First, here’s what Autodesk’s Scott Sheppard had to say about Project Photofly (now 123D Catch Beta) security last month: Project Photofly FAQ: What about the security of my data? This covers some of the same kind of stuff I’ve already discussed, but from an Autodesk point of view (albeit a pretty transparent and honest one, as you might expect from Scott). Here are some selected quotes:

In essence, we don’t want to accept liability when we don’t take money…

We intend to have a reasonably secure service, better than email, but less secure than a bank account.

We store your files on Amazon’s S3 service, and they maintain their own physical and data security policy that is considered robust.

Next, here are the 123D Terms of service, which raise many of the same alarm bells I mentioned before. Selected quotes:

We reserve the right to change all or any part of these Terms, or to change the Site, including by eliminating or discontinuing the Site (or any feature thereof) or any product, service, Content or other materials, and to charge and/or change any fees, prices, costs or charges on or for using the Site (or any feature thereof).

By uploading, posting, publishing, transmitting, displaying, distributing or otherwise making available Shared Content to us and/or any Users of or through the Site you automatically grant to us and our sub-licensees…the worldwide, perpetual, royalty-free, fully paid-up, irrevocable, non-exclusive, sublicensable (through multiple tiers) right and license to have access to, store, display, reproduce, use, disclose, transmit, view, reproduce, modify, adapt, translate, publish, broadcast, perform and display (whether publicly or otherwise), distribute, re-distribute and exploit your Shared Content (in whole or in part) for any reason and/or purpose (whether commercial or non-commercial) by any and all means in any and all media, forms, formats, platforms and technologies now known or hereafter devised, invented, developed or improved.

Please note that with respect to Non-public Content, we will not authorize your Non-public Content to be made available to others on a public section of the Site, although we cannot guarantee complete security (e.g., of cloud servers).

Moving on to another Cloud security-related issue, something that Owen Wengerd raised on Twitter was the idea that:

…once data is on the cloud, it can never be deleted.

Deelip Menezes thought this whole idea somewhat loopy:

Actually I’m implying that it is ridiculous to even start thinking along those lines.

However, I see Owen’s point. Once your data is on someone else’s server, you have no control over it. You have no idea where it lives, how often it is backed up, what happens to those backups, and so on. Let’s say you place some highly sensitive design data on the Cloud. It might be commercially sensitive, or about something that represents a possible terrorist target, or just something you don’t want certain parties to know about, ever. A week later, you delete the design data. Now, is it really gone? Any responsible Cloud infrastructure vendor must regularly take multiple backups and store them securely. So you now have multiple copies of your “deleted” data floating around, who knows where? What happens to old servers when they die? Where do backup hard drives, tapes, etc. go? If backups are stored off-site, how are your files going to be permanently removed from the media?

While there may be policies, procedures and ISO standards in place, we’re dealing with humans here. If one backup copy of your data ended up in a country where a rogue employee decided to better feed his family by selling off old hard drives, your nuclear power plant plans could end up not safely deleted at all, but instead delivered into the hands of some people you’d really prefer not to have it.

This may sound like paranoid nonsense, but risk from non-deleted data is real. There was a local case where a company was illegally siphoned of funds and went bust. The company’s old internal email servers were supposedly wiped and sold off. Somebody bought them, undeleted the data and was able to pass on incriminating emails to the police. While that ended up being a good thing in terms of natural justice and it’s not even a Cloud issue, it illustrates that making sure your stuff is properly deleted can be very important. This is related to something that Ralph Grabowski mentioned on Twitter; the “right to be forgotten”. Here is a Google search that includes various links that touch on some of the struggles related to this issue.

Finally, here’s something related to the possibility of the data being accessed illegally while it’s up. You put it up there, somebody copies it, you delete it, it’s not really gone and you are none the wiser. Is that something that only tin foil hat wearers need worry about? Have a read of this article before answering that one: Cloud Services Credentials Easily Stolen Via Google Code Search. Selected quotes:

The access codes and secret keys of thousands of public cloud services users can be easily found with a simple Google code search, a team of security researchers says.

Now the team is offering one word of advice to companies that are considering storing critical information on the public cloud: Don’t.

…an attacker who knows Google and some simple facts about cloud services authentication can easily find the access codes, passwords, and secret keys needed to unlock data stored in public cloud services environments such as Amazon’s EC3.

We found literally thousands of keys stored this way, any one of which could be used to take control of computers in the cloud, shut them down, or used to launch attacks on other computers on the same service.

