diff --git a/enforcement-case-studies.tex b/enforcement-case-studies.tex index e17a7f3..c552c36 100644 --- a/enforcement-case-studies.tex +++ b/enforcement-case-studies.tex @@ -50,7 +50,7 @@ available at \verb=https://creativecommons.org/licenses/by-sa/4.0/legalcode=. This one-day course presents the details of five different GPL compliance cases handled by FSF's GPL Compliance Laboratory. Each case offers unique insights into problems that can arise when the terms of -GPL are not properly followed, and how diplomatic negotiation between +the GPL are not properly followed, and how diplomatic negotiation between the violator and the copyright holder can yield positive results for both parties. @@ -79,40 +79,40 @@ not equivalent to attending the course. \chapter{Overview of Community Enforcement} The GPL is a Free Software license with legal teeth. Unlike licenses like -the X11-style or various BSD licenses, GPL (and by extension, the LGPL) is +the X11-style or various BSD licenses, the GPL (and by extension, the LGPL) is designed to defend as well as grant freedom. We saw in the last course -that GPL uses copyright law as a mechanism to grant all the key freedoms +that the GPL uses copyright law as a mechanism to grant all the key freedoms essential in Free Software, but also to ensure that those freedoms propagate throughout the distribution chain of the software. \section{Termination Begins Enforcement} -As we have learned, the assurance that Free Software under GPL remains -Free Software is accomplished through various terms of GPL: \S 3 ensures +As we have learned, the assurance that Free Software under the GPL remains +Free Software is accomplished through various terms of the GPL: \S 3 ensures that binaries are always accompanied with source; \S 2 ensures that the sources are adequate, complete and usable; \S 6 and \S 7 ensure that the -license of the software is always GPL for everyone, and that no other -legal agreements or licenses trump GPL. It is \S 4, however, that ensures +license of the software is always the GPL for everyone, and that no other +legal agreements or licenses trump the GPL. It is \S 4, however, that ensures that the GPL can be enforced. Thus, \S 4 is where we begin our discussion of GPL enforcement. This clause is where the legal teeth of the license are rooted. As a copyright -license, GPL governs only the activities governed by copyright law --- +license, the GPL governs only the activities governed by copyright law --- copying, modifying and redistributing computer software. Unlike most -copyright licenses, GPL gives wide grants of permission for engaging with +copyright licenses, the GPL gives wide grants of permission for engaging with these activities. Such permissions continue, and all parties may exercise -them until such time as one party violates the terms of GPL\@. At the +them until such time as one party violates the terms of the GPL\@. At the moment of such a violation (i.e., the engaging of copying, modifying or -redistributing in ways not permitted by GPL) \S 4 is invoked. While other -parties may continue to operate under GPL, the violating party loses their +redistributing in ways not permitted by the GPL) \S 4 is invoked. While other +parties may continue to operate under the GPL, the violating party loses their rights. Specifically, \S 4 terminates the violators' rights to continue -engaging in the permissions that are otherwise granted by GPL\@. +engaging in the permissions that are otherwise granted by the GPL\@. Effectively, their rights revert to the copyright defaults --- no permission is granted to copy, modify, nor redistribute the work. Meanwhile, \S 5 points out that if the violator has no rights under -GPL, they are prohibited by copyright law from engaging in the +the GPL, they are prohibited by copyright law from engaging in the activities of copying, modifying and distributing. They have lost these rights because they have violated the GPL, and no other license gives them permission to engage in these activities governed by copyright law. @@ -128,7 +128,7 @@ distributing that work. For example, the violator may have put the software in boxes and sold them at stores. Or perhaps the software was put up for download on the Internet. Regardless of the delivery mechanism, violators almost always are engaged in {\em ongoing\/} -violation of GPL\@. +violation of the GPL\@. In fact, when we discover a GPL violation that occurred only once --- for example, a user group who distributed copies of a GNU/Linux system without @@ -136,7 +136,7 @@ source at one meeting --- we rarely pursue it with a high degree of tenacity. In our minds, such a violation is an educational problem, and unless the user group becomes a repeat offender (as it turns out, they never do), we simply forward along a FAQ entry that best explains how user -groups can most easily comply with GPL, and send them on their merry way. +groups can most easily comply with the GPL, and send them on their merry way. It is only the cases of {\em ongoing\/} GPL violation that warrant our active attention. We vehemently pursue those cases where dozens, hundreds @@ -162,12 +162,12 @@ related to GPL'd software to obey the rules of the road and allow them to operate freely under them. Just as a traffic officer would not revel in reminding people which side of the road to drive on, so we do not revel in violations. By contrast, we revel in the successes of educating an -ongoing violator about GPL so that GPL compliance becomes a second-nature +ongoing violator about the GPL so that GPL compliance becomes a second-nature matter, allowing that company to join the GPL ecosystem as a contributor. \section{How are Violations Discovered?