Managing Software Intellectual Assets In Cloud ComputingPart

Document Sample
Managing Software Intellectual Assets In Cloud ComputingPart Powered By Docstoc
					                                                                                        Cloud Computing

Managing Software Intellectual Assets
In Cloud Computing
Part 1
By Dwight Olson and Stephan Peters

   Stephan Peters, LES Germany, and Dwight Olson,                    know-how, or the codified, tangible descriptions of
LES (USA & Canada), discuss how technology escrow,                   specific knowledge which may not have specific Fed-
a common technique for avoiding quarrels between                     eral legislation to protect commercialization.3
licensor‘s and licensee’s of software, is morphing and                  Independent of the kind of IP and IA protections
getting global attention to help make win-win situa-                 that apply, the classical
tions in the cloud! This is the first article in a two part          software model com-
series on the emerging issues of having software and                 prises one creator/licen-      ■ Dwight Olson,
data in the cloud. These two articles begin to address               sor, an application, a         V3Data, Principal,
the inherent complexity of managing the risk of soft-                license and a user who
ware assets including data in the cloud. Part one will                                              San Diego, CA, USA
                                                                     installs (the object code
look at software programs and systems, then part two                 of) the software on his        E-mail:
will focus on data. This article assumes the reader is               proprietary hardware.          ■ Stephan Peters,
generally familiar with classical software escrow and                The licensor controls          Deposix Software Escrow,
cloud computing concepts including SAAS, PAAS                        the origin of the soft-
and IAAS.                                                                                           Founder & CEO,
                                                                     ware (its source code)

                                                                                                    Munich, Germany
          owadays, software is highly sophisticated and              and provides mainte-
          may be protected by many forms of Intellec-                nance to the user, who in      E-mail: stephan.peters@
          tual Property (IP) and contain many forms                  turn owns and controls
of Intellectual Assets (IA). It is almost ubiquitous                 the complete infrastruc-
as it impacts and improves countless aspects of our                  ture on which the appli-
professional, corporate, and personal lives. Software                cation runs. Moving ahead into the cloud, this simple
creators typically devote significant time and financial             setup is changing completely as additional parties are
resources in an applications pre-commercial phase                    introduced and power and control shift.
and those investments often continue long after the                     Having established that, what about digital data
software’s market launch and through its life cycle.                 housed in the myriad of electronic databases across
It is thus a no-brainer that owners of the software                  the globe? Data may not be protected as an IP, but it
strive to protect the valuable components in that                    certainly is a valuable intellectual asset. In the past,
software. Just as for any commercialization, the rule,               data was considered owned by the licensees—at least
‘Put protection first!’ applies.                                     that’s what they would contend—and historically
   As discussed in a previous les Nouvelles article                  most corporate data was controlled by the software in
regarding software, one could consider “intellectual                 protected information technology (IT) departments;
property to comprise patents, trademarks, copyrights                 governance was done by IT personnel who were
and industrial designs because typically these four                  employees of the company and typically charged
intellectual properties have Federal legislation with                with the responsibilities of maintaining and securing
a public registry to govern, protect, and permit value               that data. Most data resided behind the walls of the
propositions for the owners.”2 The software content                  company’s data center where security, retention and
or components called IA would be the trade secrets,                  backup were of primary concern. That is, keeping data
                                                                     safe from migration outside the company, keeping the
                                                                     data only as long as required for legal reasons (or if
                                                                     vital digital records, forever), ensuring data consis-
   1. Software as a service, platform as a service, infrastructure
as a service.
   2. “Intellectual Asset Identification, The First Step in an In-
tellectual Property Management Program,” by Dave Tyrrell and
Gary Floyd, Vertex Intellectual Property Strategies Inc., 2011,         3. Software Inventory Valuation Part 3—A TSV (OV) les Nou-          velles, June 2009.

