BSA The Software Alliance

[warp9]

I've had a very well written introduction letter from these people strongly suggesting that we do a self complete software risk assessment and failure to do so *could* lead to an audit.

It appears that they are a trade group established by Microsoft, Adobe and other leading software manufacturers. I don't believe they actually have any regulatory authority to carry out an audit, but the tone they take is very intimidating for small business owners and they throw around figures like 'the average cost to businesses in the UK due to copyright infringement is £42K'.

Has anyone come across them before and offer any advice on how to proceed - ignore and hope they go away, or engage and potentially open the door for a full audit?
Thanks

[randlemarcus]

Best plan might be to ignore for the moment, and do your own internal audit. If you are clean, by all means talk to them. If you aren't, resolve the problem before talking. Unless its a really big one, in which case talk to them, and see if there's a deal to be done.

[Don]

I'd make sure you have no dodgy software in use anywhere in your business first.

Then ignore them. They'll try and get you to use some Software Licencing Compliance tool or other (essentially software than monitors what's on your employee's machines). This is total overkill for most small business - the time you need it is when manual checks would cost you too much time and therefore money.

The bad news is that if you get caught with unlicensed software it can be very, very expensive.

[droopsnoot]

I vaguely remember something like this from a few years back, maybe ten years or so. Letter arrives at business offering to do an audit with various slightly threatening and ominous conditions. Seem to recall we advised our customers to ignore it.

[PhilboSE]

You should conduct your own audit to make sure that you are fully licensed. There are some good cheap or free tools that will do this for you with minimal effort - but don't forget CALs for things like database connections as these sometimes don't appear on "product" audits.

Then when you are confident of your own position you can decide on whether you want to engage with BSA. They don't have any regulatory powers but that doesn't stop them suing you for some relatively arbitrary amounts.

Here is a decent link: http://www.scottandscottllp.com/main/respond_to_bs...

[BenWRXSEi]

OP - I work as a SAM/license compliance consultant so have come across these guys a few times. Drop me a pm if you'd like me to take a look and let you know best steps from here

[Splats]

I'm confused. Surely if you had any dodgy software you would either remove it or at the very least purchase it legitimately and ignore the letter safe in the knowledge that if they come knocking you can show all the software you have is paid for?

[BenWRXSEi]

Splats said:

I'm confused. Surely if you had any dodgy software you would either remove it or at the very least purchase it legitimately and ignore the letter safe in the knowledge that if they come knocking you can show all the software you have is paid for?

Unfortunately it's often not that simple. Half the battle is actually finding out what you have out there, and even then you need to work out what's legitimate, what's licensable (and how it's licensed), what's potentially a threat etc etc. A lot of potential risk can come from using perfectly legitimate software the in the wrong way.

[warp9]

BenWRXSEi said:

Splats said:

I'm confused. Surely if you had any dodgy software you would either remove it or at the very least purchase it legitimately and ignore the letter safe in the knowledge that if they come knocking you can show all the software you have is paid for?

Unfortunately it's often not that simple. Half the battle is actually finding out what you have out there, and even then you need to work out what's legitimate, what's licensable (and how it's licensed), what's potentially a threat etc etc. A lot of potential risk can come from using perfectly legitimate software the in the wrong way.

This is my concern, plus the unplanned manpower and time commitment to getting everything in order, of which I have no experience. While on the surface everything is in order - we predominantly use industry specific proprietary software where the licence is renewed annually, we also use MS office which I believe to be licenced and have used other packages over the years, which I don't believe we even use now. The issue is we have around 60 PC's and servers internally and have no idea where to start with this.

[Don]

warp9 said:

This is my concern, plus the unplanned manpower and time commitment to getting everything in order, of which I have no experience. While on the surface everything is in order - we predominantly use industry specific proprietary software where the licence is renewed annually, we also use MS office which I believe to be licenced and have used other packages over the years, which I don't believe we even use now. The issue is we have around 60 PC's and servers internally and have no idea where to start with this.

Sounds to me like you have enough PCs and servers to justify some effort. Talk to your most senior IT guy (you do have one don't you) and task him with fixing it for you. With so many rental options like Office 365 and so on you really should be able to simplify what you have and are using to the point it can be managed easily.

[toon10]

I worked for a company that went down the FAST (Federation Against Software Theft) route. When the BSA come in, you show them that you are working with FAST and they go away pretty quickly. The problem you have then is you're now paying another company to help you audit your estate and use their license management database.

Personally I'd look to invest in some decent asset tool to see what's on your estate and look into getting to grips with your licenses. If the BSA come in you'll be in a position to tell them what you know you have, how many licenses you have and you have a plan in place to purchase any extra required licenses or remove any unlicensed that isn't required.

These companies rely on you not knowing what software you have out there and not knowing what your license position is, then they use the legal action fear factor.

[andyb28]

Spiceworks is a good free tool that may get you started with the internal Audit.
If Office licences is an issue via traditional licence methods, consider a move to Office 365 for quick painless licences.

Where are you based?