GPL License: What is a "Distribution"
What is a "distribution" under the GPL? This is a particularly important issue under the GPL, because the act of distribution of modified code is what obligates the distributor to distribute source without charge.For example, it's been pretty clear for over a decade that an independent contractor is not treated the same as an employee for software licensing purposes. So, if you hire a software developer, as a contractor, to create code for your company, and the software developer uses open source software subject to the GPL or the LGPL, does that create source code distribution obligations on the part of your company or the software developer? I'm interested in your thoughts.
7 Comments:
The purpose of this string is to address potential unintended "distributions" of software that may be subject to the GPL and its consequences.
I can see at least 3 different scenarios where the potential for a "distribution" may occur: (1) creating an application that is used between a company and its suppliers or customers, (2) hiring a development shop to create software for a company, and (3) engaging IT personnel from an employment agency (body shop) where the personnel is working cubicle-to-cubicle with other (true) employees of a company.
Note that Section 2(b) of the GPL provides as follows:
"You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License."
Also note that the FAQ to the GPL, which may provide some guidance to its interpretation, states the following:
"Does the GPL allow me to distribute a modified or beta
version under a nondisclosure agreement?
No. The GPL says that anyone who receives a copy of your version from you has the right to redistribute copies (modified or not) of that version. It does not give you permission to distribute the work on any more restrictive basis."
Therefore, it would seem that a "distribution" from a company to a 1099 contractor might be a "distribution" under the GPL, thereby preventing the distributing party from restricting it by using a nondisclosure covenant.
However, the FAQ goes on:
"Does the GPL allow me to develop a modified version under a nondisclosure agreement?
Yes. For instance, you can accept a contract to develop changes and agree not to release your changes until the client says ok. This is permitted because in this case no GPL-covered code is being distributed under an NDA.
You can also release your changes to the client under the GPL, but agree not to release them to anyone else unless the client says ok. In this case, too, no GPL-covered code is being distributed under an NDA, or under any additional restrictions."
"The GPL would give the client the right to redistribute your version. In this scenario, the client will probably choose not to exercise that right, but does have the right."
This is confusing to me, in a number of ways. This confusion will be explored in an number of comments.
First, when it states that "no covered code is being distributed under an NDA" does that mean that a distribution has not occurred or that because the nondisclosure obligations run one-way from the company to the contractor that, while there has been a distribution, there has been no distribution under an NDA?
This example shows the potential differences in result, depending on what was meant. Suppose a third party asks the contractor for the code that was developed and provided to the Company. If it was "distributed" to the Company by the contractor, wouldn't the contractor be obligated to provide it to a third party under Section 2(b) of the GPL? On the other hand, if there is no "distribution," no such obligation would exist under the GPL.
If the interpretation is that no "distribution" has occurred, it would seem that "distribute" under the GPL and "distribute" under the Copyright Act must have different meanings, per MAI v. Peak.
Now suppose that the GPL would require a company to provide the code to any third party, because a "distribution" has occurred. Then a third party, such as a competitor, requests the source code. The company refuses. What result?
Since the Free Software Foundation indicates that the GPL is only a "license" and not a contract, then it is hard to argue that a third party is a "third party beneficiary" to a contract that doesn't exist. Therefore the third party competitor probably doesn't have standing to sue to force the disclosure of the code.
At most, then, there seems to be a claim available by the holder of the copyright to the unmodified code subject to the GPL for a copyright infringement. This means that the competitor would not seem to be able to force the company to give up the souce code.
I see further complexity.
Take the following example:
If X was to modify proprietary software owned by a third party company (i.e. X is not an employee of that company - so X is an independent contractor) by adding new functionality and X wanted to use GPL'd source code for that purpose, X will have created a derivative work of the GPL'd open source software.
Q1: Does delivery of X's solution to the company constitute a 'distribution'?
Q2: Assuming yes, as X would have modified GPL'd code and distributed it, does that mean that X/the company is obliged to make the derivative work (i.e the modified GPL'd code and X's customer's proprietary code) available to all and under the terms of the GPL ?
Q3: Does the answer change if the company didn't know that X used GPL'd code in the solution X provided to it?
Q4: What if the company's proprietary code was a security sensitive system and it would not be appropriate for its source code to be disclosed to the world at large?
It seems to me that if X does this work as the 'agent' of the customer, or, if the output of the work (i.e. the copyright) will be owned by the customer, then that should not be a 'distribution'.
