Every software application people use is built through years of engineering effort and significant financial investment. But when the source code, the underlying codebase that forms the backbone of a software product, is stolen, copied and repackaged under a different name, software companies can lose both their competitive edge and their business.

The problem is becoming increasingly common in Nepal. In the last fiscal year 2025-26, the Cyber Bureau of Nepal Police received 10 complaints involving the theft of computer source code. The Nepal Copyright Registrar’s Office also received similar complaints, some of which have already reached the courts. As demand for digital systems continues to grow, software piracy has emerged as a serious commercial threat to technology companies.

A case filed recently at the Kathmandu District Court illustrates the scale of the problem.

Kathmandu-based Diyalo Technologies Pvt Ltd developed an enterprise resource planning (ERP) platform called WaterMark for water distribution and customer management. According to the company, several former employees later left, established a new company called Wash TechNepal, and launched a competing product, WashBilling, which allegedly replicated Diyalo’s software.

PR Khanal, chief executive officer of Diyalo Technologies, said the company became suspicious after learning that a strikingly similar product had entered the market.

“The software looked almost identical in both appearance and functionality,” Khanal said. “When our technical experts examined the fonts and code architecture, they found clear evidence of copying. The logical structure, database design and coding patterns all matched ours. Even spelling mistakes embedded in our source code were reproduced exactly. That prompted us to file a complaint with the Cyber Bureau. Since the identical errors appearing independently would be virtually impossible, the police presented them before the court as strong evidence of source code theft.”

Following an investigation by the Cyber Bureau, the District Government Attorney Office, Kathmandu, filed charges against five individuals. Prosecutors claim the defendants copied Diyalo’s source code and sold the resulting software to several community drinking water committees in Kaski district.

Khanal says the incident is far from isolated.

“Over the past few years, several other Nepali software companies have also had their source codes stolen,” he said.

According to Chandra Bilash Bhurtel, general secretary of the Federation of Computer Association Nepal (CAN Federation), the problem is particularly prevalent in accounting software and financial technology products.

“In most cases, employees who are dissatisfied with their organisations or frequently change jobs replicate the products of companies they previously worked for after moving elsewhere,” Bhurtel said. “Proving source code theft is technically difficult. Investigators must conduct a detailed comparison of database architecture, internal data structures and other technical elements. Since many software components are available through open-source platforms, determining what constitutes proprietary code and what is publicly available often becomes a complex legal and technical challenge.”

Most complaints received by the Cyber Bureau point to insiders or former employees rather than external hackers.

Cybersecurity experts say Nepal experiences relatively few sophisticated cyberattacks compared with internal fraud. Employees with legitimate access to software systems often misuse that access to copy or sell proprietary code.

One case involved an online learning platform whose former employee allegedly stole the source code and sold it to a competitor. The Cyber Bureau began investigating, but the complaint was later withdrawn after both parties settled outside of court. According to officials familiar with the case, the accused feared the impact on their career, while the company sought to avoid reputational damage through a public legal battle.

Dilip Kumar Giri, spokesperson for the Cyber Bureau, said outsiders rarely succeed in stealing source code because access is tightly controlled within companies.

“Most cases involve insiders who see a commercial opportunity, leave the company and either establish their own business or sell the code to competitors,” Giri said.

He added that investigators are also dealing with fake versions of government websites created to harvest sensitive user information.

One recent case involved a counterfeit version of Nepal’s Nagarik App portal hosted on a privately owned domain. Nepali technology news outlet TechPana reported that developer Nirdesh Subedi had recreated the application’s previous interface to produce a website that closely resembled the official platform. After concerns were raised that the cloned site could be used to steal users’ personal information, Subedi modified the website by removing the copied interface and replacing it with a separate login page.

The issue extends beyond outright theft.

Government reports have also highlighted the risks created when public agencies procure software without obtaining ownership of the underlying source code.

