Protecting the open-source license commons [LWN.net]

Protecting the open-source license commons

Posted Nov 7, 2018 12:30 UTC (Wed) by paulj (subscriber, #341)
In reply to: Protecting the open-source license commons by bkuhn
Parent article: Protecting the open-source license commons

Punitive awards are not possible in the jurisdiction I am in, to my understanding. You can only seek compensation for damage. Which means you must demonstrate some kind of loss, and if that's to be in any way meaningful to deterring abusive corporates, there must be a relatively non-disputable way to put that loss into monetary terms. The advice I have from a commercial solicitor specialising in copyright is that the best/most-obvious/least-arguable way to achieve that in the jurisdiction I was in is to tell abusers that there is a price on non-copyleft-licence-conforming use (which arises from the value of the software, and copyright).

This would mean the copyleft copyright holder could gain monetarily though. If you say that that is fine, great - but the "principles" do seem to strongly discourage doing that. E.g., here's the text immediately after what you have quoted:

" Copyright holders (or their designated agent) therefore are reasonable to request compensation for the cost of their time providing the compliance education that accompanies any constructive enforcement action. Nevertheless, pursuing damages to the full extent allowed by copyright law is usually unnecessary, and can in some cases work against the purpose of copyleft."

Firstly, the copyleft copyright holder is instructed to only seek compensation for the /time spent on compliance/ - which is a smaller amount than the many years prior that may have gone into developing the software itself. And it then discourages seeking even that (??).

Are you saying that if I go to a corporate who I believe (based on advice) is abusing the licence on copylefted code of mine and tell them (roughly) "Any further use and/or distribution of my code outside the copyleft licence I granted will require compensation of x% of your revenue", and I later try act to recover that compensation, that the Conservancy principles are OK with that?

If you want to chat to me more in private, I tried to get help from the Conservancy before on my particular problem a good while ago. Feel free to reply. ;)

to post comments

Protecting the open-source license commons

Posted Nov 7, 2018 13:07 UTC (Wed) by paulj (subscriber, #341) [Link]

Oh, the other aspect to the jurisdiction I was in is that you _can not_ get all your costs awarded to you, should you end up having to take it to court. You /will/ be paying a significant amount of your legal costs, _even if you win_. (You don't want to go to court, but these types of considerations end up influencing pre-court action anyway, e.g. the extent to which the abuser can think you're likely to be able to go take it to court).

So the damage from the copyright infringement has to be significant enough for you to be able to pay your (non-trivial) legal costs.

If you're subscribed to a set of principles that say the only damages you should seek should be your legal costs, then you're going to end up with significant legal bills,
*even if you win*. So these principles may render any real enforcement out of reach for any non-wealthy private copyleft copyright holder.

There are other practical problems with the Conservancy's apparent "can't seek damages beyond compliance costs" that further put a non-well-resourced private copyleft copyright holder in a weak position, in at least some jurisdictions.

Protecting the open-source license commons

Posted Nov 7, 2018 16:39 UTC (Wed) by pabs (subscriber, #43278) [Link] (20 responses)

Hmm, I would have thought that one would just define the damage as the total revenue the abuser made from sale of GPL-violating products, rather than the price of something that is usually not for sale at any price (a non-copyleft license to the code), unless of course you are running a dual licensing business like MySQL or MongoDB.

Protecting the open-source license commons

Posted Nov 7, 2018 18:34 UTC (Wed) by mpr22 (subscriber, #60784) [Link] (19 responses)

You can define what you want the damages to be however you please.

Whether you can persuade the court to accept your definition is another question, and "I charge advertised fees of $MEDIUMNUM/copy (or $HUGENUM for a one-off licence) for a licence to make non-copyleft-compliant copies of my software, and this company has made BIGNUM non-copyleft-compliant copies of my software without paying my fees, so my total damages are either $HUGENUM, or $MEDIUMNUM * BIGNUM" is much easier to make a case for in court than "they made $BIGNUM from selling a product that included non-copyleft-compliant copies of my code, so my damages are $BIGNUM".

