Open Source Software: Strategies and Risk Management

Transcription

1 Open Source Software: Strategies and Risk Management Elisabeth Esner i DLA Pper i Rudnick Gray Cary US LLP (858) elisabeth.e isner@dlap iper.com Mark Lehberg DLA Pper i Rudnick Gray Cary US LLP (858) mark.lehberg@d lapiper.com Chr is Ekren Sony Corporat ion (858) christopher.ekren@am.sony.com Kevin Carmony Pres ident and CEO Linspire, Inc. Linux Adoption (Source: IDC)

2

3 Open Source Adoption Open Source Software in in the News: May 10, 2005 Intel has created a group to Free focus Redistribution Linux and other open-source software issues, Thethe license newest maymove not restrict to bring any the party opensource from selling operating or giving system away close the software to parity as with a competing products from Microsoft. CNET component of an aggregate software News.com. distribution containing programs from several different sources. The license may May not 19, require 2005 Simula a royaltylabs, or other an investment fee for such venture, sale. will establish a fund dedicated solely to open-source Rationale: Helps software. resist Simula pressure Labs to will take open-source sacrifice long development term gains pro for jects short and termseek to create profit. businesses around them. Simula Labs has commitments from Redpoint Ventures and Mission Ventures to put in $10 - $15 million for 6-8 start-ups during the next 3 years. CNET News.com.

4 Outline: 1. What is Open Source Software - Basic Principles 2. Classic Open Source Licenses - Basics of the GNU General Public License (GPL) 3. Potential Consequences for Violating the GPL or Other Open Source License 4. Elements of an Open Source Strategy 5. Business Models for Exploiting Open Source Software 6. Critical Open Source Legal Issues 7. Setting up an Open Source Policy What Is Open Source Software?? Free Distribution Source Code Derived Works Integrity of Source Code No Discrimination Distribution of License License Not Product Specific License Must Not Restrict Other Software License Must Be Technology-Neutral

5 Basic Principles of Open Source Licensing Open Source Definition Free Redistribution The license may not restrict any party from selling or giving away the software as a component of an aggregate software distribution containing programs from several different sources. The license may not require a royalty or other fee for such sale. Rationale: Helps resist pressure to sacrifice long term gains for short term profit. What Is Open Source Software?? Free Distribution Source Code Derived Works Integrity of Source Code No Discrimination Distribution of License License Not Product Specific License Must Not Restrict Other Software License Must Be Technology-Neutral

6 Basic Principles of Open Source Licensing Open Source Definition Source Code The program provided to users must include source code and must allow distribution in source code as well as compiled form. Source code must be in preferred form by programmers and may not be deliberately obfuscated or in intermediate form. Rationale: You can t evolve programs without modifying them. Alternative: If the product is only distributed in object code form, a well-publicized means of downloading the source via the Internet will suffice. What Is Open Source Software?? Free Distribution Source Code Derived Works Integrity of Source Code No Discrimination Distribution of License License Not Product Specific License Must Not Restrict Other Software License Must Be Technology-Neutral

7 Basic Principles of Open Source Licensing Open Source Definition Derived Works The license must allow modifications and derived works, and must allow them to be distributed under the same terms as the license of the original software. Rationale: This requirement is necessary for maintaining software (e.g., fix bugs, port to new systems, make improvements). What Is Open Source Software?? Free Distribution Source Code Derived Works Integrity of Source Code No Discrimination Distribution of License License Not Product Specific License Must Not Restrict Other Software License Must Be Technology-Neutral

8 Basic Principles of Open Source Licensing Open Source Definition Integrity of the Author s Source Code The license may restrict source code from being distributed in modified form only if the license allows the distribution of patch files with source code for the purpose of modifying the program at build time. Rationale: Users have a right to know who is responsible for the software that they are using and developers to know what they are supporting. What Is Open Source Software?? Free Distribution Source Code Derived Works Integrity of Source Code No Discrimination Distribution of License License Not Product Specific License Must Not Restrict Other Software License Must Be Technology-Neutral

9 Basic Principles of Open Source Licensing Open Source Definition No Discrimination Against Persons or Groups The license may not discriminate against any person or group of persons. Rationale: This provision is necessary to get maximum benefit from the process. Note: The license may warn of applicable legal restrictions, eg., export control laws, but the license may not incorporate such restrictions. Basic Principles of Open Source Licensing Open Source Definition No Discrimination Against Fields of Endeavor The license may not restrict anyone from making use of the program in a specific field of endeavor (e.g., genetic engineering). Rationale: This is intended to avoid license traps that prohibit the software from being used commercially.

