0

Some corporations have a Bring Your Own Device (BYOD) policy, and some may allow their employees to take their laptops home for usage. What if an employee takes the code and develops something outside of their employment scope?

An organization may be able to file a patent infringement lawsuit if their code is used, but what if a malicious employees steals non patented or patent pending code and sell it to someone else? How do the organizations handle these cases?

EDIT:
I agree with the copyright answer. I will search it further on the law Stack exchange site as suggested in the answer and the comments. This is different from the other question because there they OP is asking about ways to protect the source code. I am interested in impact of code theft and ways to handle it.

migrated from security.stackexchange.com Jun 29 '16 at 10:20

This question came from our site for information security professionals.

  • 3
    One hardly needs to take a whole computer to steal source code. If anything, such policies only increase the risk someone other than the employee will be able to steal the data. – Alexander O'Mara Jun 28 '16 at 5:37
  • 3
    Also, this is not related to BYOD. Employees can smuggle out sourcecode on USB thumb drives or just upload it somewhere via the internet. When you want to make data theft impossible, you would have to design your software development offices like a supermax prison facility. – Philipp Jun 28 '16 at 5:44
  • 1
    @Philipp no matter how and what you deploy there will always be some 'Law Abiding Citizen' who will execute 'Prison break' and will be joyous just the way it was shown in 'The Shawshank Redemption'.. ;) – GhostSpeaks101 Jun 28 '16 at 7:37
  • 1
    Possible duplicate of How do large companies protect their source code? – WhiteWinterWolf Jun 28 '16 at 8:51
4

Patents are not that relevant in this case. Software patents are unenforceable in most parts of the world anyway.

What matters here is copyright. Every work contract has a clause that everything an employee creates as part of their employment is copyrighted by the company. So using company-owned code to build an own project would be a copyright violation. There are also other legal tools in some jurisdiction which can be used against employees trying to misuse intellectual company property. But that's a topic for Law Stackexchange.

Also, this isn't really related to a BYOD policy. Being able to bring your own device to work and then back home might make data theft more convenient, but isn't required. There are many other ways to steal sourcecode, like USB drives or uploading them to the internet.

To prevent the first you would have to design your software development offices like a supermax prison facility with meter-high walls (so nobody can throw a device over it) and strip searches on everyone leaving the building. This is neither feasible nor reasonable for anything below matters of national security.

To prevent the second, you would have to completely prevent internet access from developer workstations, which would greatly impede the productivity of any software developer.

So most companies do not even try to physically prevent employees from stealing sourcecode. They rather rely on the legal safeguards and on maintaining a mutual trust relationship with their employees. It might seem counter-intuitive to some, but when you do not treat your employees like potential criminals they are in fact less likely to betray you.

  • I believe that people will often subconsciously try to meet your expectations. That applies in the workplace; if your boss expects you to fail or to succeed, you are more likely to fail or succeed. And if your company expects you to be honest, or dishonest, many people will subconsciously try to meet that expectation as well. – gnasher729 Jun 29 '16 at 10:55
  • 1
    "... a supermax prison facility with meter-high walls (so nobody can throw a device over it)" - what is this, a prison for ants?! It has to be at least three times as big! – Nij Jul 7 '16 at 14:16
0

So you are afraid that if I bring my own computer to work, then I could steal code. I'll let you in on a secret: I sometimes work from home, and take my company supplied computer to my home. Now you can try to tell me how that situation would be different. I have a computer at home that contains a lot of my company's source code, and I could just copy it.

I'll let you in on another secret: Amazon sells 128 GB flash drives for under £30. Nobody would notice if a plug that drive into my computer at work, copied everything to the flash drive, and took it home.

The method of sending source code through the internet was mentioned; but that is a stupid thing to do, because that would allow you to be caught.

There are several reasons why I don't do this and use the source code to develop something outside work, or sell it to a competitor: First, I'm an honest person. Second, I know that if I did anything that damaged the company, they would drag me into court and would make my life hell. Instead of living in a nice home, I would end up living in a cardboard box. Third, if I tried to sell this source code to any competitor, their legal department would immediately call my company's legal department, and the same things as under (Second) would happen. Fourth, many developers write software that wouldn't actually be of any use to any competitor.

  • The only part of this that answers how companies protect their IP is the second and third points of the final paragraph. – user3851 Jun 29 '16 at 14:22
  • It addresses the first paragraph of the question. – gnasher729 Jun 30 '16 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy