (or other, similar entities), much less have a snowball's chance in hell of winning. However, you are correct, anonymous release of trade secrets doesn't do anyone any good, because we can't show it was obtained legally and therefor can't use it safely.

    But, the author could find a friendly party in a safe country and have them take credit for the release. In this way, the author gets the protection of anonymouty (especially if he or she uses an anonymous (e.g. cypherpunk) mail forwarding service to maintain true anonymouty throughout (which I would recommend in case the "friendly party" turns out to be a malicious plant). At the same time, the community gets the benefit of a product which has been legally reverse engineered and made available.

    This doesn't guaruntee the community complete safety. After all, the CSS algorithm was legally reverse engineered abroad and that hasn't appeared to slow down the MPAA and DVD Forum from sending the secret police in to drag children from their farms, or go after every Tom, Dick, and Harry for having a link on their web page which might, somewhere, lead to the offending (though perfectly legal) code. Alas, there is no complete safety when taking on powerful, established entities with a monopoly or (in the DVD case) quasi-legal trust to protect.

    • Document everything - be as anal retentive about this as humanly possible, and have multiple backups in safe places, with at least one completely outside of your legal jurisdiction (ie foreign country)
    • Find someone in a friendly country where what you are doing is legally and let them take the credit (and risks) for releasing the product. By being a citizen of a country where reverse engineering is still legal it will be more difficult for the powers that be to (legally) go after them, though that probably won't stop them. It should also force jurisdiction into the local courts, more likely to adhere to local law, though there's no guaruntee, as the American courts seem to feel they have planetwide jurisdiction (and our illustrious military is all to willing to back that perverse notion up, alas).
    • Join the EFF, or at least send a donation there way.
    • Perhaps giving the EFF a heads up at release time would be a good idea (can anyone more in the "know" on this comment?). Such a heads up should come from the party making the public release, not the ghost author.
  • by BoLean ( 41374 ) on Tuesday February 01, 2000 @02:56AM (#1316324) Homepage
    Here is a good place to do a little research:

    http://www.softpanorama.org/SE/reverse_engineeri ng_links.shtml

    But even the most rigorous dosumentation won't protect yo from litigation. What you need is a "big daddy", someone to front you on any legal expenses. Talk to the Free Software Foundation. I know that is you assign rights to the FSF under specifically and release it under the GPL they have lawyers to help protect your copyrights. Talk to them, if you think the software you have developed is that important they are lieky to listen and maybe even help.

    Please send inquiries about GNU and the FSF to
    Free Software Foundation
    59 Temple Place - Suite 330
    Boston, MA 02111-1307, USA

    Voice: +1-617-542-5942
    Fax: +1-617-542-2652

    gnu@gnu.org
    or WWW.FSF.org
  • by Dane Torbenson ( 133523 ) on Tuesday February 01, 2000 @03:02AM (#1316325)
    People seem to be confusing the protection that patents offer with the protections offered by copyright or trade secrets.
    Patents protect a process or an idea. In order to have patent protection the subject of the patent must be fully documented and publicly available at the patent office. This means that reverse engineering should not be necessary for any product which is covered by patents, because all of the inner workings must be documented.
    Trade secret, as we all know from the DeCSS debacle, keeps the "how" out of public knowledge, but (theoretically) once the cat is out of the bag, and someone comes across the secret (by proper means) the trade secret protection is lost. Here is the area where people are trying to use trade secret law, combined with contract provisions against reverse engineering to maintain an unprecedented amount of control over intellectual property.
    Copyright, the third traditional form of IP protects a method of epression. But copyright does not protect the idea behind the expression, only the precise expression that was used.
    You really need to see an IP lawyer to have him/her identify which forms of protection are currently being asserted over the IP you are working from. Then you can figure out how to complete your project while minimizing the legal consequences.

    Dane Torbenson


  • by Raphael ( 18701 ) on Tuesday February 01, 2000 @03:28AM (#1316326) Homepage Journal
    First, release it from a country where the patents and trademarks do not apply.

    Easier said than done... However, this brings an important point: it is crucial to check for patents before releasing something that is considered to be a trade secret. If something is proprietary but not patented, then it is perfectly legal to re-implement it (as long as you use a "clean room" process and you do not copy anything directly from the current solution). But if anything is patented, then it is not possible to release this to the community.

