REPORT/RECOMMENDATION TO THE BOARD OF SUPERVISORS
OF THE COUNTY OF SAN BERNARDINO
AND RECORD OF ACTION
October 6, 2020
FROM
LARRY AINSWORTH, Chief Information Officer, Information Services Department
SUBJECT
Title
Software License Agreement and Foundation Agreement for Symantec Software Products and Services
End
RECOMMENDATION(S)
Recommendation
1. Approve Software License Agreement with Symantec Corporation, for Symantec software products and services, for the period of November 1, 2020, through October 31, 2021.
2. Approve Foundation Agreement with Broadcom Inc., for Symantec software products and services, for the period of November 1, 2020, through October 31, 2021.
(Presenter: Jake Cordova, Information Services Division Chief, 388-0503)
Body
COUNTY AND CHIEF EXECUTIVE OFFICER GOALS & OBJECTIVES
Improve County Government Operations.
Operate in a Fiscally-Responsible and Business-Like Manner.
FINANCIAL IMPACT
Approval of the Symantec Software License Agreement and Broadcom Foundation Agreement will not result in the use of Discretionary General Funding (Net County Cost). These agreements do not commit the County to make any purchases. If future purchases are made under these agreements, ISD will adhere to County purchasing policies and return to the Board for approval, if necessary.
BACKGROUND INFORMATION
The County utilizes Symantec cybersecurity and network management software products and services to protect against malware and other cyber threats, secure workloads processed in a multi-cloud environment, provide comprehensive analysis of network activity, and provide a detection and response solution.
Broadcom owns the Symantec name and the Symantec cybersecurity and network management software products and services. The Symantec Software License Agreement (License Agreement) and the Broadcom Foundation Agreement (Foundation Agreement) are Broadcom’s standard commercial agreements that govern the Symantec software products and services. The License Agreement and the Foundation Agreement contain terms that differ from the standard County contract. Broadcom will not negotiate these terms. The non-standard terms include the following:
Broadcom Foundation Agreement:
1. Broadcom has the right to assign without notice or consent.
• The County must approve any assignment of the contract.
• Potential Impact: Broadcom may assign the contract to a third party or business with which the County is legally prohibited from doing business due to issues of Federal debarment or suspension and conflict of interest, without the County’s knowledge.
2. Prevailing party in any arbitration is entitled to recover attorneys’ fee and costs.
• The County standard contract requires each party to bear its own costs and attorney fees, regardless of who is the prevailing party.
• Potential Impact: If either party institutes any legal proceedings related to the Agreement, the prevailing party will be entitled to recover reasonable attorneys’ fees, which could exceed the total contract amount.
3. Contract term is indefinite.
• County Standard Practice 11-06SP does not permit indefinite term or automatically renewing contracts unless approved by the Board.
• Potential Impact: There is no end date to the contract and the County is indefinitely bound to the terms and conditions of the contract until proactively terminated.
4. Except for enforcing intellectual property rights, all disputes will be settled by binding arbitration.
• The County standard contract does not require arbitration.
• Potential Impact: Arbitration decisions are not appealable.
5. County indemnifies Broadcom against all damages, fees, (including reasonable attorney’s fees) fines, judgments, costs and expenses finally awarded as a result of a third party action alleging a bodily injury or death which arises under the Agreement, provided that such liabilities are the proximate result of gross negligence or intentional tortuous conduct on the part of the indemnifying Party, and for any claim that any data, materials, items or information supplied to Broadcom under the Agreement infringes any US patent, copyright or trademark within the jurisdictions where Broadcom is provided with such information.
• The County standard contract does not include any indemnification or defense by the County of a Contractor.
• Potential Impact: By agreeing to indemnify Broadcom, the County could be contractually waiving the protection of sovereign immunity. Claims that may otherwise be barred against the County, time limited, or expense limited could be brought against Broadcom without such limitations and the County would be responsible to defend and reimburse Broadcom for costs, expenses, and damages, which could exceed the total contract amount.
6. No County standard insurance.
• The County standard contract requires contractors to carry appropriate insurance at limits and under conditions determined by the County’s Risk Management Department.
