Legally protect design of Access database

Hi everyone,

I am in the middle of a reasonably complex design of an M$ Access Database that has taken me six continuous months to program overall up to now, and the results are quite impressive (even if I do say so myself)

I am programming this as a freelancer - I am not registered with the CRO but have a fair charge for developing this that is running into the a nice and fair sum as a handly nixer fee).

The person inside the company that I am designing this for I believe now wants to fob it off as his own project, probably to boost his ego and career prospects (as well as a salary bonus).

All the time I have been giving him samples of databases without protection on the design of the objects, but what flagged a warning to me was when he told me that his IT department now need access to view the VBA code for security reasons, which is currently password protected (my only leverage of getting paid).

Not the hardest thing to crack, since $45 will buy you a decent VBA Password Cracker...and if he could figure out the design himself (or get someone cheaper than me to do it), then I am not going to get paid, as I am not a registered company, succumbing to ISO standards, etc.

He has a 85% working copy of the database (still missing a few key elements, but working to his contentment thus far). He may also have had a keylogger running on his machine to capture the password as I entered it to fix a few problems when working on it there.

I have modified the security of the database now on my PC for future development with additonal security layers (time-bomb, and .MDW files, shortcuts with parameters for runtime-only execution of the program) so that all subsequent work is protected to the maximum that Access can protect it.

However, how can I protect the design of the database - i.e. the table and query structure, vba code, form and report layout, etc.? I don't mind the information being stored in it (Data Protection Act will handle that one).

To satisfy his curiosity, I have managed to allow him access to view the design of all the objects and VBA code but the moment he tries to change any of these, a warning disallowing him modification privileges comes up.

But again, password crackers can get around this easily enough.

How can I legally protect the design of the objects and VBA code as my own? After the company "goes live", I probably will never see it work again, and will never know if it is cracked and/or modified, but knowing that I am in a strong legal position would help.

I have a vague understanding of patents (probably not applicable), copyright (more than likely applicable), trademarks (not a company, so probably not applicable), and Intellectual Property (applicable).

Copyright would seem to be the way to go, but how can I copyright something of my own being given to someone else to administer at a data-level only?

Thanks to all for taking the time to read this

I promise to make a reference to AskAboutMoney.com

DataLoreB4 said:

Hi everyone,
All the time I have been giving him samples of databases without protection on the design of the objects, but what flagged a warning to me was when he told me that his IT department now need access to view the VBA code for security reasons, which is currently password protected (my only leverage of getting paid).

Click to expand...

His request for access to your VB code for security reasons is completely valid. Your concern that you will be fully paid for your work is completely valid. I think this is a people issue and not a patent or technology issue.

Your mention of time-bombs would set off alarm bells in any company. You have to see it from their point of view.

Seek to ensure you are properly paid for your work on the understanding that you are cooperative with his IT department regarding security.

I would suspect that your concerns regarding his designs on your product are groundless.

As a matter of interest why did you choose Access for your database product? It is not the most robust database around and is pretty useless in multi-user environments. Locking and transaction handling are particularly poor.

Best of luck,
Gearoid

I have no problem in him viewing my code - I am just worried that he will change it. Again, as I already mentioned, I have developed the security of the database on my PC now so that he can view it and the design of the objects too, and no password will be required, but he will NOT be able to modify the design.

The time-bomb is only in the product while it is still in beta. When the full version arrives, I will allow him an access code that will change the beta into a fully working version.

The interesting fact is that he is shielding me away from the IT department, which I don't like. I am an IT Manager myself with 10 years database experience (Access, Oracle, SQL Server, Navision, DB2, Lotus Approach), and would like to think that I am professional in my approach

He is not allowing me contact with his superiors either, who are really the people that I should be demoing the product to. He won't even allow me to demo the project at all - he is taking full responsibility for showing his colleagues. He also told me that he is not mentioning my name either, just that he has outsourced the design. Strange, as I have no problem in meeting with his IT people and showing them the code and explaining it all to them. But then again, who am I to care - I just want my money!

