HT-2021-000363 - [2025] EWHC 532 (TCC)

The allegation is that Mr Taylor, a Senior Software Developer at LzLabs, accessed the Winsopia mainframe and used ICA Programs, including (i) writing REXX programs which were stored on the mainframe; and (ii) initiating GTF traces between a CICS instance on the mainframe and a NUC at Winsopia, for the purpose of developing CICS support within the SDM.

Mr Taylor was the technical lead at LzLabs for development of the design, coding and testing of Legacy Transaction Environment (“LTE”), LzLabs’ implementation of CICS, in a Linux rather than z/OS environment. CICS allows applications and resources to be distributed across CICS regions which behave like servers. ClCS applications may require communications with other CICS regions that are either located within the same operating system or in remote systems. For CICS applications to run smoothly on LTE, it was necessary for LTE to behave like a remote CICS region and to implement the same intercommunication functionality. In cross-examination, Mr Taylor stated that he was trying to achieve 80% of the functionality offered by CICS and to simulate the behaviour of a real CICS instance when communicating with CICS on the mainframe. He wanted the LTE software to be able to send and receive messages to mainframe-based CICS instances and for CICS to understand and respond appropriately to those messages.

Mr Taylor was seconded to Winsopia on 27 to 29 August 2014, 16 to 18 September 2014 and 29 September to 2 October 2014, pursuant to the Supply of Staff Agreement dated 14 August 2014 between Winsopia and LzLabs and a letter of secondment dated 20 August 2014.

Before his first visit, Mr Taylor sent a New Unit of Computing device (Brad’s “NUC”), which had an early SDM version installed on it, to Winsopia to be installed and configured within the Airlock. The Airlock was a secure network which allowed restricted communication with certain devices located at Winsopia. Once inside the Airlock, Mr Taylor was able to connect to the NUC using VPN and a connection from LzLabs in Zurich. He brought with him a hard drive with a copy of the SDM on a virtual machine, on which he had installed “SNAP-IX”, a tool licensed to LzLabs by a third party company that provided an implementation of the SNA LU6.2 protocol, enabling connectivity to Linux systems using the TCP/IP communication protocol. Winsopia engineers set up CICS regions on the mainframe so that Mr Taylor could carry out LTE-to-CICS testing and achieve a connection between the NUC and a CICS region on the mainframe.

Mr Taylor agreed in cross-examination that it was possible for devices in the Airlock to communicate with the mainframe and he was given access to the mainframe by Mr Rockmann. The NUC had to communicate with the mainframe to perform its CICS tests; indeed, the purpose for which the NUC was installed in the Airlock was so that Mr Taylor could use it to communicate with the mainframe at Winsopia.

Mr Taylor’s evidence as to the work he carried out at Winsopia was as follows:

“I would run tests, review the visible communications between LTE and CICS via SNAP-IX and CICS using SNA tunnelling over IP, make changes to the SDM source code based on those communications, recompile the SDM, and then rerun further LTE­to-CICS test communications and transactions. In more detail, I would start up CICS regions on the mainframe, start up the prototype version of the LTE on my VM, run a transaction on CICS and have it try to communicate with LTE, analyse any errors or issues that occurred by running and then reviewing a GTF trace on the mainframe, and fix any bugs I identified on the SDM. I would then try again, effectively repeating the process, or try something different…

I recall that by the end of my first secondment I had established a functional LTE-to­CICS connection using SNAP-IX. I then returned to LzLabs to continue developing LTE. During this period, after my first secondment, I established further SSH connections with the Airlock to configure and install software on the NUC, e.g. further test versions of LTE…

I wrote a REXX program tool on the Winsopia mainframe. It extracted all of the EXEC CICS and EXEC SQL commands out of what I think was a customer’s source code…

Ultimately the secondments allowed me to achieve LTE-to-CICS interoperability using both SNAP-IX and IPIC.”

In cross-examination, Mr Taylor explained that the secondments enabled him to set up his own tests on the mainframe and view the results of unredacted GTF traces, so that he could develop LTE more efficiently and more quickly:

“Q. Yes. So I mean, ultimately, what you wanted to do, and in fact what you ended up doing was setting up your own tests on the mainframe and seeing the results of traces directly yourself on the mainframe?

A. Correct. That was the purpose of the secondment.

Q. Yes. So I mean, upper level, I mean, the purpose of your secondment was so that you could develop LTE more efficiently and more quickly?

A. Correct.

Q. And it may be obvious, but it wasn't to deal with, for example, a customer emergency? Things weren't breaking at the customer side?

