United States: Version 3 Of The GNU General Public License (Gplv3) Published; Significant Changes For Open Source Software Licensing

The Free Software Foundation (FSF) on June 29 published the final, official new version of the GNU General Public License, GPLv3. The new version is the result of extensive public comment and heated debate, and could have far-reaching effects on the use of open source software. GPLv3 is the successor to GPL version 2 (GPLv2), first published in 1991, used extensively today, and among the most popular open source licenses available.

GPLv3’s key changes include:

• a new approach to patents, including an explicit patent license and a patent non-assertion clause,

• a new requirement that companies conveying GPL-covered code in "user products" provide the information necessary to install modified versions on those products (a.k.a. "anti-tivoization"),

• a new approach to digital rights management (DRM), including an express waiver of anti-circumvention rights, and

• new language implementing the GPL’s "viral effect," affecting when it applies and what is required.

New Terms for Patents

Responding to what it calls the "unwise and ill-considered application of patent law to software" in the years since it released GPLv2,¹ the FSF includes in GPLv3 provisions focused on patents that address in different ways the patents of (1) entities that modify or otherwise contribute to software that is covered by the GPL, (2) entities that merely distribute (but do not contribute to) GPL-covered software, and (3) non-contributing, non-distributing entities that enter into patent-related agreements with contributors or distributors.

(1) Contributors: GPLv3 provides that those who modify or otherwise contribute to GPL-covered software and distribute that software are deemed to grant a royalty-free, non-exclusive, worldwide patent license under their "essential patent claims," those claims which the contributors own or control that others would infringe if they were to use, make, or sell the software as the GPL permits them to do.² This license is deemed to apply to the entire "contributor version" of the programs the contributors distribute, not just the portions they contribute. This patent license is a significant change from GPLv2, which had no express patent license and included, at best, only implied rights of uncertain scope and effect.

(2) Mere Distributors: GPLv3 also imposes clearer patent non-assertion obligations on those who distribute GPL-covered software without modifying or otherwise contributing to it (i.e., mere distributors). Specifically, GPLv3 provides that even mere distributors of GPL-covered software cannot "initiate litigation . . . alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing" the software, or any portion of the software.³ Unlike contributors, whose required express patent license is deemed perpetual, patent non-assertion by mere distributors is only a condition to continued exercise of their GPL rights. Therefore, mere distributors can escape their non-assertion obligations by ceasing distribution of the GPL-covered code.

(3) Third Parties: GPLv3 also seeks to address the patents of patent holders who may not contribute to or distribute GPL-covered software but who enter into patent-related agreements with entities that do. In particular, GPLv3 provides that an entity may not distribute GPL-covered software "knowingly relying" on a patent license or other patent non-assertion commitment unless, in effect, the distributing entity ensures that the corresponding source code for the software is publicly available free of charge.⁴ In addition, GPLv3 includes two provisions responding to the open source community’s concern about last November’s Microsoft-Novell deal.⁵ First, GPLv3 provides that if an entity distributes or procures the distribution of GPL-covered software and, in connection with the same transaction or arrangement, grants a patent license or other patent non-assertion commitment with respect to specific copies of the software, then the patent license or non-assertion commitment is deemed extended automatically to every recipient of the software or modifications of the software.⁶ According to the FSF, this provision means that the patent non-assertion covenants extended by Microsoft to Novell’s customers in the Microsoft-Novell deal extend to anyone who uses software that Novell provides under GPLv3⁷ (although Microsoft has said in a public statement that it is not subject to GPLv3 and that this provision has no effect on its patents⁸). Second, GPLv3 provides that a distributor of GPL-covered software cannot enter into an arrangement with another software vendor under which the other software vendor grants a patent license or other non-assertion commitment to any of the distributor’s customers in connection with the GPL-covered software (or primarily for products containing the GPL-covered software) if, as part of the arrangement, the distributor makes payment to the other software vendor based on the "extent" of the distributor’s activity in distributing the GPL-covered software.⁹ This provision has a "grandfather" provision that makes it inapplicable to the Microsoft-Novell deal itself (or other arrangements entered into before March 28, 2007), but is intended to discourage similar patent arrangements in the future.

