What can/should I do when I see a violation to GPL restrictions?

Question

Some years ago, I was working on a software company that used some copyrighted JAR dependencies that they had bought from a medium-size obscure private company for a very expensive price.

After some time using their JARs, I figured out that most of the content was a GPL'd software that they repackaged, obfuscated, encrypted and started to sell as if they made it.

This is clearly a violation of the GPL terms (don't remember if it was GPL v2 or v3, but it is still a violation regardless of that). However, no one seems to care and I never heard about some lawyer suing somebody who is not a giant global player like Microsoft or Google due to GPL violation.

Further, how would I prove that there was a GPL violation, since the software was obfuscated, encrypted and can't be legally acquired easily? Further, who should/could sue them and how? Since I can't answer those positively, I might sadly conclude that GPL restrictions can't be enforced in practice and thus are just empty words.

I know that this question deeply depends on the country and regional laws, but I expect that answers might give some light about what may happen in practice in most place of the world about this.

Answer 1

If you do not own the copyright on the software whose license is being infringed:

It is not up to you to prove there was a GPL violation. It is not up to you to enforce the license of software for which you do not own the copyright. None of your rights are being infringed, so you have no standing to take legal action against the copyright infringement. As a practical matter, how can you be sure that the owner of the GPL-licensed software did not allow this other vendor to use it under a separate agreement? It is possible that the other software vendor could have purchased a separate license from the owner.

The best thing you can do is to bring the issue to the attention of the copyright holder, who has the exclusive right to take legal action. If they want to take legal action, they can; if they don't want to, that's their decision to make.

In this case, since the seller took unfair advantage by lying about the authorship of the software during the sale, your company may be able to take legal action for fraud. (But I'm not a lawyer and couldn't say for sure.) Note that this is different from legal action for the GPL violation itself: you would take legal action for the seller's deceit that caused you harm, rather than the seller's infringement of the original author's copyright (which has harmed only the author, not you). This is no different from how it would work for any other software, open or proprietary.

If you do own the copyright on the software whose license is being infringed:

Your copyright is being infringed, and you are entitled to take legal action. For assistance, you can contact the Free Software Foundation with details about the infringement. They state on their page about Violations of the GNU Licenses:

The FSF acts on all GPL violations reported on FSF copyrighted code, and we offer assistance to any other copyright holder who wishes to do the same.

Since the FSF has a social interest in teaching people to respect free software licenses (especially the GPL, which they authored), they offer some degree of assistance in taking legal action against offenders. There may, of course, still be significant cost to you, depending on how much aid the FSF can afford to give, but the FSF is far and away your best starting point.

Answer 2

The first step in any legal issues is to notify relevant people. Initially, you should notify the copied project's owner. Since you weren't part of the team, you don't know whether the owner made an exception for this case or not. The theory is that the owner should deal with their own copyright.

If the owner completely ignores you, then after a reasonable period of time you could send a polite email to the offending party, stating that you've noticed they're doing X which is against the license terms and asking if there's some reason you haven't noticed. This achieves the effect of telling the offender that someone has noticed they're doing something wrong (if they are), and gives them a chance to stop; or it gives them the chance to explain that actually, what they're doing is perfectly legitimate.

If the software isn't yours, it's not your job to initiate any legal proceedings against the offending party, so leave that battle for those who should do it.

Answer 3

When you release your software under the GPL, it means you give anyone a license to use your software under some terms and agreements. If somebody violates the agreement, they are in breach of contract with you.

This means you can sue them in a court of law. Depending on how principled you are this may or may not be worth it. Damages rewarded are typically low. Few start actual lawsuits, though for example busybox has been known to persue their copyrights.

You can contact the owners of the copyright who originally licensed the software under the GPL, and whatever action they choose to pursue further is their prerogative. They might take action, or they might allow them to go ahead and use their product in the way it is used now. They own the copyright, they get to decide what happens.

If the owners of the copyright happen to be the Free Software Foundation, you can contact them here.

The link also holds some additional information of concrete good ideas in case you want to contact the copyright holder.

Answer 4

It is now almost 10 years later a third party (the Software Freedom Conservancy, SFC) took Vizio to court, see the Vizio case. The case is still developing, but the court did not dismiss the case immediately, but instead asserted that SFC was a valid third party

thereby acknowledging that a third party can take someone to court for a GPL violation.

To quote a commenting lawyer

Quoting an earlier California case, the court said that the third party must show three things:

1. the third party would in fact benefit from the contract;

2. a motivating purpose of the contracting parties was to provide a benefit to the third party; and

3. permitting the third party to enforce the contract is consistent with the objectives of the contract and the reasonable expectations of the contracting parties.

To divine the objective of the contract, the court used the sophisticated technique of “read it.” And so we end up with the judge quoting the GPL directly, including

“you must give the recipients all the rights that you have”

and that distributors must provide

“a written offer … to give any third party … a complete machine-readable copy of the corresponding source code”

Not surprisingly, in an argument about third party benefits, the court found that last point particularly persuasive, since it spells out the benefits that must be provided to “any third party.”

Therefore, the accepted answer is wrong in saying without precondition that "None of your rights are being infringed".

You as a developer are a user of the software, and as such you were intended to be granted the rights the GPL mentions, as this is precisely what the GPL intends to do (and how it all started).

Some might say that a license is not a contract, but as the Vizio case shows, that doesn't imply there are no contractual rights. The GPL license comes with explicit contractual obligations.

Now, it might depend on the jurisdiction if the law will acknowledge a third person as a beneficiary from contracts. This is the case in USA and The Netherlands for example.