We publish new blogs regularly to discuss the latest topics and trends on how to protect your innovations and investments.

Vaultinum publishes a new article every week to share its knowledge about intellectual property and digital assets.

Vaultinum - Blog

All across Europe, we are witnessing astonishing levels of growth within the tech sector, thanks to business decision makers increasingly making this area a priority for their investments. In fact, the UK is one of only three nations worldwide to have created more than 100 tech unicorns (1) – private companies valued at over $1bn. 

This means that there is no time like the present for investors and businesses to stop and reconsider their approach when it comes to reducing investment risk in tech deals.

When it comes to risk prevention, it’s a common practice for investors to concentrate their efforts on financial, legal, and operations throughout their due diligence processes, but they leave a lot to be desired when it comes to protecting themselves from software risks. Given that software is a primary asset of almost every investment in the tech sector, this is an area of focus that should be much more of a priority for investors in their overall due diligence process. 

More often than not, when tech due diligence is carried out, it tends to be implemented manually by non-experts, which then leads to an analysis which is far from comprehensive. As a result, a thorough assessment of the use of open source software of the company is lacking, which can then pose some significant risks.

In this article, we will outline exactly how inadequate open source vulnerability management can put your investments at risk and how investors can mitigate these risks in the most efficient way- through the use of an open source vulnerabiltiy scanner.

Vaultinum’s Tech Due Diligence Checklist

Open source software is software that developers can inspect, copy, modify and redistribute. This is different from application software, which is designed for end-users and does not allow developers to adapt it in any way (such as Skype or the Microsoft suite).

A huge part of the open source community is how it operates on shared values when it comes to collaboration, and it is because of these values that popular software developing website GitHub witnessed a 35% increase in the number of code repositories created in 2020 compared to the previous year. The reality is that the use of open source software can almost be considered a necessity for developers in this day and age, as fast development is essential for businesses to achieve an increased market share and gain a competitive edge.

For reasons such as these, there are many benefits to integrating open source code within the code repositories of commercial software, so let us reiterate that it certainly should not be viewed with fear by business leaders and investors.  For starters, open source code is less likely to become obsolete than in-house developed code, as developers can always rely on the support of the strongly connected open source community when it comes to the need for updates or bug fixes. That very same community can also enable organisations to overcome hiring complications and save money, as they can always work with open source developers as an alternative. 

But there’s one catch: investors will not be able to take advantage of these benefits on a long term basis if their open source vulnerability management is not thorough enough- which is often the case. 

Intellectual Property Licence Restrictions- a Threat to your Investments? 

Open source licencing can be complex, but when looking at the intellectual property side, investors need to be particularly aware of highly restrictive licencing that can come with particular code. Copyleft, or ‘non-permissive' licences, require that the redistribution of the software must be done under the same terms as stated in the original open source licence. The most commonly used copyleft licence that you must look out for is the GNU General Public Licence (GPL). 

This licence is considered as strong copyleft as it applies to modifications made to the open source code originally licenced under the GPL and also to any work that is then derived from GPL code. As a result, even if a developer uses a few lines of this GPL code, it means that their entire code base is then bound by GPL terms. If organisations choose to use code bound by restrictive licences like the GNU GPL, they must do so with the understanding that their intellectual property could in fact be at risk. 

Software Copyright Infringement- Hancom Office

In 2013, they built an open source PDF interpreter called Ghostscript into their word-processing software. Unbeknown to Hancom, Ghostscript was bound by the GNU GPL, so according to the licence's terms Hancom should have made its entire app suite open source and in effect lose its IP rights. Hancom did not provide the source code to their product (and did not elect to purchase a commercial license), which then put them in conflict with the license that Ghostscript is distributed under.)

In 2017 Artifex filed a lawsuit (2), which resulted in the US District Court ruling in Artifex's favour (3). The exact terms of this settlement of course remain confidential, but it is fair to assume that Hancom will have suffered significantly in terms of finances, reputation and its intellectual property rights. Had they have used an open source vulnerability scanner prior to implementation, this would have been reported and the situation could have been avoided.

Let’s Talk Open Source Software Licencing

Even when not as strict as the GNU GPL, all open source licences need to be carefully reviewed by businesses, so that they are fully aware of the restrictions that they must comply with. All open source licences share common principles inscribed in the ‘essential freedoms' of the open source movement, meaning that they are free to use, run, study, modify and redistribute open source software for any and all purposes. But there are so many different types of licences out there, so one piece of open source software can be very different from another. 

Differing from the hard copyleft of the GNU GPL licence, there also exists permissive licenses such as the BSD licence, the MIT licence, and Apache Licence v2.0. These licences maintain the ‘essential freedoms' of the open source community, but do not demand that these are upheld in derivative works. This means that with a permissive licence, developers are free to integrate open source software into their wider codebase without any consequences and can distribute the full software under separate licencing terms- something that is not possible with more restrictive licences. 

Due to the wide diversity of open source licencing out there, it’s standard practice that businesses should continuously monitor and assess the various open source code that is used by their developers, as part of their open source vulnerability management., in order to make sure they do not run into any unwanted non-compliance issues. 

DISCOVER VAULTINUM'S TECH DUE DILIGENCE SOLUTIONS

How to Improve Open Source Vulnerability Management.

In the pre-acquisition phase investors must ensure that they implement comprehensive software due diligence which includes an analysis of the open source licencing restrictions that come with a piece of software.  The most in-depth audits tend to use a open source vulnerability scanner, which is able to scan every line of code, combined with a review by experts, to ensure that any use of open source software is identified and assessed accordingly. 

Vaultinum's Open Source Vulnerability Scanner    

Vaultinum’s Know Your Software Tech Due Diligence offers a source code scan which acts as an open source vulnerability scanner. This reviews both the code itself as well as the business’ internal operational and development processes (such as their open source management strategy) in order to reduce and avoid any possible risks in the future.

Secondary to this, users also receive a self-auditing series of questionnaires that offers Cybersecurity, Intellectual Property, Operations, and Third-Party Software assessments.

