The rise of copyright trolls

At the 2017 Free Software Legal and Licensing Workshop (LLW), which was held April 26-28 in Barcelona, Spain, more information about the GPL enforcement efforts by Patrick McHardy emerged. The workshop is organized by the Free Software Foundation Europe (FSFE) and its legal network. A panel discussion on the final day of the workshop discussed McHardy's methodology and outlined why those efforts are actually far from the worst-case scenario of a copyright troll. While the Q&A portion of the discussion was under Chatham House Rule (which was the default for the workshop), the discussion between the three participants was not—it provided much more detail about McHardy's efforts, and copyright trolling in general, than has been previously available publicly.

The panel was moderated by OpenChain program manager Shane Coughlan and consisted of Armijn Hemel, of Tjaldur Software Governance Solutions, and Mark Radcliffe, chair of global open source practice at DLA Piper, who has advised a number of clients in disputes with McHardy. Coughlan and Hemel have both been active in the GPL compliance world for many years; they have written about some of that here at LWN as well as in a new freely available book on GPL compliance. Radcliffe has been working in the area of open-source licensing for quite some time as well and advises both the Open Source Initiative (OSI) and Apache Software Foundation (ASF) on licensing matters.

Coughlan started things off by noting that the idea of copyright trolls is something that the open-source legal world has been "dancing around for a long time". He and Hemel talked about trolling ten years ago as a malicious action that could arise out of copyright and open source but, for many years, nothing happened on that front—until a few years ago. McHardy began his efforts to enforce the GPL on his copyrights in the Linux kernel and, in particular, the netfilter subsystem.

When that happened, Coughlan said, the community did not address the problem head-on until the netfilter team publicly called out McHardy on his activities. He then asked Hemel to fill everyone in on how these enforcement efforts work and on whether McHardy is still actively pursuing them.

The method

It is interesting to see that McHardy is only active in Germany, Hemel said; he is exploiting some specific features of German law. McHardy first approaches a company to tell it that its product is not in compliance; he makes a modest demand (say €6,000-7,000) for his engineering time. He also asks the company to acknowledge and sign his cease-and-desist order; under German law that turns it into a contract. Once that has been done, sometime later McHardy will come back with other products that are also not in compliance and require that the company pay a penalty for each, which can total to €500,000 or more.

Radcliffe agreed that there are favorable aspects to German law that McHardy is using. He gets companies to sign a kind of cease-and-desist letter that forms a contract agreement, then "leverages the contract" to extract more money. Companies should not sign the contract, he said, but its modest demands make it quite attractive to companies' lawyers. Since the netfilter team has brought attention to McHardy and his activities, though, companies are less likely to sign.

McHardy's cease-and-desist letter warns of injunctions if the company does not comply. That kind of action is meant to be used in situations where there is a need for immediate relief; for example, if a book that was not authorized by its copyright holders was being offered at a book fair, Radcliffe said. The threat of that is enough to get some companies to sign; part of the terms are that the companies agree to abide by the GPL, which is what McHardy uses to get damages in phase two.

McHardy has a range of GPL-infringement complaints that he has made, starting with the normal lack of corresponding source code availability as well as the lack of an offer to provide the source. There are some "more exotic" complaints too, Radcliffe said, including that the GPL text distributed is not translated into German or that the source offer should not come from the parent company; there are others that are even more odd. Once the contract is signed, complaints for other products can yield a €10,000 penalty per violation; one company was hit with complaints on around 100 devices. Companies should not sign and turn it into contract, he said.

Ineffective

But, Radcliffe said, if we had to choose a copyright troll, we would choose McHardy. Coughlan agreed; McHardy is irritating, but his tactics are not as bad as they could get. For one thing, Radcliffe said, McHardy's settlements tend to be cheap. In addition, when he actually ends up going to court, it has come back to haunt him. He also does not use lawyers much, relying instead on filing his own affidavits and the like. When a judge wanted to talk with his lawyer about one of the affidavits, the case was withdrawn because the lawyer had not been much involved in creating it.

McHardy has contacted more than 50 companies, Hemel said; the most recent cases hit his desk in April. After the netfilter announcement, McHardy went quiet for a bit, then picked up again in September 2016, before another quiet period; he is now active again. He has changed his strategy, however. Instead of going back to companies he has contacted before, he is contacting new companies that have not heard about him and his activities.

Radcliffe estimated that McHardy has gained €2m in the last 18 months. That is a lot "for someone not doing a good job", he said. He is concerned that someone will emulate McHardy or that some kind of firm will start financing these kinds of lawsuits.

In a brief comedic interlude, Hemel referred to Till Jaeger, who was the lawyer for multiple GPL enforcement suits brought by Harald Welte in Germany (and is currently involved in the VMware lawsuit). The real worry, Hemel said, is "a troll with a Till"; that would be a "trill" and be "very dangerous", he said with a grin.

McHardy has proven that copyright trolling is real, Coughlan said. That activity probably needed to be addressed faster and sooner by the community; other players will likely follow. Since we know the problem is real, the second step is to address it. Can we prevent this kind of thing in the future? Are there tools to help identify what has been contributed?

Hemel pointed to the newly released cregit tool as an easier way to extract information about "who inserted code into the kernel". (LWN covered a talk on the tool back in August 2016, before its release.) Using that and other tools to look at what McHardy has contributed to the kernel shows that there is a lot less code than most people think, Hemel said.

Governance

The community needs to look at project governance in light of all of this, Radcliffe said. Lots of open-source projects have fairly informal governance, which has served us well, he said. But there is now enough money involved that there is a need to rethink things.

There are some 13,500 contributors to the kernel, which makes for a lot of people who could turn into copyright trolls. Beyond that, some of those people will die and pass their rights onto their heirs who may have little interest in the ideals under which the original contributor operated. Some kind of litigation organization could also try to gather up the rights of contributors to use them in some kind of trolling activity, for example.

There is a need to think about what we as a community mean when we talk about compliance. 13,500 people all able to say what compliance means is not a workable scenario, Radcliffe said. For example, should the source and/or offer be allowed to come from a parent company? If not, every mom and pop reseller of Android phones would need to spin up a server to provide the source. There needs to be some agreement on the type of actions that require enforcement, he continued. Each project needs to think about it, because perfect compliance is impossible. New communities should be thinking about this up front with an eye to being as big as Linux some day. If they don't, they will get outliers disrupting the community.

If enough people start doing this copyright trolling, it could mean that companies start shifting away from Linux, Radcliffe said. Coughlan noted that some have said that Linux is too big to fail, but he does not think anything is. He has started to see some products that run FreeBSD, for example. Every community has social contracts, Coughlan said, without them, things become "nasty and brutish"—"and short", Radcliffe added. Coughlan wondered if there are other things that can be done to fight this kind of activity. If people are acting outside of the social contract, perhaps their code could be rewritten and replaced.

For McHardy's code, that may be a viable option, Hemel said. Obviously, it won't help for products that have already shipped, but ripping out McHardy's code would help for the future. Companies could hire a few developers to rewrite it. If you look at the money he has made and the cost in lawyers to handle the disputes, it comes to a loss of multiple millions of euros, he said.

Radcliffe agreed, saying that ripping out the code would provide a warning to the next person that considered doing this kind of thing. We don't know exactly what contributions McHardy is claiming, but Hemel found that McHardy has made a lot of non-copyrightable contributions, Radcliffe said. There is a need to find out what his claims are, but there are plenty of targets for the basic claims (no source and no offer); in any case, over time, McHardy has moved away from the more exotic claims. Some entities that use chips from manufacturers that do not comply with the licenses, though, are stuck. They cannot comply with the license themselves. It is important to stop all of this activity with McHardy, Radcliffe said, if he continues to benefit, it will attract others.

The book that he and Hemel just released starts with words from Douglas Adams, Coughlan said: "Don't panic". The most irritating thing is the amount of panic he has seen across the industry because of McHardy's actions. €2m is "nothing", he said, simply an irritant to an industry as large as ours. But it does provide a good wakeup call. What needs to happen, he said, is to guard against those who might see copyright trolling as something that "could be bigger than patents"; the community should "ensure that they land on spikes". He gave a shout-out to the netfilter team for raising awareness of what is going on.

To combat the problem there are "all sorts of options" that can be done with copyrights, he said. For example, copyrights could be sold to some entity that guarantees not to sell them to non-practicing entities (i.e. trolls). For hostile actors who violate the social contract, their code can be ripped out and replaced. There are, Coughlan said, plenty of ways to address this problem and now is the time to do so.

The Q&A session after that (under Chatham House Rule) was lively, with some strong opinions expressed. There was talk of codifying a social contract for our communities; putting together the various factions within the open-source community to help determine what that contract might look like is planned.

[I would like to thank Intel, the Linux Foundation, and Red Hat for their travel assistance to Barcelona for LLW.]