Oracle's surprise legal move against its main business applications rival SAP has raised questions again about the likely impact on customers of corporate scandals in the IT world. Whatever the outcome of the case, users are voicing their concerns about software vendors' ethics.

Oracle filed a lawsuit last week against SAP, its SAP America division, its TomorrowNow subsidiary and 50 unnamed individuals Oracle claims were SAP employees.

It could be good for Oracle to say, 'We have no beef with the customer, our beef is with SAP, or it could be perceived as Oracle picking on the customer

David Mitchell, Ovum

The complaint charges that SAP committed "corporate theft on a grand scale", with one or more staff at TomorrowNow allegedly pretending to be Oracle customers and illegally hacking into its secure support website for users of Oracle's PeopleSoft and JD Edwards applications.

SAP then allegedly copied content from the site and used it to offer Oracle customers cut-rate support services in the hopes of eventually migrating them over to SAP's rival applications.

So far, SAP has yet to respond publicly to the accusations and Oracle has not made any additional comment beyond the lawsuit itself.

"If we decide to trust a company, we'd hope it to be justified," said an IT manager at a French company that uses JD Edwards applications and sources its support for that software from TomorrowNow. "When we choose a supplier, we don't necessarily investigate them first," he added. The manager agreed to speak on the condition of anonymity for himself and his company.

While products, services and price are primary factors in procurement decisions, a vendor's business practices are also extremely important, according to John Matelski, chief security officer and deputy chief information officer for the US city of Orlando, and a JD Edwards user.

He is also the former president of the Quest International Users Group, which focuses on the needs of PeopleSoft and JD Edwards applications customers that Oracle acquired through the January 2005 purchase of PeopleSoft.

"As a public sector entity, which is directly accountable to its citizens and constituents, I would be concerned about our relationship with any vendor that is proven to conduct business in an unethical manner," Matelski said.

"Due to the nature of the relationships that we develop, software vendors and consultants would be held to a higher standard, because they would typically have a greater level of access to our systems and data during implementation and support engagements," Matelski wrote.

"The security and privacy of our data is key, and if an organisation is known to have illegally obtained data before, I would need to be much more careful when evaluating whether to establish or continue a relationship with them."

David Mitchell, software practice leader at UK-based analyst Ovum drew a comparison between the potential damage of the lawsuit with fallout of the corporate spy scandal that hit Hewlett-Packard last year. Despite leading to the resignations of several executives including its chairman, HP weathered the storm well and customers stayed loyal to the company.

"With HP, [CEO Mark] Hurd responded positively, he apologised," Mitchell said. "It was about the approach they took when something inappropriate had happened. If HP had not responded so positively I think they would have seen more negative consequences."

Should Oracle's charges against SAP be proven, "they need to embrace it and reassure people how it's come about", he added. If there was some wrongdoing, Mitchell, the former senior director for market development at Oracle UK, believes it will turn out to be the work of one bad apple. "SAP ethically and culturally is a very correct organisation, this isn't rotten DNA," he said. "If this turns out to be true, then it will be an individual, I think, who has acted inappropriately."

As for Oracle, the vendor needs to act to avoid any negative publicity from the suit given that it named many customers whose identities were allegedly purloined by SAP and suggested that SAP customers unknowingly might be using services that contain Oracle's intellectual property.

"It could be good for Oracle to say, 'We have no beef with the customer, our beef is with SAP,'" Mitchell said. "Or it could be perceived as Oracle picking on the customer."

Andreas Chatziantoniou, a software consultant specialising in Oracle products with Accenture Technology Services in the Netherlands, wondered about another potential negative hit on Oracle.

"From the reputation side, I believe that this can backfire," he said. "Oracle has a reputation for ‘dumpster diving' in order to get information about competitors," alluding to an incident in 2000 when Oracle defended the actions of detectives it hired to investigate two research groups that supported Microsoft during its antitrust trial.

The lawsuit alone will not deter customers from buying SAP's applications, but the noise around the legal action might give both SAP and Oracle users the sense that the firms are distracted and not fully focused on customers’ needs, he added.

Now is not the time for either Oracle or SAP to lose focus, given the competitive threat they face.

Last week, Microsoft, which has tended to focus more on the small to midsize business market with its Dynamics applications, vowed to compete more aggressively in the enterprise market against Oracle and SAP.

Another issue that should give vendors pause is that customers have long memories when it comes to scandals, Chatziantoniou wrote. "Even years later, people (the decision makers) remember the 'bad publicity'," he added. What might suit the vendors' customers and partners is an out-of-court settlement, he concluded.

"So far such a situation has never happened to me in my business life, but if it did I would consider the fact very heavily when doing business with such a company," Manfred Reif, a managing director at HSH Nordbank, a credit investment bank in Luxembourg, said in comment on the lawsuit. "Nevertheless, first of all being suspicious and 'listening' to your gut feeling should be one's daily duty," he added.

Another factor to bear in mind is the number of customers Oracle and SAP share, Seth Ravin, CEO and president of Rimini Street, pointed out. He is a co-founder of TomorrowNow, selling his share of the company to SAP in early 2005 and establishing Rimini Street as a rival supplier of third-party maintenance and support.

While Oracle and SAP compete bitterly in the applications market, many SAP users run their software on Oracle's database and middleware. It's in both vendors' interest to resolve the current dispute rapidly.

"So far, we've only heard one side of the argument," Ravin said, with SAP yet to comment.

Given how closely Oracle and SAP watch each other, he finds it hard to believe that the alleged actions by TomorrowNow were deliberate. "I strongly doubt it," he said, adding that such behaviour wouldn't be in anyone's best interests and would likely be quickly discovered. Oracle appears to require users of its customer support database to be "self-policing," he said, in other words, they have access to more content than their specific needs warrant, which may have led to some confusion about what was OK for SAP to access and what was not.

(James Niccolai and Peter Sayer in Paris contributed to this story.)

Read our round-up of news, analysis and opinion on Oracle's battle with SAP