    Second, release it to the public domain.

    Why? If he has spent a significant amount of time studying the problem and the existing solutions, I doubt that he would be happy to see some companies taking his solution and making a proprietary product out of it.

    Third, release it anonymously.

    Bad advice. If the intent of the author is to release something to the community, then he probably wants to be sure that it would be possible for others to use his work. Releasing the code or documentation anonymously would not help anyone, because they would have to prove that the original information was obtained legally, which would be impossible if it comes from an anonymous source.

    I think that the only good advice is: document everything. If you want to release something (possibly controversial) to the community, then the only way to make sure that others can really benefit from what you have done is to be accountable for it. You have to be able to prove that all the information was obtained legally, and that it does not come from any confidential documents. If every source of information is legal, then the community can benefit legally from your work (and you will be able to cover your back because you can prove how you obtained the information).

  • by guran ( 98325 ) on Tuesday February 01, 2000 @03:11AM (#1316327)
    If "they" are protecting themselves with patents, then what you are doing is illegal (even if it is ethical) If they are protecting themselves with trade secrets - No problem. As long as you can show (document everything) that you reverse engineered from open sources you are in the clean.

    Of course, IANAL, and there is much more to lawsuits than mere law (as we all know).

    Now I don't know what field you are in, but lets say you are reinventing coca cola.

    You may analyze a bottle (Reverse engineer) or use open sources (what is printed on the bottle i.e water, sugar, artificial flavoring). If you never seen the real recipy (trade secret) you are in the clear as long as you dont try to call your product "Coca cola" or something too similar.

    If, on the other hand, you are making a simpler way to shop online (i.e. one click shopping). Assuming that Amazon's patent would hold in court, you can't recreate it in any way unless you can show that what you have done is really different to what is patented.

    In short: Against patents you are screwed if their lawyers find you. Against trade secrets *they* are screwed as soon as you can show that you did the same independently.

  • by PG13 ( 3024 ) on Tuesday February 01, 2000 @02:48AM (#1316328)
    First off the issue at hand is NOT about stealing anyone else's code. It is about implementing some algorithm in code. This algorithm has (presumably) either been published in major journals or enough information is availible in the field to figure this algorithm out WITHOUT stealing anyone else's code.

    Certainly from a moral standpoint (and a legal standpoint involving copyright but not patent) their is no theft occuring if I figure out hos someone else did something independently and implement this algorithm myself. (In some sense this is what DeCSS is about. Someone figured out the algorithm mapping encrypted to decrypeted files. This algorithm, being unpatented, should be perfectly within our rights to use as we see fit. No one copied their code and is distributing it.).

    From a moral issue there is no reason whatsoever to assume that using someone else's idea is wrong or incorrect. They do not lose anything when you use their idea (to say they lose the rights to it is fallacious as it assumes that they have said rights in the first place) like they do when you take physical property from them. The arguments for Intellectual prooperty are ENTIERLY economic. If we did not have laws protecting IP then there would be no incentive to create works and/or new products. It is interesting to note that these laws were all originally choosen to have reasonably limited durations but that lobbying from various companies has pushed up the copyright time to a ridiculous level.

    For a while after the revolution the United States had no copyright law to speak of. Of course during this period we produced little literature and became a 'pirate country' reprinting books from other countries beyond their law.

  • by panda ( 10044 ) on Tuesday February 01, 2000 @03:43AM (#1316329) Homepage Journal

    You shouldn't be asking these questions here or in any other public forum. I, for one, will not answer these questions. It is asking for trouble to answer legal questions in places such as this.

    My advice to you is hire a lawyer, or don't release your work. You'd better know the legal implications of what you're doing before you do it, and the description of what you're tyring to do is too vague for anyone, even a lawyer, to give you any kind of decent answer.

    BTW, YOU WILL end up in court if someone has made it clear to you that what you are reverse engineering is considered a trade secret. If you've had any kind of access to that trade secret, and you knew it was a trade secret, you'll probably get sued, and you'll probably deserve it.

