Ask an Attorney About Open Source Licensing

I first ran into Daniel B. Ravicher on the Open Source Initiative's license-discuss email list. He's a rarity: a young lawyer actively interested in and sympathetic to Open Source licensing. In fact, he wrote a detailed article on this topic for the Virginia Journal of Law and Technology last year while he was still in law school. Dan is now an associate at Brobeck, Phleger & Harrison LLP, a firm that handles, among other things, business law and intellectual property matters. Who better to ask about Open Source under the law? (The usual attorney disclaimer applies, of course -- that Dan can only answer general law questions, and if you want specific legal advice you must directly engage an attorney yourself.) One question per post, please. Tomorrow we'll forward 10 of the highest moderated ones to Dan by email, and put up his answers as soon as we get them back.

Civil Disobedience

Many people download from Napster, reverse engineer software like DeCSS, etc. Are there any general legal strategies, etc., that can be used to limit one's liability while still publishing information on things like cryptography?

Alternatively, how would one go about constructing a straw-man case most likely to overturn the DMCA's restriction on publication of said material?

How to reduce legal boilerplate to one src line?

I hate to see source code where there's more lines of legalese than code. How can the legal part be reduced to one or two lines? I presume a well-crafted reference would be the mechanism, but what are the legal requirements? Would an md5 "checksum" of the referenced doc help? Is there any legally recognized repository of standard legal boilerplate that can be referenced, and where new boilerplate could be officially registered for this purpose?

GPL and mis-use of copyright law

I am sure there will be plenty of other GPL related questions. Mine is fairly narrow and specific. In that the GPL attempts thru a clevel legal hack to achieve a specific end result thru the use of copyright law that is different than what some envisioned the intent of copyright is, it has been suggested by some in the legal community that the GPL itself can be invalidated as a mis-use of copyright law. Is this a valid interpretation?

Supremacy Clause and shrinkwrap "no review" terms.

Daniel, you write,

59. There is a huge flaw with this core of these Supremacy Clause preemption arguments. The underlying rationales given for performing a separate Supremacy Clause preemption analysis are exactly the same arguments made for finding the license procedurally or substantively unconscionable under state contract law.

How does this square with shrinkwrap license clauses that demand no one publish reviews or benchmarks without permission? Both Microsoft and Oracle employ such clauses, for example. It would seem to me that this conflicts with the original (1823?) Supreme Court decision that established the "fair use" doctrine -- the Court declared that Congress might not pass a copyright law so stringent as to restrain freedom of speech nor freedom of the press... and benchmarking and publishing the results certainly is a legitimate exercise of the latter! And the subject would seem to me to be precisely a Supremacy Clause argument...

Re:Validity of non-sign agreements

The GPL contains language designed to address this concern:

5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it.

The GPL isn't a license to *use* software, it's a license to modify and redistribute software. So using GPL'd software doesn't commit you to following the GPL, because the GPL doesn't cover the act of running the program. If, however, you copy or modify GPL'd code, the only way you can legally do so is by following the demands of the GPL.

Of course, this only applies to licenses that are a grant of copyright rights like the GPL. Licenses that take away rights (such as the "no reverse engineering" clause in nearly every piece of commercial software) are another story; this is why the industry is trying so hard to get UCITA passed.

What of dumping?

Suppose we reach a Free Software nirvana: the GPL is successfully defended in court, the DMCA/patent/UCITA/other restrictive laws must keep their mitts out of free software, etc...

Now what of antitrust law? Yes, we're doing this for the good of humanity, but larger institutions could (especially in the eyes of the courts) use Free Software as a way to quickly drown competitors. Could a company be held liable for releasing free software, especially if it's a "category killer" that makes the proprietary competition irrelevant?

Would the fact that the competition can build on the released codebase help matters any?

--
I noticed

GPL Sturdiness

Realistically, if it came down to a fight in court, what do you believe are the chances the Gnu General Public License would be upheld and enforced? (And please don't answer with, "It depends" :-).)

Schwab

Written word or intent?

How much influence would the intent of the GPL have above its wording in court?

In Dutch law, you cannot demand - for example - a brand computer for $9.95 if it's a misprint of $995, because it should have been obvious that you could not get a brand new computer for ten bucks.

I wonder how important this would be in the case of open source licenses and particulary the GPL, since its mere existance comes forth from a philosophy and releasing code under the GPL usually is done because the author supports that (GNU's) philosophy.

