Canada: An Open Source Community Divided Is GPLv3 A Blind Alley Or A Path To The Future?

This article previously appeared in the Ontario Bar Association's Information Technology,, vol. 9, no. 2, June 2008.

Last year, the first major revision in 16 years to the leading open source license, the GNU General Public License (GPL), version 3 (GPLv3), was released.¹ First promulgated in 1989 by the Free Software Foundation (FSF), GPL was last significantly revised in 1991 (with GPLv2). Since then, GPL has become extremely successful and has been adopted by a majority of open source projects,² including most notably the popular Linux operating system in 1992. For this reason, the development of GPLv3 was hotly contested and widely followed.

While GPL sorely needed modernizing to reflect the growing acceptance and commercialization of open source software, there were divergent opinions on how to deal with the many technical and legal developments that have taken place since GPLv2 was released. When the finalized GPLv3 was released, on June 29, 2007, it met mixed reviews in the open source and technology industries and, for the reasons discussed below, a year later the markets remain hesitant to adopt it.

Notable Features of GPL

GPL and its variants³ are based on what Richard Stallman, founder of FSF, refers to as the "copyleft" movement, which uses traditional copyright law to create a so-called public license that permits a broad right to use, modify or distribute open source software. A person who wishes to modify or distribute software licensed under GPL (or "GPL'd software," as it is called in the trade) cannot place any greater copyright restrictions on the original and modified portions of the software than are already in GPL. The purpose of this approach is explained by FSF in reference to its own GNU software program:

Thus, GPL (and most open source licenses for that matter) is based on the principle of giving software users the same rights as the author and providing them with four fundamental freedoms: (1) the freedom to run the program as they wish; (2) the freedom to study the source code and change it so it does what they wish; (3) the freedom to distribute exact copies up to and including replication; and (4) the freedom to distribute copies of modified versions up to and including publication.

It is important to note that GPL permits the sale and use of GPL'd software or products containing GPL'd code for commercial purposes as long as the user or distributor complies with the terms of GPL.

GPLv3

GPLv3 was released after two years of public consultations and four major discussion drafts. With version 3, FSF set out to correct what it saw as pernicious risks and market erosion of the spirit of GPL to encourage software "freedom." However, the changes are controversial and arguably create as many problems as they solve.

Prevention of DRM Protections

GPLv3 takes a stance against so-called digital rights management (DRM) laws, such as the Digital Millennium Copyright Act in the United States⁵ (DMCA) and similar laws elsewhere. These laws forbid circumventing DRM hardware or software locks that seek to protect content such as software code, music or movies. The concern in the open source community was that the DRM anti-circumvention laws could be used to prevent people from otherwise exercising their rights to modify software distributed under GPL.

To counter this concern, section 3 of GPLv3 provides that where software is distributed (be it in source code format or embedded in hardware), the party distributing software must "waive any legal power to forbid circumvention of technological measures" under anti-circumvention laws.

Section 3 has been subtly drafted and has been misinterpreted to mean that software licensed under GPLv3 cannot contain DRM at all – which is not the case; it simply provides that in distributing GPL'd software, a party must give up its right to prevent circumvention of DRM by invoking the DMCA or similar laws.

Tivoization

GPLv3 is also intended to prevent another related "major danger" raised by DRM, so-called tivoization (a term that Stallman coined to describe a situation in which consumer products use hardware locks to prevent users from accessing or modifying GPL'd software embedded in the device).⁶ This is a common practice for many products, particularly for products such as DVD players, videogame consoles, routers and other devices, many of which contain GPL'd software that is locked down to prevent such illegal activities as causing a wireless router to exceed legally permitted ranges and frequencies, or to restrict illicit copying of protected content such as movies.

The "tivo" in "tivoization" refers to the TiVo personal video recorder, which contains embedded software licensed under GPLv2, including Linux. To comply with GPLv2, TiVo made available the source code of the GPL'd software as an Internet download from its website. However, although the source code could be downloaded, modified and compiled by users and loaded onto the TiVo, the device contained hardware locks to prevent modified software from running.

