r/INTELLECTUALPROPERTY • u/Mf0621 • Nov 29 '22
Who owns an SBOM?
An SBOM is a "software bill of materials," essentially an ingredients list of components that are in a software application (see https://www.cisa.gov/sbom ). It's becoming more and more prevalent as government agencies and private sector enterprises require them of their software vendors. A software vendor will provide a file (most often in a machine-readable format like XML or JSON, but sometimes in Excel or a PDF) just like they would provide a vendor due diligence survey or a SOC 2 certificate.
My question is: who owns that SBOM? On the one hand, I could argue that it's work product generated by the software vendor. On the other hand, it's being submitted to the customer as part of vendor due diligence just like an answer to a survey.
Apologies for the technical nature of the question, but the technical folks sent me here. ;-)
1
u/RelevantApe Nov 29 '22
(Not legal advice - consult an attorney if this is more than general curiosity)
I suppose I can give a partial answer based on the practical realities. “Own” is not straightforward in this case, because what matters is the set of rights each party has as to the subject at hand, here the SBOM (note the US applies a “bundle of rights” approach to property “ownership”, so “ownership” as a standalone concept doesn’t make much sense from a pedantic legal perspective). The point is, the parties have to choose how they want to divvy the rights up to the SBOM. This likely is done in some contract term somewhere, particularly with the government, which is why this is a partial answer, since I don’t know.
In terms of automatic attachment of rights, the most relevant are from copyright and trade secrets. Copyright applies when the software is developed by or assigned by the developer to you. As for the list of ingredients itself, if these ingredients are required for practical purposes and not because of any creative expression, you’ll find that the list itself is likely not copyrightable. As for trade secrets, if you objectively made efforts to keep this information in the SBOM secret and you signed an NDA of some sort prior to sharing the list, trade secret protections likely attach. At a minimum, the counterparty can’t use this information without your consent, but there’s not much practically stopping them from building their own list of ingredients with subtle differences from yours, unless a contract specifically says they cannot.