united-states intellectual-property software liability patents
What is the legality of implementing an unrevealed killswitch in software?
<p>In <a href="https://imgur.com/gallery/9bvFs" rel="noreferrer">this hypothetical</a>, the poster describes the following:</p>

<ul>
<li><p>during employment with his/her employer, the poster invents and patents a method (in his/her free time) that it turns out, is useful for his/her employer </p></li>
<li><p>he/she presents the invention to his employer, and after receiving a $10000 bonus he/she implemented it for the company </p></li>
<li><p>there was no signed agreement giving permission for the company to use the application and source code</p></li>
<li><p>the invention, patent, and implementation included a kill-switch that would cause the program to self-delete along with all of its output if the program's author did not check in every month</p></li>
<li><p>the employer is unaware that there is a kill-switch in the software</p></li>
<li><p>the author was laid off, and now expects the kill-switch to engage, causing financial loss to the employer</p></li>
</ul>

<p>In the hypothetical, the software author claims:</p>

<ul>
<li><p>the employer "has no legal ownership claim to the application or code or their use"</p></li>
<li><p>the employer assumes all liability for damages since it did no third party testing</p></li>
</ul>

<p>Are these two claims true? Is this hypothetical, is the program author free from liability?</p>

<p>If your friend was a salaried W2 full time exempt employee hired by the company to, among other things, write software like this, then the fact that it was developed "off the clock" with the employee's own resources means nothing once he gives it to the company. I mean if I give you a present and it blows up and breaks your arm, I'm still liable even if we didn't have a "contract" - especially if I knew it would blow up. Your friend's position is even worse since the relationship entails the employee's having the employer's best interests in mind. If I were your friend, I'd either figure out how to fix this or take gnasher729's advice from the comments and find a country where it's easy to hide from parties public and private. Maybe buy a bunch of canned food and go live on a boat?</p>

<p>There are two parts to the intellectual property here, the patent and the copyrighted software. The patent is owned by its inventor, but there is an implied license; the company awarded a $10,000 bonus, and the inventor then wrote the software in his role as an employee of the company, so his conduct implies acceptance of the company use of the patent in this way. The software itself is wholly owned by the company, but it cannot be used or sold without a valid license.</p>

<p>(It's conceivable that the software was also written in the employees own time and on the employees own equipment, in which case its just about possible that the software is separate from the employment contract. However even in this case there is a clear license under similar terms to the implied patent license.)</p>

<p>At this point I have to wonder about the amount of common sense of the parties; </p>

<ul>
<li><p>Many companies have clauses in their employment contracts about employee inventions, but the question doesn't mention one.</p></li>
<li><p>For self-protection both sides should have had a proper patent license drawn up, as the terms of the implied license are very vague. Can the company sell the software? Can it use the patent in other software? Is the license exclusive? What happens if the company is acquired? All of these are left as open questions.</p></li>
</ul>

<p>However I'll get back to the original question. The logic bomb is entirely in the software, which was written as a work for hire by the employee. The patent is therefore irrelevant.</p>

<p><a href="https://en.wikipedia.org/wiki/Logic_bomb" rel="noreferrer">Logic bombs</a> of this kind are illegal. In addition to civil damages, wiping data from a computer without authorisation is a violation of the <a href="https://en.wikipedia.org/wiki/Computer_Fraud_and_Abuse_Act" rel="noreferrer">Computer Fraud &amp; Abuse Act</a> </p>

<blockquote>
  <p><a href="https://www.law.cornell.edu/uscode/text/18/1030#a_5" rel="noreferrer">(a)(5)(c)</a> intentionally accesses a protected computer without authorization, and as a result of such conduct, causes damage and loss.</p>
</blockquote>

<p>Maximum penalty is 5 years, or 10 years if done for gain. However I don't see a "for gain" element here; the logic bomb seems to be pure revenge.</p>

<p>As to the specific claims of the developer:</p>

<blockquote>
  <p>the employer "has no legal ownership claim to the application or code or their use"</p>
</blockquote>

<p>Wrong. The application code was written as a <a href="https://en.wikipedia.org/wiki/Work_for_hire" rel="noreferrer">work for hire</a> by the employee, acting in their role as employee. Even if the employee can prove that they own the source code, the company still has an implied license, and that license does not terminate with the employee's employment.</p>

<blockquote>
  <p>the employer assumes all liability for damages since it did no third party testing</p>
</blockquote>

<p>I don't know what the term "third party testing" means here. If the software was written as a work for hire then testing, either by the developer or another employee would be routine. Software almost never works perfectly first time, so the idea that no testing of any kind was done before the software was placed in operation is simply not plausible. If the software is licensed then the allocation of liability would be a term of the license, but in the absence of anything in the license then the normal application of care and skill (which would include testing) would be required to avoid liability.</p>

<p>However here we are not talking about liability for ordinary defects. A logic bomb is a deliberate function engineered into the software by the developer. Its the difference between kicking a football which accidentally goes through a window versus deliberately throwing a brick through the window. It might also be worth noting that hidden functionality of this kind would not be found through any ordinary testing.</p>

<p>Furthermore this logic bomb did not merely disable the software, it deleted files which were created and owned by the company (software developers have no ownership rights in the output of their software unless the output contains substantial fragments which were built in to the software). This was done with the intention of harming the company. This damage was not authorised by the company, and hence falls under the CFA (see above). </p>

<blockquote>
  <p>What is the legality of implementing an unrevealed killswitch in software?</p>
</blockquote>

<p>This is a late answer, but the US government does not seem warm to the idea. From Schneier's <a href="https://www.schneier.com/blog/archives/2019/07/insider_logic_b.html" rel="nofollow noreferrer">Insider Logic Bombs</a>:</p>

<blockquote>
  <p>According to court documents, [David] Tinley provided software services
  for Siemens' Monroeville, PA offices for nearly ten years. Among the
  work he was asked to perform was the creation of spreadsheets that the
  company was using to manage equipment orders.</p>
  
  <p>The spreadsheets included custom scripts that would update the content
  of the file based on current orders stored in other, remote documents,
  allowing the company to automate inventory and order management.</p>
  
  <p>But while Tinley's files worked for years, they started malfunctioning
  around 2014. According to court documents, Tinley planted so-called
  "logic bombs" that would trigger after a certain date, and crash the
  files.</p>
  
  <p>Every time the scripts would crash, Siemens would call Tinley, who'd
  fix the files for a fee.</p>
</blockquote>

<p><a href="https://www.scribd.com/document/419389583/5948342-0-19339" rel="nofollow noreferrer">Here</a> is the charging document.</p>
