As a freelancer, in what circumstances and with what provisions (if any) would it be ethical to reverse engineer an app that a client says they own, but do not have the source code for? Should you just take their word for it, or should you make provision for checking if they're being honest about it or not.

In the instance I am thinking of. The reason given when I asked was that the guy they hired to make the app had not given them the source code, and not being technical people they hadn't asked for it, and they cannot contact him.

But I'm asking the question in general terms.

  • In your situation, you've asked the client why they don't have the source code, and they gave you a reason. It seems now you just have to ask whether you'll "accept" that reasoning or not. What other form of checking did you have in mind? – Brandin Apr 17 '16 at 16:00
  • 2
    Even if we ignore the legal aspect, wouldn't the ethics of the situation also depend on whether the contract for the original developer included an IP transfer? If they didn't think to get the source code that tells me they probably didn't think to use a software transfer agreement either in which case you're legally and ethically in the wrong. – Lilienthal Apr 17 '16 at 22:13
  • 1
    This situation really seems like it will have to end up being your judgment call. The phrase "take their word for it" can imply that you're switching off your human reasoning and just processing requests like a computer would. Don't do that. If you feel like they're not being straightforward with you, you have the option not to do business. But I think this is more about prudence than about ethics. – Brandin Apr 17 '16 at 23:50
  • 1
    @Kilisi If it is easy to check you should do it. Not doing your due diligence when a simple check is possible could be considered unethical. If you get these kinds of requests, you might also consider establishing your own official policy for reverse engineering requests or even for projects in general. Then you can refer to this policy for guidelines in such situations. – Brandin Apr 18 '16 at 11:58
  • 1
    @Kilisi Regarding your first comment: that's what you get when you provide a specific scenario :). While this is the Workplace a lot of people came here from SO so you're more likely to get answers (and debate) on the intricacies of software ownership than the general question "Is it ethical to use a tool when I can't verify that it was legally purchased?" Seems like that could be a question in its own right though. – Lilienthal Apr 18 '16 at 18:56

Your potential customer might have licensed the software and asks you to reverse engineer it (in other words, write equivalent software) with the intent of ripping off the original developer. In that case it's highly unlikely that paying you will be cheaper than paying the original developer, who, after all, has the source code and therefore could do the job much cheaper than you.

As soon as you are talking about money, you will find out. If they expect you to be cheaper than the original developer, negotiations will stop when you talk about money. If the genuinely messed up and lost the source code, they will pay your price.

Since you asked ethics and not legality: If what you do isn't robbing the original developer (because he or she cannot be contacted, for example), it's fine ethically.

  • 1
    In answer to your first two paragraphs, I have to disagree, it's easier and much less expensive to make an equivalent piece of software if you don't need to do all the planning that's involved with creating and tweaking and upgrading something from scratch. In answer to your third paragraph, I agree, but is it ethical to take the clients word on the matter without checking in some way? As a freelancer quite often you have no real idea about the client, you may have just met them. – Kilisi Apr 17 '16 at 8:49

You need to ask yourself one vital question Do they own the copyright for the code?

This is a difficult and maybe an expensive question to be absolutely sure of an answer. You cannot rely on their word. So as a freelance programmer are you will to take the chance?

Personally I would not. It is not worth the risk.

  • 2
    I don't think it's realistic to expect a freelancer to investigate copyrights just to work on a project. Besides, if the company has violated someone's copyright, it's that company who has done that violation, not the freelance programmer. – Brandin Apr 17 '16 at 15:57
  • 1
    That was my point. But doing it as freelance is it the company that is going to pay you in the future that is going to take a possible fall. Or can the company just walk away. Either way it is doing to be a difficult thing to sort out in court and therefore not worth the risk – Ed Heal Apr 17 '16 at 16:00
  • But this risk is still there even if you've got the source code. Or are you going to go through all the source code to see if there's something possibly infringing before agreeing to work on it? For evaluating legal risks get a legal consultant. – Brandin Apr 17 '16 at 16:04
  • @Brandin - It is about risk reduction. Nothing in life is risk free. But reverse engineering is very risky IHMO. – Ed Heal Apr 17 '16 at 16:08
  • I tend to agree with the sentence "Personally I would not.", it's not the risk I care about, I'm in the third World, good luck trying to prosecute me, it's the ethics of the matter. – Kilisi Apr 17 '16 at 20:19

Should you just take their word for it

No, a general rule of thumb is not to believe anything unsupported a stranger tells you when the outcome of convincing you benefits their agenda. This holds true whether it's someone in a van offering you a lollipop while you're walking home from school, or a potential client wanting some reverse engineering done. A judgement call needs to be made based on what they're trying to convince you to do. But don't assume honesty straight away.

should you make provision for checking if they're being honest about it or not.

Yes, you should do what you can, either that or just decline the job. You may not get definitive information, but if you find enough to allay your suspicions, that's all that's needed. This isn't about legality. One way is to check on the company and the person doing the requesting. I have found that a bit of time on google and looking at websites usually gives me enough information to make a 'gut' judgement call.

Eg,. it might be a solid looking company who have had the app for quite a while, but you can't find any connection between the person requesting the job and the company. Or worse still you find a connection but the person no longer works there.

  • 1
    It's worth noting that as a freelancer, you are entirely the person at risk doing the work. The company you are working on behalf of could counter-sue you if the original developer sues them for any sort of IP infringement if the company turns out to be dishonest. This is why professional liability insurance exists - because things can and do go wrong due to bad decisions and someone has to pay. – toadflakz Apr 18 '16 at 10:54
  • Very good point – Kilisi Apr 18 '16 at 11:03

Your ethical obligation should be that you are reasonably sure that you are not assisting them to take something they do not have a legal right to. In a matter like this asking to see their contract with the original author should be a reasonable step in your due diligence and should not be interpreted as a lack of trust in them. In reality they probably benefit from you ensuring that the action they are wanting taken is legal.

Do your due diligence and make sure that you are convinced they own this code.

  • Sounds reasonable – Kilisi Apr 18 '16 at 19:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.