- Whether to mention a pregnancy in a job interview
- A possible meeting protocol
- What are an end-user's responsibilities?
- Another take on opening PCs, or not
- Getting some process going
- Selling a more open environment to management
- Running an effective meeting
- Licensing rules for virtual machines
- The ROI of metrics
- Legal challenges to virtual machines
March 15, 2008 | Comments: (0)
Legal challenges to virtual machines
Dear Bob ...
I talked with our PC support group about the topic you've been discussing the past few weeks [see for example "Getting to 21st century IT," Keep the Joint Running, 3/3/2008 - Bob].
The overriding concern voiced is the liability for improperly licensed software. From the company's point of view, we are liable for any illegitmate copies of software on any computer that connects to our network, no matter which virtual machine it is installed in. What would you say to an SPA auditor who came in and found this situation? There was also concern about the cost of three copies of the operating system - one for each virtual machine, etc.
- Concerned
Dear Concerned ...
I wonder to what extent fear of SPA audits prevents good business. In any event, to answer your question (what would I say to an SPA auditor?) I think I'd say, "Show me your search warrant."
Then I'd call my Microsoft sales rep and point out that while I don't have a lot of choice about whether to use Windows on my company's desktops and laptops, nor about whether to use MS Office, I have a lot of choice when it comes to whether I use/continue to use SQL*Server, Sharepoint, Exchange, IIS, and a very wide variety of other Microsoft products.
Yes, it's Microsoft. Microsoft is a business. That means its sales reps want to do more business with you, not less.
I'm not sure of the legal situation when it comes to virtual machines layered on top of physical machines. To the extent I can figure out the Windows EULA, each license is good for one physical machine. I don't think I've seen any prohibition against installing a license more than once on different virtual machines that run on the same physical machine.
In any event, corporations can usually negotiate minor changes in license terms. I'd think this one would be pretty innocuous from Microsoft's perspective.
So far as illegitimate application software, I'm pretty sure (although I'm certainly not an attorney) that as with harassment, a demonstration that the company has exercised reasonable care in trying to prevent abuses is the key issue - not the existence of a small number of "undocumented" applications.
Plus, with both the locked-down and sandbox VMs the company can and should use scanning software to detect and inventory all applications installed everywhere. When something new pops up, IT asks the user to document the software's legitimacy.
That leaves the personal VM - the physical hardware attaches to the corporate network but the personal VM stays outside the corporate firewall.
You educate your employees regarding the rules; a bad apple or two violate the rules. How liable is your company?
I don't know the answer. I do know that Exxon/Mobil is pushing the legal theory that it isn't legally responsible for the actions of the Exxon Valdez's captain. That would seem to be an applicable precedent.
Even if the SCOTUS finds against Exxon/Mobil, I'm pretty sure the harassment standard of taking reasonable care should keep a company out of trouble with this, but it's very hard to say for sure.
- Bob
Posted by Bob Lewis on March 15, 2008 01:03 PM
RATE THIS ARTICLE:
-
- COMMENTS
Whoa! Hold off on referencing that Exxon precedent. Let's not forget that there has been a 2.5 billion judgment against Exxon and that the Supreme court is their last ditch effort to get out of it.
Posted by: Babzuptown at March 16, 2008 09:25 AMUnless the contract law I dealt with 15 years ago has changed a great deal the software vendor does not make the law: they write the EULA and act like it's law. It is not.
I have been despairing the past 10 years as the courts have been siding with the vendor in interpreting contracts of adhesion like EULA's but have seen a half dozen the past year that go back to 'common sense': They can not put whatever they want in the EULA. I'm hopeful we will soon see a case decided wherein the entire EULA is thrown out for over reaching a 'proper' level of restrictions in it.
Not holding my breath, but hoping.
Posted by: Paul at March 17, 2008 12:11 PMHave you ever heard of volume license agreements? If you are a small or medium business it would be wise to talk to your software vendors about your business needs with virtual machines and software licenses. A lot of them can work with you on runtime instance licensing or named-user licenses.
Posted by: endeavour at March 17, 2008 08:00 PMMicrosoft actually has explicit language in its standard consumer EULA that makes it clear that each Windows VM requires its own license, in addition to the host license. I looked into this a month or so ago when installing VMware Server on some PC's at home.
As noted here, corporate licenses, particularly for significant volumes, can be negotiated with better terms.
Posted by: Paul at March 19, 2008 10:37 AMRegarding the s/w licensing issue, there would seem to be at least some technical argument to be made about time-sharing of the CPU across the multiple VMs, yadda yadda yadda, there is only one copy of any s/w package running at any point in time. This is picking some mighty small nits (and of course IANAL), but it seems like it could at least give you some leverage with the s/w vendo re: licensing fees.
Posted by: John P at March 20, 2008 05:41 AM|
Three books. Three ways to change the world, your life, or at least Bob Lewis' bank account. Leading IT: The Toughest Job in the World distills the world of IT leadership into eight learnable skills and gives you concrete, practical techniques for each one of them. Bare Bones Project Management: What you can't not do makes project management manageable, even for first-time project managers with no formal training in the discipline. ManagementSpeak: What managers say/What they mean … well, it won't help your career, and won't make you a better manager. Mostly, it will make you chuckle, guffaw, and maybe even chortle. Make friends - it's the perfect gift for anyone who has ever suffered through one of those meetings. Order your copies today! |
TOP STORIES
ADDITIONAL RESOURCES
- Virtualization: A Step by Step Approach to Success
- Dialing up Agility with Business Transformation
- 5 Things You Need to Know About Storage Virtualization
- Is your smaller organization ready for High Availability?
- Is system maintenance doing more harm than good?
- Virtual Test Lab Automation: Manage development infrastructure
