Validity of audit request
Validity of audit request
During 2020, Mr Anzani of IBM Corp held initial discussions with Mr Cresswell about a future partnership between IBM Corp and LzLabs. The question of a potential intellectual property infringement on the part of Winsopia was first raised by Mr Anzani in a letter dated 24 November 2020.
Shortly thereafter, by letter dated 3 December 2020, Mr Anzani of IBM Corp wrote to Winsopia in the following terms:
“… I write to inform Winsopia that IBM will be conducting an audit of Winsopia's compliance with the terms of the IBM-Winsopia Agreements.
Before commencing the in-person portion of the audit, IBM therefore seeks the following preliminary information from Winsopia:
• A list of all IBM ICA Programs and other IBM Programs (collectively, the "IBM Software) used by Winsopia for any purpose in the past 36 months;
• A list of all Designated Machines pursuant to the IBM-Winsopia Agreements;
• A list of all machines on which any copy of any IBM Software, is or has been stored or executed in the past 36 months, including their location, platform (e.g ., z/OS, z/VM, z/Linux, z/VSE, Windows, or Linux), purpose(s) for which they are or were used, and a list of all the third party software installed on, running on, or accessible through such machines in the past 36 months;
• A system diagram showing how all the machines identified in the prior two bullets are interconnected, and have been connected in the past 36 months;
• For any z/OS machines identified above, provide the results of the following z/OS DISPLAY commands: …
• A listing of all persons and entities that have used, analyzed, or otherwise accessed the IBM Software in the past 36 months, as well as their locations and employer during that period;
• Confirmation that no employee or agent of LzLabs has used the IBM Software;
• Confirmation that no employee or agent of LzLabs or any of its affiliates has been provided with any information discerned from operating or testing the IBM Software;
• Confirmation that the IBM Software was not used in connection with the development of LzLabs' Software Defined Mainframe offering;
• A list of all uses of the IBM HLASM Toolkit Disassembler, the persons using it, and the programs on which it was used, in the past 36 months;
• An identification of any attempt to disassemble or reverse engineer any IBM Software, in the past 36 months. The response should include an identification of each use of the IBM Software licensed to Winsopia to attempt to develop software to replace IBM Software, including to attempt to develop software-defined mainframe software to replace IBM Software. The response should also include identification of any IBM Software that was executed or run in an LzLabs SDM or other x86 environment, e.g., through the use of an emulator or other facility to translate the software into x86 instructions;
• An identification of any affiliates of Winsopia, at present or in the past 36 months;
• All SMF data records in Winsopia's possession; Certification Requirements …
Please provide the above information no later than thirty days after receipt of this letter. Once a satisfactory response is received, we will contact you to discuss scheduling and procedures for the in-person phase of the audit.”
Winsopia replied by letter dated 23 December 2020, refusing to supply the information requested and making the following points:
There was no prior notice of the audit and the letter asked for a considerable amount of information to be provided within 30 days during the COVID global pandemic and over a holiday period.
Winsopia’s relationship was with IBM and there was no obligation to provide any information to IBM Corp.
The letter did not identify any contractual entitlement to a number of the categories of information sought, which included confidential information and personal data disclosure.
Mr Anzani’s earlier letter had suggested possible infringement of IBM’s intellectual property rights but provided no basis for such allegations.
By letter dated 12 January 2021 Mr Wallin of IBM wrote to Winsopia, disputing the suggestion that IBM Corp could not request the information but repeating the request in his capacity as an officer of IBM. He gave notice that Winsopia was in material breach of its obligations under the ICA and associated agreements and invited Winsopia to cure that breach by providing the requested information in response to the audit demand within 30 days. IBM gave notice of its intent to terminate the agreements in the absence of such compliance.
Mr Rockmann of Winsopia replied by letter dated 8 February 2021, making the following points:
Winsopia was not in breach of any obligation; its contractual obligations were to IBM and not to IBM Corp.
