Netfilter project: Settlement with Patrick McHardy

The netfilter project, which works on packet-filtering for the Linux kernel, has announced that it has reached a settlement (English translation) with Patrick McHardy that is "legally binding and it governs any legal enforcement activities" on netfilter programs and libraries as well as the kernel itself. McHardy has been employing questionable practices in doing GPL enforcement in Germany over the last six years or more. The practice has been called "copyright trolling" by some and is part of what led to the creation of The Principles of Community-Oriented GPL Enforcement.

This settlement establishes that any decision-making around netfilter-related enforcement activities should be based on a majority vote. Thus, each active coreteam member at the time of the enforcement request holds one right to vote. This settlement covers past and new enforcement, as well as the enforcement of contractual penalties related to past declarations to cease-and-desist.

From:		Pablo Neira Ayuso <pablo-AT-netfilter.org>
To:		netfilter-announce-AT-lists.netfilter.org
Subject:		[ANNOUNCE] Settlement with Patrick McHardy
Date:		Mon, 24 Jan 2022 14:00:57 +0100
Message-ID:		<Ye6jCQm7z0Yr3bqA@salvia>
Cc:		netfilter-devel-AT-vger.kernel.org, netfilter-AT-vger.kernel.org, netdev-AT-vger.kernel.org
Archive-link:		Article

The netfilter project announces a settlement with Patrick McHardy.
This settlement is legally binding and it governs any legal enforcement
activities concerning all programs and program libraries published by
the netfilter/iptables project on its website [1] as well as the Linux
kernel [2]. Please, see the court order [3] (in German) and/or the
translation of the court order for further details [4].

After losing contact with Patrick in regard to questions about his
unilateral enforcement activities and his subsequent suspension from
the core team in 2016, three current and former core team members
decided to file a lawsuit against Patrick in 2020. During this
lawsuit, communication with Patrick was re-established in 2021, and a
settlement could be reached.

This settlement establishes that any decision-making around
netfilter-related enforcement activities should be based on a majority
vote. Thus, each active coreteam member [5] at the time of the
enforcement request holds one right to vote. This settlement covers
past and new enforcement, as well as the enforcement of contractual
penalties related to past declarations to cease-and-desist.

The netfilter project continues to endorse "The Principles of
Community-Oriented GPL Enforcement" [6]. Therefore, this settlement does
not release third parties from their obligations to comply with the
license [7] hereinafter.

The netfilter coreteam and I personally would like to thank everyone
that has been helping and supportive in these difficult years for making
possible this legal solution.

[1] https://www.netfilter.org
[2] https://www.kernel.org
[3] https://www.netfilter.org/files/2022-01-24-Beschluss_und_...
[4] https://www.netfilter.org/files/2022-01-24-Translation_Co...
[5] https://www.netfilter.org/about.html#coreteam
[6] http://www.netfilter.org/files/statement.pdf
[7] https://www.netfilter.org/licensing.html

Netfilter project: Settlement with Patrick McHardy

Posted Jan 24, 2022 15:38 UTC (Mon) by kleptog (subscriber, #1183) [Link] (11 responses)

The part I find most interesting about this is that the settlement specifies the Netfilter Core team which is something that (AFAICT) has no formal legal existence. In a normal situation you'd have a cooperative/association/whatever that has founding documents that determine who is in, who is out and who decides disputes. Here this all appears to be informal.

If someone were to hack the website and the Git repo to remove references to everyone else but them, do they become the Netfilter Core team?

I'm guessing that the role of the court here was to stamp the agreement, not to agree to its workability.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 24, 2022 15:46 UTC (Mon) by fenncruz (subscriber, #81417) [Link]

Then you just get to spend even more time with your lawyers and the judge first proving that you are the core team.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 24, 2022 16:14 UTC (Mon) by beagnach (guest, #32987) [Link] (9 responses)

The netfilter core team has a long <strikethrough>paper-</strikethrough>trail in the form of email announcements and other interactions with the wider community. It would be very very hard for someone to plausibly make a false claim in this regard. Also I don't think that courts absolutely require formal incorporation to accept the validity of a group acting as an entity, someone with appropriate expertise might care to comment on that aspect.

