Open Source Licensing: A Free Lunch or Just a Byte?

©1998 Distributed Computing, all rights reserved; reprinted with permission.

Open source licensing is being heralded by many software groups as an idea whose time has come. In brief, "open source" licensing is the no-cost distribution of one's source code and/or binaries, usually via the Internet, so that other users and programmers may modify it, debug it, customize it, improve it, and generally contribute their improved versions back to the worldwide programmer pool.

The true industry cognoscenti see nothing new in the idea -- the earliest programmers shared source code long before "hits" and "eyeballs" were acceptable industry vocabulary, using early electronic messaging systems to facilitate such exchanges. But now, it seems that open source is everywhere. The Internet domain name system runs on BIND, sendmail permeates e-mail, languages such as Perl, Tcl and Python are used at major sites, and open-source software is associated with many leading industry names and products -- Linux, BSD, GNU, Apache, Samba, Perl, Mozilla, Netscape, Cygnus and Python.

The philosophy of open source, like that of the Internet, is that society is enriched by seamless communication, including that among the world's programmers, who will use the open-source model to collaborate and fix, patch, improve, upgrade and customize the world's software. The business philosophy of the model is that the release of one's source code will lead to a future of widespread products and services compatible with it, increasing one's long-term market share. At a bird's-eye view, the model seems to flout the old sayings that (i) there is no such thing as a free lunch and (ii) if something sounds too good to be true, it probably is. Yet, if one examines the legal issues surrounding open-source licensing, the old sayings may ring more true.

To Be Free or Not to Be Free. For starters, from a legal and consumer marketing perspective, open source software is not "free software." The promoters of "open source" products have stated that they consciously avoided using the term "free software" to make the products more palatable to American users, for whom the word "free" may connote flaky or second-rate products, such as irregulars or surplus goods. (Perhaps this is more of an American disdain -- "software libre" does not sound so unreliable.)

Yet, a less-mentioned issue is that the use of the word "free" in advertising must meet certain legal criteria, which in the world of open-source licensing, may not apply. Federal government regulations provide that advertisements for "free" goods must be made with extreme care so as to avoid any possibility that consumers will be misled or deceived. In addition, "free" offers must conspicuously set forth any qualifying terms and conditions, and disclosure in a footnote or fine print may not qualify. When one reviews the three pages of restrictions that accompany an open-source license, the term "free" seems inapt on several grounds.

Know the law. The open-source licenses now available differ in terms of one's obligations to the original licensor and downstream users. The user may or may not be obliged to re-contribute its changes back to the licensor or to the publicly available version and/or downstream users, depending on whether the user's changes are incorporated into private or commercial derivative works. Yet, these licenses contain many similar terms and conditions. The first danger, it seems, is that the software will be downloaded and modified, and the original, paper-thin license quickly discarded or mislaid. Later users of the software might simply rely on its open-source origin and continue to copy or modify at will, not knowing or investigating the initial restrictions. While these licenses may seem less formal than a 30-page one-on-one agreement negotiated with a major corporate vendor, they may be viewed in many courts as having binding legal effect.

U.S. copyright law protects computer software (including source code, object code, operating systems and applicable GUIs and screen displays) as it does similar "works of authorship." It allows the software author, which can be a person or corporate employer, to prohibit the unauthorized copying, distribution, creation of derivative works, importation, and, to some extent, reverse engineering by third parties. Most countries have a copyright regime, and these rights are reciprocally enforceable in all nations that adhere to international copyright treaties and conventions in this regard. In addition, the U.S. copyright laws protect "derivative works" (transformations of underlying works, such as translations or editorial changes), separate from the original, pre-existing work of authorship. Therefore, the creator of the original open-source software and any subsequent contributors to it may have enforceable copyrights.

Any copyright author may choose not to enforce its rights, or to consent to the above activities, by granting a copyright license to a third party. In open source licensing, the software is still protected by a valid copyright, but the owner of either the original work or a derivative work based upon it has chosen not to enforce such rights, provided that a user complies with the terms of its license. Since the software owners were never obligated to grant initial licenses, these conditions must be respected, or a user may be liable for copyright infringement.

In addition, even if an open-source licensee does not infringe the software's copyright, it may still be liable to a licensor on pure contract law. A U.S. appellate court recently upheld the validity of a "shrink-wrap" license that prohibited the copying of the software's contents -- telephone listings that were unprotected by copyright as raw data. (In general, one cannot obtain a copyright for facts and ideas, but only for one's creative expression or arrangement of such facts and ideas.)

Therefore, one is wise to retain the open source license and ensure compliance at all times with its terms. The current licenses have explicit conditions on copying, retransmission, attribution, notices, permissible fees, modifications to the product or license, warranties, choice of law and dispute resolution. The terms of these licenses vary -- particularly with warranties -- so similarities should not be presumed across products.

Know your ancestors. The open-source licenses now offered on the Internet contemplate multiple generations of contributors to the software. As open-source improvements proliferate through the years, a user may simultaneously become a licensee or sublicensee to several ancestral levels of licensors, whose contributions to the work have different restrictions on their use. For software taken directly from a reputable company web site, the applicable players may be limited, credible and easily identifiable. Yet next-generation users would be wise to make an open-source "family tree" to ensure no violations of rights. For example, one license states that unauthorized copying of the software is grounds for termination, although other sublicensees will not be penalized if they still comply with the license. Yet, other licenses may not provide such largess, and a user may wish to investigate whether it wants to get a direct license from the software owner or otherwise ensure that the "chain of title" for its license is still valid. In addition, the different pieces of software contributed to the final product may be governed by different terms and conditions and the laws of different countries.