Especially if the offender is a hardware vendor.

Protecting the open-source license commons

Posted Nov 8, 2018 2:24 UTC (Thu) by pabs (subscriber, #43278) [Link] (18 responses)

In the case we are talking about, there is no advertised fee for non-copyleft licenses and the copyright holder isn't interested in selling such licenses.

So $MEDIUMNUM = ∞, $HUGENUM = ∞ and damages = ∞ but I guess we must round that down to the value of the company, since money isn't infinite.

It seems likely that the court are more likely to accept setting damages to revenue (or a percentage) they made from violating the only available license than setting damages to ownership of the entire company.

If we are talking about non-∞ values for $MEDIUMNUM and $HUGENUM then that sounds like a proprietary relicensing business rather than what paulj was talking about?

Are there any other models for damages that would be appropriate and would be accepted by the courts?

Protecting the open-source license commons

Posted Nov 8, 2018 10:49 UTC (Thu) by paulj (subscriber, #341) [Link]

See my other reply to you: https://lwn.net/Articles/770625/ - you're mixing some stuff up.

See also mpr22's reply to you. You have to word things in a way that makes sense legally and will stand up. I'm not a lawyer, so you'll have to find one to get a real explanation. However, my hand-wavy, probably completely wrong, opinion is that you can't really define "damage" self-referentially - damage must refer to something else, something you lost or were deprived of, etc.

Protecting the open-source license commons

Posted Nov 8, 2018 19:06 UTC (Thu) by mpr22 (subscriber, #60784) [Link] (16 responses)

If you do not offer proprietary licences at any price, then MEDIUMNUM and HUGENUM are not Inf.

They are NaN.

Protecting the open-source license commons

Posted Nov 12, 2018 3:45 UTC (Mon) by GoodMirek (guest, #101902) [Link] (15 responses)

I would be really interested in reply of bkuhn on this. I have also stopped supporting SFC on same basis as paulj. I have told them that, the answer I got from them did not address my concerns.

Protecting the open-source license commons

Posted Nov 12, 2018 15:47 UTC (Mon) by bkuhn (subscriber, #58642) [Link] (14 responses)

> I would be really interested in reply of bkuhn on this

I have replied many times in this thread. paulj appears to be misreading what the Principles say, and keeps making arguments about what he thinks they say, and then arguing that if they said that, they'd be bad. I just don't have time to keep refuting that same point.

What we've seen is that companies like MongoDB who put profit above compliance end up acting corruptly. Monetary gain should never go ahead of getting compliance in Principled enforcement. I stand by that. I know some of Conservancy's donors are annoyed that we don't put money first, and they stopped giving because they feel we should. I'd rather have a few annoyed donors than be on the path to corruption.

The Principles themselves address this point that paulj keeps making:

> Logically, if the only penalty for violation is simply compliance with the original rules, bad actors will just wait for an enforcement action before even reading the GPL. That social model for copyleft and its enforcement is untenable and unsustainable. An enforcement system without a financial penalty favors bad actors over good ones, since the latter bear the minimal (but non-trivial) staffing cost of compliant distribution while the former avoid it.

The Principles do not preclude punitive damages. Elsewhere in this thread, I talk about the complexity of getting them in the real world. No one in this thread has yet to put forward an idea for how to do enforcement that Conservancy hasn't carefully vetted and investigated.

Protecting the open-source license commons

Posted Nov 12, 2018 16:31 UTC (Mon) by paulj (subscriber, #341) [Link] (11 responses)

I've asked you a question in https://lwn.net/Articles/770915/ and between the bits of the Principles that say you should not seek damages beyond your compliance costs (which seems a recipe for being left with significant legal costs in jurisdictions where you will never be awarded all your costs), and the bits you're quoting that say you may seek punitive damages (but... there is no such thing as punitive damages in some jurisdictions), I still have no idea what the SFCs' position is. The question again:

“Are you saying that if I go to a corporate who I believe (based on advice) is abusing the licence on copylefted code of mine and tell them (roughly) "Any further use and/or distribution of my code outside the copyleft licence I granted will require compensation of x% of your revenue", and I later try act to recover that compensation, that the Conservancy principles are OK with that?>”

Yes or no?

