Penhallurick v MD5 Ltd

The Claimant, Mr Penhallurick, claims ownership of copyright in eight works, all of them relating to a technique he has called “Virtual Forensic Computing”, or “VFC”. He alleges infringement of his copyrights by his former employer, the Defendant (“MD5”).

MD5 asserts that it owns the copyrights and counterclaims for a declaration to that effect, also claiming that Mr Penhallurick was in breach of his contract of employment and has infringed MD5’s copyrights.

Ben Longstaff appeared for Mr Penhallurick, Michael Conway for MD5.

Agencies, typically the police, may wish to analyse the contents stored on a computer without, by the act of searching, corrupting or otherwise altering the files and thereby compromising a prosecution. Mr Penhallurick worked on a method of retrieving an image of the hard disk without writing on it, then booting up the image on a virtual machine so that the image can be investigated. Mr Penhallurick used a freely available product called VM Software to set up the replica of the target computer’s hardware and operating system. Computer programs generally have inbuilt safeguards to prevent them from being manipulated in this way, so part of Mr Penhallurick’s method involved a password bypass feature he developed.

Mr Penhallurick conducted research in this field while he was studying for his MSc degree at Cranfield University from 2002 until 2005. His work resulted in his Master’s thesis, consisting of a description of his VFC method, an abridged version of which was published by the University in September 2005. The method was manual in the sense that although it used proprietary software, it was not performed automatically by the operation of software.

Mr Penhallurick says that in 2005 and 2006, while still developing his VFC method, he wrote his own software which would allow a computer to perform the method automatically. He also began work on a graphical user interface and a user manual.

Mr Penhallurick’s employment by MD5 began on 6 November 2006.

MD5’s case is that Mr Penhallurick’s duties were more flexible and extensive than this. MD5 further says that if Mr Penhallurick created any VFC software

By early 2007 Mr Penhallurick had developed software which permitted a fully automated version of VFC, including a graphical user interface. Both he and MD5 at the time referred to this as “VFC version 1”.

According to Mr Penhallurick it incorporated code written before his employment. He also says that after he joined MD5 his work on this software was done outside the scope of his employment, using his own computer and primarily in his own time.

MD5’s version of events is different. The manual VFC method which Mr

Following the completion of VFC version 1, Mr Penhallurick created three further versions of the VFC software, released in April 2008, May 2014 and August 2016, all built on version 1. Mr Penhallurick’s case is that these too were created in his own time; MD5 says that like version 1 they were developed in the course of Mr Penhallurick’s duties as employee.

These are the copyright works in issue, using the First to Eighth Work titles given to them by Mr Penhallurick:

Mr Penhallurick’s first contract of employment with MD5, dated 6 November 2006, was for a fixed three month term. In January or February 2007 he entered into more permanent terms of employment by a written contract which, as both parties agree, was backdated, but incorrectly to 6 October 2006. It has consequently been referred to as “the 2006 Agreement”.

From March 2007 VFC software was offered and sold to customers of MD5, but the basis on which this was done is disputed. Mr Penhallurick says that the software was offered and sold under licence from him. MD5’s case is that customers were given a written End User Licence Agreement (“EULA”) identifying MD5 as the licensor, which it was, and that Mr Penhallurick had approved the EULA.

In November 2008 Mr Penhallurick and MD5 signed an agreement under which Mr Penhallurick was given an annual bonus of 7.5% of annual sales by MD5 of VFC software. It was referred to in evidence and argument as “the November Agreement” but to be clearer I will call it “the November 2008 Agreement”.

MD5’s primary case is that since all the VFC software was written by Mr Penhallurick as an employee, MD5 has always been the first owner of the copyright in all versions. MD5 has a secondary case: under the November 2008 Agreement the copyright in the VFC software, past and future, was assigned by Mr Penhallurick to MD5.

Mr Penhallurick denies that this was the effect of the November 2008 Agreement but says that, alternatively, at most only copyright existing as of the date of the agreement was assigned, not copyright in software to be created in the future.

A further agreement was entered into on 8 November 2011 (“the 2011 Agreement”). The terms were not relevantly different from those of the November 2008 Agreement, save that there was an increase of the annual bonus to 10% of the value of VFC software sales.

On 26 February 2016 Mr Penhallurick resigned from his employment with MD5. His last working day was 22 April 2016 and his last day of employment was 30 April 2016.

On 20 April 2016 the parties entered into a final, written, agreement (“the 2016 Agreement”). Its effect is in dispute as I will discuss below.