The importance of fulfilling all these obligations is important to avoid initial liability, and takes on added importance if one redistributes improved software to other users -- a requirement of some open-source licenses. In such case, the user has just become a contracting party and Internet publisher for potentially hundreds of later users in countries throughout the world. The possibilities for legal liability are easily magnified.

Know your children. Until courts begin addressing issues of open-source licensing liability, such as the validity of blanket disclaimers and enforceability of boilerplate terms, participants in an open-source system may be at risk for the actions of downstream parties. The currently available open-source licenses attempt to remedy this problem, by requiring licensees to replicate all legal notices and disclaimers of warranties, to provide clear and accurate attribution as to the source of different products, license components and proprietary rights, and to avoid suggesting that the original licensor endorses their product.

Yet, given that the enforceability of total warranty disclaimers via the Internet is still uncertain, if some open-source software later causes a serious problem, such as Year 2000 non-compliance, all the intermediate contributors to the source code may be initially dragged into a legal dispute. The biggest loser may be the deepest pocket, not necessarily the most culpable contributor. Given the instantaneous, fluid nature of Internet distribution, it may be difficult to monitor the eventual recipients of one's product.

You get what you pay for. The available open-source licenses are accompanied by conspicuous warranty disclaimers, proclaiming the software's "as is" nature and negating responsibility for all types of damages stemming from its use. In other words, the user bears all risk that (i) the software works; (ii) the software will not harm its system; and/or (iii) the user will not be sued by a third party. In addition, there are generally no obligations for maintenance, servicing or repair. While the enforceability of these provisions is unclear, given that the software is "free" and the warranty disclaimer is conspicuous, courts may uphold the disclaimer as a fair shifting of risk. Most negotiated and standard "off-the-shelf" software licenses do provide some sort of warranty, no matter how limited, and support, maintenance or repair for defects. In addition, the current open-source licenses do not mention the Year 2000 issue, the liability for which is of major concern to software users. The no-cost nature of open source software is not without some trade-offs.

The whole world in your hands. The global nature of the Internet creates the potential for international disputes over open-source licensing. Downstream users, contributors and their competitors will reside around the world, potentially subjecting the entire software "chain of title" to the laws and jurisdictions of many countries and courts. If a person willingly retransmits software around the world via the Internet, courts may allow that person to be sued in whatever state or country a user lives. Some open-source licenses expressly warn of these risks, suggesting that later users avoid retransmissions to countries whose local patent and copyright laws may come into conflict with the applicable software.

Innovation is the sincerest form of flattery. As a definitional matter, open source supporters are not to be confused with proponents of naked cloning. Open-source software providers have voluntarily distributed their source code, with specified restrictions, as the result of a deliberate business decision that this move will help their long-term revenues by spawning future generations of compatible products and services. This may or may not be proved true, but the initial offer of software was the licensor's voluntary choice to make. Cloning of software, on the other hand, may violate the software owner's rights under copyright, trade secrets or contract law, because the owner was not consulted as to the taking or allowed to set its terms and conditions. As an analogy, while a California company now plans to give away PCs if users will use them to view Internet advertising and share personal data, it may not consider a theft from its PC storeroom to be equivalent.

On a philosophical level, the open-source model also presumes that later developers will contribute something of value to the original source code, thereby benefitting society. In software, as with most other products, no one reinvents the wheel. The acronym OTSOG -- "on the shoulders of giants" -- stands for the maxim that a dwarf standing a giant's shoulders can see farther than the giant itself. As downstream programmers build upon open source software, society can "see" farther with improved software. Pure cloning, however, does not contribute to the "vision."

What's In a Name? Trademark law is also destined to influence the open-source landscape. One theory of open-source development predicts that companies will compete against readily available software by concentrating on branding and brand loyalty. Ironically, open-source licensing may soon have some issues concerning the very brand "Open Source." The group Software in the Public Interest has applied for a U.S. registration to use the term OPEN SOURCE to certify the satisfactory compliance of third-party licenses, similar to the Good Housekeeping seal of approval. The group's web site sets forth the criteria for an "open source" license, including free redistribution, inclusion of source code in the program, permission to modify and create derivative works, integrity of the source code, and non-discrimination (against persons and fields of use).

If SPL receives its registration, it will have priority rights in the United States to use the name "Open Source" to certify qualifying software. (Imagine the commercial: "If it doesn't say OPEN SOURCE on the web site, it's not OPEN SOURCE.") If another company or industry group wishes to set up different criteria, it may create a different name and counter-certify the software field. (There is also a pending trademark application for OPEN GROUP, held by an eponymous company in Cambridge, Massachusetts.) If open source becomes an industry standard over the long term, the proprietary nature of the name may cease. Internet, Inc., an electronic banking company, registered the trademark "Internet" in 1990, but had its registration challenged by the Internet Society, who claimed that the term was generic, due to its widespread use for decades. Today, more than 500 U.S. trademark registrations and applications contain the name "Internet," making it proprietary to none. It may be fitting if the "Open Source" trademark follows this fate.

Copied to clipboard