The FOSS Way: An Introduction to GPL3

Application of GPL

Under the law of England and other common and civil law jurisdictions, for GPL to apply to the recipient of software that recipient must have its attention drawn to the licence before it uses the software.

A note accompanying GPL recommends that copyright holders insert a notice (for source code – at the start of each file, for object code – when the software launches)  including the following elements:

• copyright notice
  
• statement that distribution is subject to GPL
  
• statement that warranties are excluded
  
• link to GPL.

If software creators follow this recommendation, this writer sees no reason why GPL would not be held applicable under English law. FSF believes the GPL will be deemed to apply to the software in any jurisdiction. The German courts thought so in the D-Link case, and had just been reported to have thought so too in another case.

It is worth noting that, where no licence is in place, copyright law prevents anyone but the copyright holder from doing things such as copying a work. So, if someone ignorant of the fact that GPL applies to a particular work does something that would be a breach of the GPL, that ignorance will not be a defence to an action for copyright infringement. As with any copyright work, anyone other than the copyright holder who wants to use that work, especially for something commercial, is best advised to exercise some due diligence first.

Another point is that, even if a court were to hold that the GPL did not apply, the result would probably be that the defendant (the would-be licensee) had no licence at all to the software, and therefore that any use of the software by the defendant would be an infringement of copyright. Therefore, you cannot assume that, where the GPL is found not to apply or be enforceable for a piece of software, that software will somehow be free of the restrictions imposed by copyright.

Bare Licence or Contract?

If GPL is determined to apply to a software product, is GPL a bare licence or a contract? FSF intends GPL to be a bare licence.  GPL meets the very limited criteria required of a bare licence. Whether or not GPL is held to be a contract rather than a bare licence will vary from jurisdiction to jurisdiction.

This is not something that has caused sleepless nights at FSF; the FSF view seems to be that, because GPL is a bare licence, misuse of GPL software can be tackled. This is largely true, but there are some provisions (discussed later) in GPL that go far beyond the scope of copyright licence and therefore can only be enforced if the GPL regime creates contracts.

Governing Law and Jurisdiction

GPL is designed for use across the world and deliberately stipulates no governing law or jurisdiction. This means that these issues must be assessed on a case-by-case basis. The D-Link case was about breaches of GPL2 by a German company. GPL3 is equally silent on law and jurisdiction. In assessing whether there had been a breach, the German Court accepted jurisdiction and applied German copyright law.

Enforcing the Licence

Distributors of GPL software are not responsible for enforcing the licence terms; this falls to the copyright holder. The FSF takes the view that the mere act of distribution should not mean a distributor has to monitor or deal with GPL breaches.

There may however be many people involved in the creation of GPL software; thousands have contributed to the Linux kernel. It would be a massive and probably unfeasible undertaking for a single contributor to tackle the infringement of copyright in a piece of GPL software. The collaborative community spirit of FOSS has sought to overcome this practical problem by setting up the Gplviolations.org project to monitor and deal with GPL breaches. It was Gpl-violations.org that represented the two Linux coders whose copyright had been breached in the D-Link case.

Reinstatement and Notices of Breach

If someone stops breaching the GPL, their licence is automatically reinstated. However, the copyright holder can again terminate the licence by giving notice of termination within 60 days starting on the date on which the breach ceased.

There is a separate right for a copyright holder to give the user notice of breach. If the user rectifies the breach within 30 days of receipt of notice, the licence is permanently reinstated. This right to reinstate only applies to first-time offenders –  those who have not previously breached GPL for the software in question or any other GPL software.

Additional Permissions

GPL gives copyright holders the ability to make exceptions to the conditions of GPL. It defines these provisions as ‘Additional Permissions’. To add an Additional Permission, the copyright holder must include in the source file a notice either setting out the additional terms or stating where they can be found.

The licence allows those distributing GPL software created by third parties to remove any such Additional Permissions before distribution.

