Legal Aspects and Professional Ethics

Intellectual property in software

Copyright protects expression, not ideas. The idea "match students by overlapping free time" is free for anyone; your particular code is protected. Rewriting someone's code line by line with new variable names can still infringe, because the expression was copied. In China, software is protected by the Copyright Law and the Regulations on the Protection of Computer Software; copyright generally lasts for the author's life plus 50 years in China and life plus 70 years in the EU and the USA.

Software patents are handled differently around the world. In the USA, the Supreme Court's Alice v. CLS Bank decision (2014) made patents on abstract ideas implemented on a generic computer invalid; the European Patent Office requires "technical character"; China grants patents for software-related inventions that solve a technical problem with technical means. Engineers mainly need to know that patents exist, that independent invention is not a defence against a patent (unlike copyright), and that some open-source licences include patent grants.

Trademarks: before launching, check that "StudyBuddy" is not already a registered trademark for educational software — renaming an app after launch is expensive.

Who owns the code?

• Employees: in most countries, software written by employees as part of their job belongs to the employer (in China, the Copyright Law has special rules for works created in the course of employment; contracts usually settle it).
• Contractors/freelancers: ownership follows the contract; without a clear assignment clause, the contractor may keep the copyright.
• Students: ownership of student projects is usually defined by university policy and any agreement with a project sponsor. StudyBuddy's team must check WKU's policy before choosing a licence or signing anything with a company.

Open-source licences

"Open source" does not mean "no rules". Code without any licence is all rights reserved — you may read it on GitHub but not legally reuse it. An open-source licence grants permissions under conditions.

The key trigger for GPL obligations is distribution (giving copies to others: an app in an app store, software shipped to customers). Running GPL software on your own server to provide a web service is usually not distribution — the so-called "SaaS loophole" — which is exactly what the AGPL closes.

Compatibility — can code under licence A be combined with code under licence B in one distributed work?

• MIT/BSD code can go into almost anything, including GPL and proprietary software (keep the notices).
• Apache 2.0 code can be combined with GPL v3, but is considered incompatible with GPL v2 (because of its patent-termination and other terms).
• GPL code cannot be included in proprietary software that you distribute.
• For StudyBuddy's Android app (distributed through app stores), a GPL library would require publishing the whole app under the GPL; for the backend (not distributed), the GPL is less restrictive — but an AGPL library would require offering the source of the modified backend to its users.

Creative Commons (CC) licences are used for content, not code: CC BY (attribution), CC BY-SA (share-alike), CC BY-NC (non-commercial), CC BY-ND (no derivatives), and combinations. Instructors uploading slides to StudyBuddy should know which licence covers any textbook figures they include — and Buddy quoting those slides is a use of the material.

AI-generated code and copyright

Three questions matter:

1. Can AI output be protected by copyright? In the United States, the Copyright Office's position is that copyright requires human authorship; material generated by AI without sufficient human creative control is not protected, while human selection, arrangement and modification can be (courts confirmed the human-authorship requirement in Thaler v. Perlmutter). In China, the Beijing Internet Court decided in 2023 that an AI-generated image was protected because the user's prompts and parameter choices showed intellectual input. The law is still developing and differs by country.
2. Can AI output infringe someone else's copyright? Models trained on public code sometimes reproduce verbatim fragments, including code under GPL or other licences — "licence contamination". Several lawsuits about training data and outputs are ongoing (for example the class action against GitHub Copilot filed in 2022 and the New York Times case against OpenAI filed in 2023). Some tools offer filters that block suggestions matching public code.
3. What do the tool's terms say? Business terms of AI tools differ in who owns output, whether the vendor offers indemnity against copyright claims, and whether your code may be used for training.

Practical rules for StudyBuddy: prefer small, reviewed AI suggestions over large pasted blocks; enable duplicate-detection filters where available; run a licence/similarity scan in CI for large generated files; record significant AI use (the AI-use log from Chapter 2); never paste proprietary or confidential code into tools whose terms allow training on it.

Contracts, warranties and liability

• Licences and terms of service are contracts between the software provider and users.
• Warranty disclaimers: almost all open-source licences say the software is provided "AS IS", without warranty, and exclude liability. Commercial contracts often limit liability to the price paid. Such clauses are limited by law: they cannot always exclude liability for personal injury or gross negligence, and consumer-protection laws override some of them.
• Negligence: failing to take the care a reasonable professional would take (no testing of safety-critical code, ignoring known vulnerabilities) can create liability.
• Product liability: the European Union's revised Product Liability Directive (2024) explicitly treats software, including AI systems, as a product, so producers can be liable for damage caused by defective software — including defects from missing security updates.
• Service-level agreements (SLAs) promise availability and support, with penalties (Chapter 5's "transfer" risk response).