Bottom line - the current informal nature of the netfilter core team doesn't nullify the effectiveness of the settlement, but it may well be wise for them to move to some more formal arrangement.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 24, 2022 16:56 UTC (Mon) by anselm (subscriber, #2796) [Link] (7 responses)

Also I don't think that courts absolutely require formal incorporation to accept the validity of a group acting as an entity, someone with appropriate expertise might care to comment on that aspect.

German law stipulates that if a number of people (such as the “netfilter core team”) act together towards a common goal even without incorporating, they form a “Gesellschaft bürgerlichen Rechts” (GbR, roughly translatable as “civil-law association”), even in the absence of a written agreement, so given that this is taking place in Germany, that should be OK. If a GbR participates in commerce as its own entity, it has an independent legal existence (e.g., it – rather than its individual members – can sue someone or be sued by someone), even though its members are personally liable for any debts that it incurs.

(Disclaimer: not a lawyer.)

Netfilter project: Settlement with Patrick McHardy

Posted Jan 24, 2022 20:35 UTC (Mon) by Wol (subscriber, #4433) [Link]

Similar to an English Partnership, although I suspect over here there may need to be at least some form of formal agreement.

Cheers,
Wol

Netfilter project: Settlement with Patrick McHardy

Posted Jan 24, 2022 22:35 UTC (Mon) by warrax (subscriber, #103205) [Link]

Sounds like a "forening" in Denmark. (Which is of course a cognate of vereinung, but doesn't mean quite the same thing.)

It's just a loose association of people with a stated common purpose. I do think there is a (probably vague) legal requirement that they do have a have agreed-upon bylaws, where some parts have to be spelled out, e.g. "how are the bylaws changed, by percentage of votes", etc...

Netfilter project: Settlement with Patrick McHardy

Posted Jan 25, 2022 7:46 UTC (Tue) by t-v (guest, #112111) [Link] (4 responses)

From reading the (German) settlement:
The settlement is between Pablo Neira Ayuso, Harald Welte, and József Kadlecik as the plaintiffs and Patrick McHardy as the respondent, so it is legally binding to those four as individuals. They have the requirement to seek agreement for copyright complaints around netfilter that they want to file.
Third parties can recur to this requirement as a defense to claims brought by any of them.
There is no association being formed here between them.
An interesting detail is that the plaintiffs bear the costs of the lawsuit, but I guess this is the compromise part of getting a settlement. Also, there are two cases listed as exempt, I don't know what these are.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 25, 2022 7:57 UTC (Tue) by bosyber (guest, #84963) [Link] (2 responses)

The two exempt cases I indeed also didn't find out what they are, but it might well just be because they are currently going on (no verdict yet in either), so (not-a-lawyer-not-even-in-DE) that this settlement cannot (automatically) end those, possibly because other parties are (also) involved, for example, companies that are being sued for copyright infringement. The settlement might end up playing a role there though.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 25, 2022 15:06 UTC (Tue) by armijn (subscriber, #3653) [Link] (1 responses)

There actually is a verdict in the first case (and has been for a bit over 4 years as it was decided in November 2017): https://dejure.org/ext/945f91adbb3ce04fcddbfa5d83994382

Netfilter project: Settlement with Patrick McHardy

Posted Jan 26, 2022 13:12 UTC (Wed) by bosyber (guest, #84963) [Link]

Ah, thanks. Sorry, I guess my lack of practice in looking for Hamburg and other German court documents showing there.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 25, 2022 8:58 UTC (Tue) by anselm (subscriber, #2796) [Link]

There is no association being formed here between them.

As a matter of fact there is (in German civil law, the GbR is, so to speak, the “default case” of associations, which happens automatically when some people act together towards a common goal – no explicit written or oral agreement is required, it can be implied in fact), but as long as they sued McHardy in their own personal capacity and not as “the Netfilter core team”, that association does not appear as a separate legal entity.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 27, 2022 11:09 UTC (Thu) by NAR (subscriber, #1313) [Link]

But what happens if there's a fallout between the members of the core team? Someone is kicked out, but the kicked out person does not accept this? OK, in this case the project has probably lot of other problems too...