Permitted Non-standard Terms

GPL allows copyright holders, or those authorised by copyright holders, to add the following types of terms:

• liability limits or disclaimers different to those contained in GPL – given the very limited liability that the licensor is subject to under GPL, this could only mean increasing the licensor’s level of liability, perhaps to justify the distribution fees charged by the licensor
  
• obligations to preserve specified (reasonable) legal notices or author attributions
  
• prohibitions of misrepresentation of the origin of the software
  
• obligations to mark modified software versions to differentiate them from originals
  
• limits to the use of licensor or author names for publicity purposes
  
• withholding the right to use a trade mark or brand
  
• an indemnity from distributors of the software to the licensor or author covering any ‘contractual assumptions of liability’ imposed on the licensor/author.

Taking the final provision described above, where English law applies my view is that copyright holders will struggle to enforce such a provision. This is almost certainly so in the usual FOSS scenario, where copyright holder and end-user are many steps removed. In that scenario, the copyright holder would have to rely on the Contracts (Rights of Third Parties) Act 1999, meaning it would have to establish that GPL created a contract. This could prove to be quite a struggle. Copyright holders should not place too much reliance on this type of provision.

Implications of Including Other Non-standard Provisions

What if the software is accompanied by non-standard provisions that do not fall within the definition of ‘Additional Permissions’ or the permitted types of non-standard terms described above? These are called ‘further restrictions’; they may not be imposed, and have no effect.

The GPL also deals with the situation where conditions additional to GPL are applied to software.  The licence prohibits the distribution of software that has incompatible additions attached. The GPL cites by way of example a distributor requiring a royalty from customers.

Upgrading

Most GPL software available today was issued when v2 was the current version. If you are a distributor of GPL v2 software, can you apply GPL v3 when you next distribute it or does v2 software stay v2 forever?

Eben Moglen summarised FSF’s position on this subject when taking questions after his SSCL speech:

‘When a program is labelled “GPLv2 or any later version”… the author is delegating to the users a part of the authority to relicense.’

Most GPL software issued today states ‘v2 or later version’, meaning that for such software users can choose to follow v2 or v3.

Packaging GPL v3 Software with Other Software

There are scenarios where GPL3 software might be distributed with software issued under totally different licences, or an earlier version of GPL. One example might be the sale of a computer carrying a variant of the Linux operating system. Each Linux distribution comprises a raft of different software, each of which could have been issued under different FOSS licences.

In this situation GPL states that other software products do not become subject to GPL unless they are ‘by their nature extensions’ of the GPL-licensed software. This applies whether the other software is in source code or object code form. So, to take the example above, the v3 parts of the Linux system would stay v3, and GPL would not apply to any software issued under other licences.

Mixing Code Issued under Different GPL Versions

Mixing v2 code with v3 code, by linking, combining or merging, can give rise to messy legal issues. As Richard Stallman himself has said, the two licences are ‘incompatible’ because both state that if code is combined with software issued under that licence, it will become subject to that licence.

Luckily, most GPL software out there is ‘v2 or later’, and if you combine it with v3 software, v3 will apply.

Should your client wish to mix ‘v2 only’ software with v3 software, this may result in your client having to work a few nights in the office to resolve or eliminate the resulting legal issues. Possible solutions could be to avoid copyright infringement by performing a clean-room rewrite of the ‘v2 only’ code, or to get the copyright holder to reissue that code under ‘v2 or later’ or v3.

Patents

Under GPL, the copyright holders license the use of any patents they own that fall within the scope of the software. GPL contains provisions covering three scenarios where patents apply. Scenario 1 envisages a one-off transaction of GPL software where recipients are authorised to use a specific copy of the software. Here, GPL automatically extends the patent licence to all recipients of that software. FSF’s intention was that patents should not prevent GPL software from being used as freely as the GPL allows.

The other two scenarios are simply a reaction to the 2006 agreement between Microsoft and Novell. Amongst other things, Novell is a major distributor of the SuSE variety of Linux. Microsoft needs no introduction. In announcing the deal, the two said that the aim was to make Windows and Linux work better together. Engineers from the companies would jointly develop technologies to improve interoperability, including virtualisation – allowing Windows to run in a virtual machine on Linux and vica versa – and improve compatibility between documents created in Microsoft Office and OpenOffice. All pretty harmless stuff, right?