                                                                                                              September 2011         160
  Cloud Computing
      tency (its validity, accuracy, usability and integrity)       the database manager to modify the database
      and keeping the data backed up in case of an IT data          schematics. Creators may use any of the manifold
      center disaster. These were the nightmares of the             of existing computer based programming languages
      IT department. To complicate these four nightmares            and API’s that provide for 3-D modeling in HTML
      nowadays, software and data are becoming valuable             5 for transport to browsers. The result is the so-
      assets and as such may be generating revenue directly         called source code, and anyone being capable of
      or indirectly for the company. In the cloud we might          ‘reading’ it, that is understanding the computer
      find licensors, licensees and other stakeholders fight-       program modeling language, could extract the de-
      ing for revenue without consideration of any rules            signs, know-how and expertise which the original
      of the road.                                                  creators put into it (thus the effort by the creator
         Data and software migrating to the cloud is mov-           to keep it confidential). The computer-based pro-
      ing responsibility for governance out of the hands of         gramming language and API interfaces ‘translate’
      the corporation. So, with data and software in the            the source code into computer-readable code called
      cloud, where is it really and who is responsible for          object code. This process is called ‘compilation’
      governance? More about data in Part 2.                        and as a result creates the “executable” programs
      The First Challenge of Governance in the Cloud                (you know them on a PC as the so-called ‘.exe’
                                                                    and ‘.cgi ‘ files). These files control the computer
         How exactly are we going to manage the intellectual        and interface the database system. So in order to
      assets represented by software applications in the            implement the new 3-D field, the creator needs the
      cloud? A little background here would be helpful.             source code to make the program changes. The
      Yes, for the licensor unwarranted copies may exist,           creator also needs to coordinate with the database
      but this is not a new issue for the owner of software,        manager for access to the database schematic to
      even if in the cloud. Digital rights management               make the database changes, then the creator needs
      systems have been around for quite some time and              the data extracted, schematics updated, and data
      will operate just fine in the cloud. However, for the         restored together with the installation of the new
      Licensee, corporate concern is about continued use.           software. Without the source code the software
      This implies access to the licensor’s design docu-            and data could only be used as it was. There would
      ments, trade secrets, know-how, and source code.              be no 3-D field.
      And why are they so important? Recall that software
      application source code provides access to all the de-      Ownership or rights and access to the source code
      signs, know-how and other intelligence incorporated       provide the ability to modify and support use, continu-
      into a given software application product. Think of       ation and commercialization of software. To compli-
      it as accessing all the information about a patent at     cate matters, today’s software and data are becoming
      the PTO5, but without a patent in place to protect        inextricably linked. And as seen in the figure below,
      the licensor.                                             software and data and their physical infrastructure
                                                                (hardware) may no longer be physically together or
          An example. When software biotec creators             managed by the same organizations.
          design software for a new functionality such as to
          add a new 3-D field in the company’s genome’s         It’s Easy Being the Licensor… Not!
          database and manage that field via a browser, they      Historically some licensors have relied on copyright
          must write specific instructions for the computer     protection or to possibly file a patent for the software.
          servers and browsers and then coordinate with         Yet, it is not always that easy. While copyright protec-

                                                                   Cloud Computing4

         4. From LES 2010 Annual
      Meeting Workshop 2-B Cloud
      Computing 101: Business Models,
      Technologies and Licensing Issues,
      by Richard Greeley, Director,
      Licensing, Microsoft Corporation;
      Stacy Snowman, Partner, DLA
      Piper; Tyron Stading, Founder,
      CTO, Innography.
         5. Patent and Trademark Office.

