Insights High Court rules on whether software was developed by employee in the course of his employment


Mr Penhallurick, a former employee of MD5 Ltd, claimed ownership of copyright in eight works relating to a technique he named “Virtual Forensic Computing” (VFC). Mr Penhallurick issued proceedings for infringement of his copyright against his former employer.

MD5 counterclaimed, amongst other things, for a declaration that it was the owner of the copyright.  The  issue turned on whether or not Mr Penhallurick had developed the software in the course of his employment.

His Honour Judge Hacon explained that agencies, typically the police, may wish to analyse the contents stored on a computer without, by the act of searching, corrupting or otherwise altering the files and thereby compromising a prosecution. Mr Penhallurick worked on a method of retrieving an image of the hard disk without writing on it, then booting up the image on a virtual machine so that the image could be investigated. He used a freely available product called VM Software to set up the replica of the target computer’s hardware and operating system. Part of Mr Penhallurick’s method involved developing a password bypass feature to get round the safeguards built into VM Software to prevent it from being manipulated.

The eight works in which Mr Penhallurick claimed copyright ownership comprised the earliest version of the VFC source code and its object code, four different versions of the VFC source code, a graphical user interface and a user guide.

There was no dispute that the works in question were created by common consent while Mr Penhallurick was employed by MD5. Under s 11(1) of the Copyright, Designs and Patents Act 1988, Mr Penhallurick was the author of all the works and therefore the first owner of the copyright in them unless any of them was made in the course of his employment by MD5, in which case MD5 was the first owner according to s 11(2). The question of ownership therefore turned on the meaning of “in the course of his employment” under s 11(2).

HHJ Hacon held that there was no doubt that making VFC software was the central task for which Mr Penhallurick was paid by MD5. Mr Penhallurick sometimes worked on the project at home, but HHJ Hacon found that whatever the exact proportion done at home, it did not displace the primary indication that it was work done in the course of his employment. HHJ Hacon explained that the fact that an employee works at home is relevant to the question of whether the work falls within the scope of the duties for which he is paid, but it may or may not carry much weight. Where it is otherwise clear that the work is within the employee’s duties, the place where he chooses to do the work will not generally make any difference. The same applied to the ownership of the tools the employee chooses to use. In this case, Mr Penhallurick sometimes used his own computer system, but because it was is clear that he was being paid to carry out a task agreed with MD5, whether he used tools supplied by MD5 or his own tools, the task was still carried out in the course of his employment.

These findings applied to all the software works created by Mr Penhallurick, except for: (i) the earliest version of the VFC source code; and (ii) its object code, which HHJ Hacon found were both irrelevant to Mr Penhallurick’s claim in any event. The first owner of the copyright in five of the eight works was therefore MD5.

As for the user guide, again, HHJ Hacon found there was no doubt that Mr Penhallurick wrote it while he was employed by MD5 and that its purpose was to assist end-users of MD5’s VFC product. In other words, it was created to promote MD5’s business in those products. This fell squarely within the duties for which Mr Penhallurick was employed. Again, the location or hours of Mr Penhallurick’s work did not override that view. MD5 was therefore the first owner of the copyright in the user guide as well.

Accordingly, Mr Penhallurick’s claim was dismissed and MD5’s counterclaim in respect of copyright ownership succeeded. (Michael Penhallurick v MD5 Ltd [2021] EWHC 293 (IPEC) (15 February 2021) — to read the judgment in full, click here).