The Old Joel on Software Forum: Part 3 (of 5)

Protecting IP

I've been working on a project and have formed my own company in the past year. After almost a year of r&d, I have what I would consider a significant amount of IP. At the same time I am at the point were I would like to hire outside help. I've outsourced small portions of the work already, but nothing I would consider core technology.

My fear is loosing IP to people I hire. I'm afraid that they will either steal ideas or code. As far fetched as this might sound, I've witnessed it first hand. A company I worked for had code stolen by the contractors that developed it. They took the code and went into direct competition with the company I worked for. While a lawsuit ensued that the company I worked for won, after 5 years of being tied up in the courts, much of the damage had been done. Fortunately the company won out on the loyalty of its customers and the strength of its sales and marketing. My strength lies in technological vision and implementation, rather than marketing, and the loss of IP would be devastating.

Has anyone who started a company on a shoe string budget, given away equity in the company, and if so, how has that worked out? In someways I think equity gives people working on the code more loyalty, but while I hope that to be true, I'm not certain of it. Any other ideas on protecting your IP?

christopher baus (www.baus.net)
Wednesday, January 14, 2004

It seems you've learned firsthand that you can't *really* protect your IP. That said, you could talk to a lawyer and get some more specific advice. Certainly requiring your hires to sign a non-disclosure agreement is nothing onerous. But I think the best thing to do is hire people with integrity and all be so successful that nobody in their right mind would think about splitting, and that none of your customers would think about switching.

John C.
Wednesday, January 14, 2004

The best general solution for this is to use a combination of copyright and trade secret law.

Using copyright law is fairly straightforward. Although it's not strictly necessary, you should attach copyright notices in conspicuous places in your source code. If you're using contractors, you need to have a written contract that spells out that the company, not the contractor, owns the copyright to the code.

Trade secret law gives you some additional legal protections for confidential business information, including source code. You need to take reasonable measures to protect the confidentiality of that information, such as by having your employees sign a written nondisclosure agreement, and marking confidential documents/code with a notice like "Protected trade secret -- subject to nondisclosure agreement."

http://www.lawguru.com/faq/19.html
http://www.ipwatchdog.com/tradesecret.html

However, both of these subjects can be fairly nuanced. You should contact an IP attorney in your area to work out the details.

Robert Jacobson
Wednesday, January 14, 2004

BTW, I didn't mean to dismiss the idea of giving away equity. If you can afford it from a business perspective, it sounds like a good way to encourage loyalty and performance.

Robert Jacobson
Wednesday, January 14, 2004

People generally don't steal their own stuff. Thus, if somebody feels "ownership" of the company, product, and IP, they will tend to be more protective towards it.

Doesn't always work, of course. There's a difference between "ownership" and equity. "Ownership" is a feeling. Equity just changes the negotiations when you want to move to a competitor.

The one thing that has potential to work is defense-contractor styled disipline. As the recent Lockheed Martin vs. Boeing fiasco shows, it doesn't always work, but simply making sure that the code never leaves the local workstations and the local servers can give you some defense against stealing of physical stuff.

Next to nothing can help prevent the "theft" of IP. You can't control what's in somebody's brain and it's not necessarily fair to prevent them from changing jobs. Laws and precedents have been created lately to weaken non-compete agreements. You just have to reassure yourself that the juicy algorythms can be patented or protected by more enforcable trade secrets and the hard work can't really be duplicated without the code and documentation.

Remember, 10 % inspiration, 90 % persperation.

Flamebait Sr.
Wednesday, January 14, 2004

We've had to compete with several companies that have essentially stolen our source. Once, we had to give a distributor source so they could translate it to german and someone from that company ended up starting their own company with the source. Would have cost a fortune to sue them since they are in Europe. Basically we told anyone who asked about them that they're theives.

The second company was in Texas. I don't know how they got the source, but I think they basically decompiled/deobfuscated it. (it was mostly LISP at that time.) We successfully sued them but they had made themselves judgement proof by incorporating with the owners being their sisters in law, etc. The corp had no assets. We closed them down and they popped back up the next month as a new company with a "brand new product" that was again a copy. This kept up for a few years and then we gave up. They're still around, but the didn't invest in the software and have basically been left behind.

