Linux-savvy legal experts from the past and present weigh in on this knotty, open-source licensing matter.
A side-effect of Linus Torvalds taking leave from Linux to work on how he deals with people and the new Linux contributors’ Code of Conduct (CoC) was one person suggesting that programmers forced out of Linux could take their contributed code out of the operating system. Well, can they?
THE ESTOPPEL DEFENSE
The controversy got its start when someone under the name “unconditionalwitness” — who had never posted to the Linux Kernel Mailing List (LKML) before with that name — wrote that people ejected from the Linux Kernel Community due to the CoC could “rescind the license grant regarding their property via written notice to those whom they are rescinding the grant from regarding their property (code).”
Mind you, no one has been forced out. There’s no sign of anyone in trouble with the CoC. But, none-the-less, some people are worried sick about being shoved out of the Linux developer community.
Once the code has been given, the Linux community can reasonably rely that the developer won’t damage Linux by taking back the right to use the code.
Further, unconditionalwitness, who claims to be a lawyer, argued that simply because a Linux kernel developer had given permission for their code to be used doesn’t mean that it’s a permanent, non-irrevocable grant. This addresses the estoppel defense. In its simplest form, once the code has been given, the Linux community can reasonably rely that the developer won’t damage Linux by taking back the right to use the code.
Unconditionalwitness doesn’t appear to be a Linux kernel contributor. His e-mail account is from a dubious anonymous mail server. In many ways, he’s an anonymous troll. Many Linux developers have dismissed him. But his argument that people can remove their code from Linux has gained traction.
THIS THREAT HAS TEETH
Eric S. Raymond, one of the open-source concept’s creators, wrote in what’s currently LKML’s most popular message, “This threat has teeth. I researched the relevant law when I was founding the Open Source Initiative. In the US, there is case law confirming that reputational losses relating to conversion of the rights of a contributor to a GPLed project are judicable in law.”
Richard M. Stallman, author of the GPLv2 — the open-source license that governs Linux — is purported to have responded, “The developers of Linux, or any free program, can remove any and all code, at any time, without giving a reason. However, this doesn’t force others to delete that code from their own versions of the program.”
While both were instrumental in creating free software, open source, and Linux’s license, neither are lawyers. So, I asked prominent open-source lawyers what, legally speaking, would happen if someone tried to remove “their” code from Linux.
WHAT’S LEGALLY THE CASE?
If the developer community thinks code can be withdrawn, the developers may decide to honor a request for code to be pulled. Practically speaking, that may not matter much. The code would then be replaced. But to return to the crux of the matter, what’s legally the case?
Eben Moglen
In the Free Software Foundation (FSF) GPL guidance document, open-source legal expert and Columbia law professor Eben Moglen wrote:
In order to make sure that all of our copyrights can meet the recordkeeping and other requirements of registration, and in order to be able to enforce the GPL most effectively, FSF requires that each author of code incorporated in FSF projects provide a copyright assignment, and, where appropriate, a disclaimer of any work-for-hire ownership claims by the programmer’s employer.
Linux, however, does not require its contributors to give a copyright assignment. So, where does the copyright reside?
Heather Meeker
When a former Linux developer, Patrick McHardy, shook down European companies for copyright payments because they were using “his” code, Heather Meeker, a partner at the law firm O’Melveny & Myers, who specializes in open-source software licensing, wrote then, “Copyright ownership in large projects such as the Linux kernel is complicated. It’s like a patchwork quilt.”
She continued:
When developers contribute to the kernel, they don’t sign any contribution agreement or assignment of copyright. The GPL covers their contributions, and the recipient of a copy of the software gets a license, under GPL, directly from all the authors. (The kernel project uses a document called a Developer Certificate of Origin, which does not grant any copyright license.) The contributors’ individual rights exist side-by-side with rights in the project as a whole.
Linux is not a salad, where you can easily make out the individual vegetables. It’s a gumbo stew where everything is merged together.
Meeker also observed it’s not easy to answer who wrote what code in the kernel. For example, “Of approximately 135 files in which McHardy included his copyright notice, only 1/3 are files to which McHardy contributed 50 percent or more of the file’s code.”
Linux is not a salad, where you can easily make out the individual vegetables. It’s a gumbo stew where everything is merged together. With more than 500 different companies and over 4,000 different developers contributing in 2017 with 8.5 changes an hour, Linux is always cooking.
Karen Sandler
In the end, Karen Sandler, attorney and executive director of the Software Freedom Conservancy, wrote, “There’s no effective way to revoke code meaningfully that has been licensed, distributed, and redistributed under GPLv2. While the issue is complicated, the legal structure around copyleft is robust.”
In an e-mail, Meeker added:
The legal analysis is a little complicated, but in the end … an open-source license grants rights to every recipient, at the moment the author makes the code available under the license. Those rights can be enjoyed by each recipient until that recipient violates the license and loses the rights as a result.
Meeker went on:
The notion that open-source licenses are arbitrarily revocable — because the license is free of charge and thus lacks consideration, or because the license is not a contract and thus does not enjoy the benefits of the reliance doctrine, or because the author has been wronged in a code of conduct dispute, or whatever other theory might be manufactured — elevates form over substance. Those arguments won’t win, mainly because courts don’t like intellectual property owners to take two bites at the apple.
Meeker concluded, “The revocability idea was advanced back in the 1990s as a FUD technique to scare people away from using open-source software. It’s no more true today than it was back then.”
Pamela Jones
In 2008, Pamela Jones at Groklaw remarked to an earlier attempt to take code out of the kernel, “[You] can’t retroactively revoke licenses previously granted, unless the license terms allow you to do so. The most you can do is stop granting new licenses.”
Jones continued “Here’s the GPL v2. See any terms allowing you to revoke? Me neither.” In short, we’ve seen this problem before.
“The GPL is what it is. Please don’t use it if you don’t like the terms.”
— — Pamela Jones
She expanded on the topic:
If you change your mind and don’t want to use the GPL any more, you can stop and use something else on new code going forward, and you can dual license your own code, but you can’t redo the past and pull back GPL’d code. That’s one of the beauties of the GPL, actually, that even if some individual gets a bug up his nose or dies and his copyright is inherited by his wife who doesn’t care about the GPL and wants to take it proprietary, or just to imagine for a moment, a Megacorp were to buy off a GPL programmer and get him to pretend to revoke the GPL with threats. It doesn’t matter ultimately … The GPL is what it is. Please don’t use it if you don’t like the terms.
Sandler thinks:
The main issue, however, is that the code of conduct was obviously rushed … and folks are unhappy to be surprised by the change. There was no time for community members to comment on the draft and also no thoughtful explanation from the TAB [Linux Technical Advisory Board] or Linus about why the Code of Conflict was not sufficient and why the proposed Code of Conduct is better.
Sandler concluded, “It’s hard work to open something like this to comment when the issue is so polarizing but with strong clearly articulated support by enough key kernel developers and a clear timeline for progress I believe this conversation would be productive.”
ANOTHER KETTLE OF FISH
So, while you might remove “your” code, legally once you’ve placed your code under the GPLv2, saying you’re taking it back won’t win you friends or victories in court.
I will add, although I am not a lawyer, I think the Linux community would be wise to take Moglen’s FSF advice and require developers provide a copyright assignment for their code.
To whom? Well, that’s another kettle of fish that the kernel developers would need to hash out. But such a move would make it clear that once you’ve given copyrighted code to Linux, you can’t take it back.
This article originally appeared on ZDnet.