This use of DRM, according to Stallman, runs counter to the principle of software freedom, and if a company wishes to take advantage of free software, its users should be free of "digital handcuffs" and have no "limits on the substantive functionality you can add to a program, or remove from it." Thus GPLv3 "makes sure that you are just as free to remove nasty features as the distributor of your copy was to add them."⁷ In doing so, GPL has moved from simply being a software license to a tool to regulate the hardware domain as well.

The anti-tivoization clauses would have a disastrous result for TiVo and other businesses using code licensed under GPLv3. If TiVo were to permit users to alter and run the code used on its device, they could, for example, alter the system to prevent subscription billing, which would undermine an important method of sustaining the commercial basis for TiVo products. Similarly, the Sony Playstation game console, which runs a variant of Linux, could be easily modified to facilitate online cheating. It could also undermine attempts to authenticate transactions by using private digital signatures on security-dependent devices. Partly in response to these concerns, and after much clamour and debate, the anti-tivoization clause was ultimately watered down during the GPLv3 drafting process to essentially cover only consumer products, not medical devices or products distributed to businesses; however, the fundamental concerns remain for consumer products.

Restrictions on Patent Rights

GPLv3 was amended during the version 3 consultation process to specifically prevent patent arrangements like the November 2, 2006 cooperation agreement between Microsoft and Novell.⁸ The Microsoft-Novell agreement was a complex arrangement ostensibly intended to foster interoperability of Microsoft and Linuxbased OpenOffice software. As part of the arrangement, Microsoft agreed that it would not enforce its purported patent rights in certain elements of GPL'd software being distributed by Novell.

FSF considers such side deals as creating a precedent to force users to pay for patent licenses to use otherwise "free" software. It refers to such licenses as "discriminatory" since it restricts or prevents the exercise of rights granted under GPLv3. Accordingly, GPLv3 restricts patent arrangements in two ways. First, section 11 of GPLv3 attempts to specifically prevent such discrimination agreements:

Second, GPLv3 provides for an explicit patent license. Under this provision, any entity that contributes software to a project under section 11 of GPLv3 grants with that software, a "non-exclusive, worldwide, royalty-free patent license" covering the contributor's "essential patent claims" to the software. The intent is to prevent contributors from subsequently invoking their patent rights against the software project to which it contributed.¹⁰

The cumulative effectiveness of GPLv3's patent clauses is far from clear, and remains a topic of great controversy.¹¹ Microsoft, for its part, challenges the authority of these provisions of GPLv3, since it is not a party to the GPLv3 license and does not distribute such software; Microsoft also states that it does not grant any implied or express patent rights under or as a result of its agreement with Novell in light of the introduction of GPLv3.¹²

Compatibility with Other Open Source Licenses

Open source software comes in dozens of flavours of licenses, many with terms incompatible with the GPL.¹³ A common problem for open source vendors is that GPL permits only software with different kinds of licenses to be linked or compiled together with GPL'd software where the licenses do not contradict or conflict with each other. Section 7 of GPLv3 attempts to foster license compatibility by allowing distributors to incorporate into GPLv3 certain optional terms (such as warranty disclaimers, requirements to preserve copyright notices and indemnification requirements) that are often found in other licenses.

Despite section 7, the problem remains that outside the narrow range of permitted optional terms, GPLv3 still severely limits the combination of different types of open source software. Even versions 2 and 3 are incompatible; since each version requires that any combined code be licensed under the same license, GPLv2 and GPLv3 code cannot be combined or modified and distributed under either license.

Increase Scope of Material Covered

The scope of GPLv3 has been broadened from software to "any material that can be copyrighted"; this would include, for example, topographical circuits or semiconductor mask works.

Termination Remedies

The original GPL provided that the license would terminate immediately upon its terms being breached. GPLv3 is more consistent with software licensing norms by permitting a party who has violated a license term to remedy the breach within 30 days of notice by the copyright holder.

