Tame Your SLAs

From time to time over the years, I've received ominous letters from the Business Software Alliance (BSA) questioning whether I had illegal software on my computers. I laughed all the way to the paper shredder, since all but two of the thousands of software products I've used over the years either arrived preinstalled on computers or were provided without charge by software vendors. I paid for the other two.

But legions of others aren't so lucky. Whether you're a large enterprise or a one-person business, software licensing agreement (SLA) goblins may be coming at you with a vengeance.

The Scope Of The Problem

According to Robert J. Scott, managing partner in the law firm Scott & Scott LLP, companies typically have difficulty adequately proving the legitimacy of 10 to 90 percent of their installed software. The most common way a company violates software licenses and copyright laws, says Scott, is by failing to implement controls and procedures to prevent unauthorized installation of software.

"A typical large enterprise has 15,000 to 30,000 unique software titles installed, while only 800 may be necessary for business operations," says Scott. "Other problems include using software beyond the trial period, installing the wrong version of a product relative to what was purchased, failing to ensure no new products are installed that are not covered by the original agreement, and failing to maintain adequate procurement records."

Jose Negron, technical director at IT auditing software developer Layton Technology, cites a global software piracy study conducted by the BSA in 2004. More than $59 billion was spent on commercial packaged PC software, yet more than $90 billion was installed, meaning that more than one-third of software in use on PCs worldwide is pirated (a term that includes intentional and unintentional alleged infringement). Other sources for this story suggest that pirated software is in the range of 23 to 33 percent, even disregarding unpublished settlements. "That is a lot of lost money at the expense of software providers," says Negron, "and beware...they are fighting back!"Companies are responsible for conducting internal audits to compare install counts to their SLAs. Directly or through third-party associations, software publishers can conduct audits with little or no evidence of noncompliance on the company's part. Businesses may receive a notice that they must prove compliance, or law enforcement officers may appear unexpectedly. Negron warns, "Sooner or later, companies that fail to adhere to the SLA will get fined."

Serious Penalties For Noncompliance
If your company is found in violation of an SLA, you face back-payment license fees at punitive levels plus damages, according to Brian McCarthy, VP of marketing for IT auditing software maker Centennial Software in the Americas. Fines range from $10,000 to $150,000 per unlicensed application. Criteria for determining the amount of the fine include the egregiousness of the circumstances, whether the infringement is for desktop or enterprise-class products (such as server apps), and other, less predictable factors. According to Scott, the fine generally is two to three times a product's retail price.

A headache for large enterprises, heavy fines could put smaller companies out of business. McCarthy adds that, in deliberate and extreme copyright infringement, executives or technical staff can face prison time.
SLA Compliance Challenges

According to Centennial's McCarthy, most companies find themselves out of SLA compliance because they don't have the necessary visibility into all the software installed across a network. It's common to be both under-licensed and over-licensed at the same time.

The second challenge is controlling and educating employees about the risks of downloading illegal software. Although employees may download or share software and other applications without malice, doing so puts organizations at risk.

Other major challenges faced by IT departments include understanding software license terms from multiple vendors, controlling software acquisition and installation companywide, keeping up with internal recordkeeping and reporting, and getting senior management buy-in for all these measures. Mergers and acquisitions, outsourcing (especially offshoring), and the rise of USB thumb drives and other portable storage devices have exacerbated these headaches.Getting Audited
The BSA, which has represented companies such as Adobe, Apple, IBM, and Microsoft, and the Software & Information Industry Association (SIIA) lead the pack on SLA audits and enforcement, but others are aggressive, too. Yossi Aloni, product marketing manager at Peregrine Systems, a maker of IT management software, notes some of the other major players:

McCarthy explains, "Acting on anonymous reports, the organizations work on behalf of leading software publishers to audit a company's software compliance." Most of these audits are prelitigation "self-audits" in which the target company must compile a list of all the software installed on its network and reconcile that list with procurement records. The process may take up to a year.

According to Scott, most audits begin with a tip from a disgruntled employee or vendor. Both the BSA and the SIIA offer financial incentives to tipsters -- now up to $200,000 for the BSA, according to Scott. "The promise by the SIIA and BSA to pay disgruntled employees a percentage of a recovery in a software audit is the most disturbing development in recent years," says Scott. "These agencies compete for market share."

If a company cannot provide adequate proof of purchase for its software during a self-audit, the auditing agency usually proposes a fine. According to Scott, the BSA typically imposes fines that are two times the unbundled full retail price of each product, while the SIIA typically fines three times the retail price of the products. See the following sites for BSA and SIIA fine calculators.

Ensuring Compliance And Avoiding Audits
Centennial's McCarthy notes that the first step to compliance is to educate employees with a software usage policy. Explain the consequences of downloading software illegally.

Understanding the assets on the network is key to managing them, so the next step is to gain 100 percent visibility of software assets with a network discovery or IT asset management product. These tools can perform regular internal audits and correct over- or under-licensing. By actively tracking software use to licenses, according to McCarthy, a company can greatly reduce the chance of an audit and, if audited, demonstrate compliance.

McCarthy recommends that companies implement a software asset management (SAM) strategy like the following:

Scott notes that the total cost of compliance management runs between $50 and $150 per computer for most organizations.

David S. Bloch, partner in the Silicon Valley office of the law firm McDermott Will & Emory LLP, urges employing a part- or full-time compliance officer, if possible. For companies whose budgets don't support that, periodic internal audits or spot-checks may help. Contrary to some other experts, Bloch feels that centralized control of computers sounds good in theory, but may be unworkable in practice.And don't forget that SLAs apply to offshore as well as domestic workforces. Infringements overseas far eclipse those in the United States, especially in countries such as Vietnam, Ukraine, and China. Negotiate your offshoring contracts with due diligence.
Solutions To The SLA Nightmare
While SLAs won't be going away any time soon -- in fact, Peregrine's Aloni notes that SLA issues are becoming more critical, given the growing M&A and outsourcing transitions -- some companies are exploring new software licensing options.

Chris Wagner, manager of presales and software licensing at solution provider CDW, observes that many companies have begun to choose SLAs through annuity plans instead of paying up front as a means to better predict software expenses and plan for future needs.

On the producer and licensor side, Bloch urges companies to explore alternative licensing and pricing strategies that make it easier for customers to comply without being ensnared. "Subscription services, for example, are a plausible way forward, at least for some software companies," he says.

Bloch also would welcome a cooperative program in which auditors such as the BSA conduct a "free" audit with no consequences for detected violations, perhaps on the understanding that the subject company will agree to a second BSA audit 12 to 18 months later with fines or lawsuits only if the second audit detects problems.

Scott predicts that the failure of proprietary software makers to be sensitive to the needs of business consumers regarding compliance management will drive explosive growth in open-source software. The industry should do more to alleviate the compliance management burden, he says, by simplifying licensing rules, adding unique identifiers to registry information and procurement records to enable automation of the reconciliation process, and educating users regarding the types of documentation to retain.Until the industry works together to awaken from our continuing SLA nightmare, we must make dealing with SLAs as painless as possible. The following tips can help.

J.W. Olsen has been a full-time author, editor, and freelance book project manager with more than 1,000 editorial credits for IT publishers since 1990, and has provided computer, Web site, and editorial services to other clients since 1985. He welcomes feedback via the e-mail response form at www.jwolsen.com.