How best to respond to legal threats

What is the best way to respond to a legal threat? In the past, I've been told to tell anyone that makes legal threats or demands of me or my software to talk to direct all such communications through my lawyer as a matter of policy. Is this a good policy? When does taking a matter public do more harm than good?

Re:Where does the interest come from?

As a software engineer (going on 8 years if you count comp sci grad school), and as a soon-to-be first year law student, I can answer this from my perspective. One of the many reasons I'm going into law is to make sure people who understand technology are influencing decisions and defending the rights of the people making a real difference in this world.

If it's not clear where my heart is, let me just mention that I had UNIX on my license plate for 3 years. But in my "old age" I've become less interested in code and more interested in arguing ;)

Chad

Contributor Agreements

I'm one of the lead developers on the Open Source project Jive [coolservlets.com]. Many of our contributors work on the project as part of their job duties at their place of employment. In light of that, we've been considering a mandatory Contributor Agreement for all code that is submitted to the project (excluding one-liners).

We want the agreement to accomplish three things:

1. Stipulate that the code is being released to the project under the project's license (for our project this is the Apache License).
2. Ensure that the contributor has permission to release the intellectual property to the project, including any necessary permission from their employer.
3. Make sure that the contributor does not apply for patents for the code that they're submitting.

My question is:

1. Do you see legal value in this sort of agreement?
2. Do you know of any boilerplate agreements that exist?
3. Shouldn't more Open Source projects be worried about IP issues that a contributor agreement seeks to prevent?

Thanks!

How can we change perceptions?

My question is what can we do as a group to change the perceptions and misconceptions that judges specifically, and courts in general have toward open source licensing. This industry has grown up telling us all that almost everything belongs to someone. How can we turn over a new leaf and bring into fruition the thought that yes, we can share, that it's OK to share?

Open Source License Enforcement

The main question I have is, how do you enforce your GPL or other Open Source licensed product? Certainly, you can go to the offending party, and say, "You are in violation of the license agreement," but if they don't comply, what can you do? What are the damages? If I GPL my software, I can't very well go to court and say "You are stealing my property and costing me money" and thus sue for money lost since, after all, the GPL means anyone can copy it without paying. Without a ton of money to begin with, I can't do anything at all about people violating the licence even if there were monetary damages. So, I'd like an attorney's opinion on what tack you should take when trying to enforce GPL/Artistic/BSD or other Open Source licenses in a way that would be effective.

Re:Doesn't the GPL "infect" all derivitives?

This is easy.

You can license your own product under multiple licenses. Commercial vendors do this all this time with proprietary code. You can also release a product under multiple Open Source licenses. If you are the copyright holder, you control the licenses.

Now, you can't retroactively change the licensing of version 1.0 or any other released versions to a non-GPL license, because you've already got a binding license agreement with your users. However, any future releases of the software can be licensed as the author sees fit.

On the other hand, if you accept GPL'ed patches, and you don't get copyright from the patch owner, and you don't get their permission to relicense the work, then you are in violation of the GPL as it applies to their works.

Slightly OT, but an answer re: your post...

Don't ever say you can't afford it: I know it is possible, and yes, you will go into debt, but it can be done. Case in point:

Three years ago my friend started a protracted court battle, over all things, the rights regarding an easement to get to a house he bought. The case was long and complicated, and basically boiled down to one asshole thinking he could change the rules, and with enough money, overcome my friend.

Now, my friend is a truck driver - not rich by any means, but one of the best individuals you could ever know. He would truely give you the shirt off his back - both figuratively, and literally. I have seen him do things and help people, strangers even, just because it was the right thing to do. Anyhow - he didn't have a lot of money, but he knew he wasn't going to let this guy cave him in over a simple road (because that is what it boiled down to - a road to the top of the mountain upon which the house sits).

He went into debt - HUGE DEBT. He had the family supporting him, in every way - food, friendship, housing (he has lived under his mother-in-law's house, in the basement apartment, for those years), even money in those times when we could get him to take a little (he is very proud, and will not take handouts - ya gotta sneak em in). He worked every day, and weekends (still does, gotta pay the lawyers), sometime pulling 24 hour shifts for a couple of days - most of the time working 12-16 hour days. Sometimes I would ride with him - to talk to him, keep him awake on the weekends, tell him something to keep his spirits up.

In the end, he is coming out of it winning - he has spent a lot of money, but his hard work and perseverence has paid off, and he will have a very nice house to retire in, indeed. He deserves it, more than I can ever convey.

