Moglen On Enforcing The GPL

jdavidb writes: "The GNU Project has a new essay today by Eben Moglen, general legal counsel for GNU, about enforcing the GPL. People ranting about the GPL not holding up in court should read this. Very interesting, but I felt that this paragraph looked bad: 'In such situations we work with organizations to establish GPL-compliance programs within their enterprises, led by senior managers who report to us, and directly to their enterprises' managing boards, regularly.' I'm all for the GPL, but this sounds suspiciously like an Software Publishers' Association audit. On the other hand, circumstances of something like this would be completely different, i.e., illegally taking copyright privileges over software you didn't write, as opposed to illegally copying software." Actually, I also think they sound alike in certain ways, but that it makes sense -- since both are about unauthorized reproduction of software. I like the FSF's terms a lot more. Update: 09/18 19:53 PM GMT by T : As Dr. Nonsense points out, davidb "probably meant the dreaded audits by the Business Software Alliance," rather than the SPA.

big difference

The SPA audits software used internally in an organization. The FSF audits software that is incorporated into derived works that the organization distributes and charges license fees for as if it were their own. It seems the former is a lot easier to do by accident than the latter.

If the FSF were making deals that required organizations to only use free software internally, then you could draw comparisons with the SPA.

The first case is worse

Illegally copying software is a run-of-the-mill copyright violation. However, Illegally asserting a copyright that isn't yours exposes the violator to liability against the alleged infringer, as well as sanctions by the court and the Copyright Office. A much more serious offense.

Give me freedom..

..or give me death.

The FSF would love to hang you out to dry as fast as Microsoft will for license violation.

Keep your code FREE! Use the BSDL, the MIT license, or something that doesn't care if your code goes where it may be required.

After all, if the idea of this 'Free' is to promote the spread of information (after all, software is speech) than we should really be free.

Important difference

An important difference is that most BSA members have EULAs that are you must accept in order to use the software, because they are more restrictive than normal copyrights. This is why they need shrink-wrap licenses.

No one is forced to agree to the GPL in order to use GPL software. Even if I refuse to accept the GPL, I can still legally use gcc (or linux) so long as I obey traditional copyright law (as I would have to if gcc had no license at all). If I want more rights than that (such as the right to make copies without the authors explicit permission, or the right to produce a derivate work), then the GPL comes into play by setting the conditions I must meet in order to do that.

Have you ever gotten a letter from the SPA or BSA?

If you had, you wouldn't be comparing the FSF to either of those. The comparison is weak because the FSF only looks at software development firms, whereas the SPA/BSA target their users/customers.

(l)GPL enforcement

Without people like the SPA (Software Publishers Association) and the GNU group then coporations that should do the right thing, wouldn't due to $$$. Money makes busines decisions. The SPA makes it harder for corporations to use pirated software. Where the GNU group (I am not sure what the proper term of the GNU people are, so do not flame me on calling them the GNU group) is there to make sure that the software that was put out under the GPL/LGPL license stays that way. If not, too many corporations would steal the code and release it as theirs (without adhering to the license).

I am all for the GNU group and what they do. Open up the source code so we can fix the bugs. Make it harder for Virus writers/hackers/script kiddies to do they stuff.

Scott

GPL Issue (and maybe solution?)

I've been bothered by one thing for a while about the GPL, and I think I might have a solution (or, maybe, this is a non-problem).

It seems that a major concern of the GPL is that if you just USE a program, you do not have to accept the terms of the GPL. By refusing to accept the terms of the GPL, you are also refusing not to hold the authors of the software liable for any failures, leaving the authors open to potential lawsuit.

Solution? Maybe a particular license, in the same fashion as the closed source houses do, disclaiming liability in the event of failure, which must be accepted before the user may begin using the program. This would be in addition to the GPL, which also does the same thing.

Of course, I may be talking about a non-issue, but this seemed like as good a time as any to ask the question.

How would you attack the GPL in court?

The question I would like to ask is to any lawyers or wannabe lawyers out there. If you were in a position to defend a company against a GPL copyright infringment, how would you go about attacking the GPL?

Some Mirror URLs

Please note that this essay is merged version of the two part essay that appears on Eben's own website [columbia.edu]. The articles also appear as Part I [linuxuser.co.uk] and Part II [linuxuser.co.uk] in Linux (sic) User UK.

I thought this information might be helpful so some load balancing can be done.

Applauding the FSF

While some people may be scared of the FSF, and while I do not agree with all of their views. (Sometimes with questionable methods/reasoning.) It's nice to know that they're out the protecting the interest of the community.