10 What Is Open Source Software?? Free Distribution Source Code Derived Works Integrity of Source Code No Discrimination Distribution of License License Not Product Specific License Must Not Restrict Other Software License Must Be Technology-Neutral Basic Principles of Open Source Licensing Open Source Definition Distribution of License The rights attached to the program must apply to all to whom the program is redistributed without the need for execution of an additional license by those parties. Rationale: Mass market licenses / intended to forbid closing up software by indirect means (e.g., use of NDA).

11 What Is Open Source Software?? Free Distribution Source Code Derived Works Integrity of Source Code No Discrimination Distribution of License License Not Product Specific License Must Not Restrict Other Software License Must Be Technology-Neutral Basic Principles of Open Source Licensing Open Source Definition License Must Not Be Specific to a Product The rights attached to the program must not depend on the program being part of a particular software distribution. Rationale: To prevent locking up the rights through inclusion with a larger software distribution.

12 What Is Open Source Software?? Free Distribution Source Code Derived Works Integrity of Source Code No Discrimination Distribution of License License Not Product Specific License Must Not Restrict Other Software License Must Be Technology-Neutral Basic Principles of Open Source Licensing Open Source Definition License Must Not Restrict Other Software The license must not place restrictions on other software that is distributed along with the licensed software. For example, the license must not insist that all other programs distributed on the same medium must be open source software. Rationale: To avoid restricting the decisions distributors of open source software make about their own software. Note: Quite different from GPL

13 What Is Open Source Software?? Free Distribution Source Code Derived Works Integrity of Source Code No Discrimination Distribution of License License Not Product Specific License Must Not Restrict Other Software License Must Be Technology-Neutral Basic Principles of Open Source Licensing Open Source Definition The License Must be Technology Neutral No license may be predicated upon any individual technology or style of interface. Rationale: To avoid requiring a gesture of assent such as a clickwrap to avoid limiting channels of distribution in which clickwraps are not practical such as FTP or non-web channels.

14 Open Source Distribution Obligations Maintain appropriate notices in Code Base Post Third Party Software Source Code on a hidden public URL when required Publish appropriate generalized Third Party Software notice in: End user manual End user license Sales agreements Meet any marketing attribution requirements Avoid code with those requirements If use is authorized, compliance requires legal assistance Open Source Notice Requirements Copyright notices included in: Documentation Software product Source code Notice of additions and modifications (document changes + date)

15 Source Code Disclosure Source code disclosure and distribution obligations vary in scope and impact: Re-distribution of licensed code Disclosure of modified source code Distribution of modified source code Disclosure of associated proprietary source code Disclosure and distribution of source code can present serious risk to the proprietary rights and commercial value of a client s products Open Source Marketing Attribution Use of licensor s trademark(s) and/or name can be either restricted or required by the license.

16 Classic Open Source Licenses GNU General Public License (GPL License) GNU Lesser General Public License (LGPL License) MIT License BSD-New License Mozilla Public License Academic Free License Q Public License Note: these licenses are less restrictive or more permissive than the GPL depending on your point of view. GNU General Public License Contains a great deal of political dialogue In addition to standard terms of source code licensing, GPL provides that any work based on the program is subject to GPL Scope of based on work Linking to a GPL library (Open Source community position) Linking modules or drivers to Linux Kernel (dynamic versus static) Disclaimer of all warranties Disclaimer of liability Patent license: uncertain

17 GNU General Public License Never enforced in court Potential problems Enforceability in US and foreign jurisdictions Scope of based on (definition of derivative work) Many potential enforcers Ambiguity of treatment of patents Legal effect of FAQs Automatic termination No choice of law GNU Lesser General Public License Version of the GNU Library Public License Designed for libraries of the Free Software Foundation Encourage use of FSF libraries with proprietary code Can modify as long as modified work is also a software library Can opt to apply terms of GNU General Public License Program that uses the library not bound by LGPL Special Rules for combining libraries

18 Potential Consequences for Violation of GPL or other Open Source License Copyright infringement actions Negative publicity (one of the strongest weapons available to the Open Source community is the Internet) Possible monetary consequences Costly delays in product launch or product recall Expensive redundant development efforts Restricted commercializations and lost profit opportunities Potential enforcement rights for every contributor Automatic termination of GPL GPL Enforcement Free Software Foundation claims rights to enforce GPL Created Compliance Lab Claims 50 enforcement actions in 2002 Approximately enforcement actions in 2003 Sends letter alleging violations and demanding right to audit Claims everyone settles because they know they will lose Most actions never become public

19 Elements of an Open Source Strategy Corporate strategy Is open source an enabling technology or business model? Business model Product strategy Licensing model Community strategy Special Considerations External M&A Partnering and channels Internal Research and development Sales and marketing Compliance Business Models for Exploiting Open Source Dual distribution based upon open source Proprietary and open source MySQL/ SugarCRM/Sl eepycat/ TrollTech Subscription/Maintenance Red Had, MySQL Services Spi kesource, SourceLabs, JBoss, CA, Blackduck Mixed proprietary/open source JasperSoft Zend Actuate

20 Critical Open Source Legal Issues Ambiguity of scope of most commonly used license, the General Public License (GPL) Use of derivati ve work No choice of law Incompatibility of licenses (frequently referred to as license proliferation ) Software distributed under the GPL cannot be used with software distri buted under the MPL/ CDDL For projects like Linux, multiple licensors with potentially multiple interpretations of the license Patent infringement: patent trolls and Microsoft (Intellectual Ventures) Setting Up Open Source Policy Implications of Open Source Licensing Choose A License Do you want to allow your code to be incorporated with non-open source code? Do you want to have dual versions of your code (e.g., open source and more robust non-open source versions)? Do you want to segment your code ( i.e., some open source, some object code only)? Whether in Infrastructure or Product every company should have an Open Source (or third party software) Policy. Inventory what has already entered the company. Develop policy for handling third party software. Develop effective procedures for implementing the policy. Educate employees about the policy and procedures. Build mechanisms for addressing open source into M&A due diligence.

21 Use of Open Source Software Policy should include combination of legal and senior technical personnel to review and approve of each use of open source software. May want to have separate terms for proprietary and open source code. What modifications may be made to the open source code. Good record keeping procedures. Easy procedures for following policy (Company Intranet). May be able to obtain a commercial license for the open source code ($$$). Use of Open Source Software When evaluating whether to use open source code consider the following: How will the open source be used (use in product or critical business operations is the most sensitive). The applicable license terms. The availability and cost ( in all senses) of commercial software. The warranty and support terms (as well as importance of having indemnity). The cost and availability of service and support. The technical details of communication with proprietary code.

22 Questions During Audit and Internal Review Characterize the nature of the use of OSS: Is the OSS tool used to evaluate proprietary code? Is the OSS tool used as a basis to develop new applications? Does the OSS interact with proprietary code? With other OSS Code? Characterize the nature of any interaction with other code: Static linki ng (other compliance ti me linking) Dynamic linki ng (or other run-ti me linking) OSS header files or APIs copied into proprietary code OSS itself modified with proprietary code Exist on same storage medium, but no other interaction OSS places or imbeds OSS code in other proprietary code Characterize the Output of the OSS package: Output files of the proprietary software contain OSS Other form? Conclusion Open Source is here to stay Will complement not replace traditional models Not every Open Source license is truly Open Source Must understand the risks you are assuming Should implement policies and procedures for handling open source code