open-source-software confidentiality
Is it legal to use leaked documents for open source development?
<p>Lets say a specific data structure is only documented in a confidential document, which can not be found over the official websites.</p>
<p>If a developer can find a copy of this document via Google (on an indexed server), is it legally allowed to implement the data structure in open source projects (and make it public with that)?</p>
<p>I am wondering because technically, the developer using this data structure and document has never signed a NDA with the owner of this document. But has simply found it online via Google. So the document was not even obtained by &quot;breaking&quot; or hacking into any systems.</p>
<p>Besides, is there a difference with which country the developer works?</p>

<p>Such use might well be illegal, and subject the user to tort liability, or possibly even criminal liability.</p>
<h2>Parties</h2>
<p>For this discussion let us call the person or company that developed and wants to protect the information D, the person or company that downloaded and wants to use the information U, and the person who placed the information on the server P.</p>
<h2>Trade Secret</h2>
<p>One possible source of liability is if D considers the information to be a <a href="/questions/tagged/trade-secret" class="post-tag" title="show questions tagged &#39;trade-secret&#39;" rel="tag">trade-secret</a>. The law on trade secrets varies to some extent in different countries, although there is a general similarity. Since no jurisdiction is specified in the question, I am going to look at the <a href="/questions/tagged/united-states" class="post-tag" title="show questions tagged &#39;united-states&#39;" rel="tag">united-states</a> law.</p>
<h3>Definition</h3>
<p>The <a href="https://www.law.cornell.edu/wex/trade_secret" rel="nofollow noreferrer">LII page on &quot;Trade Secrets</a> defines a trade secret  under the US  Uniform Trade Secrets Act (&quot;UTSA&quot;) as:</p>
<blockquote>
<ul>
<li>&quot;information, including a formula, pattern, compilation, program, device, method, technique, or process that:</li>
<li>Derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use; and</li>
<li>Is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.</li>
</ul>
</blockquote>
<p>A similar definition is given by the USPTO page on <a href="https://www.uspto.gov/ip-policy/trade-secret-policy" rel="nofollow noreferrer">&quot;trade secret policy&quot;</a>.</p>
<p>Prior to the USTA, and still in those US states that have not adopted the USTA, trade secrets were/are protected under the common law. The LII page lists the common law factors, as given by the  <em>Restatement of Torts</em> (1939) § 757, comment b:</p>
<blockquote>
<ul>
<li>The extent to which the information is known outside the claimant's business</li>
<li>The extent to which it is known by employees and others involved in the business</li>
<li>The extent of measures taken by the claimant to guard the secrecy of the information</li>
<li>The value of the information to the business and its competitors</li>
<li>The amount of effort or money expended by the business in developing the information</li>
<li>The ease or difficulty with which the information could be properly acquired or duplicated by others</li>
</ul>
</blockquote>
<p>These factors may apply in other common-law countries.</p>
<p>In either case, one must consider how the would-be user came to acquire the information, and thus how it came to be on the server from which it was downloaded. One must also consider whether it was the subject of &quot;reasonable efforts&quot; to protect its secrecy, under the circumstances.</p>
<h3>Circumstances</h3>
<p>If P was violating an obligation of confidentiality, such as an NDA or a duty as part of an employment relationship, then the placement of the info on the server was improper. In such a case its acquisition by another, such as U  might constitute  misappropriation. The same would be true if a person under an obligation of confidentiality arranged for the server to be indexed by a search engine, when it should not have been. The case for misappropriation would be stronger if U knew that the information was considered confidential by D, and also if P had informed U about where to find the info, or what search terms would uncover it.</p>
<p>If P was acting with the permission of D, and P or someone else at D simply failed to realize that the server was, or might become, indexed, then the question is whether the steps taken by D to keep the info secret were reasonable. If this a case of &quot;inadvertent disclosure resulting from the trade secret holder's failure to take reasonable protective measures&quot; then there is no misappropriation, and the actions of U are lawful. That will depend of a judgement of whether D's actions were reasonable in light of the value of the info and the overall circumstances.</p>
<p>If the placement of the info on the server is considered to constitute &quot;general publication&quot; of the info, so that it is no longer secret in any meaningful sense, then D may have a claim against P, but not against U unless U acted in collaboration with P.</p>
<h2>Copyright Law</h2>
<p>The documents downloaded from the4 server are almost surely protected by copyright. Directly incorporating them into an open source project without permission from the copyright holder would be copyright infringement, and would subject U to a suit for infringement.</p>
<p>However, copyright does not protect ideas, methods, or facts. If U learns a method or idea from the document, and uses that knowledge without directly copying or closely paraphrasing the document, there is no copyright infringement and no claim under copyright law.</p>
<h2>Patent Law</h2>
<p>The question does not mention any patents. It is possible that D has patented the method describe in the downloaded documents. If so, and if the patent is valid, any use by U would be patent infringement, and the question of how U learned the info becomes irrelevant. However, most software developments such as data structures are not patented, so this is a somewhat unlikely, albeit possible, case.</p>
<p>Notre that if the information is covered by a patent is is by definition not secret, as all patents must be openly disclosed. But they may not be widely publicized, and if U does not make a patent search, U may not realize that the document includes patented technology.</p>
<p>This possibility is largely incompatible with the trade secret possibility, althogh it is possible to use trade secrets in connection with patented tech.</p>
<h2>Conclusion</h2>
<p>In short whether U may lawfully use then info, or is subject to a tort claim by D, or even  criminal action, depend on the details of the overall facts. U would do well to take legal advice on the matter before proceeding to use the info.</p>

<p>Yes, it's legal but that doesn't mean you won't have legal troubles.   If the code is confidential in some way, the coder that released it is under the NDA and should suffer legal ramifications regardless of use. As with any language, phrases and names are not eligible for copyright, so a snippet of code is not in and of itself copyrighted... it's the entire code as a whole that is (i.e. The totality of a code for your favorite open world driving simulator... Let's call it &quot;Red Dead Carejackers&quot; is copyrighted, while a smaller portion of the code, such as calculating the player character's money, would not and could be similar to your favorite cowboy video game, &quot;Grand Theft Horsey&quot;.   If this was a work of fiction, saying &quot;Life is like a Box of Chocolates&quot; is not infringing on copyright or trademark laws... but having a person who is mentally handicapped but still capable of living a rich life say this to someone while waiting for the bus will get you in to a bit of trouble (though it does matter about how many other elements are shared).</p>
<p>That said, you might have legal troubles as an organization with enough money and spite may try to sue you even though they don't have a snowball's chance in hell of winning because suits are expensive win or lose and they can afford to keep it going longer than you can... it's hard to punish someone for filing frivolous suits to stop this behavior.  While they likely won't, it's not for an inability.  I can sue you right now for chewing too loudly...  whether this needs to get to a trial is a matter for a judge to determine, not myself... That said, if the code is published product (i.e. the software is being sold) it's likely sourced from a person who bought a legit copy and wants to understand &quot;whats going on under the hood&quot; so to speak.   If it's not a published product, the employee is the first person to go after legally speaking because an NDA is stronger evidence and the company hosting, rather than a person making open source code.   While it might be illegal for you to do, a good lawyer will point out that &quot;you can't get blood from a stone&quot; meaning that the damages incurred by your actions aren't fiscally worth the lawsuit process when you have someone who broke a contract and a major tech firm that you can take to court (in the former case you can demand a return of payments you made AND have strong evidence.  IN the latter, the money you could gain in damages is worth the risk of the legal process up front costs.).</p>
