Developments in the FOSS response to Copilot and related technologies [LWN.net]

Back in July, the Free Software Foundation (FSF) put out a call for white papers to explore the issues around GitHub's Copilot AI-assisted programming tool, especially with regard to copyleft licensing; each selected white paper was awarded $500. The FSF has now published five of the submissions that the organization thought "advanced discussion of important questions, and did so clearly".

In our call for papers, we set forth several areas of interest. Most of these areas centered around copyright law, questions of ownership for AI-generated code, and legal impacts for GitHub authors who use a GNU or other copyleft license(s) for their works. We are pleased to announce the community-provided research into these areas, and much more.
First, we want to thank everyone who participated by sending in their papers. We received a healthy response of twenty-two papers from members of the community. The papers weighed-in on the multiple areas of interest we had indicated in our announcement. Using an anonymous review process, we concluded there were five papers that would be best suited to inform the community and foster critical conversations to help guide our actions in the search for solutions.

One of the submissions published was from Policy Fellow at Software Freedom Conservancy, Bradley M. Kuhn; that organization has announced the formation of a committee to "develop recommendations and plans for a Free and Open Source Software (FOSS) community response to the use of machine learning tools for code generation and authorship". A public ai-assist mailing list has been set up for discussions. "The inaugural members of the Committee are: Matthew Garrett, Benjamin Mako Hill, Bradley M. Kuhn, Heiki Lõhmus, Allison Randal, Karen M. Sandler, Slavina Stefanova, John Sullivan, David ‘Novalis’ Turner, and Stefano ‘Zack’ Zacchiroli."

to post comments

Developments in the FOSS response to Copilot and related technologies

Posted Feb 25, 2022 19:23 UTC (Fri) by ballombe (subscriber, #9523) [Link] (14 responses)

I have read this one Copyright Implications of the Use of Code Repositories to Train a Machine Learning Model and the facts are not correct. It states

Users of GitHub are generally the authors of the code they write and upload, and therefore own the copyright to it.

This is not the case. It is very common for github users to upload FOSS project they did not write to github. I do not have a github account and about all the GPL code I ever wrote has been uploaded to github by someone else. github does not make any attempt to ascertain that code is only uploaded by the copyright holder.

Users who wish to deposit their code into a GitHub repository must agree to the website’s Terms of Service. These terms grant GitHub certain rights to use the code in ways that might otherwise infringe the user’s copyright

If they are not the copyright holders and the copyright holders did not agree to github TOS, how can they grant any right to the code ?

Developments in the FOSS response to Copilot and related technologies

Posted Feb 25, 2022 20:48 UTC (Fri) by NYKevin (subscriber, #129325) [Link] (13 responses)

GitHub already thought of that. From their TOS:

> You retain ownership of and responsibility for Your Content. If you're posting anything you did not create yourself or do not own the rights to, you agree that you are responsible for any Content you post; that you will only submit Content that you have the right to post; and that you will fully comply with any third party licenses relating to Content you post.
>
> Because you retain ownership of and responsibility for Your Content, we need you to grant us — and other GitHub Users — certain legal permissions, listed in Sections D.4 — D.7. These license grants apply to Your Content. If you upload Content that already comes with a license granting GitHub the permissions we need to run our Service, no additional license is required. You understand that you will not receive any payment for any of the rights granted in Sections D.4 — D.7. The licenses you grant to us will end when you remove Your Content from our servers, unless other Users have forked it.

The permissions listed in those sections are a rather narrow subset of the Four Freedoms, specialized to GitHub (for example, you must give anyone in the world permission to make and distribute forks of your repository, through the GitHub platform - but most if not all FOSS licenses give permission for anyone to make and distribute forks through any platform, GitHub included). Therefore, even if you have never directly interacted with GitHub, if your code is under a "reasonable" FOSS license, then that license already gives GitHub all of the rights described in their TOS anyway.

(If it's not under a "reasonable" FOSS license, then uploading it to GitHub would violate the TOS.)

Developments in the FOSS response to Copilot and related technologies

Posted Feb 26, 2022 14:25 UTC (Sat) by ldearquer (guest, #137451) [Link] (8 responses)

> You retain ownership of and responsibility for Your Content

If this is copyright ownership, certainly not many do.

