I know how much fun it is to rag on lawyers, but this is pretty much exactly why companies have legal departments.
This should have been referred to the company’s legal department, who could have coordinated the response and/or investigation (if either were warranted), and then decided how to deal with something that sure looks a lot like invoice fraud.
This wasn’t a technical issue or a business issue; as soon as Monotype alleged a license violation, they made it a legal issue, and the lawyers should have been involved from that point on. It makes no sense for some random tech guy to be taking a meeting or handling the response on a licensing dispute.
And quite likely more expensive than the spurious license fee. Lawyers and businesspeople might pay them to go away, it takes a (self-proclaimed) nerd scorned to go for justice here!
It feels like the recipient company did an awful lot of work in response to what was at best a fishing expedition. A serious complaint about licensing that demanded a real response would have been sent by post. It's not clear to me that scattershot LinkedIn messages deserve any response at all. The fact that the initial message lies about trying to contact him another way is another check in the "ignore this completely" column.
The same way that I wouldn't bother to fact-check a spam phone caller, why give any credence to this kind of thing?
The author explains this - initially, responding to the Mootype rep was not really given much thought or concern, for the same reasons you point out.
But then the rep started emailing EVERYONE, until eventually someone's manager started to panic about it. And when managers start to panic, it becomes everyone's problem.
So really this ended up being simply a successful scare tactic by Monotype.
Paying for fonts is something I will never understand, I have a perfect vision but I'm nearly blind to fonts it makes nearly no difference to me (except for windings)
Wingdings isn't really a "font" in the same way that Times New Roman is a "font". Wingdings and and Webdings were basically proto-emojis, a vestige of the old "dingbats" publishers would put at the top of chapter pages to make them look nice.
“But before responding, the digital team would do their own investigation into the fonts we use and the licences we own so we could verify everything was in compliance. […] messaged a dozen or so more people from different parts of the business, hoping to hook just one person who would reply to the scary message they were sending.”
Piece of advice for the future: if you receive a message like this, and don’t want the sender to reach out to other people in your organization — acknowledge the message.
…I would think the appropriate behavior would be for the security team to send an announcement stating they've seen an uptick of phishing emails, with an example screenshot, and to please not respond to phishers.
The business has no contract with Monotype, has conducted no business with Monotype, and has also (as they double checked) committed no infringement against Monotype. In short, the Monotype sales rep has no entitlement to any of the business' time.
And yet they managed to get quite a lot of it. It looks like double digit humans spent double digit hours, some of that totally in parallel to each other by accident.
In part, that's because all the people who got nerd-sniped by this didn't ever actually send a response back. In part, it's because several different business units decided to try to Handle It without doing the rational thing of centralizing to legal counsel.
By spamming multiple people at multiple departments, Monotype is probably relying on one department screwing up and responding with something that’d strengthen their (non-existent, apparently) case.
Since their behavior is indistinguishable from scammers, it probably makes sense to also ask procurement/design to additionally ban the vendor.
I think it is more nuanced than that -- they are sending a message via LinkedIn, is it really the company or a scam?
You should take time to respond appropriately and not be rushed in all cases. By acknowledging the message they'll want to continue the discussion. It's probably worth considering a standard response to approaches like this, along the lines of "Please contact us on generic-something@domain, I cannot discuss this on my personal social media account."
Do these tactics ever work out for companies in the long term?
Over my 20 years in tech, I've seen a couple cases where someone installed something they shouldn't have and we got threatening emails from the companies who somehow caught wind.
It's always resulted on our side with a total corporate ban on using anything from that company, even things that are otherwise OK / open source.
For instance at a previous company I worked, Oracle came calling for "VirtualBox Tools" trying to charge us some asinine amount because like one user had it installed and they wanted us to pay seats for the entire company. This resulted in a swift and decisive total corporate ban on VirtualBox.
I've seen this at a couple companies and can't imagine we're alone in this. You're trading long-term business for short-term gains.
Oracle is, Rambus is still around, Qualcomm appears to be quite strong.
I feel for font foundries, it's hard work to make great fonts. People want great fonts. Actually paying for them is kind of an afterthought. It sort of seems like some of the big ones should put together an MPEG like group, get all the major foundaries to join and then have a couple licensing options. Some annual fee based upon your use and application and you get to use all the fonts. If it was like $120 or less for personal use, I think I'd buy the license for the family. I suspect they'll want 10x what I think is reasonable.