A. No, no customer had this code.

Q. No. And you weren't assisting in running the DR system?

A. I'm not sure what you mean by "assisting in running".

Q. You weren't going over to Winsopia to help them run the DR system?

A. No, I was not.

Q. Or to assist with a support issue relating to one of -- with Lz's customers?

A. No, I was not.

Q. It was all about you and your work on LTE, wasn't it?

A. Yes, it was.”

Mr Taylor accepted in cross-examination that, while on secondment, he was able to work on developing the SDM code simultaneously with the mainframe access. He was able to look at unredacted GTF traces and make substantive changes as a direct and immediate result of what he saw on the mainframe. The REXX program he wrote extracts, lists and counts EXEC CICS commands and EXEC SQL commands. Although he was not permitted to make any SDM source code changes whilst at Winsopia, as soon as he returned from secondment he committed the changes he had made to the Git repository.

The experts agreed in their second joint statement that:

The defendants’ case is that whilst he was at Winsopia, Mr Taylor was part of Winsopia’s Enterprise; therefore, his use of the mainframe was for the Customer’s authorised use and complied with IBM’s terms regarding ICA Programs. Although he remained employed by LzLabs, he was reporting to Winsopia, using Winsopia equipment, and working with other Winsopia staff in order to complete tasks, that fell within Winsopia’s responsibility under the Services Agreement but for which it lacked the necessary expertise.

I reject the defendants’ submissions for the following reasons. Firstly, the Supply of Staff Agreement provided that each secondee would remain employed by LzLabs for all purposes and would continue to be paid by LzLabs. Although it also provided that each secondee should report to Mr Rastall at Winsopia and carry out work at his direction, in fact, as Mr Taylor confirmed in cross-examination, this did not accurately reflect the conditions under which he worked at Winsopia or the work that he carried out. Mr Rastall stated in cross-examination that Mr Taylor was issued with an electronic pass, which allowed him to come and go as he pleased and gave him access to the mainframe room at Winsopia. He continued working in furtherance of his development of the LTE, a project for LzLabs. Therefore, this was not a genuine secondment.

Secondly, even if treated as a consultant, Mr Taylor did not carry out work that Winsopia was entitled to do under the terms of the ICA. As set out in respect of Item 13 above, use of the GTF facility to collect VTAM buffer traces that disclosed details of the CICS-to-CICS communications amounted to reverse engineering. If Mr Taylor had been acting as an employee or agent of Winsopia during the secondments, his activities would have amounted to reverse-engineering of the CICS Transaction Server for z/OS, v.5, an ICA Program. Further, Mr Taylor’s activities were not permitted pursuant to Articles 5(3) and/or 6 of the Software Directive for the reasons set out in respect of Item 13 above. Therefore, the defendants’ arguments in reliance on the decision in SAS do not provide any defence.

Thirdly, the defendants correctly point out that the GTF traces were reviewed by an external lawyer, Mr Hedley, and redacted before being sent to LzLabs through DR0235. But that ignores the fact that Mr Taylor, an LzLabs’ employee, was given access to study the unredacted CICS-to-CICS traces at Winsopia, so that he could understand how the communications worked from one CICS region to another CICS region; in particular the data formats in which CICS sent and received instructions and data once a connection (or handshake) was established.

Fourthly, Mr Taylor’s evidence was that he took a copy of the SDM into Winsopia, which he worked on whilst he had access to the mainframe. The Git commit records show that Mr Taylor made a number of commits to the SDM Git repository shortly after each of his visits to Winsopia. Professor Donaldson examined some of the Git commits and concluded in his third report that they mainly related to establishing, testing and debugging support for inter-system communications (“ISC”) between the LTE running on the SDM and a remote CICS region and integration of the SNAP-IX tool. The changes made in the Git commits included (i) the addition of a new code file implementing CQP, an IBM protocol; and (ii) the addition of code implementing XLN, an IBM feature whereby, when an ISC session is established between two CICS regions, the name of the system log being used on each system is passed to the other system. A screenshot of the Git record for 10 October 2014 shows that Mr Taylor made 517 changes to CQP and 938 changes to XLN. In cross-examination Professor Donaldson agreed that Mr Taylor’s examination of the mainframe at Winsopia could have informed his understanding of how the ISC worked, so as to prompt those Git commit changes. Given the nature and timing of the changes made, I find that on the balance of probabilities Mr Taylor used the knowledge gleaned from his study of the CICS-to-CICS communications on the Winsopia mainframe to develop the LTE on the SDM.

In summary, regardless of whether he was formally seconded to Winsopia, Mr Taylor remained an employee of LzLabs and his activities entailed development of the LTE for LzLabs as part of the SDM. Access to the Winsopia mainframe and permission to use the ICA Programs given by Mr Rockmann to Mr Taylor amounted to a breach of clauses 4.1 and 4.1.2(b) of the ICA.