Market Reaction and GPLv3 Adoption Issues

A year after GPLv3 was finalized, there is still no clear indication of the extent to which the open source marketplace will embrace GPLv3. Many assumed there would be automatic adoption, which has not been the case. And since GPLv3 has no retroactive effect (i.e., software distributed under GPLv2 will not automatically move to GPLv3), open source programmers and distributors are free to continue to use GPLv2 (or any other variant of open source licenses, for that matter).

A few months after the official release of GPL, Evans Data Corporation published its regular Open Source Software Development survey, which indicated that over two-thirds of respondents would not be adopting GPLv3 in the next year and that 43% would "never" implement the new license.¹⁴ One of the problems, according to John Andrews of Evans Data, is that "GPLv3 is controversial because it imposes restrictions on what you can do with programs implemented under this license. Developers are confused and divided about those restrictions, with fairly equal numbers agreeing with the restrictions, disagreeing with them, or thinking they will be unenforceable."¹⁵

Palamida Inc. provides a central clearinghouse for tracking projects under the different variants of GPL. It reports that, as of April 21, 2008, out of more than 30,000 projects, 2,270 have converted to GPLv3, and calculates that 5,000 projects will be converted by the end of 2008.¹⁶ Although the number of projects converted is significant, most projects are small, and it is difficult to determine from these numbers the overall penetration rates for GPLv3.

Some major GPL projects and software vendors have adopted or stated their intention to adopt GPLv3. For example, Dan Frye, the vice-president of Open Systems Development at IBM, a major open source software contributor, declared that GPLv3 is "absolutely a commercially viable license."¹⁷ Red Hat, Novell and MySQL appear to be on side with IBM and are in the process of converting much of their software to GPLv3. And since GPLv3 is promulgated by FSF, it is naturally FSF's stated intention to ultimately transition all its software projects to GPLv3, which would include the GNU operating system and related GNU projects.

On the other hand, there are some significant abstainers. Linus Torvalds, the originator of Linux and an influential proponent of open source software, has loudly proclaimed his misgivings on the various drafts of GPLv3, and ultimately concluded that the Linux kernel would not be licensed under GPLv3, citing the "antitivoization" measures as his primary objection. Manufacturers of consumer products will almost certainly avoid GPLv3 software because of its anti-tivoization provisions.

Adoption of GPLv3 may also be slowed as a result of the incompatibility of GPLv2 and GPLv3. Software licensed under GPLv2 may simply remain under GPLv2 software until decommissioned or obsolete. Many vendors are almost certainly adopting a wait-and-see stance, waiting to see if a critical mass of vendors will adopt GPLv3 enabling the market to reach a tipping point in favour of GPLv3. Others, pointing to Torvalds' (and others') decision not to adopt version 3, may simply continue to use GPLv2, or, concerned with GPL's increased scope of activism, may turn to other, less restrictive licenses.

The stated purpose of GPL is "freedom." The debate about GPLv3 centres on whether GPL has been adapted to maintain this freedom or if, to the contrary, FSF's evangelistic zeal to prevent new types of uses and certain types of intellectual property rights actually restricts such freedoms. But aside from the philosophical debates, whether GPLv3 will be adopted may ultimately be a question of momentum; if a critical mass of projects converts to GPLv3, most GPL projects will likely simply migrate to GPLv3 for compatibility. However, if key projects such as Linux never adopt GPLv3, this version of the license may either lead to orphaning the license or perhaps dividing GPL development into two separate camps.

Considerations Before Adopting or Licensing Software Under GPLv3

Although the meaning and enforceability of much of GPLv2 remains for the most part untested by the courts, the ultimate effect of the novelties in GPLv3 – particularly relating to DRM and patents – is even more uncertain. Companies faced with the choice of adopting GPLv3 for their products or of obtaining software or products under GPLv3 will need to carefully assess how these changes may relate to their specific situation.

These issues are more than academic. Open source issues will almost certainly become more important in the coming years, and GPLv3 will likely be in the forefront of these issues.