In January 2018 MD5 stopped payments under the 2016 Agreement which, by common consent, brought the 2016 Agreement and the commercial relationship between Mr Penhallurick and MD5 to an end.

Aside from its defences to Mr Penhallurick’s claims referred to above, MD5 runs a defence of estoppel. Its case is that Mr Penhallurick made repeated representations to MD5 that MD5 owned the VFC software, that MD5 acted in reliance on those representations to its detriment by compensating Mr Penhallurick above his standard remuneration, by allowing Mr Penhallurick to work on the VFC software instead of forensic analysis and other duties and by incurring expense in the marketing of the software. Mr Penhallurick is now estopped from denying MD5’s title to the software. Alternatively Mr Penhallurick represented that he was developing the software in the course of his employment by MD5 and is now estopped from contending otherwise.

Mr Penhallurick denies making any such representations and all other elements of MD5’s case on estoppel; MD5 was at all times aware that Mr Penhallurick owned the software.

MD5 pleaded a counterclaim in three parts. First, Mr Penhallurick was in breach of the 2011 Employment Agreement by failing to maintain full and correct versions of the VFC source code and failing to provide the source code to MD5. This was not pursued at trial.

Secondly, Mr Penhallurick infringed MD5’s copyright and also acted in breach of the 2011 Agreement by making unauthorised adaptations of the VFC software and by storing versions of it.

Thirdly, Mr Penhallurick was in breach of the 2016 Agreement by failing to provide updates to the VFC software and support work in relation to the software after he left MD5’s employment.

Mr Penhallurick gave clear and direct answers to the questions put to him in cross-examination. He made realistic concessions during the course of what appeared to me to be his honest attempt to explain matters as he saw them.

Time was taken up with questions about comparisons of source code. This arose from disclosure given by Mr Penhallurick very late in the day. It is enough to say here that the disclosure neither assisted nor damaged Mr Penhallurick’s case and I do not think that the answers he gave about the late disclosure affected his credibility.

John Green was Managing Director and Chairman of MD5 from 2003 until his retirement in 2012. Counsel for Mr Penhallurick rightly accepted that Mr Green gave his evidence in good faith. Criticisms were made about Mr Green’s uncertainty regarding the date on which Mr Penhallurick had demonstrated the manual version of his VFC method and Mr Penhallurick’s initial 12-week contract but these were not central. I think Mr Green was doing his best to correct himself where he believed he should.

More relevant was Mr Green’s evidence about the November 2008 Agreement, where he was required to reflect again on what was meant by a term in that agreement: “access code”. I discuss this below. I do not accept the suggestion made that his answers undermined the reliability of his evidence.

Mr Boyd is a former Financial Investigator with the South Yorkshire Police Fraud Squad and the Money Laundering Team of the National Crime Squad. In September 2003 he set up MD5 with his uncle Mr Green and his cousin Adrian Green. He was a director of MD5 and took over as Managing Director when Mr Green senior retired.

Mr Boyd was a very good witness and as counsel for Mr Penhallurick rightly observed, he gave his evidence straightforwardly.

James Clark is the sole director of a company called Data Synergy UK Ltd. He has a master’s degree in forensic computing.

MD5 filed three witness statements from Mr Clark. No objection was taken to the first, dated 13 March 2020. Even so, the contents of that witness statement are to my mind not free from difficulty, to which I will return.

Ten days before the trial the parties sought permission, by consent, to serve witness statements in reply. I gave permission. The evidence served by MD5 was a second witness statement of Mr Clark. Three days before the trial MD5 filed an application to serve a third witness statement from Mr Clark.

Mr Penhallurick objected on the ground that the second and third witness statements consisted of disguised expert evidence. They did. At the CMC there had been no permission given to either party to file expert evidence.

Mr Clark’s second and third witness statements had been filed to offer an explanation of spreadsheets and printouts of executable computer files which made up the late disclosure by Mr Penhallurick to which I have already referred. This disclosure went to a central issue at the trial: whether Mr Penhallurick had written VFC software before he became an employee of MD5 in November 2006. My impression before the trial, when the admissibility of Mr Clark’s second and third witness statements was challenged, was that I had no prospect

In closing, counsel for MD5 submitted that Mr Penhallurick’s late filed documents contained too much confusion and inconsistency for me to place any weight on any of them. I agree. I found none of them of any assistance in resolving anything and the same goes for Mr Clark’s second and third witness statements.

