...making Linux just a little more fun!

The Law for Geeks

Contents:

(?)Slanderous Thread
(?)Usage of NDAs in legal flummery
(?)NDA Addendum page
(?)More on legal follies and software: Barracuda v. merger
(?)More about real-world legal conflict

(?) Slanderous Thread

Thu, 27 Oct 2005

From Rick Moen

So, regulars will recall that I'm profoundly unimpressed with computerists' depressing habit of running shrieking in terror the moment some pushy dumbass sends them a demand letter -- or, even more pathetically, a demand e-mail. Here is a current example from one of our perennially hapless local user groups. (If this gets published, better to redact or change the names, so I don't get in trouble with $LUG.)

On the anti-spam newsgroups, there's a term for the sort of imaginary legal staff notionally wielded by spammers who send antispam activists threatening e-mails: "cartooney" (http://en.wikipedia.org/wiki/Cartooney) The term kept coming to mind, as I perused Mr. $COMPLAINANT's threat mail. 

----- Forwarded message from -----
Date: Thu, 27 Oct 2005 09:40:29 -0700

I got this in email a couple days ago. It's someone trying to force me to remove this from the $LUG archives. It's up to you if you would like. I'm sure the person who responded to me probably got some sort of threatening letter as well. I'll let you decide if you want to take it down or not. If you do want to take it down, you can notify them that it has been removed. 

Reply-To: <SNIP>
From: <SNIP>
To: <SNIP>
Cc: <SNIP>
Subject: RE: Slanderous Thread
Date: Mon, 24 Oct 2005 23:59:20 -0400
Organization: <SNIP>
X-Mailer: Microsoft Outlook Express 6.00.2900.2180

Hello $PERSON -

$URL1 and this one - $URL2

You have been previously advised to get this thread taken down. This appears at Google.com when a search is made for $COMPANY

We now are filing actions with the Attorney General's Office in Ca. We also will report this to the proper ISP authorities as well as Google.

Respond to this message to avoid any further actions and get this thread down - now.

Thank You 

Date: Thu, 27 Oct 2005 17:14:36 -0700
To: <SNIP>
From: Rick Moen <rick@linuxmafia.com>
Cc: <SNIP>
Subject: Re: Slanderous Thread

Quoting $PERSON: 

> I got this in email a couple days ago.  It's someone trying to force me
> to remove this from the $LUG archives.  It's up to you if you would
> like.

When some pushy business people want to find out if a critic will roll over, they at least lavish 10 mintes of paralegal time and a 37 cent stamp on a demand letter.

But you know you're really scraping the bottom of the barrel when they can't even bother with postage.

And the great thing about making bullshit claims like "We are filing actions with the Attorney General's office" is that most computer geeks are so extremely ignorant of the law, that they don't even realise one does that for certain criminal actions. For civil complaints such as the "slander" one (which is of course an error; should be libel) vaguely hinted at here, they would file in a county superior court having jurisdiction. And no such court would accept a formal complaint without proof that plaintiff had attempted -real- written attempts to resolve the dispute, i.e., at bare minimum a genuine demand letter sent via certified mail with return receipt.

Understand that they have no downside to making bullshit demands: It's not against the law to ask for what one is not entitled to, and it costs them essentially nothing. People who give in (which computer geeks do with depressing regularity) are giving them free victories with zero opposition, in a confrontation where the other side risks nothing at all -- an absolute dream for any shady businessman.

Only suckers roll over when they get e-mailed legal demands. 

Date: Thu, 27 Oct 2005 20:59:37 -0700
To: $PERSON
From: Rick Moen <rick@linuxmafia.com>
Cc: $LUG
Subject:  [RE: Slanderous Thread]

Quoting $COMPLAINANT:

So, for the benefit of anyone who might be still taking the sloppy (and incompetent for reasons cited) e-mailed legal threat against $PERSON (and potentially others) seriously, let's review the elements of defamation law in the USA and (generally) in common-law countries:

A defamatory statement is one that injures the reputation of another party, either by lowering the standing of the injured party in the community or by tending to make others refrain from associating with him. However, it's not just any such statement. It must pass these tests: 

-- If the speaker can prove that the statement is true, it is not
   defamatory.
-- For slander, it must actually have had that effect on listeners,
   not just potentially.  That is, if you orally claim that X is a
   child-molester and all other tests are met, it's not defamation
   unless people actually believed your claim.  The assumption of
   actual damage is only assumed in certain specific cases of
   "slander per se" (as always, assuming the claim is untrue):
        -- charges that plaintiff committed a criminal offence
        -- charges that plaintiff has one of certain "loathsome"
           contagious diseases
        -- charges that impute unchastity or adultery to any woman
        -- charges disparaging plaintiff's conduct of office,
           trade, calling, or business being conducted at that time
-- For libel, actual damages are presumed if the statement is one
   one of a small number of types considered to be "libel per se"
   (defamation that is apparent on the face of a communication):
   charges of criminal activity, adultery, "contagious distemper,"
   or dishonesty, as well as any charge which injures the plaintiff
   in his or her trade, business, or profession."  Otherwise, actual
   damages must be shown by specific and unambiguous evidence of
   wrongful harm, which is called "libel per quod".
-- "Publication":  It must be made to a third party.  X telling Y
   alone that Y is a child-molester does not defame Y.
-- Similarly, if X (above) tells only Y, and Y then tells others,
   then X hasn't defamed Y -- because Y did the publishing.
-- The statement's not defamation if it's in a situation subject
   to "absolute privilege".  There is a list of such situations,
   including communications with one's spouse, and testimony in
   court or in legislative or executive governmental hearings.
   (It should be noted that you could evade slander, only to be
   charged with perjury.)
-- The statement's not defamation if it's in one of a variety of
   situations subject to "qualified privilege".  Most involve
   speaking on matters of public or community concern, and must
   be made without malice.  This is related to the press's 1st
   Amendment protection against restrictive legislation (such as
   libel law: NY Times v. Sullivan, US Supreme Court, 1964.)
-- The defamatory statement must be fairly understood by listeners
   to be a statement of fact, rather than opinion.  Opinions need
   not be fair to be privileged:  Unfair opinions are protected
   by law.  This distinction between allegations of fact and of
   opinion is a grey area that would be decided by the Court.  The
   key question would be whether the purported opinion implies some
   false factual claim, e.g. "I think X is a murderer."
-- In most states, it is not defamation unless the speaker was
   negligent in checking his facts.  If he meets an implied standard
   of reasonable care and was mistaken, then he would be not liable.
-- Republishing someone else's libel/slander can itself be defamatory,
   if the "publisher" had the knowledge and opportunity to not do so.
   E.g., if a caller defames someone on a KGO talk show, KGO is
   probably not liable, but would not be protected if it later replayed
   that segment from tape.
-- The statement's not defamatory if the target's reputation is already
   so unsavoury that no damage was done.