So, it is possible - if you think you are right, you should pursue it. You may have to work yourself to death, maybe take a second job, who knows what else - but defending your rights and what you believe in is never an easy job - if it were, far fewer people would have died throughout history defending those ideals...

Worldcom [worldcom.com] - Generation Duh!

How Can We be More Effective?

The open source community interaction with law and politics to date has been almost completely reactive. Typically some company or governement institution has or is about to do something draconian before we are able to mobilize. Sometimes we get there in time, sometimes not. Examples are: DMCA, UCITA, and hundreds of software patents, Microsoft's embrace and extend campaign of the week, ... the list goes on.

What can we do as a community to be more effective in protecting ourselves. I'm someone who has joined the EFF, written letters to the copyright office, participated heavily on Openlaw, and written letters to my Congressmen. Many of us are involved in these ways, but somehow we've got to take it up a notch. What's the next step?

Can we use the DMCA to our advantage?

Developers of Open Source software typically don't have large reserves of cash and big corporations backing them up. So far, the DMCA has been used against us, but technically anyone should be able to use it to protect his intellectual property. In what ways can an Open Source developer make us of the DMCA?
--
Lord Nimon

When will source code be considered speech?

Every programmer knows that source code is speech, and should be protected like any other speech. However, the courts just don't seem to realize that, probably because none of the judges have ever been programmers. What would it take for the court system to generally acknowledge that source code is speech, and how long will it take for that to happen? What do you think will be the biggest ramifications if/when it does happen?
--
Lord Nimon

Helping avoid contributory and vicarios liability

Fred von Lohmann wrote a White Paper [eff.org]for the EEF concerning avoidance of "contributory and vicarious copyright infringement" (being liable for writing software that promotes "fair use", but can be used for copyright infringement).

In that, he states guidelines for developers. One of the guidelines is: "Be open source".

I would think Open Source would set you up for liability in such matters: anybody who modified your code, making it able to infringe on copyrights, would make you vicariously liable for opening the code in the first place.

Or, take for example, TiVo. Their systems are open source, they've posted their kernel and tool modifications on their web site (as per the GPL). Now they're worried that someone could use that to easily create code that will allow MPEG extraction from the unit [avsforum.com] (and widespread distribution of copyrighted materials).

I'm not sure how being open source can protect a software developer from such litigation.

Can you explain this?

Re:Open Source License Enforcement

AFAIK, you can ensure that you can collect some damages by registering your copyright with the Copyright and Trademark office. Every work is inherently copyright by its authors unless they explicitly place it into the public domain, but without registering it they're only allowed to collect real damages, i.e. proven economic losses resulting from the infringement. If it's registered, though, they're allowed to collect statutory damages, which are specific fines established by law as a punishment for violation. Also, IIRC, once you've won your case the violator has to stop distributing in violation of copyright, and if they continue to infringe then you can collect more in the way of damages.

No funds, no change of winning?

I'm a freelance programmer, and like most programmers I do it for the love of the "art", and because of that most of my creations are licensed under GPL.. However, my question is, what would happen if Big Corporation X were to take my code, integrate it into a proprietary system, and sell it for millions, ignoring all demands to release source to the modifications (and thus breaking the GPL).. What could I honestly do besides writting letters threatening legal action?

I obviously don't have the funds to compete in the courtroom with Big Corporation X, and even if I were to try, the expense and time alone would set me into debt for probably the greater part of the rest of my life. What chance does the GPL or any other Open Source licensed software have, if a good part of it's development team is composed of just average guys with bills, debt and little free time?

Junkbusters' Spamoff

Is this (http://www.junkbusters.com/ht/en/spam.html [junkbusters.com]) GPL'd disclaimer that an individual will not tolerate spam email really admissible in court? Could I change the amount from $10 per spam email to, say, $1000 per smam email, then send it to Spammer #1282733, and then take them to court if they send me another spam email and win $1000?

I'm not money hungry, but I do detest spam.

Demand for Technical Lawyers?

As an avid follower of Slashdot, I have a keen interest in open source systems, intellectual property, and technology. In my former life, I was an engineer, and I hold an advanced degree in mechanical engineering. I currently make a living working for a business consulting firm performing large scale technology implementations. Whether it's e-business, high-tech, or Internet-related, I experience a great deal of "Slashdot" in the workplace everyday.

I would like to know how much demand exists in the field of law for a person with a skill set and background comparable to my own. Can the current market for lawyers who possess a deep technical background offset the cost of three years of law school, especially in comparison to what I would be making if I stayed with technology consulting?

