BSA Audit question 1

[lb63640]

I have a client operating under a lease agreement from a former business partner who retired; the physical office space, customer accounts and data, computers and software are all included in the monthly lease.

The client doesn't own the equipment; can they still be held liable if it turns out that some of the software on the leased machines isn't properly licensed and it wasn't their IT folks who did the actual installation?

I would say if an audit revealed blemishes on the licensing, it would be the company from whom my client is leasing who would be liable for fines, etc.

Do you agree or have experience to indicate otherwise?

I haven't begun software auditing yet, but will do so in the next week. They are concerned that their MS Office installations may all have the same registration code and need to know who is responsible to take care of the problem if BSA ever came knocking on their door.

 

[Opieo]

While IANAL, I would say that it would not be your company's fault.
Logic and common sense would dictate that if you had nothing to do with it, it would not be your fault.
Unfortunately more and more these days, common sense, when it comes to laws, seems to be disappearing. Companies are more likely to sue whoever they can either A) Reach the easiest, or B) Whoever has the most money (in most cases these are the same). Whoever is actually responsible is not entering into the picture as much.

I would say though that your team is not liable. You would have to consult legal counsel to be sure though.

~
“Your request is not unlike your lower intestine: stinky, and loaded with danger.” — Ace Ventura.

 

[gbaughma]

While IANALE (I am not a lawyer either... lol) I would be sure to CYOA (Cover your own assets). If you find that you are out of compliance with licensure on leased or rented equipment, I would DOCUMENT that you have brought the licenses in question to the owner of the equipment, so it doesn't come back on you as "aware of the situation, but didn't do anything about it" scenario.



Just my 2¢

"What the captain doesn't realize is that we've secretly replaced his Dilithium Crystals with new Folger's Crystals."

--Greg

http://parallel.tzo.com

 

[kmcferrin]

I am not a lawyer, but I have gone through a software audit before. The following is based on my experience:

BSA won't care if they're using the same license keys, as long as you have enough licenses of the correct type. In fact, when you do volume licenses you buy a bunch of licenses at once but only get one key. The next time you buy another batch of licenses you'll get another key, but you can continue to use the old one.

The only thing that they'll check for in a licensing audit is how many of each type of license you have, and compare that to how many of each type of license you own. Keep in mind though that when I say "type" of license I don't just mean "product". For MS Office there are multiple SKUs (Standard, Professional, Enterprise, etc) and multiple ways to obtain (OEM, Volume License, Retail, etc) and they do track those separately. I bring this up because you might have 100 volume licenses of Office Pro, and 100 retail installations of Office Pro, and you would be out of compliance. The same goes if you're licensed for Office Standard and have Office Pro. On top of that, there are also evaluation versions of software that you can get dinged for. I had that happen once too.

Keep in mind that when you true up, you're not allowed to uninstall/reinstall to make you right, you have to buy whatever it takes to cover the gap.

This is one place where volume licensing really helps. You can track all of your volume license purchases through the MS eOpen site and have an easy way to find out what licenses you own. Unfortunately most people don't know about volume licenses, so they start buying some retail licenses, then some OEM stuff, and when it comes audit time they have no way to easily prove what they own licenses for. I've spent a lot of time tracking down purchase orders that were from three years prior because the previous staff didn't buy volume licenses.

The following is my personal opinion, and may be completely wrong (though I think that it makes sense):

All that said, I think that you are mistaken about your licensing. If you lease PCs from Dell then you're responsible for the software installed on it (regardless of what came preinstalled) because you are using the software in your business and Dell has no way to know how you are using the machines (nor do they care, so long as they get their money). If you look at your client's situation from that perspective, the former owner is "Dell" and your client is the company using the machines. It seems pretty straightforward in that case. But on top of that, there may be some language in the licensing agreements that prevents the rental/leasing of the application software (or at least put limits on how it can be done and by whom). The former owner of the business may already be in violation of the licensing agreement in that case.

Unfortunately, there's no way to know for sure until you go through an audit. That's the problem with BSA/MS audits. There's so much grey area in software licensing that no matter how strictly you manage it, you're always going to have a gap between what you have licenses for and what you have installed (unless you use all open source or something like that). Your only hope is to minimize the gap as much as possible.

On the bright side, the "software police" aren't normally interested in going to court to try to get damages plus fines. They know that practically every company in existence is out of compliance, so if they get you to buy enough licenses to true up they're usually happy.

________________________________________
CompTIA A+, Network+, Server+, Security+
MCTS:Windows 7
MCTS:Hyper-V
MCTS:System Center Virtual Machine Manager
MCSE:Security 2003
MCITP:Enterprise Administrator

 

[monkeylizard]

kmcferrin hits it pretty close. It all depends on the language of the lease. If the lease includes a Schedule of Equipment that specifically references the software as well as the hardware, the quantity of each, and the business isn't using any more than what's covered under the lease, then the licensing requirement falls on the lessor.

This would be an unusual equipment lease, and I'm not entirely sure it could be done at all. It's far more likely that the lease includes the hardware, and the hardware comes with an OS license sticker. Any other software would be the responsibility of the business leasing the equipment.

Monkeylizard
Sometimes just a few hours of trial and error debugging can save minutes of reading manuals.