in defense of "contributor agreements" or whatever they are called nowadays [LWN.net]

in defense of "contributor agreements" or whatever they are called nowadays

Posted Apr 12, 2011 21:22 UTC (Tue) by wahern (subscriber, #37304)
In reply to: in defense of "contributor agreements" or whatever they are called nowadays by wahern
Parent article: Project Harmony decloaks

Looks like the FSF assignment has similar representation language:

I hereby represent and warrant that I am the sole copyright holder for the Work and that I have the right and power to enter into this contract. I hereby indemnify and hold harmless the Foundation, its officers, employees, and agents against any and all claims, actions or damages (including attorney's reasonable fees) asserted by or paid to any party on account of a breach or alleged breach of the foregoing warranty.

(http://git.savannah.gnu.org/cgit/gnulib.git/tree/doc/Copyright/assign.changes.manual)

Fraud is illegal. Erroneously authorizing rights is also illegal, and has the same strict liability as use infringement.

Subject to sections 107 through 122, the owner of copyright under this title has the exclusive rights to do and to authorize any of the following.... 17 U.S.C. 106.

It just seems a little gratuitous for individual contributors (as opposed to corporate contributors) to indemnify the FSF when the contributor already has every motivation to be honest. A lone programmer is not much of a target for litigation, but the FSF is a larger target, and by indemnifying the FSF a contributor has significantly increased their own exposure. But I guess if the chance of the FSF actually being sued is miniscule, it hardly matters.

Interestingly, the Ubuntu agreement seems much more favorable to the contributor:

9. I have not created or assigned to Canonical the Assigned Contributions in breach of My employment or any other contract.

10. To the best of My knowledge I have the legal right to enter into this assignment and have not infringed any third party's intellectual property rights in creating and assigning the Assigned Contributions to Canonical.

(http://www.canonical.com/system/files/Canonical%20Contributor%20Agreement%2C%20ver%202.5.pdf)

Two noteworthy differences here. There's no express indemnification. But also the catch-all clause 10 requires knowing breach or infringement, which is infinitely more fair to the contributor. So unless he gets wrong the work for hire status or other contractual interest in the contribution (strict representation in clause 9), his exposure is much less. Although, the applicable law is nominally English law according to clause 12. But unless English law implies those things just discussed then on first blush, kudos to Ubuntu.

(Log in to post comments)

in defense of "contributor agreements" or whatever they are called nowadays

Posted Apr 14, 2011 4:04 UTC (Thu) by wahern (subscriber, #37304) [Link]

Right. But that can happen accidentally. But per the terms it doesn't matter whether it was an accident or not.

By way of example, let's say that hypothetically some court says that interfaces are copyrightable, like Oracle claimed for Java. All of a sudden that contribution of code implementing the Java API is infringing. Or rather, it was always infringing, but only now do you know that.

Or you're an employee of a software company. The free software code you wrote happens to be so related to your company's business interests that it falls within the scope of your employment, so the code is theirs. The FSF probably tries to screen these people in their questionnaire, but they can't always be right about it.

There are tremendous grey areas in copyright law, and the FSF clause shifts most of the repercussions of this onto you. That's its very purpose. If they didn't want to do this, they would have qualified it with a variant of something like "known or should have known". The Ubuntu language, "to the best of my knowledge", is even more pro-contributor.

Also consider that you're indemnifying for any "alleged breach." So maybe you were in the right, but the FSF chose to settle out of prudence. You're still on the hook. But now let's say you can find a way around the language, or that my interpretation is totally bogus. My interpretation isn't so bogus that you won't be forced to spend thousands of dollars on an attorney to make your case.

But now let's say that we all agree none of the FSF officers would ever willing do any of this. (Which probably goes without saying.) I don't know much about non-profit governance, but if it were a for-profit corporation the benevolence of the officers doesn't matter much. If they don't sue they could possibly be on the hook for shirking their duty to protect the corporation.

None of this is worth discussing anymore, though. Frankly, I was just surprised that these organizations would use this language, and even more surprised that Ubuntu didn't. In reality we all take much greater legal risks every day.

in defense of "contributor agreements" or whatever they are called nowadays

Posted Apr 14, 2011 9:53 UTC (Thu) by mjw (subscriber, #16740) [Link]

Not disputing that there are always legal risks in whatever activity you do, but I think at least some of your worries in this case are somewhat covered.

> it was always infringing, but only now do you know that.

In my contract with the FSF it explicitly says "(to the extent known to Developer)".

> The free software code you wrote happens to be so related to your company's business interests that it falls within the scope of your employment, so the code is theirs.

They also send you a separate company disclaimer of rights which you can then let your company sign. You can keep that on file (or also send to the FSF) to show they were aware and approved of your actions.

> Also consider that you're indemnifying for any "alleged breach."

In the FSF contract I got it says "Developer is not obliged to defend FSF against any spurious claim of adverse ownership, but will cooperate with FSF in defending against any such claim"