161   les Nouvelles
                                                                             Cloud Computing
tion and patents for software are generally available      its long-term potential? NOT! If only it would be that
across most industrialized countries and jurisdictions,    easy! The issue of software continuity for the body of
typically only certain parts of today’s comprehensive      users is far more complex. Here is an example. Often
software programs out there stand a chance of reach-       times in the corporate world, corporate licensees
ing that intended shelter. Yes, copyright protection       have to invest millions in new and improved software
is typically universal and used to protect specific        and it‘s inevitable implementation into an existing
components of the software, such as the deliverable        IT landscape. Often new software, even updates,
.exe programs, “how to” documentation and to aid           must be integrated and databases reinstalled. This
in the enforcement of un-warranted copies. Patents         requires additional costs for individual adaptations,
for computer-implemented inventions offer a broader        interface programming, new hardware, modifications
protection for a product or process regardless of the      to surrounding IT infrastructure, time and effort to
software language they are written in. Patents can be      analyze and adapt obsolete or incompatible internal
obtained generally for novel software-based inven-         business processes, and then comes training for the
tions which, for example, guide a satellite in orbit,      employees. Yes, the body of users each has a strong
manage more telephone calls through narrower band-         interest in mitigating the risks involved and in protect-
width, or make a computer run faster through more          ing their investments in any software and recapturing
efficient memory usage. But any competitor, who            existing data. But stuff happens! Licensors and even
finds a different way to achieve the same objective,       some cloud providers could default on maintenance
perhaps even a better way, will not have to explain        or other critical deliverables and sometimes they even
himself to the patent holder. Furthermore, and this is     go bankrupt. Then what?
true for other content such as books, music or videos      Thinking About the Problem
as well—software is digital and travels very easy on
the Internet and between computers and countries              For those readers who have not had to think about
in the cloud. Nowadays, there are very few physical        access to trade secrets such as source code at the
restrictions on its dissemination or boundaries. In        corporate level, recall the time when you decided to
many ways, it is this last aspect only that enables        upgrade from an older model of a PC with Microsoft
cloud computing.                                           XP to a newer model PC with Microsoft Vista (now
                                                           Windows 7). Remember? Some of your XP programs
   But, here is the heart of the issue for the licensor.
                                                           would not install on Vista, you needed to go to the
Historically, even when considering copyright and
                                                           supplier of the software and purchase an upgrade.
international patent protection for one’s software,
                                                           Remember! Not fun! What would you have done if the
most licensors will never allow their source code,
know-how, and design document contents to be dis-          supplier was not there for the upgrade? What would
closed, either to the general public (through copyright    you have done with your data files? In the corporate
registry disclosure) or to licensees who desire access     world, the company needs to get access to the creator
to source code for risk management. Why? Because           and/or the source code if the licensor is gone.
trade secrets and know-how, often considered the              Depending on the licensing process, the parties
most valuable assets of a company, could possibly          who did not start addressing this conflict of interest
be extracted and re-used in any number of creative         early in the negotiations encountered a very costly
and legal methods. The result could mean dire con-         situation. The quarrel over the source code has been
sequences for a vast majority of existing creators         recorded as an insurmountable stumbling block in
and licensors.                                             more than one case in the past 30 years! Just recently,
It’s Easy Being the Licensee… Not!                         Marshall Phelps, past corporate counsel for Micro-
                                                           soft, was speaking at an LES event on doing business
   So while the licensor/creator has every reason to
                                                           in China; he recalled the Chinese government wanted
keep his trade secrets and know-how secret, that is
                                                           the source code for the Microsoft Operating System.
not the position of cloud customers, cloud caretakers,
                                                           I believe the words were: “NO WAY, they are some of
and licensees (let’s call them the body of users). From
                                                           the most valuable assets of the company!”
their perspective, risk management and protection
is just as crucial for continued revenue. This may be         (Note: The particular case of open source (OS) will
further complicated if the software application is man-       not be discussed here—while the authors recognize
aging the data “owned” by one of the body of users.           the value and acceptance of the many OS business
   Is the body of users to be totally dependent on            models being used globally, we predict that there
the good will of the licensor to allow them to exploit        will always be proprietary software in the global
both the data and software’s immediate benefit and            community including the OS collaboration world.)

