[Msurrow]

At this level (govt, 6 figure+ deals) I would at least consider if this problem should have a non-tech solution, and instead have a legal/lawyer solution. In my experience (not US based though) the govt contracts are under compliance programmes as well so the govt agency’s legal/contract mgmt team would probably follow up internally on expiring contracts (ie licences) and require the owning stakeholder to either renew the contract or abandon the software. Meaning the customer would supervise itself regarding licence. But even if you don’t want to rely on self-supervision then having your lawyer spend 1 hour reaching out with a “do you need to renew your licence” at the end of a licence term would probably be much cheaper than building and maintaining an air-gapped licence solution.

[bobmcnamara]

Years back a friend of mine's startup failed when USAF pirated their software and the original customer org stopped paying for it.

Feds are DMCA immune, so no real recourse.

[atonse]

This seems very suspect.

Usually you do have recourse via procurement channels and reps. If you file a complaint with that agency stating that they’re using a license without paying for it, it will result in at least an investigation.

[michaelt]

If you got to hire the cops to investigate your own mistakes, would you hire competent, motivated folks who'd leave no stone unturned and get access to every classified, air-gapped network in search of license infringements?

I wouldn't. I'd hire some Peter Gibbons type, who only does about 15 minutes of real, actual work in a typical week. Then I'd tell them they can finish early if all their pending cases are closed.

[GabeIsko]

If enterprise corporations actually did a throughout investigation, they would probably find that a lot of their license deals have gone unfulfilled. They are really bad about this kind of stuff. It became super complicated to buy this kind of software once companies realized that they could force everything though a deal desk and try to extract as much money out of the government as possible.

We have had companies outright refuse to even give us a price when we told them we wanted to investigate buying a license. Such a PITA.

[atonse]

The acquisition and procurement departments in many government agencies are often “independent” in that they don’t directly report to the agency. They’re more like compliance people that make sure you’re completing with the procurement laws and regulations.

And unpaid software licenses are a violation.

Now maybe the client in this case may have had some kind if ownership clause, etc. but in general, procurement people tend to be pretty neutral in my experience.

Then again, over only dealt with small contracts (< $500k)

[bobmcnamara]

Practically the federal government shouted, Neener neener neener! Rules for thee but not for meeeeeee!

https://arstechnica.com/tech-policy/2008/08/air-force-cracks...

[bobmcnamara]

https://arstechnica.com/tech-policy/2008/08/air-force-cracks...

Hopefully this was fixed, but this was the standing precedent at the time.

[unethical_ban]

As soon as I saw that he put it on the employer machines at his own work before locking down a sale, they'd screw him whether he deserved it or not.

[bigfatkitten]

Sounds like having only one paying customer was the real cause of the business’s failure.

[bobmcnamara]

They've mentioned that was a valuable lesson.

[Cthulhu_]

Surely that would fail any kind of security or compliance audit?

[bobmcnamara]

This was the precedent at the time: https://arstechnica.com/tech-policy/2008/08/air-force-cracks...

[fc417fc802]

Largely agree but I want to challenge this bit at the end.

> probably be much cheaper than building and maintaining an air-gapped licence solution

I think this is an unwise attitude to take. There's something to be said for a simple picket fence. Even though someone could easily hop it if they wanted to, they lose plausible deniability and in most cases that's all that really matters at the end of the day.