Here’s a PDF of the presentation, if you’re interested.

The terms applicable to a particular service may vary.

Translation: Autodesk can move the goalposts.

Autodesk has the right (but not the obligation) to monitor Your usage of the Service to verify compliance with these Terms.

Translation: Autodesk can keep its eye on you.

You acknowledge and agree that: (a) You will evaluate and bear all risks associated with Your Content; (b) under no circumstances will Autodesk Parties be liable in any way for Your Content, including, but not limited to, any loss or damage, any errors or omissions, or any unauthorized access or use; and (c) You (and not Autodesk) are responsible for backing up and protecting the security and confidentiality of Your Content.

Translation: whatever happens, it’s your problem, not Autodesk’s.

Third Party Content and services may be made available to You, directly or indirectly, through the Service (including Content shared by other users of the Service, through Forums or by any other means). In some cases, such Content and services may appear to be a feature or function within, or extension of, the Services or the Autodesk Software. Accessing such Content or services may cause Your Computer, without additional notice, to communicate with a third-party website … for example, for purposes of providing You with additional information, features and functionality.

Translation: Autodesk and others can use the service to advertise to you.

Autodesk reserves the right to delete inactive accounts or purge related Content (and all backups thereof), without further notice and Autodesk Parties shall have no responsibility or liability for deletion or any failure to store Your Content.

Translation: don’t just leave your stuff up in the clouds and expect it to still be there a few years later.

You acknowledge that Autodesk may use third-party service providers in connection with the Services, including without limitation the use of cloud computing service providers which may transmit, maintain and store Your data using third-party computers and equipment in locations around the globe.

Translation: it’s not just Autodesk here, there is a chain of responsibilities and vulnerabilities.

THE SERVICE OFFERING IS PROVIDED “AS IS” AND “AS AVAILABLE.” AUTODESK PARTIES MAKE NO, AND HEREBY DISCLAIM ALL, REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF ANY KIND…

YOUR USE OF THE SERVICE OFFERING IS AT YOUR OWN DISCRETION AND RISK.

AUTODESK PARTIES DO NOT WARRANT THAT THE SERVICE OFFERING WILL PERFORM IN ANY PARTICULAR MANNER AND HEREBY DISCLAIM LIABILITY FOR NEGLIGENCE AND GROSS NEGLIGENCE.

Translation: Autodesk lawyers LOVE SHOUTING. Whatever happens, including gross negligence on Autodesk’s part, it’s still all your fault and you’re severely out of luck.

…for all Service Offerings accessed as part of Subscription, these Terms and Your access to the Services will terminate when Your Subscription (and the Subscription Program Terms applicable to Your Subscription) terminates or expires.

Translation: here’s a further disincentive to ever dropping out of Subscription once you’re on it.

It is Your responsibility to retain copies of Your Content. Upon termination Autodesk shall have the right to immediately delete, without notice, Your Content, if any, and all backups thereof, and Autodesk Parties shall not be liable for any loss or damage which may be incurred by You or any third parties as a result of such deletion.

Translation: don’t rely on the Cloud alone.

Autodesk reserves the right, from time to time in its sole discretion, to (a) modify or release subsequent versions of the Service, (b) impose license keys or other means of controlling access to the Service, (c) limit or suspend Your access to the Service, and (d) change, suspend or discontinue the Service at any time.

Translation: Autodesk can do pretty much whatever it likes, including killing the whole thing.

I don’t think any of this means Autodesk is evil. Looked at from the point of view of a corporation that needs to cover its backside and reduce risks to itself, it’s quite understandable. Much of it is just very sensible advice. You can expect similar conditions from other companies providing Cloud services. But what if you’re not happy with using a Cloud service that has such conditions attached? Well, you can use it anyway and keep your fingers crossed, or you stay away from it altogether.

How do you see this? Assuming you were happy with everything else about the Cloud, would clauses like those above be a dealbreaker?

Edit: this post is also being discussed on the Dezignstuff blog.

Note: the above clauses are Autodesk copyright, reproduced here under fair use (comment and criticism).

Wrong. Although I think the latest court to look at this has picked the right side, it has done so for entirely the wrong reasons. (Again, morally wrong, not legally. I have no qualifications on legal matters, but I can spot an injustice a mile off). In a diabolical, dangerous, far-reaching decision, it has concluded that the doctrine of First Sale does not exist at all for products where the copyright owner merely claims not to sell its products, but rather to license them.

