Michael Penhallurick v MD5 Ltd

JurisdictionEngland & Wales
JudgeHacon
Judgment Date15 February 2021
Neutral Citation[2021] EWHC 293 (IPEC)
Date15 February 2021
Docket NumberCase No: IP-2018-000200
CourtIntellectual Property Enterprise Court

[2021] EWHC 293 (IPEC)

IN THE HIGH COURT OF JUSTICE

BUSINESS AND PROPERTY COURTS OF ENGLAND AND WALES

INTELLECTUAL PROPERTY ENTERPRISE COURT

Royal Courts of Justice, Rolls Building

Fetter Lane, London, EC4A 1NL

Before:

HIS HONOUR JUDGE Hacon

Case No: IP-2018-000200

Between:
Michael Penhallurick
Claimant
and
MD5 Limited
Defendant

Ben Longstaff (instructed by Virtuoso Legal) for the Claimant

Michael Conway (instructed by Lupton Fawcett LLP) for the Defendant

Hearing dates: 2–3 July 2020

Approved Judgment

HIS HONOUR JUDGE Hacon

Hacon Hacon Judge

Introduction

1

The Claimant, Mr Penhallurick, claims ownership of copyright in eight works, all of them relating to a technique he has called “Virtual Forensic Computing”, or “VFC”. He alleges infringement of his copyrights by his former employer, the Defendant (“MD5”).

2

MD5 asserts that it owns the copyrights and counterclaims for a declaration to that effect, also claiming that Mr Penhallurick was in breach of his contract of employment and has infringed MD5's copyrights.

3

Ben Longstaff appeared for Mr Penhallurick, Michael Conway for MD5.

VFC

4

Agencies, typically the police, may wish to analyse the contents stored on a computer without, by the act of searching, corrupting or otherwise altering the files and thereby compromising a prosecution. Mr Penhallurick worked on a method of retrieving an image of the hard disk without writing on it, then booting up the image on a virtual machine so that the image can be investigated. Mr Penhallurick used a freely available product called VM Software to set up the replica of the target computer's hardware and operating system. Computer programs generally have inbuilt safeguards to prevent them from being manipulated in this way, so part of Mr Penhallurick's method involved a password bypass feature he developed.

The development of VFC

5

Mr Penhallurick conducted research in this field while he was studying for his MSc degree at Cranfield University from 2002 until 2005. His work resulted in his Master's thesis, consisting of a description of his VFC method, an abridged version of which was published by the University in September 2005. The method was manual in the sense that although it used proprietary software, it was not performed automatically by the operation of software.

6

Mr Penhallurick says that in 2005 and 2006, while still developing his VFC method, he wrote his own software which would allow a computer to perform the method automatically. He also began work on a graphical user interface and a user manual.

7

Mr Penhallurick's employment by MD5 began on 6 November 2006. According to him, he was employed to assist with forensic case work supplied to MD5 by police forces and his primary duties were to carry out forensic computer investigations, prepare witness statements, attend court and give evidence.

8

MD5's case is that Mr Penhallurick's duties were more flexible and extensive than this. MD5 further says that if Mr Penhallurick created any VFC software before the start of his employment it formed no part of the VFC software created for MD5.

9

By early 2007 Mr Penhallurick had developed software which permitted a fully automated version of VFC, including a graphical user interface. Both he and MD5 at the time referred to this as “VFC version 1”.

10

According to Mr Penhallurick it incorporated code written before his employment. He also says that after he joined MD5 his work on this software was done outside the scope of his employment, using his own computer and primarily in his own time.

11

MD5's version of events is different. The manual VFC method which Mr Penhallurick brought to MD5 was slow and cumbersome. In or about January 2007 John Green and Geoffrey Boyd of MD5 discussed with him the possibility of developing software to implement the method. All such software was created by Mr Penhallurick following his discussion with them and as part of his duties as employee.

12

Following the completion of VFC version 1, Mr Penhallurick created three further versions of the VFC software, released in April 2008, May 2014 and August 2016, all built on version 1. Mr Penhallurick's case is that these too were created in his own time; MD5 says that like version 1 they were developed in the course of Mr Penhallurick's duties as employee.

The Works

13

These are the copyright works in issue, using the First to Eighth Work titles given to them by Mr Penhallurick:

First Work

The earliest version of the VFC source code, said to have been created before Mr Penhallurick's employment with MD5.

Second Work

The object code compiled from the First Work.

Third Work

A fully automated version of the First Work, referred to as “VFC version 1”.

Fourth Work

The graphical user interface (“GUI”) for the Third Work.

Fifth Work

Version 2 of the VFC source code released on or about 4 April 2008.

Sixth Work

Version 3 of the VFC source code released on or about 12 May 2014.

Seventh Work

Version 4 of the VFC source code released on or about 10 August 2016.

Eighth Work

The user guide for v.2 VFC source code created during Mr Penhallurick's employment with MD5.

The Agreements

14

Mr Penhallurick's first contract of employment with MD5, dated 6 November 2006, was for a fixed three month term. In January or February 2007 he entered into more permanent terms of employment by a written contract which, as both parties agree, was backdated, but incorrectly to 6 October 2006. It has consequently been referred to as “the 2006 Agreement”.

