[ISN] SAP admits 'inappropriate downloads' from Oracle

From: InfoSec News (alerts@private)
Date: Tue Jul 03 2007 - 22:31:22 PDT


By Dawn Kawamoto
Staff Writer, CNET News.com
July 3, 2007

SAP has acknowledged in a court filing that its TomorrowNow subsidiary 
engaged in "inappropriate downloads" of Oracle's proprietary fixes and 
support documents.

SAP, a German-based enterprise software applications giant, also noted 
in its filing late Monday that the U.S. Justice Department has requested 
documents from the company and Texas-based TomorrowNow. SAP said it is 

The company made the filing in response to a lawsuit that rival Oracle 
filed in March. In the suit, Oracle alleged that third-party support 
company TomorrowNow engaged in more than 10,000 illicit downloads, in 
which it accessed more information than it was entitled to receive when 
acting on behalf of its customers who were using Oracle applications. 
Oracle said that, in some cases, TomorrowNow downloaded materials 
unrelated to the type of software that a particular TomorrowNow customer 
was running and, in other cases, presented Oracle support materials as 
its own.

SAP issued an apology and said it has taken action to resolve the issue.

"Even a single inappropriate download is unacceptable from my 
perspective. We regret very much that this occurred," Henning Kagermann, 
SAP's chief executive, said in a statement. "When I learned what 
happened, I promptly took action to strengthen operational oversight at 
TomorrowNow while assuring that we maintain excellent service for 
TomorrowNow's customers going forward."

SAP appointed SAP America Chief Operating Officer Mark White as 
TomorrowNow's executive chairman to manage the company's operations and 
compliance programs. Andrew Nelson, TomorrowNow's chief executive, will 
report to White.

"We have no evidence that Andrew was aware of these inappropriate 
downloads," Kagermann said in an analyst and press conference call 
Tuesday morning. The internal investigation is continuing.

"I told my people to do as much as possible," Kagermann said. "It's 
important to get entire clarity (of the situation)." SAP said that 
existing and new policies will be enforced at TomorrowNow, and that it 
will renew training for employees.

The company also noted that SAP and SAP America did not have access to 
Oracle's intellectual property via TomorrowNow, because its subsidiary 
operates on a separate system and the information is not shared.

"We don't think a jury is likely to think much of the argument that the 
activity was confined to a subsidiary--and that as a result SAP should 
be less culpable," Pat Walravens, an analyst with JMP Securities, said 
in a research note. "SAP argues that this conduct is not the same as 
'corporate theft'--again, we think a jury might think the TomorrowNow 
conduct seems very much like corporate theft."

Walravens noted that the SAP-TomorrowNow debacle will be a "net 
positive" for Oracle, which generates $10 billion a year in support and 
maintenance fees.

SAP's battle with perception

One analyst noted that while SAP has a reputation of being a credible 
company, it will have to work hard to reassure customers.

"It's up to SAP to make sure that customers feel that doing business 
with them is not a mistake," said Peter Kuper, a Morgan Stanley analyst. 
"If they can't assure them, there could be a backlash, but this is not a 
catastrophic event that they can't recover from."

Oracle, in response, said its lawsuit provided the means to explore the 
extent of the issue.

"SAP CEO Henning Kagermann has now admitted to the repeated and illegal 
downloading of Oracle's intellectual property. Oracle filed suit to 
discover the magnitude of the illegal downloads and fully understand how 
SAP used Oracle's intellectual property in its business," Geoff Howard, 
Oracle's outside counsel, said in a statement.

Oracle and SAP are fierce competitors in the applications market, as 
well as in the lucrative support and maintenance arena.

SAP acquired TomorrowNow in 2005, shortly after Oracle acquired 
PeopleSoft and J.D. Edwards. TomorrowNow provides third-party 
maintenance and support to PeopleSoft and J.D. Edwards customers.

SAP and TomorrowNow launched a major marketing campaign to woo away 
Oracle customers, soon after its rival completed its major acquisition.

Honeywell and Merck, for example, signed up for TomorrowNow's services. 
But, according to SAP's court filing, TomorrowNow used customers' Oracle 
licenses and passwords to download materials unrelated to the licenses 
they held, unbeknownst to those customers.

SAP also admitted in its court filing that portions of TomorrowNow's 
PeopleSoft Daylight Saving Time offering is "substantially similar and 
in some instances identical" to Oracle's DST offering.

"Defendants further aver that while (TomorrowNow) TN referred to 
Oracle's 'DST Solution' during the course of researching and preparing 
TN's PeopleSoft Daylight Savings Time solution, TN also conducted its 
own independent research," according to the filing.

The PeopleSoft Daylight Saving Time solution features written materials 
on how to address daylight saving time when using PeopleSoft 
applications. TomorrowNow plans to discontinue the use of the materials 
where it is found to be similar or identical to Oracle's DST.

SAP and Oracle will have a case management hearing September 4 in the 
U.S. District Court for Northern California.

Copyright 1995-2007 CNET Networks, Inc. All rights reserved.

Attend Black Hat USA, July 28-August 2 in Las Vegas, 
the world's premier technical event for ICT security 
experts. Featuring 30 hands-on training courses and 
90 Briefings presentations with lots of new content 
and new tools. Network with 4,000 delegates from 
70 nations.   Visit product displays by 30 top
sponsors in a relaxed setting. Rates increase on 
June 1 so register today. http://www.blackhat.com

This archive was generated by hypermail 2.1.3 : Tue Jul 03 2007 - 22:41:29 PDT