The solution, hire people you trust, and don't let the source out to anyone who doesn't have a stake (emontional) in the company. The other thing to do is to make your company more valuable than just the code. Your customer list, relationships, employees, distribution network, etc can't be duplicated overnight even with the source.

pdq
Wednesday, January 14, 2004

Copyrights and patents, combined with giving all of your employees NDA's when they start working will keep you safe from most forms of theft. Backup your company with good lawyers and use intimidation on people who do steal your stuff. Keep innovating and adding new features, and use FUD liberally against competition.

John Rosenberg
Wednesday, January 14, 2004

Another thing: Since you have developed much of the code on your own, maybe you don't have to expose all of it to employees or contractors. Only reveal parts that are required for them to do their work.

T. Norman
Wednesday, January 14, 2004

To answer my own question, I am only slightly worried that the idea would be stolen. In my opinion execution is worth more than the initial idea. I'm more concerned about flat stealing of code, as I feel it is novel approach to the problem at hand.

I suspect the integrity of the company must be worth something more than just bytes on the CD. For instance when bugs show up, who is more likely to fix them, and respond to problems.

christopher baus (www.baus.net)
Wednesday, January 14, 2004

T. Norman,

That has been my approach up until this point. I have hired other developers, and made the API black box. I've just been debating whether I should open the code up to them, so they can fix bugs and improve it.

christopher baus (www.baus.net)
Wednesday, January 14, 2004

I want to work for you people!

A boss who considers me a significant threat to his business and acts as if I'm a thief waiting for the opportunity to strike would make me feel like such an appreciated member of the team.

I thought people who are afraid to talk about the market they're in were paranoid, and it turns out that they were actually fairly reasonable - at least they were more worried about the competition than their employees.

"I've just been debating whether I should open the code up to them, so they can fix bugs and improve it."

I'ld keep away from that - you don't want to have developers actually improving the product or anything, that's not why you hired them after all.

I mean, what are you going to do? Have a staff meeting and say "ok, guys, I've finally come to the conclusion that you're not actually all engaged in industrial espionage and now I'll let you take a peek at the mysterious software that I wrote."

Er, actually, come to think of it - why did you hire them, if not to work on the product? If you're not letting them near any useful code, what do they spend their days doing?

And how did you explain to them that you don't trust them with your precious code in the first place?

The thing that amuses me the most is that you started this discussion by explaining what your weaknesses and limitations are, and seem to have concluded that paranoia is a more sensible option than actually developing your business skills. That was probably not the smartest decision you've made in your entire life.

Wednesday, January 14, 2004

This is an interesting contrast to the thread about the guy who wanted to go after his company because they used code he wrote before he got there and used in apps he wrote for the company.

www.MarkTAW.com
Wednesday, January 14, 2004

First off I should say I am hiring contractors not employees. I don't have resources for full time employees, yet. Secondly, hey, I've seen it happen before, and I can't afford that the happen to me right now.

It is possible to maintain core code and applications, and keep the core code under lock and key. I personally don't see anything wrong with this at this point in the game.

Like any Groove said: "Only the paranoid survive."

When you've most of your free time for the better part of a year working on a project, and it comes to letting the code out your sight, come back and tell me how you feel about it.

christopher baus (www.baus.net)
Wednesday, January 14, 2004

make that Andy Groove ; )

christopher baus (www.baus.net)
Wednesday, January 14, 2004

The only obvious solution is to hire a friend you already trust. It seems clear that you feel you're at the point where you need more manpower than you can provide, so you have to hire someone. It's also clear you're not ready to take the leap of faith that it involves.

Your only option is to hire someone you already know personally.

Hiring friends is a risk in itself though, of course. Is friendship or the business the most important thing in your life at the moment? ;)

Sum Dum Gai
Wednesday, January 14, 2004

I think the other option is search out a real partner. I've considered friends and relatives, but that doesn't seem like a good idea.

christopher baus (www.baus.net)
Thursday, January 15, 2004

You really can't stop people from stealing your source code if you want them to work on it. Difficult as it sounds, the legal system, or the threat of its use is your best bet. Make anyone who has access to the source code sign an agreement. Even if they are "judgement proof" you will find that the average guy doesn't want to be sued.

Another possibility. Write a backdoor in your code. If someone steals it but fails to remove it you can make them pay one way or another...

Name withheld out of cowardice
Thursday, January 15, 2004