German lawyer Till Jaeger came to the Embedded Linux Conference Europe to
update attendees on the AVM vs. Cybits
case that is currently underway in Germany. The case has some
potentially serious implications for users of GPL-licensed software,
particularly in embedded Linux contexts, so Jaeger (and his client Harald
Welte) felt it was important to
publicize the details of the case. So important, in fact, that he and
Welte are forgoing the usual practice of keeping all of the
privileged information (between a lawyer and client) private.
Jaeger has also represented Welte in GPL enforcement cases based on the
work the latter has done with gpl-violations.org. It is
"clear I'm not neutral in this case", Jaeger said. The case
is important to kernel developers, device makers, and to people using GPL
said, which is why they are publicizing it.
AVM is a company that makes DSL routers called the "FRITZ!Box"—because
anything named "Fritz" sells well in Germany, he
said—which are based on Linux. These routers have 68% market share
in Germany. Cybits offers a product to do internet filtering on the
FRITZ!Box with its "Surf-Sitter" software. Surf-Sitter is installed on the
router by the
user downloading firmware from AVM, running a program that modifies the
Linux kernel in the firmware and adding a user-space program to it, then
installing the modified firmware onto the router.
AVM did not like that,
Jaeger said, so it asked a court to prevent Cybits from distributing
software that allowed a customer to change any software on the
router. There are some side issues, like the changed firmware not blinking
the lights of the device correctly when online, but the core issue is that
allowed to change any software on the router, according to AVM's
arguments. That is a "major attack on users' freedoms under the
GPL", Jaeger said. It should not be possible to stop sales of
software that changes the firmware on a device like the FRITZ!Box, he said.
In January 2010, a preliminary injunction was issued in a Berlin court that
prevented Cybits from selling its software. That is when Welte got
involved. In German civil law, it is possible to intervene in a case if
you are concerned that your rights are not being upheld. Because Welte
licensed his kernel code to both AVM and Cybits (i.e. under the GPL), he
was able to intervene with Jaeger as his lawyer. When Cybits appealed the
preliminary injunction, the court of appeals overruled most of the original
decision, saying that Cybits could continue distributing its software as
long as it doesn't cause technical problems with the router (such as the
blinking lights problem).
At the same time, though, AVM filed another case in the Berlin regional
court to, once again, stop Cybits from shipping its software. AVM won that
case by default, because Cybits did not respond to the complaint in a
timely manner. According to Jaeger, the company moved and the case fell
through the cracks. Cybits then appealed the decision, which was
considered at an oral hearing in June.
In that hearing, the details were discussed quite deeply, Jaeger said. The
legal question had gotten more complicated because AVM had changed its
claims, though the additional claims are not the interesting ones, he
said. The main claim of interest is that you can't change any of the
software installed on the router, including the GPL-covered software.
Jaeger said that he asked AVM if it really meant to make that claim
against the GPL software, and AVM affirmed that. He noted that Welte would
probably not have intervened without the GPL claim. So far, there has been
no decision, and he had hoped there would be one before the talk, but one
is due sometime around November 1.
Jaeger's opinion is that if AVM prevails in its case, it will itself lose the
right to distribute the kernel as it does on the FRITZ!Box. Because it
will be imposing further restrictions than those embodied in the GPL, its
license to distribute the GPL-covered parts will be automatically
terminated. Because the GPL (version 2 in this case) clearly states that
the source code includes the scripts used to control compilation and
installation, it is clear that the intent is to enable the user to
reinstall modified versions of the software, he said.
One member of the audience wondered whether the GPLv2 was sufficient to
require AVM to allow its customers to change the firmware, as that was one
of the things that the GPLv3 tried to address. Jaeger said that his
interpretation of the GPLv2 was that it was sufficient to the task at hand,
at least under German law. Another asked whether the Cybits software was
free or proprietary, and he noted that it was the latter, but that there
wasn't a GPL question about Surf-Sitter itself because it all ran in user space.
AVM has made several arguments about why the injunction should be upheld:
trademark and copyright infringement, as well as unfair competition. One
of the main questions that was discussed in the oral hearing in June
seems silly to him: is the router a computer? AVM argued that it is not
and that they are the only ones who should be allowed to change the
firmware on the device. It
is not a good argument in Jaeger's opinion, especially because the device
is owned by the customer, so it is their property.
AVM claims to get more support calls from Surf-Sitter users than it does
from users of unmodified FRITZ!Box routers. That is the basis of the unfair
competition claim. It is an argument that the free software community
would not like to hear Microsoft or HP make about installing free software
on their systems, he said. If there were truly a support issue, AVM could
refuse to support modified routers, so there is clearly more to it than
that, he said.
The trademark claims are not really an issue in Jaeger's view, but the
copyright infringement claims are more interesting. AVM argued that the
firmware is a copyrighted work that cannot be changed without its
permission, but Jaeger and Welte argued that the firmware is a derivative work
of the GPL-covered kernel. AVM then changed its argument to say that the
firmware was a collective work, but Jaeger believes that the GPL is
intended to handle both derivative and collective works.
AVM is being contradictory in its behavior, he said, by claiming to be
licensees of the kernel by releasing the source code as is required by the
GPL, but then asserting claims that others cannot change the code. Those
assertions constitute a GPL violation in his opinion, so that AVM will lose
its rights to distribute the kernel if it prevails.
When the court releases its decision, which could be any time now, it may
render a judgement or reopen the case because of the additional claims made
by AVM. If there is a final decision, either side can appeal, which is
a likely outcome, he said. There may be an additional case eventually filed against
AVM for violating the GPL. That could come from Welte or others, depending
on how things play out, he said.
There were various audience questions about TiVo's technical measures to
stop owners from changing the firmware (i.e. Tivoization) in relationship to this case. There
are differences, Jaeger said, as AVM is trying to legally bar customers
from changing the firmware, rather than using a technical measure (like
cryptographically signing the binary as TiVo does). In his opinion, even
the technical measure used by TiVo is a violation of the GPLv2, though he
recognizes that there is a different interpretation in the
US—something that led to some of the wording in the GPLv3. In
Germany, Jaeger said, the court can dig into the intent of the license, in
addition to its words.
Jaeger believes that what AVM really wants is an "Apple-like
system" where it controls all of the software that runs on the
device. But that runs afoul of its GPL obligations. AVM didn't write all
of the software that runs on the FRITZ!Box, so it needs to comply with the
licenses of the software it includes. That means allowing customers to
modify the GPL-covered software contained inside, at least in Jaeger's
view. We should know more about the case soon, but, whatever the outcome
from the oral hearing, it seems likely that it will drag on for some time
[ I'd like to thank the Linux Foundation for assisting with travel
expenses to attend the conferences in Prague. ]
to post comments)