HN Explorer

Is there anyway to protect/enforce your IP using a dev shop in another country?

9 points by ghostmatt ↗ HN
I am going to outsource my dev to a dev shop overseas in the Philippines. I have a contract I am going to use that says I own all the IP blah, blah blah. But I understand this is really hard to enforce in other countries.

Is there anything you can do to protect yourself with devs in other countries? I know people outsource development all the time ... Any advice on how to go about this properly?

10 comments

[ 4.2 ms ] story [ 43.0 ms ] thread
tossaway9000
The Philippines has some special laws on the books to make the country more friendly to outsourced jobs like telemarketing and support. I know there are specifics for foreign PII protection for example, you might want to see if anything exists for IP as well.

Keep in mind that like many things in the Philippines, enforcement isn't very consistent and probably seriousness varies greatly by the region.

I came across a PH goverment website leaking copious amounts of PII and couldn't manage to get anyone at the National Privacy Commission to take it seriously. I lived there for about 3 years.

908B64B197
No. That's the risk you take for cheaper devs.

If they launch the same product in China or the Philippines, good luck.

AnimalMuppet
It can get worse than that. They can offer to sell your source code to your competitors. And print out the offer on your office printer during a visit to your facility.

Yes, that really happened to us. Their code didn't work very well, either.

meadowy
Even better: Their code can also just not work at all and waste months of your time to the point that you are willing to spend more than $100k to fix everything by getting help from someone you know.

Yes that really happened in real life to a business owner I know.

908B64B197
> Yes that really happened in real life to a business owner I know.

I generally advise consultants that lost a client to an outsourced shop to check back in 3-6 months.

[dead] meadowy
For some strange reason, it seems like the first choice of those cost-saving business owners usually tends to be bad devs and then the irony is that it costs them way more in the end.
rossdavidh
Even if the laws exist in that other country, and even if they are enforced, you would need to have a familiarity with that country's legal system to be able to do anything about it.

If you're intending to establish a major presence in that other country, and spend a lot of time getting to know the local legal (and economic and labor) system, it might be possible. But, if you're not wanting (or perhaps even able) to invest a lot of time in knowing this other country and how business happens there (including what the laws are and which ones are enforced and how to get them enforced), you should consider it an unavoidable risk that your IP gets leaked.

TuringNYC
I did this with my startup, fairly successfully. There is a lot of great talent in multiple countries and it was nice to help them with amazing wages (like 2x their local dev wages.)

Couple of thoughts

- Modularize the codebase. DB layer. API layer. UI layer. Models. Different groups dont have access to each other's code, only to running APIs and docs

- Build the models yourself, dont outsource that. Whether its a neural network, algo, whatever. Make it yourself and expose it with an API.

- Give the backend API layer to one group and UI layer to another group.

- Everything MUST be in source control. No binaries. You have to build from scratch.

- ** You do all pull requests and merge code. You do the tagging and builds. You have to fully understand it. None of this works if you dont fully understand the pieces.

- Have good test harnesses and dummy data to work with that is representative of real data.

- Dont give PROD DB access to offshore teams, manage that yourself.

- Work with many people on small assignments. If they do well, expand the assignments. Eventually you'll have 5-7 people you trust for larger assignments.

- Write good automated tests against the API layer

You have to be hands on, or this all grinds to a halt since you get a circular blame game of the the blocking item is.

ghostmatt
This sounds great, but unfortunately I am not technical, so I wont be able to perform these tasks :(
meadowy
> not technical

You could take the first step to spend good money to hire a good technical person and pay that person well. Because it will pay off in protecting your IP.