Larry Rosen: A Case Study In Understanding (and Enforcing) the GPL 191
lrosen (attorney Lawrence Rosen) writes with a response to an article that appeared on Opensource.com late last month, detailing a court case that arose between Versata Software and Ameriprise Financial Services; part of the resulting dispute hinges on Versata's use of GPL'd software (parsing utility VTD-X, from Ximpleware), though without acknowledging the license. According to the article's author, attorney Aaron Williamson (former staff attorney for the Software Freedom Law Center), "Lawyers for commercial software vendors have feared a claim like this for essentially the entire 20-odd-year lifetime of the GPL: a vendor incorporates some GPL-licensed code into a product—maybe naively, maybe willfully—and could be compelled to freely license the entire product as a result. The documents filed by Amerprise in the case reflect this fearful atmosphere, adopting the classically fear-mongering characterization of the GPL as a 'viral' license that 'infects' its host and 'requires it to become open source, too.'" Rosen writes: I want to acknowledge Aaron's main points: This lawsuit challenges certain assumptions about GPLv2 licensing, and it also emphasizes the effects of patents on the FOSS (and commercial) software ecosystem. I also want to acknowledge that I have been consulted as an expert by the plaintiff in this litigation (Ximpleware vs. Versata, et al.) and so some of what I say below they may also say in court.
Read on for the rest (and Williamson's article, too, for a better understanding of this reaction to it). An important take-away: it's not just the license that matters.
Let's be open about the facts here. Ximpleware worked diligently over many years to create certain valuable software. The author posted his source code on SourceForge. He offered the software under GPLv2. He also offered that software under commercial licenses. And he sought and received and provided notice of United States patent claims related to that software.
Unbeknownst to Ximpleware, Versata took that GPLv2 software and incorporated it into Versata products – without disclosing that GPLv2 software or in any other way honoring the terms of the GPLv2 license. The reason Ximpleware became aware of that GPLv2 breach is because some months ago Versata and one of its customers, Ameriprise, became embroiled in their own litigation. The breach of GPLv2 came out during discovery.
Ximpleware has terminated that license as to Versata. This is exactly what the Software Freedom Conservancy and others do when confronted by GPL breaches.
That earlier litigation is between two (or more) commercial companies; it is not a FOSS problem. These are mature, sophisticated, profitable companies that have the wherewithal to protect themselves. I know in my own law practice, whether I represent software vendors or their commercial customers, we typically provide for some level of indemnification. Perhaps Ameriprise and the other customer-defendants can count on Versata defending them against Ximpleware. Such a commercial dispute between big companies – even if it involves the GPLv2 software of a small company and separate indemnification for copyright or patent infringement – is between them alone.
But as to Ximpleware and its GPLv2 copyrighted and patented software, there are a few misunderstandings reflected in Aaron Williamson's article:
1. The notion of "implied patent licensing" has no clear legal precedent in any software licensing. While it is true that goods one purchases include a patent license under what is known as the "exhaustion doctrine," there is no exhaustion of patented software when copies are made (even though copying of the software itself is authorized by GPLv2). For example, a typical commercial patent license nowadays might include a royalty for each Android phone manufactured and sold. Companies that distribute Android phones and its FOSS software acquire patent licenses so recipients of their phones are indeed free to use those phones. But that isn't because of some implied patent licenses that come with Android software, but because commercial companies who distribute phones pay for those patent rights, directly or indirectly. I think it is entirely reasonable to require commercial companies to get their patent licenses in writing.
2. Versata's customers who received the (in breach!) GPLv2 software all moved to dismiss Ximpleware's infringement claims against them, pointing to Section 0 of GPLv2, which says, "[t]he act of running the Program is not restricted." What that sentence actually means is just what it says: The GPLv2 copyright grant itself (which is all there is in GPLv2) does not restrict the act of running the program. Nor could it; that is a true statement because running a program is not one of the enumerated copyright rights subject to a copyright license (17 USC 106). The authors of the GPL licenses have themselves made that argument repeatedly: The use of software is simply not a copyright issue.
3. Because there are U.S. patent claims on this Ximpleware software, Section 7 of GPLv2 prohibits its distribution under that license in the United States (or any jurisdictions where patent claims restrict its use). If Ameriprise and the other defendants were outside the U.S. where the Ximpleware patents don't apply, then GPLv2 would indeed be sufficient for that use. But inside the U.S. those customers are not authorized and they cannot rely on an assumed patent grant in GPLv2. Otherwise GPLv2 Section 7 would be an irrelevant provision. Reread it carefully if you doubt this.
The Versata customers certainly cannot depend on an implied patent license received indirectly through a vendor who was in breach of GPLv2 since the beginning – and still is! Versata ignored and failed to disclose to its own customers Ximpleware's patent notices concerning that GPLv2 software, but those patents are nevertheless infringed.
Should we forgive commercial companies who fail to undertake honest compliance with the GPL? Should we forgive their customers who aren't diligent in acquiring their software from diligent vendors?
As Aaron Williamson suggests, we shouldn't ignore the implications of this case. After all, the creator of Ximpleware software made his source code freely available under GPLv2 and posted clear notices to potential commercial customers of his U.S. patents and of his commercial licensing options. Lots of small (and large!) open source commercial companies do that. Although it is ultimately up to the courts to decide this case, from a FOSS point of view Ximpleware is the good guy here!
There is rich detail about this matter that will come out during litigation. Please don't criticize until you understand all the facts.
------------------------------------------
Lawrence Rosen
Rosenlaw & Einschlag (lrosen@rosenlaw.com)"
Re:Software patents (Score:5, Informative)
Yes it would. RMS invented the GPL because of copyright issues, and before software patents became a problem.
