Findings of the CARDS Sponsored Software Reuse Legal Workshop (22-24 Mar 93)

Theresa R. Huber

DSD Laboratories, Inc. 75 Union Avenue Sudbury, MA 01776 Tel: (508) 443-9700 Email: huber@cards.com

Abstract

The Central Archive for Reusable Defense Software (CARDS) Program is currently addressing concerns being raised by the software reuse community regarding perceived legal impediments in software reuse. In March of this year, CARDS held a workshop in conjunction with the U.S. Army Intellectual Property Law Division (IPLD) and the Defense Information Systems Agency/Center for Information Management (DISA/CIM) to address outstanding legal questions, liability issues and agreements so that the results could be transitioned to Government managers who are investigating implementing reuse.

Keywords: Software Reuse, Legal Issues, Liabilities, Risk, Agreements, Reuse Libraries, CARDS.

Workshop Goals: Promulgate findings of legal issues workshop, network, learn.

Working Groups: Reuse Management, Organization and Economics

1 Background

Ms. Huber currently works on the Air Force’s Central Archive for Reusable Defense Software (CARDS) Program. CARDS is developing a knowledge base to transition domain-specific reuse techniques and guidance throughout the DoD. By developing and operating a domain- specific reuse library system and necessary tools as well as a Franchise Plan, CARDS can provide a blueprint for institutionalizing domain-specific, library-centered, model-based reuse throughout the DoD. This Franchise Plan is being implemented by providing users with a tailored set of services to support reuse. Included in this knowledge base is guidance for acquisition executives and Program Managers. Ms. Huber has worked on this portion of CARDS by researching, developing and implementing plans to facilitate the adoption of software reuse within DoD. She has developed and written guidance in technical, personnel, risk and budgetary issues for both middle managers and high level executives to implement software reuse technology.

2 Position

Since the DoD began investigating strategies for incorporating reuse into systems acquisition and development, various groups have been examining and developing in-roads into both the technical and business aspects of software reuse. Issues that impact software reuse, such as, acquisition regulations and policies, library mechanisms and interoperability have been addressed. However, there has been limited progress within the legal discipline in formulating guidance for Government managers in software reuse in general, and in establishing and operating reuse libraries in particular.

The Central Archive for Reusable Defense Software (CARDS) Program, sponsored by the U.S Air Force, (ESC/ENS) Hanscom AFB, MA, has investigated business areas that impact software reuse. During this research, it was learned that the DoD community perceived many legal impediments in applying software reuse in general. But, specifically, many questions were unanswered regarding establishing and operating a software reuse library. As a result, the CARDS Program held a workshop for Government lawyers to address general legal aspects of operating a software reuse library and to try to resolve these legal questions.

The primary goals behind the workshop were to document the recommendations and distribute them to policy makers and implementers in the software reuse, software development, acquisition and legal communities and to initiate positive changes within these communities. The participants determined the baseline assumptions, which were the foundation of all discussions, analyzed and provided answers to the posed questions, and discussed library liability and agreements to reduce those liabilities. The results, as documented in the proceedings [1], can be used by managers who are responsible for formulating or implementing plans of operations for software reuse libraries, as an overview of some of the problem elements that should be taken into account, and to initiate discussion between them and their legal counsel.

2.1 Library Baseline

Since legal decisions are dependent upon particular circumstances, great care was taken in defining terms and establishing the assumptions of a library model before any particular discussions began. All discussions assumed that the hypothetical library is a Government owned-Government operated or Government owned-contractor operated, domain-specific library. Use of the library is restricted to Government purposes only and the users and suppliers are Government employees, Government contractors or prospective Government contractors. The library could contain Government off the Shelf (GOTS), Commercial off the Shelf (COTS) and public domain components, but no classified components. However, the library does provide effective safeguards to prevent unauthorized access. Furthermore, the library does not negotiate nor determine terms and conditions of use with respect to third party users.

For purposes of the workshop discussions, a component was defined to be any reusable item (e.g., requirements, specifications, designs, object code, source code or system/software documentation) pertaining to computer software or its documentation. Liability was defined to be a ”risk of claims”, since use of it during discussions did not take into consideration the amount of liability nor degree of likelihood of a recovery.

2.2 Liability/Agreements

Liability depends upon the library’s particular activities. As the library engages in more varied activities, the greater the risk of claims for mistakes/errors in its activities and in the reusable software component. As the library becomes more active, its liability increases. Some variables that should be taken into consideration when conducting an analysis of liability are: the nature and frequency of the activity; how the activity is performed; the functional knowledge or scope of knowledge of library personnel, subscribers and suppliers; technical qualifications of library personnel, suppliers, and subscribers; and the purpose or goal of the library, subscriber and supplier organizations.

If all, or most, of these variables are known, then the level of risk can be roughly estimated. The more variables known, the more accurate the estimate. If the level of risk is judged as being too great (unacceptable), then supplier and subscriber agreements can be drafted to include provisions which reduce the level of risk for the library.

Many issues of contention can be avoided through negotiation and careful drafting of supplier and subscriber agreements. Various provisions can be negotiated into the agreement, which will decrease the potential of liability for the library and/or contracting agency.

The terms and conditions of doing business with the library will not be the same for the supplier and subscriber. Clauses should be drafted and negotiated which deal with such subjects as: disclaimers; warranties (full and limited); collection and payment of fees; releases; waivers of liability; indemnity; non-disclosure; standard of care; information provided; or evaluations to be performed. Most problems, potential problems or conditions which may lead to liability can be addressed in the agreement. While even the most carefully drafted and negotiated agreement cannot solve all problems, it can significantly reduce the potential for problems arising.