(Note, I'm not saying where, if obtained, that theoretical compensation would go, after legal costs [see 'b' above] - it could go to a nice new TV, to charity, FOSS or more general, etc.).

Protecting the open-source license commons

Posted Nov 12, 2018 17:04 UTC (Mon) by bkuhn (subscriber, #58642) [Link] (10 responses)

Feel free to join the principles-discuss mailing list if you want to discuss the efficacy of the Principles.

Protecting the open-source license commons

Posted Nov 12, 2018 17:14 UTC (Mon) by paulj (subscriber, #341) [Link] (9 responses)

You don't respond to private email. You refuse to give a direct answer here. What's the point joining an email list to have the question not answered there?

I don't know why you/the SFC has not responded to any of my emails seeking help on licensing. It's strange.

It's making me wonder if it was because in my first email to the SFC on this topic that I one of the corporates that I noted as being involved happens to one of your sponsors (I didn't think of that at the time of writing, have to say). And that's sad. :(

Protecting the open-source license commons

Posted Nov 12, 2018 17:43 UTC (Mon) by bkuhn (subscriber, #58642) [Link] (8 responses)

You're not likely to get useful replies if you swing around unsubstantiated accusations of corruption against Conservancy like you just did. Please do refresh any thread you have with compliance@sfconservancy.org and ask for status. As we've stated many times, we're usually tracking hundreds of GPL violations at any given time. I'm sorry that we didn't take action on the one that bothered you most, but if you have a violation report, regardless of who it is against, we want to know about it and triage it along with the hundreds of other ones.

You seem to think that if we did things exactly as you said, we'd have so much money to pursue enforcement we wouldn't know what to do with it. We've tried many the things you said. If you haven't read the entirety of the documents in the BusyBox cases, you should. We asked for actual and statutory damages both. It is just not worth anyone's time to engage in hypotheticals of what we might do if copyright law were different and we had different remedies available. We have the remedies we have in the USA: statutory and actual damages. Conservancy pursues both in enforcement cases, and there is detailed Court evidence to show that we did in the BusyBox cases.

I sympathize with what you are feeling. It angers me too that big companies get away with GPL violations because the GPL enforcement remains expensive and complicated. But I'm not sure alienating the only organization doing something about the problem by captiously attacking Principles they wrote in an effort to avoid corruption is going to yield an outcome that helps you or anyone else.

There is a place for discussion of the Principles and to air concerns about them; I invited you there. LWN is not really the right place.

Also, sending personal email to me is not the way to do it, and claiming that I am not engaging with the community because I don't answer your personal emails is just unfair. (BTW, I can find no emails from anyone with username paulj in my archives nor the violation report archives, so I don't know which emails you're referring to anyway.) Also, BTW, if I answered every email I get from the general public, I'd spend my entire day every day answering emails. It's just untenable to expect someone who is a public figure to do that.

I did engage heavily with this thread because people raised questions and I've addressed them. I know you don't like the answers, and you want more attention to your points. I wish I had time to engage for unbounded amounts of time with everyone who has feedback on GPL enforcement. But I have to get back to the work that you keep urging me to be doing. :)

Protecting the open-source license commons

Posted Nov 12, 2018 18:08 UTC (Mon) by paulj (subscriber, #341) [Link] (7 responses)

It'd be: paul@ - I have emailed apply@ before, and karen@, and bkuhn@ the other day.

I don't think there is some magic money pot. I never claimed anything like that.

I think that - even if the principles work for the SFConservancy in the jurisdiction the SFC prefers - it's crippling to other copyleft developers in other jurisdictions. Given that you and Karen are clearly extremely busy and overloaded and can't deal with all the cases you have, clearly some of those developers are going to have to seek help elsewhere (e.g., commercial solicitors). What I'm saying is that the SFC principles render a difficult (financially) situation impossible there, based on my understanding of legal advice.