As Winsopia was not in breach, Mr Wallin’s letter did not constitute valid notice under the ICA, and IBM had no right to terminate Winsopia's licences.
The ICA required IBM to allow Winsopia a reasonable opportunity to comply before alleging breach, and to attempt in good faith to resolve all disputes, disagreements or claims but this had not been done.
Before any confidential information would be exchanged, the ICA required a separate signed confidentiality agreement between Winsopia and IBM.
The audit request did not give sufficient details of the provisions in the ICA and associated agreements in respect of which IBM sought information and materials to provide auditable verification of Winsopia's compliance.
The 30-day time frame for compliance was not reasonable and would cause disruption to Winsopia’s business, especially in the context of the pandemic conditions.
Winsopia expressed concern that the compliance verification provisions of the ICA were being invoked by IBM in a wide-ranging way, not merely to verify Winsopia’s compliance, but also for purposes of IBM’s commercial advantage, which included anti-competitively trying to gain indirectly non-public and confidential information about LzLabs, its intellectual property and its SDM product.
Winsopia was not refusing to provide information or materials to which IBM was contractually entitled but required further details as to the purpose for which the information was sought and the contractual provisions to which the questions related.
By letter dated 24 February 2021, IBM notified Winsopia that it was terminating the ICA and associated agreements, on the grounds that: (a) Winsopia’s refusal to provide the requested information in response to IBM’s audit demand; and (b) use of the licensed IBM software outside the Winsopia Enterprise, were breaches of the ICA and associated agreements, which breaches Winsopia had failed to cure.
By letter dated 1 March 2021, Winsopia disputed the validity of the purported termination and sought to affirm the ICA and associated agreements.
By letters dated 29 July 2024, Winsopia purported to terminate the ICA and other licence agreements as from 31 August 2024.
The relevant contractual audit provisions were:
Clause 4.4.1
“IBM’s right to verify the Customer's usage data and other information affecting the calculation of charges also includes the right to verify the Customer’s compliance with other terms of this Agreement (including applicable Attachments and Transaction Documents) relating to the Customer’s use of ICA Programs at all sites and for all environments in which the Customer installs or uses ICA Programs for any purpose. IBM may use an independent auditor to assist with such verification, provided IBM has a written confidentiality agreement in place with such auditor.”
Clause 4.4.2
“The Customer agrees to create, retain, and provide to IBM and its auditors written records, system tools outputs, and other system information sufficient to provide auditable verification that the Customer’s installation and use of ICA Programs complies with the Agreement terms, including IBM's applicable licensing and pricing terms. IBM will notify the Customer in writing if any such verification indicates that the Customer is not in compliance with Agreement terms. The rights and obligations in this section remain in effect during the period any ICA Programs are licenced to the Customer and for two years thereafter.”
Clause 1.11.4 provided that each party would allow the other a reasonable opportunity to comply before claiming that the other had not met its obligations under the ICA; further, that the parties would attempt in good faith to resolve all disputes, disagreements, or claims between the parties relating to the ICA.
Clause 1.11.5 provided for the exchange of any confidential information to be made under a separate, signed confidentiality agreement.
The starting point is that clauses 4.4.1 and 4.4.2 gave IBM a contractual right to verify Winsopia’s compliance with the ICA and associated agreements.
The audit request set out in IBM’s letter dated 12 January 2021 was a valid request pursuant to clause 4.4.1 of the ICA. It was sent on IBM headed notepaper by Mr Wallin of IBM, who had at least ostensible authority to send it, and who reiterated the requests for information in connection with the audit as set out in Mr Anzani’s earlier letter of 3 December 2020. This did not simply repeat the request by IBM Corp but made the same requests on behalf of IBM.