Most terms and conditions can be negotiated. However, a business plan and detailed concept of library operations is crucial to properly draft and negotiate the necessary supplier and subscriber agreements.

2.3 Findings

The most disconcerting of results, is that, in general, not only are those who are developing and operating Government reuse libraries not aware of these issues, legal counsel who are providing support are not knowledgeable in software reuse issues. The major findings are:

1. Risk depends upon library activities.

2. Risk can be managed by using well-drafted agreements (supplier, subscriber, reuse)

3. Legal decisions depend upon specific circumstances.

4. There is no known regulatory/statutory bar to establishing an effective software reuse program.

5. There is a failure of the concerned parties to come to terms and conditions of licensing adequate for software reuse.

6. Through negotiations, a mechanism can be worked out to achieve the minimum needs of the Government and the commercial ends of the contractor. (i.e., negotiate terms in accordance with limited rights clause).

2.4 Conclusions

The topics discussed during the 22-24 Mar 93 workshop focussed on library-related legal issues, which is only one segment of reuse barriers which need to be addressed in order to successfully implement software reuse. Although this workshop specifically addressed library issues, future forums are planned to address or expand upon: liability/risk issues; library agreements with suppliers and subscribers; and training/education on legal issues effecting software reuse (liability, agreements, negotiations).

CARDS is currently developing sample agreements for libraries that will address interactions between the library and: suppliers, subscribers and interoperability with other libraries. Common terms and conditions that should be included in agreements, will be outlined. In addition, the effect on the agreement by variables, such as ownership, risks, security, component types, and the goals of the various players will be discussed.

3 Comparison

There have been several studies in the past which have investigated legal issues pertaining to copyrights, policies and regulations, and liability as it relates to warranty (or lack of it). However, what is new from this workshop is the focus on providing guidance to Government managers in establishing and operating reuse libraries. Since reuse libraries have not existed very long, many library managers are finding it difficult to develop agreements and determine the best legal approach to operations and interactions with others. The proceedings of this workshop will help meet that need. In general, Government lawyers are not knowledgeable about software reuse and in turn are not able to provide the necessary support to Government managers. This workshop addressed this issue by getting Government lawyers together to take an interest in reuse and to provide them with background information on reuse.

The Strategic Defense Initiative Organization (SDIO) sponsored conference on legal issues in software reuse [2], held in Colorado in 1990, addressed legal issues that could arise in establishing reuse libraries. However, some questions were left unanswered. A member of that workshop brought the unanswered questions to the CARDS workshop, where most of them were answered. The discussion of library legal issues tended to focus on the industry perspective rather than that of the Government, while the CARDS workshop focussed on the Government viewpoint.

Last year, CARDS developed two guidebooks, the Direction Level Handbook [3] and the Acquisition Handbook [4], which provided guidance to acquisition executives and Program Managers, respectively, in incorporating software reuse into the acquisition cycle. They cover planning the acquisition strategy through awarding the contract to managing the effort and follow-on support.

Legal issues, such as software rights, liabilities, recoupment, license agreements, royalties, incentives, warranties, are discussed only as they pertain to acquisition planning for a particular system. Additional contractual guidance was provided to assess risk, choose contract types, develop Requests for Proposal (RFPs), Contract Data Requirements List (CDRLs), and evaluate criteria for reuse. Neither document addressed reuse library issues.

The Software Technology for Adaptable, Reliable Systems (STARS) program sponsored a study [5] to examine the Federal Acquisition Regulation (FAR) and all its supplements, as well as budget/finance regulation impediments, in the way data rights and software is contracted and for any cost restrictions and financial disincentives. This report documents the FAR environment with respect to software development, software reusability and the use of commercially available software and proposes changes to the FAR and DoD Federal Acquisition Regulation Supplement (DFARS) to promote reuse of software products. Liability is discussed only with respect to warranty (or lack of) of the software. Unnecessary cost restrictions and disincentives to providing financial resources for software reuse and for reusing commercially available software are also documented. However, the study does not focus on libraries nor other aspects of liability.

The DoD Center for Software Reuse Operations’ report on legal and acquisition issues primarily discusses acquisition and contractual topics and recommends changes to the FAR and DFARS [6]. It does have some discussion of agreements and some examples. However, discussion focusses on ownership, incentives and liability as it relates to warranty and third party users.

References

[1] “Proceedings: Software reuse legal issues workshop (22-24 mar 93),” in Central Archive for Reusable Defense Software (CARDS), Apr. 1993.

[2] “Proceedings of the workshop on legal issues in software reuse,” in Strategic Defense Initiative Organization, Colorado Springs, CO., July 1990.

[3] “Cards acquisition handbook, final, stars-ac-04105/001/00,” tech. rep., Oct. 1992.

[4] “Cards direction level handbook, final, stars-ac-04104/001/00,” tech. rep., Nov. 1992.

[5] “Current far and budget/finance environments, stars-sc-03501/001/00, stars-sc-03504/001/00,” tech. rep., Mar. 1991.

[6] “Legal/acquisition issues: A technical report, 1222-04-210/49.1,” tech. rep., DoD Center for Software Reuse Operations, Feb. 1993.

4 Biography

Theresa R. Huber is employed by DSD Laboratories, Inc., assigned to the USAF Central Archive for Reusable Defense Software (CARDS) Program. She is researching alternative business solutions to barriers that are restricting the implementation of software reuse with DoD. Ms. Huber has also developed software reuse strategies, methods and guidance for systems acquisition personnel at various levels in the DoD. Ms. Huber has in-depth knowledge and experience in Government technology transition processes, DoD contracting and acquisition, and technical planning from both strategic and tactical points of view. She earned a Bachelor of Science in Mathematics and a Master of Business Administration from the University of Lowell, Lowell, MA.