In September 2007, the Federal Court of Utah dismissed the SCO Group's claim against Novell that put into question not just whether Linux software could be licensed under GPL if it included UNIX software supposedly owned by SCO, but also the constitutionality and enforceability of GPL itself.¹⁸ Furthermore, open source stakeholders have over the past year become much more active in successfully using litigation to enforce the terms of open source licenses.¹⁹ Although these recent lawsuits did not relate to GPLv3, they reflect a growing assertiveness by the open source community, and have helped clarify and legitimize open source licenses. More than ever, companies must understand when and how to implement open source licenses and carefully consider the risks and benefits of software licensed under GPLv3.

Footnotes

1 The official text of GPLv3 can be found at .www.gnu.org/licenses/gpl.html

2 The leading Internet open source software repository, SourceForge.net, reports that as of April 2, 2008, 82% of its open source projects use GPL-type licenses . www.dwheeler.com/frozen/sourceforge-stats-20031110.html Other leading GPL'd software products include the Samba file and print server suite, and the MySQL database.

3 There are several variants on GPL, including the GNU Lesser General Public License (LGPL), which provides simpler and more permissive terms than GPL; and the GNU Free Documentation License, which has similar principles for texts (used notably in the Wikipedia online community encyclopedia).

4 Richard Stallman, "What is Copyleft?" online: www.gnu.org/copyleft accessed April 2, 2008.

5 112 Stat. 2860 (1998). Canada has no similar DRM anti-circumvention laws and, as a result, the addition of section 3 to GPLv3 has no practical effect under Canadian law.

6 Richard Stallman, "Why Upgrade to GPLv3," online: GNU Operating System www.gnu.org/licenses/rms-why-gplv3.htm accessed April 2, 2008.

7 Ibid.

8 Laurie Flynn, "2 Giants in a Deal Over Linux," New York Times (November 2, 2006), online: www. nytimes.com/2006/11/03/business/03soft.html accessed April 2, 2008.

9 Oddly enough, even though the Microsoft-Novell agreement was the catalyst for the development of this clause, section 11 of GPLv3 would not apply to that agreement because section 11 explicitly "grandfathers" agreements signed prior to March 28, 2007. This was likely intentionally done with a goal of allowing users of Novell's software products to take advantage of Microsoft's covenants, and allowing Novell to distribute GPLv3 software when it could have otherwise been in breach of GPLv3 for its arrangement with Microsoft.

10 GPLv2 was silent on patent licenses, although there is certainly a strong argument that there is an implied patent license or a covenant not to sue for patent infringement for use of software that was distributed by the patent holder.

11 For example, see the detailed analysis in Francis M. Buono and McLean Sieverding, "GPL, Version 3: The Perils of Ideological Extremism" Les Nouvelles (September 2007) at 471.

12 "Microsoft Statement about GPLv3" (July 5, 2007), online: www.microsoft.com/presspass/misc/07- 05statement.mspx April 2, 2008.

13 The Open Source Initiative, an established organization dedicated to promoting open source software, lists 71 approved open source licenses.

14 Evans Data Corporation provides regularly updated IT industry market intelligence based on in-depth surveys of the global developer population. The biannual report is available by subscription from www.evansdata.com.

15 "GPLv3 shunned, survey says," InfoWorld Magazine (September 24, 2007).

16 Palamida Inc. is a leading supplier of software and services for adopting and using open source in large organizations. A detailed breakdown can be found at gpl3.blogspot.com/2008_03_01_archive.html.

17 Stephan Shankland, "Free Software Foundation Releases GPL3," Cnet News (June 29, 2007), online: http://www.news.com/Free-Software-Foundation-releases-GPL-3/2100-7344 3-6194139.html accessed April 2, 2008.

18 SCO Group v. Novell Inc., 2007 U.S. Dist. LEXIS 68371, (D. Utah, Sept. 14, 2007).

19 In addition to settled claims filed in Germany, the Netherlands and Korea since 2004, the Software Freedom Law Center, a United States group that campaigns on behalf of open source developers, filed four high-profile lawsuits against Verizon Communications and others, alleging non-compliance with GPLv2 by distributing GPL'd BusyBox software in various devices without making the source code available.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.