The complaining party states that he wants "this thread taken down", and provides two URLs. (That's pretty damned vague. One would normally expect a libel complaint, which $COMPLAINANT in error refers to as slander, to identify specific text.)

At the first URL, $PERSON did not, in fact, make any specific allegation about the complaining party. He asked if he was justified in getting "pi$$ed off". He then asked whether there ought to be some sort of arbitration in cases where it was obvious that someone trying to sell a domain is (to paraphrase) merely squatting. He did not state that $COMPLAINANT's company was squatting.

In any event, domain squatting is not illegal or grossly immoral in any libel-per-se sort of sense, and is something a large number of businesses do, so if $PERSON did make such a statement, even if untrue, it could not reasonably be found to create actual damage per libel law.

$COMPANY would be required to show actual damages to a judge's satisfaction, and would not have a snowball's chance in Hell of doing so.

And how much do you want to bet that $COMPANY could be shown to have a dicey reputation already?

At the second URL, $ANOTHER_PERSON, responding to $PERSON, changed the subject to "Domain Squatting -- <SNIP>]", and said "These individuals registered $SITE just three days ago, apparently for the sole purpose of ripping you off", followed by "One might wonder if there's a certain amount of risk in running such a business."

The subject header doesn't actually say that $COMPANY engages in domain squatting -- and for reasons cited such a statement seems extremely unlikely to be libellous "actual damages", anyway. The "rip off" would potentially be a problem if it unambiguously meant that $COMPANY was attempting to steal from $PERSON. However, in context, it's pretty obviously an assertion of $COMPANY carrying out sharp dealing that leaves $PERSON and others with a sense of distaste, i.e., setting up a situation where $PERSON felt manipulated into buying the domain back.

Naturally, I should in fairness point out that I am not an attorney, and therefore do not and cannot offer professional legal advice. I'm just someone who does his best to understand the law, which I also recommend to everyone else here.

(?) Great: Now the guy who started this nonsense wants to insist that he's guilty of libel. I don't know why I bother, some days.

(!) [Ben] Oh, that's an easy one: you're over-supplied with human decency and are possessed of a desire to live in a better world. Than which there's no greater crime, these days. You should be ashamed to be so out of step with the society around you...

(?) Here's what I just heard from $PERSON on IRC: 

13:48 < $PERSON> redrick: Got your emails today.  All very good information.
13:49 < $PERSON> redrick: Everybody that I've spoken to about it says that
                   $COMPANY has no case.  I sent a query in to the California
                   Attorney General, will see something probably in a week or
                   two.
13:50 < $PERSON> That's my hope at least.
13:52 < $PERSON> Here's what I sent to them: <SNIP>
14:40 <redrick> $PERSON: Delighted to hear.  Hope I didn't bowl everyone
              over with too much analysis.

Indicated URL shows this text, apparently sent to the California Attorney General's office: 

   1.  Hello, I have a company in Florida who is harassing me to take
down an internet posting I made to a public mailing list in September
2001.  They are accusing me of "slander" in this post:
   2.
   3. <SNIP>
   4.
   5.  My email does not accuse them of doing anything wrong or illegal,
it only expresses my opinion that I don't like the way they did it.  To
my understanding, the First Amendment gives me the right to air my
opinions in a public forum.
   6.
   7.  I'd like to know if this is protected under the First Amendment.
Is this threat something that I need to worry about?  Their claim seems
frivolous in the least and constitutional infringing at the worst.
   8.
   9.  Regards...$PERSON

I think he's going to be disappointed, though, since I doubt that any attorney general is in the business of giving gratis legal advice to citizens about their civil tort issues.

(?) 

----- Forwarded message from $PERSON -----

Date: Fri, 28 Oct 2005 05:58:33 -0700
From: $PERSON
To: Rick Moen <rick@linuxmafia.com>
Cc: $LUG
Subject: Re: [RE: Slanderous Thread]

For a little background, I also had posted on the $OTHER_LUG mailing list. They threatened me back when I was still working for $UNRELATED_COMPANY, sometime around 2002 or 2003. I might still have the emails.

