📜 ⬆️ ⬇️

The legality of protecting your software

For a long time, I haven’t got a chance to write an article on how to make protection so that in case of software hacking, sales are not likely to suffer, and maybe even increase. However, it is difficult to advise people to do a competent defense of their software due to the fact that the Magadan programmer was given 2 years conditional for deciding to protect his software. However, a considerable number of people argue that if you “understand the question,” it will become clear that the guy is guilty. I have carefully studied the circumstances of the case of Zhukov and asked his advocate to give answers to questions that in my opinion should dot the i.

What remains "behind the scenes"

from son Zhukov

I (the son of Zhukov, and his lawyer in court) want to clarify some questions about the Zhukov case.
')
As a result of the discussion of the Zhukov case, a significant part of the Internet community came to two conclusions:

1. Users did not know that the program has an urgent license for a year, that is, there is a deception
2. The program at the end of the license period distorts information and simulates failures, which is terrible

However, there are a number of important points in this matter that were not previously mentioned and which allow for a different look at the problem. These moments I will try to clarify.

1) Why is this deadline at all? To force users to buy the program again and again?

The peculiarity of accounting and payroll is the annual change of legislation, tax forms, the algorithm for calculating taxes, fees, vacation, etc. In this regard, every year our company produces a new program for the calculation of wages. The version name corresponds to the year for which it is intended (ZRP99 - for 1999, ZRP4 - for 2004, and so on).

Historically, the limitations on the program’s work period appeared as follows: At the beginning of the 90s, the head of the city tax inspectorate Pentyashin addressed the developer with the words that he was given the tax reporting for the last year’s program that did not comply with the legislation, and that it was impossible to do so. It was at that moment that the restriction was introduced that it is possible to work on the ZRP program only in the Nth year. Those. FIRST OF ALL, this was done to prevent the submission of reports in the new year on the old program.

That is, in fact, the purchase of a new version of the program is forced by annually changing accounting legislation. Therefore, each version of the program is designed STRICTLY for a particular year. And the restrictions in it historically appeared to prevent the work of an accountant on the old program that does not comply with the new legislation.

Since then, it has become the standard operating procedure of the company-developer. Contracts were concluded with clients before the end of the calendar year, and it was explained that in order to work with the program next year, it is necessary to conclude a new contract (although it is usually clear to an accountant that working on last year’s program does not make sense under the legislation of the new year). The supporting testimony of the witnesses is in italics here .

Thus, it is as if the developer was deceiving customers by hiding the deadline for providing the program from them - this is a MYTH built by the prosecutor's office. The development company has almost 300 clients, many of which are permanent. There is a whole volume (!) Of positive feedback from clients in the case file. Despite the verdict, people are in no hurry to abandon the "malicious" programs, and vice versa - in support of the developer. Among the regular clients are the regional court (!), The judicial department, the police department (!) Of the city of Magadan ...

Yes, and if the prosecutor’s office so insists on the version of extortion and coercion to conclude treaties, then why hasn’t a criminal case been initiated under these articles? The Criminal Code has articles for fraud and extortion. And here is Article 273 of the Criminal Code: “the creation of malware”?

AND ONE MORE IMPORTANT MOMENT. The user is in no way limited to working with information for a contractual period. The information entered under the contract for the 2008th year is fully available in the 2009th and subsequent years, without any problems, you can make reports for the 2008th year. Restrictions arise only if the program performs the transition for 2009, and starts working with the reported data for 2009, which the program algorithms do not correspond to. In the examination, it can be seen - restrictions in the programs starting with the ZRP4 version do not work according to the calendar date, but according to the current reporting month in which the work is carried out. That is, while the user is working with information for the paid reporting period, no restrictions arise, regardless of the current calendar date. In versions of the program prior to ZRP4, the developer, upon request, supplied the client with a version without any restrictions with the condition that he would work with information only for the period of the contract.

2) So why do we need restrictions? After all, it is impossible to work on an outdated program because of its incompatibility with the law!

Of course, a qualified accountant understands that it is impossible to use the program of the last year due to non-compliance with its legislation. To the questions in court, “Could you work purely hypothetically on the last year’s program?” The accountants answer, “No, because the method of calculating taxes, social contributions, etc., has changed.” However, sometimes non-professional or inexperienced accountants work with the program. They do not attach much importance to the annual changes in legislation, considering that it is possible to “slip” on the old program (“maybe it will cost”).

