How to respond to an employer's intent to copy software design

Question

We are working on planning a new design of an old outward facing legacy web application and during one of our meetings we covered the specs for what the new features should be along with the look and feel of the this new version once its been developed and tested. The company president has signed an NDA for a vendor application and has instructed me, as the lead member of the dev group, to go out to this vendor application (we've been given a sandbox access) and take pictures of its UI and functionality to replicate into the redesign of the legacy system.

He wishes to take their system, change the color and a few minor UI elements and rebrand it as this company's own system. The duplication is not just the UI but the architecture. As a result of the NDA signed, we've built a relationship with the vendor company and have been given many internal proprietary documents relating to their sofware (i.e. DB table schematics, API maps, system architecture schematics to name a few). Hence we've been given architectural level access to their design flow, sandbox environment where they develop and test.

I understand in the market there's replication to some degree (i.e. Samsung copying Apple just to name one). Clearly its unethical to go out and plagiarize another company's copyright application and put your label on it; especially when they are nearly visible clones. Question is, how can you professionally respond to what is clearly an ethical and legal violation?

The vendor thinks they are granting access for us to evaluate their system for intent of entering into a contract for purchasing licenses and engaging in a long-term integration relationship with them. We own the legacy system which is being redesigned at the visual and functional code level.

This is in the United States.

Answer 1

I would tell your boss that based on the facts that they lied to the vendor, got access to information because of these lies, and signed an NDA, you would really, really prefer to only proceed if this has been run past a decent lawyer who says it is Ok. Even if a lawyer says it's legally Ok, that lawyer will also advise you how likely it is that you get sued, and what the expected cost of being sued is. And what is the likelihood of losing. Even if what the company wants you to do is legal, that doesn't mean they will win in court.

There are obviously three possibilities what can happen after this. The boss tells you to go ahead, he checks with a lawyer, or he gives up the plan. In the first case, it's your decision. Looking for a different job would be a possibility. Obviously don't do anything that puts your current job at risk (until you have signed for a new one).

Answer 2

You are truly faced with a moral dilemma. To be ethical about this, first it is important to understand your responsibility. Officers of corporations (and certain other, legally identified representatives) have a responsibility to understand the legal implications of the type of actions you are being asked to perform. It is a personal responsibility with personal legal implications. So, first and foremost, you need to understand if you are under a personal obligation to understand the legal ramifications of your actions.

Also, if your boss has been this straightforward about his intent to copy their work, it is unlikely any conversation with him will be productive in convincing him of the immorality of the request. He is probably aware of this and, for reasons unknown to you, is not concerned. It could be because he is immoral, but also it could be that he has a legal basis for the actions that is not clear to you. And there are some cases where disclosing such information to non-officers or other people has other legal implications (especially if he has confidential knowledge of how this could impact negotiations or development of other products).

If you are personally responsible, then it is important to have a clear conversation with your boss about how the company intends to protect you personally for these actions. While it may seem to you that you are doing something illegal, there is also a concept in both law and the real world of "inspiration" - many artistic and engineering ideas are inspired by the study of previous achievements and/or failures of others. To closely study an example in order to create your own version is legal and encouraged by law and society in general. To say that a musician "inspired your work" is giving credit to a new creation that another influenced without having legal claims on the new work.

If you are not personally responsible for these actions, then you should likewise be aware that although the actions you are taking might sound like an attempt to "copy" an original work, it is not your responsibility to make that determination. It may sound like some kind of means of stealing another person's idea, however the ability to actually copy complex processes and systems accurately is difficult to begin with. Most software engineers are eager to be creative along the way, and therefore significantly deviate from the original work. Also, copying is very difficult to accomplish even when you have dedicated engineers. To make an analogy, there are very few artists that are capable of replicating important art works, even if given the proper incentives to do so. With abstract works, like a software process, this is even more difficult.

So, even if you are asked to try to copy this product, you should make your boss aware that you (and/or your team) is unlikely to succeed to the extent that he is asking because it is a lot to ask of any team. Although, this also means that in your attempt to copy the work, you may actually improve upon it. However, even with blueprints, screenshots and other "confidential" materials available, you should at least warn him that they may still have proprietary knowledge that is not available to you, which may lead to your ultimate failure to "copy" it. This should simply be a fair warning, and not implied message that you are interested in sabotaging his request. You must be careful to communicate that his request is simply much more difficult than it sounds.

Last, consider that you can defend yourself in another way - the more you try to deeply understand the inner workings of this system, the more it is possible the vendor will become suspicious of your motives. Additionally, it seems that it will be possible for them to have a mountain of evidence available to them of this breach of confidence, if your team is "successful" in copying their system. Emails that request information and/or verify their process can provide them sufficient evidence to mount a compelling legal case. Then you can rest easy knowing that if a breach of confidence occurred, the communications will allow for an appropriate legal decision.

NOTE: This is not legal advice, and I'm not a lawyer. I just would hope to provide a perspective that will help you feel better about whatever course of action you take.

Answer 3

In as far as legality is concerned, it may or may not be legal. In terms of business ethics the same. However both the legal implications and the ethical considerations are your bosses problem and responsibility, not yours.

It appears your boss has access to code and structures and he wants to take immediate advantage of it. That's the way a lot of businesses get ahead. I would go ahead and do what you're tasked with. You could well be second guessing your boss without knowing all the facts.

If it was me, I'd ask the boss point blank "Are you sure this is legal?" and abide by his answer, if he said it wasn't, I wouldn't do it. Otherwise I would go ahead, business is a cut throat place, companies should be protecting their core data and infrastructure themselves and you may not be aware of all the facts in the case and lots of companies copy others methods and structures if they can work them out.

My personal experience with being asked to duplicate software in such a way was as a consultant which because I owned my own business had different implications, and I refused. But there are occasions where I have been asked to look at a piece of software and make something similar, which is fine by my ethical standards. I don't need their db structures and source code etc,. to do that.