Rick Moen wanted us to know: 

>So, for the benefit of anyone who might be still taking the sloppy (and
>incompetent for reasons cited) e-mailed legal threat against $PERSON (and
>potentially others) seriously, let's review the elements of defamation
>law in the USA and (generally) in common-law countries:
>
>A defamatory statement is one that injures the reputation of another
>party, either by lowering the standing of the injured party in the
>community or by tending to make others refrain from associating
>with him.  However, it's not just any such statement.  It must pass
>these tests:
>
>-- If the speaker can prove that the statement is true, it is not
>   defamatory.

The reply to my post made the only attempt at stating the claim was true by noting the registration date versus notification of myself. 

>-- For slander, it must _actually_ have had that effect on listeners,
>   not just potentially.  That is, if you orally claim that X is a
>   child-molester and all other tests are met, it's not defamation
>   unless people actually believed your claim.  The assumption of
>   actual damage is only assumed in certain specific cases of
>   "slander per se" (as always, assuming the claim is untrue):
>        -- charges that plaintiff committed a criminal offence
>        -- charges that plaintiff has one of certain "loathsome"
>           contagious diseases
>        -- charges that impute unchastity or adultery to any woman
>        -- charges disparaging plaintiff's conduct of office,
>           trade, calling, or business being conducted at that time

All they have to have is one person's email who says "I won't do business with you because of this" for it to qualify. 

>-- For libel, actual damages are presumed if the statement is one
>   one of a small number of types considered to be "libel per se"
>   (defamation that is apparent on the face of a communication):
>   charges of criminal activity, adultery, "contagious distemper,"
>   or dishonesty, as well as any charge which injures the plaintiff
>   in his or her trade, business, or profession."  Otherwise, actual
>   damages must be shown by specific and unambiguous evidence of
>   wrongful harm, which is called "libel per quod".

I did hint at dishonesty by calling them domain squatters who had no intention of using it but instead holding it out for ransom. 

>-- "Publication":  It must be made to a third party.  X telling Y
>   _alone_ that Y is a child-molester does not defame Y.

I made it to a public mailing list, archived by google, accessible by anybody. The fix for us at $OTHER_LUG was we made it so that only list members could access the list. 

>-- Similarly, if X (above) tells only Y, and _Y_ then tells others,
>   then X hasn't defamed Y -- because Y did the publishing.

I don't know if I could use that argument. 

>-- The statement's not defamation if it's in a situation subject
>   to "absolute privilege".  There is a list of such situations,
>   including communications with one's spouse, and testimony in
>   court or in legislative or executive governmental hearings.
>   (It should be noted that you could evade slander, only to be
>   charged with perjury.)

Not applicable to me. 

>-- The statement's not defamation if it's in one of a variety of
>   situations subject to "qualified privilege".  Most involve
>   speaking on matters of public or community concern, and must
>   be made without malice.  This is related to the press's 1st
>   Amendment protection against restrictive legislation (such as
>   libel law: NY Times v. Sullivan, US Supreme Court, 1964.)

I made the comment at the beginning that I was pissed off. I don't know how cleanly they'd be able to map malice to pissed off. But I do make it quite plain that I think they are wrong and that there should be an arbitration process. Hmmm, maybe ICANN is at a point now where I could submit something to them. 

>-- The defamatory statement must be fairly understood by listeners
>   to be a statement of fact, rather than opinion.  Opinions need
>   not be fair to be privileged:  Unfair opinions are protected
>   by law.  This distinction between allegations of fact and of
>   opinion is a grey area that would be decided by the Court.  The
>   key question would be whether the purported opinion implies some
>   false factual claim, e.g. "I _think_ X is a murderer."

My entire post was an opinion (IMO) so I think the bulk of the legal posting here applies in this capacity. 

>-- In most states, it is not defamation unless the speaker was
>   negligent in checking his facts.  If he meets an implied standard
>   of reasonable care and was mistaken, then he would be not liable.
>-- Republishing someone else's libel/slander can itself be defamatory,
>   if the "publisher" had the knowledge and opportunity to not do so.
>   E.g., if a caller defames someone on a KGO talk show, KGO is
>   probably not liable, but would not be protected if it later replayed
>   that segment from tape.
>-- The statement's not defamatory if the target's reputation is already
>   so unsavoury that no damage was done.
>
>
>
>The complaining party, Mr. $COMPLAINANT of $COMPANY, Inc, states that he
>wants "this thread taken down", and provides two URLs.   (That's pretty
>damned vague.  One would normally expect a libel complaint, which
>$COMPLAINANT in error refers to as slander, to identify specific text.)

In our first go round with them on $OTHER_LUG. We censored text, replacing it with XXXX's and attributed the "why" to their url. That was not sufficient for them, and I think it pissed them off even more. They wanted it completely gone, so we set archive access to list members only. 

>At the first URL, $PERSON did not, in fact, make any specific
>allegation about the complaining party.  He asked if he was justified in
>getting "pi$$ed off".  He then asked whether there ought to be some sort
>of arbitration in cases where it was obvious that someone trying to sell
>a domain is (to paraphrase) merely squatting.  He did not state that
>$COMPLAINANT's company was squatting.

I don't see how that doesn't translate to me accusing them of squatting. 

>In any event, domain squatting is not illegal or grossly immoral in any
>libel-per-se sort of sense, and is something a large number of
>businesses do, so if $PERSON _did_ make such a statement, _even if_ untrue,
>it could not reasonably be found to create actual damage per libel law.

I don't like it. Where I come from, you buy something if you're going to use it. But that's all opinion. 

>$COMPANY would be required to show actual damages to a judge's
>satisfaction, and would not have a snowball's chance in Hell of doing so.

Like I said, an email or a phone log showing a potential customer refusing business due to finding that url. 