By continuing to work on the old program in the new year, such accountants (unaware of themselves) will inevitably get results in the program that do not comply with the new legislation. And it turns out to be quite late - when submitting reports, when there is not enough time for rework. To prevent such incidents, and there are restrictions on the term. It would be better if the program ceases to work at all, than it will not work in accordance with the law, giving out incorrect results (remember the tax inspector!).

If we talk about specific witnesses who said that it is possible to work with the old program in the new year, it is Yakovlev and the Ilins. Both of them are interested in the accusation of Zhukov and, probably, therefore, made such statements. It should be noted that in the case file there is a letter from the chief Ilinykh, which says that due to the change of legislation in the new year, it is necessary to update the program. That is, there is a contradiction - on the one hand, the Ilinists need a new program, on the other hand, in court, she declares that she does not need it.

More information about what protection tools are in the program, and what they are for, is written here .

3) And what is the license for the program really? And what of the contract "for maintenance"?

A few words about contracts. The company-developer of a separate lawyer has never been. Therefore, the contract was legally weak. For the developer, the first priority was always to do a good job (to deliver a quality product). Attracting a lawyer and developing a license agreement was a secondary task. There was a time limit in the contracts, but what the term meant was not explained in the contracts themselves. In the old contracts there are no words like “the copyright holder does not allow the use of the program after the expiration of the contract”. However, as I said, the developer explained everything to the customers, so there was no misunderstanding on their part. For accountants, it is only natural that the program is designed for a specific year and only for it. But people who are not familiar with the order of work, with the specifics of accounting programs, may seem to be deceived in the fact that there is no explicit explanation in the contract, which means the term of the contract.

Another weak point is that the contracts are called "for maintenance". The fact is that along with the program the developer also provided all updates to it for the term of the contract. We decided to call this “maintenance” or “implementation and maintenance” (in different contracts differently). As a result, an opinion arose (now in the Internet community, and not among clients!) That the developer concludes contracts for servicing the program for a year, and the program itself is provided forever. But it is not. All users knew that the program is designed to work with the data of that year, the laws of which correspond to its algorithms, next year you cannot work on this program. For the calculation of salary in the next year to enter into a new contract. For accountants it is quite natural. There was no deception. The “fault” of the developer is that he did not invite a lawyer in time to formalize everything in the text of the contract. Another point - the contract has not changed for 15 years, since the beginning of the 90s. No one complained, no one appealed to arbitration. There have always been good relationships with customers. Therefore, they focused on what seemed more important. On the finalization of the software for endless changes in legislation. Bringing contracts to a decent view seemed not so important. Well, paid. Not without the interference of competitors (there is a separate page on the website about the interested persons), criminal prosecution for “malicious” programs was organized.

In 2008, a lawyer was invited to draw up contracts and the contracts clearly set out the right of use for the term of the contract. At the same time, the transition to a new contract went smoothly, just because the essence of the relationship HAS NOT CHANGED: the program was intended to work in a certain year and until 2008 and after.

All this is detailed here . Links to examples of contracts (one new and two old) are on the same page.

4) This program distorts information - it's sabotage!

The program has 2 types of restrictions:

1. menu items do not work
2. 80% of the lines are displayed in the reporting forms.

These restrictions arise after a few months (!) After the expiration of the contract, and ONLY if the user works with the data of the next year, the law of which the program does not comply with. Accountants during interrogation confirm that every year the legislation changes quite strongly, so that working in the new year on the program of the old year does not make sense. And then these restrictions apply only to the image on the screen. Accounting information does not change, does not distort.

2-3 months before the first restrictions, the user begins to receive a message about the need to contact the developer. This is confirmed by expertise in the case file.

5) And if the accountant passes such a report, the company will receive a tax penalty!

Only people who are not familiar with accounting can think like that. The accountant went to the tax to submit reports, in which there are no 20% of the lines (including in the header of the reporting form)? Yes, no accountant will go to submit reports, in which 20% of the lines are missing! Their absence is visible to ANY accountant, although it is not obvious to the hacker. In addition, for 3 months the program asked to contact the developer, and the company itself warned that it was impossible to work on this program ... Therefore, the situation when the accountant went to submit a report without 20% of the lines in it, despite all the warnings, is purely hypothetical.

6) And why do we need such a peculiar method of protection? Make fun of the user?