Netfilter project: Settlement with Patrick McHardy

Posted Jan 24, 2022 20:08 UTC (Mon) by flussence (guest, #85566) [Link] (16 responses)

Overall, this is a relief. McHardy's actions were, by the most literal definition, terrorism. The sort of thing you'd expect from BSA members like Microsoft. Targets prioritised by the depth of their pockets, not their infringement.

Yet at the same time it looks like we're back to the status quo of "go ahead and steal this code, ship your semi-proprietary embedded junk and never upstream anything, the LF won't ever care". (Maybe we were already there according to the adjacent article about RYF, but it's more obvious now)

Netfilter project: Settlement with Patrick McHardy

Posted Jan 24, 2022 20:33 UTC (Mon) by Wol (subscriber, #4433) [Link] (5 responses)

Thing is, I believe it's true in America, and it's likewise probably true over here in Britain, you cannot be bound by a court decision where you were not involved. So this agreement is in many ways brilliant.

Netfilter can carry on as they were, decisions are made by the core team. Hardy can NOT take any action against violators of Netfilter, the kernel, or anything else covered by the agreement, without the agreement and consent of the Netfilter core team (which of course they are extremely unlikely to agree to).

But everybody else can just ignore the agreement. I'm not a German national, I don't (and never have) lived there. If I were a kernel copyright holder suing in the High Court, how (or why!!!) am I supposed to know anything about some obscure legal agreement in some provincial German court?

Hardy however, whether or not he has any personal link to Germany, chose it as his jurisdiction of choice to be plaintiff. He therefore chose to give Germany jurisdiction over himself.

Cheers,
Wol

Netfilter project: Settlement with Patrick McHardy

Posted Jan 24, 2022 22:39 UTC (Mon) by warrax (subscriber, #103205) [Link] (3 responses)

> Thing is, I believe it's true in America, and it's likewise probably true over here in Britain, you cannot be bound by a court decision where you were not involved.

Define "you were not involved".

Netfilter project: Settlement with Patrick McHardy

Posted Jan 25, 2022 2:49 UTC (Tue) by felixfix (subscriber, #242) [Link] (2 responses)

If parties A and B reach a legal settlement to some dispute, their agreement has no hold on parties C, D, ... This shows up, for instance, when party A wins a libel lawsuit against party B and tries to make Google or a website stop referencing the result.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 27, 2022 20:27 UTC (Thu) by kpfleming (subscriber, #23250) [Link] (1 responses)

Rather off-topic, but the massive 'settlement' in the US between Purdue Pharma/its owners and various state governments included just such a provision: once accepted (it's since been un-accepted), no third party could bring a claim against the defendants, they were granted immunity from third-party claims as part of the settlement. This was a ludicrous thing for anyone to agree to, but it happened.

I would have loved to see a large, well-financed, third-party bring a suit anyway if the settlement had been fully implemented, just to see the judge in that case throw out the 'defense' that this unrelated case provided immunity.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 28, 2022 14:44 UTC (Fri) by farnz (subscriber, #17727) [Link]

AIUI (not a lawyer), the legal theory behind that provision was that the state governments were a party to the settlement, and thus could prohibit use of their courts for suing the defendant. Would have been fun to see that tested in court…

Netfilter project: Settlement with Patrick McHardy

Posted Jan 25, 2022 7:48 UTC (Tue) by bosyber (guest, #84963) [Link]

Well, that's sort of true. But in order to use netfilter code to do so, you do need a copyright in netfilter.

Also, and especially after this settlement, a company that you have a McHardy like go at would seem to be encouraged to get in contact with the netfilter core team to work out a way forward, which does hamper the potential threatening nature of any action you take. In the end a valid copyright claim remains a valid copyright claim, so sure everyone who (believes they) has(ve) one is allowed to pursue that against an infringing company, and the best solution for companies remains to be in compliance, but when not, it does seem that working with them constructively has the most effect for the future to resolve things if they hadn't properly clearly done that before.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 25, 2022 9:36 UTC (Tue) by xophos (subscriber, #75267) [Link] (8 responses)

