Newegg Beats Patent Troll Over SSL and RC4 Encryption

New submitter codguy writes to note that a few days ago, and after a previous failed attempt to fight patent troll TQP Development in late 2013, Newegg has now beaten this troll in a rematch. From the linked post: "Newegg went against a company that claimed its patent covered SSL and RC4 encryption, a common encryption system used by many retailers and websites. This particular patent troll has gone against over 100 other companies, and brought in $45 million in settlements before going after Newegg." This follows on Intuit's recent success in defending itself against this claim.

Comments

Good

[msobkow]

What would be fitting is for all those "settlements" to be automatically overturned and the troll forced to refund the money.

But I know it doesn't work that way. If you wuss out and pay the toll, there is no getting your money back from the troll.

Re:Good

[Solandri]

This. This needs to be made illegal. Patent licensing fees should be returned (minus reasonable administrative fees) if the patent is overturned. Force the burden of proving the patent is indeed valid back upon the patent holder. Don't force the purported violator to prove the patent is invalid.

If the USPTO could control the patents it gives out so the rate they're overturned upon challenge is low, then it makes sense to force violators to prove the patent is invalid. But because they're seemingly willing to give out patents for anything and the rate they're overturned, it makes more sense to shift the burden onto the patent applicant to take reasonable steps to make sure his patent is ironclad and will not be overturned. If the patent applicant's confidence in his own patent is so low he isn't sure it won't be overturned upon a detailed review, then that's a pretty good indication the idea isn't really worthy of a patent in the first place.

This also has the effect of making pure IP companies a high-risk business. If all you do is license patents and one of your main patents gets overturned, it could bankrupt you. But if you're actually using the patent to make stuff, then you'll have an alternate revenue stream which will allow you to survive having to pay back the licensing fees.

There is a drawback in that companies may be more willing to license specious patents, in hopes that someone else will go through the expense of fighting it. If someone else fights it and wins, you get your money back, so why should you fight it? On the patent's holder's side, this creates a multi-year potential liability in the accounting books even if you have a valid patent. A sunset period of a few years after which you can't recover licensing fees (or a graduated return period, so after say 3 years you have to pay back 50%, after 5 years 25%, after 7 years you can keep it all) would address both problems.

Justice?

[Stan92057]

And liberty and justice for all...who can afford it.

Obsolete crypto shows problem of software patents

[l2718]

It's worth noting that there are known attacks against RC4 (especially SSL using RC4). While these aren't quite practical yet, it is clear that RC4 is obsolete, and that current programmers should choose other stream cyphers (AES). Even supposing the patent was legitimate, the technology it covers has become obsolete well within its lifetime.

This illustrates one of the key reasons software (that is, algorithms) shouldn't be patentable: the field moves so fast that 20-year patent protection isn't useful. Even supposing the authors of software need patent protection to recoup their "investment" in inventing the algorithm, 20-year protection is effectively an infinite term, since by the time the protection ends, the technology is obsolete.

As an aside, note that patenting a protocol (such as RC4) automatically ends its usefulness. Protocols are only useful if the other party to the communication can participate, and interoperability is very important in software. Patents are ill-suited for this. Copyright, on the other hand, works well: the code you write is protected, but anyone else can write their own code to implement the protocol and communicate with you.