“The modern thief can steal more with a computer thanwith a gun“

– NationalResearch Council, “Computers at Risk”, 1991.

With the growth of e-commerce,the security of the database to prevent the improper disclosure/copying ofinformation to unauthorized users is of utmost importance in present automatedenvironment. These customized software’s and information’s/data organized,compiled & stored on the computer systems of the organization in the formof a huge database, tables & compilations of essential information andknow-how are being developed by the organization by appointing expert staff andspending huge investment in the form of resources and therefore constitutesoriginal literary & artistic works, therefore copyrightable within themeaning of Section 13 of the CopyrightAct, 1957 and the organization is the owner of such copyright within themeaning of Section 17 of the Copyright Act. Therefore, unauthorizedreproduction/use and copying of the database & information from the systemof the organization by the employees would be a cognizable offence by virtue ofSection 63 Copyright Act.

Further, use of infringedsoftware & database apart from the infringement of the copyright wouldinevitably result in diminishing the value of these works in the hand of theorganization & injuriously effecting the same more particularly when suchconfidential/secret information is passed on to competitors and thus takingaway the benefit/edge of the organization which it have because of these worksover its competitors. Thus, the act is squarely covered under Section 66 IT Act within the meaning of“hacking” and punishable under it because the employees while accessing(which may be authorized or unauthorized, doesn’t matter however) to thedatabase/software and making copies and then secretly transfer suchdata/software residing therein to the competitor, the act would become one of‘hacking’ as though the data residing in the “computer resource” has not beendestroyed or altered but it value has been lost or reduced as the secretdata/customized software which gave an competitive edge to the organization hasfallen in the hand of competitor who may use it resulting in loss to theorganization.

One such case of databasetheft came to notice when a renowned logistics company lodged a complaint withthe Cyber Cell, CBI against the database theft and infringement of customizedsoftware developed by its IT Department by none other but one of itsex-employee who was key member of the IT Development team while he was workingfor the complainant company and switched over to the rival company having sameline of business as that of the complainant company. The complainant has alsoalleged that the directors of the rival company were instrumental ininstigating its key employees involved in the development of proprietarysoftware for inventory management to commit the hacking of the source/objectcode of the software and databases maintained at its server and join the rivalcompany. The brief facts disclosing theModus Operandi adopted by the accused persons and how they hacked thedatabase are as follows:-

· An ex-employee of the complainant companyworking at the rival company informed the management of the complainant companythat the management of rival company has been using software which is nothingbut exact replica of the customized software that was being developed by thecomplainant company for inventory management solutions. The said employee alsosend an e-mail to Head IT Development Team of the complainant company,attaching the executive file of the said software for further analysis to findout the copying/duplicity of the copyrighted work.

· Earlier it was noticed by the management of thecomplainant company that the rival company approached some of its esteemedclients/customers like Bharti Airtel, Tata Teleservices, Reliance Telecom,Ericsson India, Motorola, Siemens, etc. and made bids at slightly lower pricesthan that of the complainant company. The rival company surprisingly used samemethodologies, strategies as that of Complainant Company; as if they knewbeforehand what complainant are up to which looked quite weird, strange.

· Aboutthe Software: The software developed by the complainant company wasbasically inventory management software and provides complete warehousingsolution applications for Telecom Industry. The software was very crucial andimportant to provide effective warehouse support and other value added servicesto the clients and gave the complainant company competitive edge over othercompetitors. The said software was completely designed and developed by thesoftware development team of Complainant Company. During the development phaseof the software, the source code of the software was known to the members ofin-house development team. The source code of the said software was a closelyguarded secret as the same was a key to the development of software and would loseits value if it falls into the hand of the competitors.

· On analysis of the copyrighted software with thesoftware purportedly developed by the rival company, it was revealed that theliteral elements of copyrighted software i.e. source code, as well as its nonliteral elements i.e. the structure, sequence and organization, that is to sayoverall organization of a program, the structure of a program’s command system,the program’s flow charts, the screen presentation, graphical user interfaceetc. has been literally copied into the software purportedly developed by therival company.

· The striking similarities noticed between thecopyrighted software and infringed software clearly lead to the conclusion thatthe source code of complainant software has been stolen and subsequently bymaking cosmetic changes, rival company were using the same software. Further,analysis of the data structure of both the software using Starlnix Software “SQL Compare” also reveals that thedata structure has been copied and which also leads to conclusion that samecannot be possible without the theft of source code of copyrighted software.

· Thus, as suspected by the management of thecomplainant company, the conduct of the rival company in approaching itscustomers, submitting quotations/bidding to its customers just below pricequoted by complainant, using methodologies, operations similar to complainant,using its copyrighted software for a new company which has just come into operationcould not have been possible without unauthorized accessing its hugeproprietary database maintained in its server. Further, the developing suchmethodologies, operational procedures and development of such software can onlybe possible by spending resources, manpower, collection of data over a longperiod of time and the startling fact was that the rival company has just cameinto operation in November 2007 and it was highly improbable that it managedthe impossible with its limited resources within such a short span of time.

