ELCE11: Till Jaeger on AVM vs. Cybits

German lawyer Till Jaeger came to the Embedded Linux Conference Europe to update attendees on the AVM vs. Cybits case that is currently underway in Germany. The case has some potentially serious implications for users of GPL-licensed software, particularly in embedded Linux contexts, so Jaeger (and his client Harald Welte) felt it was important to publicize the details of the case. So important, in fact, that he and Welte are forgoing the usual practice of keeping all of the privileged information (between a lawyer and client) private.

Jaeger has also represented Welte in GPL enforcement cases based on the work the latter has done with gpl-violations.org. It is "clear I'm not neutral in this case", Jaeger said. The case is important to kernel developers, device makers, and to people using GPL software, he said, which is why they are publicizing it.

The dispute

AVM is a company that makes DSL routers called the "FRITZ!Box"—because anything named "Fritz" sells well in Germany, he said—which are based on Linux. These routers have 68% market share in Germany. Cybits offers a product to do internet filtering on the FRITZ!Box with its "Surf-Sitter" software. Surf-Sitter is installed on the router by the user downloading firmware from AVM, running a program that modifies the Linux kernel in the firmware and adding a user-space program to it, then installing the modified firmware onto the router.

AVM did not like that, Jaeger said, so it asked a court to prevent Cybits from distributing software that allowed a customer to change any software on the router. There are some side issues, like the changed firmware not blinking the lights of the device correctly when online, but the core issue is that nobody is allowed to change any software on the router, according to AVM's arguments. That is a "major attack on users' freedoms under the GPL", Jaeger said. It should not be possible to stop sales of software that changes the firmware on a device like the FRITZ!Box, he said.

In January 2010, a preliminary injunction was issued in a Berlin court that prevented Cybits from selling its software. That is when Welte got involved. In German civil law, it is possible to intervene in a case if you are concerned that your rights are not being upheld. Because Welte licensed his kernel code to both AVM and Cybits (i.e. under the GPL), he was able to intervene with Jaeger as his lawyer. When Cybits appealed the preliminary injunction, the court of appeals overruled most of the original decision, saying that Cybits could continue distributing its software as long as it doesn't cause technical problems with the router (such as the blinking lights problem).

At the same time, though, AVM filed another case in the Berlin regional court to, once again, stop Cybits from shipping its software. AVM won that case by default, because Cybits did not respond to the complaint in a timely manner. According to Jaeger, the company moved and the case fell through the cracks. Cybits then appealed the decision, which was considered at an oral hearing in June.

In that hearing, the details were discussed quite deeply, Jaeger said. The legal question had gotten more complicated because AVM had changed its claims, though the additional claims are not the interesting ones, he said. The main claim of interest is that you can't change any of the software installed on the router, including the GPL-covered software. Jaeger said that he asked AVM if it really meant to make that claim against the GPL software, and AVM affirmed that. He noted that Welte would probably not have intervened without the GPL claim. So far, there has been no decision, and he had hoped there would be one before the talk, but one is due sometime around November 1.

Legal questions

Jaeger's opinion is that if AVM prevails in its case, it will itself lose the right to distribute the kernel as it does on the FRITZ!Box. Because it will be imposing further restrictions than those embodied in the GPL, its license to distribute the GPL-covered parts will be automatically terminated. Because the GPL (version 2 in this case) clearly states that the source code includes the scripts used to control compilation and installation, it is clear that the intent is to enable the user to reinstall modified versions of the software, he said.

One member of the audience wondered whether the GPLv2 was sufficient to require AVM to allow its customers to change the firmware, as that was one of the things that the GPLv3 tried to address. Jaeger said that his interpretation of the GPLv2 was that it was sufficient to the task at hand, at least under German law. Another asked whether the Cybits software was free or proprietary, and he noted that it was the latter, but that there wasn't a GPL question about Surf-Sitter itself because it all ran in user space.

AVM has made several arguments about why the injunction should be upheld: trademark and copyright infringement, as well as unfair competition. One of the main questions that was discussed in the oral hearing in June seems silly to him: is the router a computer? AVM argued that it is not and that they are the only ones who should be allowed to change the firmware on the device. It is not a good argument in Jaeger's opinion, especially because the device is owned by the customer, so it is their property.

AVM claims to get more support calls from Surf-Sitter users than it does from users of unmodified FRITZ!Box routers. That is the basis of the unfair competition claim. It is an argument that the free software community would not like to hear Microsoft or HP make about installing free software on their systems, he said. If there were truly a support issue, AVM could refuse to support modified routers, so there is clearly more to it than that, he said.

The trademark claims are not really an issue in Jaeger's view, but the copyright infringement claims are more interesting. AVM argued that the firmware is a copyrighted work that cannot be changed without its permission, but Jaeger and Welte argued that the firmware is a derivative work of the GPL-covered kernel. AVM then changed its argument to say that the firmware was a collective work, but Jaeger believes that the GPL is intended to handle both derivative and collective works.

AVM is being contradictory in its behavior, he said, by claiming to be licensees of the kernel by releasing the source code as is required by the GPL, but then asserting claims that others cannot change the code. Those assertions constitute a GPL violation in his opinion, so that AVM will lose its rights to distribute the kernel if it prevails.

What's next?

When the court releases its decision, which could be any time now, it may render a judgement or reopen the case because of the additional claims made by AVM. If there is a final decision, either side can appeal, which is a likely outcome, he said. There may be an additional case eventually filed against AVM for violating the GPL. That could come from Welte or others, depending on how things play out, he said.

There were various audience questions about TiVo's technical measures to stop owners from changing the firmware (i.e. Tivoization) in relationship to this case. There are differences, Jaeger said, as AVM is trying to legally bar customers from changing the firmware, rather than using a technical measure (like cryptographically signing the binary as TiVo does). In his opinion, even the technical measure used by TiVo is a violation of the GPLv2, though he recognizes that there is a different interpretation in the US—something that led to some of the wording in the GPLv3. In Germany, Jaeger said, the court can dig into the intent of the license, in addition to its words.

Jaeger believes that what AVM really wants is an "Apple-like system" where it controls all of the software that runs on the device. But that runs afoul of its GPL obligations. AVM didn't write all of the software that runs on the FRITZ!Box, so it needs to comply with the licenses of the software it includes. That means allowing customers to modify the GPL-covered software contained inside, at least in Jaeger's view. We should know more about the case soon, but, whatever the outcome from the oral hearing, it seems likely that it will drag on for some time to come.

[ I'd like to thank the Linux Foundation for assisting with travel expenses to attend the conferences in Prague. ]