The results of the online assessment and code audit are then reviewed by our IT experts, who adapt the recommendations to the context of the business. The report includes clear findings, illustrations, an estimated time of fix.

Speak to us today and find out more about how Vautinum’s Know Your Software Tech Due Diligence assists investors with their open source vulnerability management, giving them the reassurance needed to make informed decisions.  

(1) https://technation.io/news/tech-unicorns-dont-appear-by-magic

(3) https://www.linux.com/topic/open-source/artifex-v-hancom-open-source-now-enforceable-contract

All across Europe, we are witnessing astonishing levels of growth within the tech sector, thanks to business decision makers increasingly making this area a priority for their investments. This means that there is no time like the present for investors and businesses to stop and reconsider their open source vulnerability management.

Discover the importance of an in depth vulnerability scan when it comes to OSS risks

Reduce Your Investment Risk With an Open Source Vulnerability Scanner

Due diligence has become one of the buzzwords of the 21st century. And there is a good reason for it. After all, we live in an age of data explosion where information is easily available, but its veracity itself is in question. In such a situation, due diligence and due diligence mechanisms are essential tools in the digital economy.

 But what exactly does due diligence mean, and how it is it carried out? Are there different kinds of due diligence that apply in different situations? These are some of the questions that we'll attempt to answer today.

What Is Due Diligence And Why Is It Important?

Due diligence is a process that involves checking the validity of a position, action or status. It is the opposite of negligence, or the accepting of things at face-value. 

 The origins of the term "due diligence" can be traced back to US legislation that sought to protect investors against misinformed investments. Here, investment brokers were required to disclose all essential information about the business being invested in. In case they failed to do so, they could be held liable and faced prosecution.  However, brokers raised concerns regarding the fact that they themselves might not always have access to the required information, and in such cases, they should not be held responsible for withholding the same.  To protect brokers from wrongful lawsuits, the legislation was adapted such that so long as they exercised "due diligence" in their investigations, then they were not liable to be prosecuted for not disclosing any information they were not privy to.

 Due diligence plays an important role not just in business but, as you will see, in the overall proper functioning of the economy.  We will take a brief tour through a few of the areas that you may have encountered due diligence and in doing so, you will understand what it is and begin to see the outsize role this process has in everyday life.

 The most obvious is in the context of employment; a reference or background check is an example of due diligence.  For example, a prospective employee claims that they graduated from a prestigious university and have extensive work experience in a certain area.  The employer would verify this information with the university as well as former employers.  This type of due diligence may also involve criminal background screening.  

 In some industries criminal background screening is compulsory.  The human resources department of the potential employer, for example, conducts due diligence in this respect so as to verify the criminal status of the candidate.  

 A bank also conducts due diligence for loan applicants to make sure that they have not defaulted on previous loans or that they are not over-stretched financially and at risk of defaulting.

 Another example is that of a client who conducts due diligence on potential suppliers to check that they will be able to perform the expected services or deliver the goods at the required quantity and quality levels.  This due diligence may entail verifying references or researching a supplier’s track record or their reputation in the market.

 But due diligence is not only directed at others. Introspective due diligence is also an important part of company management and operations.  A company who has set principles for sustainable growth would want these applied at all times and across the board.  In conducting its own due diligence, it will check that:

it has appropriate policies and processes in place to comply with regulations, grow the business in a healthy and sustainable manner, maintain a culture of ethical business dealings, show that it is serious about what it represents and expects in terms of ethics and behavior,

its policies and processes are properly implemented on an ongoing basis, and

relevant information about the organization is gathered and stakeholders are aware of any issues.

Company due diligence is also essential when dealing with other businesses.  For example, clients will often expect that their suppliers or subcontractors abide by the same kind of principles as they themselves adhere to.  Why define standards and principles if these are not applied consistently across the supply chain?  

 Another important aspect of due diligence is its status as a recognized defense in litigation.  For example, in the context of an Initial Public Offering (IPO), certain parties who participated in the preparation of the IPO documentation, including the registration statement, may be able to use a due diligence defense if the registration statement contains misleading information or material misinformation.  

 Underwriters, lawyers, accountants, officers, and directors will try to show that they conducted a reasonable investigation of the information contained in the registration statement and that it was their belief, following such investigation, that such document contained no material misinformation or misleading statements. Demonstrating that such due diligence was indeed conducted will enable them to avoid liability.  

Finally, due diligence is sometimes imposed by law, and failure to conduct effective due diligence in accordance with legal guidelines can trigger liability.  For example, the US Bank Secrecy Act requires financial institutions to adopt an anti-money laundering program which is basically a due diligence policy and process.  Financial institutions need internal systems and controls, including policies and procedures, designed to help employees detect and prevent money laundering activities, a compliance officer in charge of monitoring the implementation of the program, training and awareness raising exercises and certification for senior employees, independent third-party audits to check, with impartiality, that the program is fully implemented.

As you have seen from the various examples above, in today’s world, due diligence has become a necessary aspect of conducting any business transaction. Whether you're hiring a new employee or looking to acquire a company, due diligence is an essential part of the process.

And due diligence need not be restricted to business alone. In every aspect of life today, we need to exercise due diligence in order to ensure that the required safeguards are in place to protect our interests. Whether to secure investments, perform a security risk assessment, or undertake vulnerability tests, the appropriate due diligence processes must be used to ensure the veracity of the operation.

Here, the question arises: is all due diligence the same? The short answer is: yes and no. While the basics of conducting due diligence remain the same, the exercise takes on different meanings and objectives in different settings. In the following section, we're going to look into some of the common types of due diligence that can be performed in various business situations.

What Are The Different Types Of Due Diligence?

Are you looking to open a new bank account? Or maybe you're interested in digital investments? Whatever the case, due diligence is either required or useful. In the sections that follow, we're going to introduce you to the many types of due diligence that are required to get the task done appropriately.

Acquisition due diligence is necessary when one business entity is looking to take over another business. This is a matter of common sense. After all, if you're buying something as substantial as a large business, it is essential that you perform the required background checks.