Then it goes

> If you're posting anything you did not create yourself or do not own the rights to （...）

So you can upload sthg you don't "own"? As long as you are responsible for it, have the right to post and comply with its license

Yet later on it goes

> Because you retain ownership of and responsibility for Your Content, we need you to (...)

Maybe that "and" should be an "or". Or maybe I am misreading all this. But if it is the former, these lawyers need some static analysis tool for what they write :)

Developments in the FOSS response to Copilot and related technologies

Posted Feb 26, 2022 15:03 UTC (Sat) by mpr22 (subscriber, #60784) [Link] (7 responses)

Reading isolated excerpts from contracts (and other contract-adjacent things such as copyright licences) can be a good way to achieve misunderstanding.

In the GitHub TOS, "Content" and "Your Content" (thus capitalized) are distinct concepts, the latter being a subset of the former. GitHub Terms of Service, Section A, Paragraph 4 reads:

“Content” refers to content featured or displayed through the Website, including without limitation code, text, data, articles, images, photographs, graphics, software, applications, packages, designs, features, and other materials that are available on the Website or otherwise available through the Service. "Content" also includes Services. “User-Generated Content” is Content, written or otherwise, created or uploaded by our Users. "Your Content" is Content that you create or own.

Developments in the FOSS response to Copilot and related technologies

Posted Feb 26, 2022 15:26 UTC (Sat) by ldearquer (guest, #137451) [Link] (6 responses)

Thanks for clarifying.

However, I wonder how github distinguishes Content from Your Content, so they can know on what portion of what you uploaded they have been granted D.4-D.7 permissions through this mechanism, or whatever they else claim on their agreement.

Developments in the FOSS response to Copilot and related technologies

Posted Feb 26, 2022 22:10 UTC (Sat) by NYKevin (subscriber, #129325) [Link] (5 responses)

They don't maintain such a distinction in practice. Instead, they require that all Content (including, but not limited to Your Content) grants them D.4-D.7. If you upload Content (which is not Your Content), and that Content includes a typical FOSS license, then that license very likely satisfies those requirements already. If it does not include a typical FOSS license, then you have violated the TOS and they can take the Content down whenever they discover it.

Developments in the FOSS response to Copilot and related technologies

Posted Feb 26, 2022 23:54 UTC (Sat) by ldearquer (guest, #137451) [Link] (3 responses)

I'd say the way you just wrote this down is better, probably more correct and shorter than what their team of lawyers did with section D of TOS.

Where ownership is not established, which seems not to be uncommon, they are entitled to what the Content license grants them, period; just like anyone else. With no distinction between Content and Your Content, all the "you grant us" wording is useless. Github would not have any more rights than any other user.

In particular, couldn't this be problematic (D.7)?
> To the extent this agreement is not enforceable by applicable law, you grant GitHub the rights we need to use Your Content without attribution (...)

If I upload Joe's FOSS-attribution licensed code to Github, no matter how many rights I give Github on my own content, they have no more right to use Joe's code without attribution than you or me.

So, in theory, any FOSS license with attribution clause (for Content not Your Content) would be in breach of the TOS.

Developments in the FOSS response to Copilot and related technologies

Posted Feb 27, 2022 0:52 UTC (Sun) by NYKevin (subscriber, #129325) [Link] (2 responses)

Stop pulling individual lines of the TOS out of context. Here is the full quote of that section[1]:

> 7. Moral Rights
> You retain all moral rights to Your Content that you upload, publish, or submit to any part of the Service, including the rights of integrity and attribution. However, you waive these rights and agree not to assert them against us, to enable us to reasonably exercise the rights granted in Section D.4, but not otherwise.
>
> To the extent this agreement is not enforceable by applicable law, you grant GitHub the rights we need to use Your Content without attribution and to make reasonable adaptations of Your Content as necessary to render the Website and provide the Service.

There are at least two problems with your analysis:

1. You conflated Your Content with Content. That paragraph is about Your Content, not about Content. So "Joe's FOSS-attribution licensed code" is not relevant here.
2. This whole section is about moral rights, which function differently to copyright and require more specialized language. They often cause problems for more careful FOSS licensors, and you will find similar wording in CC-BY-SA[2]:

> Moral rights, such as the right of integrity, are not licensed under this Public License, nor are publicity, privacy, and/or other similar personality rights; however, to the extent possible, the Licensor waives and/or agrees not to assert any such rights held by the Licensor to the limited extent necessary to allow You to exercise the Licensed Rights, but not otherwise.

