Enforcement and compliance for the GPL and similar licenses

The Free Software Legal & Licensing Workshop (LLW) is a three-day event held every year for legal professionals (and aficionados) who work in the realm of free and open-source software (FOSS). It is organized by the Free Software Foundation Europe (FSFE) and, this year, the event was held in Barcelona (Spain), April 13-15. The topics covered during the event ranged from determining what constitutes authorship, how to attribute it, and what is copyrightable, to the complexity of licenses and how to make them more accessible for potential licensees lacking in legal background. In addition, license enforcement and compliance were discussed, with a particular focus on how the GPL and related licenses have done in court.

According to the organizers, there were approximately 90 attendees, 70% of whom were legal professionals and 30% technical professionals linked in some way to legal matters in their communities or companies. Attendees came from legal firms, traditionally open-source companies and communities, such as the Linux Foundation, Red Hat, and Debian, tech companies with some open-source products (Intel and others), and companies that are using open-source software embedded in their products. Discussions were held under the Chatham House Rule, which means that names and affiliations of participants are only available for those who have explicitly agreed.

As mentioned above, one of the hot topics was that of enforcement. It is worth pointing out that both FOSS and the related Creative Commons (CC) licenses, especially those that include copyleft clauses, are relatively modern legal documents. Those licenses are often infringed upon, either due to ignorance or because the conditions they require for compliance are not taken seriously.

The return of gpl-violations.org

The true test of a legal document is how it stands up in court. Harald Welte carried out a lot of the legwork to get GPL and GPL-like licenses recognized as legally valid and binding through his gpl-violations.org work and his role in suits against infringers in the mid to late 2000s.

Welte has recently decided to bring gpl-violations.org back to life after a hiatus in which he was involved in other projects. In his brief talk, Welte said that although "licenses are not an end in themselves, but tools to promote a collaborative development model", it is important that companies realize that "complying with [FOSS] licenses is not the maximum they can do to collaborate with free software. It is, in fact, the bare minimum."

German GPL court cases

In her presentation, Dr. Miriam Ballhausen from JBB Lawyers (based in Berlin, Germany) reviewed the history of enforcement of licenses in German courts, much of which came out of work by Welte and gpl-violations.org. She described the precedents set and how they have affected compliance. She also gave some insights on the steps to follow if a company is believed to be infringing.

Germany is probably the country in which most suits have been filed for FOSS-license infringements, starting with Welte vs. Sitecom (Regional Court of Munich, 2004). In that case, Welte sued Sitecom B.V. for including and distributing a modified version of GNU/Linux within their wireless routers, but not providing access to the modified source code.

There had been some prior difficulties enforcing the GPL in Germany because the terms of the GPL are deemed to be general terms and conditions, which meant the German law on general terms and conditions applied. More importantly, software can only be effectively licensed in Germany under a license that is written in German. Hence, Sitecom argued that the GPL, in this case version 2 of the license, was ineffective and its terms could not be enforced. Furthermore, the defendant stated that, by licensing code under the GPL, the authors waived their intellectual property rights.

However, the court ruled in favor of the plaintiff. The court concluded that either the defendant abide by the clauses in the GPL or the defendant must abide by regular copyright laws. If the GPL is deemed ineffective, then there's no license and no rights were granted to Sitecom. If the GPL is deemed effective, then the defendant would be bound by its terms. One way or the other, the defendant had infringed.

The precedent established by Welte vs. Sitecom has allowed Welte to win other cases and settle many others (which can be seen in the gpl-violations.org news archive). In addition, a case heard in the Regional court of Halle in 2015 upheld the legal standing of the GPLv3 as well.

