If they were just using the software and telling investors that they were using it under the Apache license, there would be no problem. The investor said that the startup is claiming they actually wrote the code.
Think if it in alternate terms. And, yeah, it's going to be highly contrived, but I'm trying to avoid overreaching the bounds of this metaphor. :)
Someone at a party you're hosting (we'll call him Stuart Upton) stole a car that you recently offered to loan to anyone who wants it, because - hey! - free car! You have an OBD key installed that lets you track it. You're not certain if they're intoxicated, or if they're intending to commit a crime, and there's a risk they could cause harm to person or property. You believe you know their destination, because they discussed going there to "have a chat" with someone named Victor Curtis (we'll call him "VC" for short) about some money they believe they're owed earlier in the evening.
Is it your duty to call up VC to warn him about his unexpected caller? That the caller has expressed a monetary motivation for his visit, and that he has taken advantage of your good will and stolen a car you were willing to loan freely to anyone who respectfully asked to borrow it?
No, in fact he should not. The DD is the investors problem, not the OPs, if they do lousy DD, do not spot the anomaly and invest anyway at least he'll have a fat target assuming there is a case here.
> Regardless of his own attachments to the code, and his emotional response to its false attribution
False attribution by hearsay at this point in time, that's not actionable.
> a response I think most of us would have, by the way - the investors "don't know what they don't know", and I think any good samaritan would consider it his duty to inform someone who is at a possible informational disadvantage, especially when that information could prevent the investors from dealing with a loss or a future liability. It also reflects the character of the startup using the code, an additional and relevant piece of information that the investor is disadvantaged not knowing.
That might get you into a lot of trouble.
Your analogy doesn't hold water on several fronts, for one nothing got stolen.
> Is it your duty to call up VC to warn him about his unexpected caller?
No, in fact that might be construed as interference.
> That the caller has expressed a monetary motivation for his visit, and that he has taken advantage of your good will and stolen a car you were willing to loan freely to anyone who respectfully asked to borrow it?
This could be but the OP is not a disinterested and objective party. So he should contact his own lawyer and discuss his options rather than to take advice from strangers on the net with extremely limited data.
Go for a consultation. Decide if its viable to go after them. If it isn't, those investors should know that they're investing in dishonest crooks who probably don't have any qualms with misdirection of funds.
Ultimately investors are all competing with each other for good deals and if some investor doesn't find this is a bad deal in their due diligence, how much would the smarter investor be willing to let their competitors tie up their money in the bad investment? They have no ethical obligation to share this information...