[1]: https://docs.github.com/en/github/site-policy/github-term...
[2]: https://creativecommons.org/licenses/by-sa/4.0/legalcode#...

Developments in the FOSS response to Copilot and related technologies

Posted Feb 27, 2022 16:48 UTC (Sun) by ldearquer (guest, #137451) [Link] (1 responses)

> Stop pulling individual lines of the TOS out of context.

I did read the section carefully several times, and copied the part that was relevant to the discussion. In case I was missing something, I indicated clearly the source (section D.7 from Gihub TOS). For proper context, I would need to copy half the TOS, including the glossary.

Saying attribution is a moral right is pretty much legal redundancy (it is quite established in most jurisdictions). If anything, it reinforces Joe's argument, since moral rights are not even transferable in most cases.

> 1. You conflated Your Content with Content. That paragraph is about Your Content, not about Content. So "Joe's FOSS-attribution licensed code" is not relevant here.

Well, yes, this is exactly my point. I did not conflate anything.

Developments in the FOSS response to Copilot and related technologies

Posted Feb 28, 2022 2:23 UTC (Mon) by NYKevin (subscriber, #129325) [Link]

> Well, yes, this is exactly my point. I did not conflate anything.

Then why did you falsely claim that uploading Joe's code would violate the ToS, when the specific clause of the ToS you quoted is obviously inapplicable to Joe's code?

Developments in the FOSS response to Copilot and related technologies

Posted Mar 3, 2022 11:48 UTC (Thu) by Rigrig (subscriber, #105346) [Link]

> they can take the Content down whenever they discover it.

But can/will they make the bot forget about it?

Developments in the FOSS response to Copilot and related technologies

Posted Feb 26, 2022 22:55 UTC (Sat) by ballombe (subscriber, #9523) [Link] (3 responses)

Note that the issue I raise is in the paper, not in github TOS.

Developments in the FOSS response to Copilot and related technologies

Posted Feb 27, 2022 0:47 UTC (Sun) by NYKevin (subscriber, #129325) [Link]

The paper is being slightly sloppy here, but it hardly matters, because GitHub gets the D.4-7 rights either from the uploader or from the FOSS license, so they have those rights no matter what.

Developments in the FOSS response to Copilot and related technologies

Posted Feb 27, 2022 1:57 UTC (Sun) by jthill (subscriber, #56558) [Link] (1 responses)

This may seem a nitpick, but they did not "write and upload" the code you wrote.

Developments in the FOSS response to Copilot and related technologies

Posted Feb 27, 2022 10:18 UTC (Sun) by ballombe (subscriber, #9523) [Link]

Certainly, but then the paper needs to address this alternative, and not dismiss it with "generally".

Developments in the FOSS response to Copilot and related technologies

Posted Feb 27, 2022 19:39 UTC (Sun) by developer122 (guest, #152928) [Link] (3 responses)

The FSF has a vested interest in extending the reach of licences they control, and in selecting opinions that support that.

As noted by Matthew Garrett however, this may not necessarily benefit Free Software.

https://mjg59.dreamwidth.org/57615.html

Developments in the FOSS response to Copilot and related technologies

Posted Mar 1, 2022 8:09 UTC (Tue) by LtWorf (subscriber, #124958) [Link]

I don't think the argument makes any sense.

The gigantic corporations with many lawyers already do whatever they want. For example they already routinely violate GPL and very little can be done to stop it.

Weakening the GPL would make it even harder to scare companies into complying with the terms.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 1, 2022 18:11 UTC (Tue) by JoeBuck (subscriber, #2330) [Link] (1 responses)

Matthew Garrett writes:

If Github's interpretation of copyright law holds, we can train a model on proprietary code and extract concepts without having to worry about being tainted.

That's a good point. Perhaps the resolution of this issue should be that Copilot includes Microsoft's proprietary software in their training set, which they can do because Github is owned by Microsoft. This would benefit Windows programmers, presumably, since lots of examples of correct use of Microsoft APIs would be included. If their argument that use of FLOSS to train their model is fair use, then use of Microsoft source code for this purpose should also be fair use.

