RC4 Legal Issues

[hughes@ah.com (Eric Hughes)]

   Does the answer to this question depend on whether it really was reverse
   engineered, or is a direct lift from the original source code?

It does not matter to disinterested parties, like the average
cypherpunk.  

If it was reverse engineered, there may be a claim by the seller of
the software against the licensee for breaching a "no reverse
engineering" clause.  In this case RSADSI is not a party to the action
because the reversing engineer did not make an agreement with RSADSI
concerning trade secrets.  Any disinterested party is also not subject
to this action, because they made no agreement with anybody involved.
It's possible that RSADSI and, say, Lotus have an indemnification
agreement in the case of reverse engineering, but that only affects
the distribution of resources between those two companies.

If it was lifted from source code, then RSADSI has a claim of
malfeasance against theft of trade secrets.  This doesn't reverse the
fact that it's no longer a secret, but rather allows RSADSI to sue for
the damages caused by the revelation of the secret.  RSADSI can only
sue the person who revealed the secret, not just anybody who posesses
it.  It's also possible that there might be a claim against the party
to whom the secret was directly divulged, were there some conspiracy
to steal trade secrets.  That situation does not seem to apply here.

In all of the above, be mindful that anybody can file a lawsuit and
claim anything at all, and if it sounds official the gullible might
believe that even the most farcical claims have merit.

Eric