Does the answer to this question depend on whether it really was reverse engineered, or is a direct lift from the original source code? It does not matter to disinterested parties, like the average cypherpunk. If it was reverse engineered, there may be a claim by the seller of the software against the licensee for breaching a "no reverse engineering" clause. In this case RSADSI is not a party to the action because the reversing engineer did not make an agreement with RSADSI concerning trade secrets. Any disinterested party is also not subject to this action, because they made no agreement with anybody involved. It's possible that RSADSI and, say, Lotus have an indemnification agreement in the case of reverse engineering, but that only affects the distribution of resources between those two companies. If it was lifted from source code, then RSADSI has a claim of malfeasance against theft of trade secrets. This doesn't reverse the fact that it's no longer a secret, but rather allows RSADSI to sue for the damages caused by the revelation of the secret. RSADSI can only sue the person who revealed the secret, not just anybody who posesses it. It's also possible that there might be a claim against the party to whom the secret was directly divulged, were there some conspiracy to steal trade secrets. That situation does not seem to apply here. In all of the above, be mindful that anybody can file a lawsuit and claim anything at all, and if it sounds official the gullible might believe that even the most farcical claims have merit. Eric