    Now, we just have to get the Slashdot crew to stop posting these things.

  • by irh ( 27628 ) on Tuesday February 01, 2000 @04:09AM (#1316330) Homepage
    As much as I admire and enjoy slashdot, it is about the last place I would seek legal advice (which is what this is.) A perfect illustration of why is that your initial post, and the replies that have followed, have failed to distinguish between patents, trade secrets, copyrights, etc.

    You mention that the work you are attempting to re-implemenent is the subject of "proprietary" protection and "trade secrets", but then you claim that you will be the subject of patent litigation. I'm sorry - what are you referring to? If they have patents on the technology, then what are the patent #'s? Further, if they have patents, then their technology is NOT a trade secret - patents are published.

    You mention that "most of the work is considered proprietary, the rest is considered trade secrets" this doesn't make much sense. First point - "proprietary" is NOT a subset of intellectual property. IF a technology IS the subject of either patent, copyright or trade secret protection, only then can they consider it proprietary.

    So again - if there is no patent, there is no patent protection. If the technology is contained in published works, then there is no trade secret protection (unless what you are referring to is object code software that has been released to the public - you are not clear on this point). (If however, you gained knowledge of the technologies you are trying to re-implement under an implicit or explicit agreement of secrecy, then you may be in hot water.) If you are not copying source code verbatim, then you are NOT violating copyright by re-implementing the algorithm.

    Further than that, you simply haven't provided enough information to help you in any meaningful way.
  • by x0 ( 32926 ) on Tuesday February 01, 2000 @02:31AM (#1316331) Homepage
    I recall watching Cringeley's first special on computers a few years ago. In order to claim that the reverse engineering was clean, there were two sets of engineers. The first set of engineers had access to the device being reversed (IBMs PC BIOS) and compiled a set of rules. The second set of engineers worked _only_ from the rules obtained by the first set and supposedly never came into contact with the device being reversed.
    I get the impression from your posting that there really isn't even a product available yet to be reversed, but that there is enough information to design a parallel process. Whether or not this can stand as 'clean room' reversing would depend on how the data you obtained was presented.
    I agree with one of the prior posters; If it was obtained from patent documents, you might have some problems.
    I am curious whether or not, if the data was obtained from published commercial/scientific documents, copyrights might also be claimed?
  • by Paul Johnson ( 33553 ) on Tuesday February 01, 2000 @03:26AM (#1316332) Homepage
    I am not a lawyer, but I'll have a shot at the patent side of this.

    The thing to read in patents is the Claims. Getting a patent is a bit like homesteading a piece of territory used to be: you stake your "Claim", and if nobody else has got it first then its yours.

    Imagine how homesteading might have worked if there were no size limits and no need to "prove" the claim (in the sense of exploiting it all). You can stake your claim by putting four pegs in the ground: the perimiter defined by those pegs is your claim. However the claim is only valid if nobody else has put any of their pegs in that area first.

    Patent claims work like a series of (mostly) concentric peg claims. Claim 1 pegs out the whole of Arkensas, but you don't really expect to get that one. Claim 2 pegs out the whole of Hazzard County, and you don't really expect to get that one either. Claim 3 pegs out 50 square miles, and you might get that one if you are lucky. Claims 4-6 are the most likely looking homesteads within claim 3, and claim 4 is where you actually start expecting to defend your property.

    So, look at the claims on the patent, and figure out which ones are just restatements of prior art. For example in the DVD content scrambling patent [164.195.100.11], claim 1 pretty much describes any PRNG. Claim 2 probably covers a lot of cryptographic PRNGs (its not my field), and claims 7 and 8 cover the use of a PRNG number stream XORed with the data. So those claims would be covered by prior art and the MPAA is unlikely to contest them. They will concentrate on the later, more specific claims, such as the precise pattern of XORs in the PRNG.

    So if I were writing a DVD descrambler routine I would try to come up with an algorithm which evaded the detailed claims, and forget about claims 1, 2, 7 & 8, and any others with textbook prior art. If you could show a standard textbook as prior art then I would expect the suit to be declared vexatious. But IANAL, of course.

