What happens if an app developer uses copyrighted code without permission?

A software developer who copies or incorporates another person's copyrighted code without permission may expose both the developer and the company using the resulting application to substantial legal and commercial risk. The answer depends on ownership of the code, the licence under which it was obtained, whether the copied material is protected expression, the extent of use and whether an applicable exception or authorisation exists. The problem is not solved merely because the developer changed variable names or because the application works differently from the original program.

Pakistan's Copyright Ordinance, 1962 expressly includes computer programmes within the literary-work framework. Copyright does not give a proprietor exclusive rights over a programming language, mathematical principle, business idea or every method of solving a common technical problem. It may, however, protect original software expression subject to the statute. A sound legal assessment therefore requires a technical code comparison, a contractual ownership review and an analysis of distribution and deployment.

Establish precisely what was copied

Begin by distinguishing original source files, libraries, dependencies, visual assets, database structures, algorithms and general design approaches. Different components may be governed by separate licences or bodies of law. A third-party function copied verbatim into a proprietary repository raises a different issue from writing an independently implemented function that produces the same ordinary output.

The legal assessment should identify file names, commits, timestamps, lines allegedly reproduced, the original repository or package and the manner in which the code appears in the commercial product. A mere similarity report or security scanner warning is a starting point, not conclusive proof of infringement.

Determine the copyright owner

A developer may have written the code while employed, as a freelancer or as a contributor to an open-source project. Initial ownership and subsequent assignments need to be examined under the Copyright Ordinance and actual contracts. A company should not assume that code on its servers is necessarily its exclusive property. Nor should a former employee assume that every component written personally during employment can be reused freely.

Where the disputed code was purchased from a contractor, ask for the development agreement, delivery documentation and warranties concerning third-party material. Where the code belongs to an external company, confirm that the person who supposedly licensed it had authority to do so. Defective chains of title frequently become important during financing, licensing or acquisition due diligence.

Distinguish permitted open-source use from unauthorised copying

Open-source code can be lawfully used, but not on the assumption that 'public on GitHub' means copyright has been abandoned. Licence conditions may regulate attribution, preservation of notices, source disclosure, modified distributions, patent grants or other aspects of use. The obligations differ between permissive and copyleft licensing models.

The company should prepare a software bill of materials identifying packages, versions, licences and how each dependency is integrated. The legal effect of linking, modifying, conveying or deploying software must be examined in light of the particular licence. It is unsafe to claim that every open-source component requires publication of the entire application, or that no open-source condition can affect a closed-source business.

Reproduction, adaptation and distribution

Copyright rights in computer programmes may be engaged by copying substantial protected expression, adapting it or authorising unlawful distribution. The facts must establish what protected material was used and whether the use fell within an applicable permission. A development team's claim that the code was 'only used internally' may be relevant to remedies but is not a universal exemption from copyright obligations.

Commercial deployment increases the practical consequences because the application may be licensed to many users or incorporated into deliverables promised to enterprise clients. A company with warranties stating that it owns or is entitled to use all deliverables may face contractual exposure to its customers even before any infringement suit is resolved.

Preservation and internal investigation

Once an issue is identified, preserve the relevant repository state, commit history, package-lock files, communications, licences, invoices and build artefacts. Do not delete disputed code or instruct staff to rewrite the Git history to obscure provenance. Evidence preservation permits counsel and technical experts to reconstruct development and analyse the scale of any unauthorised incorporation.

Access to repositories should be appropriately restricted during the review, but normal business operations need not automatically cease without considering actual risk. If a live infringement appears substantial, the business should assess containment, temporary feature deactivation, replacement of disputed code and customer communications under appropriate legal guidance.

Responding to a copyright complaint

A properly prepared response identifies the claimant's work, asserted ownership, allegedly infringing files and applicable permissions. The recipient should request particulars where allegations are vague, while avoiding unnecessary admissions or destructive activity. Legal notices should not be answered solely by a developer's statement that copying was technically insignificant.

If a genuine problem exists, possible resolution can include a retroactive licence, agreed remediation, substitution of independently developed code, cessation of distribution or a commercially negotiated settlement. Any settlement should address historical uses, future rights, customer licences and confidentiality. A simple promise to delete files does not necessarily resolve deployed copies.

Remedies and litigation exposure

Where infringement is established, remedies may include injunctive relief, damages and other relief available under the Copyright Ordinance and procedural law. Separate claims may arise from confidentiality undertakings, breach of development agreements or false representations of ownership. The competent forum and requirements for interim relief depend on the actual claim and current law.

Quantifying loss requires discipline. A claimant may have licensed the code commercially, lost a contract or suffered other demonstrable harm; none of these amounts can be assumed without evidence. Equally, the defendant should not treat the absence of a proven immediate sale loss as automatic immunity from an infringement action.

A developer's employment and confidentiality duties

A programmer who previously worked for a competitor may carry general programming skill and experience to a new employer. Those skills are distinct from taking proprietary source files, confidential specifications or private repositories. The line between independent development and unauthorised copying should be documented through original design notes, commit histories and clean-room procedures where warranted.

Employment agreements should address ownership, acceptable use of third-party software, disclosure of open-source contributions and secure repository access. An employer seeking exclusive rights must ensure its assignments and third-party licence controls are effective. Overbroad prohibitions on general professional knowledge should not substitute for proper proof of protected information.

Practical example involving a fintech application

Suppose a fintech startup engages a developer to build a digital onboarding system. The developer incorporates substantial code from a former employer's proprietary application and removes its copyright notices. The startup later sells subscriptions and assures clients that its technology is fully proprietary. Even if management was unaware of the copying, the company's distribution, customer warranties and development controls must be examined for potential exposure.

By contrast, using a properly licensed public library in accordance with its conditions is not infringement merely because another application uses the same library. A thorough review should separate prohibited copying, licensed dependencies and independently written common functionality.

Transactional consequences for investment and sale

Code ownership defects often emerge during investor due diligence. A buyer may request a repository audit, all developer assignments, material open-source licences and a schedule of pending disputes. A serious unresolved claim can delay the transaction, affect valuation or require escrow, specific indemnities or technical replacement before completion.

The business should maintain an inventory of critical dependencies and proof of ownership from formation onward. A one-time emergency audit is less reliable than a regular review of incoming components, contributor permissions and licences whenever a major software release is planned.

Opinion and recommended course

A developer's unauthorised use of protected code can support copyright and contractual remedies, but the claim must be grounded in identifiable expression and actual rights. Immediately preserve code evidence, identify the alleged source, examine licences and assignments, and obtain both legal and technical assessment. Decide on remediation proportionately and record every corrective step.

Technology companies should introduce a software bill of materials, contractor IP assignments, source-code review policies and open-source approval procedures. These measures protect the business from later infringement claims and make it possible to demonstrate a reliable chain of title when the software is licensed, financed or sold.

Principal authorities for verification: Copyright Ordinance, 1962, including the definition of literary work and statutory infringement provisions; Contract Act, 1872; the relevant software and open-source licences; applicable remedies under Pakistani intellectual-property law.