The requests for information and the period allowed for compliance were reasonable. Although the audit request sought a substantial amount of documentation, much, if not all, of the information would have been available readily in electronic form by straightforward searches, which could have been carried out remotely, as Mr Rockmann accepted in cross-examination, and were therefore unaffected by the pandemic. Despite that, Winsopia failed to provide any such information, or explain why any particular categories of information might be difficult to provide. Even if Winsopia had legitimate reasons for its inability to provide all requested information within 30 days, it failed to give any indication as to when it would start to comply with the request.
It was not incumbent on IBM to explain or justify the purpose for which it required the information. It was sufficient that it identified the contractual provisions pursuant to which it was entitled to carry out the audit and to receive the information requested. The ICA did not contain any express or implied obligations of good faith in respect of the contractual audit entitlement. Clause 1.11.4 of the ICA contained an obligation of good faith on both parties to attempt to resolve all disputes, disagreements or claims between the parties but this did not override the express provisions entitling IBM to carry out an audit.
Clause 1.11.5 provided for any exchange of confidential information to be subject to a separate, signed confidentiality agreement but that was subject to the proviso that confidential information exchanged in connection with any Product or Service under the ICA was covered by the applicable confidentiality agreement incorporated in and subject to the terms of the ICA. For the purposes of the audit request, a separate confidentiality agreement was only required in circumstances where an independent, third party carried out the audit. In any event, much of the information sought by IBM was not confidential. In particular, details of the software and hardware in use were not confidential to Winsopia, nor was the request for Winsopia to confirm that LzLabs had not used the IBM software, or information derived from testing the IBM software, in development of the SDM.
It follows from the above, that the audit request by IBM was valid and Winsopia’s refusal to comply with it, or supply any of the information requested, amounted to a breach of the ICA.
- Heading
- Mrs Justice O’Farrell
- Section II - Background to the dispute
- The SDM
- Hercules
- Neon litigation
- Formation of LzLabs and Winsopia
- The ICA
- SDM development and the clean room procedures
- Launch of the SDM
- Project Eiger
- Further development of the SDM
- Audit request and termination
- Section III - The proceedings
- The Issues
- The factual witnesses
- Section IV - Construction of the ICA
- Approach to construction of the ICA
- Scope of licence
- The ICA Programs
- Customer applications
- Licensed Program Specifications
- Independent software vendors (ISVs)
- Debugging tools
- Restrictions on use of ICA Programs
- Legislative framework
- Berne Convention
- TRIPS
- WIPO
- Software Directive
- Copyright, Designs and Patents Act 1988 (CDPA)
- Applicable legal principles
- Conclusions on ICA
- Section V - Alleged breaches of the ICA
- Disassembly, decompilation and translation
- Item 2: Load Module Decompiler (“the LMD”) (Paragraph 11.2 of the Technical Particulars)
- Item 3: CICS Control Blocks Document (Paragraph 11.3 of the Technical Particulars)
- Item 4: EXEC DLI (Paragraphs 27.18 & 28.19 of RRRAPOC)
- Item 5: IBM Binder Software (Paragraph 11.4 of the Technical Particulars)
- Compiler listings – summary of the dispute
- Item 6: IGZCIVL COBOL runtime module (Paragraph 11.6 of the Technical Particulars)