>And how much do you want to bet that $COMPANY could be shown to have a
>dicey reputation already?

I'm actually going to spend a little time looking into that. 

>At the second URL, $OTHER_PERSON, responding to $PERSON, changed the subject
>to "Domain Squatting -- ", and said "These
>individuals registered $SITE just three days ago, apparently for
>the sole purpose of ripping you off", followed by "One might wonder if
>there's a certain amount of risk in running such a business."
>
>The subject header doesn't actually _say_ that $COMPANY engages in
>domain squatting -- and for reasons cited such a statement seems
>extremely unlikely to be libellous "actual damages", anyway.  The "rip
>off" would potentially be a problem if it unambiguously meant that
>$COMPANY was attemptiong to _steal_ from $PERSON.  However, in context,
>it's pretty obviously an assertion of $COMPANY carrying out sharp
>dealing that leaves $PERSON and others with a sense of distaste, i.e.,
>setting up a situation where $PERSON felt manipulated into buying the
>domain back.

I never owned the domain, someone else did, can't remember who it was. They let it lapse, $COMPANY picked it up and then notified me it was available. 

>Naturally, I should in fairness point out that I am not an attorney, and
>therefore do not and cannot offer professional legal advice.  I'm just
>someone who does his best to understand the law, which I also recommend
>to everyone else here.

Yes, I'm undecided at this point. The wife doesn't want me to do anything "stupid". We don't have the money to pay for lawyers. It is free speech to express an opinion. I'm wondering if this is something the EFF would look at or if this is too far below their normal dealings.

It bodes poorly for $COMPANY that they can't tell the difference between slander and libel, but that means nothing to a judge. 

----- Forwarded message from Rick Moen <rick@linuxmafia.com> -----

Date: Fri, 28 Oct 2005 08:49:53 -0700
From: Rick Moen <rick@linuxmafia.com>
To: $PERSON
Cc: $LUG
Subject: Re: Slanderous Thread

Quoting $PERSON:

Just to clarify, I was in no way suggesting that $COMPANY would fail to meet all the requirements I listed for a defamation action. Rather, I was listing them all merely for completeness's sake -- and to point out that if they fail any one of them, their (hypothetical) case falls apart. 


> >-- If the speaker can prove that the statement is true, it is not
> >   defamatory.
>
> The reply to my post made the only attempt at stating the claim was
> true by noting the registration date versus notification of myself.

As I pointed out, you really made no factual claim at all, in your post. $OTHER_PERSON was a lot more careless in his, but that's [him] in a nutshell for you.

You cannot be held to libel someone for hinting, or indirectly suggesting, something. If that were the case, we'd probably be an even more ghastly litigious country than we are. 

> All they have to have is one person's email who says "I won't do
> business with you because of this" for it to qualify.

No. That's really important to understand: If that were the case, then everyone would be in peril of being sued for libel who ever said something even mildly derogatory about a business. For a statement to rise to the level of libel , a judge must be convinced that you have made a factual allegation that the complaining party did something really objectively bad, and are unable to prove that factual allegation in court, when called on it. 

> I did hint at dishonesty by calling them domain squatters who had no
> intention of using it but instead holding it out for ransom.

No. Read what you wrote again: You did not call them domain squatters, though you were undoubtedly thinking that. Nor did you say they had the intention of not using it: You asked if there should be arbitration required for situations when people act in that way with a domain, but did not state directly that $COMPANY had done that. No statement of fact, no libel. Which was my point, on that required element of defamation law.

I must say, though: If you do insist that your indirect suggestions were a statement of fact, and take seriously the $COMPANY cartooney's allegation of libel ("slander"), and if all this has come up before on $OTHER_LUG, then why do you post such things? I personally think that your post was neither a statement of fact nor libel, but you seem oddly inconsistent in your own stance. 

> >-- The statement's not defamatory if the target's reputation is already
> >   so unsavoury that no damage was done.

FYI, googling on $COMPANY reveals that their domain is on at least two DNS blocklists for spamvertising. 

> In our first go round with them on $OTHER_LUG.  We censored text,
> replacing it with XXXX's and attributed the "why" to their url.  That
> was not sufficient for them, and I think it pissed them off even more.
> They wanted it completely gone, so we set archive access to list members
> only.

Obviously, I have no idea what specifically was said on $OTHER_LUG, so I cannot comment. But clearly any pushy businessman inducing a LUG to take its mailing list private is exceeding what we collectively should be willing to tolerate.

It gives me a royal pain that all too many computerists are both peresnnially ignorant of legal matters and also consequently absolutely eager to get pushed around the moment they get any sort of complaint -- even, laughably, a complaint e-mail that isn't even clear on the distinction between criminal and civil law. It would be refreshing to see them act less like frightened and stupid sheep, for a change.

(?) Usage of NDAs in legal flummery

Thu, 15 Dec 2005

From Rick Moen

Might be too California-specific for LG itself, but possibly of interest among TAG readers.

I decided not to send this e-mail to a firm I deal with, in hopes of not stirring that pot unless it actually becomes an issue. However, it really annoys me that so many computer geeks let themselves be so easily manipulated by transparently and insultingly bogus legalistic bullshit -- and so I hope this draft can be of benefit to some others.

Hello, $EXECUTIVE.

It was a pleasure speaking to you, on Tuesday, December 13, and I look foward to the opportunity to examine $FIRM's product line.

