A successful defense against a copyright troll

At the 2018 Legal and Licensing Workshop (LLW), which is a yearly gathering of lawyers and technical folks organized by the Free Software Foundation Europe (FSFE), attendees got more details on a recent hearing in a German GPL enforcement case. Marcus von Welser is a lawyer who represented the defendant, Geniatech, in a case that was brought by Patrick McHardy. In the presentation, von Welser was joined by Armijn Hemel, who helped Geniatech in its compliance efforts. The hearing was of interest for a number of reasons, not least because McHardy withdrew his request for an injunction once it became clear that the judge was leaning in favor of the defendants—effectively stopping this case dead in its tracks.

Copyright trolling

Von Welser began by noting some of the reasons that Germany is an attractive venue for copyright trolls. It is inexpensive to file cases and the process is relatively quick. The practice of the courts in Germany is to issue an interim injunction without an oral hearing. In order to avoid that interim injunction, defendants must sign a cease-and-desist declaration that then subjects them to contractual fines. There is also a lack of transparency in the German court system, which allows trolls to operate largely anonymously.

The tactics used by McHardy are to first notify the company of the GPL violation and ask for a cease-and-desist declaration that would subject the company to a flexible contractual fine. If that is signed, it is followed up with another letter, pointing to a different GPL violation, that asks for a second cease-and-desist declaration with a fixed contractual fine. After that is signed, further violations are alleged, each of which comes with a request for the fines (which can be a five-figure value per infraction), along with further cease-and-desist declarations with even higher fines.

A timeline of the McHardy versus Geniatech case was then presented. The company received a letter from McHardy on July 17, 2017 requesting the first cease-and-desist declaration in order to avoid an interim injunction. Instead of signing it, the company replied a week later questioning some of McHardy's claims, which appeared to anger him. On July 26, he replied by terminating Geniatech's GPLv2 license on McHardy's netfilter contributions in the kernel. Hemel noted that there were two elements here that were quite different from most of McHardy's cases: the defendant did not sign the first warning and McHardy explicitly terminated his license to the code for the defendant.

In his filings, McHardy referred to the Linux kernel in general, not to a specific version or one that was tied to the firmware in Geniatech's product. In its reply to his first letter, Geniatech raised questions about McHardy's contributions to the kernel, noting that his contributions were not integral to the kernel itself. The regional court in Cologne did not understand, however, and granted an interim injunction on August 23 that stopped Geniatech from distributing (or even hyperlinking to) any version of the kernel.

Arguments

That injunction was appealed and there was an oral hearing at the higher regional court of Cologne on March 7, 2018, where McHardy eventually withdrew his application for an injunction. The arguments that Geniatech made at that hearing seemed to resonate with the judge, according to von Welser and Hemel.

McHardy claimed joint authorship in the kernel, which gave him the right to enforce the copyright of the whole, but Geniatech argued that McHardy's contributions were simply adaptations. The kernel was authored by Linus Torvalds and released under the GPLv2, which explicitly grants the right to modify the work. Modifying the work under that clause does not give rise to joint authorship, but were instead adaptations under German law. If it is not a work of joint authorship, McHardy could only enforce the copyrights of his changes, not those of the whole Linux kernel.

Beyond that, McHardy's arguments that his modifications are protected by copyright and were infringed by the defendant were not proven. He alleged that he contributed 50,000 lines of code over the years and provided a CD with the changelogs corresponding to those changes, but did not show that those modifications fulfilled the requirements for copyright protection. In addition, he did not show what parts of the modifications he made were actually used by the defendant.

Another argument that Geniatech used was that McHardy was abusing his rights by approaching multiple companies with the intent of gaining monetarily. This hurts more than just the companies involved; it harms the entire Linux ecosystem by making companies insecure in their use of the operating system, it argued. Hemel said that the judge had heard from colleagues about other companies that had suffered at the hands of McHardy, which helped this argument.

The final element of the abuse-of-rights argument concerned the revocation of the GPL terms for Geniatech by McHardy. This was done to raise pressure on the defendant. In his efforts to enforce the GPL, McHardy is not following community norms, specifically "The Principles of Community-Oriented GPL Enforcement", which prioritizes compliance and not financial gain. He is also not entitled to terminate his GPL grant to Geniatech as it does not comply with German law or the GPLv2 itself, von Welser said.

The final argument, which von Welser thought was "quite striking", was that that the scope of the interim injunction was too broad and not well defined. It enjoined Geniatech from distributing the Linux kernel, not some specific version or versions of the Geniatech firmware. There are more than 100 officially released versions of the kernel that do not include any contributions from McHardy, von Welser said. By ordering Geniatech not to distribute any version of the kernel, the court was covering kernels that were not even part of the dispute with McHardy.

After those arguments had been presented, McHardy and his lawyer discussed it over the telephone (McHardy was not present, according to Harald Welte's account that was linked above). At that point, the request to continue the injunction was withdrawn. McHardy is required to cover the costs of the proceedings, including court fees and lawyer costs for both sides.

Recommendations

The recommendations for companies contacted by McHardy "are quite obvious", von Welser said. They should refuse to sign the cease-and-desist declaration. They should then ensure GPL compliance for their products and prepare a legal defense strategy. That may be easier to do now, since there is more information available from this case. Those that sign the declaration generally do so in the hopes of avoiding a conflict altogether, but it is important to recognize that it likely will not succeed in doing that. Hemel added that if companies do end up signing something with McHardy, they should try to get rid of the confidentiality clause that he demands; shining more light on his tactics will help others defend against them.

In answer to a question from the audience, von Welser said that since there is no judgment, there is nothing to translate to English for others to study. He also noted that it sets no precedent since there was no ruling, but he thinks the arguments make logical sense and will be successful elsewhere.

James Bottomley noted that it was good to have fended off McHardy in this case, but wondered how legitimate (i.e. community-oriented) enforcement would be able to proceed in Germany. Von Welser said that McHardy was trying to make wide claims to make things simpler for himself. If he had showed which parts of the kernel he modified, demonstrated that these modifications are copyrightable (which is not difficult in Germany), and showed how those modifications were used by the defendant, he might have found a different reception by the court. Bottomley said that the goal should be to stop trolls like McHardy, but to still allow legitimate GPL enforcement for the kernel. Von Welser indicated that should still be possible.

[I would like to thank the LLW Platinum sponsors, Intel, the Linux Foundation, and Red Hat, for their travel assistance support to Barcelona for the conference.]