• Potential Impact: The contract does not include County standard insurance requirements. This means that the County has no assurance that Broadcom will be financially responsible for claims that may arise from the County’s use of the software, which could result in expenses to the County that exceed the total contract amount.
7. Limitation of liability of two times the amount paid by the County for the offering that gave rise to the breach in the twelve month period prior to the date such breach occurred.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the contract amount leaving the County financially liable for the excess. In addition, the County’s liability under the contract is not similarly limited.
Symantec License:
1. Term is perpetual.
• County Standard Practice 11-06SP does not permit indefinite term or automatically renewing contracts unless approved by the Board.
• Potential Impact: There is no end date to the contract and the County is indefinitely bound to the terms and conditions of the contract.
2. Symantec may assign without consent and without notice.
• The County must approve any assignment of the contract.
• Potential Impact: Symantec, now Broadcom, may assign the contract to a third party or business with which the County is legally prohibited from doing business due to issues of Federal debarment or suspension and conflict of interest, without the County’s consent or knowledge.
3. Broadcom’s/Symantec’s liability is limited to the fees paid by the County for the licensed software giving rise to the claim, except for death or personal injury arising from Broadcom’s/ Symantec’s negligence.
• The County standard contract does not include a limitation of liability.
• Potential Impact: Claims could exceed the liability cap and the contract amount leaving the County financially liable for the excess. In addition, the County’s liability under the contract is not similarly limited.
4. No indemnity from Broadcom/Symantec.
• The standard contract provision for intellectual property indemnity is: Contractor will indemnify, defend, and hold harmless County and its officers, employees, agents and volunteers, from any and all third party claims, costs (including without limitation reasonable attorneys’ fees), and losses for infringement of any United States patent, copyright, trademark or trade secret (Intellectual Property Rights) by any goods or services. The County standard contract general indemnity provision requires the Contractor to indemnify, defend, and hold County harmless from third party claims arising out of the acts, errors or omissions of any person.
• Potential Impact: If the County is sued for any claim, including intellectual property infringement based on its use of Broadcom’s Symantec software or services, the County may be solely liable for the costs of defense and damages, which could exceed the total contract amount.
5. County is required to defend and indemnify and hold harmless Broadcom/Symantec and its affiliates, shareholders, employees, agents, and subcontractors against all claims arising out of: (a) breach of a representation or warranty made by County in this License Agreement; (b) County’s failure to comply with any applicable laws or regulations; (c) County’s modification of the Licensed Software, and any claim against Symantec in connection with any unauthorized installation, use, copying, access or distribution of any Licensed Software that Symantec has provided to County under the License Agreement; (d) any alleged infringement or misappropriation of any intellectual property rights of any third party based on or related to Licensed Software modifications not made by Symantec, (e) any alleged eavesdropping, interception, failure of delivery or loss of data sent, stored or received using the Licensed Software, and/or (f) County’s breach of the License Agreement.
• The County standard contract does not include any indemnification or defense by the County of a Contractor.
• Potential Impact: By agreeing to indemnify Broadcom/Symantec, the County could be contractually waiving the protection of sovereign immunity. Claims that may otherwise be barred against the County, time limited, or expense limited, including claims from Broadcom itself, could be brought against Broadcom/Symantec without such limitations and the County would be responsible to defend and reimburse Broadcom/Symantec for costs, expenses, and damages, which could exceed the total contract amount.
ISD recommends approval of the License Agreement and Foundation Agreement, including the non-standard terms which are typical in the IT industry, to allow ISD to purchase various Symantec security software products and services needed to protect the County from potential security threats.
PROCUREMENT
The License Agreement and Foundation Agreement, including the non-standard terms, will be used to accompany future competitively procured purchases to be approved, as necessary, per County Policy 11-04.
REVIEW BY OTHERS
This item has been reviewed by County Counsel (Bonnie Uphold, Deputy County Counsel, 387-5487) on September 15, 2020; Purchasing (Jessica Barajas, Lead Buyer, 388-5546) on September 15, 2020; Finance (Joon Cho, Administrative Analyst, 387-5402) on September 18, 2020; and County Finance and Administration (Kelly Welty, Deputy Executive Officer, 387-5423) on September 21, 2020.