This brings me to Mr Clark’s first witness statement. It addressed a different issue: whether a copy of the version 3 of the VFC software supplied by Mr Penhallurick to MD5 after the end of his employment had been altered by him to remove key functions and thereby to hinder its use by MD5 in further development work. Mr Clark concluded that it had.

Mr Clark’s opinion that this is what Mr Penhallurick had done was exactly that, an opinion. As I have said, there was no permission to serve expert evidence. Although no objection was taken to the filing of Mr Clark’s first witness statement, that lack of objection did not serve to convert the witness statement into an expert’s report. The evidence of what Mr Clark did by way of investigation of the copy of version 3 in issue and the fact that he drew the conclusion he did was admissible evidence of fact and I accept it. However it was not admissible as opinion evidence to support the contention that Mr Penhallurick made a copy of version 3 and then altered the software to make it non-functional.

None of the foregoing should be taken as any criticism of Mr Clark. He was an honest witness doing his best to help the court with the matters which MD5 had retained him to consider.

Mr Penhallurick explained in his witness statement that between December 1992 until October 2005 he was a police officer with the South Yorkshire Police. In about 2001 he was introduced to VMware, the software I have mentioned which allows the installation of the operating system of a computer on to a virtual computer generated by the software.

From 2002 to 2005 Mr Penhallurick also attended Cranfield University. His final year project involved the creation of what he called his VFC methodology.

His evidence in chief continued: in about September 2006 he started to write software which embodied his methodology and which served to automate it. In mid-2006 he spoke to Mr Boyd, then a director of MD5 whom he had met when

Mr Penhallurick said that by the time he started at MD5 he had already created the First and Second Works relied on by him in this action: the first VFC software and the compiled object code. Within weeks of joining MD5 he shared his manual VFC method with MD5.

In cross-examination Mr Penhallurick clarified what he had said in his witness statements. He confirmed that his methodology had been developed at Cranfield and added that his understanding had been that if he wrote any software it would go to the university; he had not written any software at that time. He also repeated that by the time he arrived at MD5 he had developed some VFC software. But he stated that it did not work and was not worth mentioning to MD5.

Mr Penhallurick later said in cross-examination that the breakthrough in developing the VFC software came in the last weeks of December 2006 and that he had demonstrated this software to Mr Boyd in January 2007. On the other hand, when taken to a page of source code which on its face had been created on 23 December 2006 and last written on 30 December 2006, he said that this had been his first attempt at an automatic methodology.

Mr Green said that shortly after Mr Penhallurick joined MD5 he demonstrated his VFC methodology, not any software. He was not sure in cross-examination when this was but settled on November or early December. As counsel for Mr Penhallurick said in closing, this was likely since it accorded with the evidence of other witnesses.

Having been shown the method, Mr Green thought that using software to operate the method would speed it up. Mr Penhallurick had expressed confidence that he could convert his manual methodology into a program. Following discussion with Mr Boyd, Mr Penhallurick was allocated time to do this.

Mr Boyd’s evidence was that the manual VFC process demonstrated by Mr Penhallurick took a lengthy 24-48 hours to complete. Mr Boyd’s recollection was that he too thought that it would be helpful to have software created to carry out the process. He discussed with Mr Green the possibility of hiring a third party to do the work, but Mr Penhallurick had assured them he had programming skills and was keen to be given the job. In cross-examination he stated that Mr Penhallurick had worked on the software from January until midMarch 2007.

There was in evidence a Staff Annual Appraisal dated 31 August 2007, completed by Mr Penhallurick. It included this in Mr Penhallurick’s handwriting:

“During February/March, I was given time to develop VFC, a product which is still performing well in the sales arena, even though further development is still required.”

The product in question still selling well was the VFC software. Mr

I found the evidence of Mr Green and Mr Boyd more convincing than that of Mr Penhallurick on this subject. I believe that they suggested to Mr Penhallurick that software should be written to automate the VFC method and that Mr Penhallurick volunteered to do it. It may be that Mr Penhallurick had done something by way of working on VFC software before he joined MD5 but on his own admission it did not work and was not worth showing to MD5. If any such software existed, I think it is likely that he abandoned it and started again while employed by MD5. He probably started in late December 2006 and carried out the bulk of the work from January to March 2007. The important point I draw from this is that whatever the precise date on which Mr Penhallurick first started work on what became the VFC source code as compiled for use in MD5’s products, it was after the beginning of his employment with MD5.

The First and Second Works, if they ever existed, are of no relevance to Mr Penhallurick’s claim in this action.