 Acquisition due diligence involves investigating the financial as well as technical prospects and viability of the business you're looking to acquire. This itself has multiple dimensions, such as:

And this is just the tip of the iceberg. Mergers and acquisitions are complex processes that require caution on multiple levels. Not only do you, as the acquirer, need to be sure that you're making a sound investment, you also have to make the seller comfortable and get as much information as possible from them. Acquisition due diligence aims to help you do just that.

Everyone who has a bank account has, knowingly or not, experienced KYS or Know Your Customer due diligence.  When providing the bank with detailed and personal information in order to open an account, the customer is helping the banks to “check the box,” so to speak.  The information provided is required in order for the banks to comply with regulations and demonstrate to regulators that they have done their “homework” in performing effective due diligence.  Banks take the information provided and check it against databases of known criminals or sanctioned persons such as the UN, OFAC, AUSTRAC and EU. The KYC information is proof that they have been diligent in ensuring that they checked who their customers are.  

 KYC due diligence is good business practice but it is not voluntary.  

 In today's complex business landscape, it's not sufficient to know just the financial side of your dealings. You also need to keep a close watch on who you're dealing with. Not performing the right background checks on business partners and customers can expose some businesses to hefty fines and lawsuits.

 That's exactly where KYC due diligence comes into the picture. This is a process aimed  at ensuring that you're entering into a business transaction with the right person. Especially in the case of financial institutions such as banks and insurance firms, KYC due diligence takes on a vital role. KYC due diligence is usually performed by financial entities when opening a new account or investment portfolio. KYC due diligence lets you know more about the person you're dealing with, their past business records, and financial performance. All this information can come in handy when assessing whether a customer is indeed a reliable entity or a risk.

 However, KYC due diligence goes beyond mere regulatory requirements. It helps your business gain greater insights into the customer and their unique needs and requirements. In this way, you can better serve your customers and enhance your business in turn.

 Another type of due diligence that must be mentioned here is enhanced due diligence. It's a stricter form of KYC due diligence and involves deeper background checks.

Also known as pre-IPO due diligence, this is a form of due diligence that involves checking whether a business is ready for its Initial Public Offering. It's essential that a financial institution carries out complete, rigorous, and thorough due diligence in order to understand the maturity status of the market before a business launches its IPO.

In IPO due diligence, experts conduct a detailed analysis of the business's legal, financial, and tax-related status. The emphasis is  on operations, IT, and HR aspects. Seen in this light, IPO due diligence is similar to acquisition due diligence.

Further, in this form of due diligence, it's important to conduct a detailed analysis of the company's business model so as to understand its feasibility and long-term sustainability. The entire process also needs to take into account the competition levels, risks, and strengths. In other words, a thorough SWOT analysis.

IPO due diligence is an essential part of the IPO process, as it helps the business understand whether they are ready for the IPO or not. It's also important for proving to the regulatory authorities, such as the SEC, that the claims made by the business are legitimate.

This form of due diligence is vital for candidates who are about to accept a position on a company board of directors. While it's no secret that joining the board as a director is a massive responsibility, with commensurate professional returns, still in recent times, top executive roles have come under intense public and legal scrutiny. As a result, it's important for any candidate to the board to conduct the required due diligence into the background of the company they're joining.

Thorough due diligence will help potential board members understand more about the role they are going to take on. It will also help them gain a detailed understanding of the company culture, business model, and general knowledge of how the board functions. Some important questions to ask include:

What is the experience level of the board, and what's their work culture?

How is the board's relationship with its investors?

Why are you being asked to join the board?

The very last question on the above list shows that the director's due diligence should not be focused only on the board but also on the candidate. Potential directors should perform a detailed self-assessment to understand how they can contribute to the board, what their limitations are, and whether they are ready to join the board at all. All this will help them to perform the role better.

Investment due diligence refers to the investigation that you should do in order to understand whether a particular investment instrument is right for you. Here, the potential investor needs to assess the product to understand its viability. This can include detailed steps such as reviewing the performance of the business in the long and short terms, taking stock of their financial records, and also public perception.

Investment due diligence is essential for corporate as well as individual investors, as it helps them understand whether to go forward with the investment. It also lets them get a clear idea of the returns they stand to gain in the short and long term. For digital investments, as well as any technology investment, due diligence is vital.

Investment due diligence, in the international context, will also involve looking at political risk and corruption issues.  

IP due diligence is usually conducted as part of acquisition due diligence. This involves assessing a business's intellectual assets before acquisition or investment. Particularly in tech-driven industries, a company's IP assets go a long way towards determining its value. These include copyrights, patents, and trademarks, among others.

This type of due diligence is vital in the context of today's environmental impact awareness. It involves assessing the health, safety, and environmental issues associated with the business. Other aspects that should be taken into account are environmental regulatory compliance, sustainability assessment, and contamination studies.

Apart from the above-mentioned types of due diligence, different industries may have additional and different forms of due diligence. Due diligence can also be divided into hard and soft due diligence.

Hard due diligence is where the entire exercise is dependent on factual and quantitative data. This is the kind of due diligence that's traditionally carried out, and the most significant portion of due diligence exercises fall under this bracket.

Soft due diligence, on the other hand, is more people-centric and concerns the human segments of a business. Recently, this has become an integral part of the due diligence process and looks at the cultural and organizational structure of a company.

Due diligence is no doubt one of the essential aspects of any modern business transaction. However, it requires expertise, experience, and insights that a regular team of professionals might not always possess. While it's always an enticing option to conduct due diligence yourself, the best and most objective results can only be obtained from an independent agency.

Companies specializing in due diligence services can help with background check screening, supplier checks, and credit checks.  

Vaultinum is a provider of a specific type of due diligence service.  As a technology company, Vaultinum has developed a due diligence platform to help:

private equity investors evaluate potential investment or acquisition targets,

Vaultinum’s Know Your Software  solution is a due diligence tool focused on helping clients to understand a digital asset from a variety of perspectives, including sustainability, corporate governance, software sustainability, IP protection and management, and security.  

With a dual expertise in IT and Legal, and over 40 years of experience, Vaultinum is here to help you with all your technology due diligence needs.    

