Open Source and Legal Issues

Transcription

1 In-House Lawyers: Shaping New Legislation, Case-Law and Government Plans into Practical Company Policies Open Source and Legal Issues Rodolphe Michel, British Telecommunications plc This presentation contains the views of the author and does not indicate endorsement by British Telecommunications plc.

2 Question set 9: Open Source and Legal Issues What on earth is open source (and what it s not)? Governments at the national, state and local level across the globe are requiring open source in their projects - almost all major commercial software vendors use or distribute code under some open source licence Should the lawyer be wary of open source? Why should you be concerned? Why different OSS/FS licences matter? Copylefting vs. non-copylefting - can you copyright-infringe open source software? Jacobsen v. Katzer, 535 F.3d 1373 [Fed. Cir. 2008] Open source licences create binding obligations on the licensees of open source software While these obligations are not always clear, taking steps to identify and manage the use of open source software can help mitigate the risks associated with open source software

3 What on earth is Open Source Software (OSS)? Open Source Software (OSS) Any program whose source code is made available for use or modification as users or other developers see fit. Usually developed as a public collaboration and made freely and publicly available. OSS refers to software that complies with the Open Source Definition. OSS is distinguished by the licence(s) that governs the use, distribution, and, most importantly, the rights to access and modify the software's source code. Although OSS is also called free software it is far from free. Freeware Commonly used for software packages that permit redistribution but not modification (source code is not available). Offered at no cost, typically copyrighted so cannot be incorporated into another product.

4 What on earth is Open Source Software (and what it s not)? Open Source Software is/can be: Royalty-free for use, copying and redistribution Available with corresponding source code Freely modified Available to all Not tied to any particular software distribution Freely distributed with other software Protected by copyright laws Subject to enforceable licences Open Source Software is not: In the public domain freeware shareware

5 Open Source Development Cycle Open Source Software goes through the following cycle: 1. A developer generates a source code as well as a compiled code for a particular function/task Source Code 1 Compiled Code 2. That source code is passed on to Open Source community 3. Once in Open Source community other developers may study, modify, improve, enhance the source code Improved version of the code is then redistributed for further improvements to the open source community Developer 4 Open Source Community Improved Version 3

6 The Free Software Definition Free software is a matter of liberty, not price. To understand the concept, you should think of free as in free speech, not as in free beer. Free software is a matter of the users' freedom to run, copy, distribute, study, change and improve the software. More precisely, it means that the program's users have the four essential freedoms: The freedom to run the program, for any purpose (freedom 0). The freedom to study how the program works, and change it to make it do what you wish (freedom 1). Access to the source code is a precondition for this. The freedom to redistribute copies so you can help your neighbour (freedom 2). The freedom to distribute copies of your modified versions to others (freedom 3). By doing this you can give the whole community a chance to benefit from your changes. Access to the source code is a precondition for this.

7 Governments at the national, state and local level across the globe are requiring open source in their projects OSS on UK Government Key Open Source and Open Standards documents: 2000: The European Commission s initiative eeurope An Information Society for All Action Plan dated June It includes the target that: during 2001 the European Commission and Member States will promote the use of open source software in the public sector and e-government best practice. 2001: Analysis of the Impact of OpenSource Software 2002: Open source software use within UK Government 2004: Open source software use within UK Government 2004: e-government Interoperability Framework 2009: Open Source, Open Standards and Re-Use: Government Action Plan 2011: Procurement Policy Note (PPN) Use of Open Standards when specifying ICT requirements

8 Governments at the national, state and local level across the globe are requiring open source in their projects Europe leads the world in open source software adoption and development. Open source solutions have greater market share in Europe than the rest of the world, both on the server and the desktop, and more open source developers live in Europe than on any other continent including North America. European firms that contribute to open source projects account for about 565,000 jobs and have combined annual revenues of over 260 billion ($350 billion).

