On the 'death penalty' thing [LWN.net]

On the 'death penalty' thing

Posted Feb 1, 2012 18:04 UTC (Wed) by armijn (subscriber, #3653)
In reply to: On the 'death penalty' thing by pizza
Parent article: A tempest in a toybox

The problem that I (and others) have is that SFC demands things to be fixed that are outside of their own direct copyright (which is BusyBox), like binary kernel modules.

I have talked to various lawyers in the free software world about this (under Chatham House Rules, so I can't explicitely name them), but all of them have frowned upon this, or dismissed it outright.

Before this turns into another flamefest about whether or not it is immoral or not for companies to violate the GPL, this is *the* core question: can you demand things outside of your own direct copyright?

Perhaps the editor could poll some lawyers about this subject, and get permission to quote them? It would be very helpful.

to post comments

On the 'death penalty' thing

Posted Feb 1, 2012 18:09 UTC (Wed) by corbet (editor, #1) [Link] (4 responses)

"The editor" has found it frustratingly difficult to get lawyers to say anything useful about subjects like this. It's unfortunate. There are, in fact, a lot of high-clue lawyers out there; they understand and support what we're doing. But the nature of their profession makes them unwilling to say much of anything interesting outside of the most private situations.

On the 'death penalty' thing

Posted Feb 1, 2012 22:21 UTC (Wed) by marcH (subscriber, #57642) [Link]

Is this a problem to quote these private discussions anonymously? I know it looks bad from a journalistic perspective but, journalists with enough credit can rely on that credit to do it.

On the 'death penalty' thing

Posted Feb 2, 2012 12:52 UTC (Thu) by ortalo (guest, #4654) [Link]

Would it be feasible (interesting?) to try a summary of the various cases and decisions actually judged on this topic? After all, lawyers opinions are less interesting than actual courts judgments on the topic.
However, such work would probably be extremely cumbersome (esp. for a technically-oriented writer): so do not take that for a request. But I am curious if such survey is simply feasible - it seems few trials on the topic have been brought to an actual end. (That's not necessarily a bad thing, but in the meantime, endless discussion goes on.)

On the 'death penalty' thing

Posted Feb 2, 2012 14:38 UTC (Thu) by dwmw2 (subscriber, #2063) [Link] (1 responses)

Lawyers say what they're paid to say.

When the module thing comes to court, as I'm sure it will, you'll find that there are "high-clue" lawyers on both sides.

In cases like this, lawyers don't tell you what the law is; a judge does.

On the 'death penalty' thing

Posted Feb 3, 2012 10:32 UTC (Fri) by marcH (subscriber, #57642) [Link]

This might sound surprising but I think some lawyers can also be human beings sometimes and have private, honest conversations. For free.

On the 'death penalty' thing

Posted Feb 1, 2012 18:11 UTC (Wed) by mjg59 (subscriber, #23239) [Link] (7 responses)

From a purely practical viewpoint, you obviously can - the SFC have done so on multiple occasions.

On the 'death penalty' thing

Posted Feb 1, 2012 18:24 UTC (Wed) by armijn (subscriber, #3653) [Link] (6 responses)

Please don't confuse an end result with something being legally sound.

I talked to several companies and lawyers and the pretty harsh terms (veto, review, binary kernel modules) are only pretty recent (Best Buy case, end of 2009). Before that it was indeed just as Bruce said: "not that bad" and reasonable terms.

Every company so far that has settled in the Best Buy case has settled under undisclosed terms but there is no *actual* judgement.

Perhaps the end result is indeed the same and companies said they would disclose source code, plus agree to something else (perhaps money, perhaps something else, but since those terms are not disclosed we don't know), just to get the lawsuits of their backs. But that still does not answer the core question whether or not it is actually legal to do so, which is what I am most interested in.

So far I have not heard a single lawyer (except from the ones from SFC) speak in support of the demands of SFC.

On the 'death penalty' thing

Posted Feb 1, 2012 18:36 UTC (Wed) by mjg59 (subscriber, #23239) [Link] (2 responses)

Just to make sure we're on the same page here - are you saying that you've received legal advice to the effect that it's actively illegal for the SFC to make demands on unrelated software as a condition of restoring a Busybox license, or merely that there's no law saying that they can?

On the 'death penalty' thing

Posted Feb 2, 2012 2:56 UTC (Thu) by rahvin (guest, #16953) [Link]

I think anyone with at least the basic understanding of the legal system in the US should know that a plaintiff could demand the CEO of the defendant dress up in a bunny suit and play in traffic and there is nothing illegal about the request. The judge isn't likely to award such a thing in the event infringement is found but they can still claim it and demand it as part of a settlement AND the other side can agree to it as part of the settlement and it would be binding as long as the clause itself isn't illegal (such as requiring the murder of some other person).