Judging from the sheer number of issues surrounding technology and the law raised in this forum, it seems that the open source/technology community could certainly benefit from more advocates with roots in technology. I'm just deciding whether it's worth it to make the move myself...

Microsoft Licensing

In your detailed paper, you note:

37. For instance, under the first sale doctrine, an owner of a piece of software can transfer her program to whomever and for whatever she desires. The use of a license prevents this doctrine from applying, which allows computer programming firms to price-discriminate between customer characteristics. If Microsoft wants to give Windows software to public schools at a cost blow the production cost and the transaction consummates a sale, the first sale doctrine would apply, and the school could resell the programs at a higher price to a corporation, retaining the difference. This would cause Microsoft to charge all customers one price, either by lowering its price, forcing it to run at a loss, or raising its price, thus making the program unavailable to schools and other meagerly funded organizations. This result is economically inefficient and would most assuredly be politically unpopular.

I am interested on the implications of the fact of Microsofts monopoly in as it applies to licensing. While it can be argued that the two issues are separate, and one is not relevant to the other, many people look at the practices of Microsoft in this regard and view it with horror and contempt. Are there instances where such licensing practices impose a non-legitimate enforcment of "rights", and in fact constitute improper maintenance of a monopoly? Or do people have these separate issues confused, when they should be treated separately?

Check out the Vinny the Vampire [eplugz.com] comic strip

What are ...

What are the weakest points of the GPL?
3 S.E.A.S - Virtual Interaction Configuration (VIC) - VISION OF VISIONS!

Re:How can we change perceptions?

Judges? Courts? Could you give an example of when a court has failed to uphold an open-source license?

Images and Sounds

How does the GPL affect non-sourcecode files that are part of an application?

Specifically, I'm concerned about the images and sounds that are included with a game I'm working on [mugu.org].

Does the GPL "contaminate" these other files that are included? If so, how do "source" and "binary" distribution apply to images and sounds.

Thanks,
K45

Variations on a theme...

We have several licensing schemes available for the Open Source enthusiast, all dependant upon one's definition of 'Open Source'. Would you care to comment on each of these licenses, and their various pro's and con's?

Off the top of my head: GPL, QT Open Source, Public Domain, BSD.. most likely others.

Where does the interest come from?

As an open source programmer, my reasons for adopting the GPL in my programs are clear:

• street cred
• humanity
• code review
• inspiration
• bug squashing

I was wondering what could inspire a lawyer to believe in these sentiments enough to become involved with open source software.

Well, your fingers weave quick minarets; Speak in secret alphabets;

Will Open Source be overpowered by cash?

Knowing the legal and political systems surrounding intellectual property as you do, what do you think the chances are that money (specifically, lobbying from organizations like Microsoft or the RIAA) will overpower Open Source by creating more and more insidious forms of copyright protection and law, possibly even to the point that Open Source becomes illegal because it "threatens" the closed-source business model?

This seems to be one of the current trends in intellectual property law. Do you think it will continue?

UCITA and liability

The FSF's Why We Must Fight UCITA [gnu.org] article seems to say that UCITA invalidates free-software disclaimers. Is this true? Why or why not?

Big ballpark hypothetical

Okay, some unknown hacker creates his/her foo application and releases the source under GPL. Something occurs that leads him/her to suspect that the foo source has been incorporated into a commercial product that isn't following the terms of the GPL with regards to rereleasing the source. Furthermore, the things that lead him/her to suspect this aren't basic paranoia -- someone with a conscience and access to the suspect source has leaked information about it or whatnot. Or maybe something else -- point is, there is a case that could be made.

From a PRACTICAL standpoint, what sort of things would this unknown hacker have to do to make their case? Would it be possible from a practical point of view under (eg) the United States legal system for this unknown hacker to take the company to court? What sorts of costs would he/she incur? What sort of time-frame would it take to achieve resolution? What sorts of potential rewards or compensation could he/she expect? Are there any precedents that are analogous to this situation?

Public Domain

I've considered releasing software in the public domain as perhaps the simplest alternative to some copyrighted-yet-free approach, but I'm not clear on all the implications. Here's what I think:

1) I have to explicitly state that the source is in the public domain, otherwise it is copyrighted by default,
2) anybody else adding to or modifying the source would have to state that their mods are in the public domain (for the same reason),
3) if a person adding to or modifying the source wants to copyright their mods, they'd have to specify the extent of their changes or their copyright might be invalid, unless they substantially changed the whole thing.