9 Almost all major commercial software vendors use or distribute code under some open source licence 100+ billion of lines of code (*) 500,000+ projects (*) Billions of of development (*) 2,000+ unique licences (*) 22% of typical commercial application/project is open source (*) (*Source: Black Duck Open Source Resource Center )

10 Why different OSS/FS licences matter? All Open Source Software licences are NOT the same Each licence has different set of requirements for using the software and set of requirements for modifying, distributing the source code, etc. Top 20 Most Commonly Used Licences* (*Source: Black Duck Open Source Resource Center) 2.41% 1.80% 1.13% GNU General Public License (GPL) % 6.74% 7.99% 8.22% 4.95% 8.49% 45.21% Artistic License (Perl) MIT License GNU Lesser General Public License (LGPL) 2.1 GNU General Public License (GPL) 3.0 BSD License 2.0 Apache License 2.0 Code Project Open 1.02 License Microsoft Public License (Ms-PL)

11 Example: GNU General Public License, version 2 (excerpts)... TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION You may copy and distribute the Program (or a work based on it, under Section 2) in object code or executable form under the terms of Sections 1 and 2 above provided that you also do one of the following: a) Accompany it with the complete corresponding machine-readable source code, which must be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or, c) Accompany it with the information you received as to the offer to distribute corresponding source code. (This alternative is allowed only for non commercial distribution and only if you received the program in object code or executable form with such an offer, in accord with Subsection b above.) The source code for a work means the preferred form of the work for making modifications to it. For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable. However, as a special exception, the source code distributed need not include anything that is normally distributed (in either source or binary form) with the major components (compiler, kernel, and so on) of the operating system on which the executable runs, unless that component itself accompanies the executable. If distribution of executable or object code is made by offering access to copy from a designated place, then offering equivalent access to copy the source code from the same place counts as distribution of the source code, even though third parties are not compelled to copy the source along with the object code. 4. You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance. 5. You are not required to accept this License, since you have not signed it. However, nothing else grants you permission to modify or distribute the Program or its derivative works. These actions are prohibited by law if you do not accept this License. Therefore, by modifying or distributing the Program (or any work based on the Program), you indicate your acceptance of this License to do so, and all its terms and conditions for copying, distributing or modifying the Program or works based on it. 6. Each time you redistribute the Program (or any work based on the Program), the recipient automatically receives a license from the original licensor to copy, distribute or modify the Program subject to these terms and conditions. You may not impose any further restrictions on the recipients' exercise of the rights granted herein. You are not responsible for enforcing compliance by third parties to this License. 7. If, as a consequence of a court judgment or allegation of patent infringement or for any other reason (not limited to patent issues), conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all. For example, if a patent license would not permit royalty-free redistribution of the Program by all those who receive copies directly or indirectly through you, then the only way you could satisfy both it and this License would be to refrain entirely from distribution of the Program....

12 Should the lawyer be wary of open source? Why should you be concerned? General Contractual Risks No meaningful warranty provisions No indemnity provisions Unidentified upstream licensors Most open source licences were drafted by non-lawyers and have never been tested in court, the ambiguities in the licence terms give rise to uncertainty as to compliance with them Uncertainty about the governing law and jurisdiction

13 Should the lawyer be wary of open source? Why should you be concerned? Risks Imposed by OSS Licences Copyleft obligations persistent May be viral E.g. GPL requires that you must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this license. GPL v. 2 2(b) Duty to disclose licence obligations Notice obligations Attribution requirements Advertising restrictions Patent Protection Whenever someone conveys software covered by GPLv3 that they've written or modified, they must provide every recipient with any patent licences necessary to exercise the rights that the GPL gives them. In addition to that, if any licensee tries to use a patent suit to stop another user from exercising those rights, their licence will be terminated.

14 Different Types of Open Source Licences (depending on the type of restrictions they imposed upon) Strong Copyleft Weak Copyleft Permissive Restrictive Hybrid Permissive

15 Why should you be concerned? Breach of the Open-Source licence is a breach of copyright law (as Open Source Licences rely on copyright laws). Open source comes with unusual licence restrictions that may impact a company's strategies, particularly the risk that its own proprietary software may be tainted by a duty to open its source code to others, by requiring that any modified software be redistributed on the same terms as the open-source software and at no charge. Consequently, the commercial value of a proprietary software could thereby be virtually eliminated. There may be conflicts between the terms of different Open Source licences, e.g. components licensed under General Public Licence ( GPL ) may not be distributed with components licensed under the Mozilla Public Licence. If one fails to comply with the Open Source licence governing a particular piece of software code, the right to use that particular piece of code is automatically revoked. Open Source licences do not usually include standard notice-of-breach and cure provisions.