IANAL, but there is nothing illegal about what SFC is doing. They can only make these claims and requests because the companies in question open the door by infringing the GPL.

I'd also like to point something else out which unfortunately wasn't in the article. It should go without saying that if a Kernel developer steps forward to work with SFC as the plaintiff they will be the one in the driver seat and if they disagree with certain actions SFC is taking they would be in a position to stop that and prevent SFC from doing whatever it is that the developer disagreed with. The only thing SFC could do would be to refuse to work for the plaintiff.

If you don't like how SFC is engaging in these actions and the terms and conditions they demand for closure the best way to stop them is to become their plaintiff and work with them.

On the 'death penalty' thing

Posted Feb 2, 2012 14:32 UTC (Thu) by dwmw2 (subscriber, #2063) [Link]

They most definitely can. They can require whatever they like in "payment" for granting a licence to use their code.

Some people grant a licence in return for money; some grant a licence in return for postcards. There's absolutely no reason that they can't grant a licence on the condition that the licensee complies with the licence of the *other* software they use. Or stops beating their wife. Or stands on their head and asks nicely.

I believe that the standing on the head example was actually made by a judge in a recent ruling.

On the 'death penalty' thing

Posted Feb 1, 2012 19:44 UTC (Wed) by jku (subscriber, #42379) [Link]

I understand the discussion on whether this the right thing to do or not, but why on earth would SFCs actions be illegal? Remember that we're talking about a settlement, something that the infringer chooses to take part in. They always have the option of not settling.

On the 'death penalty' thing

Posted Feb 2, 2012 2:07 UTC (Thu) by Trelane (guest, #56877) [Link]

How is the veto different from the "we may audit you for compliance at any time" terms of most proprietary software?

Aside from the obvious issue of the SFC not auditing you until you've allegedly violated the terms once.

On the 'death penalty' thing

Posted Feb 11, 2012 12:21 UTC (Sat) by Wol (subscriber, #4433) [Link]

I think the problem here is that, in most cases, once the SFLC get through to someone senior who understands the problem, the offender caves pretty quick and says "how can we put it right?".

Once the SFLC has got hold of someone who (a) has the clout to fix things, and (b) has the determination to fix things, it's pretty easy to come to an amicable solution.

The problem with Best Buy, as far as I can make out, was the only response the SFLC got was "not our problem". To the point they were finally exasperated enough to say "well it is your problem and we're going to court to make you face up to it!"

I don't know whether you have the same thing in America, but over here we have a position called "Company Secretary", of which most companies *M*U*S*T* legally have one. And one of the "perks" of the post is that if the company breaks the law, the Secretary is - *PERSONALLY* - legally liable and can be fined or imprisoned.

So over here, the equivalent of the SFLC could go to Companies House (the relevant public records office), find out who the Secretary is, and send them a registered letter. At which point he is personally on notice that he could end up in jail. He now has two choices. Pass the buck to the rest of the board, placing them on notice of jail terms, or resign. What do you think it's going to do to confidence in the Company if the Secretary resigns, giving as his reason that he doesn't want to go to jail?

Cheers,
Wol

On the 'death penalty' thing

Posted Feb 1, 2012 18:41 UTC (Wed) by raven667 (guest, #5198) [Link]

> for companies to violate the GPL, this is *the* core question: can you demand things outside of your own direct copyright?

If it came down to the technicality of it then probably no, the case would be thrown out (see RightHaven) but why wouldn't you ask for and help implement a comprehensive compliance program rather than playing monkey hear-no-evil, see-no-evil, speak-no-evil? Compliance is the ultimate goal, not punishment. Unless you think being forced to comply with the licenses of the software you ship is "punishment".

On the 'death penalty' thing

Posted Feb 1, 2012 18:53 UTC (Wed) by mjw (subscriber, #16740) [Link]

I was under the impression that this is a fairly standard settlement deal to avoid a full lawsuit and damages. The FSF also asks for something like this when they settle with a company and drop their lawsuit over GPL violations. In return for dropping the lawsuit the company that settles agrees to appoint something like a Free Software Director that periodically reports to the FSF about compliance with the free software licenses used by the company. It seems cheaper and more productive than having to fight a lawsuit, pay penalties and possibly having to terminate a whole product line. All parties win. I assume in return for not enforcing your copyrights you can ask (demand) anything, the other party doesn't have to agree of course, but if it is cheaper why wouldn't they? Or is this what the lawyers object to?

On the 'death penalty' thing

Posted Feb 1, 2012 19:04 UTC (Wed) by Otus (subscriber, #67685) [Link] (2 responses)

> Before this turns into another flamefest about whether or not it is
> immoral or not for companies to violate the GPL, this is *the* core
> question: can you demand things outside of your own direct copyright?