If Microsoft/Github is unwilling to do this, then that's an argument against them, and perhaps some other party that has access to Microsoft source code under license could do it, using Copilot as a justification.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 26, 2022 21:49 UTC (Sat) by JanC_ (subscriber, #34940) [Link]

Now you assume Microsoft’s use of Windows APIs is exemplary. You might recall that they got caught using secret hidden API functions or API parameters several times in the past to get an advantage over competitors, and then after they were discovered in some cases went on to booby trap such functions when they were used slightly differently by those competitors…

Developments in the FOSS response to Copilot and related technologies

Posted Feb 28, 2022 23:28 UTC (Mon) by LtWorf (subscriber, #124958) [Link]

> Since GitHub’s purpose in copying the deposited code is not to sort lists, etc., but rather to enable developers to create new programs more easily, a court might find that this factor supports a finding of fair use.

(from https://www.fsf.org/licensing/copilot/copyright-implicati...)

Except that the new code is still code to sort lists and nothing more than that.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 1, 2022 20:43 UTC (Tue) by timrichardson (subscriber, #72836) [Link] (22 responses)

Can an open source licence prohibit bots from using the code, while remaining an open-source licence? We know that open source licences can't discriminate against classes of users, but where does this leave bots?

Developments in the FOSS response to Copilot and related technologies

Posted Mar 1, 2022 20:58 UTC (Tue) by rahulsundaram (subscriber, #21946) [Link] (2 responses)

> We know that open source licences can't discriminate against classes of users, but where does this leave bots?

We can't discriminate against bots unless we can identify them in the first place.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 12, 2022 22:43 UTC (Sat) by immibis (subscriber, #105511) [Link] (1 responses)

Licenses are read by humans rather than computers, so identifying bots is trivial. However, defining what a bot *is* is not trivial. Does your license accidentally make it illegal to wget the code?

Developments in the FOSS response to Copilot and related technologies

Posted Mar 13, 2022 12:02 UTC (Sun) by rahulsundaram (subscriber, #21946) [Link]

> However, defining what a bot *is* is not trivial.

Defining what anything is, is the first step towards identifying it.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 1, 2022 21:33 UTC (Tue) by NYKevin (subscriber, #129325) [Link] (2 responses)

It depends on what you mean by "use":

1. Under US law, you probably can't prevent anyone from "using" the code without some sort of EULA (and maybe not even then, depending on which lawyer you ask). See 17 USC 117.[1] But this covers a very narrow definition of "use" (i.e. running the code, or making a backup copy). I have no idea if this provision exists in any other country's copyright law, but I rather doubt that it would be worded exactly the same.
2. There are a variety of other limitations and exceptions to copyright, notably the idea-expression divide, the merger doctrine, scènes à faire, fair use, etc., and you probably can't restrict any of those, either. But those details will also vary by jurisdiction.
3. If by "use" you mean "reproduce or modify in a way that is prohibited by copyright law," then you can impose the usual copyleft restrictions on the code, and bots are just as bound by those restrictions as humans would be. This is not a violation of the OSD or the DFSG; copyleft is well-established as a legitimate restriction in a FOSS license, and "it's hard to comply" is not a valid reason to disregard such a restriction.
4. If the bot complies with all of the terms of the license, then you probably can't restrict it (and still be OSD/DFSG compliant).

[1]: https://www.law.cornell.edu/uscode/text/17/117

Developments in the FOSS response to Copilot and related technologies

Posted Mar 2, 2022 0:34 UTC (Wed) by timrichardson (subscriber, #72836) [Link] (1 responses)

What I meant was that the OSI is a gatekeeper for what is an open source licence and what is not. The MongoDB/ElastiSearch approach (Server Side Public License) got blocked because it took rights away from commercial users of a certain type, which the OSI said is discrimination by user class, which is not allowed to be open source. Would the OSI remove open source certification from a licence that did not allow certain types of automated reuse, or use as training data?

I suppose it is a moot point; it is pretty clear form the work done in those articles that copyright law won't stop it (fair use on the basis of transformation).