So all those programs, games, maybe even CDs, DVDs, books etc. you have at home and thought you owned? How about that laptop with its pre-installed Windows? Or that iThing with its iOs? If you’re in the jurisdiction covered by this ruling, you quite possibly now don’t own them at all. Check out the fine print on each of those items; if it includes the magic word “license”, then you may not legally own it, or be allowed to sell it if you no longer need it. If you’re not outraged by this attack on your private property rights, you should be.

What’s more, the Court ruling explicitly rewards companies for making the “license” terms as ridiculously restrictive as they can:

We hold today that a software user is a licensee rather than an owner of a copy where the copyright owner (1) specifies that the user is granted a license; (2) significantly restricts the user’s ability to transfer the software; and (3) imposes notable use restrictions.

One of the Autodesk EULA’s more unconscionable and unenforceable restrictions, that of only being able to use the software within a certain geographical region, wasn’t used to point out the unreasonableness of Autodesk’s claimed power over its customers. Instead, it was actually used by the court to help justify its decision!

Amazingly, this ludicrous outcome wasn’t decided in ignorance. The court carefully considered the effects this decision would likely have, but apparently for reasons of legal nicety, decided to go ahead anyway. Common sense and justice be damned, a convoluted and narrow interpretation of partially-relevant previous decisions just had to rule the day.

We can only hope that this case is reviewed and overthrown (again). While such a revised outcome might be unfortunate in terms of failing to right a wrong (Vernor’s sale of already-upgraded software), that would be much preferable to the terrible damage that the 9th Circuit’s decision has inflicted on the people it is supposed to serve. I’m only glad I’m not one of those people.

Other commentary:

EFF: “Magic Words” Trump User Rights: Ninth Circuit Ruling in Vernor v. Autodesk

Wired: Guess What, You Don’t Own That Software You Bought

Techdirt: Appeals Court Destroys First Sale; You Don’t Own Your Software Anymore

ars technica: No, you don’t own it: Court upholds EULAs, threatens digital resale

Lawgarithms: In Autodesk case, 9th Circuit missed better reason to bar resales

Public Citizen: Ninth Circuit says consumers may not own their software

1. Post a comment in direct response to the allegedly objectionable post.
2. Contact me by email to point out any inaccuracies or any other perceived unfairness in my post. If I consider the objections valid, I will amend the post and/or apologise as appropriate. If I disagree, I will explain my position. Such correspondence will remain private if requested.
3. Contact me by email, requesting equal-exposure right of reply. If I consider such a request reasonable under the circumstances, even if I disagree with the objection, then I will either append the reply to the post in question, or create a new post containing the requested reply, verbatim and in full.
4. Those with their own blogs, sites, newsletters or other media can of course use those to reply. Those without such facilities can raise objections using media controlled by others, such as discussion groups and other online forums.

None of the above options apply to obvious trolls and other spammers; they have no rights at all here.

I guess it’s also possible to threaten legal action, without first trying any of the above. That hasn’t happened to me yet, but if it does, it promises to be quite entertaining. I take an extremely dim view of those who use legal threats to suppress free speech and other legitimate activity. The gloves will be off. Any such threats will be deemed “correspondence for publication”, to be reproduced in full, with commentary (probably laced with heavy sarcasm).

• I’ve been to AU sessions dating back to 1995 that pretty much give away the contents of the next release of AutoCAD, using a vague cover-my-butt session title and a disclaimer at the start of the session. I understand that these days, attendees need to sign an NDA before entering such sessions.
• Last year in San Francisco, an international blogger audience was given all sorts of information about Autodesk’s future directions (preceded by a similar disclaimer), with no NDA and nothing off the record. I assume something similar happened at this year’s North American bloggers’ event.
• The Subscription (Advantage) Packs of the last couple of years have been a dead giveaway about some of the features that are going to make their way into the next release.
• The new 50%-cost upgrade policy was announced a year in advance.
• Surveys and other customer feedback mechanisms provide a very big clue about what Autodesk is looking at changing next. Some of these are covered by NDA, others are not.
• In the specific case that triggered this discussion, Autodesk has been gradually building up expectation of a Mac AutoCAD for quite a while. Yes, it required a little reading Between the Lines, but for some time it has been pretty obvious where all the Mac love was leading to.

Feel free to add your own examples, but it seems to me that Autodesk is perfectly happy to reveal future plans as and when it sees fit. And that’s fine. In each of the above cases, the revelations have been A Good Thing. Good for Autodesk, good for customers.