Consequences for infringers

Under German law, winning an infringement case gives the plaintiff the rights to certain claims, namely:

• the right to claim a cease and desist from further infringements
• the right to claim for damages
• the right to claim for removal (i.e. recall from the supply chain) of the infringing product
• the right to claim information about the chain of distribution and number of sold devices
• the right to claim for reimbursement of costs

Ballhausen touched briefly on the last three claims from the list, commenting that plaintiffs have never required a removal of a product, because product removal has never been their objective; no plaintiff has ever requested information about the chain of distribution simply because this information would be of no use. Finally, with regard to the reimbursement of costs, awarding coverage of legal costs is automatic in European law when a plaintiff wins a case.

Requiring that the defendant cease and desist from further infringements is, however, an important issue, since the aim of most of these suits has typically been to force compliance onto the infringers. To cease infringing, the defendant must provide access to the exact same source of the code supplied with the product (yes, there has been at least one case where the defendant tried to pull a fast one and linked to an outdated version of the software), and a full copy of the license. It is not enough just to say "some of the software included with this device is distributed under license XYZ".

Ballhausen explained that a notification to cease and desist can, and probably should, be sent to the infringer before court proceedings, thus allowing the infringer to correct the fault before actually being sued. In Ballhausen's experience, friendly letters advising of infringements tended to be ignored and were often not considered clear enough by the court if the parties ended up going to trial. So a no-nonsense letter demanding immediate cease of infringement is preferred. If the case does end up in court, the plaintiff can request an injunction to stop the distribution of non-compliant products before the resolution of the case.

In terms of damages, though there have been no damages awarded to date, the plaintiff could in theory request that the infringer hand over the profits it made while distributing the non-compliant products. However, there has been some controversy as to what, if anything, an infringer should pay.

In a case heard in the regional court of Cologne in 2014, the court went as far as ruling that the defendant would have to pay all profits from sales, customer service, support, and other services for the product subject to the dispute. In other cases, however, courts concluded that it was nearly impossible to calculate an amount and that it would have been easier if the software had been dual-licensed. The infringer would then have to pay as if it had licensed the proprietary version of the software.

Consequences for free software

The GPLv2 and GPLv3 have been ruled to be valid legal licenses in Germany and the cases that have been fought in court have helped establish a framework of legal arguments for the rest of Europe. This has also trickled down to other FOSS-like or FOSS-inspired licenses, such as the AGPL, LGPL, and the family of CC content licenses, Ballhausen said.

There are, of course, downsides to the successful enforcement of FOSS licenses. Due to the proliferation of repositories and media, not all of which are clearly licensed, as well as the ever-growing number of licenses, using or reusing code, images, audio, or video has become somewhat of a minefield for those seeking to use FOSS-licensed software and media. Some participants in the discussion at the LLW event argued that there was some anecdotal evidence that this complexity has had a chilling effect to some degree on the adoption of open source by companies.

To mitigate some of the uncertainty companies may feel when thinking of using open-source software or media, Dr. Till Jaeger, also from JBB, presented an automated Attribution Generator. Although it is currently only a proof of concept, is not translated into English, and works exclusively for CC-licensed images found on Wikipedia and Wikimedia Commons, this application helps generate a legally correct attribution. A questionnaire leads one through the process of collecting information needed when publishing images to create a legally sufficient attribution line. The code for the project is available from GitHub and distributed under the GPLv3.

Conclusion

All of the speakers agreed that, thanks to all the work carried out by Welte and others, the legal validity of FOSS licenses, once a gray area, is becoming much clearer thanks to a growing corpus of precedents. At least in Germany, enforcing the GPL or the CC family of licenses is not at all a quixotic endeavor anymore.

The issues with FOSS licensing these days lie elsewhere, affecting more the licensees than the licensors. The complexity of licenses themselves and the proliferation of different licenses and versions makes licensing a complex topic. This may negatively impact the adoption of FOSS technologies by third parties. This complexity is pushing legal professionals in the FOSS sector to develop tools to help companies simplify compliance.

[ The author would like to thank the Linux Foundation for assisting with his travel expenses and the FSFE for help during the event. ]