The Third to Eighth Works were by common consent created while Mr Penhallurick was employed by MD5. All of them are literary works within the meaning of section 3(1) of the Copyright, Designs and Patents Act 1988 (“the 1988 Act”). The starting point for ownership of copyright is section 11 of the 1988 Act:

“11.

First ownership of copyright

Mr Penhallurick was the author of all Works in issue and was therefore the first owner of the copyright in them unless any was made in the course of his employment by MD5, in which case MD5 was the first owner. Which of these was the case turns on the meaning of “in the course of his employment” in s.11(2).

It requires a multi-factorial assessment. My attention was directed to a nonexhaustive list of matters which may be considered, helpfully set out in the judgment of David Stone, sitting as an Enterprise Judge in Mei Fields Designs Ltd v Saffron Cards and Gifts Ltd [2018] EWHC 1332 (IPEC):

“42.

I accept, as put to me by both counsel, that there is no single test to be applied. Rather, it seems to me that the question of whether or not given acts were carried out in the course of employment for the purposes of s.11 of the CPDA is a multifactorial assessment, to be based on all the circumstances of the case. In most situations where an employment relationship has been conceded, there will be some factors which point to the copyright work being created in the course of that employment and some factors which point otherwise. The relevant factors may include:

(a)

the terms of the contract of employment;

(b)

where the work was created;

(c)

whether the work was created during normal office hours;

(d)

who provided the materials for the work to be created;

(e)

the level of direction provided to the author;

(f)

whether the author can refuse to create the work/s; and

(g)

whether the work is ‘integral’ to the business.”

The final version of the 12-week contract between Mr Penhallurick and MD5 has not survived. An email exchange in early October 2006 between Mr Green and Mr Penhallurick shows that there was such a contract, beginning on 6 November 2006. It was common ground that the terms of this agreement were retrospectively replaced by those of the 2006 Agreement.

Clause 2 of the 2006 Agreement, headed “Job Title and Duties” states:

“You are employed as a Computer forensic analyst, reporting to the Director. Your role will involve carrying out a range of duties relating to computer and mobile phone analysis. This includes, but is not limited to, forensic analysis of computers and other data storage equipment including mobile phones. Due to the nature of our business you will be expected to be flexible in your approach and undertake other duties as may be reasonably required of you commensurate with your position and capabilities. This may involve a change in job title, duties and, or, reporting online.”

Clause 15, headed “Intellectual Property Rights”, implies that the parties expected Mr Penhallurick to write copyright works for MD5 and given the context this was likely to be software:

“[MD5] shall be the legal and beneficial owner of the copyright in, and all other rights to, all work produced by you in the course of your employment.”

Although clause 15 on its face provides an arguable basis for a contractual claim by MD5 to ownership of copyright in the VFC software, irrespective of first ownership, this was not the basis of MD5’s contractual claim at trial which was instead focussed on the November 2008 Agreement.

Returning to the scope of Mr Penhallurick’s duties under the 2006 Agreement, there is no doubt that while employed by MD5 he wrote the Third Work and compiled the Fourth Work with the knowledge and encouragement of Mr Green and Mr Boyd and with the intention that if all went well the VFC software would be marketed by MD5. Mr Penhallurick described the creation of the Third Work in his second witness statement:

“39.

During the period from late-January to mid-March 2007 I spent almost every waking hour of my personal time developing VFC functionality at home whilst adding software and hardware-based security protection at work and ensuring that it worked against real world data. … I would often test a piece of code at work and, when it didn’t function entirely as expected, I would … then go home and code; oftentimes it was commented on at work that the development was coming on at a rapid pace.

…

41.

… I used my own personal computer system at work for any coding work and only copied the compiled code to the work machine for testing. I routinely copied the source code onto a USB memory stick and transported it home to copy back onto my own machine.”

Mr Penhallurick was challenged about this in cross-examination and maintained his position.

In argument there was a tendency to run down the list of factors in Mei Fields and suggest that the answer to whether the Works were created in the course of Mr Penhallurick’s employment depended on which way the majority of the factors pointed. In my view this is not that sort of case.