· Later on it was revealed that one key employeeof the development team who was having dominion and control over the databaseof the complainant and also part of the software development team has resignedin the suspicious circumstances and joined rival company along with few otherkey employees and shifted the database of the complainant to rival company.

· The database maintained by ComplainantCompany: The complainant company in order to cater to the requirements ofits esteemed clients maintains the specific client profile, client inventorydetails, inventory cost data, business strategies and methodologies etc. Theseenormous and valuable data which is in the nature of trade secret has beencompiled by the technical staff of the complainant company on which huge amountis spent in form of salaries, other day to day expenses etc. These information& data are organized, compiled & stored on the computer systems ofcomplainant company in the form of a huge database, tables & compilationsof essential information and know-how, the access of which is granted to fewkey employees to whom the information is entrusted to be used for authorizedpurposes only. This confidential information/data base in the nature of tradesecret is also original literary work. Any compromise, breach of secrecy,misuses etc. these works & information would inevitably result indiminishing the value of these works in the hand of company & injuriouslyaffecting the same.

· The literal copying of the source code,structure, sequence and organization of the software is further conclusivelyestablished from errors found in original copyrighted software which have beenalso found in the data structure, text fields, description etc. inadvertentlycarried over in the infringed software when the software including thepertinent computer databases, information hacked from complainant system wasblatantly copied by the development team of rival company headed by ex-employeein conspiracy with Managing Director of rival company.

· The aforesaid copying provides an intrinsiccircumstantial evidence of ex-employee who indulged into slavish imitation ofinventory detail, databases, compilations maintained on complainant’s computerserver which had been illegally accessed by ex-employee to unauthorisedly copythis literary, proprietary information. The striking similarities noticed inthe two software could not have existed but for the fact of ex-employee havingmade use of our computer database.

· The Ex-employee acting under the instructions ofMD of rival company copied and took away databases consisting of specificclient profile, client inventory details, inventory cost data, businessstrategies and methodologies etc. and other software like TALLY Software andbilling software containing the crucial clients information which has been usedby rival company with impunity to lure or solicit the clients of thecomplainant to divert business from them causing major loss to them.

· The conspiracy between ex-employee and MD ofrival company is further established from the fact that these methodologies,operational procedures, software and data cannot be used without the activeparticipation of the management as they are the main beneficiaries of thewrongful gain accrued to the rival company. Thus, the ex-employee has illegally& unauthorizedly copied the confidential computerized databases, sourcecode & other software etc. from the computer system used by him while inemployment with the complainant & was contemplating to engage in competingbusiness and misusing the same to indulge in the same business as that of thecomplainant company in conspiracy with the management of the rival company.

· The illegal hacking of the computer source codefrom the computer resource of the complainant by its Ex-employee and itsmisappropriation to make infringed software for rival company has diminishedthe value and utility of the information residing in the system of complainantcompany, as the same has fallen into the hands of rival who used the same alongwith other stolen secret trade information, computer database to lure theclients of complainant which caused it huge losses. Thus, the accused personshave committed the offence punishable under Section 66 of the Information TechnologyAct, 2000.

· Further, as the ex-employees were entrusted withthe data by the complainant company while they were in employment which theymisappropriated for their illegal gain causing corresponding loss to thecomplainant company, the offence u/s 408 Indian Penal Code is, also attracted.Further, the proprietary database along with source code of the softwareconstitutes literary work within the meaning of Section 2 (o) of the Copyright Act, 1957& therefore copyrightable work within the meaning of Section 13 of theCopyright Act, 1957. Therefore, any illegal copying, use of the misappropriateddata attracts the offence U/s Section 63 of the Copyright Act. Further, as thecopyrightable source code of the complainant company has been copied to makethe infringing software, it also attracts offence u/s 63 read with Section 63-Bas there has been a knowing use of infringing software by the accused persons.

· The case was registered by the Cyber Cell, CBIwhich handles the crucial cases of database theft and software infringement. Ateam was constituted and a raid was conducted at the offices of the rivalcompany situated at Delhi and NOIDA. During the raid, the CPU, hard disk,compact disk containing the infringed software/database and other incriminatingdocuments were seized.

A Word of caution for the companies maintaining huge valuable databaseon its server

Organizations which maintainconfidential data base need to develop robust measures to protect the same fromthe unauthorized use, without compromising the employee’s ability to carry outhis duties. In today’s competitive world, if the integrity of sensitive data iscompromised, the accompanying repercussions are heavy; both economical andotherwise. It is not only necessary to hire the professionals formaintaining cyber security but also to set up a mechanism for taking promptaction and to preserve the digital footprints as admissible under the law. Ifthe valuable database is suspected to have been compromised, please take promptaction to file a police complaint in consultation with your legal counsel.

Neeraj Aarora

(Advocate)