And you are right - it is a people issue; I just want to be legally grounded for the work I am providing. He does not need to know the password (now defunct with the new measures I have put in place) as I can meet his IT people and discuss it with them - they would be the ones to qualify the product for distribution around his company.

This database is a time-management system, for holidays and sick-leave. It won't be in continuous use and I have designed it in such a way that record-locking will not be problematic, as I am designing my own security protocols with my own login form and user-profile handling.

His company are quite backward in terms of platforms offered - I would loved to have programmed it with a Java/Access/Web front end and a MySQL/SQL Server backend but they don't even have the Java Web Client installed - I am working towards handling Office 2000! Thank goodness Access 2003 makes development a lot simpler, but I have to retrograde my product to fit his platform!

The only drawback is that Access <= 2003 has no internal way of preventing the scroll-wheel from functioning on subforms as this has a detrimental effect on my product. There is a workaround in which I can create a batch file, and this will be a part of the installation routine before the database can be used.

BTW, the time-bomb is only a form that runs before the database is open, with a message to say it is a trial version and no longer works after a certain date. The data remains intact, but the database cannot run until a code is entered. It will remain in trial until a 'sign-off' that I have verbally agreed with my friend has indeed been signed off.

Cheers.

Thanks for a very detailed explanation... I'm no expert just another techie (on the db side) with well over 10 years in the business

I guess it is a complicated scenario, more so than I knew on initial posting.

The issues that strike me are as follows:
1) There are major trust issues here and by the sound of it, much is not your fault
2) If you're developing a product for market then perhaps it needs to be separate to providing a service on a contract or nixer basis to a client.
3) There are many, many products in the space you're in. I would say Enterprise Ireland are supporting lots of employee management and likewise CRM and workflow management products at present. Why is your product better than any of the freeware out there if indeed it is a generic product?

See the below:
[broken link removed]

4) VBA and VBS are a hackers paradise are they not? I haven't worked in Microsoftland since mid-90's but I think the security concerns may be genuine .

If you feel you have a good product then PERHAPS approach Enterprise Ireland for funding and they may put you up in a business incubator unit, at least for the first year. They've made hundreds of millions from the dot com era so should be prepared to plough some of that back. At that stage you can choose your technology platform.

If you don't go that route then I guess it may be difficult coming in as a contractor providing a product to someone who will steal your thunder and potentially rip off your idea. I can't advise you on that.

Good luck.

I didn't intend for it to be a marketable product, but since a lot of good work has gone into this, as well as time away from more important things like my wife, I may just do that.

There is a trust issue here, definitely. But only in the sense that I may be ripped off. I am very forthcoming with the design and underlying code, so long as I'm am there to present it and that modifications only come through me, as any agreeement would allow.

This started off as a very simple database that has snowballed over the past few months (being an IT admin guy, that happens to me a lot).

As for the security - the ironic thing is that this is going into a mid-sized legal firm!

I agree that I face stiff competition but I am not competing - this was supposed to be a one-off custom database. But if I was going to make money from it, why would I want to offer a free alternative? Seriously, there were very few holiday-recording packages that did exactly what this company wanted. It is heavily customised and while I know there are companies that charge per user record on a system (excellent products from Softworks-Computing for businesses, for example), I am only interested in a one-off fee. If maintenance is required, I will charge extra, about Euro50 per hour.

But what I really want to do is just protect the design and have it in my name, that's all - well, that and getting paid!

Cheers.

I'd hope I would just worried about getting paid, but I know that many freelancers care about the design, and that they are recognised for it. It is the sign of a good software engineer. I am not sure it is the sign of a good contractor/freelancer though.

I've seen contractors who couldn't stand it that their good work was not being acknowledged. I saw others whose attitude was "I don't care if some pratt takes the kudos as long as I get MY ******* money".

Just playing devils advocate but are you not just applying full-time mores to a contractors role?