Maybe the question should be, “Why doesn’t Autodesk discuss future plans much more often?” Stock market regulations, perhaps? But hang on, there are some very major publicly traded corporations that seem to get away with revealing all sorts of things about their future products. For example, Microsoft regularly conducts very widespread public Beta programs that let people know in great detail what’s very likely to appear in the next release, and seems to have survived the experience so far. There’s surely no reason why Autodesk couldn’t do the same if it wanted to.

Ultimately, it comes down to a desire for secrecy; a culture of concealment and control. Of course Autodesk may have legitimate reasons for keeping some of its plans from its competitors, but the culture can be so pervasive as to cause some bizarre side effects. You may find this difficult to comprehend, but there are those in Autodesk who got into a tizzy about me speculating in my launch announcement that Autodesk’s general design product (AutoCAD 2010) was going to be followed by something called AutoCAD 2011. There was something of a surreal drama behind the scenes. There were apparently people within Autodesk who genuinely thought I needed privileged information to work out that 10+1=11. No, I’m not making this up.

I’m not sure Autodesk’s secrecy is doing any good for anyone. It’s surely harder to maintain these days and it’s only going to get harder. I suspect several Autodesk blood vessels were burst when AutoCAD Mac Beta 1 was leaked. On the one hand, I can understand that; somebody broke an NDA, a legitimate agreement was freely entered into and then broken. Some people at Autodesk probably had their carefully planned marketing timelines disrupted.

On the other hand, this provided a whole heap of free and largely positive publicity. Potential AutoCAD for Mac users are now hovering in anticipation, filling the Mac forums, spreading the good news among themselves, putting off the purchase of competitive products, considering entering the official Beta program, and so on. At the same time, the news of performance issues in the early Beta is helping to put a dampener on expectations in that area. Lowered customer expectations may turn out to be very useful when the product is actually released. All considered, a good thing for Autodesk, then.

I’m convinced that Autodesk is opening up. That’s great, but there’s a way to go yet.

Vernor won (for now, and in one jurisdiction) because the court found he was not a party to the EULA. He didn’t read it, he didn’t click on anything to indicate his agreement to it, nothing. He just bought a bunch of books and discs and wanted to sell them on eBay. The fact that the item being sold is a remnant from software that had already been upgraded was not considered relevant. Neither was the fact that Autodesk is not obliged to provide the buyer of the discs with the codes they will need to make the software work.  The upshot is that this decision will allow a small number of people to buy and sell useless discs. What about the buyers of those discs who may not know they are useless until too late? Caveat emptor, I guess. Some other court can sort out that mess.

I agree with Ralph Grabowski that “software should be no different than any other consumer good: buy it, use it, resell it, or toss it”. I’d love to see Autodesk and other vendors forced to support a legitimate used software resale market (as they once did in pre-eBay days), but this decision won’t make that happen. It won’t help customers at all. If your firm has shrunk a bit and you have some spare licenses, you still can’t sell them because you are a party to the EULA (probably, although this area is still a bit fuzzy). But take heart! If you go bust, your creditors may be able to slip any discs left over from your upgrade history into a garage sale and hope that Mr. Vernor drops by. Mr. Vernor will be allowed to sell them, and the new buyers will be allowed to put them on their shelves and look at them.

Is that really a win for customers? I don’t think so.

This clause extends as far as making an arrangement with your creditors, which is a common enough phrase but can mean several things and isn’t defined within the agreement. So, if your cash flow is a bit tight and you have to ask your phone company for another month to pay your bill, you’ll be sure to stop using all your Autodesk software, won’t you? Never use it again, because otherwise you’ll be a thief.

OK, maybe that’s a bit extreme, but I’m sure it could be interpreted that way by an aggressive and/or inventive lawyer, and Autodesk doesn’t appear to be short of those. Who knows? Why would Autodesk put that kind of thing in its EULAs if there is no intention of ever using it?

That’s an interesting aside, but it’s not my main point. Autodesk EULAs have traditionally contained unreasonable, unconscionable and arguably unenforceable clauses, so there’s nothing particularly remarkable there. My main point relates to reading EULAs in general, not just Autodesk’s. As a general rule, should you do it?

Looking at the polls I’ve done on this subject, lots of you don’t read them. In fact, over two thirds of poll respondents either never read them, or rarely do so. It would be interesting to find the reasons behind that. Do you not have the time? Is it pointless because it’s all legal gobbledygook? Do you trust the software maker to be reasonable? Do you consider click-throughs to be unenforceable? Or are there other reasons? Please let me know. I may do another poll once I have a reasonable set of choices to offer up.