15

From March 2007 VFC software was offered and sold to customers of MD5, but the basis on which this was done is disputed. Mr Penhallurick says that the software was offered and sold under licence from him. MD5's case is that customers were given a written End User Licence Agreement (“EULA”) identifying MD5 as the licensor, which it was, and that Mr Penhallurick had approved the EULA.

16

In November 2008 Mr Penhallurick and MD5 signed an agreement under which Mr Penhallurick was given an annual bonus of 7.5% of annual sales by MD5 of VFC software. It was referred to in evidence and argument as “the November Agreement” but to be clearer I will call it “the November 2008 Agreement”.

17

MD5's primary case is that since all the VFC software was written by Mr Penhallurick as an employee, MD5 has always been the first owner of the copyright in all versions. MD5 has a secondary case: under the November 2008 Agreement the copyright in the VFC software, past and future, was assigned by Mr Penhallurick to MD5.

18

Mr Penhallurick denies that this was the effect of the November 2008 Agreement but says that, alternatively, at most only copyright existing as of the date of the agreement was assigned, not copyright in software to be created in the future.

19

A further agreement was entered into on 8 November 2011 (“the 2011 Agreement”). The terms were not relevantly different from those of the November 2008 Agreement, save that there was an increase of the annual bonus to 10% of the value of VFC software sales.

20

On 26 February 2016 Mr Penhallurick resigned from his employment with MD5. His last working day was 22 April 2016 and his last day of employment was 30 April 2016.

21

On 20 April 2016 the parties entered into a final, written, agreement (“the 2016 Agreement”). Its effect is in dispute as I will discuss below.

22

In January 2018 MD5 stopped payments under the 2016 Agreement which, by common consent, brought the 2016 Agreement and the commercial relationship between Mr Penhallurick and MD5 to an end.

Estoppel

23

Aside from its defences to Mr Penhallurick's claims referred to above, MD5 runs a defence of estoppel. Its case is that Mr Penhallurick made repeated representations to MD5 that MD5 owned the VFC software, that MD5 acted in reliance on those representations to its detriment by compensating Mr Penhallurick above his standard remuneration, by allowing Mr Penhallurick to work on the VFC software instead of forensic analysis and other duties and by incurring expense in the marketing of the software. Mr Penhallurick is now estopped from denying MD5's title to the software. Alternatively Mr Penhallurick represented that he was developing the software in the course of his employment by MD5 and is now estopped from contending otherwise.

24

Mr Penhallurick denies making any such representations and all other elements of MD5's case on estoppel; MD5 was at all times aware that Mr Penhallurick owned the software.

The counterclaim

25

MD5 pleaded a counterclaim in three parts. First, Mr Penhallurick was in breach of the 2011 Employment Agreement by failing to maintain full and correct versions of the VFC source code and failing to provide the source code to MD5. This was not pursued at trial.

26

Secondly, Mr Penhallurick infringed MD5's copyright and also acted in breach of the 2011 Agreement by making unauthorised adaptations of the VFC software and by storing versions of it.

27

Thirdly, Mr Penhallurick was in breach of the 2016 Agreement by failing to provide updates to the VFC software and support work in relation to the software after he left MD5's employment.

The witnesses

Michael Penhallurick

28

Mr Penhallurick gave clear and direct answers to the questions put to him in cross-examination. He made realistic concessions during the course of what appeared to me to be his honest attempt to explain matters as he saw them.

29

Time was taken up with questions about comparisons of source code. This arose from disclosure given by Mr Penhallurick very late in the day. It is enough to say here that the disclosure neither assisted nor damaged Mr Penhallurick's...

To continue reading

Request your trial
1 cases
  • Michael Penhallurick v MD5 Ltd
    • United Kingdom
    • Court of Appeal (Civil Division)
    • December 2, 2021
    ...BUSINESS AND PROPERTY COURTS OF ENGLAND AND WALES CHANCERY DIVISION INTELLECTUAL PROPERTY ENTERPRISE COURT His Honour Judge Hacon [2021] EWHC 293 (IPEC) Royal Courts of Justice, Strand, London, WC2A 2LL Before: Lord Justice Arnold Mrs Justice Falk and Sir Christopher Floyd Case No: A3/2021/......
2 firm's commentaries
  • Quarterly Copyright Blog - Q4
    • Canada
    • Mondaq Canada
    • October 27, 2021
    ...Party of Canada 2021 FC 425. When is a Work Created in the Course of Employment? An English case, Penhallurick v. MD5 Limited [2021] EWHC 293 (IPEC), concluded there is no single test to be applied. Whether or not given acts were carried out in the course of employment for the purposes of s......
  • Quarterly Copyright Blog - Q4
    • Canada
    • Mondaq Canada
    • October 27, 2021
    ...Party of Canada 2021 FC 425. When is a Work Created in the Course of Employment? An English case, Penhallurick v. MD5 Limited [2021] EWHC 293 (IPEC), concluded there is no single test to be applied. Whether or not given acts were carried out in the course of employment for the purposes of s......

VLEX uses login cookies to provide you with a better browsing experience. If you click on 'Accept' or continue browsing this site we consider that you accept our cookie policy. ACCEPT