See your link here
FBI: Offshoring still a risky proposition
7 comments- IT TOPICS:Government & Regulation, Management, Security, Software
A few years back Boston-based FBI special agent Nenette Day busted a rogue programmer in India who had stolen the source code to SolidWorks Corp's CAD program. The sting, which took place in India, was a success in that SolidWorks was able to recover its software. If you think the perpetrator is rotting in jail, however, you'd be sadly mistaken.
The case is still dragging on in court, and it's unlikely that the defendant will ever serve jail time due to weak laws, Day says. In the SolidWorks case, which involved the theft of intellectual property valued at $750 million, the perpetrator is free, walking the streets and working in another programming job. He is unlikely to see any jail time.
Day provided an update on the SolidWorks case during a presentation last week at the CIO Forum.
SolidWorks was lucky. Once the source code goes out the door it could be posted on the Internet and at that point the damage is done. Prevention is key.
Nondisclosure agreements with offshore organizations won't help reduce this risk because they have no legal standing in other countries. The only way to contractually protect your intellectual property is to have the local outsourcer bind employees to an agreement under local laws, says Day. But when the laws are weak, she says, even these agreements provide little protection.
Day says before sending source code to a country companies should check what laws are available to protect them - and whether they've been successfully used by prosecutors. The prevalence of corruption in law enforcement can also stop a case. In many parts of the world, for example, it's not uncommon for police to refuse to help unless bribes are paid first.
To mitigate the risk of offshoring, Day says companies should use an offshore partner with tight security practices and release only portions of the source code at any one time so that the offshore programmers never have the complete program.
It's also important to work with an offshore partner who will be committed to working with local authorities to track down and prosecute any perpetrators, should a loss occur.
Still another way organizations are migitating this risk is by offshoring through a U.S.-based company like Gap International Inc. in Springfield, PA. The consulting company has a division in India where it hires local programmers as employees. While that still won't prevent a disgruntled employee from trying to steal trade secrets, you can bet that a company that can be sued in the U.S. is going to be very careful. I asked Rich Rothman, director, what would happen if just one disgruntled employee got away with a client's source code? "We'd be out of business," he said without hesitation.
Print
Email this
Digg this