I don't follow. Even disregarding the doubious practice of calling anything you disagree with terrorism, i see any GPL enforcement as good.
Prioritizing targets with deep pockets results in more press coverage and (in case of success) therefor more motivation for other parties to avoid becoming a target by complying without waiting for a lawsuit.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 25, 2022 15:01 UTC (Tue) by Paf (subscriber, #91811) [Link] (2 responses)

I would encourage you to read up on details of McHardy’s practices. They were clearly not done in good faith and there was no attempt to encourage compliance. The only goal was to extract as much money as possible even if the violations were more technical or incidental in nature and the companies willing to attempt remedy. Even minor and unintentional violations were pursued zealously without interest in remedy - just cash.

My understanding is he also didn’t truly prioritize deep pocketed violators (no suit against VMWare, afaik) - he prioritized that delicious sweet spot of “deep enough to pay me off, but too small to make it realistic to fight me in court”. And, again, he was uninterested in remediation of even minor and unintentional violations - he wanted cash. It seems unlikely this was helping the cause of free software.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 25, 2022 17:54 UTC (Tue) by mdolan (subscriber, #104340) [Link] (1 responses)

Paf, that is all correct. The damage done to Netfilter as a brand has been considerable - Pablo and the team have had a lot of unwanted stress because of McHardy's actions.

Netfilter project: Settlement with Patrick McHardy

Posted Mar 19, 2025 12:58 UTC (Wed) by paulj (subscriber, #341) [Link]

For the casual reader, Mike Dolan is a long-standing executive at a trade association - the Linux Foundation - representing commercial corporate interests, at least some of whom are GPL violators.

Netfilter project: Settlement with Patrick McHardy

Posted Jan 28, 2022 22:21 UTC (Fri) by flussence (guest, #85566) [Link] (4 responses)

Netfilter project: Settlement with Patrick McHardy

Posted Feb 1, 2022 12:22 UTC (Tue) by jezuch (subscriber, #52988) [Link] (3 responses)

In related news, Cory Doctorow recently wrote about Creative Commons trolling: https://doctorow.medium.com/a-bug-in-early-creative-commo...

Netfilter project: Settlement with Patrick McHardy

Posted Feb 7, 2022 0:15 UTC (Mon) by flussence (guest, #85566) [Link] (2 responses)

Oh, this is tiresome. Between this and the CC org endorsing NFTs recently, maybe it's time to find a more modern replacement.

Netfilter project: Settlement with Patrick McHardy

Posted Feb 7, 2022 4:37 UTC (Mon) by pabs (subscriber, #43278) [Link] (1 responses)

The trolling wasn't done by the CC org though? Can you link to the NFT thing? :(

Netfilter project: Settlement with Patrick McHardy

Posted Feb 7, 2022 12:39 UTC (Mon) by mathstuf (subscriber, #69389) [Link]

It seems to have happened on Twitter which I don't really feel like digging into right now. There was this article[1] last May and an overview of whatever happened in December from Gizmodo[2].

[1]https://creativecommons.org/2021/05/04/at-the-intersectio...
[2]https://gizmodo.com/wait-are-nfts-the-new-creative-common...

Netfilter project: Settlement with Patrick McHardy

Posted Jan 25, 2022 20:43 UTC (Tue) by developer122 (guest, #152928) [Link]

>Maybe we were already there according to the adjacent article about RYF, but it's more obvious now

The Problems that RYF tries and fails to solve are unrelated to copyright. There's no open-source code in any of these silicon vendor's bring-up blobs. They're written from scratch (and for practical reasons have to be) to bring-up their specific hardware. Writing configuration values, calibrating receivers they designed, etc.

These then find their way into open source and proprietary products alike, because without them the system simply doesn't work. Without using synopsys's DDR4 PHY blob (through secondary-processor obfuscation), the librem phone wouldn't have any ram.

But the argument that "these blobs should be open-source because they interact with open source code" like uboot doesn't hold water. They're provided to all users of the chip, open source and proprietary alike, and it's the vendor's right to choose the licence of code that's 100% theirs. The open source projects then have to decide if they can legally pick it up and use it.

In the end, it all comes back to nurturing open hardware where the bringup code is written open in the first place.