Re:What if it were Microsoft code (Score:5, Informative)
If you don't like the restriction of GPL, XimpleWare also offers flexible commercial licenses for VTD-XML [contact info follows]
The software is distributed for free provided certain license terms are followed, and otherwise, a license can be purchased for it as a commercial product. This seems to be a case where the GPL-licensed version of the software was inappropriate, and Versata should've paid for a license. I think that it can be argued that there are real damages in this case.
Re:What if it were Microsoft code (Score:5, Informative)
The difference is that the code is distributed for free. No judge is going to award damages for the redistribution of something that is free. At least, not actual damages, like $$$ per infringing copy. The breach of the terms (like not redistributing the source code) could be translated to some punitive damages, perhaps.
Copyright law explicitly provides for statutory damages of up to $250,000 per copy, precisely so that authors who are ripped off do not have to definitely prove exactly how much they lost.
Re: Do What Though Wilt (Score:2, Informative)
BSD license removes most of these legal acrobatics.
Are you a sado-masochist or where does this desire to be exploited stem from?
You're thinking of the BDSM license, which is something else entirely. Don't worry; it's a common mistake.
Specifically: problems with public domaining. (Score:5, Informative)
RMS invented the GPL because of copyright issues, and before software patents became a problem.
As I understand it: It was a (brilliant) workaround for two problems with putting software in the public domain, which releases ALL rights:
- Derived works: Somebody makes a modified version and copyrights that. They do a bugfix or enhancement and even the original author is locked out of his own software's future. He can't do the same bugfix or a similar enhancement without violating the new copyright. Similarly with other users of the software.
- Compilation copyrights: If somebody combines several public domain works into a combined work, they can copyright THAT, claiming violation if somebody uses excerpts from it - such as some of the original public-domain components or excerpts from them. In book publishing this covers publishers of collections and anthologies. In software, including a public-domained module in a library or distribution would let the distributors of that lock up the rights to the components. Again the original author and other users can get locked out of the author's own work. (For instance, nobody else could include it in a similar library or distribution.)
Stallman's trick solution was to keep the original work under copyright, but license it under terms that require derived works to also be licensed under the same terms and source to be included with obect. Expiration of the copyright might cause a problem - but with companies like Disney on the job lobbying congress, that's probably not going to happen in the US as long as there IS a US. Alternatively, eliminating copyrightability of software would also eliminate the need for the GPL.
Re:What if it were Microsoft code (Score:4, Informative)
The code wasn't distributed for free. It was distributed under a choice of two separate licenses: One was the GPL, one was commercial. Clearly, the commercial license route wasn't taken, and the GPL license wasn't adhered to.
Irrelevant if the patent owners argument is accepted that the GPL license did not include a license to use the software because you also needed to obtain a license for the patent that the GPL'd source uses. It's like cops putting out a plate of free 'special' (unmarked as such) brownies next to a plate of $5-per regular brownies at back-to-school night and promptly arresting everybody who eats one of the 'free' brownies.
If Oracle pulled such a BS claim out in their Java lawsuits, everybody but the corporate lawyers would be puking in disgust at such a bold admission of intent to entrap users.
I believe Larry Rosen's warning to learn the facts carefully applies here. XimpleHelp's argument is not that the GPL license did not include a license to use the software. The problem is more complicated than that. XimpleHelp's argument, as I understand it, is that the software was offered under two terms: one: you could abide by the GPL and use it (and redistributed it under certain conditions) for free. Two: you could buy a commercial license and use (and presumably redistribute) the software without any need to follow the GPL. The VDT-XML distribution site is pretty clear on this: it took me only a couple minutes to find and read the relevant part of the FAQ:
* Can you explain the GPL license a bit more? The GPL does not necessarily require one to disclose their source code when modifying a GPL-covered work or using GPL-covered code in a new work. This requirement arises only when the new project is "distributed" to third parties. If the resulting software is kept only for use by the modifier, no disclosure of source code is required. Although VTD-XML is protected by US patents 7133857, 7260652, and 7761459, as long as you abide by GPL, you don't have to worry about patent infringement. All licenses to any parties in litigation with XimpleWare have been expressly terminated. No new license, and no renewal of any revoked license, is granted to those parties as a result of re-downloading software from this or any other website If you don't like the restriction of GPL, XimpleWare also offers flexible commercial licenses for VTD-XML. Please email us at sales@ximpleware.com for more details.
XimpleHelp's legal argument as I understand it is that Versata violated the GPL when it used VDT-XML and *redistributed* the software in modified form without subjecting the derivative software to the terms of the GPL. That means effectively Versata did not have a valid license to VDT-XML, because they broke the GPL which granted it in the first place. Without that license, Versata was now not just in violation of the GPL, but also now violating XimpleWare's patent rights of the software - because Versata was using patent-protected software without permission.
Versata's customers may not have the right to estoppel they think they do, for the reason Rosen specifies: the GPL *would have* offered some protection to those customers if Versata itself had been compliant with the GPL. But since they are not, the GPL doesn't apply to Versata and neither does it apply to its customers - except insofar as they are in breach of it.
Addressing your analogy, nothing prevents Versata's customers themselves from downloading VDT-XML (or would have, before Versata terminated their ability to get a license because of the lawsuits) and using it, and nothing prevents anyone else from downloading VDT-XML and using it free from patent infringement allegations. If XimpleHelp tried to sue me for violating its patents just because I downloaded and used VDT-XML, they'd almost certainly lose that case both on legal merits and also because they explicitly said on their distribution site they would not do