If one intends for a work to be freely editable, it seems as though the only thing you give up by putting it in the public domain is some legal basis to sue. For example if somebody takes my public domain work and slaps their name and copyright notice on it, I may not have a good way to stop them although their copyright is invalid.

Is this correct? Any comments?

Changes to the GPL?

What changes if any would you make to the GPL to help support it's goals?

Patents and GPL

Since the US government allows software patents, is it possible to void the GPL by using patents?

1. You take a GPLed product, and extend it. You add some patented code into it.

2. You sell it to someone, and you give them the source code as the GPL requires.

3. However, since the GPL doesn't cover the execution of the code, you tell them that the only way they can get a license to execute the patented code is by never releasing the source or binaries to anyone else.

4. And anyone else who got the code downstream would have the right to have the source code, but not the right to execute it since that would be a patent violation.

Does this mean that a company can use patents to "close" GPLed code?

Possible liabilities for end-users?

I like the idea of open source but wonder how reliable the various open license models are. I'm concerned someone could release a program with an open license, then change their mind about its value, and start legally pursuing end users with the claim they never intended to release the program freely. Alternatively, an open license statement could get slapped on proprietary software in an attempt to avoid end-user liability for piracy. Are open source licenses legally robust enough to withstand these kinds of potential misuses?

Re:UCITA and liability

Is GPL a contract or some kind of wierd unilateral grant of some rights? My untutored mind naively thought it was not a contract because there is no 2 way exchange ov value and no agreement. I have since heard legal people take both sides of this question. I think that UCITA will not apply directly to the GPL if it were not a contract, because UCITA seems to mostly regulate how contracts work. Thus I think that the above question turns on whether GPL is a contract. This is an important question to me because I have written and will write letters oppsoing UCITA to Texas state legislators. And I need to know whether to include Stallman's arguement. P.S. In a private comunication Stallman, the author of the GPL said he thought the GPL was not a contract, but agreed with the unilateral grant of some rights theory. But he is not a lawyer either.

Doesn't the GPL "infect" all derivitives?

This question has come up before, and I've seen flavors of it in this discussion:

If I release code under the GPL, doesn't the GPL "virus" now infect my code and all derivitives? There are examples of GPL code that was simultaniously released under a different license, and examples of GPL code that was the basis for derivative works that were not released under the GPL. Please explain how this is legal, under the GPL.

Several Slashdotters have said things like "Naturally, the author is free to do this" but I don't see the "natural" connection. If I release version 1.0 under the GPL, my reading of the GPL is that the "virus" infects all versions of the code, and that if I tried to release version 2.0 under a proprietary license then someone else could sue me because my version 2.0 violated the GPL on version 1.0. Yes, I'm the author and I hold all the rights, but when I release my code under the GPL I give up some of my rights and transfer them to the software's users. Don't the people to whom I gave those rights in version 1.0 retain those rights to all subsequent versions? If not, why not? The only way I can see for anybody, even the original author, to modify GPL code and not release the new source is to not release the new binarys either.

Similarly, I don't understand how I, as author of the code, could possibly release it under the GPL and another license at the same time. Why doesn't the GPL trump the other license? If A can get the source under the GPL and do whatever they want with it, and I sell the same code under another license to B, what prevents B from using the GPL to give the code away to whomever B wants, even though B didn't buy it under the GPL?

The specific example is a company that releases their *NIX version under the GPL but releases a Windows version of the same code under a proprietary license with no source code. Why can't a user of the Windows version sue for the source code, citing the GPL on the *NIX version? Why doesn't the GPL on the *NIX version trump the proprietary license on the Windows version?

Public Domain

A common justification for choosing an open source license, and putting up with all the license-compatibility issues, over simply releasing the code into the public domain is fear of litigation. Do you believe that the creator of public domain software (perfection disclaimed, use at own risk) is at any greater legal risk than the creator of open-source licensed software in the case of costly software failure? (I'm especially interested in any relevant precedent you are aware of)
--

Public (government) code and the GPL

I am employed at a US national lab, involved in a scientific programming project for which we make the source code publicly available. We have an apparent difficulty with incorporating GPL'd code into this project. The problem is that code (or scientific papers, etc.) produced by the US government is, by statute, not subject to copyright. Government-produced code is just plain open. This means that the copyright hook the GPL uses to require subsequent copiers to disclose their source code does not apply. We cannot use licensing features to "bind our successors", as they say, in the way that the GPL would like us to. What are the implications of this for incorporating GPL'd code into our project? Can we do it at all?