  • by Hobbex ( 41473 ) on Tuesday February 01, 2000 @02:23AM (#1316333)
    IANAL, but this seems more or less clear:

    a) Stay down. Barring your own vanity, releasing something anonymously on the Internet is not that difficult. Put everything together nicely, and then send it to a mailing list or newsgroup on the subject through a Mixmaster or Cypherpunk mailing list. Leave spreading it to the power of the masses and of the Internet, by just creating it you have done enough.

    This means major paranoia though, possibly you are not careful enough even when submitting this Slashdot. How sure are you that Rob and Andover are _really_ wiping the logs?

    Yes, it sucks to have to be anonymous to speak freely, but such is the nature of living in a non-free society (and I won't even dignify anyone who says we do with a reply). Possibly you could sign the message with a public key, so that when (if) freedom comes you can take credit for your work. Consider that possesion of the private key would be very incriminating however.

    b) Make a matyr of yourself. Contact a lawyer, and maybe a charity that is ready to help you first. Then just go out and tell the truth, ready to be the case that gets taken to the supreme court. It's a risky strategy, but it is a lot more glamorous then the first, so some people may still prefer it (being a pompous asshole myself, I think I might). And at least in this case you have a better chance of the data actually becoming legal, so that using it is not thoughtcrime...


    -
    We cannot reason ourselves out of our basic irrationality. All we can do is learn the art of being irrational in a reasonable way.
  • by grumpy_geek ( 97488 ) on Tuesday February 01, 2000 @02:33AM (#1316334)
    One thing I've been trying to wrap my head around lately is, why do people believe they have the right to decompile and start distributing someone else's hard work? It seems to me that the mantra of the opensource movement is free as in freedom not free as in beer; and what these people are doing is reversing that and making it "free as in beer". Haven't people ever thought to work within One thing I've been trying to wrap my head around lately is, why do people believe they have the right to decompile and start distributing someone else's hard work? It seems to me that the mantra of the opensource movement is free as in freedom not free as in beer; and what these people are doing is reversing that and making it "free as in beer". Haven't people ever thought to work within the system... (use your most whiny voice) "oh, but it takes to long", "oh, they didn't want to the first time, so I'm going to make them", "we didn't have it for X platform and I want it now!", "oh, I'm spoiled little brat who can't wait for something".

    Forcing a company to release source code really isn't freedom, it sure seems me like strong-arm mafia tactics by snotty brats. Slashdot sure brings itself into a huge fit when a mention of the GPL being violated, now where is our moral outrage that someone is wanting advice on a premeditated violation of someone else's license.

    I don't really care if it's legal or not in their home country, I think it's morally wrong to force our opensource ideals onto companies by tactics slashdot would raise holy hell about if the rolls were reversed. If a company doesn't want to release something opensource what right to we have to TAKE AWAY THEIR FREEDOM? I love opensource, I am a firm believer in giving back to the community; but this premeditated stealing of someone else's code I can't agree with.
  • by uglyduckling ( 103926 ) on Tuesday February 01, 2000 @02:27AM (#1316335) Homepage
    I have to agree with other posters: documentation is essential. I work in a (UK) lab environment where documentation is very hot. Off the top of my head, here are the guidelines we follow:
    • Lab books should be properly bound and have sequential page numbers
    • Each page should be dated and signed by the researcher and a witness/supervisor
    • Blank spaces should be crossed through and initialed/signed
    • Computer printouts should be glued in, not just kept on disk
    • Any crossings-out/deletions should leave the original text readable. No tippex/whiteout
    • Abbreviations should be kept to a minimum and explained where unclear
    That's probably not an exhaustive list, and the poster of the article may know this already. Hopefully it will be useful to somebody.
  • by Teliver ( 142439 ) on Tuesday February 01, 2000 @02:14AM (#1316336)
    Document, Document, Document. The key to a good defense is to be able to prove HOW you did something. Keep a daily diary with the steps you've taken and plan to take. Document all results, and all versions of the code you are using. If you can prove that this was reverse engineered 'cleanly', then your legal problems will be much less than they would be. I'd also hire a good lawyer NOW. And not one that handles wills and property transactions. I mean one that understands copyright law. Good luck to you.

Where there's a will, there's an Inheritance Tax.

Working...