Open Source Software - Avoiding Common Pitfalls

More than ever, open source software is at the heart of modern online businesses and technology companies. Open source is nearly everywhere: web browsers, smartphones, home wireless routers, databases, web servers, and countless components of free, commercial, and large enterprise software. But most open source software comes with strings attached, and if misunderstood, they can trip up the unwary.

Topics:
• The most common sources of non-compliance with open source licenses
• The key differences between the most popular licenses
• The basis in intellectual property law for open source licensing
• How courts in the US and abroad have enforced open source licenses

These slides are from a webinar by attorney Ansel Halliburton on September 22, 2015.

Transcript

1. Open Source Software: Avoiding Common Pitfalls September 22, 2015 © 2015 Kronenberger Rosenfeld, LLP
2. Agenda What is Open Source? Quick Overview of Intellectual Property Dimensions of Open Source Licenses Common Open Source Licenses Open Source in Court Pitfalls Proactive Compliance Conclusion Q&A
3. What is Open Source? The Open Source Definition by the Open Source Initiative: 10 paragraphs The Free Software Definition by the Free Software Foundation: 4 pages
4. What is Open Source? • Open source • Public domain • Free software • FOSS • FLOSS • GPL • BSD ??? • Copyright • Copyleft • Software freedom
5. What is Open Source? “Open source software is software that can be freely used, changed, and shared (in modified or unmodified form) by anyone.” Free of charge Published source code Varying restrictions on commercial use
6. Where is Open Source?
7. Agenda What is Open Source? Quick Overview of Intellectual Property Dimensions of Open Source Licenses Common Open Source Licenses Open Source in Court Pitfalls Proactive Compliance Conclusion Q&A
8. Quick Overview of Intellectual Property (IP) Kind Protects Laws Patent Technological inventions Federal Copyright Expression Federal Trademark Signals of source Federal and State Trade Secrets Information that is valuable because it is secret Mostly State
9. How IP Protects Software Kind Protects Laws Patent Technological inventions Federal Copyright Expression Federal Trademark Signals of source Federal and State Trade Secrets Information that is valuable because it is secret Mostly State
10. How IP Protects Open Source Software Kind Protects Laws Patent Technological inventions Federal Copyright Expression Federal Trademark Signals of source Federal and State Trade Secrets Information that is valuable because it is secret Mostly State
11. How Copyright Protects Software • By default, copyright law excludes others from using creative works. • An author must expressly allow you to use a work. • In software, permission is granted with a license.
12. What is a License? • Contract • Allows use of IP (copyrighted source code) • Imposes conditions
13. Agenda What is Open Source? Quick Overview of Intellectual Property Dimensions of Open Source Licenses Common Open Source Licenses Open Source in Court Pitfalls Proactive Compliance Conclusion Q&A
14. Proprietary Software vs. Open Source Proprietary Software Open Source High price tag Free Strong warranties No warranties Support provided No support Black box – no source code Source code provided No modifications or reverse engineering Modifications encouraged No sublicensing Sublicensing with conditions Express patent license Patent treatment varies by license
15. Dimensions of Open Source Licenses • Copyleft Your code must be under the same license • Notice Must include notice and a copy of the license • Source code disclosure Must include a copy of your source code • Sublicensing Can you grant downstream licenses? • Patent license Some give express patent license (GPLv2 is silent!)
16. Copyleft Requires that you MUST share modifications. “You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.” —GPL v2 § 2
17. Copyleft Requires that you MUST share modifications. “You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License.” —GPL v2 § 2
18. Notice
19. Agenda What is Open Source? Quick Overview of Intellectual Property Dimensions of Open Source Licenses Common Open Source Licenses Open Source in Court Pitfalls Proactive Compliance Conclusion Q&A
20. Spectrum of Open Source Licenses Copyleft Permissive Public domain GPL, Affero GPL, LGPL Mozilla Public License BSD MIT Apache CC0
21. Common Open Source Licenses GPL BSD MIT Apache v2 v3 Notice Y Y Y Y Y Source Code Y Y N N N Sublicense Y Y Y Y Y Copyleft Y Y N N N Patent License ? Y ? ? Y
22. The GPL • 1989 – Berlin Wall falls – GPL 1.0 • 1991 – Gulf War – Soviet Union Dissolves – GPL 2.0 • 1993 – Mosaic graphical web browser released • 2007 – GPL 3.0
