Personal tools

User:ashawley/Making copyleft work with implied compliance

From GPLv3 Wiki

< User:ashawley(Difference between revisions)

Revision as of 21:17, 16 October 2006

Considering the 60-day time requirement

For those interested in strengthening, or at least preserving, the enforcement aspects of the GNU General Public License (GPL), the changes found in the new termination clause in the upcoming revision of the license may be of some interest.

Before discussing the new clause, let us reinforce the central issue: GPL enforcement. For example, what constitutes a "violation" under the GPL? Common mistakes ("mistakes", since a majority of violations are usually misinformed, not malicious) include,

  • failing to provide an offer for the source code,
  • not providing the correct source code (for the particular version distributed),
  • failing to provide necessary components to compile or execute the program,
  • providing only patches to the source and not the complete corresponding source code,
  • and any number of minutiae in the license related to fulfilling obligations that inform any recipients of the work the freedoms they should be provided by a copyleft license.

So what happens if people who distribute GPL software don't fulfill to the letter of the GNU GPL? In version 2 of the GNU GPL, any act that violated the license's terms resulted in "auto-termination":

You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License.[1]

In 2006, the GPL is being modified to produce a third version of the license, the first revision in 15 years.[2] There are many noteworthy changes in the drafts. This is a discussion of just one aspect of the changes. The first and second draft revisions of the license have both proposed modifying the termination clause from an automatic system, to a manual one. The changed clause in the first draft was primarily assailed for its confusing prose. However, heavy concerns were related to a qualitative difference being introduced to the license.

Both drafts have preserved the prohibition on ignoring the licensing. Now, ignoring the license makes "void" any attempt to do so. I'm not sure what making "void" means legally or practically. Perhaps, it reinforces and expresses the important sentiment to follow and obey the license. The larger change is the rephrased clause on termination that requires copyright holders provide notice to violators. This considerably departs from automatic termination in the previous version of the license. After notification, the licensee's rights to the software can be terminated "at any time". Here is how the termination section in the second draft of the GPLv3 reads in its entirety:

If you violate this License, any copyright holder may put you on notice by notifying you of the violation, by any reasonable means, provided 60 days have not elapsed since the last violation. Having put you on notice, the copyright holder may then terminate your license at any time.

In contrast with the new requirements in the GNU GPL which most aim to fix bugs or incomplete aspects of the popular free software license, this part of the new license is perhaps a softened "requirement"--or an introduced "permission". It is this quantitative change of limiting violations to 60 days that is earning criticism. On face value, the criticism is a reasonable and even expected response by the free software community to the change. Here are some observations of those criticisms.

Requiring a notice to be sent 60 days "since the last violation" is an extremely short window in the realm of free software distribution. The time it took Linksys to comply with the GPL and release the source to their wireless devices was "three to four months".[3] Some have read the "60 days" as an escape clause for GPL violators that would fundamentally weaken the GNU GPL by making investigating violators an even more difficult task than it previously was. However, this is perhaps a closed reading of the new clause.

The 60-day "limitation" only applies to termination of the license. It is not a wholesale limitation on all responses to a violation, just a time limit for termination. This nor any other section of the GNU GPL limits taking other actions against copyright infringement to the extent of the law. Therefore, the 60-day time limit does not apply to actions other than license termination. If the time limit weakens the GPL or "ties the hands" of enforcers, it must be mentioned that the criticism is confined to termination and not all potential aspects of license violation. Enforcement other than termination is discussed later.

Let's assume you're convinced that the 60-day limit only applies to license termination. Is the time window of 60 days acceptable? It sounds like a loophole for people to violate the General Public License for our software on a temporary basis. That people can violate the license until they get, and there are no assurances they were or can be caught.

However, the 60-day time window given in the current drafts of the GPLv3 for its termination clause are not a threat to the power of the GPL. Also, even if the time limit for activating the termination sequence was as short as 1 day, it would still not be a threat. Why you ask? Well, there's no point terminating someone who's not violating the license any longer.

Some people aren't satisfied by this logic. They think the "60-day" rule could be exploited with trickery. The complex hypotheticals have already been imagined for us: A company is created for a limited basis and it distributes GPL software as a sold product. After 60 days, the company dissolves and ceases distributing the software. By dissolving as a legal entity, the violator is immune from termination, since the 60-day window has passed.[4]

The problem with this kind of scenario is it's characterization of distributing or selling GPL software as the violation. That there is but a single date of the violation, and the it is last time the violation occurred. However, license violations occur not at a single point in time, but exists as a violation until they comply with the license. This is no different than if a book was distributed illegally. The copyright violation for a book exists as a violation and is actionable by the copyright holder as a violation until a remedy occurs and no one finds out within the time limit of enforcing copyright.