The opinions, presentations, figures and estimates set forth on the website including in the blog are for informational purposes only and should not be construed as legal advice. For legal advice you should contact a legal professional in your jurisdiction.

The use of any content on this website, including in this blog, for any commercial purposes, including resale, is prohibited, unless permission is first obtained from Vaultinum. Request for permission should state the purpose and the extent of the reproduction. For non-commercial purposes, all material in this publication may be freely quoted or reprinted, but acknowledgement is required, together with a link to this website.

Due diligence plays an important role not just in business but, as you will see, in the overall proper functioning of the economy.  This article will take you on a brief tour of the different types of due diligence and in doing so, you will understand what it is and begin to see the outsize role this process has on our everyday lives.

What is Due Diligence and why is it important? This article explains the different types of due diligence and the impact it has on everyday life

If 2021 was a big year for European dealmaking, 2022 looks set to be even better. 

Currently the UK is western Europe’s M&A hotbed, accounting for more than 32% of deals in 2021 (1) and has seen a £1.1 billion increase in domestic M&As in quarter 1 alone, when compared with the same period in 2020 (2). This success looks set to continue well into 2022 with the Ansarada UK Dealmakers Survey showing that 90% of their respondents (senior executives from 50 UK-based firms across investment banking, private equity, and M&A) believe that the number of M&A deals in the UK will increase in the next 12 months, with 54% believing it will increase significantly. (3)

Taking this into consideration, M&As are clearly a focal point for accelerated organisational growth and development as we look to the year ahead. But how can investors take advantage of this promising landscape whilst ensuring that they don't fall victim to the ever-increasing threat to cyber security?

Traditionally, organisations and investors have conducted due diligence covering financial, legal, operations, and human resources. However, when it comes to conducting due diligence of software, this is not always met with the same systematic approach.  Often, this is due to the speed at which organisations are implementing new technology in their everyday operations and partly due to the rapid growth of tech-forward companies. With technology increasingly becoming a primary asset to businesses, new issues have arisen which are overlooked in traditional due diligence.

Recent statistics have highlighted that cyber-attacks are rising sharply in the UK. According to Sophos data, last year 51% of UK organisations were affected by ransomware attacks, with criminals successfully encrypting data in 73% of these attacks (4). Considering these figures, a comprehensive due diligence that assesses both software and source code during the pre-acquisition phase is integral to provide the acquirer with a full view of the potential data breach risks that could lead to serious financial and legal consequences. Furthermore, for those acquiring or merging with a pre-existing company, they run the risk of inheriting hidden data vulnerabilities which can significantly impact the primary company’s business operations, investor relations and reputation.

One of the most renowned cases of insufficient software due diligence resulting in catastrophic consequences is that of Marriott International after their merger with  Starwood Hotels & Resorts. Two years down the line, it was revealed that a huge data breach in Starwood’s reservation system had occurred pre-merger, in which 400 million guest records were exposed through a security flaw. This resulted in a $123 million GDPR fine by Britain’s Information Commissioner’s Office, as well as reputational damage for both Marriott and Starwood.

But if only the issues ended with hidden data vulnerabilities. For any M&A activity in which the target company’s software is a significant asset of the deal, investors must also consider the potential restrictions that open-source software (OSS) can bring. Today, software developers often rely on public code repositories available on websites like GitHub or Stack Exchange, as it appears to be free at the point of use. However, often these licences are offered subject to conditional restrictions. When using OSS to create derivative products or linking source code to OSS, the integrated product becomes subject to these conditional restrictions, which can include making all or part of the code public or paying a fee for its use. In other words, a company may not have full rights to their product or software.

If acquirers carry out a comprehensive due diligence during pre-acquistition, this can help to avoid liability for the target’s previous use of OSS, and any terms relating to its licencing. And bad news for the software supplier, if OSS is found embedded in their software, investors may walk away from the deal entirely, or at the very least adjust its value and/or terms.

But how to avoid these issues? The first step lies within ensuring that investors have carried out a comprehensive software due diligence during the pre-acquisition phase. Following the advances in AI technology, audits like these can be performed through automised tools which thoroughly analyse every line of code to identify any possible cyber vulnerabilities, intellectual property issues and maintainability risks. 

Vaultinum’s Know Your Software Tech Due Diligence

Vaultinum’s Know Your Software Tech Due Diligence offers an online solution for software due diligence that helps businesses and tech investors mitigate risk, gain crucial knowledge of a firm’s technology and increase the value of the software assets. 

Know Your Software Tech Due Diligence offers an online self-audit (Know Your Software Self-Assessment,) which analyses Intellectual Property, Cyber Security, Third-Party software management and Software development as well as an in-depth software source code scan (Know Your Software Code Audit) which provides a thorough risk analysis of the software asset, which is evaluated by IT experts. 

Automated tools such as the Know Your Software Code Audit enrich the traditional tech due diligence by making audits more objective and less susceptible to human error, ensuring that the acquirer’s reputation, business and liability remains protected and in the best possible position to make bold business decisions.

(2) www.ons.gov.uk/businessindustryandtrade

(3) www.ansarada.com/blog/UK-M-A-set-to-surge-in-2022

If 2021 was a big year for European dealmaking, 2022 looks set to be even better. Currently the UK is Europe’s M&A hotbed, accounting for more than 32% of deals in 2021 and seeing a £1.1 billion increase in domestic M&As in quarter 1 alone. Now as we look to the year ahead, M&As will clearly be a focal point for accelerated organisational growth and development making technology due diligence more important than ever.

Discover how investors can protect themselves by performing thorough technology due diligence

Due diligence is a risk assessment tool used prior to an acquisition or investment of various forms.  This duty of diligence is mainly present in the acquisition process of target companies.  In the context of these large-scale transactions, it is necessary to implement an in-depth audit in order to limit the acquisition risks inherent to this operation.  This due diligence scrutinizes the entire life of the target company and permits the validation or adjustment of the value.  This audit must be carried out ethically and independently.