There can be no doubt that making VFC software was the central task for which Mr Penhallurick was being paid by MD5 from late January to March 2007. That is a very strong indication that the Third and Fourth Works were created in the course of his employment. It seems that Mr Penhallurick took on the task with enthusiasm, to the extent that he took his work home some of the time. His staff annual appraisal of August 2007 suggests that much of the work must have been done during working hours at MD5. But whatever the exact proportion done at home, it does not displace the strong and primary indication that it was work done in the course of his employment. The fact that an employee does work at home is relevant to the question of whether the work is of a nature to fall within the scope of the duties for which he is paid but it may or may not carry much

It is probable that Mr Penhallurick wrote a small part of the VFC software before he was given permission by MD5 to devote all or the bulk of his time to writing it and that he did this early work at home on his own computer. But he had already by then demonstrated the manual version to MD5 with an eye to its being exploited by MD5. He must have contemplated that software which made the method automatic would be shown to and exploited by his employer to their mutual benefit. I have also accepted Mr Green’s and Mr Boyd’s evidence that after they were shown the manual VFC they discussed the creation of software with Mr Penhallurick. No precise date was given for this discussion, but since there was a consensus that the demonstration of the manual version was in November or December 2006, it is likely that the discussion took place before the end of December 2006. Work done by Mr Penhallurick on VFC software at the end of December 2006 would have been work which he understood to be integral to his duties as an employee of MD5.

I find that the Third Work was created by Mr Penhallurick in the course of his employment and that accordingly MD5 was the first owner of the copyright in it. No separate considerations arise in relation to the Fourth Work, the GUI, so the first owner was MD5.

In fact, the relevant considerations are the same for the Fifth to Seventh Works. All were created by Mr Penhallurick with the knowledge and encouragement of MD5 and all were directed to making and improving the VFC software product sold by MD5. Mr Penhallurick was paid by MD5 to carry out that work. The first owner of the Fifth to Seventh Works was MD5. It is convenient to consider the Eighth Work, the user guide, separately below.

On 24 November 2008 Mr Green sent a letter dated 24 November 2008 to Mr Penhallurick. It was signed by Mr Green on 26 November 2008 and by Mr Penhallurick on 27 November 2008. It reads:

“Michael, this letter is confirmation of the verbal agreement we have regarding the annual payment of the 7.5% bonus of the *qualified VFC sales MD5 pay you for your continuing contribution to VFC. This payment will only be applicable while you are an employee of MD5 Ltd and you are continuing your involvement and development of VFC software or future versions.

*The bonus will be calculated from the total sales of the software less any direct VFC expenses such as dongles, postage, commissions and any direct sales costs. 50% of training costs will qualify for a bonus and the balance will be added to your personal fee earnings.

I would also like to take this opportunity to confirm with you for our records, that the software developed at MD5 Ltd by yourself and sold as VFC is the sole property of MD5 Ltd including the access code ………… I would also like confirmation that this code will not be modified or changed without the consent of the Managing Director.

I agree to the above statement and conditions.

Signed [by Mr Penhallurick and Mr Green]”

MD5 argues that in the event that it was not the first owner of copyright in the VFC software created by Mr Penhallurick pursuant to s.11(2) of the 1988 Act, it acquired the copyrights, past and future, by reason of the November 2008 Agreement.

Mr Penhallurick’s pleaded position was first, the letter was not a contractual agreement, merely a written record of a pre-existing oral agreement. There was no further consideration which would give rise to a separate written agreement.

Secondly, under the existing oral agreement referred to in the letter, MD5 was granted a licence by Mr Penhallurick, by implication under his copyrights in the VFC software, to commercialise the software. The bonus paid was a royalty due to Mr Penhallurick under the licence.

Thirdly, the third paragraph of the letter, in which “the software developed by MD5 by yourself” is referred to, had a particular meaning. I quote from paragraph 9(h)(iv) of the Reply and Defence to Counterclaim:

“On its proper construction, this paragraph refers only to rights in the VFC computer program in the form actually sold to end users at the time, and not to the source code, and/or only to such parts of that software as had been developed by the Claimant in the course of his employment at MD5. The access code was not the source code.”

Fourthly, any purported assignment under an existing oral agreement was ineffective because it was not in writing and lacked consideration.

Fifthly and alternatively, the effect of the third paragraph was to assign only the existing copyright.

Sixthly, section 91(1) of the 1988 Act requires any assignment of future copyright to be by way of a specifically enforceable agreement. The letter was unsupported by consideration and therefore void.