There was, however, one thing you said that concerned me: You asserted that a non-disclosure agreement I signed 2 1/2 years ago is still in force, and would apply to our telephone conversation that followed. The purpose of this e-mail is to share with you the results of my legal research on that question. (I am not an attorney, and nothing in this e-mail should be construed as me giving professional legal advice to you, $FIRM, or anyone else.)

1. In California law, non-disclosure agreements cannot have force without exchange of consideration, as that lack causes no contract to form. I note that I have not at any point executed any business contract whatsoever with you or $FIRM, thus far. Any moves towards such a contract would have been executory at that time, and had long gone defunct by the time 2 1/2 years passed.

2. California law actually voids completely, in Business and Professions Code §16600, any contract that purports to restrain anyone "from engaging in a lawful profession, trade, or business of any kind", to the extent of that retraint.

I am, of course, generally speaking, in the Unix-based IT and network consulting trade.

3. §16600's application is of course tempered by California's Civil Code §3426 et seq., implementing the Uniform Trade Secrets Act, which specifies the scope of trade secret law in our state. But those provisions apply only within an employment or similar business relationship involving a duty to maintain the information's secrecy or limit its use, only for a limited period of time, and only for subject matters within the scope of that business. Trade secrets, by the way, are constrained by statute to these areas: a "formula, pattern, compilation, program, device, method, technique, or process" that maintains economic value. (Customer lists are also trade secrets per the separate provision of Business and Professions Code §16606.) You cannot just declare, say, your next intended product ship date to be a trade secret and expect your opinion to enjoy legal protection.

As a result of these concerns, I cannot regard myself as bound at this date to the terms of any NDA I might have executed with you or $FIRM, 2 1/2 years ago: We do not have that close a business relationship. In fact, we do not yet have one, at all. I'm, by intention, a sympathetic but very much independent and external party, interested in your firm's products and services.

Irrespective of that, I am (and will remain) of course careful to safeguard the privacy and interests of all persons and firms I deal with during the course of my business affairs: Protecting people's confidences is part of just ordinary business ethics, irrespective of legal obligations.

I hope this matter does not cause you problems, but I felt ethically obliged to bring it to your attention.

(?) Just to define a term:

Executory (adj.): still unperformed, hence inoperative

If you hear a lawyer talk about an "executory contract", he means something that's not (yet) a contract because one of the parties hasn't carried out an action that would be required for it to actually become binding.

Example: You walk into a diner and order pancakes. The short-order cook is just about to drop batter onto the griddle, when you shout "Wait, cancel that. I just remembered: I can't eat until after my medical exam."

If the diner then hauls you into court claiming you had already entered into a binding contract with them (to have breakfast) at the moment you ordered, your answer is "Sorry, any contract would have been still executory, at that point." You said "cancel" before that batter fell onto the griddle. Hence, there was no performance by the cook, which would have been the "consideration" (something given) required for contract formation.

I was telling the executive, "Hey, you guys have yet to do jack for me, so kindly don't go around telling me I'm bound by some contract."

It's common for sales and service firms to attempt to hustle customers about their supposed obligations under "contracts" that are, in fact, still executory and hence not binding at all.

(?) NDA Addendum page

Tue, 20 Dec 2005

From Rick Moen

After hearing (in confidence) yet another horror story of an unreasonable non-disclosure agreement (NDA) suddenly sprung on people without prior warning, in a situation that didn't even involve a business relationship, I've drafted this thing:

http://linuxmafia.com/faq/Licensing_and_Law/nda.html

The idea is: You print out a copy, scrawl at the bottom of the NDA "Addendum A incorporated by reference" just above where your signature will go, and hand in the sheet with your signed NDA. They can of course tell you it's not OK. Depending, you might walk -- or discuss which of your terms aren't OK and why (and why it's OK for them to spring a surprise legal instrument on you, but turnabout is somehow not fair play).

Like all my other writings in the knowledgebase (except as noted), that page is freely licensed under Creative Commons's Attribution-ShareAlike 2.5 licence, a permissive copyleft licence. Please modify to suit.

(You could just line out and ink in a replacement for the sentence in item #3 where I cite my line of business -- substituting your own -- if you never otherwise create your own modified version. Also, of course you might alter the expiration to match the details of your situation -- but there should be one, anyway!)

Reminder: NDAs can be dangerous to your independence and livelihood, if they don't have a suitably narrow scope and duration. This crap about "confidential information" needing to be stifled by force of law is ridiculous in the computer field, if nowhere else. Six months is about the reasonable maximum life of any secret, there.

(Obligatory note: Neither this mail nor my Web pages are a substitute for compentent professional legal help, if you're in a situation that requires it. I am not a lawyer. This is not legal advice.)

(?) More on legal follies and software: Barracuda v. merger

Thu, 22 Dec 2005

From Rick Moen

Here's another tale of legal follies using fake names (and, for all you know, fake facts). As they might have said on Dragnet, the legal issues are true; only reality has been changed to protect the innocent.

I always explain that I could cite either names or anedotes but not both; the anecdotes are more interesting. However, if these misadventures aren't exciting enough without public disclosure of real names, as some have complained, then please feel free to go forth unto businessland, and generate some calamities of your own.

Louise is an accomplished C developer and sysadmin in Miami, who formed a team with three other coders (the "Gang of Four") to help out a rapidly growing, services-rich Internet hosting company, Crunchco, that they all use -- by rapidly prototyping and coding a much-needed C codebase, Barracuda, that they intend to make available free of change to Crunchco, filling a high-visibility hole (as a result of disappearance of a third-party product) in Crunchco's offerings to customers. Harvey, founding CEO at Crunchco, is busy trying to staff up Crunchco and consolidate its too-scattered and slightly chaotic & overworked operations, drawing them together to new offices near where he lives in Minneapolis. Harvey especially wants to hire Louise, in part because they're rapidly migrating their servers off HP/UX to Debian, because they have almost no Debian expertise, and because Louise is a Debianista. He makes an oral deal (if a somewhat fuzzy one) to hire her, and tells her she should immediately wind up her commitments to existing clients. She starts turning down new prospects, e.g., a $10,000 local consulting gig, to keep herself available.

