A referendum on GPL enforcement

Frankly, that's often what we do, from our point of view. Ironically, from the violator's point of view, they are paying a lot for the whole process already, because the first thing they do (these days) is hire high-priced outside attorneys who advises them to fight us. After a GPL enforcement matter gets a year or two into the usual clock, the other side has probably paid many tens of thousands to their counsel advising them to introduce delay and refuse to even acknowledge that they were out of compliance; sunk cost fallacy likely kicks in at that point. By then, the company has paid so much money to their lawyers that they are fed up with the whole process and we're lucky to get them into compliance without a lawsuit, let alone recover our costs.

Felix noted further:

it should be cheaper to ship a compliant product in the first place than to violate the GPL and fix things up later.

I agree that it should be true, but sadly, it's not; violators play the odds. I often point out that Conservancy is aware of hundreds and possibly thousands of GPL violations ongoing, just on Linux, at any given moment. Most products with Linux have a life cycle of 18 months or less. Violators realize that the odds are forever in their favor: for any given product, the odds that we can get to them before the product hits end of life are very low. Plus, when companies have outside vendors who are ultimately responsible for the firmware (and are the primary violator) it's more valuable to the OEM to preserve those relationships than to insist on compliance. Factor that into the (small but nontrivial) cost of complying up front, and you have a corporate decision-making recipe that always says to violate first and comply later (if we ever even have to). Few companies are committed to doing the right thing and not playing those odds. I'm glad some do, but they're rare.

You might reasonably ask why we don't go after the upstream firmware/board manfuacturers directly. We rarely have enough evidence of a board-maker's violation that is sufficient for enforcement action. From the point of view of us and everyone who bought the product, the OEM is the violator, not their firmware vendor. If the OEM protects their upstream vendor at all costs (which they do, since the vendors have a lot of power in the relationship once it's in place), the OEM refuses to even say the vendor was the primary violator. We thus don't have any evidence to pursue the original violator. Not until there is a strong set of Court cases that show such violations won't be tolerated will this behavior change, IMO.

Conservancy chose to fund the VMware suit (and set its money aside separately — the funding for VMware is already collected and not at issue in Conservancy's current fundraiser —) as part of a careful strategic plan to maximize the value of the enforcement we can afford to do. We cannot guarantee our donors that GPL enforcement will become self-funding, but we constantly consider ways to make it so, provided that we not compromise the moral principles of GPL enforcement. Personally, I've seen too many cases where well-intentioned people got involved in enforcement and then began to value revenue over compliance — Jon Corbet made reference to one such situation in his main article. For my part, I'm constantly vigilant to ensure any time funds are involved in an enforcement settlement that we are not even close to trading failures in compliance for money. Even doing that a little bit begins the path to corruption.

This fundraising campaign is the culmination of many years of thinking and seeking a formula that generates sustainable self-funding revenue for ethical GPL enforcement. During those years, I have personally been offered high paying jobs if I'd just stop doing GPL enforcement, and some companies have offered funding to Conservancy if we'd just “remove enforcement work from [our] roster”. I suspect that many who care about the GPL but don't work regularly in the enforcement/compliance community will be flabbergasted to learn that powerful for-profit interests seek to curtail enforcement of copyleft. Given this political climate, Karen and I both feel that Conservancy needs a mandate from the public to continue this work. Jon Corbet's phrase for this, a referendum on GPL enforcement, is thus apt.

Meanwhile, I know that Karen and I sometimes may sound dismissive when people come forward with suggestions on better ways to do enforcement. It's because we've tried as many suggestions as we can that don't compromise our enforcement principles — in fact, we've tried most of them at least twice in different time periods; we've done a lot of “well, that didn't work before, but maybe things have changed and it'll work now”. Yet, the situation doesn't get any better. In fact, violation counts increase. In particular, over the last two years, we've seen a rise in companies who are what I call “savvy” violators: companies that knew about the GPL and its requirements but sought specific methods to avoid compliance. GPL violations stopped being just a series of innocent mistakes by n00bs a long time ago.

I realize that's a long winded answer to your point, Felix, but I hope it illuminates that we did not come to this decision to launch this fundraiser lightly. I realize it's frustrating to be asked for an annual donation to do the seemingly simple job of asking other people to follow the rules, and I don't blame you for feeling some donor fatigue, particularly when the wheels of justice move so slowly. (We'd hoped for a decision in the VMware case by now, but it may be a long way away!) The best I can promise you is we're always committed to looking for creative solutions to the problem, and that we operate as transparently as we possibly can (which is why Karen and I are spending time late into the night answering queries on LWN ;)

Finally, I'm glad LWN readers had the opportunity to read about this and ask these questions.

— Bradley M. Kuhn, Distinguished Technologist, Software Freedom Conservancy