Let’s face it, software asset management (SAM) might be a best practice, but there are still plenty of organizations out there who haven’t instituted SAM due to a lack of resources or initiative. If your organization is one of them and the Business Software Alliance (BSA) hasn’t come calling yet, there’s still time to get your house in order. But once that BSA threat letter hits the mailbox, the ballgame changes.
The BSA is known to be a persistent enforcement agency which rarely grants clemency to organizations once it begins settlement proceedings. The following eight tips are offered by two attorneys who specialize in BSA defense cases; they give advice on what to do once your business receives a letter requesting a BSA audit.
1. Retain a lawyer.
The BSA is an efficient organization when it comes to extracting punitive damages from companies found to be in a non-compliant licensing situation?its experts and lawyers know copyright laws inside and out because that is all that they do. For that reason, Scott recommends seeking legal counsel as soon as an audit request is received from the BSA.
"Whether the attorney is working in-house or outside the firm, don’t go it alone," you have an audit," said Rob Scott, partner at Houston-based Scott and Scott. Scott said. "The BSA has very experienced attorneys working for it and this is a very complicated process. It involves not only the legal issues related to copyright law, but also it subsumes with it all of the software licensing rules because the copyright claim that lies underneath the BSA audit matter is related to the software licensing rules."
2. Cooperate?carefully.
As much as a business person would love to screw up their eyes and wish the BSA away, the trouble will only multiply through inaction. Though the BSA is not a law enforcement agency it is acting on the behalf of the software companies and it will take matters to civil court if a business does not cooperate with the self-audit process and settlement negotiations.
"When you get a letter from the BSA do not throw it away," said Steve Helland, partner at the Minneapolis-based law firm of Fredrikson and Byron. "That is a serious tip, because some people think that ‘Oh if I ignore this it will just go away, but the cases where the BSA is most likely to file in court are where they think there has been infringement and they don’t get any response."Scott agrees.
"You really are in a position of either cooperating with the self audit process or facing litigation," Scott said. "Between the two most clients choose the self audit process because it has a lot of advantages over litigation."
According to Jenny Blank, director of enforcement at the BSA, timely cooperation is likely to improve a business’ chances for a reduced settlement."If we have to fight and argue and try to persuade someone to do an audit and it goes on for month after month after month, that’s not a cooperative company and that company is not going to get, maybe, the lowest number available," Blank said. "The company that comes out and works with us and says, ‘You know what? I’m going to do an audit and we’re going to discuss the results like adults and we’re going to come to a fair agreement,’ well, when it comes time to making that final number, it is going to be noted that this was a cooperative company who wanted to do the right thing."
But Scott and Helland warn businesses to tread carefully during negotiation."Remember the sole propose of the BSA is to get as much money from your business as possible," Helland said. "The way that those lawyers stay on the retainer of the BSA is by having a high recovery rate it is not their incentive to be your friends."
One of the first things Scott says he does for his clients starting the process is draft a contract with the BSA that protects them should matters end up in court.
"We basically enter into a contract with whoever the auditor is that says we’ll agree to produce the audit materials if you agree to keep it confidential and agree that information exchanged is for settlement purposes only and there is no admission here that you could use against us in court," Scott said.
3. Don’t let the BSA’s rhetoric intimidate you.
The BSA’s threat letter can be a pretty scary item when it is addressed to your business, but Helland says that businesses shouldn’t despair."Things are probably not as bad as the bsa suggests they are," he said. "If you’ve seen a sample of the bsa’s threat letters, they say that copyright law allows for $100,000 in damages per infringement, but what they don’t tell you is that the number of cases in which that level of damage is awarded is extremely rare."
His advice is to not allow these high initial numbers cloud your judgment during negotiation, because otherwise you could leave money on the table in the form of a better deal that just might have been accepted.
4. Don’t rush out and buy any software.
When many businesses first receive an audit letter from the BSA the first impulse may be to panic and rush to action. Scott recommends strongly against buying a lot of software to ‘make up’ for the amount of non-compliant seats an organization may find once they’re faced with an audit.
"Any software that you purchase after the date of the letter is not going to help you in the audit matter whatsoever," Scott said. "You can uninstall software that you don’t need on a go-forward basis."
5. Preserve evidence with confidentiality.
As an organization goes through the self-audit process, it is critical to collect evidence so that it is protected from being discoverable evidence during litigation. Scott recommends having an attorney oversee the process to ensure the confidentiality of the audit information.
"Having the attorneys involved in controlling the collection of the information and the reporting imbues that information with certain privileges that help protect the client’s interests," Scott said, "otherwise the resulting paperwork could be discoverable in court."
Having an attorney supervise the process will also ensure that an IT staff eager to be cooperative doesn’t give the BSA more information than it needs.
"Prepare your audit response carefully, and with the legal assistance of counsel because otherwise the off the cuff audit response prepared by your IT staff alone will be the confession that will hang you," Helland said.
6. Find your allies.
Don’t forget that it pays to ask for help when you need it. Helland suggests enlisting the help of software resellers or even the software vendor itself if there is a previous relationship.
"If you use a sales rep who helps you purchase a lot of software, get them on your side," Helland said. "Get your software reseller on your side, ask them for documentation. In some cases, if you have a relationship with the software vendor itself, leverage that."
7. Create a compliance plan.
The self-audit process will need to be completed quickly and the BSA will definitely make demands for an organization using unlicensed software to get into compliance. Scott believes the best way to negotiate is to prove the organization is serious about making amends by developing a compliance plan.
"It’s just a basically a crash course in software asset management," he said. "Make sure that you’re SAM folks are either cooperating with whoever you have working on the audit to do the work that is needed to complete the project in a way that is much faster than what typically it organizations are accustomed to dealing within terms with software license compliance and software asset management."
8. Negotiate non-monetary aspects.
One common mistake businesses make while negotiating with the BSA is they focus only on the amount of money they’ll have to pay to settle. However, there are other non-financial factors at play as well.
Non-monetary aspects to a settlement may include agreements as to how and when the BSA can inspect a business in the future and whether or not the BSA can publicize the details of that business’ case. Scott advises those negotiating a BSA settlement to carefully consider the future impact to the business that such settlement agreements may have before signing on the dotted line. Unless a business includes the right stipulations within the settlement, the BSA could end up issuing a press release for all to hear about the investigation and settlement fine.
"Certainly damage to brand is a major concern to anyone who has been accused of software piracy or being out of software license compliance and how the BSA publicizes a particular investigation may have a major negative impact on a particular company’s brand," Scott said.