Despite these various pleaded positions, in his second witness statement Mr Penhallurick stated that following meetings and discussions he entered into an agreement on 24 November 2008. From what he says and his specifying the date of 24 November 2008 as the date of the agreement, it seems to me that Mr Penhallurick believed that he reached an agreement with MD5 on that date, this

Mr Green said he drafted the November 2008 Agreement because he was aware that the VFC software had been based around the methodology developed by Mr Penhallurick before he joined MD5 and because Mr Penhallurick had been complaining about the amount of work that he had done on VFC and what he thought were his rights in the software. Mr Green wanted something formal in place to confirm MD5’s rights.

A point developed by Mr Penhallurick in his evidence was that under the November 2008 Agreement he granted MD5 a licence and that the 7.5% bonus payments were royalty payments. He maintained this in cross-examination but conceded that nowhere in any of the exchanges between him and MD5 was there ever a mention of a licence. Mr Green was clear in his mind that there had never been talk of a licence.

It may be that in November 2008 Mr Penhallurick and Mr Green approached the November 2008 Agreement with different convictions in mind. Mr Penhallurick may have become convinced that he owned the copyrights in the VFC software. Mr Green believed that the copyrights were owned by MD5. I have found that they were owned by MD5 but must interpret the November 2008 Agreement on the assumption that I am wrong about that.

Although Mr Green wanted to put matters on a more formal basis, it cannot be said that the November 2008 Agreement was a formal document in the sense of being an agreement drafted with meticulous care by lawyers. The objective meaning of the language of the third paragraph does not support the contention that Mr Penhallurick was granting a licence or indeed granting anything. The words “the software developed at MD5 Ltd by yourself and sold as VFC is the sole property of MD5 Ltd including the access code” in my view objectively mean that the VFC software is the property of MD5. The software referred to can only be the VFC software and ownership can sensibly only mean ownership of the copyright in the VFC software.

Moreover, I take the view that the document as a whole is contemplating the parties’ position as to ownership in the future as well as in the past. The first paragraph, which discusses Mr Penhallurick’s bonus payment, says that the payment will be made only while Mr Penhallurick is employed by MD5 “and you are continuing your involvement and development of VFC software or future versions.” There the parties are contemplating the future as well as their relationship to date. Mr Penhallurick’s argument that in the third paragraph only copyright subsisting at that time is the subject of that paragraph rests on giving the word “developed” in the third paragraph its strict meaning, i.e. past tense. As I have said, this is not a document drawn up by lawyers to be construed with that sort of precision. I take the view that just as the subject of the first paragraph is or includes payments in the future, so the third paragraph objectively refers to ownership of copyrights in existence and which were to come into existence.

This interpretation of the November 2008 Agreement is not inconsistent with section 91(1) and (2) of the 1988 Act. They provide:

“91.

Prospective ownership of copyright.

I find that the November 2008 Agreement was a binding agreement between the parties following verbal exchanges by which terms had been agreed. If MD5 had not already been entitled to first ownership of the copyrights in the VFC software by reason of its status as Mr Penhallurick’s employer, including copyrights in VFC software yet to be written by Mr Penhallurick while he remained employed by MD5, the effect of the November 2008 Agreement would have been to assign those copyrights to MD5. The consideration was the payments made to Mr Penhallurick under the November 2008 Agreement.

The foregoing is subject to the question of what was meant by “access code” and whether the assignment was narrower than all copyrights in the VFC software. The first point to note is that whatever “access code” meant, on the face of the November 2008 Agreement the rights assigned were not limited to rights in the access code, they were included within a broader assignment of rights.

Mr Penhallurick said in his second witness statement:

“My understanding was that this part of the November Agreement referred to the security of the VFC computer programme in the form actually sold to end users at the time, and not to the source code, and/or only to such parts of that software that I had developed during my time at work. Accordingly, I did not consider that the ‘access code’ they refer to was the ‘source code’, as I created the source code (First Work) prior to my employment with the Defendant.”

In cross-examination Mr Penhallurick said that the idea had been that there should be a division of ownership of the copyright. The access code was to be MD5’s. The rest would belong to him. He justified this by saying that the source code other than the access code, what he called “every version of the core functionality” had been created by him in his own time. He conceded, however, that (unidentified) “enhancements” belonged to MD5.

Mr Green drafted the letter which became the November 2008 Agreement. He said in his second witness statement that he had a rudimentary grasp of computer language and that when he had written “access code” in the November 2008 agreement, he had meant “source code”. It was put to him in cross-examination that this would have made the November 2008 Agreement meaningless because the final sentence would then have forbidden Mr Penhallurick from changing the source code without the consent of Mr Green. In closing, counsel for Mr Penhallurick submitted that this challenge had forced Mr Green to change tack and say that access code meant the password protection part of the software. This does not accord with my note of the cross-examination. Mr Green was, as I recall, a little flustered, trying to recollect again what he had meant 12 years earlier and 8 years after his retirement. However, according to my note his final position was that his intention had been to ensure that Mr Penhallurick kept him up to date with changes to the source code. That is plausible.