There’s an argument that can be made that you are actually better off not reading these “agreements”. According to this argument, if you don’t read it, how can you have agreed to it? There’s no meeting of the minds. Better still; get somebody outside your company to do the installation for you. That person has no authority to bind your company to anything, so no agreement exists.

Or does it? Is this a valid argument? Until there’s either well-established case law or unambiguous legislation, it’s anybody’s guess. Even when the answer is known, it’s highly likely that the answer will vary depending on your location. Even if the agreement states that it is based on California law, what if the local law establishes that no obligation exists that binds you to that agreement?

What’s the best thing to do? I honestly don’t know. You could do an R. Paul Waddington and make a public repudiation of any obligation to abide by Autodesk’s EULAs, and continue to use the software. You could do what I suspect a large number of people do, which is the same kind of repudiation, but a silent one. You could attempt to negotiate a modified EULA with the software vendor, but I don’t fancy your chances. You could stop using software with unreasonable EULAs, but what kind of choice is that? It may not be possible at all for your business. Finally, you could just put up and shut up, either agreeing unreservedly to accept whatever is in the EULA, or crossing your fingers in the hope that the software vendor will do the right thing.

What choice have you made, and why?

You would think that Autodesk would be rubbing its corporate hands together at the prospect of the ODA being distracted like this. Or maybe not, if the bunfight throws up more little gems like this:

Autodesk had at least once gone to the ODA website, agreed to the click-through membership agreement, received their access password via email, downloaded each and every library on the ODA’s website, then denied they did it. (The ensuing conversation about this, between the ODA and Autodesk, was pretty interesting, to say the least.)

If that’s true (and I would welcome evidence from either party) it certainly puts an interesting slant on what Autodesk thinks about the enforceability of click-through agreements.

On a related subject, see the polls on the right. There has been one running for a while about whether you even read such “agreements”, and I’ve added two more. They ask if you feel morally and legally bound by the terms that lie under that “let me get on with the installation” button.

I have been following this fight with interest, but only in a half-baked way, third-hand via commentators (like myself, now). Based on my skimming of that commentary, my natural inclination to support the underdog, and my general dislike of of Autodesk’s previous and current legal adventures, I had been of the firm but privately held opinion that Vernor was right and Autodesk was wrong.

Today, after noting that new filings had been made, I had a proper look at some (not all) of the actual court documents themselves (thanks to Owen Wengerd’s CAD/Court), and surprised myself by coming to quite the opposite conclusion. I am now convinced that I was totally wrong.*

Until today, I was hoping that the court would support Vernor’s assertion that the First Sale doctrine applies in this case. Why? Because I feel that Autodesk is morally wrong in attempting to prevent the transfer of its software from one party to another.** At one time, Autodesk allowed AutoCAD to be resold (despite the EULA of the time saying that it wasn’t allowed) and indeed actively supported the transfer process. I felt at the time that Autodesk’s introduction of this restriction of a customer’s ability to resell AutoCAD was morally wrong. I still feel that way.

I also feel Autodesk is morally wrong in geographically restricting the sale of its software, and in several other areas of its EULA. I would be quite happy to have a court find that Autodesk is legally wrong in those areas, too. Despite that, I feel that it would be A Bad Thing if Vernor won in this case.

Why? Because Vernor was selling software that effectively didn’t exist. He was selling used copies of Release 14, when those copies had already been upgraded to AutoCAD 2000. To me, that’s clearly morally wrong.*** If the court finds that First Sale applies here, then that opens the floodgates to allow anyone to sell old copies of any software that has been upgraded, and keep using the new stuff. I really don’t think that would be good for anyone.

Those of you who have been upgrading AutoCAD for the last 25 years, I hope you held on to all your old copies, because you could be sitting on a gold mine. Of course, unless the court is going to compel Autodesk to acknowledge all these new “owners” of AutoCAD and support them with the various magic numbers required to keep them alive, there are going to be a lot of disappointed buyers around, the word will get around, and the bottom will quickly drop out of the market.

* This is not a first, I assure you.

** It has been stated elsewhere that Autodesk can actually be persuaded to allow the transfer of its software outside the usual restricted areas of merged companies, deceased estates and so on. This may be so, but it’s not something I would rely on.

*** This is a quite different moral proposition from somebody continuing to use an old version of software after upgrading, alongside the new version, on the same computer. That’s something I find entirely morally acceptable, whatever any EULA may stipulate.

http://www.blog.cadnauseam.com/terms-of-use/

Enjoy.