Free Code, Hidden Legal Risk: Study Finds Big Problems in Security Software
One stray line of borrowed code could cost your company millions in lawyers.
The study also found a surprising amount of code with no copyright attribution — essentially recipes with the chef's name torn off. That makes problems harder to trace and fixes harder to negotiate. The authors say their findings should help three groups: managers who need to understand how contamination creeps in, open-source volunteers who can protect their own work by labelling it properly, and entrepreneurs choosing which security tools to build on. Their advice is unglamorous but practical: track where your code came from, read the fine print, and keep records. The paper was published in the Technology Innovation Management Review.
- Researchers examined over 200 free cybersecurity software projects and found many labelled 'free to reuse' actually contain code with strict legal strings attached
- Using that code in a paid product can trigger lawsuits, forced code rewrites, or an obligation to publicly release your own private code
- A large share of the code had no author credited, making legal problems harder to trace and fix
Why It Matters
If your company builds or buys software, unchecked borrowed code can mean lawsuits, surprise bills, and forced rewrites.