} -Our enforcement of GPL is not a fund-raising effort; in fact, FSF's GPL +Our enforcement of the GPL is not a fund-raising effort; in fact, FSF's GPL Compliance Lab runs at a loss (in other words, it is subsided by our donors). Our violation reports come from volunteers, who have encountered, in their business or personal life, a device or software product that @@ -197,7 +197,7 @@ software is included. Once we have confirmed that a violation has indeed occurred, we must then determine whose copyright has been violated. Contrary to popular belief, -FSF does not have the power to enforce GPL in all cases. Since GPL +FSF does not have the power to enforce the GPL in all cases. Since the GPL operates under copyright law, the powers of enforcement --- to seek redress once \S 4 has been invoked --- lie with the copyright holder of the software. FSF is one of the largest copyright holders in the world of @@ -207,11 +207,11 @@ software copyrighted by FSF present. In cases where FSF does not hold copyright interest in the software, but we have confirmed a violation, we contact the copyright holders of the -software, and encourage them to enforce GPL\@. We offer our good offices +software, and encourage them to enforce the GPL\@. We offer our good offices to help negotiate compliance on their behalf, and many times, we help as a third party to settle such GPL violations. However, what we will describe primarily in this course is FSF's first-hand experience enforcing its own -copyrights and GPL\@. +copyrights and the GPL\@. \section{First Contact} @@ -292,9 +292,9 @@ the availability on its Web site and via a customer newsletter. Bortez did have some concerns regarding patents. They wished to include a statement with the software release that made sure they were not granting -any patent permission other than what was absolutely required by GPL\@. +any patent permission other than what was absolutely required by the GPL\@. They understood that their patent assertions could not trump any rights -granted by GPL\@. The following language was negotiated into the release: +granted by the GPL\@. The following language was negotiated into the release: \begin{quotation} Subject to the qualifications stated below, Bortez, on behalf of itself @@ -359,7 +359,7 @@ This case introduces a number of concepts regarding GPL enforcement. possible. \item {\bf Confirming compliance is a community effort.} The whole point - of making sure that software distributors respect the terms of GPL is to + of making sure that software distributors respect the terms of the GPL is to allow a thriving software sharing community to benefit and improve the work. FSF is not the expert on how a compiler for consumer electronic devices should work. We therefore inform the community who originally @@ -373,7 +373,7 @@ This case introduces a number of concepts regarding GPL enforcement. \item {\bf Informing the harmed community is part of compliance.} FSF asks violators to make some attempt --- such as via newsletters and the company's Web site --- to inform those who already have the products as - to their rights under GPL\@. One of the key thrusts of GPL's \S 1 and + to their rights under the GPL\@. One of the key thrusts of the GPL's \S 1 and \S 3 is to {\em make sure the user knows she has these rights\/}. If a product was received out of compliance by a customer, she may never actually discover that she has such rights. Informing customers, in a @@ -386,8 +386,8 @@ This case introduces a number of concepts regarding GPL enforcement. difficult negotiation point of the Bortez case was drafting language that simultaneously protected Bortez's patent rights outside of the GPL'd source, but was consistent with the implicit patent grant in - GPL\@. As we discussed in the first course of this series, there is - indeed an implicit patent grant with GPL, thanks to \S 6 and \S 7. + the GPL\@. As we discussed in the first course of this series, there is + indeed an implicit patent grant with the GPL, thanks to \S 6 and \S 7. However, many companies become nervous and wish to make the grant explicit to assure themselves that the grant is sufficiently narrow for their needs. We understand that there is no reasonable way to determine @@ -409,7 +409,7 @@ knowledge of the Free Software community and its functions is deep. Bracken produces a GNU/Linux operating system product that is sold primarily to OEM vendors to be placed in appliance devices used for a single purpose, such as an Internet-browsing-only device. The product -is almost 100\% Free Software, mostly licensed under GPL and related +is almost 100\% Free Software, mostly licensed under the GPL and related Free Software licenses. FSF found out about this violation through a report first posted on a @@ -430,7 +430,7 @@ online distribution: available \item An End User License Agreement (``EULA'') was included that - contradicted the permissions granted by GPL\@ + contradicted the permissions granted by the GPL\@ \end{itemize} @@ -441,7 +441,7 @@ following steps: \begin{itemize} -\item Bracken attorneys would rewrite the EULA to comply with GPL and +\item Bracken attorneys would rewrite the EULA to comply with the GPL and would vet the new EULA through FSF before use \item Bracken engineers would provide source side-by-side with the @@ -457,7 +457,7 @@ following steps: \end{itemize} This case was completed in about a month. FSF approved the new EULA -text. The key portion in the EULA relating to GPL read as follows: +text. The key portion in the EULA relating to the GPL read as follows: \begin{quotation} Many of the Software Programs included in Bracken Software are distributed @@ -497,7 +497,7 @@ role in GPL compliance. easier time with compliance.