Thanks to Tim Hodkinson for the link that led to this post. There’s more problems to the Vista EULA than meet the eye - and Microsoft has a very good chance of not being able to enforce it in both Washington state and the state of Maryland. Mark Rasch is a former head of the Justice Department’s computer crime unit and now is a lawyer specializing in computer crime, computer security, and privacy matters. From his article:

After this series of cases, many states considered reforming the Uniform Commercial Code to specifically cover those situations when a software developer can resort to self-help. As a result of these efforts, two states, Maryland and Virginia enacted versions of the Uniform Computer Information Transactions Act (UCITA).

The Maryland version of the statute allows the software vendor to obtain a court order that allows it to disable the software, or “[o]n material breach of an access contract or if the agreement so provides, [to] discontinue all contractual rights of access of the party in breach. . . ” In other words, the software vendor can only terminate access to the software if there has been a material breach, if doing so does not result in a breach of the peace, if there is no foreseeable risk of personal injury or significant physical damage to information or property.

The UCITA also provides a procedure for “electronic self-help” - that is, the termination of access or use of the software without a court order. The first thing to note is that, in Maryland at least, the law expressly notes that, “electronic self-help is prohibited in mass-market transactions.” Microsoft’s EULA is undoubtedly a mass-market transaction, and therefore Microsoft may be prohibited from exercising self-help in Maryland. Moreover, even in non mass-market transactions, before you can resort to self-help, the contract must provide notice that self help will be used, who will be told about the exercise of self help, and provide other notice. The Maryland law also provides that “electronic self-help may not be used if the licensor has reason to know that its use will result in substantial injury or harm to the public health or safety or grave harm to the public interest substantially affecting third persons not involved in the dispute.”

Thus, the harm to Microsoft (not getting a license fee) may be disproportionate to the harm to the licensee in having their systems completely shut down. This is particularly true if Vista is being used for a system providing medical treatment, controlling a power plant, or other such critical infrastructure. The Maryland law expressly provides that the “rights or obligations under this section may not be waived or varied by an agreement. . .”

Microsoft may have some trouble if it tries to enforce its EULA terms in a court in Washington State - especially if that court is running a computer using Vista. You see, all software license agreements with the courts in Washington State contains a “no self-help code” warranty where the vendor warrants that there is no “back door, time bomb, drop dead device, or other software routine designed to disable a computer program automatically with the passage of time or under the positive control of a person other than a licensee of the Software.” Thus, the Vista EULA terms would not apply to the Washington State courts!

To understand what Mr. Rasch means by self-help, you should read the rest of Vista’s EULA Product Activation Worries here.