One of the most ironic facets of SCO's lawsuits is that they actually created new business opportunities for companies that choose to seize them. For Open Source Risk Management (OSRM) chairman and founder Daniel Egger, it basically created his company's reason for being--insuring users of open source against the risks associated with usage of the software. Although indemnification isn't insurance, OSRM's business model is all about assuming most of its customers' risks at a price that is profitable to the company and palatable to its customers who want peace of mind. Fors olutions providers, however, SCO's lawsuit created a different opportunity.

"I have no prediction regarding the outcome of the case," Rovira told me. "This just has to do with the risk [of losing to SCO if HP's customers get sued], putting numbers to that risk and looking at the revenue possibility. Based on the way we've structured the program, the return makes taking the risk worthwhile." Unlike OSRM, however, which plans to outsource their risk to a large insurance underwriter, HP is taking on the liability risk itself.

Like Novell, Sun, and OSRM, Rovira sees SCO's legal activities as an opportunity to offer a unique form of protection that cannot be procured anywhere else. Indeed, HP's indemnification is unique when compared to the others, but most closely resembles Novell's in that Linux distributions that are covered are not embedded into a solution in the way that the distribution that Sun is protecting (SuSE's distribution) is embedded into its Java Desktop System (JDS).

For starters, unlike Novell's policy, which offers protection regardless of who files a lawsuit, HP's customers can only invoke protection in the event they are sued by SCO. Also, unlike Novell's plan, which puts a limit on the damages it will pay in the event SCO emerges victorious, HP has placed no limit on the cost of the legal defense it will bear or the damages it will cover in the event that a legal battle with SCO is lost.

HP's program is also broader than Novell's in a couple of other ways, too. For example, it covers all of the distributions of Linux that are sold by HP. This includes Red Hat, SuSE, Debian, Mandrake, TurboLinux, and Caldera distributions. Looking at the sort of obligations a customer must make financially, HP's program is also more broadly available to all types of Linux customers from consumers to enterprises. "This program is available to customers with one server, or a thousand servers," Rovira said.

Although it is unlikely that SCO would sue a small business or personal user of Linux in the same way that such small potatoes have ended up on the receiving end of an RIAA lawsuit for downloading music, HP's indemnification is noteworthy for the way in which it offers unlimited protection to its customers regardless of the financial commitment that those customers have made to HP.

That said, customers must qualify for entry into the indemnification program and in order to do so, must satisfy at least four criteria. The first of these is that the distribution of Linux must have been acquired directly from HP or must be authorized distributions that were acquired through an HP reseller. Second, the distribution must be run on HP systems (or Compaq) only. This is one of the more unique aspects of HP's program because, according to Rovira, HP won't discriminate based on the age of the system. It could be a five-year-old Proliant just as easily as it can be a brand new HP desktop.

Third, similar to the way Novell runs its program and where Rovira hopes to generate new revenue, qualification for indemnification requires that a support contract be in place for the HP authorized distributions of Linux. HP has a tiered-support program that varies in cost on a per system basis from three prepaid incidents of support over a period of one year to 24/7 support over three years. Depending on the support package, an example financial commitment for Red Hat Enterprise Linux ranges from about $500 to $7,000 per system (at the time this story was published, details on the schedule of fees for other distributions were not available. Finally, applicants for HP's indemnification must fill out a form on HP's Web site.

Once indemnified, however, the customers' obligations do not end with these aforementioned qualifications. One question that continually comes up with respect to these indemnification programs is, if in true open source fashion, customers can modify and recompile the Linux source code. According to Rovira, "You can add whatever you want, but you cannot modify the source. We protect against the use of the binary distribution, not the source distribution or the modification or recompilation of it." This situation doesn't, however, preclude users from updating their Linux distributions with patches or security updates. "Such updates are small in code and are inherently covered because the risk [of misappropriation of SCO's intellectual property] doesn't lie in that new code," said Rovira. "The potential problem is in the millions of lines of code that are already are part of Linux." When asked if it mattered where the patches and security updates came from, Rovira said, "Security updates can come directly from the vendor of the distribution."

One question, which is unique to both HP and Sun because of their support of SuSE-based distributions of Linux, has to do with subrogation. In the insurance world, subrogation comes up in areas of "double" insurance. For example, when someone is injured in a car accident, which insurance company picks up the resulting medical expenses? The auto insurance company or the health insurance company? According to Rovira, HP wants to make it simple for its customers seeking indemnification, even if the provider of the distribution in question also provides some form of indemnification as is the case with Novell and SuSE. "There's no subrogation. We're a one stop shop, a single throat to choke. If you're our customer, and you get sued, HP will be responsible for the legal defense as well as any and all damages that result."

You can write to me at david.berlind@cnet.com. If you're looking for my commentaries on other IT topics, check the archives.