Due diligence is the process by which a company verifies the financial, legal and administrative status of each business to be acquired or assimilated in the context of a merger.  The audit carried out takes into account the target company's history, its current actions, and also its projections. 

Due diligence is a precautionnary principle.  The acquisition of one or more companies is a complex process involving different parties with possibly divergent interests.  Moreover, the in-depth study of heterogeneous elements requires particular attention from the parties involved.  Respecting the due diligence process is therefore crucial for the acquirer who will not be able to rely on his ignorance to protect himself legally in case of a post-acquisition problem.  This principle echoes the notion of "caveat emptor" which requires the buyer to be prudent.

Although due diligence process is not a legal obligation,it is nevertheless part of a precautionary strategy to better secure the capital invested in a major transaction.

Beyond the duty of diligence of any company that engages in a transaction that mobilizes a high level of capital, due diligence is part of a global strategic action.  The audit carried out allows for better visibility of the state of play and the projections of the target company and whether they correspond to the reality on the ground.  One may also conduct a social audit to determine the strength of the human capital, or a financial due diligence to examine the key elements of the target company's economy.  The audit should also cover the assessement of assets and liabilities, results and the level of debt.  If some elements are not consistent with the information provided during the previous negotiations, this will open the door to a price reduction.

Ideally, due diligence should include an industrial audit of technological risks and the risk of an intellectual property right infringement.  This establishes whether the company is the owner of the intangible assets, and allows appropriate measures to be taken if this is not the case (transfer, assignment, etc.).  Intellectual property rights have a central role in most companies and as such, their protection is essential.

Let's take the example of a company whose main asset is software.  The acquisition of such a business requires a thorough study of the software, particularly its content, the use of open-source licenses, ownership of the source code and its maintenance.  To assist in this complex assessment, Vaultinum has developed a series of solutions to audit software, "Know Your Software".

Originally used for the acquisition or merger of companies, due diligence now also covers other areas such as banking and credit institutions. 

Before granting credit, a lender must, among other things, ensure the solvency of its client.  In most countries, it is mandatory for financial and banking institutions  to be vigilant about the origin and destination of the funds they handle.  The objective of the duty of vigilance is to reduce the rate of toxic credits, as well as the risks of money laundering and the financing of criminal organizations.

Industrial property rights and copyrights

Due diligence also applies in the field of intellectual property (IP), whether to assess industrial property rights (trademarks, designs and patents) or literary and artistic property rights (copyright covering software in particular).  All of these rights constitute considerable intangible capital for a company, which is often difficult to evaluate.  Due diligence therefore makes it possible to highlight the IP rights of a target company and to anticipate any difficulties arising from poor management. The audit makes it possible to identify problems that can be solved through, for example, a transfer of rights, in order to prevent any litigation.

The due diligence procedure must also determine whether the target company has set up a system to secure personal and professional data. Verification of the security of information systems is nowadays an unavoidable step in any due diligence procedure.  Failure to do so can have legal and financial consequences for the new entity.  The analysis of risks related to the security of information, particularly confidential information, is therefore essential.

Due diligence, an audit to be carried out by an independent entity

To be fully exploitable, the due diligence audit must be performed by an entity that is totally independent from the companies involved.  Depending on the size of the organization to be audited, the procedure sholuld be carried out by a consultant or a specialized firm.  The auditor must not have any link to the structure audited.  If so, there would be a conflict of interest and the conclusions would be deemed biased. 

The choice of auditor is essential in order to have a report that reflects the reality as faithfully as possible.  It is essential to consult the auditor's previous work to ensure that their field of expertise is in line with that of the company being audited.

What is the price of a due diligence audit?

The cost of due diligence depends on the scope of the areas to be audited.  The price can vary considerably depending on the complexity of the assignment and the number of departments covered (financial, legal, human resources, information system, cyber security, etc.).  If the due diligence audit is multidisciplinary, the cost can quickly increase.  The quote presented by the service provider must be detailed.  However, this cost must be put into perspective with the economic, possibly catastrophic, consequences of a merger or acquisition that could have been avoided by such audit.

Due diligence is a business tool for assessing the risks involved in large transactions, particularly in the context of mergers and acquisitions. It is above all a duty of diligence that requires the implementation of an in-depth audit that will highlight potential dangers in order to mitigate them.

Learn more about how due diligence helps to assess the risks of large transactions, particularly in mergers and acquisitions

Due diligence: the precautionary principle in business 

Almost two years after the study carried out by the European Commission for the evaluation of Directive 96/9 /CE raising the question of its abolition because of the legal uncertainties it would create, this judgment implements the legal regime, in a clear and didactic way, and thus restores a certain vigor to the sui generis right of database producers. 

Following a partial contribution of assets agreement  of June 28, 2011 concluded with the company SCM France (now Schibsted France), the LBC France company operates the Internet site "leboncoin.fr" on which can be published small online ads, including real estate, listed and classified by regions, as well as by categories. The company Entreparticuliers.com operates a website that offers individuals an advertisement hosting service mainly for real estate. Within the framework of its activity, the latter has subscribed to a real estate freelance service from a service provider, who collects and transmits daily to its professional subscribers new real estate listings published by individuals, especially online. 

Believing that the implementation of this process was a total, repeated and systematic extraction from the database properties of its website about which many users had complained, the LBC company invoked a bailiff's report of the “entreparticuliers.com” website relating to the proportion of advertisements selected at random. The LBC company then filed a suit against the company Entreparticuliers.com prohibiting these practices and compensation for the damage suffered, on the basis of the infringement of the sui generis right of database producers of Articles L. 341-1 and L.342-2 of intellectual property code.

The Paris Tribunal de Grande Instance granted its requests: the court considered that (i) the website "leboncoin.fr" constituted a database in the sense of article L.112-3 of the intellectual property code of which LBC France is the producer, and (ii) that by proceeding with the extraction or the repeated and systematic reuse of qualitatively or quantitatively substantial parts of the LBC database content, the company Entreparticuliers.com had infringed its right as producer of the database. 