Developments in the FOSS response to Copilot and related technologies

Posted Mar 2, 2022 1:46 UTC (Wed) by NYKevin (subscriber, #129325) [Link]

> Would the OSI remove open source certification from a licence that did not allow certain types of automated reuse, or use as training data?

I'm not aware of anybody having proposed such a license in the first place. If such automated use is subject to copyright law (which GitHub contends is not the case), then the automated use would need to comply with the license conditions like anyone else, of course, but that's an entirely different animal to a license that flat-out says "no automated use ever." Such a (hypothetical) license probably would not be Open Source by the OSI's definition.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 2, 2022 13:57 UTC (Wed) by rgmoore (✭ supporter ✭, #75) [Link] (15 responses)

My question with all of this is how you can restrict the ability to train bots on the code without violating the 1st Free Software Freedom:

The freedom to study how the program works, and change it so it does your computing as you wish (freedom 1).

Having a bot read the code in an attempt to teach it how to program seems like it falls squarely within this freedom. Unless you're going to claim that showing the software to a bot is fundamentally different from showing the code to a human, you have to let bots train on the code to fall within the Free Software Foundation's definition of what constitutes Free Software.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 2, 2022 14:34 UTC (Wed) by anselm (subscriber, #2796) [Link] (14 responses)

Arguably the problem isn't bots reading the code, it is bots reading the code and then incorporating nontrivial swathes of it into code they generate without attaching the proper license (e.g., the GPL). Obviously if a bot was trained exclusively on GPL code, then its output would also have to fall under the GPL. In a mixed-code environment, if the bot produced code with a GPL license grant at the start if and when appropriate, then nobody would be in a position to complain.

Whether this is actually required hinges on the question of whether what the bot outputs is a “derived work” (in the copyright-law sense) of the original GPL'ed code. If there are recognisable pieces (as in, idiosyncratic sequences of statements, not just isolated instances of i = i + 1) of the original code evident in the bot's output then it could reasonably be argued that that is in fact the case.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 2, 2022 16:25 UTC (Wed) by nybble41 (subscriber, #55106) [Link] (4 responses)

> Obviously if a bot was trained exclusively on GPL code, then its output would also have to fall under the GPL.

[citation needed]

That isn't true for humans who learned programming exclusively from GPL code, and I don't see why it would be true for bots either. It would depend on whether the bot's output incorporates enough recognizable "creative elements" from the code it was trained on to qualify as a copy or derivative work of any specific input. Depending on how the training goes, the output could be considered original (or at least free of any copyrightable elements) rather than derivative.

Of course, ensuring that this is the case is a hard problem since we don't even have a clear standard for what counts as a "creative element" in software. The only way to get an authoritative answer—asking a court to rule on each instance——obviously doesn't scale. Incorporating feedback from a code-oriented plagiarism detector would be a good start, though you can't expect high accuracy.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 2, 2022 18:34 UTC (Wed) by awww (guest, #122021) [Link] (1 responses)

I'm still waiting to see anything that's genuinely creative and not just statistically plausible.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 2, 2022 18:54 UTC (Wed) by rgmoore (✭ supporter ✭, #75) [Link]

Note, though, that creativity of the bot is not the issue. Under current US law, for example, nothing an AI produces is subject to copyright even if it appears to be extremely creative. Only human beings can create works that are covered by US copyright. Animals, AIs, and the like aren't covered.

The key question is whether the bot's output is automatically derivative of the training material. Under copyright, it is not a derivative unless it incorporates copyrightable elements of the training corpus. If the bot's output is sufficiently different from any of the training corpus, or if the material it incorporates isn't creative enough to be copyrightable, then the work isn't a derivative as defined by copyright law. Since the GPL depends on the copyright definition of a derivative work to constrain what you can do with the code, any code produced by the bot that doesn't count as derivative under copyright law isn't covered.

The only question, then, is whether the bot itself a derivative work of all the code in the training corpus. This is something that would have to be tested in court, but I sincerely doubt the bot would be considered a derivative under copyright law. You can't look at the bot and find the training corpus anywhere, which is the normal test you would use to determine if it is a derivative. Even if you get over that hurdle, it's likely to be considered fair use, since the use of the training corpus is highly transformative.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 6, 2022 0:44 UTC (Sun) by anguslees (subscriber, #7131) [Link] (1 responses)

> asking a court to rule on each instance——obviously doesn't scale.