Regulating AI

EU AI Act (Regulation (EU) 2024/1689, in force since August 2024, applying in stages from 2025 to 2027) takes a risk-based approach:

For StudyBuddy: Buddy as a tutoring chatbot has transparency duties ("you are talking to an AI"); an AI that grades students or flags them for cheating would be high-risk; a camera feature that detects "student engagement" from facial expressions would be prohibited in the EU.

China regulates generative AI through the Interim Measures for the Management of Generative AI Services (in force since 15 August 2023): providers of public generative-AI services must respect content rules, protect personal information, prevent discrimination, label generated content and handle complaints; further rules on labelling AI-generated synthetic content took effect in September 2025. Other countries and states are adopting their own rules; the direction is clear: transparency, human oversight and accountability.

Computer-misuse law

Accessing a computer system without authorization is a crime in China, the EU, the USA and most other countries — also when the intention is "just to test security" or "to show them the bug". Penetration testing (Chapter 10) requires written permission and an agreed scope. Found a vulnerability in someone else's system? Follow their responsible disclosure / vulnerability-reporting process instead of exploiting it.

Professional ethics

Law sets the minimum; ethics asks what a good professional should do. The ACM/IEEE-CS Software Engineering Code of Ethics and Professional Practice (1999) has eight principles:

1. Public — act consistently with the public interest (the first and highest principle).
2. Client and employer — act in their best interests, consistent with the public interest.
3. Product — ensure products meet the highest professional standards possible.
4. Judgment — maintain integrity and independence in professional judgment.
5. Management — managers promote an ethical approach to development and maintenance.
6. Profession — advance the integrity and reputation of the profession.
7. Colleagues — be fair to and supportive of colleagues.
8. Self — lifelong learning and ethical practice.

The ACM's general Code of Ethics (2018) adds principles such as avoid harm, be honest and trustworthy, be fair and take action not to discriminate, and respect privacy.

A case: Volkswagen (2015). Engineers wrote software for diesel cars that detected when the car was on an emissions test bench and only then fully activated emission controls; on the road, the cars emitted far more nitrogen oxides than allowed. About 11 million vehicles were affected; the company paid tens of billions of dollars in fines and settlements, and at least one engineer was sentenced to prison in the United States. "My manager told me to" did not protect anyone. The code worked exactly as designed — the design was the problem.

Ethics of AI in education. Tools that judge students can be unfair even when they seem objective. A 2023 Stanford study found that popular detectors of AI-generated text classified more than half of essays written by non-native English speakers (TOEFL essays) as AI-generated, while almost never flagging essays by US-born students. At a university like WKU, where most students write in their second language, using such a detector to accuse students would be discriminatory. Ethical principles — avoid harm, be fair, keep a human in the loop, allow students to contest decisions, be transparent about AI use — are therefore not decorations but design requirements.

Making an ethical decision (a practical process):

1. What are the facts? Who are the stakeholders (especially those with no voice)?
2. What are the options?
3. What do the law, the code of ethics and the organization's policies say?
4. Which option best protects the public and the people affected? Could you explain it publicly?
5. Act, document, and — if you are asked to do something harmful — raise it internally, and, if necessary, through proper external channels.

Key takeaways

• Copyright protects code as expression (automatically); patents protect inventions (examined, ~20 years, independent invention no defence); trade secrets and trademarks protect secrets and names.
• Ownership of code follows employment law, contracts and — for students — university policy.
• Open-source licences: permissive (MIT, BSD, Apache 2.0 with patent grant), weak copyleft (LGPL, MPL), strong copyleft (GPL: triggered by distribution), AGPL (also network use). No licence = no permission. Check compatibility (Apache 2.0 ✓ GPL v3, ✗ GPL v2).
• AI output: copyright status varies by country (human authorship); outputs can reproduce licensed code; tool terms matter — review, filter, scan, log.
• Contracts disclaim warranties within legal limits; negligence and product liability (EU 2024: software is a product) still apply.
• EU AI Act: prohibited / high-risk (many education uses) / transparency (chatbots) / minimal. China regulates generative-AI services and content labelling.
• Unauthorized access is illegal, even for "testing"; use permission and responsible disclosure.
• ACM/IEEE Code: Public first; ethics is part of design — Volkswagen shows code can be the instrument of wrongdoing; biased AI tools in education cause real harm.