Mr. Cheng and Mr. Helms have published the results of shoddy research. As a customer who regularly requires my vendors to escrow their source code, I find it an invaluable tool for disaster recovery and business continuity in the event my software provider is unresponsive. The Business Case is clear: I calculate the lost revenue potential and compare it the tiny escrow costs. The insurance we pay is well worth it. We hope to never have to request release of escrow code in the first place. Moreover, my supplier offsets most of the escrow costs. Is the source code valid? I make sure the code is verified. Who wouldn't? Cheng and Helms need to do a bit more research I'm afraid.

Almost all of the instances cited should have been non-issues if proper due diligence into the escrow requirements or legal support for the escrow contract were addressed up front. Any agreement is subject to being ineffective if not properly documented and legally supportable. As far as the time and cost of getting a team able to support the application is concerned - I know for certain that if you don't have access to the source code (ie. it wasn't escrowed) and you have a software failure without the original developers to fix it - you have zero chance or ability to get it fixed. Given most developed software, I could find someone to review, troubleshoot, and fix a software bug if necessary. If you can't do this...perhaps more thought should have gone into the application tools and platform to begin with.

Hey Cheng and Helms -- you two interns clearly did not research the analyst commentary on this:

Gartner Affirms
“If you don’t plan to do regular audits, or verification that the version of the software you are using is in escrow, the agreement may be worthless… if the vendor falls behind on source code deposits, and has incomplete or unusable deposits, the escrow agreement will be useless.”

---Gartner Research Note - Feb. 7, 2005

Software licensing issues (of which escrow is one) are some of the least appreciated and most dangerous business risks.

Those risks can be reduced by employing open source software where possible (ignoring fud from those who want your business in a leash) and simply not signing custom development contracts that do not leave the rights to the product you are paying for with you. If you own it, there is no escrow to worry about.

The only practical "escrow" is an active and well-maintained CVS, or something like it. If you can't link your business software stuff up, push it into production, and have it do what it did yesterday, sooner or later you're in trouble.

This is a great piece! I am the CIO of a growing IT company and we often require our software developer vendors to escrow their software. It is always a battle and I have always questioned the benefit of the escrow.

I have not dealt with a vendor that has not willingly put a source code escrow clause into their contract. It seems silly to NOT do this. To refute each point:

1. Only a Small Percentage of Escrows Is Ever Released - People buy all kinds of insurance that never gets paid out. If the exposure is the re-implementation of an ERP for $5million, I pay the insurance premium.

2. Most Escrowed Source Code Is Defective - Seems reasonable, but your contract should specify the code in escrow should be updated for every patch and works properly. Again, this is just insurance. You take a leap of faith with every vendor, and just watch your exposure.

3. Customers Lack Expertise to Use the Released Source Code - This seems silly. Code is code, and any developer can read it. What you are buying is the vendor's expertise on the business side, not necessarily their technical expertise, which you can get consultants to help out with if needed.

4. Significant Delays and Legal Battles Often Accompany a Release - Breach of contract issues work that way. Whether it is for escrow code or other reasons, it happens.

5. Utilizing an Escrow Can Be Expensive - It is possible that there are costs, but those are the costs of insurance. A thousand bucks versus a new $5million ERP implementation is worth it. If it is a large software company you are working with, they already have escrow agreements in place, and may not be charged an additional fee for the escrow (though it will be part of the overall cost of the product).

Escrow source code = insurance. If you are risk taker, go without the insurance.

Just my 2 cents.

I tend to agree with the author, but he missed one very real legal reason why the escrow agreement can be false security. When a software company goes bankrupt the only asset of any real value is the source code. In my experience a bankruptcy judge 'sits at the right hand of God'...and can freeze, cancel or negate any previous business contract (excpet IRS liabilities!). So the first thing the judge will do is freeze all escrow agreements to preserve the value of the only significant asset the company has...the source code. You can try to fight this, but be prepared to spend a kings ransom on legal fees and wait a very long time.

They have changed the article without noting the changes. Original article had flase and misleading information, great shot at trying to save your credibility!

Cheng and Helms have pulled a fast one chaging teh original article without noting this retraction and correction . I will no longer read this rag online given the horrendous display of journalism by Cheng and Helms. They should open up a Pizza Shop and leave legal arguments and journalism to the real experts. If this were American Idol, I'd vote Cheng and Helms off the show.

Thank God for Jones Day they had the disclaimer, "The views set forth in this article are the personal views of the authors and do not necessarily reflect those of Jones Day."
We wouldn't want such a large firm spewing out misleading information that goes against the best practices of their clients.