Copyright

Copyright

a wrong idea that really flourished.

Copyright in FOSS Consulting

You know what the General Public License (GPL) is , because you are a Linux hacker, web developer, or other Free Software consultant who lives and breathes free software. You consult for clients, doing DevOps using Software Engineering tools such as Subversion, and Git or build automation like Jenkins. You work with database engines like MySQL, Postgres, and MongoDB. You do System Administration on RedHat, Ubuntu, and Debian. You build web services, proxies, reporting systems and more on Apache and Nginx web servers. You build extensions for MediaWiki, modules for Drupal, or plugins for WordPress. You do User Interface based on jQuery and JavaScript. You extend, improve or integrate GPL software and systems, that is to say 50,000 market leading, state of the art software products. You consult for companies, universities, governments, other organizations large and small and they all use boilerplate contract language that is completely oblivious of the software they are using, and the work that you are doing for them in a proper legal context. To a certain degree, this is understandable - technology changes rapidly while legal systems and bureaucracies evolve slowly.

In the definition of Copyright , the word software never appears. The phrase 'digital transmission' is the only hint of technology that was to come in the ensuing decades. In fact, section 102 on the Subject matter of copyright expressly excludes software in concept:

In no case does copyright protection for an original work of authorship extend to any idea, procedure, process, system, method of operation, concept, principle, or discovery, regardless of the form in which it is described, explained, illustrated, or embodied in such work.

But in order to create an expansive copyright regime, this was interpreted to mean that the "expression" of the idea is copyrightable, while the actual methods or processes adopted by the programmer are not within the scope of the copyright law. While you chew on that for a bit, we'll get back to the point here: contract language that is GPL-aware.

It's time to have "boilerplate" contract language that understands the world we live in and is helpful to the client and contractor in clear terms.

Old-School Boilerplate

ContractStandards.com is a pretty useful website setup by Lambert & Associates (Boston, MA and Nashua, NH) that illustrates and explains in plain language the various clauses of a contract. For example, they have a page about Intellectual Property (Representation); calling it "one of the most heavily negotiated representations". (Note: you have to click on the "Clause Elements" section heading to actually view the contents.)

Unfortunately, they offer no example that would pertain specifically to a client using GPL software, and hiring a consultant with expertise in that software. If you look at their example Independent Contractor Agreement ownership is conferred 100% to the client. As in the boilerplate example, you'll likely see language from your clients about the contractor providing a "work made for hire" under the Copyright Act . This is old-school, pre-Internet mentality and legal framework (This section of the U.S. Copyright Act was updated in 1979).

So, where can we get an idea of the language to use for a client wishing to hire a consultant who would employ GPL software and intend to publish and share that intellectual property for the benefit of the client, the contractor and the world at large?

Good Intellectual Property Agreements

Examples and Guides

• In 2010 Code for America and Open Plans collaborated to create Civic Commons, which is now all-volunteer, but the work product remains online. The Civic Commons' 2015 article Best Practices Around Procuring or Deploying OSS in Your Organization is one helpful example.
• 2013 GPL and free software language for government contracts shows a clause that was used in a University setting.
• Balanced Employee IP Agreement (BEIPA) is the legal agreement GitHub (now owned by Microsoft) uses for its employees.
• Innovators Patent Agreement (IPA) from Twitter, a commitment from a company to its employees that the company will not use patents in offensive litigation without the permission of the inventors. Other pertinent policy choices include participation in anti-troll and non-aggression networks such as LOT and OIN, as well as contributing to open source projects.
• Model IP Policy created at Rackspace.

Distribution explained

To get an in-depth explanation and analysis of what constitutes distribution in everyday practice, see The Gift that Keeps on Giving - Distribution and Copyleft in Open Source by Heather Meeker

Contribution Agreements

Contribution agreements are one area where we can look to get an idea of standard practices among larger foundations and FOSS projects. Essentially, the client is the foundation, and the developer may be an individual or a member of a corporation. The OpenID Foundation (OIDF) develops specifications, so it's a good example of where standards development and software development meet. There is a long list of contributors to the OpenID Foundation. The OIDF has both a formal Process to develop their specifications, as well as an IPR Policy . The Policy classifies contributors as "unaffiliated" (an individual), "affiliated" (anyone who work for a company), and "representative" (third-party).

Here is the language in section 5.1 of the IPR:

Copyright License. Some Contributions may not be subject to copyright. To the extent, however, that a Contribution is or may be subject to copyright, the Contributor hereby grants a perpetual, irrevocable (except in case of breach of this license), non-exclusive, royalty-free, worldwide license in such copyright to the OpenID Foundation, to other Contributors, and to Implementers, to reproduce, prepare derivative works from, distribute, perform, and display the Contribution and derivative works thereof solely for purposes of developing draft Specifications and implementing Implementers Drafts and Final Specifications

Section 6 of the IPR addresses patents, with essentially a promise not to assert.

Here are some others to look at.