What FSF really objected to was the patent infringement part of the deal. The two companies promised to each other’s customers that they would not sue them for any patent infringement that using the other’s operating system might entail. Microsoft has quite a history of making allegations about Linux, including claims that Linux infringes its patents. The most recent example was the claim in May 2007 (after the Microsoft/Novell deal) that Linux infringed a staggering 228 of its patents, a number which it then increased to 235. Microsoft has yet to substantiate the allegations, or even to identify the relevant patents, and the bigwigs of the free software world (including, it should be said, Novell) have dismissed Microsoft’s claims out of hand.

The controversial world of software patents is outside this article’s remit. However, whether or not Microsoft’s claims have any substance, they have damaged the perceived legitimacy of FOSS and have done nothing to persuade corporations and the public sector to use FOSS software.

To deal with the Microsoft/Novell deal, GPL firstly addresses the distribution of GPL software ‘knowingly reliant’ upon a patent licence. In this scenario, if the source code for the software is not publicly available free-of-charge and on GPL terms, the distributor has three choices:

• make the source code publicly available; or
  
• deprive itself of the benefit of the patent licence – a ‘Final Rationale’ document published by FSF in the run-up to the release of GPL v3 explains that ‘repudiation by ceasing royalty payments could be one way’ of doing this; or
  
• arrange to extend the benefit of the patent licence to users of the software downstream (such an arrangement must be compatible with GPL).

In other words, remove the benefits of the patent deal or you cannot distribute the software under GPL3. This provision raises many questions. How exactly does it protect end-users from patent infringement claims by Microsoft?

Applying the first bullet point, perhaps the point here is that, with the source code, those end-users with patent attorneys at their disposal can assess whether the source code does infringe a patent. Taking the second bullet point, a distributor depriving itself of the benefit would not aid an end-user; the end user would still be in breach of the patent, but now it would be joined by the distributor. Coming to the final bullet, GPL does not create a licence or contract between Microsoft and the end-user. Perhaps end-users could rely on some form of estoppel, although this would need researching in each of the world’s jurisdictions, or at least those containing the large corporate and public sector FOSS users that Microsoft would presumably target.

Of course, by suing end-users Microsoft might itself be in breach of the GPL. Even if FSF or the end-user could establish this, you are still left with unfortunate end-users facing expensive patent infringement claims. The above provision is therefore of less comfort to GPL3 software users than the (apparent) lack of substance to Microsoft’s claims about Linux infringing its patents.

Secondly, GPL provides that, if (after 28 March 2007) the distributor enters into a patent licence that is incompatible with GPL, it cannot distribute GPL software to which that patent licence applies where:

• it must pay the patent licensee fees based on the act of distribution; and
  
• its customers receive an equivalent licence from the licensee.

It’s pretty difficult to make sense of this provision without the knowledge that it is designed to prevent distribution by Novell of software that falls within the scope of the patent licence that it received from Microsoft. Even then, and having read it many times, this writer is still struggling.

Novell has not specifically commented on these provisions, although Linux.com quoted Novell’s head of PR stating that it was able to distribute GPL software, adding that ‘if… GPLv3 does potentially impact the agreement we have with Microsoft, we’ll address that with Microsoft.’  

‘Tivoization’

GPL seeks to prevent what its authors like to call ‘tivoization’. This is a reference to TiVo, a digital video recorder sold in the USA.

Recent versions of the TiVo firmware include modified versions of GPL2 software. TiVo Inc. publicly releases the source code to the modified software. However, if someone were to customise the source code and then upload it to a TiVo, their efforts would be wasted because TiVo contains measures that prevent users from running customised software.

Whilst TiVo’s actions are within the letter of GPL2, FSF took issue with this, and similar measures implemented by other manufacturers, and sought to prevent such actions from occurring with GPL3 software. Upon the launch of GPL3, Richard Stallman published an article called ‘Why Upgrade to GPL Version 3’. On the tivoisation point, Stallman’s main objection to anti-modification measures is that ‘the manufacturers… take advantage of the freedom that free software provides, but they don’t let you do likewise’. He insists that the user of free software must retain control over what the software does.

To combat ‘tivoization’, GPL stipulates that, if you include GPL software in a ‘user product’ that is sold on and users are able to install modified object code on the product, the requirement to either provide, offer to provide, or direct users to the source code applies. In addition, you must provide users with any information (such as authorisation keys) needed to install and execute modified versions of the software in that product. Here, ‘user products’ means ‘tangible personal property used for personal, family or household purposes’ (such as music players, and possibly computers sold with GPL software installed) and products built into homes (eg an alarm system).