- Item 7: CICS Translators (Paragraph 20.1-2 of the Technical Particulars)
- Item 8: Floating point rounding rules (Paragraph 20.3 of the Technical Particulars)
- Item 9: IBM PL/1 compiler (Paragraph 20.4 of the Technical Particulars & Paragraph 27 of the POC)
- Item 10: XML Parse statements (Paragraphs 33-38 of the Technical Particulars)
- Item 11: COBOL initialisation, branching and I/O declaratives (Paragraphs 27.4&27.5 RRRAPOC)
- Item 12: PL/I Condition handling (Paragraphs 27.10-27.12 of RRRAPOC)
- Reverse engineering through the systematic use of traces, dumps, slip traps, packet sniffing and other debugging tools techniques – summary of the dispute
- Item 13: CICS-to-CICS communications (Paragraph 28.1 of the Technical Particulars)
- Item 14: AMBLIST analysis of CICS Stubs (Paragraph 28.2 of the Technical Particulars)
- Item 15: Colesoft z/XDC and COBOL initialisation (Paragraph 28.3 of the Technical Particulars)
- Item 16: XDC and IMS (Paragraph 28.4 of the Technical Particulars)
- Additional examples
- Item 17: SLIP Traps and CICS (Paragraph 28.5 of the Technical Particulars)
- Item 18: SLIP Traps and COBOL (Paragraph 28.6 of the Technical Particulars)
- Macros and Copybooks - introduction
- Macros (Paragraphs 32.1-32.9 of the Technical Particulars) – summary of the dispute
- Item 19: DR-3246 (Paragraph 32.1 of the Technical Particulars)
- Item 20: DR-10237 (Paragraph 32.2 of the Technical Particulars)
- Item 21: DR-2753 (Paragraph 32.3 of the Technical Particulars)
- Item 22: DR-2771 (Paragraph 32.4 of the Technical Particulars)
- Item 23: DR-2796 (Paragraph 32.5 of the Technical Particulars)
- Item 24: DR-3280 (Paragraph 32.6 of the Technical Particulars)
- Item 25: DR-4281 (Paragraph 32.7 of the Technical Particulars)
- Item 26: DR-4322 (Paragraph 32.8 of the Technical Particulars)
- Item 27: DR-0847 (Paragraph 32.9 of the Technical Particulars)
- Macros - discussion
- Copybooks (Paragraphs 2.1.1.3 and 32.10-32.12 of the Technical Particulars) – nature of the dispute
- Item 28: DR-715 (Paragraph 32.10 of the Technical Particulars)
- Item 29: DR-753 (Paragraph 32.11 of the Technical Particulars)
- Item 30: DR-756 (Paragraph 2.1.1.3 of the Technical Particulars)
- Copybooks - discussion
- Transferring “unscrubbed” materials
- Item 31:Epiphany
- Item 32: Db2 Catalog table metadata
- Item 33: DSS dump
- Item 34: Kednos
- Item 35: CSECTs deliberately omitted from scrubbing
- Items 36 and 42: Unscrubbed CSECTs
- Items 37 and 40: IMS PROCLIB & DLIBATCH
- Item 38: DFHEI1 module
- Item 39: IGZXANE
- Item 41: IGZXNE3N
- Item 43: CEEBETBL, CEEBLLST, IBMPINPL & CEESG*
- Item 44: DR-4617
- Item 45: DR-171
- Item 46: Scrubbing failures
- Item 47: @@TRGLOC CSECT
- Item 48: PARMLIB & PROCLIB
- Use outside Enterprise and beyond Designated Machine
- Item 49: Brad Taylor (Paragraph 44.2 of the Technical Particulars)
- Item 50: Winsopia Pizzabox (Paragraph 44.5 of the Technical Particulars)
- Item 51: Justin Bendich (Paragraph 44.6 of the Technical Particulars)
- Conclusions on technical breaches
- Section VI - Wrongful procurement of breach
- Applicable legal principles
- LzLabs
- LzLabs UK
- Claims against the directors
- Mr Moores
- Summary on unlawful procurement
- Section VII - Unlawful means conspiracy
- Applicable legal principles
- Knowledge of unlawfulness
- Summary on unlawful means conspiracy
- Section VIII – Audit and Termination
- Validity of audit request
- Validity of termination
- Section IX - Limitation
- Contractual limitation
- Statutory Limitation
- Deliberate concealment
- Finding - section 32(1)(b)
- Finding - Section 32(2)
- Actual or constructive knowledge – legal principles
- Date of knowledge issues
- ICA 2013
- Mr Knight - 2017
- Mr Anzani - 2018
- Conclusions
![HT-2021-000363 - [2025] EWHC 532 (TCC)](https://backend.juristeca.com/files/emisores/logo_yJUntHA.png)