Edit: What's confusing me here is you are inhabiting a space between providing a product and providing a service. You provide a product of which you're justly proud. They're treating you (he's treating you?) as a hired hand coding their system. Seems to be a conflict.

It's not really the case that I get recognised for the work. I just don't want it stolen (probably a harsh word, but if someone uses your code and passes it of as theirs, what else would you call it?).

I am not even getting the chance to speak to anyone technical there, which I would have to for, as an example, the .dll files that I needed registered on each PC...

So while I do want what was agreed with financially, I don't want my work to be plagarised or modified outside of my knowledge, in case I get called in to develop it (a bit like a maintenance agreement....possibility for more money? )

Do you have a contract with the company? It should cover the legal aspects of access to source code, ownership and audit rights. One possible solution to the dilemma would be for a trusted 3rd party to sign-off on the security aspects. In the real world, it's expensive to protect programs, even more so the source code. More money is made from selling services & support than from one-off programs. These days most professionals rely on reputation and shortage of competent alternatives to ensure that the services & support work comes to them.

Technologist said:

Do you have a contract with the company? It should cover the legal aspects of access to source code, ownership and audit rights. One possible solution to the dilemma would be for a trusted 3rd party to sign-off on the security aspects. In the real world, it's expensive to protect programs, even more so the source code. More money is made from selling services & support than from one-off programs. These days most professionals rely on reputation and shortage of competent alternatives to ensure that the services & support work comes to them.

Click to expand...

I'd agree, you should have a contract/license.

Think of it from the company's point of view as well - what if the program crashes all their systems or deletes a wad of their employee data? Who is liable in that case?

When you buy software from, say, Microsoft, you are not really buying the software, you are buying a license to use the software.

It is not really a case for having a contract, per se.

My friend and I originally decided to work on the database - he would tell me the scope and specifications, and I would do the development.

Ownership of the database, I thought, would be duly mine, as he asked me to prepare an invoice and set up a maintenance agreement (where I would make my money).

But this was supposed to be something that could have spawned off to more development for his company; yet the product itself was supposed to be one-off (there would be little need to modify it, as the data is easily changed to suit the needs of the company, rather than the rules).

So, what legal protection do I have over the ownership of the design and code? I have no problem in handing over the design, so long as I know that it cannot be modified. There is no and will be no contract, as this was agreed to in a freindly manner, and releasing design was NEVER discussed until last week.

Am I correct in providing access to the design but restrict modifications to it? What copyright do I have if I am not registered to the CRO?

By the sounds of it, I would be more worried about getting paid than him passing it off as his own work. But he would be quickly made to look like a fool if you started sending in invoices and ringing up looking for money.

Look for a Purchase Order Number from him, once it is issued you can ring up his accounts and check it valid and for the correct sum etc.

Put a good description of the project on your invoice and/or maybe break down in the invoice into:
Initial Specification X hours @ Y.
Design X hours @ Y.
Programming X hours @ Y.
License X.
Total Z
Etc.

It shows that it is your work. He does not have to see this invoice just give him the total. Send the invoice directly into their accounts!


I assume you know about sending copies of your source you self via registered post, leaving them sealed, to be opened in court etc.

If you are doing an install don't for get to add a license agreement, which has to be accepted before it can be installed. Etc.


Towger

DataLoreB4 said:

It is not really a case for having a contract, per se.

My friend and I originally decided to work on the database - he would tell me the scope and specifications, and I would do the development.

Ownership of the database, I thought, would be duly mine, as he asked me to prepare an invoice and set up a maintenance agreement (where I would make my money).

But this was supposed to be something that could have spawned off to more development for his company; yet the product itself was supposed to be one-off (there would be little need to modify it, as the data is easily changed to suit the needs of the company, rather than the rules).

So, what legal protection do I have over the ownership of the design and code? I have no problem in handing over the design, so long as I know that it cannot be modified. There is no and will be no contract, as this was agreed to in a freindly manner, and releasing design was NEVER discussed until last week.