I have found that all of the source code used for MD5’s products was created after Mr Penhallurick started his employment. He devoted all or most of his time at work to this project from January or February 2007. He dealt with this in cross-examination by saying that all the core functionality had been created in his own time. I think it is unlikely that he created none of the core functionality during his hours devoted to the VFC software at work. In any event, I have already found that copyright in source code created in his own time does not ipso facto belong to him.

No reason was given why there was any commercial logic in MD5 owning the copyright in the security source code plus the enhancements, whatever they were, and for Mr Penhallurick to own the rest. There was no indication anywhere in the documents of such a split.

Mr Green’s explanation that he used the term “access code” in the November 2008 Agreement when he meant “source code” was at first surprising, but he said he was not sophisticated in the field of software and was not shown to be so. To my mind his version of events is more probable than Mr Penhallurick’s.

In my view, the November 2008 Agreement applied to the ownership of copyright in all the VFC software, past and future.

An issue was raised as to whether MD5 acquired copyright by reason of the 2011 Agreement but that would stand or fall with the same issue in respect of the November 2008 Agreement.

The Eighth Work relied on by Mr Penhallurick is a user guide which he created for VFC version 2 in or around April 2011. It is not in dispute that MD5 used Mr Penhallurick’s guide as the basis for a guide of its own published to support version 4, released in August 2016.

Mr Penhallurick’s evidence was that he created his guide in his own time during evenings or lunch breaks without any input from MD5. Mr Boyd said that the user guide was done at the request of his cousin Adrian Green, a director of MD5. Mr Penhallurick said that it was not.

There is no doubt that Mr Penhallurick wrote the user guide while he was employed by MD5 and that its purpose was to assist end-users of MD5’s VFC product. In other words it was created to promote MD5’s business in those products. I take the view that this fell squarely within the duties for which Mr Penhallurick was employed. For the reasons discussed above in the context of the VFC software, I do not believe that the location or hours of Mr Penhallurick’s work overrides that view. MD5 was the first owner of the copyright in the user manual.

Section 104 of the 1988 Act provides:

“104.

Presumptions relevant to literary, dramatic, musical and artistic works

(1)

The following presumptions apply in proceedings brought by virtue of this Chapter with respect to a literary, dramatic, musical or artistic work.

(2)

Where a name purporting to be that of the author appeared on copies of the work as published or on the work when it was made, the person whose name appeared shall be presumed, until the contrary is proved –

(a)

to be the author of the work;

(b)

to have made it in circumstances not falling within section 11(2) …”

Mr Penhallurick relied on the presumption set up by s.104. He said that each version of the VFC software and the User Guide expressly identified him as the author of those works and the owner of the copyright in them. There was a presumption that he was the owner. MD5 did not deny that Mr Penhallurick had identified himself as author and owner.

In Henry Hadaway Organisation Ltd v Pickwick Group Ltd [2015] EWHC 3407 (IPEC) Melissa Clarke, sitting as a Deputy Enterprise Judge, had to consider s.105(1) of the 1988 Act which provides for a similar rebuttable presumption of ownership of copyright in a sound recording where copies of the recording bear a label or mark stating that a named person is the owner of the copyright. Ms Clarke held (at [67]) that the presumption may be rebutted if the court is satisfied that the contrary is true on the balance of probabilities. The section does not impose any higher burden of proof on the party seeking to rebut the presumption. I agree. I have found on the evidence that MD5 owns the copyrights in the VFC software and the user guide. Section 104 does not affect that finding.

Counsel for MD5 submitted in closing that if I were to find that the November 2008 Agreement was binding and, assuming MD5 was not already the first owner of the copyrights in the Works, served to assign those copyrights to MD5, the estoppel point became otiose. I agree. I need not consider the estoppel argument.

The 2016 Agreement is headed “Retention of Services & VFC Exclusivity Contract”. These were its terms:

“The purpose of the agreement is to ensure that

1.

The intellectual property rights of any version of VFC are not disclosed to any other party in the world. The intellectual property rights include database rights, confidential information, trade secrets, know-how, methodology, processes, trade names, trademarks and service marks.

2.

VFC is supported fully by responding to support enquiries from VFC license holders (customers) and potential customers as well as MD5 employees.