Barracuda gets close to deployment status, and seems likely to be a valuable property. The Gang of Four line up plans to form an LLC (limited liability corporation) to licence out Barracuda as a proprietary software product, with Crunchco intended as the first official "Barracuda chum" -- a set of favoured, free-of-charge or low-cost customers. Harvey arranges to meet with Louise and the others at conferences and on business trips; he sets up flying two of them out to Minneapolis HQ in March.

At the same time, Louise and the others hear of something else, essentially unrelated, that's approaching at the same time: Harvey has been putting together, during those same business trips, a merger deal with Engulfco, a Java shop of about the same size, in Nashville. Engulfco has more cash; Louise's estimate is that, in substance, it's really more an outright acquisition than a merger, but these PR characterisation games are pretty common.[1]

The merger proceeds: It's to result in a firm called, in a fit of delirious optimism, Synergistic Engineering[2], with Engulfco CEO Sally remaining in the resulting firm's CEO spot, and Harvey moving to VP of Engineering. The firm picks up the cost of flying Louise and other new hires up to Minnesota for a week, to sign them on. Despite having the typical Floridian's bad luck walking on frozen sidewalks, Louise enjoys finally meeting her future co-workers and hobnobbing with Harvey, who among other things hands her (and one of the other Gang of Four members, who is likewise to be hired) Cruchco's proprietary inventions agreement as a necessary initial step for her to get hired. She signs.

Things seem a little haphazard, but she knows from experience that there's a lot of chaos and missed cues at startups. It's nothing personal; you just deal with it. Nobody's yet done an offer letter. She expects a pretty good salary, because she's of proven high value to Crunchco, but making something happen seems to need a kick. So, she sends an e-mail to Ron, her intended future boss, reminding him that this needs to be taken care of. Ron seems a bit disoriented by the question, and kicks it over to Sally.

Sally replies back saying: "Hmm, I don't know if we can hire you at this date. Maybe in a few months, if we get additional funding, and if we really need a Barrucuda maintainer on staff, which we're not sure we will."

Louise is understandably peeved: She's been made a clear offer of employment, albeit one with some vagueness, by Harvey, has started turning down other business based on their request that she do so, and has shlepped 2000 miles into the northern winter -- only to be told by some clown in Nashville that it's not happening. She has to wonder: Is there a complete breakdown in communication between Harvey and Sally? Do those Java weenies in Nashville simply not understand, unlike the better-clued Crunchco crowd, exactly how much the firm needs her talents? (It later turned out that the answer was "Yes" to both -- but that that wasn't the full story, either.)

So, Louise carefully writes a reply outlining the extent of Crunchco commitments to her, and the fact that her role is hardly to be confined to, or even principally concern, Barracuda. She clarifies that she can't sit around and wait for job opportunities, and names a date by which it'd have to occur or be written off -- and mentions that Barracuda's direction of course remains in the Gang of Four's hands, not Engulfco/Synergistic's.

Sally sends IM to Louise asking Louise to call her.

They talk: Sally claims that Louise has already, inherently, signed over all her rights to Barracuda, when she signed her Crunchco proprietary inventions agreement, a couple of days ago, and that Engulfco/Synergistic now owns it outright, by virtue of owning Crunchco. Sally says she knows this because of comments by someone at Crunchco about Barracuda, to the effect that Engulfco would be "buying" Barracuda as part of the merger deal. In any event, Synergistic doesn't have the cash flow for more staff at this time, unless and until Louise can find and bring in a sufficiently compelling revenue model for Synergistic's property, Barracuda.

However, this is not Sally's lucky day. This is one of those rare occasions when not only is an executive (Sally) reaching beyond her firm's rights out of ignorance (which is very common), but she also has the poor fortune to try this on someone who knows the law . Louise now (very politely) lowers the boom on her.

Sally has made several severe errors:

  1. Crunchco never owned Barracuda's copyright. There is a bulletproof trail of documentation of the Gang of Four's title.
  2. The proprietary inventions agreement was explicitly incidental to employment -- which never happened. In fact, Louise has never received anything that can be pointed to as "valuable consideration" as a required element of any contract.
  3. Even if it were valid, that proprietary inventions agreement would give Cruchco a claim only to the copyright on _new_ work Louise performed within the scope of her employment, under the Copyright Act's "work for hire" rule.
  4. Actually, come to mention that, Sally has completely misunderstood the "work for hire" rule.[3]
  5. According to the Copyright Act, for the Gang of Four to give over their existing title (concerning work to date), all would have had to sign a separate transfer-of-copyright legal paper, which never happened.
  6. Only two of the four were ever even courted as potential employees, whereas all four members hold title.
  7. And, by the way, Louise pointed out, somehow Crunchco and Engulfco seem to have missed the fact that one of the developers is a minor, and therefore would be entitled to void most contracts he might sign upon reaching adulthood, anyway.
  8. There was considerable paperwork on the record from Harold speaking, both as Crunchco CEO and as Synergistic Engineering VP, of her employment as an agreed fact.
  9. The entire series of events, taken as a whole, look difficult to distinguish from a fraudulent business scheme to cheat Louise out of her copyright title through false and misleading documents, erroneous and possibly illegal claims about ownership, and insincere business offers.