... Until we replace judges with bots and automate court rulings. Seems like a reasonable application of some very similar ML to me..

Developments in the FOSS response to Copilot and related technologies

Posted Mar 6, 2022 15:07 UTC (Sun) by mathstuf (subscriber, #69389) [Link]

Given that the pipeline for knowing the answer to any given instance is measured in "months" at best, I think I'd expect enough training data to be ready by the next ice age.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 2, 2022 18:37 UTC (Wed) by rgmoore (✭ supporter ✭, #75) [Link] (1 responses)

Obviously if a bot was trained exclusively on GPL code, then its output would also have to fall under the GPL.

That's not how copyright works, and thus not how the GPL works. Copyright covers only expression, not ideas. A work is only considered derivative if it contains copyrightable elements from the work it's a derivative of. If you can't find those in the code the bot produces, it can't be considered as a derivative work, and thus the provisions of the GPL wouldn't apply to it.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 2, 2022 20:01 UTC (Wed) by anselm (subscriber, #2796) [Link]

A work is only considered derivative if it contains copyrightable elements from the work it's a derivative of. If you can't find those in the code the bot produces, it can't be considered as a derivative work, and thus the provisions of the GPL wouldn't apply to it.

That's what I meant when I wrote “If there are recognisable pieces (as in, idiosyncratic sequences of statements, not just isolated instances of i = i + 1) of the original code evident in the bot's output …”. You can't use an AI-type bot to circumvent the GPL any more than you can use a program that rearranges the order of functions in the source file.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 3, 2022 2:46 UTC (Thu) by pabs (subscriber, #43278) [Link]

> If there are recognisable pieces of the original code evident in the bot's output

This has already happened for GPL code, Copilot spit out a function of Quake 1 GPL code verbatim, including the swearwords:

https://twitter.com/mitsuhiko/status/1410886329924194309
https://news.ycombinator.com/item?id=27710287

Developments in the FOSS response to Copilot and related technologies

Posted Mar 3, 2022 9:15 UTC (Thu) by anton (subscriber, #25547) [Link] (5 responses)

Can the bot cannot guarantee that it does not produce a copyright-relevant derived work of the sources it is trained from? It probably cannot, and that's what's relevant to those who want to integrate the code into their software. It's irrelevant that there is no guarantee that the code is a derived work.

One way to deal with this is to have bots trained on different code bases: A bot trained on GPL-compatible code would produce code that can be distributed under the terms of the GPL (copyright attribution and enforcement would be interesting), while a bot trained on code under proprietariable licences (e.g., BSD) and public domain code only would produce code that could be distributed as part of proprietary code.

The argument that distributing code under a GPL-compatible copyleft license gives free software a head start over proprietary software would see another area of application: The bot that produces code that can be distributed under the terms of the GPL has more training data and is expected to produce better results than the bot that is only trained on proprietary-compatible free code.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 3, 2022 9:51 UTC (Thu) by mjg59 (subscriber, #23239) [Link] (4 responses)

> Can the bot cannot guarantee that it does not produce a copyright-relevant derived work of the sources it is trained from?

No, because we don't have a lot of meaningful case law around what a derivative work is when humans aren't involved. Without that, we can't figure out what a guarantee actually means in this situation.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 3, 2022 14:09 UTC (Thu) by anselm (subscriber, #2796) [Link] (3 responses)

No, because we don't have a lot of meaningful case law around what a derivative work is when humans aren't involved.

I haven't used Copilot, but I presume that its job is to suggest code snippets that a human programmer then inspects to decide whether they want to include them in their codebase (possibly with additional tweaks). You don't tell Copilot “write an ERP system”, go for coffee, and return to find a finished piece of software. Therefore it seems to me that if copyright is infringed, in the end it's the human programmer who is actually responsible for the copyright infringement, because the final decision whether the Copilot output ends up in a “work” is theirs. This is not that different from the situation where somebody copies code from a book, a web site such as Stack Overflow, or a different Github repository.