3.

VFC is regularly updated and developed to keep at the forefront of technology with updates to current processes and routines as well as new features and scope of use.

Whilst this agreement is in place MD5 will have exclusive rights to VFC methodologies including those previously developed by Michael Penhallurick.

This agreement will exist whilst MD5 pay Michael Penhallurick £5000 in advance of each month to be paid on the 1^st of each month. An invoice for this amount is to be provided on the last week of each month.”

Mr Penhallurick characterised the 2016 Agreement as an exclusive licence granted by him to MD5 to commercialise VFC, which he said meant the compiled end-product, after he left MD5 and in return Mr Penhallurick would receive £5000 per month.

Mr Boyd said that the 2016 Agreement was a consultancy agreement. After Mr Penhallurick had left MD5’s employment he provided consultancy services and sent invoices.

Leaving aside my findings above as to the ownership of the VFC software, on its face I do not read the 2016 Agreement as a licence to commercialise the VFC product. The first numbered paragraph restrains both Mr Penhallurick and MD5 from disclosing the IP rights in VFC, which obviously makes no sense. Construing it to mean a restraint on the disclosure of VFC source code would make more sense. The second and third numbered paragraphs should I think be read in association with the final paragraph. MD5 was to pay Mr Penhallurick £5000 per month for something, and the something was to assist in responding to enquiries from licence holders, to supply VFC updates and to allow MD5 the exclusive rights referred to in the penultimate paragraph.

It is the penultimate paragraph which implies the grant of an exclusive licence to MD5. But the licence relates to Mr Penhallurick’s methodologies, not software. In my view it was a recognition by both parties that the VFC software was based on Mr Penhallurick’s methodologies and that those had been created before his employment with MD5. In case this gave Mr Penhallurick any right which could be exercised against MD5 to restrain its marketing of VFC software, MD5 wished to ensure that there was a licence and was willing to pay for it as well as for Mr Penhallurick’s support services.

Mr Penhallurick alleged that by stopping the payments to Mr Penhallurick set out in the 2016 Agreement, MD5 was in breach. This was barely pursued in argument and I think for good reason. The 2016 Agreement explicitly states that it remained in place while MD5 paid Mr Penhallurick £5000 per month. Implicitly MD5 was entitled to stop payments when it chose to and bring to the 2016 Agreement to an end.

MD5 argued that in breach of the numbered paragraphs 2 and 3 of the 2016 Agreement Mr Penhallurick failed to respond to enquiries about VFC and failed to update and develop VFC. MD5 alleges that although Mr Penhallurick provided some updates in 2016 and 2017, nothing was done after September 2017. Mr Penhallurick was paid £20,000 between September 2017 and December 2017, a period during which, according to MD5, he did nothing. MD5 seeks damages or restitution of £20,000 for a total want of consideration between September and December 2017.

Mr Boyd’s evidence was that he had suspected that Mr Penhallurick was not putting time into the services MD5 needed under the 2016 Agreement.

In his second witness statement Mr Penhallurick said that until December 2017 he continued research into the password bypass feature of VFC; updated routines were made available to MD5 and their customer base. This did not require a new version of VFC, only that the updated password bypass be downloaded and plugged in. Mr Penhallurick added that all relevant technical support queries were responded to in a timely fashion.

Mr Penhallurick was not cross-examined on this evidence. I accept it and find that no sufficient ground was established for me to conclude that Mr Penhallurick was in breach.

MD5 alleges that before Mr Penhallurick left its employment, he was asked for a copy of version 3 of the VFC source code. The source code supplied after he had left had been modified such that it could not be used easily or at all to enable further development or analysis. MD5 interprets this as having been an attempt to sabotage the ability of MD5 to continue developing VFC. MD5 had to resort to the efforts of Mr Clark to allow MD5 to develop its latest versions, versions 4.5 and 5. MD5 says that since it owned the copyright in version 3, the modification by Mr Penhallurick was both an infringement of its copyright pursuant to s.21 of the 1988 Act and a breach of clauses 12 and 22 of the 2011

These allegations rested on Mr Clark’s evidence that the copy of version 3 supplied by Mr Penhallurick had been modified as alleged. For the reasons explained above, that evidence was not admissible. I reject this part of the counterclaim by MD5.

Mr Penhallurick’s claim is dismissed. MD5’s counterclaim is also dismissed save that it is entitled to a declaration that copyright in the Third to Eighth Works is owned by MD5.