} Bracken's products were designed and built around the GNU/Linux system and Free Software components. Their engineers were deeply familiar with the Free Software ecosystem, and - their lawyers had seen and reviewed GPL before. The violation was + their lawyers had seen and reviewed the GPL before. The violation was completely an honest mistake. Since the culture inside the company had already adapted to the cooperative style of resolution in the Free Software world, there was very little work for either party to bring the @@ -533,12 +533,12 @@ role in GPL compliance. \item {\bf EULAs are a common area for GPL problems.} Often, EULAs are drafted from boilerplate text that a company uses for all its products. Even the most diligent attorneys forget or simply do not - know that a product contains software licensed under GPL and other + know that a product contains software licensed under the GPL and other Free Software licenses. Drafting a EULA that accounts for such licenses is straightforward; the text quoted above works just fine. The EULA must be designed so that it does not trump rights and - permissions already granted by GPL\@. The EULA must clearly state - that if there is a conflict between it and GPL, with regard to GPL'd + permissions already granted by the GPL\@. The EULA must clearly state + that if there is a conflict between it and the GPL, with regard to GPL'd code, the GPL is the overriding license. \item {\bf Compliance Officers are rarely necessary when companies are @@ -574,7 +574,7 @@ FSF discovered the violation from a user report, and determined that the cryptographic features were the only part of the product that constituted a derivative work of GNU tar; the extraneous utilities merely made shell calls out to GNU tar. FSF requested that Vigorien come into -compliance with GPL by releasing the source of GNU tar, with the +compliance with the GPL by releasing the source of GNU tar, with the cryptographic modifications, to its customers. Vigorien released the original GNU tar sources, but kept the cryptographic @@ -605,7 +605,7 @@ did so, and the violation was resolved. \item {\bf Removing the GPL'd portion of the product is always an option.} Many violators' first response is to simply refuse to - release the source code as GPL requires. FSF offers the option to + release the source code as the GPL requires. FSF offers the option to simply remove the GPL'd portions from the product and continue along without them. Every case where this has been suggested has led to the same conclusion. Like Vigorien, the violator argues that the @@ -620,7 +620,7 @@ did so, and the violation was resolved. \item {\bf The whole product is not always covered.} In this case, Vigorien had additional works aggregated. The backup system was a suite - of utilities, some of which were GPL and some of which were not. While + of utilities, some of which were the GPL and some of which were not. While the cryptographic routines were tightly coupled with GNU tar and clearly derivative works, the various GUI utilities were separate and independent works merely aggregated with the distribution of the @@ -647,11 +647,11 @@ did so, and the violation was resolved. by identifying them early. \item {\bf External regulatory problems can be difficult to resolve.} - GPL, though grounded in copyright law, does not have the power to trump + The GPL, though grounded in copyright law, does not have the power to trump regulations like export controls. While Vigorien's ``security concerns'' were specious, their export control concerns were not. It is indeed a difficult problem that FSF acknowledges. We want compliance - with GPL and respect for users' freedoms, but we certainly do not expect + with the GPL and respect for users' freedoms, but we certainly do not expect companies to commit criminal offenses for the sake of compliance. We will see more about this issue in our next case study. \end{enumerate} @@ -727,7 +727,7 @@ regarding the problem. GPL violators if they are negotiating in a friendly way and operating in good faith toward compliance. Most violations are honest mistakes, and FSF sees no reason to publicly admonish violators who genuinely want to - come into compliance with GPL and to work hard staying in compliance. + come into compliance with the GPL and to work hard staying in compliance. This case was so public in the Free Software community that both Haxil's and Polgara's representatives were nearly shell-shocked by the time FSF @@ -814,9 +814,9 @@ distribute products based on GPL'd software: Software component. \item Build a ``Free Software Licensing'' committee that handles requests - and questions about GPL and other Free Software licenses. + and questions about the GPL and other Free Software licenses. -\item Add ``What parts of your products are under GPL or other Free +\item Add ``What parts of your products are under the GPL or other Free Software licenses?'' to your checklist of questions to ask when you consider mergers, acquisitions, or joint ventures. @@ -826,13 +826,13 @@ distribute products based on GPL'd software: rapidly changing field. \item When someone points out a potential GPL violation in one of your - products, do not assume the product line is doomed. GPL is not a virus; + products, do not assume the product line is doomed. The GPL is not a virus; merely having GPL'd code in one part of a product does not necessarily mean that every related product must also be GPL'd. And, even if some software needs to be released that was not before, the product will surely survive. In FSF's enforcement efforts, we have not yet seen a product line die because source was released to customers in - compliance with GPL. + compliance with the GPL. \end{itemize}