On appeal, in addition to requesting the inadmissibility of the requests made by LBC France for the “real estate” sub-database, the Entreparticuliers.com company attempted to deny to LBC France the two essential criteria for recognition of the right of database producers, which are the initiative and the risk taken by the producer and the substantial financial, material or human investment.

Moreover, they denied any extraction or reuse of disputed data. The court did not agree.

The quality of database and sub-database producer

Article L. 341-1 of the Code of intellectual property defines the database producer as "the person who takes initiative and risk of the corresponding investments ”. In the present case, the company Entreparticuliers.com contested the quality of database producer of the company LBC France, on the grounds that the company LBC France would not have taken any initiative, nor run the slightest risk in producing the database, since it had been constituted by the SCM France company prior to the registration of LBC France. The Entreparticuliers.com company claimed that LBC France had a purely technical, automatic and passive role, which would be incompatible with that of a database producer.

The court refutes this argument and considered that although the database had been created by another company, all risks have been assumed and all related investments were supported by the company LCB France since August 2011 following the conclusion of a partial contribution of assets agreement. In addition, the court affirms that the quality of host of the company LBC France is not incompatible with the protection of the sui generis right of the database producer since the operations of verification of the announcements carried out at the time of the constitution of the database and its operation can be established. Consequently, the court considers that the LCB France company can take advantage of the quality of database producer according to article L. 341-1 of the intellectual property code, provided that it can prove a substantial investment.

Thus, several owners may claim protection by the right of a database producer on the same basis as long as they can demonstrate that each has made substantial investments on that basis. In addition, there is no incompatibility between the quality of host and that of a database producer.

If the quality of host within the meaning of article 6-I-2 of the law of June 21, 2004 implies that it exercises a role that is “neutral, and that its behavior is purely technical, automatic and passive , implying the absence of knowledge or control of the data it stores”, this role does not exclude verification operations intended “for ensuring the reliability of the information contained in the database, for the control of the accuracy of the elements searched, during the constitution of this database as well as during its operation period”.

On the contrary, the databases protection by the sui generis right would probably be excluded if the LBC France company had played an active role during the creation of the database, since the protection is excluded when the verification operations are carried out “during the creation phase of elements subsequently collected in a database do not fall under this notion”.

Substantial financial, material or human investment

In addition to the quality of producer, the protection by the sui generis right offered by Article L. 341-1 of the Intellectual Property Code is based on the notion of investment: the producer "benefits from content protection when its constitution, verification or presentation attests to a substantial financial, material or human investment”. In application of this text, the investment must be assessed at several levels.

In the present case, the court successively examines whether the constitution, verification or presentation of the database contents actually attests to a financial investment.

Investments related to the constitution of the content of the database

Firstly, the substantial investment may be related to obtaining the database contents. As the court noted, the CJUE clarified the notion of investment linked to obtaining the database content in four judgments delivered on November 9, 2004.

Thus, the CJEU indicated that "the notion of investment linked to obtaining the content of a database should be understood as referring to the means devoted to the search for existing elements and their gathering in said database". The substantial investment to be taken into consideration is therefore distinct from "the means implemented for the creation of the constituent elements of a database".

The court held in this case that the elements produced by the LBC France company - namely investments in communication and investments for the storage of content - constitute "financial, material and human investments, which contribute to the collection of data, allow their sorting and storage in order to promote their accessibility when they are put online”. They therefore deserve to be taken into account under Article L. 341-1 of the Intellectual Property Code.

Investments related to the verification of the database content 

The substantial investment may then be made to verify the content of the database. The notion of investment linked to the verification of the content must thus, according to the court adopting the interpretation given by the CJUE, "be understood as targeting the means devoted, in order to ensure the reliability of the information contained in the database, to check the accuracy of the elements sought, during the constitution of this database as well as during the period of operation of this one”. The substantial investment to be taken into consideration is therefore distinct from the checks related to the creation of the data.

In the present case, the court considered that the company LBC France had made a substantial investment concerning the verification of the contents of the database and the sub-database, consisting in the establishment of technical teams made up of employees and service providers carrying out moderation and reporting activities, notably through software support.

Investments related to the presentation of the contents of the database

Finally, the substantial investment may lie in the presentation of the contents of the database. In this context, the investment corresponds to "means aimed at giving said database its information processing function, namely those devoted to the systematic or methodical arrangement of the elements contained in this database as well as to the organization of their individual accessibility”.

In the present case, the court considered that the company LBC France justified substantial investments concerning the presentation of the database and the sub-database, because of the establishment of a team and the use of service providers responsible for the definition, maintenance and development of categorization rules.

The successive analysis of the financial, material and human investments made by the company LBC France concerning the constitution, the verification and the presentation of the database allowed the court to conclude that they are "substantial within the meaning of the Articles L. 341-1 and L. 342-5 of the Intellectual Property Code, due to their nature and their amounts”. It therefore confirmed the judgment that the "leboncoin.fr" website constituted a copyrightable database. In addition, the court held that the company LBC France justified specific investments in the constitution of the "real estate" sub-database, linked in particular to the purchase of an online real estate advertisements site, thus allowing it to benefit from protection by the sui generis right.

The distinction between the different types of investments by the court follows on from the "Ouest France" judgment rendered by the Court of Cassation in 2009 in light of the decisions of 9 November 2004 of the CJEU11. Since this judgment, the French judges have verified, as in the present case, that the criteria laid down by European case law are rigorously respected. As previously recalled, the Court of Justice considers in particular that the investments devoted to the creation of data are not relevant in determining the eligibility of a database for protection by the sui generis right. Consequently, the sui generis right does not make it possible to protect so-called "spin-off" databases, that is to say those which are the sole result of a main activity, which has a considerable impact on the data economy and raises the question of a clarification of the sui generis right.