However,if you read the GNU GPL FAQ entitled 'Is making and using multiple copies within one organization or company 'distribution'?, the answer given, in part, is "..when the organization transfers copies to other organizations or individuals, that is distribution. In particular, porviding copies to contractors for use off-site is distrbution". That seems to be a non-legal interpretation of 'distribution'. Why should a physical location matter?
Any comments?
tk,
Congratulations! You're the first person to comment on this blog!
Good questions, too. Let me see if I can work through my own thoughts about your questions and see if they shed any light.
First of all, I'm still working through the concepts of free (gratis) and free (libre) in the context of the GPL, or in more common vernacular, GPL'd software being free as in free speech, not as in free beer. This is manifest in the GPL when it talks about being able to charge for software that one creates but the licensee must be able to get source for free and distribute source and binary for free. (See the FAQ, "Does the GPL allow me to sell copies of the program for money?")
In addition, I'm still considering what "any third party" means in Section 2(b) of the GPL. My working hypothesis here is that "any third party" actually means any third party that is an actual direct or indirect licensee, not any old person off the street who has no license to the code.
With that in mind, let's turn to your questions, using your example (company contracts with X, a contractor, to create code).
Q1: Does delivery of X's solution to the company constitute a "distribution"? My answer would be probably yes (at least from a legal interpretation), but it also doesn't really matter. Because the distribution is from developer to user, and there are no requirements in the GPL related to limiting the rights of the developer (only the recipient or licensee), the user could put the developer under nondisclosure, preventing the additional distribution of the code. The user could, but normally wouldn't want to, distribute the code further.
Note that this is an easier question than the one that involves joint development between a company's employees and contractors.
Q2 (paraphrasing): Does a distribution from developer to company mean that developer/company is obliged to make the derivative work available to all and under the terms of the GPL? My answer would be no. The GPL doesn't place any restrictions on the developer's right to limit distribution, except for the obligation to provide source to "all third parties" (which I think, as I explained above, means all licensees of the modified software, not all unrelated third parties). The company would be obliged to distribute to other licensees only if the company chose to license to third parties in the first place.
Q3(paraphrasing again): Does the answer change if the company didn't know? If my interpretation is correct, then the answer doesn't matter, because there isn't an obligation to distribute. However, note that lack of knowledge is likely not a defense in this context. People can unknowingly misappropriate copyrights; they do it all the time. While the amount of damages in a copyright infringement action may be reduced for an unwitting infringement, lack of knowledge isn't a defense to the infringement itself.
Q4: What if the company's proprietary code was a security sensitive system and it would not be appropriate for its source code to be disclosed to the world at large? I believe that this conflict has already occurred in real life, in connection with Cisco's purchase of Linksys. More info on this is at www.linuxdevices.com/news/NS7719522768.html. I have heard that some of the open source that should have been disclosed by Cisco according to the GPL also had issues with U.S. export regulations that prohibited disclosure.
There are two simple here. First, it is clearly possible to contract yourself into a situation that prevents you from complying with laws or another contract. The Scylla and Charybdis could be either to violate U.S. export laws or be a copyright infringer by violating the GPL.
Second, the answer is to disgorge yourself of the software that is subject to the GPL. No one is making you use software subject to the GPL.
Thanks again for your comment.
'The GPL doesn't place any restrictions on the developer's right to limit distribution, except for the obligation to provide source to "all third parties" (which I think, as I explained above, means all licensees of the modified software, not all unrelated third parties).'
I happen to think all third parties means the rest of the world. I don't think this meaning causes the practical problems which you mention however.
3b only kicks in where you distribute binaries with no source. If you don't want to give to any and everyone, give the binary and source together (3a) and you are golden. You have no obligations to any third parties.
This would not be a problem in practice if you take a bit of care.
It is late and I am a bit confused. I have been mixing up 2 and 3.
That being the case, note the differences between 2b and 3b.
In 2b, I may license the work to the world, but they still have the problem of getting a copy. In 3b, I am under obligation to actually supply the copy.
I have always taken 2b to mean that anyone I give it to can pass it on to all third parties without incurring any furhter obligations to me. It is licensed to all third parties. I don't have to give anything to said third parties however.
This is where 3 becomes important. Choose 3a and you still don't have to give anything to third parties. Choose 3b and you do.
Does this make sense to anyone?
A Nony Mouse
Post a Comment
<< Home