A committee formed to recommend information technology reforms for the Ministry of Finance and its subordinate agencies found that several proprietary software systems used in public financial management had been purchased without source code ownership. As a result, government agencies remain fully dependent on vendors whenever they need to modify, upgrade or troubleshoot those systems.

Legal experts say prosecuting source code theft remains difficult because the cases require both legal interpretation and highly specialised technical expertise.

Advocate Atit Rijal, who has handled such cases, said Nepal’s courts and investigative agencies still lack sufficient expertise to fully understand the complexity and commercial significance of software source code.

Although Section 44 of the Electronic Transactions Act, 2008, criminalises the theft of computer source code, he argues that the penalties are too weak to deter offenders.

“The maximum punishment is three years’ imprisonment or a fine of up to Rs200,000,” Rijal said. “Most defendants are released on bail with relative ease. They continue using the stolen code while the case is pending and often make substantial profits before the legal process concludes. Ultimately, the consequences are minimal. The law does little to discourage this type of crime.”

In some cases, lawyers say, victims struggle to obtain justice because software piracy is still viewed as little more than ordinary business competition.

One advocate recalled that during a court hearing on a source code theft case, a judge questioned the government prosecutor by asking: “If I’m selling instant noodles, does that mean nobody else in the world can sell the same brand of noodles?”

The lawyer described the comparison as both inappropriate and absurd.

“Source code theft cannot be equated with ordinary market competition,” he said. “There is still a significant lack of understanding within Nepal’s legal profession and judiciary about software-related crimes.”

Source code is the human-readable programming language developers write to create software, applications and computer programs. Nepal’s Electronic Transactions Act defines it as “computer source code”, including programme listings, commands, computer designs and layouts.

In practical terms, source code contains the software’s underlying logic, database architecture, programming structure and variable naming conventions. It represents the intellectual property at the core of a software company’s business.

Baburam Aryal, a cyber law expert, said that although Nepali courts have convicted defendants in source code theft cases, securing adequate compensation for victims remains a major challenge.

“The courts still lack a consistent methodology for calculating damages,” Aryal said. “As a result, companies often win the legal case but still fail to receive meaningful compensation for the commercial losses they have suffered.”

He said confidentiality agreements between employers and employees provide some legal protection, but are rarely enough to stop someone determined to steal proprietary code.

Rijal believes many companies weaken their own legal position by failing to require employees to sign robust non-disclosure agreements when they are hired.

Gaurav Raj Pandey, president of the Nepal Association for Software and IT Services Companies (NAS-IT) and chief executive of EKbana Solutions, warned that weak intellectual property protection threatens far more than individual software companies.

“If intellectual property cannot be protected, it undermines the entire knowledge economy,” he said. “Investors become reluctant to make large investments, and ultimately the growth of Nepal’s technology industry suffers.”

The problem is far from unique to Nepal.

Around the world, source code theft has become an increasingly serious concern for software companies. One of the most high-profile recent examples involved a supply chain attack targeting US-based technology firm Cisco. Attackers exploited vulnerabilities in software developed by Trivy, an open-source security scanner, to gain access to more than 300 GitHub repositories and steal source code linked to Cisco’s artificial intelligence products.

The rapid rise of generative AI has introduced new risks. Experts say even individuals with only basic programming knowledge can now use AI tools to modify stolen source code and quickly develop competing software.

AI has also created new legal uncertainty. As more software is produced with the assistance of AI tools or through so-called “vibe coding”, questions are emerging over who owns the intellectual property when AI-generated or AI-assisted source code is copied or stolen.

Industry experts say addressing these risks requires both stronger legal safeguards and tighter technical controls.

Companies should implement mandatory confidentiality agreements and comprehensive employment policies covering intellectual property when staff are hired and when they leave the organisation.

“They need stricter access controls for source code, regular security audits and better employee awareness about the legal consequences of intellectual property theft,” said Khanal. “At the same time, the government should amend the Electronic Transactions Act to strengthen protection for digital assets and establish a modern framework for compensation that reflects today’s technology industry.”