In the United States if someone makes a false statement about you, comminicates that statement to a third party, and that statement can or has caused financial harm, you can reocover damages in court. If there are similar laws in your country. it's probably worth sending a demand letter to cover the time wasted on investigation.
I think monotype would argue they only sent the message to the company they were shaking down.
Of course, LinkedIn’s ToS might beg to differ. I wonder if the bar is worded like a big and statement like you said, or if the disclosure to the third party has to be part of the chain of harm or something (and what precedent says).
This is like the old IBM shakedown playbook "we have thousands of patents, if we dig enough we'll find one you infringe upon, so better pay for peace of mind". I do assume that like in the case of IBM, some companies do pay...
You need to have enough HM karma to see the downvote button. A long time back it used to be 100, no idea if it still is. Have an upvote to get you a step closer.
This should have been referred to the company’s legal department, who could have coordinated the response and/or investigation (if either were warranted), and then decided how to deal with something that sure looks a lot like invoice fraud.
This wasn’t a technical issue or a business issue; as soon as Monotype alleged a license violation, they made it a legal issue, and the lawyers should have been involved from that point on. It makes no sense for some random tech guy to be taking a meeting or handling the response on a licensing dispute.
except that most don't, and the lawyers they can call are much more expensive than their internal employees
The same way that I wouldn't bother to fact-check a spam phone caller, why give any credence to this kind of thing?
But then the rep started emailing EVERYONE, until eventually someone's manager started to panic about it. And when managers start to panic, it becomes everyone's problem.
So really this ended up being simply a successful scare tactic by Monotype.
We’re reasonably sure your report is incorrect, and it doesn’t contain compelling evidence to back up its claims.
Our standard auditing fee for requests like this is $10,000, pre-paid to an escrow account and refundable if we find the use of an unlicensed font.
Or something. Not a lawyer.
https://www.bluejeanscable.com/legal/mcp/index.htm
I wish I could find the original writeup from Blue Jeans, it was frickin' magnificent.
Letter: https://www.bluejeanscable.com/legal/mcp/monsterletter.pdf
Exhibits: https://www.bluejeanscable.com/legal/mcp/exhibits.pdf
Response: https://www.bluejeanscable.com/legal/mcp/response041408.pdf
https://youtu.be/JdKV1L1DJHc
Piece of advice for the future: if you receive a message like this, and don’t want the sender to reach out to other people in your organization — acknowledge the message.
In part, that's because all the people who got nerd-sniped by this didn't ever actually send a response back. In part, it's because several different business units decided to try to Handle It without doing the rational thing of centralizing to legal counsel.
Since their behavior is indistinguishable from scammers, it probably makes sense to also ask procurement/design to additionally ban the vendor.
I think it is more nuanced than that -- they are sending a message via LinkedIn, is it really the company or a scam?
You should take time to respond appropriately and not be rushed in all cases. By acknowledging the message they'll want to continue the discussion. It's probably worth considering a standard response to approaches like this, along the lines of "Please contact us on generic-something@domain, I cannot discuss this on my personal social media account."
Journalistic attention can be very helpful at getting companies to reform bad behaviour (at least temporarily)
Over my 20 years in tech, I've seen a couple cases where someone installed something they shouldn't have and we got threatening emails from the companies who somehow caught wind.
It's always resulted on our side with a total corporate ban on using anything from that company, even things that are otherwise OK / open source.
For instance at a previous company I worked, Oracle came calling for "VirtualBox Tools" trying to charge us some asinine amount because like one user had it installed and they wanted us to pay seats for the entire company. This resulted in a swift and decisive total corporate ban on VirtualBox.
I've seen this at a couple companies and can't imagine we're alone in this. You're trading long-term business for short-term gains.
I feel for font foundries, it's hard work to make great fonts. People want great fonts. Actually paying for them is kind of an afterthought. It sort of seems like some of the big ones should put together an MPEG like group, get all the major foundaries to join and then have a couple licensing options. Some annual fee based upon your use and application and you get to use all the fonts. If it was like $120 or less for personal use, I think I'd buy the license for the family. I suspect they'll want 10x what I think is reasonable.
Of course, LinkedIn’s ToS might beg to differ. I wonder if the bar is worded like a big and statement like you said, or if the disclosure to the third party has to be part of the chain of harm or something (and what precedent says).
Do these people have no actual work to do? Refer to legal if you really feel compelled, and just move on...