16 Why should you be concerned? Patent risks for patent holders If a patent holder distributes open source code, the patent holder may be forced to grant a royalty-free licence or a non-assertion undertaking to all users of the open source code. E.g. Mozilla Public Licence Anyone who contributes to a project licensed under the Mozilla Public Licence is required to give an unlimited, royalty-free patent licence on his contribution to the whole world. E.g. GNU General Public Licence The GNU General Public Licence (GPL) forbids imposing any restriction whatsoever on the rights granted by the licence to the recipients of the software. If a distributor does impose any further restrictions, his licence under the GPL is revoked. This means that a patent holder who distributes a software package incorporating his patent can no longer assert that patent against people who distribute that package further or incorporate the package in their own product. Please note that the mere distribution in unmodified form of third party software under the GPL licence means that any patent covering that software becomes unenforceable.

17 Free Software Foundation v. Cisco Systems Chronology of the case December 2008: Free Software Foundation started proceedings against Cisco Systems in the United States District Court for the Southern District of New York. Free Software Foundation claimed that various products sold under the Linksys brand by Cisco have violated the licensing terms of many programs on which the Free Software Foundation holds copyright, including GCC, binutils, and the GNU C Library. Most of these programs are licensed under the GNU General Public Licence, and a few are under the GNU Lesser General Public Licence. Free Software Foundation asked the Court to enjoin Cisco from further distributing Linksys firmware that contains Free Software Foundation copyrighted code, and also asked for all profits that Cisco received from its unlawful acts. Cisco responded that they were reviewing the issues in the suit, but they believed to be substantially in compliance. May 20, 2009: the parties announced a settlement which includes Cisco appointing a director to ensure their Linksys products comply with free software licences, and Cisco making an undisclosed financial contribution to the Free Software Foundation.

18 What on earth is Open Source Software (OSS) (and what it s not)? Adverse effects of failing to properly manage the use of open-source code can extend beyond liability for damages for copyright infringement. E.g. in acquisitions/mergers transactions: When IBM acquired Think Dynamics a few years ago, a scan of the software code of Think Dynamics found 80 to 100 examples of open-source code that the company had failed to disclose during the negotiations. As a result, IBM reduced the purchase price for the company over thirty percent (30%) from $67 million to $46 million. Discovering unaccounted for open-source code in an enterprise s software during the due diligence process could also upset a potential joint venture, an investment in the enterprise, or other strategic transaction.

19 Copyleft vs Copyright Copyleft one of the main innovations of Open Source licensing is a word play on copyright. Copyright law is used to prohibit others from reproducing, adapting, or distributing copies of the author s work. Copyleft allows an author to give out copies of a work with permission to reproduce, adapt or distribute, but requires any resulting copies or adaptations to also be bound by the same licence agreement. Copyleft relies on copyright laws.

20 Copylefting vs. non-copylefting can you copyright-infringe open source software? Major difference between Open Source licences is whether they are considered Copyleft or not? Where copyright law allows the copyright owner to withhold permission to copy, modify, or distribute software, Copyleft licences require that permission to be granted. In order to use or distribute software licensed under a Copyleft licence any changes made to the code must be released under the same Copyleft licence. The best example of a Copyleft licence is the GPL licence (GPL v2 and GPL v3). So called Permissive Licences, like the BSD Licence, are non-copyleft licences as they do not impose many restrictions on later development or modification of the original software.

21 Weak Copyleft The Lesser-General Public Licence (LGPL) is like the GPL, but it allows works licensed under it to be linked to by closed-sourced proprietary software. LGPL was originally used for libraries. LGPL would allow a developer to use a library of code licensed under the LGPL, without requiring the developer to release their software as open source. If the library itself is changed though, the copyleft provisions apply to the new version of the library.

22 Questions to Ask If an Open Source code is modified, can the modified code be distributed under a different licence? Copyleft licences require any distribution of a modification to be distributed under the same licence. Some copyleft licences will allow distribution under a similar licence. The Copyleft provisions do not kick in until distribution though. So you can typically modify a program and use the modified version internally without revealing the changes and thereby protecting any other code that could be considered a trade secret. Once the modified version is distributed, the changes must be revealed. What are the risks of combining the Open Source code with proprietary code? Copyleft code cannot be combined with proprietary code. Non-copyleft code and some weak copyleft code (e.g., LGPL) can be combined with proprietary code. Are there any other requirements imposed by the Open Source licence? E.g.: Include warranty disclaimers Include copyright and attribution notices provide a copy of the licence to a downstream licensee include a description of any changes made to the code by the licensee prior to redistribution include an offer to provide the source code to the software upon request include source code to non-standard software that is required in order for the program to run properly include a file listing any known intellectual property disputes involving the software.