Tackling DRM

GPL states that those distributing or copying works covered by the licence must ‘waive any right to forbid the circumvention of technological measures’.

Digital rights management (‘DRM’) is a much-discussed and controversial technology.  Its critics are many, and it will come as no surprise that the authors of GPL3 are among them.

In his ‘Why upgrade to GPL version 3’ article, Stallman describes DRM as ‘nasty features designed to restrict your use of the data on your computer’. GPL3 does not seek to somehow ban DRM, instead (to quote Stallman again) it ‘makes sure you are just as free to remove nasty features as the distributor… was to add them.’

Eben Moglen gave a persuasive justification for this stance in his SSCL speech:

‘If you want to experiment with locking down layer below 7… we have no objection – not only do we have no objection to you doing it, we’ve no objection to your using our parts to do it with. But when you use our parts to build machines which control peoples’ daily lives… build devices which are modifiable by them to the same extent that they’re modifiable by you… If you can modify the device after you give it to them, then they must be able to modify the device after you give it to them – that’s a price for using our parts.’

Online Services?

Previous versions of GPL have not dealt with online services, perhaps unsurprising since GPL2 was released in 1991. In recent years, such services have been increasingly common and popular, and many (such as Google) use FOSS code behind the scenes. Despite FSF zeal in areas such as patents and DRM, FSF has made no attempt to bring online services within GPL3, which remains focussed on the distribution of copyright works.

Whilst GPL3 is not itself relevant to online services, a modified version of GPL3 called Affero General Public Licence version 3 (AGPL3) is designed to cover these. . AGPL3 is currently in draft form. AGPL3 effectively states that:

• if a service provider uses AGPL3 software to run an online service; and
  
• it has modified that software; then
  
• that service provider must give users access to the modified source code.

If an online service wants to differentiate itself from the competition through its operating software, it is best advised to not modify AGPL3 software to achieve that differentiation. Otherwise, it could find itself forced to release its prized code to the world. Of course, this is exactly what the AGPL3 authors intend; if you are going to take advantage of AGPL3 software, you cannot deprive others of the same advantages.

GPL3 is compatible with AGPL3; if software issued under the two licences is combined/linked, GPL3 applies to the GPL3 part, AGPL3 applies to the AGPL3 part, and the above provision applies to the combined/linked part.

Conclusions

For an overall impression of GPL3, one cannot do better than to quote again from Eben Moglen’s SSCL speech:

‘In the end, the license bears in my judgement many of the marks of legislation. It is a little too long, it is a little too complex. It divides cases where they might with some analytical clarity have been merged, and it merges cases that might with some analytical clarity have been divided. It isn’t one man’s work of art, it’s a community’s work of self-definition.’

GPL3 is an impressive piece of work. As something intended to apply across the globe, its drafting isn’t going to impress everyone but, to be fair, this writer cannot recall enjoying the drafting in any contract designed to operate across multiple jurisdictions.

The comparison of GPL3 to legislation is quite apt; some of the provisions I’ve noted are framed in a language more akin to legislation than to a licence or contract, and are of a scope that raises serious questions about their enforceability. Saying that, these wanna-be-legislative provisions are in the minority; most of GPL3 is confined to the humble and enforceable world of copyright licensing.

Overall, whilst there are some provisions of GPL3 that raise objections, the simple fact is that if you want to commercially exploit GPL3 software, you must accept its terms. If not, the alternatives are to:

• write your own software from scratch; or
  
• persuade the copyright holder to issue the software to you under a more favourable licence; or
  
• use equivalent software issued under a more favourable licence (such as MIT).

Alex Newson is a Solicitor in the Intellectual Property & Technology team at Freeth Cartwright LLP: alex.newson@freethcartwright.co.uk. See their blog at http://impact.freethcartwright.com.

Acknowledgements

Collaboration, one of the key features of the FOSS world, has filtered down to the writing this article. Thanks to Ciarán O’Riordan  of the Free Software Foundation Europe, Andrew Katz of Moorcrofts, and Deryck Houghton of Freeth Cartwright LLP for their comments on the drafts of this article.