Protecting the open-source license commons

Posted Nov 12, 2018 18:31 UTC (Mon) by bkuhn (subscriber, #58642) [Link] (6 responses)

I don't think Conservancy's enforcement work for Linux, Samba, etc. is harming the enforcement efforts of others. The only enforcement efforts we've condemned are McHardy's (and general proprietary relicensing business models), because they are clearly prioritizing revenue above compliance.

I'm dubious of solicitors/lawyers who seek to make money from enforcement, mainly because they are likely to pressure a client to prioritize revenue over compliance. However, the Principles take no position against using for-profit law firms as part of enforcement, and you should do so for your copyrights if you think it will help. I urge you to follow the Principles when you do.

It seems the violations you're concerned about are not related to any copyrights Conservancy holds, nor any member project of Conservancy, so we're not really part of the conversations you'd need to have in any event.

Protecting the open-source license commons

Posted Nov 12, 2018 19:00 UTC (Mon) by GoodMirek (guest, #101902) [Link] (2 responses)

As paulj explained in detail, in our jurisdictions we cannot perform sustainable (in terms of covering expenses) GPL enforcement without proprietary relicensing business models.

Protecting the open-source license commons

Posted Nov 13, 2018 4:47 UTC (Tue) by pabs (subscriber, #43278) [Link] (1 responses)

It wasn't clear until now that paulj and yourself were talking about wanting/needing proprietary relicensing business models in order to achieve GPL compliance. I think this should have been stated much more clearly much earlier in the subthread.

Personally, a proprietary relicensing business model achieving GPL compliance sounds like an oxymoron to me.

Could you explain how this might work?

Is the idea to sell enough cheaper proprietary licenses to smaller businesses such that you can afford to take abusively non-compliant large corporations to court? You would then achieve GPL compliance by telling them that due to their license violations (both proprietary and GPL) you won't sell them the proprietary license and then take them to court to get compliance with both the GPL and with the more expensive large-corporation-sized proprietary license? So the end result of such an enforcement action, if successful, would be a number of smaller businesses with non-GPL-compliant codebases (due to proprietary licenses, for the time period specified by those licenses), one large corporation with a GPL-compliant codebase and more money to go after the next abusively non-compliant large corporation.

Protecting the open-source license commons

Posted Nov 13, 2018 5:43 UTC (Tue) by paulj (subscriber, #341) [Link]

No, no.. I have not argued for a proprietary licensing scheme at all! Read https://lwn.net/Articles/770625/ again.

In my personal case, even if *I* did take action against abusers to recover compensation for prior use of my code in the work concerned, outside the copyleft licence I gave, there are (many) other copyright holders, and *in no way* could any abusers I took action against ever receive a "proprietary licence" as a result!

That said, I am not against proprietary licensing at all, if it allows the developers of copyleft software to get the following types of corporates to fund and pay for the development of copyleft software:

a) Corporates who would otherwise avoid using and contributing to copyleft software, as much as possible.

b) Corporates who would otherwise parasitically use and abuse copyleft software

The non-profit model just isn't going to fly. If a non-profit gains traction, it will just be captured by the type-b corporates via donations. I've been in one and watched it happen. It just destroys copyleft software and communities. A few developers benefit perhaps, but the rest is destroyed.

Protecting the open-source license commons

Posted Nov 14, 2018 15:58 UTC (Wed) by paulj (subscriber, #341) [Link] (2 responses)

The Conservancy doesn't hold any copyrights in these violations because the application to join the Conservancy went nowhere, for reasons never communicated to me. Even though you personally reached out to me in '17 encouraging me to apply. Eventually, after 9 months odd of waiting (and other reasons) I gave up waiting to hear back.

So yes, you don't hold the copyright.

On whether I can stick to the Principles in any enforcement I do myself. I have no idea. The Principles are - at best - contain statements in tension with each (if not self-contradictory) and need interpretation, and you refuse to give direct answers to requests for clarifications.