During the rest of her day, Sally does the one truly intelligent thing she's managed during this entire fiasco: Being a Java weenie, she has contacts at Sun Microsystems, including the legal experts who helped establish the OpenSolaris project and its CDDL (open source) licensing. She calls them: They tell her she's completely wrong and right on the brink of big trouble.

She immediately sets up a conference call with the Gang of Four. To Louise's surprise and relief, Sally acts on the basis of the Sun guys' advice, recognising that Synergistic had no title to Barracuda, and adding that she regretted her prior errors on that point, which were an honest mistake. They close the call with the (genuine) possibility of future business dealings -- since the Gang still wants Synergistic as the first "Barracuda chum" -- but, alas, with little likelihood of a job for Louise.

A few points about that anecdote:

  1. There's a lot of honest, innocent chaos and fsck-ups inside the businesses that we imagine to be always running well: It's seldom really the SPECTRE/Blofeld model, where some guy with a Persian cat & monocle knows everything and occasionally hits a button to send some misbehaving underling to the flames below. More often, it's more like Chesterton's "The Man Who Was Thursday", where you have multiple people going around completely clueless about what each other is doing. Put another way, think of most businesses as collections of ganglia: The organisation has little in the way of a central nervous system. When the company does something unpleasant to you, it's often not only "not personal", but also largely inadvertant.
  2. The reason we're not generally aware of this widespread craziness and patterns of screw-ups is that, typically, everyone involved is either an interested party or is under a non-disclosure agreement. So, all of it goes beneath the radar of the general public.[4]
  3. Though business people often attempt to push others around with mind-numbing legal instruments and impressive-sounding notions about rights and responsibilities, most of the time they have no earthly idea what they're doing. The fact that they hit you up with a bullshit legal claim probably doesn't reflect evil, fraudulent intent: It's more often simple error and wishful thinking.
  4. At the same time, they get in the habit of that legal gamesmanship because it works -- against computerists, particularly, who generally are really easy to snow, and (being introverts and legally naive) slow to assert their interests. To quote J.P. Morgan, "The meek shall inherit the earth, but not the mineral rights."
  5. Business executives, especially those trying to build startups, tend to hand out wild promises in all directions -- far more than they'd ever be able to fulfill -- just to keep things rolling. Although it should be obvious that the oral ones are flimsy, what may not be so obvious is that the written ones aren't necessarily much more trustworthy.
    (It's likely that Sally was actually insincere in her claim that she hadn't known of any plan to put Louise on staff: That doesn't jibe with her being put through the new-hire process at the same time as several other hires. In fact, likely Sally simply decided Louise's salary as a veteran developer was too expensive, and unilaterally decided to renege on Harvey's commitments.)
  6. Certain large business initiatives, including mergers and acquisitions, develop an inertia all of their own: If you're perceived as being in their way (as Louise was), you can find yourself subjected to some tactics of questionable sanity and legality, because you're seen as easier to move than is the thing you're blocking. Crazy talk directed at you by business people often has a perfectly rational underlying (financial, legal, regulatory) cause, that might just not be visible from your perspective.

[1] See also: Electric Lichen. (Where are they, now that we need them?)

[2] Conventional wisdom is that mergers and acquisitions in the tech field are even more risky than elsewhere, because so much of the acquired firms' value resides in the employees. Many such purchases have left the buyer holding an empty bag, when disaffected staff depart for elsewhere.

[3] "Work for hire" is an exception in the Copyright Act and surrounding caselaw, to the general rule that, the moment you invent a creative work "in fixed form", you gain copyright title over it: 17 USC 101 and 201(b) says that, if you are an employee and create something within the scope of your employment ( or if it's a specially ordered or commissioned work), title goes directly to the funder, not to you, unless there's an agreement to the contrary. This was a little vague; the matter was clarified in 1989 in the Supreme Court case of CCNV v. Reid (http://www2.tltc.ttu.edu/Cochran/Cases%20&%20Readings/Copyright-UNT/reid.htm).

The term "employee", here, is not defined in the everyday-English sense, but rather uses the word's meaning from the area of law called "agency law". Whether you're called an employee or not has zero relevance. Employee vs. not an employee is decided according to three criteria, forming a picture that a court would evaluate, taken as a whole:

  • Control by the employer over the work. (E.g., does putative employer have right to dictate how, where, with what tools the work gets done?)
  • Control by employer over the employee. (E.g., does putative employer have right to dictate worker's schedule, assignments, method of payment, assignment or non-assignment of assistants?)
  • Status and conduct of employer. (E.g., does employer provide job benefits?)

For a "specially ordered or commissioned work" to be work for hire, per 17 USC 101(1), there must be a written agreement to that effect, plus the work can be only in one of nine specifically listed categories: motion picture, other audiovisual work, translation, supplementary work, compilation, instructional text, test, answer for a test, or atlas.

Louise politely pointed out that Crunchco had no claim to her copyright title under either provision.

[4] Do you think there's a news story, every time a bank uncovers a multimillion dollar embezzlement? Not if the bank can help it. In fact, the culprits are often in a position to negotiate their keeping all or part of the theft, when caught -- if the sum is big enough: The bank's publicity exposure is worrisome enough that parting with the money is cheaper.

(?) More about real-world legal conflict

Fri, 23 Dec 2005

From Rick Moen

[A friend was having me review a draft outline of a piece about non-disclosure agreements. This is an excerpt from some of my comments.]

This is good as far as it goes, but it's a bit more black and white than I think the world really is.