I don't think people realize how important it is that the FSF does this with the corporate world. Not only does this keep abuse of the community's gifts from happening, but it also makes corporate lawyers all warm and fuzzy because they can tell their bosses that they're all legal.

This service is something that's very important to the community's continued success. Don't underestimate it...

How does the GPL define "distribute" ?

This article reminds me of a question I've had for a long while now. What does the GPL take as the definition of "distributing" source code?

The extreme cases are obvious: I assume if I package and sell a product based on GPL code, that would be construed as "distribution." But if I make mods to a GPL project and use it personally, that's *not* distribution.

So here come the gray areas: what if my company makes experimental mods to a GPL program and puts the result on an NFS server for others in the office to use? Is that considered "distribution"? What if that same fileserver is also available to remote offices in my company? What if the code is made available to subcontractors?

I've run into this

Here are some other grey areas:

1) installing modified GPL code on a machine for a customer to evaluate -- RMS has told me that if the customer controls the machine, it is distribution, but if the code modifier controls the machine, it is not.

We ran into this when installing a system for a customer for acceptance testing.

2) Distributing binaries ahead of source (i.e. to subcontractors). RMS has made it clear to me that this is verboten. He sympathized with our plight, but could find no way that the GPL would permit this. OTOH, in practical terms, as long a source was distributed as rapidly as possible, we would likely not face allegations of violation.

We ran into this when sending "the latest, greatest build of code" to subcontractors, or potential customers for evaluation on machines we do not control. Sometimes we'd want to ship an installation CD, or download updates to someone as part of work in progress. This is a technical violation.

3) redistribution within an organization. This is a real grey area -- is the organization in control of the code or the individuals who have access to it? Personally, I have taken the former approach, but have never refused to give mods to GPL code to coworkers, when asked.

"accepting the license"

Eben claims that users of GPL'ed code need
do "nothing" in order for the license
to apply.

I just read an article in a law review newsletter
on the GPL that disagrees with him, and lists
several conditions the author believes
someone would have to have taken in order to
get a court to agree that he agreed to a license.

The author continues, and I think that Eben would agree, that under such circumstances, the GPL
and its provisions are null and void - the case
becomes a simple matter of copyright infringement.
Thus, the "license breaker" could not be
forced to release their own source code.

The article is not online unfortunately,
else I would have posted it here.

This only reinforces...

...my decision to stop using the GPL for any of my own code; I've relicensed everything under a libpng/zlib-style agreement, thus distancing myself from the extreme opinions of GPL's adherents.

Knowledge doesn't want to be free -- knowledge has no desires of any kind. It is certain people who want knowledge to be free. I'm one of those people; where I differ from the GPL is in my definition of "freedom".

Freedom is a lack of obligation; the GPL does not define "freedom", it forces obligations on people, and uses the very Copyright they despise as a tool for control. Mod me down if you will, but I have just as much right to my opinion as they do to theirs.

I have respect for Mr. Stallman's goals, but not his tactics. He and I share many beliefs when it comes to freedom -- on the issue of GPL, though, I beg to differ.

In many ways, GPL's adherents remind me of an obnoxious slogan I once saw on a hat: "If you love something, set it free; if it doesn't come back, hunt it down and kill it." Sorry, RMS, I just don't hold with that kind of thinking.

The GPL is about power, not freedom; buy into the GPL myth, and you're just exchanging one master (Mr. Gates) for another (Mr. Stallman).

GPL vs. LGPL

The essay says that trying to defy the GPL will only harm the company doing so. True, but will that stop them from doing it?

Imagine company X, project Y and programmer Z. Company X want's to include some ingenious code from project Y made by Z. The problem is that Y is protected by the GPL thus forcing company X to publish their program under the GPL or any compliant license. Company X is small and needs all the money it can get, the GPL won't insure profit so they have to abandon their project. Had the program or parts of it been published under the LGPL this would not been a problem. Fair should be fair, the company X has got one option. They could ask Z to re-publish Y as a whole or partially under the LGPL, this however requires an unnessecary amount of work.

I would like to see future GPL's as a fusion between the LGPL and the GPL making it possible for makers of proprietary code to include parts of GPL'd code in their work. (Providing that those parts, or the whole project, are published in source-form.)

(Flamestopper: X, Y, Z - I'm good at the alphabet.)

GPL is based on copyright law

The GPL derives it's legal power from copyright law. No copyright law, no GPL. Copyright law, rightly, gives the original author of a work exclusive rights to publish, sell, or distribute that work as he or she sees fit, for a limited time. Unfortunately, our congresscritters convieniently ignore that last clause when drafting new laws.