I do wish you and the Conservancy all the best, in furthering the interests of the community the Conservancy represents. (Regrettably, it doesn't include me, but you can't say I didn't try to join it ;) ).

Protecting the open-source license commons

Posted Nov 15, 2018 18:13 UTC (Thu) by bkuhn (subscriber, #58642) [Link] (1 responses)

paulj, I have an email from you on 2017-11-10 in which you say "there was no point in pursuing SF Conservancy" membership for your project. That's the reason we didn't proceed.

As for "inviting you to apply", as a matter of historical record, the first inquiry about joining was indeed from *you* in Feb 2017. I do see in April 2017 I joined the thread, responding to your Feb 2017 inquiry (which Karen and already answered twice in Feb and March) and encouraged you to submit the application materials. We do write back to project leaders and encourage them to apply after they've shown initial interest, but that's not the same as "reaching out" as a cold contact, which your prior posts seem to indicate. (I think the number of times Conservancy has contacted projects on a cold-contact basis and asked them to apply is less than three in our more than ten years of existence. Our typical experience is we have a large queue of inquiries and cannot possible accept all the projects who want to join us given our limited resources.)

It's not uncommon from the date the application is submitted to acceptance in Conservancy to take 6-8 months. We got your application on 2017-04-12 and sent you updates along the way, and then received the withdraw of your application on 2017-11-10 and removed it from the queue. We carefully vet applications and make sure the project is a good fit. I'm sorry that timeline didn't work well for your project; we are not the right fit for fiscal sponsorship of all projects by any means, and there are less involved fiscal sponsors with smaller service plans (i.e., who don't do GPL enforcement) that can accept a project faster. Our commitment to our projects is stronger than most fiscal sponsors so we have to be deliberate in our decision-making.

Anyway, thanks for your kind words for Conservancy and I wish you success in resolving GPL violations on your copyrights. If you have questions about the principles, there is a mailing list for it, principles-discuss, as I mentioned in an earlier thread.

Protecting the open-source license commons

Posted Nov 28, 2018 15:51 UTC (Wed) by paulj (subscriber, #341) [Link]

I don't know, I didn't hear from the Conservancy for 3 months after the month where I'd been told the application would be considered. Maybe it's my fault for being impatient, and not realising it would take 8+ months to even look at the application. ;) Doesn't matter anyway.

I wish you well. I do though hope you process my concerns on the Principles as they are, with regard to the lack of clarity (at least) on points that are very important to the practicality of enforcement in at least some places. It seems I am not alone. As you're now aware of those concerns, I don't see a reason why I need to post to another mailing list (I've been subscribed to that list for a good while FWIW, if you want to discuss further and post there I'll see it).

All the best.

Protecting the open-source license commons

Posted Nov 12, 2018 18:05 UTC (Mon) by GoodMirek (guest, #101902) [Link] (1 responses)

bkuhn, I really appreciate your response. The valid point paulj makes and which is of my concern is that in many European jurisdictions including mine the Principles can never work the way they work in USA. In my understanding, paulj is asking whether lost profit damages are acceptable enforcement under the Principles.
The question is asked because only sustainable way to enforce GPL in my and many other European jurisdictions is via the lost profit damages.
In my eyes Principles are against that way of enforcement and you seem to second the Principles.
Am I misreading?

Protecting the open-source license commons

Posted Nov 15, 2018 17:10 UTC (Thu) by Wol (subscriber, #4433) [Link]

As a European myself, I look at it simply ...

If I had any copyrights, I would contact a violator and say "we need to fix this". If they engage with me and want to put things right, legal enforcement should be unnecessary.

If on the other hand, they come back with a "sue me" attitude, I'd sue for everything I could get. And I don't see that as conflicting with the ethos of the GPL at all! If they wilfully ignore it, why shouldn't I go for every penny? But if it was accidental, and they are genuine, it would never have got that far.

Cheers,
Wol