Correct me if I'm wrong, but isn't the SFC doing this via settlements? I though settlements allow the two parties to decide on whatever terms both accept, with basically no legal limits.

If the sued companies don't see the terms as acceptable they can continue the court case, where the SFC would presumably ask for a payment or whatever the law allows them to ask for.

On the 'death penalty' thing

Posted Feb 2, 2012 3:06 UTC (Thu) by rahvin (guest, #16953) [Link]

The law allows statutory damages for copyright at $150K per incident. Ship 10,000 widgets and statutory penalties for violation are going to max out at $1,500,000,000 (or $1.5 Billion).

Considering juries have been handing max statutory damages to poor single mothers who downloaded music off the internet (Jamie Thomas in her first trial for 21 songs was ordered to pay more than $1.5 million dollars) I think it's fairly probable that if a corporation was foolish enough to take this to the Jury they would end up with the max statutory damages the law allows but in reality the Jury can award damages anywhere between $0 and the max the law allows per infringement.

On the 'death penalty' thing

Posted Feb 5, 2012 20:42 UTC (Sun) by dwmw2 (subscriber, #2063) [Link]

"If the sued companies don't see the terms as acceptable they can continue the court case, where the SFC would presumably ask for a payment or whatever the law allows them to ask for."

Indeed. It seems rather odd to complain that a settlement is unfair to them, and then to accept it anyway because it costs them less than the penalty that the court would have imposed for their crimes.

I find it particularly strange given that the type of settlements they're talking about bear so little relation to the things that the SFC say they do ask for (see here).

If the likes of Sony really want to reduce their risk, perhaps they should lobby the government to reduce the statutory damages for copyright infringement?

On the 'death penalty' thing

Posted Feb 1, 2012 21:43 UTC (Wed) by rahulsundaram (subscriber, #21946) [Link] (6 responses)

"this is *the* core question: can you demand things outside of your own direct copyright?"

Oh, sure you can. If you don't agree, take it to court. The fact that noone has dared to, speaks volumes about the legitimacy of the request.

On the 'death penalty' thing

Posted Feb 2, 2012 2:12 UTC (Thu) by Trelane (guest, #56877) [Link] (3 responses)

Do BSA auditors also audit for non-member software?

On the 'death penalty' thing

Posted Feb 2, 2012 2:16 UTC (Thu) by rahulsundaram (subscriber, #21946) [Link] (2 responses)

I have no idea and don't care at all. BSA has nothing to do with Free software licenses which don't try to control use.

On the 'death penalty' thing

Posted Feb 2, 2012 2:51 UTC (Thu) by raven667 (guest, #5198) [Link] (1 responses)

Personally I think a comparison with what the BSA does would be instructive because they are very broadly doing the same kind of thing, enforcing copyright licenses.

On the 'death penalty' thing

Posted Feb 2, 2012 3:09 UTC (Thu) by rahvin (guest, #16953) [Link]

I don't think they venture outside their members though they may tip of a company and ask them to join. The problem would be that I doubt there is a software company with more than 1 employee that isn't a member of BSA.

On the 'death penalty' thing

Posted Feb 11, 2012 12:27 UTC (Sat) by Wol (subscriber, #4433) [Link] (1 responses)

Well, if said defendant is shipping a box containing, amongst other things, busybox, AND THE SFC HAS BOUGHT ONE OF THOSE BOXES, then per the GPL they are entitled to a copy of the source of all the GPL programs on it.

So what they are demanding is "give us all the source we are legally entitled to".

Where it becomes a problem, and where Sony :-( has a problem with it, is they are also asking for the source for other products they may not have bought (that may well not even be on sale!).

Cheers,
Wol

On the 'death penalty' thing

Posted Feb 11, 2012 18:18 UTC (Sat) by corbet (editor, #1) [Link]

In the interest of clarity, it's worth repeating an important point here:

If somebody is shipping Busybox (or another GPL-licensed program), and they did not ship the source along with a binary distribution, then any third party is entitled to ask for the source. Having bought the box (or not) does not play into the picture in any way.

That said, third parties have no standing to legally enforce that requirement. Only the copyright holders can do that. The SFC, by virtue of representing copyright holders (and, possibly, being a copyright holder itself), has the standing to initiate this sort of action.

On the 'death penalty' thing

Posted Feb 9, 2012 8:06 UTC (Thu) by kevinm (guest, #69913) [Link]

They can "demand things outside their own copyright" because they are negotiating a new contract to restore the infringer's license to distribute the busybox code being represented. Almost any obligation can be written into a contract.