LWN.net Weekly Edition for November 26, 2003

Examining an attack on the GPL

On November 21, a law firm called Wolf, Greenfield & Sacks, P.C saw fit to issue a press release on the evils of the GPL. By the reckoning of Steve Henry, a "senior intellectual property lawyer" with the firm, the GPL is indeed scary:

We found this reading of the GPL to be interesting, so we asked Mr. Henry to explain his reasoning a bit. We thank him for getting back to us; for the curious, we have put his full response on a separate page. We'll just look at the core of his claims here. What Mr. Henry tells us is:

So, if you see the GPL as a contract, those who have received GPL-licensed software can enforce that contract's provisions against you. How could that be a problem? According to Mr. Henry:

Mr. Henry's point (a) is not controversial; if you use copyrighted work in violation of the license that applies to that work, you are infringing the copyright. There is nothing unique to the GPL there. Point (c) is the crux of the matter: Mr. Henry claims that, if you distribute a product containing GPL-licensed code, anybody receiving that code could sue to have your proprietary code relicensed. The fact that nobody has ever attempted to do this is irrelevant by this analysis; in the future somebody could make a try at it.

One could argue that, even if this reasoning holds, there is no real problem here. If a company does not wish to abide by the terms of the GPL, it should simply avoid incorporating GPL-licensed code into its products. Once again, the GPL does not differ from any other software license in this regard: if you do not like the license, nobody forces you to use the code. But the fact is that, by this argument, GPL-licensed code is more actively dangerous than other code. If you get caught using somebody's proprietary code, all you have to do is settle the copyright infringement claims and get on with life. With GPL-licensed code, you still have the infringement issue, but you could also be forced to give your proprietary products away. That would be a heavy price for a company to pay just because one of its employees slips some GPL-licensed code into its product.

But does this reasoning hold water? We dropped a note to FSF counsel Eben Moglen to get his opinion on Mr. Henry's argument. His response was:

If the GPL is not a contract, what is it? If you look at §106 of the U.S. copyright code, it states:

One of the rights given to copyright holders is to authorize others to create copies and derivative works. The GPL is that authorization: you have the right to create certain kinds of copies and derived products from GPL-licensed code. You have not signed a contract with the copyright holder, and you have not paid any sort of consideration, which is a required part of any legal contract. So you, as the recipient of GPL-licensed code, do not have any contract rights against those who distributed that code to you. Even the copyright holder lacks such rights, though the holder does have the right to claim infringement if the provisions of the GPL are not followed.

Mr. Moglen concluded with: "This talk about 'incorporating' GPL'd code in a product leading to forcing the rest of the product open is scare-mongering." We are inclined to agree. Anybody who is truly concerned about such issues, however, should discuss it with their own lawyer rather than taking our word for it.

Comments (55 posted)

Lawyers in charge

Anybody following the SCO Group story is aware that, in the last couple of weeks, the company has issued a new set of threats. Among other things, SCO claims that it will, soon, file suit against at least one Linux user. It is tempting to disregard these threats as just more bluster coming out of the company. Threats against other Unix vendors have failed to come to pass, the deadline for the company's "half-price Linux License" promotion continues to recede, the flood of invoices they promised us never appeared, etc. Why should things be different this time? When the weakness of SCO's case and the fact that a copyright suit would require a rather more straightforward unveiling of the company's evidence is considered, more lawsuits may seem unlikely.

There is, however, a recent Gartner Group pronouncement which is relevant here:

Of course, one could rephrase the above more succinctly: the company has no revenue stream and the lawyers are running the show. SCO has no real alternatives to income from litigation at this point, and its lawyers have nothing to lose from filing more lawsuits. Gartner could be right: SCO might indeed try to open up more legal fronts in the near future. If the company chooses its targets carefully, it might just succeed in finding one that will decide to settle rather than get involved in a long intellectual property case.

Or so SCO management must hope. At this point, however, there is enough information about the company's claims out there that any SCO target which takes the time to research the situation may well turn out to be less of a pushover than SCO might wish. In fact, as SCO carries out its search for the softest targets, chances are good it will pass over any company which makes it clear that it will fight back. Potential recipients of SCO licensing claims would do well to bear that in mind.

Comments (7 posted)

The CAN-SPAM bill examined

The U.S. House of Representatives passed a version of the "Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003," on Saturday. Commonly referred to as the "CAN-SPAM" bill, the House agreed on a version of the bill very similar to the bill passed by the Senate in October. This makes it likely (but not certain) that the U.S. will soon have a national law governing unsolicited commercial e-mail (UCE) -- better known as "spam" (or any number of less polite terms) by the rest of us.

Very few outside of the Washington beltway or the Direct Marketing Association (DMA) seem convinced that the CAN-SPAM bill is going to put a halt to spam. A number of people, including several state Attorneys General have argued that CAN-SPAM will make matters worse, rather than better. There is a fair amount of evidence to support this opinion.

The CAN-SPAM bill actually has the effect of legitimizing spam so long as it is non-fraudulent and provides the recipient with a means to "opt-out" of future e-mails. This is a big win for the DMA, and a major loss for the rest of us. Having to opt-out of receiving spam from each and every "legitimate" source of spam is a burden that should not be placed on the user. Given that there are thousands of legitimate businesses that will seek to make use of e-mail marketing, users are going to be doing a lot of opting out.