In fact, spending some time around corporate lawyers caused me to have an epiphany, one day: Businesses violate each others' (and individuals') legal rights all the time -- not because they intend to, but because it just happens. A lot of the work of a corporate counsel involves helping the company pick the lesser evil, apply balm to burned fingers, and apologise -- and in other cases bully some people; threaten, buy off, or stonewall/outbluff third parties.

Let me tell you a story: I was the unofficial software-licensing effort at a company we'll call Venture Capital Linux, Inc. VCL published two variant forms of the Red Hat Linux distribution, including one that was specialised for NAS clusters. Like most medium-sized companies, VCL suffered endemic communications and coordination screw-ups between groups. The Engineering department did cooperative work under NDA with Truth Software of Palo Alto, backup specialists, and Network Fiascos of Emeryville, both of which firms provided VCL as confidential proprietary code some of their enhancements to the third-party GPLed ndmp network-backup utility -- intending it as strictly internal experimental code. But then, the Professional Services department grabbed that code off the internal CVS, made a binary i386 RPM, and bundled it into the downloadable NAS distribution on the exterior public ftp site.

A few months later, a polite query arrived at VCL Technical Support from a coder at Mountain View NAS, politely asking to be furnished matching source for our ndmp code under the provisions of GPLv2. I asked Professional Services, whose VP said "Oh shit!" and referred me to Enginsering. Engineering's VP said "Oh shit!" and referred me to Jim, the corporate counsel. I sent Jim what I had.

By the time I arrived at Jim's office, he already had sussed it all out and had the matter covered -- but I was curious, and needed to have it spelled out for me: 

Me:  "But aren't we obligated to give the Mountain View guy what he
      asked for?"
Jim:  "Yes."
Me:  "But we're not going to do that?"
Jim:  "No."
Me:  "Isn't that a copyright infringement against the upstream ndmp authors?"
Jim:  "Yes."
Me:  "So, why aren't we going to give him the code?"
Jim:  "Because that would be breach of contract with our business
      partners, Truth Software and Network Fiascos, which would have
      severe and expensive consequences for us."
Me:  "Oh.  What are we telling the Mountain View guy?"
Jim:  "That the modified ndmp was released by mistake, that it's now been
      withdrawn, and that we regret any inconvenience."
Me:  "What if he sues?"
Jim:  "He can't.  He doesn't have standing."
Me:  "Oh, right.  What if the upstream coders sue?"
Jim:  "In the first place, not likely, since they aren't even aware of
      this situation, and since they haven't been offended, and since
      the infringement has already been remedied.  In the second place,
      without registering their copyrights with the Library of Congress,
      which they haven't done, they could sue only to enjoin further
      infringement, not for damages -- and there is no more infringement
      at this point.  Even if they had registered, their recoverable
      damages would be keyed to the extent of their commercial loss,
      of which they've suffered none at all."
Me:  "So, basically, since we have to choose one tort or another, we pick
     the one that's pretty much harmless."
Jim:  "Right."
Me:  "OK, makes sense.  Do I need to reply to the Mountain View guy?"
Jim:  "No.  Legal is sending out that nice, short letter today.  Leave
      it to us."

The point is that this sort of thing happens all the time. Firms step on each others' toes, through screw-ups or because smaller interests and concerns got in the way of larger ones; the end-result is some sort of accomodation: Either someone's merely annoyed but not enough to act, or that firm gets a favour or payment or apology, or in extreme cases the firm is annoyed and self-righteous enough to sue for some form of remedy -- but not very often. The public isn't aware of 99% of this, because the parties simply don't publicise it.

NDAs get violated all the time, too. How many reviews or "previews" of prerelease software have you read? Only a tiny fraction of those were authorised. The reviewers didn't get sued, because the firms didn't think that would work out as to cost/benefit. And the authors don't even, realisitically, get blacklisted. The world just moves on.

Thus, your "Avoid breaching the NDA" would be better if it were qualifed and put in perspective: Avoid breaching the NDA, or else what, _really_? Are all breaches equal? What happens if you end up violating the NDA despite your intention to the contrary, either by accident or because it was the lesser of two evils?

If someone does sue you for breach of contract (i.e., the NDA), then what determine whether they're likely to prevail, and what they're likely to get?

(!) [Jay] They'll likely get to watch you spend money you didn't want to on a lawyer you *don't* have on staff, to defend yourself. That's where a lot of legal maneuvering comes from:
"For about $5000, I'll lay such a burden of discovery on these people that we don't get into court until the product is obsolete."
"Cool. Here."

(?) While I have a great respect for the ability of legal expenses to ruin someone's entire decade, it's also true that the tactic can boomerang:

A friend of mine discovered some magic words back in 1999, when a business executive was threatening her with legal action: "Well, discovery should prove interesting."

(!) [Jay] Ooooh. Neat. :-)

(?) The executive blanched, and backed off. Hauling my friend into court entailed permitting her very wide lattitude in delving through his company's records and requiring his staff to answer interrogatories and depositions under oath, and, given that even your average executive isn't sure he knows where all of his firm's skeletons are buried, would have entailed a fearsome risk that he really couldn't justify.

Being sued by a firm will absolutely cost you money. On their side, the cost might just be a lot more serious than merely the money entailed.

(!) [Jay] Too true.
On the other side of the coin, business executives are often wagged by their lawyers, rather than the other way 'round; a lesson I learned from Mark McCormack's second book "The Terrible Truth About Lawyers".

Released under the Open Publication license

Published in Issue 122 of Linux Gazette, January 2006

Tux