Debugging software failures takes a considerable amount of time – 620 hours of development per year – at a cost of around $ 61 billion, according to a recent report released by Undo in conjunction with an MBA firm from Cambridge Judge Business School.

The correction of software errors must be handled correctly not only from a technical point of view, but also from a legal point of view, in order to avoid a violation of the contractual and / or legal provisions of the European Union.

The long-awaited decision of the Court of Justice of the European Union (“CJEU”) in the Top System SA v Belgian State case (case C-13/20) rendered on October 6, 2021 provides us with useful clarifications on the rights and obligations of the licensor and the licensee of the software or, more generally, the owner of the right and the purchaser. In other words, who is licensed to kill (software) bugs?

As the Advocate General pointed out in his previous opinion, “whether and, potentially, to what extent the user of a computer program has the right to translate the object code of that program into source code (this process is known as “decompilation”) in order to learning its content is precisely at the heart of this matter”. For an in-depth analysis of Advocate General Szpunar’s opinion in this case, please see our previous article here.

Context of the case

Top System, a Belgian computer program development company, is the author of a number of applications developed at the request of Selor, the entity responsible for selecting public authority personnel in Belgium. These applications include on the one hand “tailor-made” components specifically intended to meet Selor’s needs and requirements and, on the other hand, components from a program developed by Top System, called Top System Framework (“TSF” ). Top System has licensed Selor to use these applications.

Following some persistent software malfunctions that Top System was unable to repair, Selor decompiled part of the TSF licensed software in order to deactivate the faulty function, as the licensee admitted before the Brussels Court of Appeal. In the appeal proceedings, Top System argued that outside the contractual framework, the decompilation of a computer program is only permitted for the purposes of interoperability of independent software and not of correcting errors under Article 6 of the Directive on the legal protection of computer programs. (Council Directive 91/250 / EEC, “the Directive”).

The Court of Appeal suspended the proceedings and put two questions to the CJEU (case C-13/20) relating to the interpretation of the directive.

First question referred to the CJEU: the right to decompile a computer program

First, the referring court asked the CJEU whether and to what extent the legitimate purchaser of a computer program has the right to decompile the program when such decompilation is necessary to allow the correction of errors affecting the program operation. In this case, the correction consisted in deactivating a function which affects the proper functioning of the application of which the program is a part.

Article 4 of the Directive lists the exclusive rights of the author, including the reproduction, translation, adaptation, arrangement and any other modification of a computer program,

Decompilation as such is not expressly included in the activities mentioned in article 4 of the Directive. However, the Court of Justice noted that the decompilation “constitutes an operation of transformation of the form of the code of a program involving a reproduction, at least partial and temporary, of this code, as well as a translation of the form thereof” and therefore, “the decompilation of a computer program involves the performance of acts, namely the reproduction of the code of this program and the translation of the form of this code, which in reality fall under the exclusive rights of the author, such as defined in Article 4 (a) and (b) of Directive 91/250”.

Articles 5 and 6 of the Directive provide for certain exceptions to the monopoly of the right holder. Namely, Article 5 of the Directive provides that in the absence of specific contractual provisions, the acts referred to in Article 4 (a) and (b) (i.e. reproduction and modification of a computer program) do not require the authorization of the right holder. when they are necessary for the use of the computer program by the legitimate purchaser in accordance with its intended purpose, including for error correction purposes.

As regards the scope of Article 5, the Court of Justice has stated that “It therefore follows from the foregoing considerations that Article 5 (1) of Directive 91/250 must be interpreted as meaning that the legitimate purchaser of a program has the right to decompile that program in order to correct errors affecting its operation”. In addition, the Court stated that “this interpretation is not called into question by Article 6 of Directive 91/250 which, contrary to what Top System maintains, cannot be interpreted as meaning that the possibility of decompiling a computer program is not authorized only insofar as it is carried out for interoperability purposes”.

Article 6 of the Directive, entitled ‘Decompilation’, provides that the reproduction of the code and the translation of its form, necessary for the decompilation, may not be carried out without the authorization of the right holder only to ensure the interoperability of programs and only under certain conditions. conditions.

In paragraph 49 of the decision, the Court concluded that “while Article 6 of Directive 91/250 concerns the acts necessary to ensure the interoperability of programs created independently, its Article 5 (1) aims to allow the legitimate purchaser of a program to use it directly. ‘in a manner compatible with its destination. These two provisions therefore have different purposes.”.