The “SLV-Salary” program was repeatedly hacked and some even distributed on its (!) Name. It is written in the Clipper language, programs on which are easily opened (using the Valkyrie decompiler). Therefore, to confuse hackers, the author has instructed many defenses of a different nature. It’s one thing, if the program simply writes “it’s impossible to work with this year, make a new contract” and no action other than this is provided for in the unlicensed program - then the hacker will very easily remove such protection. (according to some data, even in less than an hour (!). But to understand that only 20% of the lines are not displayed in the report, a hacker without an accountant will probably not work. He is not an accountant and does not know what the reporting one should look like form. In some cases, the program window is painted in different colors. And go, hacker, make out, this is a license restriction or something he broke, rummaging through the program.

I repeat that this is all “mockery” NOT over an accountant. An accountant who has been warned a thousand times will not encounter these limitations. This is all a fight with hackers, with burglary.

And, by the way, such hacker-proof remedies are not Zhukov’s “invention”. A specialist in the case file gives an example that the Project Expert program, if it is suspected of illegal use, starts issuing incorrectly calculated business plans.

7) What about blocking information? It also has a place to be. After all, it was for that.

With this conclusion, too, do not hurry. From a household point of view, an act can be called a law, it is not so important, but in court the substitution of words is of paramount importance. It should be understood that there is a blocking of information in terms of article 273 of the Criminal Code of the Russian Federation.

A typical example of blocking information is WinLock virus. It interferes with the operation of the operating system; as a result, the user can no longer receive his data with standard OS tools. At the court hearing, the specialist Yurin cited another example - a virus that intervenes in the work of the postal client, hindering the work with postal information.

If the program itself, according to its algorithm, stops working, then in this case there is no third-party intervention. For example, the program DrWeb after the end of the license stops checking the contents of the computer, but talking about the interference and the creation of obstacles by the program for its own actions is not appropriate. The absence of third-party intervention is an important difference between the functional limitations in the program and the behavior of known viruses blocking information.

3 experts in court stated that the program itself can not interfere due to the unity of the program's goals. Therefore, the statement about blocking information in terms of article 273 of the Criminal Code of the Russian Federation in this case is not correct (the co-author of article 273 of the Criminal Code of the Russian Federation - Karelin also adheres to the same opinion). Zhukov’s defense in court was based on the correct interpretation of the word “blocking”.

8) But there is no smoke without fire! The point is not from scratch appeared.

Yes, it is necessary to mention where the legs grow from. Only three girlfriends and one separate person testified against Zhukov in court. ALL THEY are extremely interested in the prosecution. The rest ~ 15 witnesses spoke either for Zhukov or neutral (“I don’t know anything, everything seems to work fine, we don’t complain”). The report from the prosecutor's office seems to be solid - 11 episodes. But three episodes are the creation and modification of a program. Three episodes - the distribution of the program in the judicial department, from which the prosecutor's office has already refused in the cassation submission . Two more episodes of distribution (at the blood transfusion station) are as meaningless as in the judicial department, because users confirm that there were no restrictions on the use of the program, but there were failures associated with equipment failures that stopped after computer repair (readings Putilova, Skurat This is confirmed). There are “witnesses of harmfulness” in three episodes in two enterprises with the same accountant. But these are the very three friends and one woman who threatened the developer with her connections - Yakovleva V.G. (witnesses speak about her threats in the interrogation of October 4). About these three friends and Yakovleva here .

It is likely that the initiator of the case is the current competitor of the developer company (and the former employee) Sereda L.I., who declared her connections to the prosecutor's office. So from the case of her friend Bobrova about the theft of programs, the documents disappeared, and the developer was prosecuted for malicious programs (Bobrova called herself the author when she distributed them from herself - funny, right?). Her second friend, Ilinykh, an accountant of those two seemingly "affected" enterprises.

So the state has become a tool in business fights. Directing the law enforcement system to its competitor is an effective method of unfair competition, because the statistics of acquittals in Russia are less than 1% .

My comment

Those. My understanding of the situation is:
The guy, of course, in vain did not attach importance to the “right” contracts, but he was not condemned for it. Invalid agreements, and all that is connected with them is all other articles or even another RF code.
They condemned him for the “malicious” code inside his own software. Those. If you follow the logic of the prosecution, then at least you cannot make code in your software that forces users to update - after all, this will result in “blocking” the program. I ask you to note that judging by the materials of the examination, it does not matter whether the update is paid - the examination in the case determined “harmfulness” only at the expense of one parameter “inexorability of the passage of time” - and as a result, blocking information from any user ...

Source: https://habr.com/ru/post/284568/


All Articles