Under copyright law, only the copyright holder may create derivitive works. By publishing under the GPL, the copyright holder conditionally relinquishes this exclusive right, under the restriction that any derivitive work must also be released under the GPL. If you don't abide by this restriction, you don't have permission to release the derivitive work. The GPL may be a more socially responsible and less restrictive application of copyright law than a traditional EULA, but both derive their authority from the same source.

Keeping this in mind, is it really that suprising that the mechanism for enforcing the GPL compliance is very similar to the process used to enforce more restrictive EULA's? Any legal processes can be used for good or evil: the court that issued the Miranda ruling is the same court that came out with Dred Scot decision. Regardless of the application or the outcome, the process of applying the law is the same.

Enforcability

". . . in the cases I have in mind, legal technicalities prevented actual criminal prosecution of the violators"

So convincing other people not to use software which continues to be published is enforcement? What are these technicalities? Specifics man, I need the facts!

Heck, I thought he meant...

The Boy Scouts of America; man, they're nasty when they want to be...

...I know, I was one of those little military wannabes. Heh, heh, I have fond memories of camp fires and indendiary devices... ;)

EULA problem...

The restriction on decompiling software contained in end user licences would make it illegal to decompile a program to check its simillarity with a GPL'd program. I wonder how much of a problem this is?

From a technical perspective, you can't just do an "ungcc badprogram; diff badprogram.c goodprogram.c", and from a legal perspective, even if you could would this information be admissable in court as it was obtained in violation of the EULA?

This has to be done, people.

I felt that this paragraph looked bad: 'In such situations we work with organizations to establish GPL-compliance programs within their enterprises, led by senior managers who report to us, and directly to their enterprises' managing boards, regularly.' I'm all for the GPL, but this sounds suspiciously like an Software Publishers' Association audit.

hypothetical situation:

Company X downloads GPL'd code Y which would be really useful as part of the new commercial product they're writing. Company X uses code Y and locks it into the binary of the program and breaks the GPL, releasing it as closed source payware and not giving any credit either. Hacker Z suspects his GPL'd code was used in the software but can do nothing because company X can use the DMCA to stop anyone from reverse engineering the program.

With this is mind, the only way it seems possible to stop someone from stealing GPL'd code is to watch them AS they write code that may contain it.

Comments, suggestions?

-Kasreyn

A more friendly GPL

While this sounds like a "Nazi" [SPA] approach to some, to me it sounds like GPL leaders are simply extending their hands to help avoid a potentially costly legal battle. In my opinion, it's a sane, friendly and mature approach. By GPL supporters saying, "Here, let me help you comply and make this work with your business goals..." they are improving the "feel-good" effect of using GPL as well as the cold business aspects of the GPL.

Let's face it, by giving companies a difficult time where the GPL is concerned, we are stiffening the arguments against "free software" that are currently preventing companies from using it.

Fanatics.

Why is everyone looking for fanatism in Afganistan when there are plenty of it right over at the free software foundation.

I have returned to the Dark Side!

Yo CM! How ya doin'?

Fuck posting for karma. It got boring, and hell, they modded me down anyway.

I'm gonna get muhself bitchslapped! -1, here I come!

Legal != Just

If someone were able to take GPL'd code proprietary simply due to a 'loophole', this obviously runs 180 degrees against the spirit of the GPL. The FSF is doing its best to see that no one does this.

They aren't perfect, but who is?

Re:terms of FSF and friends

So much for making informed decisions, lets just be morally superior and force our views on others.

Yeargh..... You probably haven't really read the GPL or LGPL have you? ;-)

These licenses do not force you to use them when starting your own projects or applications.... they only stipulate that if you want to use code from an existing GPL/LGPL project, you must retain the software license. You are free to choose whatever license you want for your own projects.

This is socialism, no matter how you wrap it up in pretty rhetoric.

Double yeargh.... It is not socialism... You can take the GPL or LGPL, retain the copyright of your code/project in your own name, change the copyright at a later date (just not on already published/released code), and even modify the GPL or LGPL to ensure you retain in control (just remove the "or any
later version" from them, and viola!).

While RMS is extreme, and many times arogant and hard to deal with, the one thing you have to realize is that the FSF is not RMS and RMS is not the FSF! There have been many many examples of desent inside the FSF (just take a look at the glibc maintainer's issues with RMS [linuxprogramming.com]).

hey moderators? suck my ass

troll shit, when you fucking assholes grow up you'll realize the meaning of the word opinion, even when you disagree with it. Everything I wrote is factually true and in response to the original (off-topic!) message.

for the vast majority of you i was a moderator long before you found the place.

read the guidelines again.