In addition, it is interesting to put the present case into perspective with the aforementioned "Ouest France" judgment, since these two judgments are rendered in the area of ​​real estate advertisements. In the “Ouest France” judgment, the Court of Cassation had in fact ruled in favor of the Court of Appeal for having decided that the company which created the ouestfrance.com site on which real estate advertisements are published could not benefit from the provisions relating to the sui generis right in the absence of substantial investments in the constitution, verification or presentation of the contents of the database: "after having first of all noted that the investments invoked, if they were significant, also concerned sectors other than that of real estate and other entities, so that they could not be assigned to the single sector of the database, the judgment notes that the latter consists of announcements formalized by the Precom company when entering them for the purposes of publication and according to the indications that the advertisers have been invited to provide to allow their use and classification, that no verification of the content of these advertisements, except manifest illegality or inconsistency, is not and cannot be carried out, the said company not being authorized to do so; that in view of these findings and assessments showing that the resources devoted by the company Precom for the establishment of real estate advertisements published in the various editions of the newspaper Ouest France did not correspond to an investment linked to the constitution of the database in which they were integrated but to the creation of the constituent elements of the content of this database and to purely formal verification operations during this creation phase”. Likewise, in a “Seloger.com” judgment rendered in 2015 also relating to real estate advertisements, the Court of Cassation quashed the judgment appealing to the visa of article 455 of the code of civil procedure for having determined "by a reason which does not allow to define whether it considered that the investments related to the collection of data and their dissemination, as collected, fell within the creation of the constituent elements of the content of its database and therefore should not be taken into consideration or if, on the contrary, they were part of the "specific" investments of which the company Pressimmo had to provide proof in order to justify the protection it requested".

By characterizing the substantial investments of the company LBC France in the constitution, the verification or the presentation of the contents of the database and the sub-database and not in the creation of the constituent elements of the contents of this database, the court of appeal of Paris thus meets the requirements set by the CJEU and the Court of Cassation to determine the eligibility of a stocking data protection under the sui generis right.

Substantial extracts and re-uses of the content of a sub-database

Article L.342-1 of the Intellectual Property Code gives the database producer the power to prohibit two types of acts: the extraction or re-use of a qualitatively or quantitatively substantial part of the content of a database.

In application of the code, the extraction is carried out "by permanent or temporary transfer of all or a qualitatively or quantitatively substantial part of the content of a database on another medium, by any means and in any form".  As recalled by the court in the commented judgment, the CJEU specified that the extraction corresponds "to the transfer of a substantial part, evaluated qualitatively or quantitatively, of the content of the protected database or to transfers of non-substantial parts which, by their nature repeated and systematic, would have led to reconstituting a substantial part of this content”. The proof of extraction can be based on the constitution of a body of corroborating clues.

Reuse is achieved "by making available to the public all or a qualitatively or quantitatively substantial part of the content of the database, whatever the form". The CJEU, cited by the court, was able to specify that reuse “is characterized by a series of successive operations, going, at the very least, from the posting of the data concerned on the said site for the purposes of their consultation by the public to the transmission of this data to interested members of the public”.

Finally, the prohibitions provided for in Article L.342-1 of the Intellectual Property Code imply that the extraction or reuse relates to a qualitatively or quantitatively substantial part of the content of a database. As such, the CJEU considers that the notion of "substantial part" assessed quantitatively must be assessed with regard to the volume of data extracted and / or reused from the database compared to the total volume of the database. At the same time, it considers that the notion of "substantial part" assessed qualitatively must be assessed in relation to the importance of the investment linked to the constitution, the verification or the presentation of the content of the base object of the extraction or reuse.

In the present case, the company LBC maintained that the company Entreparticuliers.com engaged in qualitatively substantial extractions and re-uses of its database and of its “real estate” sub-database, both because of the contract concluded by the latter with its provider only of the extraction with indexing of the practiced advertisements. On the contrary, Entreparticuliers.com maintained that it had neither extracted nor reused the data.

The court considered, in the light of a bundle of concordant clues, that the company Entreparticuliers.com had indeed proceeded to the extraction and the reuse of a qualitatively substantial part of the contents of the "real estate” sub-database of the company LBC France, justifying its order to cease these acts and repair the damage suffered by the company LBC France.

The judgment handed down by the court of appeal thus confirms the protection by the sui generis right of sub-databases. The CJEU indeed affirmed in the Apis-Hristovitch judgment that a "sub-group" of a database could be eligible for protection by the sui generis right subject to meeting the conditions set out in Article 7., paragraph 1, of Directive 96/9 - that is to say, on condition of demonstrating a qualitatively or quantitatively substantial investment in the constitution, the verification or the presentation of the sub-database. As soon as a sub-database is eligible for protection by the sui generis right, the volume of elements allegedly extracted and / or reused from this sub-database must then be compared to the volume of the total content of this sub-database to be considered as relating to a quantitatively substantial part. In the absence of protection of the sub-database, the volume of elements extracted and / or reused must be compared to the total database.

The possible protection of a sub-database on the basis of the sui generis right is thus confirmed by this judgment. This decision also condemns an increasingly widespread practice on the internet, web scraping, which consists of extracting content from websites, via a script or a program, in order to reuse it in another context, such as SEO. However, information accessible on the Internet is not necessarily freely reusable. In addition to contractual mechanisms linked to the general conditions of use of the site, it can also be protected by intellectual property law on the basis of the sui generis right of database producers. 

Charles Bouffier, counsel attorney and Antoine BOULLET, lawyer at August Debouzy 

To learn more about ways to protect your digital assets, you can read our previous article: Registering a logo: an essential step in any business strategy

On February 2nd, 2021, The Paris Court of Appeal confirms the protection of the leboncoin.fr website against extraction and unauthorized reuse of its real estate ads, by the sui generis right of database producers. 

Learn more about the protection by the sui generis right of databases of the Leboncoin website against extraction and reuse of its ads

Protection by the sui generis right of databases

The headlines are telling: “Lost Passwords lock millionaires out of their Bitcoin fortunes,”[1] “A crypto exchange may have lost $145 million after its CEO suddenly died.”[2]  Whether you are a CEO of a crypto exchange, passive investor or new to the crypto market, we are all subject to the same human fallibility that is losing or misplacing one’s password and thus we are all equally at risk of financial loss.  Lose your password and lose out on millions? The question arises of how we can safely and securely protect our cryptocurrency digital assets so that, when memory fails us or an unforeseen event occurs, we won’t be left stranded. 