• Drupal
• OpenStack
• Karl Fogel in his book "Producing Open Source Software" discusses exactly that, from soup to nuts. In it, he includes a discussion of Copyright License Agreements as well as Copyright Assignment Agreements. This is a good read for anyone producing open source software of course, but it's also a great way for a corporate attorney to get the perspective of the FOSS developer.
• Google Individual Contributor License Agreement
• Project Harmony offers not only a "harmonizing" view of Contributor Agreements, but also the inter-company contributor agreements so that employees of one organization can effectively collaborate on external FOSS projects that the company uses.
• The Civic Commons Wiki offers a complete run down of CLA and CAA examples

Is it Viral?

Why do contracts seem so hostile toward Free Software? Basically, contracts were written to defend against the risks that GPL could introduce to a companies core products. But this is only one aspect of the complete landscape. A separate aspect is how companies rely on GPL software.

For a long time (and it still continues), the GPL was labelled "viral" (in a bad way) because if you let GPL code touch your proprietary code, you'll be forced to share your proprietary code. That's only half true. Articles like this one talk about this viral nature, but don't even touch on the other half of the story: what triggers the license. You have to "distribute" software to trigger the GPL, so if all you ever do is use the software (plus GPL additions) for your own internal purposes, then you have all the right in the world to use GPL software without having to publish your software to the world. Of course many people recognized that they could circumvent distribution by making "services" out of free software, for example, an online logo generator that uses the GIMP as a backend. This is sometimes called the ASP loophole. In drafting the GPLv3, there was an attempt to define network transmission of services tantamount to distributing the software. This did not ultimately make it into the GPLv3, but instead is part of the variant called the Affero GPL (or AGPL). The AGPL license has not been as popular as the GPLv2, but at least it's there for software developers to use when they want to prevent their creations from getting boxed up in the cloud. Of greater concern to the corporation is how distribution can be triggered in some non-obvious ways - such as through merger and aquisition.

Ultimately, using GPL software in your (commercially available and distributed) product is not different than using some other (proprietary) software -- you need the right to do it. GPL says you don't have that right unless you're willing to share. You don't want to share, then build it yourself. In-house counsel was often focused exclusively on this viral aspect and the "FOSS governance" policies that grew out of it were focused on restricting what could come in-bound to an organization. Their consulting contracts with vendors still had the mindset that they weren't using GPL software anywhere in their organizations, including the mundane and operations related areas of the business that would never cross the "distribution" threshold. To be clear, you can -- and millions of companies do -- use Drupal for an internal website, or MediaWiki for a knowledgebase. You can even modify or extend that code to do things you need it to do. And you don't have to share your code if you don't want to. For most companies and most situations, the best thing they can do is to actually promote their code back "upstream" into the FOSS software project. At a minimum, they should not prevent their code from getting upstream by placing legal obstacles in the way.

The issue we're trying to focus on here and that very few address, is that a majority of companies not only use free software, but need commercial support for that software. They frequently want to build that extra feature or just need help deploying, integrating, upgrading and documenting it. It's not a core product. It's just some internal thing to get work done. Take for example a simple PHP application used for keeping track of Time Off, using a MySQL database backend. Should a company "own" the intellectual property associated with upgrading MySQL? It may actually be counter to the law. An author only has rights to the specific pieces of expression that they've contributed to a collaborative work so they can't claim ownership over the whole thing.

Further Resources

• Legal Information Institute - a project started in 1992 by the Cornell University Law School that publishes the law online, for free. See the U.S. Constitution and U.S. Code, etc.
• Copyfree, offers a collection of interesting articles, essays etc. about the problems of Copyright and offers an alternative copyright regime.
• JOLTS (Journal of Open Law, Technology & Society): an international, broadly-scoped journal about openness still has an archive of their work online
• Traditional treatment of the subject comes from the perspective of protecting against risks that the software is perceived to create. The Association of Corporate Counsel has this primer http://www.acc.com/legalresources/quickcounsel/quickcounsel_open_source_software.cfm While it does discuss many of the valid concerns that you would have as a corporation, it does nothing to address the proactive and beneficial things you can and should do to address the needs and benefits created by the collaboration economy.
• Cornell University Law School https://www.law.cornell.edu/wex/collective_work
• It would be great if the Wikimedia Foundation published their Employee IPR Policy, as a reference model, but there is no mention of it at https://foundation.wikimedia.org/wiki/Policy:Main#Board_and_staff_members and I don't believe it is publicly available.

Disclaimer

"Nothing on the website is legal advice. If it were, it would come with an invoice." I'm just a free software expert.

This information is here to educate, inform, and hopefully spread best practice information to consultants, their clients, employees and employers alike who wish to operate in the real world that is completely full of interconnected "Intellectual Property". It is not legal advice. It should not be construed as legal advice. It does not create an attorney-client relationship. If you're an attorney reading this, I'd love to get your feedback and I hope that this information is useful to the representation you provide to your clients.

Colophon

As part of our Free Culture efforts, the copyright for this wiki was updated to use the Creative Commons Attribution-ShareAlike 4.0 International License.

This work by http://freephile.org is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.