Should I provide some way to disable my software post-delivery?

Question

I'm debating the value of putting remote disable (or destruct) functions into my software before delivering it to clients...

As a hypothetical example, consider the development of a Silverlight app where you're worried about the client not paying you. You create a function which when a specific query string is entered it deletes everything in the database.

Destroying data might be a bit of an extreme example. Making the application either partially or completely unusable would be another example.

What are the benefits and risks of doing this? If you've done it, why did you do it, and how did you go about it?

Answer 1

NO, I never did and never will. There are professional ways of solving these kind of problems. IMHO just building in the possibility to do these kind of things is a violation of the trust put into you by the customer.

But your question got me thinking, if somehow I got myself into I place where I was was made to deliver software to a customer that never pays and could do nothing else about it. I would still try to keep it as professional as possible and make sure that what ever I did could be undone.

• encrypt all his data, he can buy the key back.
• pop-up messages that tell the end users that the boss doesn't pay his bills.
• scramble output in a way that it is unreadable

p.s. just building in a trial period that requires a key to be activated is a normal way of course, but that will also never destroy any customer data

Answer 2

Get a good contract in place before you do the work.

Self-destructive code is no substitute for a competent lawyer.

Answer 3

IANAL, but I suspect that such "backdoors" could make you legally liable if discovered, even if you did not use them.

Answer 4

Sounds like a typical "Your license has expired" scenario to me.

Also, the "delete everything in database" functionality may be very, very expensive for you if somebody else finds out about it and executes it...

Answer 5

The guiding principle should be to never break anything the customer already has. That is likely to be illegal in numerous jurisdictions. Moreover, never do anything unfriendly to your customers. That's basic PR. It also can be a matter of saying things in the right way. An extra charge on top of your standard rates is a lot more annoying than higher standard rates and a discount for some customers.

Given enough work, the chances of getting stiffed approach 100%, and you do need to account for that.

If possible, build the chance of getting stiffed into your rates. For repeat customers who have a history of paying on time and in full, give them a preferred customer rate, which would be your standard rate minus the amount you were reserving against the likelihood of not being paid.

Make sure you have a written contract that covers payments and deliverables. Make sure that the payment schedule doesn't allow arrears to build up past what you're willing to accept losing. Make sure the contract has some sort of linkage, so you aren't required to keep working without payment. You should draw up a sample contract and run it by a lawyer. A lawyer up front will cost a lot less than a contract dispute, and contract disputes tend to come up when the contracts are unclear. You never want to be in a position where a court has to figure out what the contract means.

Never talk about disabling things in any manner. That will get you in trouble no matter how bad the customer. If you're worried about it, put some sort of license control on the demo and trial versions of the product, and have it in the contract that you will turn over the permanent key at the time of the final payment.

Given the tone of the posting, it appears that the OP may already have been stung badly. If somebody has, accept it as a learning experience and make sure it doesn't happen again.

Answer 6

Sounds like 'wilful misuse of a computer' that can get you several years in gaol to me, and using "but he didn't pay me" argument wouldn't get you any slack from the judge either.

Adopt a more professional approach - and sue their ass if they breach your contract. Make sure you get a contract first, of course, and consult a lawyer if you're providing services that you think may require the services of a lawyer. Standard contracts can be had on the internet for next to nothing.

The UK government has a few templates you might find useful as starting points.

Answer 7

I agree with the comments above on destroying customer data. An alternative approach that I've seen used quite widely (I work at Agilis Software, a supplier of license-management to software vendors) is to issue a time-limited license, that you convert to a perpetual license (if that is what they purchased) when you actually receive payment. To allow time for payment processing I'd set the time limit somewhat beyond your payment terms, so you also have time to get them their perpetual license without risking a disruption to their use of your product. You should also make sure they know you have done this.

This can be a manual operation, or automated using a product activation system. We call this leased licensing. When the user activates the license it is enabled for the limited time period. One you receive payment you update the limit for this license in the activation server to perpetual, and this new limit takes effect when your application automatically re-validates its licenses against the server at the end of the lease period. This makes the whole process transparent to the user.

Dominic

Answer 8

You can make all of this part of the user agreement. Don't charge up front and let clients pay as they go. Some may prefer this, so there's nothing immoral about it. It may be a way to bundle support as well.

I wouldn't delete their data because:

• I think it is wrong
• difficult to implement; most everyone has a backup
• no one would knowingly sign that agreement.

Answer 9

Vindictiveness is kid stuff. Just watch a little daytime court TV. You'll see plenty of it.

Have a good agreement going into the relationship, submit your bills on time, and nicely remind them to pay you.

Sometimes you have to eat a loss, but your professional reputation is your best asset.

Answer 10

If you are worried about them paying, then dont give them the software until they pay.

If you are offering a product with a subscription model, use a platform thats better suited for it. ie, a web based application where you control access.

Disabling desktop software is, imo, pretty classless. If someone buys software, they expect it to be able to run as-is indefinately. Certainly you can stop updates and stop offering support, but crippling functional software thats been paid for (ie, not trial software) seems really cheap to me.

And dont EVER delete data or files. EVER. That is not yours to delete, and people end up in prison for that sort of thing.