The other problem with this hypothetical is that it assumes terminating a license is a useful response. One could seek termination to be punitive, but to who's gain? Certainly it is not the gain of the copyright holder nor the free software community's. If someone is no longer distributing software, the copyright holder would have spent effort terminating the license for someone who has already willing self-terminated their use of the license and its software. In the more likely scenario of someone who's sought compliance rather than dissolving their legal status, punitive termination would punish those who wish to become compliant. It is better for the free software community to embrace those who seek compliance and therefore partake in the fair and equal basis the GPL provides for free software distribution. Punitive license termination is still available, but is not practically useful, anyway. And the hypothetical here is as useful as it show that termination as a response to license violation could never produce a useful result.

The alternative punishment for GPL violators is copyright enforcement. Copyright enforcement is available in the nearest available legal and judicial system (if it supports it). The license does not---and probably should not---describe every possible legal response for copyright violation and do this for each and every single jurisdiction. Adding this to the license would be similar to the warnings from the Federal Bureau of Investigation appearing at the beginning of video recordings of Hollywood-made films. Assuming such legal threats were added to the license, regardless of how technically difficult it would be to keep these updated for each locale, how useful would they be? Seeking damages for infringement varies by each copyright holder's particular wishes. The Free Software Foundation (FSF) represents one side of the spectrum. It only seeks compliance of the GPL first, does not seek damages nor seeks to prevent software distribution.[5] Their position is consistent with their philosophical criticisms of the copyright regimes in place in the U.S. and elsewhere, and its increasingly strong-handed enforcement by the media industry.[6]

Termination is probably a hefty enough threat for any technology company whose revenues depend on a free software package. This is probably the reason the FSF is satisfied with using termination to seek GPL compliance (Notice that seeking retribution other than termination is not mentioned at all by the GPL).

Again, the new clause isn't a threat to the GPL's strength or those who enforce the GPL, since termination is not the strongest available response to violation. It only works well enough for the FSF and others to bring others into compliance and "in to the fold" of free software. Regardless, why the change? Why the addition of such particular limits? Is this an improvement?

The obvious criticism of auto-termination originally in the GPLv2 is its inherent weakness. It doesn't work practically, since automatic termination implies self-policing by the same individuals who violated the license. Why would those who violated the license then begin to follow the enforcement aspect of the license? Automatic termination probably isn't worth including in a license, since it instantly "lacks teeth".

As anyone can imagine--and those who enforce the GPL for free software know from experience--investigating and enforcing the GPL is anything but automatic. It requires vigilance, patience and energy to actively pursue and investigate potential violators. It also requires copious correspondence and negotiation--either with or without the aid of professional lawyers. This brings us to a reason for the 60-day limit.

The new clause for termination is meant to provide a termination system that works and is based on the experience of GPL enforcers, like the FSF's GPL Compliance Lab.[7] The years of using the GPLv2 by the Compliance Lab has meant they not only know the GNU GPL intimately, but they also understand the process of contacting violators and seeking compliance. One communication they likely have to make often with simple violations--with automatic termination--is a notice to the violator that they are in compliance and can continue using the software.

Now, GPL enforcers like the FSF's GPL compliance lab handle dozens of violations at any one time and each violator will in all probability seek the path of compliance. Most violations are likely accidental and not malicious.[8] They simply ask the wrong be corrected by pointing to the language of the GNU GPL. Regardless, a final letter needs to be sent to confirm that a violator has reached compliance. To fix this, the small piece of language that puts a 60-day limit on catching violators doesn't require the notice. In a manner of trickery that only a computer programmer (read "hacker") could devise, the 60-day rule for notice implies that when 60 days expire then the violators know they are in compliance. If within 60 days of the last notice, they don't receive another notice or worse termination, then they are in compliance and can take a sigh of relief. This is how the license works anyway: All activities are free, uninhibited, and assumed in compliance until its seen otherwise.

Under the old regime, reinstating the license for violators likely required a written letter saying, "you are no longer terminated and are permitted to exercise the license". The letter may need to have a negotiated understanding of what warrants fulfillment of the license. All this could become a lot of work for each and every rudimentary violation. The contents of such a letter could also compromise the enforcer's ability to seek compliance for a later violation by the same party. The letter of understanding could potentially be used as a motive and evidence to defend a later violation. The 60-day time limit--which should be renamed "implied compliance"--keeps GPL compliance labs from getting in to trouble from any poorly written correspondence. It also confines discussions on violation and compliance to the letter of the license and not any other evidence that could be used in court. However, certifying software as compliant is done by the FSF, but by a separate process.[9] Something they've made a separate transaction and service, and does not interfere with the compliance lab's work (Don't you love how hackers divide their tasks, even the real-life one's?).

The new termination clause realizes rather than idealizes the activity of enforcing the GPL, but also fulfills the commitment to guard the work's copyright as stated in the license's preamble: "Developers that use the GNU GPL protect your rights with two steps: (1) assert copyright on the software (2) offer you this License....". Copyright for software and other works is a "necessary evil" for providing copyleft to the free software movement. However, this "necessary evil" makes copyright assignment, copyright enforcement, license compliance and other aspects of preserving the free software distribution and licensing system under the GPL another necessity for sustaining the free software movement. Work that is as important as the work from those who program, hack, document and produce the free software and also sustain the free software movement. The new termination clause affirms the actions of those who are "on the ground" making copyleft happen.