23. GPL v3 12 pages long!
24. GPL v3 § 5
25. GPL v3 § 8
26. BSD (3-clause) Copyright (c) <YEAR>, <OWNER> All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Notice No endorsement Disclaimers
27. BSD (2-clause) Copyright (c) <YEAR>, <OWNER> All rights reserved. Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: 1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. 2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. 3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission. THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. Notice No endorsement Disclaimers
28. The MIT License
29. More Obscure Licenses DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE Version 2, December 2004 Copyright (C) 2004 Sam Hocevar <sam@hocevar.net> Everyone is permitted to copy and distribute verbatim or modified copies of this license document, and changing it is allowed as long as the name is changed. DO WHAT THE FUCK YOU WANT TO PUBLIC LICENSE TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION 0. You just DO WHAT THE FUCK YOU WANT TO. /* * ---------------------------------------------------------------------------- * "THE BEER-WARE LICENSE" (Revision 42): * <phk@FreeBSD.ORG> wrote this file. As long as you retain this notice you * can do whatever you want with this stuff. If we meet some day, and you think * this stuff is worth it, you can buy me a beer in return. Poul-Henning Kamp * ---------------------------------------------------------------------------- */ 1,089 items in Wikipedia 305 items in Wikipedia
30. Agenda What is Open Source? Quick Overview of Intellectual Property Dimensions of Open Source Licenses Common Open Source Licenses Open Source in Court Pitfalls Proactive Compliance Conclusion Q&A
31. Notable Open Source Cases • Jacobsen v. Katzer Open source licenses are enforceable • BusyBox cases GPL violations by embedded developers • Linksys: Free Software Foundation, Inc. v. Cisco Systems, Inc. GPL violation in routers Settlement: $ donations to FSF + open source compliance director • XimpleWare Corp. v. Versata Software, Inc. GPL violation in enterprise software • VMWare case (Germany) Mixed proprietary/GPL Linux kernel
32. Jacobsen v. Katzer 535 F.3d 1373 (Fed. Cir. 2008) • Software: Jacobsen’s Java Model Railroad Interface • License: Artistic License • Violations: – No attribution – Copyright notices removed • Lower court: Breach of contract, but no copyright infringement, so no injunction • Court of Appeals: – Violation of open source license is copyright infringement. – Upheld validity of public licenses – “Copyright holders who engage in open source licensing have the right to control the modification and distribution of copyrighted material.”
33. BusyBox cases • 7 cases filed in 2007–09 • Software: BusyBox utilities for embedded systems • License: GPL v2 • Plaintiffs: Two developers • Defendants: Device makers • Outcomes: – Several settlements, including payments to developers – Default judgment, injunction, and treble statutory damages against Westinghouse
34. Linksys Case Free Software Foundation, Inc. v. Cisco Systems, Inc. • Plaintiff: Free Software Foundation • Software: GNU C Library, GCC compiler, etc. • Licenses: GPL v2, LGPL • Alleged infringement: – Modified code in router firmware binaries – Failure to provide source code • Filed December 2008 • Settled May 2009 – “Free Software Director” position created – Source code published – Payment to Free Software Foundation
35. XimpleWare v. Versata • Plaintiff: Small California software company • Defendant: Versata Software • License: GPL v2 • Alleged Infringement: – Removal of copyright notices – Non-copyleft sublicensing • Other issues: Three patents (asserted in companion patent case) • Preliminary injunction barely denied in copyright case • Settled in early 2015
36. XimpleWare v. Versata
37. VMWare Case • Plaintiff: Christoph Hellwig, Linux kernel contributor • Defendant: VMWare • Currently pending in Germany • Alleged infringement: – Mixing GPL v2 and proprietary code – Failing to release source code
38. Agenda What is Open Source? Quick Overview of Intellectual Property Dimensions of Open Source Licenses Common Open Source Licenses Open Source in Court Pitfalls Proactive Compliance Conclusion Q&A
39. Common Pitfalls • “I found this code on the web. I can use it, right?” • “This code is open source, that means I can do whatever I want with it, right?” • “I’ll be okay under the fair use doctrine, right?” • “No open source” clauses
40. “I found this code on the web. I can use it, right?” Source: Open source license usage on GitHub.com (March 9, 2015) https://github.com/blog/1964-open-source-license-usage-on-github-com
41. “I found this code on the web. I can use it, right?” • Not all “code on the web” is open source. • All open source is not the same. • Look for explicit licensing information—do not assume anything. • When in doubt, ask the author. • Without a license, you do not have permission to copy a copyrighted work!