                                                                                                 September 2011        162
  Cloud Computing
         This conflict of interest becomes apparent when the               to the underlying agreement. The team must take
      licensor prefers to keep his source code secret and                  into account all points of view and mitigate the risks
      not disclose it to anyone; but the body of users seeks               including technical and value solutions. Someone
      to get hold of the source code in case the licensor                  needs to give an opinion as to whether the escrow
      defaults on obligations. Both sides have legitimate                  and contents are valuable, appropriate, and fit for
      interests. If both sides insist, they would never sign               the purpose. In the cloud this will require the legal
      an agreement, but luckily source code escrow was                     community, technical escrow companies and consul-
      invented in the early 1980’s6 to address this specific               tants to work in concert to solve the dilemma. How
      problem. Historically, without source code escrow                    does one create instruments and verify, validate, and
      the deal may have gone south or the creator may                      value the contents that will help solve access and
      give up its assets.                                                  continuity? And be able to address the issues of the
         But, the issue and solution is far more complicated               data (part 2)?
      in the cloud. Why? In the cloud, who is responsible                     For the technical escrow companies, these organiza-
      for mitigating the risk for future source code access?               tions need to have internal processes with verification
      Who, of the body of users, has any contract/license                  and validation expertise to help counsel with the de-
      agreement at all with the creator of the licensor? Who               posit components, and then be ready to accommodate
      and where are the creator(s)? Do the SAAS players                    regular updates, electronic or media, and possibly
      license the software to the PAAS or IAAS players, or                 have an international transfer capability or partner to
      do they just have an agreement to use the platform                   house the escrows in an appropriate country.
      or infrastructure? Is the SAAS player the creator or                    Remember in the United States, Congress amended
      is there another creator/licensor? These were the                       the Bankruptcy Code, 365n, to permit an executory
      nightmares of the corporate IT department. Who of                       contract/license to continue after bankruptcy as well
      the body of users is thinking of these issues?                          as any escrow agreement that was supplementary
         In order to begin to solve this or any other cloud                   to the license. So what licenses exist in the cloud?
      issue, it may be wise to select a team of players who                   What country is the licensor in? If the provider goes
      can begin to provide some guidance. Possibly, IP                        bankrupt, who is responsible?
      counsel with international bankruptcy experience,                       Based on the business deal, the countries involved,
      a trusted neutral third party with international and                 the parties involved, and the risks to be mitigated, the
      technical escrow expertise, and the body of user’s                   technology escrow/bailee/SPV company and counsels
      counsels would be a good start. They must construct                  may need to morph software escrow and adapt new
      solutions to mitigate risks for all parties’ including               solutions to the special situations of the international
      the licensor. Sometimes a starting solution is to use                cloud. For example, Data Securities International
      the current escrow vehicle to address the software                   operated prior to the 365n statue change for execu-
      continuity dilemma and morph as needed.                              tory contracts. They worked with U.S. counsels to
         Historically, after 1986, the software escrow ve-                 prepare instruments that could begin to solve the
      hicle was a three-party constellation in which the                   executor status issues. Using a structure like a ‘let-
      escrow company served as a trusted bailee or SPE7                    ter of credit” or 2 x 2 party agreement structure’
      and held the IA in digital secure custody; similar in                could act as a beginning. Though this structure was
      concept to a notaire, bank, or legal services firm                   never tested in court, because 365n was amended,
      which serves as trustee in physical properties and                   at all times where a license agreement existed with
      securities. But in the cloud, the trusted bailee must                an escrow agreement, the source code deposit was
      have the competency to understand the total situa-                   delivered to the licensee.
      tion and to help implement a solution complementary                     In one situation, however, when the escrow was
                                                                              supplementary to an investment collateral agree-
                                                                              ment; instead of providing the escrow contents, it
         7. See les Nouvelles March 2008 Leveraging Software: “lend-
                                                                              provided the investor with enough information to
      ers will prefer to have the software assets reside in a wholly          convince the judge to render the decision that the
      owned subsidiary that has a totally separate operation from the         debtor could not just walk away with the source
      software owner. Referred to as a Special Purpose Vehicle or             code. Because of the escrow, the investor was able
      Entity (“SPE”), these holding companies serve to protect the            to gain an equity position in the new company.
      lender against the possibility that the software owner will file
      for bankruptcy protection. If there is not a SPE already in place,      Once the contract structures are worked out,
      setting one up should be one of the first steps taken.”              specific release conditions defined, SPV defined and

