6

Here in Stack Exchange we have mentioned some cases of lawsuits involving open source projects that allegedly breached patents and were sued. I'm curious, however, in the opposite case: has anyone been sued for not following the terms of an open source software that has been used?

Possible examples narrow down to GPL-related software, since the copyleft terms create the precedent for someone to "breach" the licence. So, in other terms: has anyone used/altered a GPL-licenced software, hasn't released its source code and thus has been accused of not following the licence's terms?

0

1 Answer 1

9

Yes, there have been lots of lawsuits involving open source licenses. The GPL is a very popular license and been involved in a large share of that litigation. The result is that open source licenses and the GPL have been recognized as effective and enforceable licensing tools in many jurisdictions around the world. However, it might not be possible to enforce these licenses in individual cases.

I'll highlight some interesting cases or campaigns below.

SCO (2003): “The GPL is invalid and unconstitutional! But wait, we're using it…”

The SCO–Linux controversies are hilarious in hindsight, and too complex to summarize quickly. The core issue was that SCO considered itself to be the true owner of Unix (they're not), and went around suing anyone for being involved with any Unix-ish operating system, including Linux. Linux uses the GPL license.

In 2003, SCO sued IBM because IBM added features to Linux that SCO thought violated their rights. In this context, there was a brief time where SCO both distributed a Linux version under the GPL license (which is only possible if the GPL is valid), while simultaneously claiming that the GPL is entirely invalid (??) because the GPL would violate the US constitution (????). They soon removed this claim in an amended filing.

While this isn't a precedent (and final appeals are still awaiting judgement), SCO's attacks were one of the strongest attacks on Linux copyright & licensing status. Linux and its GPL license have survived, SCO is no longer in business.

Wallace (2005): “The GPL is an illegal price-fixing scheme!”

GPL software is usually provided at no cost. In 2005, Wallace tried to sue the FSF for creating the GPL. The argument seemed to be that the GPL encourages pooling and sharing of IP, leading to predatory pricing. This would crowd out other market actors. However, the lawsuit was filed pro-se, without assistance from a lawyer. The case was thrown out, though more on procedural grounds than on the merits. In any case, the judge found that the GPL is good for competition:

[T]he GPL encourages, rather than discourages, free competition and the distribution of computer operating systems, the benefits of which directly pass to consumers. These benefits include lower prices, better access and more innovation.

Jacobsen v Katzer: open source licenses are enforceable in the US

In Jacobsen v Katzer (US, 2006–2010) (Wikipedia), a company had used open source code under the Artistic License, without complying with its terms.

The company argued that the license consisted of an (unconditional) license grant, plus some contractual terms like having to retain attribution notices. It would be possible to sue for this breach of contract, but there wouldn't be any damages since the software was made available at zero cost.

Instead, the court found that the terms of the license did protect economic interests:

For example, program creators may generate market share for their programs by providing certain components free of charge. Similarly, a programmer or company may increase its national or international reputation by incubating open source projects. Improvement to a product can come rapidly and free of charge from an expert not even known to the copyright holder. […]

The conditions set forth in the Artistic License are vital to enable the copyright holder to retain the ability to benefit from the work of downstream users. By requiring that users who modify or distribute the copyrighted material retain the reference to the original source files, downstream users are directed to Jacobsen's website. Thus, downstream users know about the collaborative effort to improve and expand the SourceForge project once they learn of the "upstream" project from a "downstream" distribution, and they may join in that effort.

Jacobsen v. Katzer, 535 F.3d 1373 (Fed. Cir. 2008).

Furthermore, the license terms were found to be enforceable conditions of the license, not just contractual terms. Not complying with the conditions means there is no license, no license means copyright infringement.

This result applies to all open source licenses. The licenses can impose conditions, and violating these conditions results copyright infringement. While the judgement explicitly calls out Creative Commons, the same reasoning applies to the GPL.

Busybox compliance campaigns

Busybox is a minimal “userland” for Linux systems, i.e. a collection of basic command line tools. It is licensed under GPLv2, and frequently used in embedded Linux systems like WiFi routers or TV boxes. So the device manufacturers also provide the complete corresponding source code for Busybox – at least after a bit of “assistance” from the Software Freedom Law Center or the Software Freedom Conservancy. Most of these cases were settled.

Such cases are fairly controversial in the community, and escalating to legal means is seen as pretty aggressive – the focus should be license compliance, not punishment. On the other hand, many distributors of GPL-covered material don't seem to care unless actively threatened.

Linux compliance campaigns

There are similar efforts for other GPL software, in particular Linux. The Software Freedom Conservancy is the primary actor in this space. For example, Conservancy had been lobbying Tesla since 2013 to release the GPL code used in their cars, which led to first (but incomplete) code being released in 2018 (!). As far as I know there is no litigation involved here despite the clear GPL violations.

The gpl-violations.org project by Harald Welte is a similar actor, which has e.g. successfully enforced the GPL on Linux and netfilter/iptables in German courts. The project claims that they launched 100 cases between 2004 and 2006, with a 100% success rate. Some opponents have unsuccessfully tried to claim that the GPL was invalid. In one case they joined with the FSF Europe to successfully defend the right to modify embedded GPL software on routers.

Developers don't always have standing to sue.

As seen above, there have been many successful GPL enforcement actions. However, can a single developer sue for GPL violations regarding their contributions in a huge project like Linux? The answer is not always yes.

An example is Hellwig's lawsuit against VMware (Germany, 2015?–2019). Hellwig is a prolific Linux contributor and was supported in this lawsuit by Conservancy. VMware's ESXi hypervisor has a kernel that mainly consists of the proprietary vmkernel component, but loads the GPL-covered vmklinux module that includes code from Linux. Hellwig argued that vmklinux includes parts of Linux he modified, that vmklinux and vmkernel form a combined work, and that therefore vmkernel should be open-sourced as well.

The court (and various appeals) denied these claims because Hellwig could not show that his copyright (≠ the entire Linux copyright) had been violated. Hellwig would only have copyright in his modifications/contributions to the program, not in the entire modified program. Since Hellwig could not meet the necessary burden of proof to the court's satisfaction, he did not have standing to demand any injunction against VMware. So the lawsuit was denied on mostly procedural grounds. The court did not rule on interesting questions like whether dynamic loading of GPL code would violate the GPL.

Specifically, the court was not satisfied with the Linux Git history, with a blame-view of Linux files (showing most recent contributor for each line), and with a diff between Linux files and vmklinux files. The court was missing a direct explanation for which parts vmklinux Hellwig would have a modification copyright. This is further complicated because the committer for a line of code is no evidence for the copyright holder for that modification, e.g. if the commit merely moved code to a different place. Furthermore, the inclusion of Hellwig's copyright notices in vmklinux did not prove that any of Hellwig's actual code had been copied (it only indicated that his code could have been copied).

So while GPL as a license is clearly enforcible (as shown here with examples from the US and Germany), actually enforcing on a specific software can be pretty difficult, especially in a very collaborative context where it's not clear who wrote what. And even when violations are clear, it can take many years to get companies to compliance (e.g. see the 5-year delay in Tesla starting to comply).

0

Not the answer you're looking for? Browse other questions tagged or ask your own question.