42. “This code is open source, that means I can do whatever I want with it, right?” • Open source licenses have strings attached. (Lawyers call them terms and conditions.) • Notice requirements are easy to mess up.
43. “This code is open source, that means I can do whatever I want with it, right?” http://www.law360.com/articles/486925/ximpleware-says-versata-sold-300m-in-stolen-software
44. “I’ll be okay under the fair use doctrine, right?” • Probably not. • The fair use doctrine is probably not what you think it is. • The scope of protection is narrow. • It exists only in the US. • How it is applied is unpredictable and very fact-specific. • Recent case law says fair use is a right, not an affirmative defense. (Lenz)
45. “I’ll be okay under the fair use doctrine, right?” § 107. Limitations on exclusive rights: Fair use Notwithstanding the provisions of sections 106 and 106A, the fair use of a copyrighted work, including such use by reproduction in copies or phonorecords or by any other means specified by that section, for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright. In determining whether the use made of a work in any particular case is a fair use the factors to be considered shall include— (1) the purpose and character of the use, including whether such use is of a commercial nature or is for nonprofit educational purposes; (2) the nature of the copyrighted work; (3) the amount and substantiality of the portion used in relation to the copyrighted work as a whole; and (4) the effect of the use upon the potential market for or value of the copyrighted work. The fact that a work is unpublished shall not itself bar a finding of fair use if such finding is made upon consideration of all the above factors. 17 U.S.C. § 107: https://www.law.cornell.edu/uscode/text/17/107
46. Enterprise Deals: “No Open Source” Clauses • Context: Big companies buying software from vendors • Concern: Unknown obligations, i.e., copyleft
47. “[VendorCo] hereby warrants that the Software contains no open source code and that it will not provide any open source software as part of its Services or Software.” Enterprise Deals: “No Open Source” Clauses
48. “No open source. No software, code and/or firmware delivered by [VendorCo] to [BigCo] will contain any Works licensed under a license agreement that requires that derivative works of such Works be provided to the licensor or recipient of such derivative works with a right of use, redistribution or modification.” Enterprise Deals: “No Open Source” Clauses
49. Agenda What is Open Source? Quick Overview of Intellectual Property Dimensions of Open Source Licenses Common Open Source Licenses Open Source in Court Pitfalls Proactive Compliance Conclusion Q&A
50. Open Source Audits • Identify components in a code base • Deep dependency tracing • License identification • Identify known security vulnerabilities in packages When • Due diligence (financing, acquisition) • Enterprise software sales (e.g., warranting no copyleft)
51. Scanning Tools • Black Duck (proprietary) • FOSSology (open source: GPL v2) • Palamida
52. Bigtime Compliance https://www.blackducksoftware.com/audits/open-source-audits https://www.blackducksoftware.com/products/black-duck-suite/protex/black-duck-code-label
53. Standardization of License Information • Software Package Data Exchange • Working group under the Linux Foundation • “a standard format for communicating the components, licenses and copyrights associated with a software package” – Toward a “bill of materials” for software • Maintains a large license list http://spdx.org/licenses/ ®
54. Agenda What is Open Source? Quick Overview of Intellectual Property Dimensions of Open Source Licenses Common Open Source Licenses Open Source in Court Pitfalls Proactive Compliance Conclusion Q&A
55. Conclusions • Open source software is everywhere… And that’s great! • Open source licenses are enforceable. • There are important differences between the major licenses. • There is a lot of dangerous unlicensed code on the web. • Fair use is probably not what you think it is (and doesn’t exist outside the US). • Proactive compliance efforts can pay off.