23 Jacobsen v. Katzer, 535 F.3d 1373 [Fed. Cir. 2008] Chronology of the case Jacobsen is the copyright owner of certain computer program (DecoderPro files), which is available for download and use. Code made available to the public without cost pursuant to the "Artistic Licence" -- an open source or public licence. Jacobsen s open source group JMRI (Java Model Railroad Interface) created the computer program in question. The program is an application called DecoderPro, which allows model railroad enthusiasts to use their computers to program the decoder chips that control model trains. The downloadable files contain copyright notices and provide a file that clearly sets forth the terms of the Artistic Licence for use of those files. Katzer is a commercial software developer for the model train industry and hobbyists. Jacobsen alleges that Katzer used portions of the downloaded files as part of Katzer s software program that did not comply with terms of the Artistic Licence. Software did not include: the authors names; copyright notices; references to the COPYING file that includes the text of the licence; identification of plaintiff s site as the source; and description of the changes made to the copied files. Jacobsen sought a preliminary injunction against Katzer s use of the DecoderPro materials.

24 Jacobsen v. Katzer, 535 F.3d 1373 [Fed. Cir. 2008] Jacobsen argued that the terms of the Artistic Licence define the scope of the licence, which restrict the copyright rights that could be exercised by the licensee. Katzer counterclaimed that the terms of the licence were merely covenants that provide contractual terms for use of the materials, such that a violation was neither compensable (since the licence provide use at no cost) nor subject to injunctive relief. The Court relied on reasoning by other Circuit Court of Appeals regarding copyright holder's rights. Copyright holders who engage in open source licensing have the right to control the modification and distribution of copyrighted material. The Court held that: the Artistic Licence provided for the use of the copyright materials with the right to make modifications and to distribute the software conditioned on the restrictions in the licence. it is outside the scope of the Artistic Licence to modify and distribute the copyrighted materials without copyright notices and a tracking of modifications from the original computer files. Katzer did not comply with the copyright restrictions nor did Katzer make other arrangements with Jacobsen. The Court pointed out that Artistic Licences provide economic benefits, such as driving traffic to the open source incubation page or providing downstream users with notice of the open source project that eventually lead to creative collaboration. Katzer did not comply with the conditions set forth by the Artistic Licence and therefore infringed Jacobsen s copyright in the programs.

25 Bochum District Court, partial judgment of 20 January 2011 I-8 O 293/09 Bochum District Court (Germany), partial judgment of 20 January 2011 I-8 O 293/09. The plaintiff develops open source software (FreeadhocUDF) and licensed this according to the GNU Lesser General Public Licence ( LGPL ). The defendant sold this software but failed to abide by the licence requirements in relation to its product WISO Mein Büro In particular, it failed to specify the name of the developer, did not provide the text of the LGPL and did not make the source code available. The court held that: Defendant s conduct amounted to an infringement of the software developer s user rights under copyright law. It was immaterial whether the software performs a function within the product WISO Mein Büro A developer of Open Source software may claim damages according to principles analogous to those applicable to licences, irrespective of whether the right to use the Open Source software is granted free of charge. Problems may arise solely in relation to the calculation of the quantum of damages due to the fact that the plaintiff itself only developed part of the open source software, and therefore the evaluation of its share is of decisive importance in calculating damages.

26 Developing Open Source Policies Companies must have a policy for procuring OSS, deciding which applications will be supported by OSS, and identifying the intellectual property risk or supportability risk associated with using OSS (Gartner). Once a policy is in place, then there must be a governance process to enforce it (Gartner). Vendors Explicitly address the use of OSS Warranty/Indemnification Employees Understand what your developers are doing IPR policies Remediation Assess during IP Due Diligence Address during versioning process Involve legal team

27 Dealing with Open Source M&A Risk The conventional due diligence and warranty approach still works but also think about: does the target have an Open Source policy - is it followed? can it define the scope of its usage? what Open Source is present, can it be listed? has the target had any correspondence with the Open Source or free software "community" (who actively police Open Source licences)? If there is a viral licence which could trigger a Copyleft issue then it is vital this is analysed from a legal and technical perspective to see if the buyer's plans for that product are consistent with the Open Source licence obligation. Code Scanning Companies are now emerging to provide source code scanning services to identify Open Source and their associated Open Source licence terms. Once identified, a risk assessment can be carried out prior to the transaction closing. Code scanners provide an effective way of understanding the nature of core software assets in a target's business and this process sits well alongside traditional IP due diligence.