What about a "do-not-spam" list? The CAN-SPAM Act does contain a provision to create a national "do-not-spam" list. This can only be seen as a tactical error of gargantuan proportions. While a "do-not-call" list may succeed in reducing or eliminating unwanted telemarketing calls, spammers operating beyond U.S. borders are unlikely to be deterred by the CAN-SPAM provisions. Indeed, getting a copy of the the "do-not-spam" list will likely be a high priority for offshore spammers looking for a roster of known-good e-mail addresses. Users who place their e-mail addresses on a "do-not-spam" list may avoid spam from legitimate businesses, but will still find themselves subjected to unwanted e-mail from offshore spammers. Happily, the CAN-SPAM bill does not require the Federal Trade Commission to create a "do-not-spam" list, it only permits the creation of such a list. Given that the FTC has objected to this provision, implementation seems unlikely.

Even worse, the bill overrides state legislation that may be more stringent than the CAN-SPAM bill. This is presented as a solution to the difficulty for "law-abiding businesses" to comply with anti-spam laws, but complying with multiple state laws is a cost of doing business. This should not be an excuse to shift the burden to users and organizations rather than businesses seeking to advertise their goods or services. By overriding state laws that require "opt-in" rather than "opt-out," the CAN-SPAM Act is giving merchants free reign to send unwanted spam, at least until the user asks to be left alone. While one may argue that any laws against spam are unlikely to be effective, at least laws like those passed in California are stacked in favor of the user rather than the spammers.

Some have claimed that the CAN-SPAM Act may make anonymous e-mails illegal altogether. John Gilmore argues that the bill would make it a crime "to use any false or misleading information in a domain name or email account application, and then send an email." However, this is a somewhat liberal interpretation of the bill, which actually says:

A close reading of this language indicates that merely sending an anonymous e-mail or e-mail with a falsified header would not automatically be a crime. The provisions only apply to those "in or affecting" commerce, which would seem to exclude a user who sends an anonymous e-mail for non-commercial purposes. It might be that the language could be abused to include someone who has sent an anonymous e-mail that may have some impact on a business, perhaps a whistleblower or disgruntled customer sending out negative commentary about a company, but then the user would have to send a relatively large number of e-mails. Further on, the bill classifies "multiple" as "more than 100 electronic mail messages during a 24-hour period," up to 10,000 during a 1-year period.

Unlike some of the state laws, which allow users to sue spammers directly, the CAN-SPAM Act seems to put users at the mercy of others to take action against spammers who do not comply. The Act explicitly addresses the ability of state and federal agencies to prosecute spammers under the provisions of the Act, and provides authorization for ISPs to bring action against spammers.

There are a few good things about the CAN-SPAM Act. The bill specifically states that nothing in the bill requires an ISP to carry or deliver spam. This prevents spammers from claiming that an ISP is in any way required to deliver spam, even if it is explicitly legal. The bill also contains a provision that allows the court to force a spammer to pay legal fees for the party that initiates proceedings. This may make it more likely that prosecutors will take on spammers who violate provisions of the bill.

CAN-SPAM also makes it illegal to for spammers to use open relays or other methods of hijacking computers to send spam, and requires a working method to opt-out of e-mail. Again, these provisions are unlikely to deter offshore spammers, but the provisions are welcome nonetheless.

Finally, the bill provides for vendor liability. This means that if a vendor contracts with a third party to send e-mail on their behalf, the vendor can be held liable for failure to comply with the CAN-SPAM provisions. This prevents companies from contracting with offshore spammers to escape legal liability.

In all, however, the CAN-SPAM Act is disappointing legislation. It fails to affirm users' rights to consent to e-mail marketing, and instead burdens them with the responsibility of opting out of unwanted marketing. The bill will negate tougher state laws against spam that have the backing of the general populace in favor of weakened provisions that are backed by lobbyists. After more than six years of Congressional foot-dragging, we will likely be stuck with a law that does little good, and may even serve to exacerbate the problem. It may well be that the spam problem is not solvable by legislation, but, even if it is, the CAN-SPAM act is not the law we need.

(For those who are interested, the full text of the proposed law is available in PDF format.)

Comments (21 posted)

Page editor: Jonathan Corbet

Inside this week's LWN.net Weekly Edition

• Security: Attacks on free software infrastructure; New vulnerabilities in iproute, pan, ...
• Kernel: BSD security levels for Linux; Review: Linux Kernel Development; kmsgdump.
• Distributions: Interview with Andreas Typaldos, Xandros CEO; new - Firenet mini linux
• Development: The MlView XML editor for GNOME, new versions of Ogg Vorbis, omniORB, PostGIS, ntfsprogs, Barbecue, Net-SNMP, Red Carpet, CUPS, ecasound, Rhythmbox, Passepartout, GIMP, Gaim, Wine, RTMix, gputils, Bluefish, Mozedit.
• Press: 2004 predictions, Linus speaks from the Cruise, KDE at Comdex, lots of interviews.
• Announcements: Lindows deploys 30K systems in Canada, MS Voucher refund, CELF publishes Baseline Source Tree, Desktop Integration Bounty Hunt.

Next page: Security>>