56. Agenda What is Open Source? Quick Overview of Intellectual Property Dimensions of Open Source Licenses Common Open Source Licenses Open Source in Court Pitfalls Proactive Compliance Conclusion Q&A
57. Thank you! https://github.com/anseljh @krinternetlaw @anseljh Ansel Halliburton KRONENBERGER ROSENFELD, LLP (415) 955–1155 Ext. 122 ansel@krinternetlaw.com https://krinternetlaw.com October 4: IP Basics Evergreen Valley College San Jose, CA https://www.siliconvalley- codecamp.com/Session/2015/ ip-basics October 4: IP Basics Evergreen Valley College San Jose, CA https://www.siliconvalley- codecamp.com/Session/2015/ ip-basics
58. Appendix 1: Extra Resources
59. opensource.org
60. tldrlegal.com
61. choosealicense.com
62. Linux Foundation • Open Source Compliance Publications http://www.linuxfoundation.org/publications/compliance • Open Source Compliance Templates http://www.linuxfoundation.org/programs/legal/compliance/templates
63. Books • Open (Source) for Business: A Practical Guide to Open Source Software Licensing by Heather Meeker (2015) • Intellectual Property and Open Source: A Practical Guide to Protecting Code by Van Lindberg (2008) • Open Source Licensing: Software Freedom and Intellectual Property Law by Lawrence Rosen (2004)
64. Future of Open Source Survey • 55%: “Open source delivers superior security” • 58%: “Open source affords the greatest ability to scale” • “78% of companies run on open source” • “Less than 3% don’t use [open source] in any way” http://www.slideshare.net/blackducksoftware/2015- future-of-open-source-survey-results Developer hoodie
65. Appendix 2: Attributions
66. Attributions • The Open Source Initiative logo is a trademark of the Open Source Initiative. http://opensource.org/trademark-guidelines#Publications • Tux drawing by Larry Ewing, Simon Budig and Anja Gerwinski https://commons.wikimedia.org/wiki/File:Tux.svg • Router by Evan-Amos (public domain) https://en.wikipedia.org/wiki/Linksys#/media/File:Linksys- Wireless-G-Router.jpg • Macbook Pro photo by Jeff Geerling (CC-BY) http://www.flickr.com/photos/lifeisaprayer/3346288138/ • “Samsung Galaxy S6” photo by Kārlis Dambrāns (CC-BY) https://www.flickr.com/photos/janitors/16660301626/ • BMW 435i M Sport (F32) interior” by Yahya S. (CC-BY) https://www.flickr.com/photos/128326674@N06/16721598404/ • Beer mug by Nicubunu (public domain) https://openclipart.org/detail/14854/beer-mug
67. Attributions • “Percentage of repositories licensed” chart by Ben Balter at GitHub https://github.com/blog/1964-open-source-license-usage-on- github-com • “Stop sign” photo by “Kt Ann” on Flickr (CC-BY) https://www.flickr.com/photos/54409200@N04/5070012761/ • Black Duck images by Black Duck Software https://www.blackducksoftware.com/audits/open-source- audits https://www.blackducksoftware.com/products/black-duck- suite/protex/black-duck-code-label • The SPDX logo is a trademark of the Linux Foundation. http://www.linuxfoundation.org/about/linux-foundation- trademark-usage-guidelines