If that is the case, the risk with services like Copilot is really that the human may inadvertently take on code that is a verbatim regurgitation of something that they're not allowed to use in the eventual context (like an excerpt from some GPL code base that ends up in a proprietary program). That a piece of code comes out of Copilot shouldn't absolve the person running Copilot from exercising due diligence. In that case it would be nice to have some transparency as to how Copilot arrived at its suggestion, including any licenses that apply to (parts of) the original input.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 3, 2022 14:42 UTC (Thu) by rgmoore (✭ supporter ✭, #75) [Link]

The thing that should keep Microsoft's lawyers up at night is whether Copilot is guilty of contributory infringement by suggesting copyright violating code to users. It seems like a big legal exposure.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 4, 2022 18:50 UTC (Fri) by nix (subscriber, #2304) [Link] (1 responses)

That a piece of code comes out of Copilot shouldn't absolve the person running Copilot from exercising due diligence. In that case it would be nice to have some transparency as to how Copilot arrived at its suggestion, including any licenses that apply to (parts of) the original input.

Given that humans don't have psychic powers and can't tell if something Copilot emits is used in some proprietary software they have never seen but which happened to be used as training data, it seems to me that if you don't want a court saying "you cannot trust that any of this is not copyrighted and must never use any of it", you *must* tag it with a license. Of course, given how neural nets work, tracking that might be slightly nightmarish and many things would probably come out with a dozen incompatible licenses on them, making them unusable in any case...

Developments in the FOSS response to Copilot and related technologies

Posted Mar 5, 2022 14:33 UTC (Sat) by anton (subscriber, #25547) [Link]

That's the point I was trying to make: The developer who wants to be legally clear would use only stuff from a Copilot trained on code that is compatible with his intended licence. E.g., if you want to use the result in proprietary code, you would use a Copilot trained on proprietizable (BSD-licensed and such) code. If you want to use the result in a GPL program, you could use a copilot trained on a wider range of code: all proprietizable code and all other code that's GPL-compatible. There should be such Copilot options. Are there?

Developments in the FOSS response to Copilot and related technologies

Posted Mar 3, 2022 2:43 UTC (Thu) by pabs (subscriber, #43278) [Link] (2 responses)

Is code produced by Copilot even considered copyrightable since it isn't produced by a human?

A lot of source code isn't creative in any way, even if it were generated by a human, is that considered copyrightable?

If not, does that mean that when source code was produced by Copilot (or non-creative code from a human), included in a proprietary project and then subsequently leaked, that it is legal to then include that source code in other projects, including Free Software projects?

Developments in the FOSS response to Copilot and related technologies

Posted Mar 3, 2022 3:01 UTC (Thu) by NYKevin (subscriber, #129325) [Link] (1 responses)

> Is code produced by Copilot even considered copyrightable since it isn't produced by a human?

In the US: The position of the Copyright Office is a firm "no," but the statute doesn't explicitly specify. The Copyright Office interprets the statute's use of the word "authorship" to mean "human authorship," which is probably what Congress meant, but it is not entirely clear that this is how a court would interpret it. See also the copyright dispute over the so-called "monkey selfie" (https://en.wikipedia.org/wiki/Monkey_selfie_copyright_dis...).

Note, however, that this has nothing to do with whether or not Copilot's output infringes the copyrights of its training data. Those are two entirely different questions.

> A lot of source code isn't creative in any way, even if it were generated by a human, is that considered copyrightable?

Most countries interpret "creative" in a very broad sense. Even simple things like variable names, ordering of statements, how you divide the program into subroutines, etc. are all creative elements that make most code copyrightable. But (in the US) see also Feist v. Rural.

> If not, does that mean that when source code was produced by Copilot (or non-creative code from a human), included in a proprietary project and then subsequently leaked, that it is legal to then include that source code in other projects, including Free Software projects?

Only if you also believe that Copilot's outputs are not infringing of its training data. In practice, you would also need to somehow prove that the code originated from Copilot and was not subsequently modified by a human, which strikes me as unlikely.

Developments in the FOSS response to Copilot and related technologies

Posted Mar 3, 2022 3:04 UTC (Thu) by pabs (subscriber, #43278) [Link]

> you would also need to somehow prove that the code originated from Copilot and was not subsequently modified by a human

In a court case presumably you could subpoena Microsoft to get the exact source code output by Copilot on that day to the user who committed the code, then compare it with the potentially modified code.