163   les Nouvelles
                                                                               Cloud Computing
implemented, content and ownership transfer pro-            to the source code. Of course, the software escrow
cess agreed upon, verification, validation, and valua-      registry holding company must be able to verify that
tion determined, only then can the software owner           the deposit can re-build the application, but what
securely transmit the initial components to the first       else? The new software escrow registry must also be
independent software escrow/bailee/SPV company for          able to technically validate any open source issues (Is
digital safe keeping. In some cases this may require a      the escrow full of open source?), database schematic
secure and encrypted transfer between independent           issues, and database retention issues. Then possibly
software escrow companies of the design documents,          they may be required to provide an opinion as to
know how, trade secrets and source code interna-            the value of the software contents. Is the software
tionally to provide legal jurisdictions. This may also      ownership transferring between countries? Are there
require the same or another independent escrow              tax implications? What else might be needed for dif-
company to accommodate the data and database for            ferent uses of the software? These are just a few of
additional escrow protections for the database own-         the questions that will need to be answered.
ers. However, without someone providing an opinion          Let’s Close Part 1 With the Advantages of
as to whether the escrow is worth its salt, verification,   Software Escrow of the Past
validation and/or valuation must be undertaken.                A correctly administered software escrow registry
   Yes, another major expense of a source code (trade       and agreement can be beneficial to all parties, and
secret) escrow registry is in the verification, valida-     the most obvious advantages being:
tion and/or valuation procedures besides the contract          1. The critical IP/IA of the software developer is
formulations. Having some degree of guarantee is of               properly protected; there is no immediate dis-
the utmost importance. If you are going to put it to-             closer of source code.
gether, you want to make sure what is in the escrow
registry is what is useful, informative, and of value.         2. The licensor is securing a revenue stream by
This was not a trivial situation for the first technical          licensing his software to that particular cus-
escrow companies, yet they managed to put together                tomer, which otherwise might not have happened.
some sophisticated standard verification processes.            3. At the same time, the licensee’s investment
These processes are still in use today by most of the             (into this software and into his IT infrastructure
technical escrow companies. Yes, verification can even            in general) is protected by an appropriate risk
be done for the cloud.                                            management tool.
Today, There is a Lot More Risk in the Right                   4. Licensee’s need for continuity (of IT operations)
to Use Software in the Cloud                                      is being addressed.
  Why validation and valuation processes for the IA?           Apart from these obvious benefits, software escrow
Well, currently verification deals with continuity of       offers additional advantages that may not be so evi-
the software application for use. If the deal is only       dent for the casual global observer. There are many
for software continuity in the cloud, then “for use”        others reasons.
verification may be all that is required.                      First, facilitating deal closures: for the licensor, us-
  Note: “For use” verification processes typically only     ing a professional escrow service builds trust in the
  deal with the ability to recompile the source code        marketplace and thus serves as an effective sales tool.
  into executable code that will permit the licensee to     The licensor is sending out a positive market signal
  update and make changes to the existing program.          about his own solidity and is openly addressing the
  However, “For collateral agreements, development          risk management needs of his customers.
  agreements and the like” other processes need to be          Second, fostering IP creation: escrow generally fos-
  developed to determine if “all” components are in         ters the creation of IP, more specifically by supporting
  escrow that provide the other party with the ability      the development of software, through offering more
  to fulfill the intent of the agreement. It may be col-    attractive market conditions—due to the additional
  lateral where a bank needs to collapse on the asset       security, licensees are more likely to buy the license
  if a loan was not repaid.                                 from the developer.
  But many escrow situations are centric to develop-           Third, offering additional financing options: when
ment agreements, collateral agreements, reseller            looking for financing—a critical process for every
agreements, co-operative agreements, and the like.          software developer—software escrow offers the
Thus data and other components of the intellectual          benefit of reducing risks to prospective investors/
assets may be required to be opinioned in addition          shareholders. A potential investor performing a due

                                                                                                   September 2011         164
  Cloud Computing
      diligence will carefully analyse the company’s IP as-      versions of his source code staying in the depot of an
      sets and assess their individual risk. If the licensor     independent trustee. In case of an IP violation, the
      can prove that his software is held in custody with a      escrow company could always prove the exact date
      professional escrow service, this will add significant     when the licensor developed his IP, a possibly crucial
      value to his business. And furthermore, software           aspect when it comes to patents, or cases of industry
      developers can offer to add the potential investor         espionage or disgruntled employees which involve
      to its escrow as beneficiary, thereby granting them        the IP incorporated in the source code.
      access to what typically is the major ‘asset’ in any
                                                                    In closing, it is worth noting that the United States
      (new) technology start-up.
                                                                 is the only country in the world that offers patent
         Fourth, improving stability in the EU for Basel II      protection under its patent law to those who are the
      and Solvency II ratings: Escrow may help licensees to
                                                                 ‘first to invent.’ All other countries are on a ‘first to
      obtain a better rating under the Basel II or Solvency
                                                                 file’ basis. Given U.S. patent legislation, an audit trail
      II schemes by reducing their overall operational IT
      risk, e.g. failure of their critical IT systems due to a   provides a valuable additional backup to the licensor
      potential default of their licensor. As a result, the      when planning to file for a U.S. patent. In this way,
      licensee may obtain access to cheaper credit offerings.    the licensor will be able to prove ‘first to invent.’
         Fifth, building an audit trail: From the moment of         Software escrow, though not as widely known out-
      signing an escrow agreement, all events such as modi-      side of the United States, Germany and Great Britain,
      fications concerning the source code are seamlessly        has escrow companies (modeled after Data Securities
      documented and a professionally managed audit trail        International, Inc.8 the first software escrow company
      accumulates. The licensee will benefit from an audit       that started in 1982) that can begin to provide solid
      trail as it allows him to roll back to older versions at   solutions for controlled access to the verified, vali-
      any time. But also the licensor will benefit from older    dated and possibly valued source code! ■

         8. See

165   les Nouvelles