In spite of the considerable consequences, the problem is a simple one and a simple solution exists.  But first, in order to better understand what’s at work here, let’s take a crash course in cryptocurrency, learn how it is deployed via digital wallets, review some of the greater risks inherent in these wallets and finally, see what steps we can take to better protect our digital assets. 

In today’s world, assets are increasingly digital (“Digital Assets”).  Bitcoin, Etherum, Litecoin, Cardano, Stellar – these are just a few of the more than 4,000 cryptocurrencies in existence as of January 2021[3].  We won’t delve too much into the background of cryptocurrency, there are plenty of articles and YouTube videos available that do an excellent job in that respect, but at its most basic cryptocurrency is the virtual or digital representation of currency in certain environments or situations, often taking the form of virtual “coins” or “tokens.”  The latter of which is not limited to merely representing a currency but also functions as an investment tool to commodify digital creations.

The best known, and most widely used of these cryptocurrencies, is Bitcoin.  This example of a Digital Asset, and those like it, are for the most part managed by a decentralized network of computers that use blockchain protocols and open-source software which all adhere to the same pre-defined rules concerning cryptocurrency.   This software enables one to create a digital wallet where the so-called “keys” to the bitcoins are stored.   

 To better explain the mechanism of crypto-keys, let’s take the analogy of a traditional bank, whereby you are provided a bank account number, a security pin and in today’s digital age, password protected access to an online account.  As applied to cryptocurrency, instead of accounts, pins and passwords, we have keys and a seed.   

More specifically, there is a public key and a private key.  The public key is like the bank account number, the receiver shares these coordinates with the sender so that they know where to send the money. The private key is akin to a bank pin number, or the series of numbers you enter to prove, for example, that the funds attached to the credit card you are using actually belong to you.   

Lastly, and what mostly concerns us today, is the password, or “seed”, which allows you to gain access to your digital wallet by unlocking, or ‘decrypting’, your private key. This password is made up of a sequence of 12 to 24 automatically generated words known only to the you, the owner.   

 So in our example of the traditional bank, if the public key is an account number and the private key is the pin number, then the seed is your password that ‘unlocks’ and gives you access to your online account.    Except, unlike a normal online bank account, there is no option to re-establish a forgotten password.  The password, or seed, if lost means that all is lost, including your millions!!

Cryptocurrency transactions via Digital Wallets 

As we said above, cryptocurrency, like any other currency, can be used to purchase products, services or effect other types of transactions.  But since we are not dealing with cold hard cash, how does this work exactly?  The typical practice for holders of cryptocurrency is to utilize cold wallets, hot wallets or a combination of both.   

Cold Wallets for the security-first mindset 

Cold wallets, or ‘hardware’ wallets, live on tangible devices such as a USB stick. The device must first be connected to the internet, the password entered to decrypt the private key, and then it provides an in-device signature that allows one to make secure transactions.  The private key never leaves the device so no malware in existence today can forge its signature. Trezor and Ledger are two popular brands of cold wallets.   

 While more secure, cold wallets, unlike hot wallets, require the intermediary step of connecting to the internet to make a payment, for example, and are thus considered less user-friendly.  

Hot Wallets for transactions on-the-go 

Hot wallets are an online storage system, whether web-based, mobile or on a desktop, that contain both the private and public keys permitting easy access to the stored cryptocurrency in order to make exchanges between currencies, products or services on-the-go.  Since hot wallets contain both keys and are always online, hence the ‘hot’, there is no need to connect a separate device to the internet in order to make a cryptocurrency transaction.  MetaMask and Crypto.com are two examples of this kind of digital wallet. 

 However, given the digitalized nature of the storage system, this form of wallet is, as you may have already guessed, vulnerable to malware, hacking and cyberattacks. 

Combination Wallets for the savvy investor 

In simplistic terms, the difference between hot and cold wallets is like the difference between withdrawing cash from a bank teller or swiping your credit card – withdrawing cash requires physical presence and valid id, whereas a credit card while efficient and fast does not always require additional levels of security, like in the case of contact-less payments, and is more vulnerable to theft or misuse.   

 Some savvy cryptocurrency holders use a combination of the two, storing only a portion of their valuable asset on a hot wallet like a mobile device and the remaining, majority portion, on a cold wallet and making monetary transfers between the two as needed.  

Lost Passwords and Inaccessible Wallets 

If security is the priority, the best choice of digital wallet is hands-down a cold wallet.  But even in this instance, what happens if you lose, misplace or forget your password?  Or your hardware is damaged in a fire or corrupted while reformatting? Given cryptocurrency’s unusual nature, the consequence is finding yourself permanently locked out of your cryptocurrency investment and, in the majority of cases, having no recourse.    

 A poignant example is found in the case of Stefan Thomas, a German-born programmer living in San Francisco, who has a digital wallet in the form of a small hard drive - a cold wallet - that holds over 7,000 Bitcoin worth more than 200 Million USD at its height.  This digital wallet gives users 10 guesses before locking them out permanently and leaving its contents encrypted forever.  The problem is Mr. Thomas wrote his password down on a piece of paper and lost it years ago.  Two more wrong attempts and he will permanently lose his ability to cash in on his Bitcoin investment. 

 Lost passwords aren’t the only risk.  A British man recently discovered that he had accidently tossed his Bitcoin hard drive wallet out with the trash and was offering the city 25% of the value, approximately 91 Million USD at the time, to excavate the landfill.  His request was denied.   

 These are not cases of a few unfortunate or unlucky souls.  According to the New York Times, using data compiled by the cryptocurrency data firm Chainalyis, of the existing 18.5 million Bitcoin, around 20 percent — at one point worth around $140 Billion USD — appear to be in lost or otherwise inaccessible wallets[4].  

 These examples bring us full circle to the question posed at the start: how can we safely and securely protect our cryptocurrency digital assets so that, when memory fails us or an unforeseen event occurs, we won’t be left stranded? 

The loss of bitcoin passwords results in the loss of cryptocurrency fortunes.  How is this even possible and more importantly, how can it be avoided?