In view of the above, in response to the first question put to the CJEU, the Court ruled that “Article 5 (1) of Directive 91/250 must be interpreted as meaning that the legitimate purchaser of a computer has the right to decompile it in whole or in part in order to correct errors affecting the functioning of that computer. program, including when the correction consists of deactivating a function affecting the proper functioning of the application forming part of said program”.

Second question referred to the CJEU: conditions required for decompilation activities

If the CJEU answered the first question in the affirmative, the referring court asked whether the conditions referred to in Article 6, relating to decompilation, or any other condition, should also be fulfilled.

Considering that Articles 5 and 6 of the Directive have different purposes, as mentioned above, the CJEU asserted that “the requirements set out in this Article 6 are not, as such, applicable with the exception provided for in Article 5 (1) of that Directive”.

However, according to the wording, structure and purpose of Article 5 (1) of the Directive, acts constituting decompilation are subject to certain requirements, namely that these acts must be necessary allow the legitimate purchaser to use the program concerned in a manner consistent with its intended purpose goal and, in particular, to correct “errors”.

In this regard, the Court noted that in most cases, correcting errors will require modification of the program code and, therefore, will require access to the original source code (or decompiled source code). The CJEU also clarified that “in the event that the source code is already legally or contractually accessible to the purchaser of the program concerned, it cannot be considered that it is “necessary” for the latter to decompile this program”.

In addition, the Court underlined that Article 5 (1) of the Directive allows the correction of errors subject to “specific contractual provisions”.

The Court’s considerations which follow are particularly relevant for the drafting of software license agreements under the European Directive (and the law of European Member States implementing that Directive) which deal with the conditions of the decompilation activities of the European Union. legitimate user.

First, the CJEU noted that, according to recital 18 of the directive, it is not possible to contractually prohibit both the loading and unwinding operations necessary for the use of a copy of a program legally acquired and the correction of errors affecting its operation. Thus, the Court stated that under Article 5 (1) of the Directive, interpreted in the light of recital 18, “the parties cannot contractually exclude any possibility of correcting these errors”.

However, the right holder and the acquirer remain free to contractually set up the modalities for exercising the right of decompilation, for example, as recalled in the decision, the parties may agree that the right holder must ensure the corrective maintenance of the program concerned.

On the other hand, in the absence of specific contractual provisions, the legitimate purchaser of a computer program is entitled to perform, without the prior consent of the right holder, the acts listed in Article 4 (a). and (b) of Directive 91/250 (i.e. reproduction and modification of a computer program), including decompilation of the program, insofar as this is necessary to correct errors affecting the operation of the program.

Similar to what Article 6 requires with regard to decompilation for interoperability purposes, the Court was very clear in stating that “the legitimate purchaser of a computer program having decompiled this program with the aim of correcting errors affecting the operation of the latter cannot use the result of this decompilation for purposes other than the correction of these errors”.

In view of the above, the CJEU concluded on the second question asked by the Brussels Court of Appeal that “Article 5 (1) of Directive 91/250 must be interpreted as meaning that the legitimate purchaser of a computer program wishing to decompile that program with a view to correcting errors affecting its operation is not required to meet the requirements set out in article 6 of this directive. However, the purchaser has the right to proceed with this decompilation only to the extent necessary for the correction and in compliance, if necessary, with the conditions provided for by contract with the holder of the copyright on said program.”.

Conclusion and takeaways

The rights holder / licensor and the legitimate / licensed user are invited by the Court of Justice to contractually address the error correction procedure in order to limit disputes regarding the decompilation of the licensed software.

As the CJEU ruling underlined, the parties cannot contractually exclude any possibility of error correction, but they can agree on the steps and procedures that best suit them with regard to handling the correction of errors. and associated decompilation activities.

In any event, it is clear from decision C-13/20 that users / licensees cannot use the decompiled software for error correction purposes for any other reason.

For the sake of completeness, it should be noted that this decision is based on the provisions of Directive 91/250, which was repealed by Directive 2009/24 / EC of the European Parliament and of the Council of 23 April 2009 on the protection of computer programs. The same considerations apply in the context of the 2009 directive where Articles 4, 5 and 6 contain the same provisions.

* The English translation of all direct quotes in this article is provided by the author and should not be construed as an official or authoritative translation.


Source link

Previous

DSME's on-ship cybersecurity system obtains ABS approval

Next

The next big game changer

Leave a Reply

Your email address will not be published. Required fields are marked *

Check Also