HT-2021-000363 - [2025] EWHC 532 (TCC)

DR-171 was opened on 13 August 2020, in response to which Winsopia packaged up material from a customer, scrubbed it using CPX and sent it to LzLabs. However, these load modules included 22 PL/I CSECTs from the PL/I or Language Environment runtime libraries that were not removed by CPX because they were not on the scrub list, as reported by Mr Bowler in DR-282 opened on 9 October 2020.

On 16 October 2020 Mr Bowler added the following comment on DR-282:

“I discovered some more unredacted csects in that library … It’s likely there are more that I haven't found yet. What we really should be doing is to scrub all csects that begin with CEE, IGZ, or IBM, with the exception of IGZUOPT, CEEUOPT, CEEROPT, CEESTART, CEEMAIN, and CEEFMAIN. I understand from Chris Palmer when I discussed this with him three or four years ago that it would need some CPX development to be able to specify prefixes instead of complete names, but I don't know if this is still the case.”

By a comment in response on 19 October 2020, Mr Whittingham stated that he had raised an enhancement request to cover this issue. In cross-examination, Mr Whittingham accepted that this was a scrubbing failure by Winsopia:

“Q. Yes, so there had been a scrubbing failure by Winsopia; do you agree?

A. Yes.

Q. And Mr Bowler had picked it up?

A. Yes.

Q. And that is why you updated the scrub list on 22 October with a whole bunch of CSECTs?

A. Yes.”

The experts agree that the CPX scrub list was enhanced shortly after DR-282 to implement pattern-based entries in LZSLIST, which resolved this issue.

From the above evidence, it is clear that the inadequately scrubbed load modules, containing IBM PL/I CSECTs, were sent by Winsopia to LzLabs in response to DR-171.

The experts agree in their second joint statement that these CSECTs are provided by IBM in the SCEELKED and SCEEBIND libraries provided with z/OS. As such, they are ICA Programs as defined by the ICA.

It follows that: