1

by Bong DizonUP College of Law

Dealing with

in the Era of GPLv3Source Software

Free and Open

Today, I will be discussing how free and open source software (FOSS)licenses, in particular the newly-released version 3 of the GNU GeneralPublic License (GPLv3), affects IT contracts.

I chose the phrase “dealing with” because, as IT developers, you deal withFOSS in different ways. You may want to: open source your code; useFOSS in your company; develop your own FOSS; use FOSS togetherwith proprietary software in your systems; use FOSS to provide servicesto clients; or learn how FOSS works because your competitor uses FOSSor is a FOSS developer.

Even if you deal with FOSS in these various ways, this presentation will beuseful because its aim is to give you a better idea of how you canproperly deal with or manage FOSS in your company or business.

2

LicenseFocus on GPLv3Rights granted

Obligations demandedNew and updated conditions

Legal Issues

O v e r v i e w

This is an overview of what we will be discussing. I will:Discuss FOSS licenses as a contract, as a licensing agreement involvingintellectual property rights (IPR). In essence, a FOSS license is acontract between parties for use of IPRs. I will also discuss differenttypes of open source licenses and how they relate to each other.There are many different kinds of FOSS licenses but I will focus onGPLv3.In particular, since the emphasis is on the contractual undertakings ofparties in a FOSS license, I will discuss the rights granted and theobligations demanded by GPLv3.I will also highlight the new and updated terms and condition imposed byGPLv3 and how these affect code licensed under GPLv3.Finally, I will discuss the main legal issues in using, managing anddealing with code under GPLv3.

3

IPR Licensing ContractGPL =

“Free” and “open source” are terms that are used to describe various thingsand concepts: the community, the philosophy, the movement, or thelicense. The focus of this presentation is the last one.

An open source license like the GPL is a contract – it is an agreementbetween the contracting parties concerning intellectual property rights ofa piece of software. It involves the grant of permission to use anotherperson's IPR (primarily copyright, but also patents and trademark).Basically, the GPL is a contract to license IPRs to another. As a license,it sets out in writing the rights that a licensee has and the differentpermissive uses of the software; the limits of what the licensee can orcannot do with the software; and the rights and obligations of the partiesas a whole.

Since FOSS licenses are contracts, it is important to know what rights aregranted and what obligations are imposed on the contracting parties.Knowing these rights and obligations is key to understanding how toproperly deal with FOSS in IT contracts.

4

GPLBSD

Commercial

PublicDomain

Obligations Imposedon User/Licensee

Rig

hts

of U

ser/L

icen

see

Before we begin discussing these rights and obligations, it might be good toillustrate how FOSS licenses stack up against other types of softwarelicenses.

This graphic shows different types of licensing agreements and thespectrum of rights and obligations they grant or impose. How do FOSSlicenses fair against other types of licenses?A grant of software to the public domain means that the authorrelinquishes all rights over the work. Anyone is free to use the work as heor she pleases with almost no obligations imposed. No one can preventyou from using a work in the public domain.On the opposite end is a typical commercial software license. The author,as owner of IPRs underlying the software, imposes a lot of obligations onwhat the user can do. The user normally cannot access the source codeand has no right to derivative works – he cannot use code of the softwareto make his own code.FOSS is in between these extremes. FOSS licenses assert copyrightover the work but permit others to freely use, modify and distribute thework on the condition that the user grants the same rights to others. Thisis called copyleft which is using copyright to keep a work free. Copyleft isepitomized by the GPL.BSD is a kind of FOSS license that imposes almost no obligations. It alsoasserts copyright over the software but the license allows the user to dowhatever he or she wants to the code – keep it free or make turn it intoclosed, proprietary code.

5

Basic Rights of Users

To run the programTo study, access and modify

To redistributeTo modify and redistribute

of Users

FOSS licenses like the GPL use copyright to impose obligations on usersand licensees in order to grant the following essential four rights to users:(1) right to run; (2) right to study, access and modify; (3) right toredistribute; (4) right to modify and redistribute. To be considered aFOSS license, a license must guarantee these basic rights to users (alsocalled freedoms).

6

GPLv3 GPLv3

The GPL is the most popular FOSS license. Linux, considered the mostpopular FOSS, is licensed under the GPL. A new version of the GPL,version 3, was released on June 29, 2007 after 18 months of consultationwith various stakeholders. As the most popular FOSS license, the GPL isan ideal licensing contract to study in order to get a better understandingof how to handle FOSS issues.

7

Rights Granted

Run and useCopy

Modify

Propagate and Convey

These are the four main rights granted to users and licensees under GPLv3.They correspond to the four basic rights previously mentioned but, underGPLv3, these rights are more defined and subject to more conditions.

GPLv3 licenses or authorizes you to: (1) run and use the program; (b) copyit as many times; (3) modify the program; and (4) propagate and conveythe program (similar to the distribution or release of a program but with amore specialized meaning which I will discuss later).

It is worth pointing out that the first two rights (run and copy) have lessconditions while the third and fourth rights (modify and convey) have a lotmore accompanying obligations.

The term of the rights granted under GPLv3 is for the full term of copyright,which in the Philippines is the author's lifetime plus 50 years. For patents,the term is 20 years from the date of filing of the patent application. Therights granted are unlimited and generally irrevocable.

Later, I will discuss how GPLv3 can be used to create a perpetual copyrightover a piece of software.

8

RightsObligations

Before going through the rights granted by GPLv3, it's important toremember that, as with any licensing agreement, rights go hand-in-handwith duties and obligations. As I present each right in detail, I will alsodiscuss the specific corollary conditions and obligations that accompanythese rights.

9

Unlimited useRights over output

Right to RunRight to Run

RightsThis is one of the most free activities granted to users. One has an unlimited

right to run a program.In fact, one is not required to accept GPLv3 if you will just run or use the

program. Technically, you are not subject to the license.If you use the program and it produces an output, for example, an image,

design, document, a database, information or an executable file that youproduced entirely on your own, then that output belongs to you and is notsubject to GPLv3. Any kind of output produced through mere running oruse of a program is not considered derivative work (a work created basedon another work). You own the copyright to it. However, if the originalcode or part of that code is included or reproduced in the output, theresulting output will be covered by the GPLv3.

ObligationsNo real obligation imposed by GPLv3.

10

Make as many copies of unmodified programGive copies to others – for free or for a feeOffer support services or warranty for a fee

Right to CopyRight to Copy

Notification requirements

Give copies of licenses to recipients

RightsLike the right to run and use, there is full authority to make as many copies

of unmodified software as you want. Similarly, you are not required toaccept the license.

In addition to the general right to make copies, you also have a right to givecopies to others either for free or for a fee. This is considered ahandholding fee and not a fee to use the software. The later is prohibitedunder GPLv3. You pay for the service not for the use of the software itself.

You can also offer support services or warranty for the software for a fee.Please note that all these cases deal with unmodified software. The rules

are different if its software you modified. We will get to this later.

ObligationsThere are some minor obligations when copying unmodified (aka verbatim)

copies of software. You need to comply with certain authorship and legalnotice requirements and give recipients copies of the GPLv3 license.

11

CaseStudies

This might be a good time to tackle some actual cases and situations.

12

Installing RedHat LinuxCase # 1

Case # 1: A company installs RedHat Linux on all it's computers withoutpaying RedHat anything.Is this allowed under GPLv3? (Yes.)Does the company have to get a copy from RedHat? (No.)Can the company buy a copy of RedHat in Makati Cinema Square andinstall that copy even if the person selling has no special authority fromRedHat? (Yes.)

13

Selling FOSS CDsCase # 2

Case # 2: A person plans to burn CDs of different Linux distros and FOSSand sell them for a price well above the value of a blank CD.Is that allowed under GPLv3? (Yes.)Can he sell licenses to use the software? (No.)Instead of selling FOSS CDs, can he set up a website that provides apay-for-download service? (Yes.)

14

ObontoCase # 3

Case # 3: A company plans to take the source code of Ubuntu, modify itand release it as a new Linux distro called Obonto. It also wants to offersupport services to both Ubuntu and Obonto.Is that allowed under GPLv3? (Yes.)Can the company provide services as an Ubuntu support service providerand charge a fee? (Yes.) Even against the wishes of Ubuntu? (Yes.)But, this is without prejudice to trademark and notice requirementsissues. In general, when code is licensed under GPLv3, the trademarksof the developer are not included in the license.

15

Right to ModifyRight to ModifyAccess source codeMake derivative works

Must accept the licenseModified work licensed under GPLv3May be required to license modified

work to others

RightsThe right to modify means that you can access the source code of a work and make derivative works

based on the original work (called the modified work).

However, in contrast to the general freedom to run and copy an unmodified program, once youexercise your right to modify, there are a lot of obligations accompanying the modified work.

ObligationsFirst, you must accept the license. You are thus subject to GPLv3.The modified work becomes covered under GPLv3.You may be required to license the modified work to others also under GPLv3.

16

Viraleffect

The rule that modifying GPL'd code or combining and mixing non-GPL'd code with GPL'd code makes modified GPL'd code and thenon-GPL'd subject to GPLv3 is often referred to as the viral effectof GPL. This also happens when you combine code with GPL'dcode to form a larger work.

For example, if you modify GPL'd code by adding your own code, theresulting modified code becomes covered under GPLv3 and youare required to license the entire work to downstream recipientsunder GPLv3.

However, mere aggregation of a non-GPL'd code that works independentlyof GPL'd code does not result in the any “infection”.

17

Right to ConveyRight to ConveyPrivate modification –

no need to release code to the publicLicense it to others under GPLv3

Give others copy or access to modified sourcecode via: (i) physical medium; (ii) written offer 3

years; (iii) written offer to provide; (iv) offeringaccess at designated place (e.g. Server)

Place appropriate notices

If you modify GPL'd code and convey (release or distribute) it to others, youare required to: (a) license it to others under GPLv3 and (b) give thepublic copies of or access to the modified source code.

So, if you keep the modification private, there are no additional duties. Amodification is deemed private if you keep it within your company ororganization and you do not release the code to other persons.

There are different ways to comply with the source code access obligations:(1) durable physical medium; (2) written offer for 3 years to give physicalcopy or give access to network; (3) written offer to provide a copy of oraccess to the source code; (4) offer access at designated place e.g. aserver or a peer-to-peer network.

In addition, you have to place appropriate notices regarding themodifications you made.

18

Additional RightsAdditional RightsDisclaimer of warrantyLimitation on liability

Persons who modify GPL'd code have additional protection. Likecommercial software licenses, GPLv3 contains a general disclaimer ofwarranty and a limitation on liability provisions. This is standard practicein the software industry and are meant to protect FOSS developers.Developers may, however, grant warranties for a fee.

19

CaseStudies

This may be a good time again to discuss some real world cases andscenarios involving these topics.

20

GoobuntuCase # 4

Case # 4: Google uses a modified version of Ubuntu in its computers.Can Google modify Ubuntu without Canonical's permissions? (Yes.)Does Google have the obligation to make the source code of Goobuntuavailable to the public? (No.)

21

Software-as-ServiceCase # 5

Case # 5: A company offers a web-based word processing program thatruns on modified GPL'd code and can be used by people via a webbrowser.Does the service provided by the company amount to conveying ofmodified code? (No.)Is the company required to provide access to the source code of themodified work? (No.)

22

Developing codeCase # 6

Case # 6: A software company is developing security software.Can the company release the software code both under GPLv3 and acommercial license to different parties? (Yes.)Can it mix its own code with publicly available GPL'd code? (Yes.) Whatwould be the effect on the resulting modified code? (Covered underGPLv3.)What if the company decides to port the software to run on Linux. Thecompany developed the software entirely on its own. Can people demandthat the company give access to the source code? (No.)What if the company's software links to a GPL-covered library and thesoftware cannot work without the library. Is the software GPL'd? (Yes.)What if the company mixes its own code with GPL'd code. Itsubsequently offers the modified code to its clients. Can the companyprevent the client from licensing and redistributing the modified code toothers? (No.)

23

Anti-DRMAnti-TivoizationPatent

New and Updated Conditions

Grant ofadditional permissions

Future versions

Termination

These are the new and updated terms and conditions in GPLv3 thatdifferentiate it from GPLv2.

24

Anti-DRM

No express prohibition against DRMLicensee waives legal power to

prohibit circumvention oftechnological measures

Disclaim intention to limit operation

This is the controversial anti-DRM provision. Take note that there is noexpress prohibition from using GPL'd code for DRM systems or insystems with DRM. However, by using GPL'd code, the licensee agreesnot to sue or prevent the circumvention of technological measures thatare implemented on a system or device. There is also a promise that thelicensee has no intent to limit the operation of the program or how it'sused.

Under GPLv3, persons who use GPL'd code cannot prevent others fromcircumventing DRM. They waive the power to enforce the rights grantedto them under DMCA-type laws.

25

Consumer products using GPL'd codePrevent running of modifed code

information as part of source code

Exception: ROM, support service,warranty, updates or modification

materially and adversely affectsoperation of network

Anti-Tivoization

Disclose installation

This is the well-known “anti-tivoization” of GPLv3.Like most consumer electronic devices, Tivo uses Linux software. However,

while users are free to modify Tivo software, the Tivo hardware refuses torun modified Tivo software. The new provision was added in order toprevent this type of restriction on the use of modified GPL'd code inconsumer products. The product or device must remain useful even if it’srunning modified software.

To prevent this, GPLv3 requires persons who use GPL'd code in consumerproducts to disclose installation information (i.e., those required to installand execute modified versions of a covered work) to ensure continuedfunctioning of the device. The installation information must be disclosedand made public – similar to source code

The requirement does not apply if the code is in ROM or pertains to supportservice, warranty and updates. Furthermore, access to a network may bedenied if the modification materially and adversely affects the operationof the network.

26

Express license of patentsNon-exclusive, worldwide, royalty-free

Patents

No discriminatory patent licensebeginning March 28, 2007 (like

Microsoft-Novell deal)

GPLv3 now contains an express patent license for all contributed work aspart of the license.

The license is non-exclusive, worldwide, royal-free, and includes a covenantnot to sue

There is also a long provision prohibiting discriminatory patent licenses likethe one Microsoft (MS) entered into with Novell. MS and Novell agreed toa cross-patent licensing agreement whereby MS issued coupons toNovell's customers (who were using FOSS) guaranteeing them that MSwill not sue them. Under the new provision, if MS enters into a similaragreement concerning FOSS, MS will be deemed to have granted thesame rights and guarantees to all FOSS users. FOSS developers viewMS’s “licensing agreement” with Novell as a form of tax on the use ofFOSS. It should be noted that the provision only applies to discriminatorypatent licenses that are entered into beginning March 28, 2007. The MS-Novell deal is safe.

27

May add supplementary termsconcerning: warranty, notices,prohibit misrepresentation,publicity, trademark andindemnification

Additional Permissions

Further restrictions notallowed – not binding

GPLv3 allows the licensor to add supplementary terms to the license. Thelist of supplementary terms is exclusive:warranty and liabilitylegal and author noticesprohibit misrepresentationpublicitytrademarkindemnification

While addition permissions are now allowed, further restrictions are not. Anylicensee can remove them, e.g. prohibition against military use.

28

Termination

License may be reinstated ifviolation ceases or is cured

Termination of license does notaffect rights of subsequent

licensees

Any violation of GPL – automatictermination of license

License becomes void

The license is deemed terminated if there is a violation of GPLv3. It resultsin automatic termination making the license void. The license may bereinstated when the violation ceases or if the breach is cured.

However, the termination only affects the rights of the licensee in breachand not those of his or her subsequent licensees. So if you think of codelicensed under GPLv3 as connected links in a chain (with the linkscorresponding to the modified code that each person contributes), if aperson commits a violation of GPLv3 his rights to his link and to the entirechain are broken. However, his contribution remains covered by GPLv3and the rights of other licensees to his link and the entire chain remainunchanged.

29

The Free Software Foundation (FSF) has the express right to revise the textof the GPL and make new versions. If modified code is license underGPLv2 “or any later version”, it can be covered by GPLv3. If the license issilent, it is still covered by GPLv2 unless all contributors consent to shiftto GPLv3. GPLv3 introduces the idea of proxies so it's easier to approveversion changes.

It is interesting that Linux is covered by GPLv2 alone. Even with the releaseof GPLv3, GPLv2 is still a valid FOSS license. Legally, code underGPLv2 is incompatible with GPLv3 code because of the additional termsand conditions contained in GPLv3. You cannot combine or mix them.FOSS developers face the possibility of having two classes of FOSS.Sun and Linux may move to GPLv3. Samba announced that it willrelease all new versions of its software under GPLv3.

30

Since the GPL is a licensing agreement, most legal issues involving GPL’dcode are contract-based and are focused on the rights and obligations ofthe parties. You rely on the terms of GPLv3 and one sues based onbreach of contract instead of a violation of the law.

The other major legal issues in FOSS licenses are: unclear IPR, third partyliability (SCO, MS patent threat), TTA.

Due to the open software development model practiced by FOSSdevelopers, it's sometimes difficult to find out who contributed a piece ofcode. Also, since there's a community of developers, one has to deal witha number of licensors/copyrightholders. It's harder to find out whoactually owns or controls the IPR in FOSS and thus results in unclearIPRs. However, with the notification and documentation requirementsimposed by GPLv3 and the use of systems to better documentcontributions, IPR issues involving FOSS are becoming less problematic.

Unclear IPR naturally results in potential third party liability. If somebodyelse owns the copyrights or patents over a piece of code that’s found inFOSS, any and all users may be subject of a infringement suit. However,like most commercial software vendors, big FOSS companies likeRedHat offer third party liability protection to its customers.

The technology transfer arrangement provisions in the Intellectual PropertyCode require that IPR licensing agreements must contain certainmandatory provisions and must not contain any prohibited clauses asstated in the law. Otherwise, the licenses will be unenforceable. MostFOSS are mass market software which are exempt from TTA rules. It isalso important to point out that commercial software licenses are alsosubject to the TTA provisions.

31

Q&A. End.