Am I correct in providing access to the design but restrict modifications to it? What copyright do I have if I am not registered to the CRO?

Click to expand...

You want to retain the ownership of the code but you want to provide access to the other company to use the system? Then you are giving the company a license to use the software. It would be a good idea to make the license explicit in writing.

You want to cover your own ass as well, as mentioned above, what if the database inadvertedly deleted a load of data? What is to stop the law firm from holding you responsible if you don't have a license with the usual disclaimers.

I agree, but after signing-off the acceptance of the database after the company's own vigorous testing, it will need to be incorporated into their own security and backup strategies. If the database is not backed up, as I pointed out to my friend, or if the database is hacked (for the $45 VBA Password cracker, not the most expensive piece of kit to break an Access DB down!) then this is hardly my problem.

You bring up a valid point, and there is one case where this can happen (using the mouse scroll wheel, belive it or not) that I am creating a new program to prevent.

I am an IT guy with 10 years DB admin under my belt and this has happened to me more often than not. Once the vendor can repair or restore the database for me and explain why it happened, I am happy with that, even on a production system.

But I am not a company nor am I registered, so how can I apply a license to my product for the company to succumb to?

Towger:

I don't know about the posting of the code to myself, sealed, etc. Is that all I need to do? If I copy the database onto a CD and post it to myself, is that enough?

And what do you mean by "doing an install" - there really isn't much of an install - the database will end up on a server share and a shortcut placed on the user's desktop.

The only install I need to do is run a batch file to register a dll to prevent the mouse scroll wheel from corrupting the database, but not directly to do with the database itself - it is just to knock out that 'feature' in Access. My friend knows about this, too.

Also, can I place a copyright symbol (c) and my name to be displayed on the login form of my database?

DataLoreB4 said:

Towger:

I don't know about the posting of the code to myself, sealed, etc. Is that all I need to do? If I copy the database onto a CD and post it to myself, is that enough?

And what do you mean by "doing an install" - there really isn't much of an install - the database will end up on a server share and a shortcut placed on the user's desktop.

The only install I need to do is run a batch file to register a dll to prevent the mouse scroll wheel from corrupting the database, but not directly to do with the database itself - it is just to knock out that 'feature' in Access. My friend knows about this, too.

Click to expand...

If not on install, then you should bring up a prompt before the user can run the database program to accept the terms and conditions as you have outlined above
- you retain ownership but license the firm to use the code
- firm is not allowed to license others to use it
- modifying the code is not allowed and invalidates the license
- you are not responsible for loss of data etc.

Maybe you could register a business name, as distinct from a company, with the CRO.

I don't know about the posting of the code to myself, sealed, etc. Is that all I need to do? If I copy the database onto a CD and post it to myself, is that enough?

Yes, this is what is recommended for copyright songs etc. It has to be sent via registered post, as they but a sticker over the envelope opening. I don't know how well this holds up in court, but it is a old technique.

And what do you mean by "doing an install" - there really isn't much of an install - the database will end up on a server share and a shortcut placed on the user's desktop.

An install program eg Install Shield etc. or as someone else said License screen that pops up and has to be accepted when first run on a computer.

Add the "Copyright 2007 XYZ. All rights reserved" to the About and Splash screen. Add "Licensed to XYZ Ltd." to these screen as well. Also have the Copyright in the source code at the top of each file/module. Then at the top of each Sub/Function/Event etc, (where you describe it ) eg Purpose: XYZ, Created ##/##/#### and Author: XZY etc etc.

You are basicly licensing the software for use by the company, they don't own the code. You can find some good examples on the internet.

Towger

Never thought about the license screen - that would be a good idea on first running of the app.

But as I am not a company, should I just use my own name?

If I register a business name, how is that different from a company?

Are there tax implications?

Is there any website that specialises in business names for people like me?

Thanks to all for your much needed assistance!

Check out this link to the copyright association of Ireland. Might be of some help

[broken link removed]