GPLv3 also seeks to stop a practice that Richard Stallman, the GPL’s original primary author, calls "tivoization." Tivoization refers to companies (1) distributing devices (such as the TiVo digital video recorder) that run GPL-covered software while (2) providing, as required by GPLv2, access to and copies of the corresponding source code for the software, but (3) using technical means like access keys to prevent users from installing modified code back onto the devices.

GPLv3’s anti-tivoization provisions apply only to "user products"—e.g., consumer electronics products, the context in which the FSF views "tivoization" as most problematic.¹⁰ The new provisions require that where a distributor (a) conveys GPL-covered software, (b) for use in a user product, (c) in conjunction with the sale or lease of that product, then (d) "installation information" must accompany the corresponding source code.¹¹ Installation information includes methods, procedures, access keys, and any information required to install and run modified versions of the distributed code in the user product. GPLv3 exempts situations in which no one, including the distributor itself, can install modified code in the user product—e.g., when the covered code is burned onto a chip and cannot be modified. In addition, for user products that access a network, the distributor retains the right to deny network access to user products running modified code if the "modification itself" would have a material, adverse effect on operation of the network or violate that network’s protocols and rules.

GPLv3 provides that those who distribute GPL-covered software are deemed to waive their rights to prevent circumvention of DRM technology under the DMCA and other countries’ similar laws "to the extent such circumvention is effected by exercising rights under this License with respect to the covered work." Thus, while GPL-covered software may be used to implement access or copy controls as a technical matter, those who do so are deemed to waive any legal right to prevent circumvention of those controls. GPLv3 also provides that distributors of GPL-covered software disclaim "any intention to limit operation or modification of the work as a means of enforcing, against the work’s users, your or third parties’ legal rights to forbid circumvention of technological measures." This provision seeks to prevent distributors from using anti-circumvention legal rights to prevent users from modifying GPL-covered code.¹² The FSF added these terms because it views DRM as a set of "nasty features" and DRM’s widespread use as fundamentally contrary to the free software movement.¹³

GPLv3 lays out new terms relating to when software becomes subject to the GPL, i.e., what circumstances trigger the GPL’s "viral effect." In particular, under GPLv3, the GPL’s terms apply to "modified" works, where the term "modify" is defined to mean "copy[ing] from" or "adapt[ing]" any part of a work licensed under the GPL in such a way that would otherwise require copyright permission, other than making a verbatim copy.¹⁴ This new terminology departs from GPLv2, which focused on code "derived" from, "based" on, or "containing" code distributed under the GPL. The FSF has suggested that this change in language is not intended to be substantive (rather, the FSF has indicated that the change is part of an effort to "internationalize" the GPL by moving away from terminology identified with U.S. copyright law),¹⁵ but the change could turn out to be meaningful in some circumstances.

GPLv3 also introduces the new term "conveying" to describe, among other things, the activities that bring modified works under the GPL.¹⁶ To be deemed to have "conveyed" code, a person must: (1) have "propagated" the code, i.e., have done something that, without permission, would make the person liable for direct or secondary infringement under applicable copyright law (except executing the code on a computer or modifying a copy privately), and (2) have done so in such a way that enables others to "make or receive copies." The FSF has said that "conveying" is essentially the same as "distribution" (as understood under U.S. copyright law),¹⁷ but, as with other changes, it remains to be seen whether differences will emerge in application of the new language.

The FSF rejected calls for GPLv3 to address the so-called applications service provider (ASP) "loophole" and treat software used on an ASP basis as the equivalent of distribution. Instead, GPLv3 specifically excludes from the definition of conveyance "[m]ere interaction with a user through a computer network, with no transfer of a copy."¹⁸

Also, recognizing that many enterprise users engage contractors to modify and host software, GPLv3 now gives users explicit permission to "convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright."¹⁹ This permission applies only where the contractors make or run the software "under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you." Moreover, since transmission to contractors (even under these limited circumstances) is characterized as "conveyance," this permission does not necessarily allow users of GPL-covered software to treat their contractors as the equivalent of the users’ own employees.

Another key change in the new version of the GPL involves what a distributor has to do once software it distributes comes under the license. GPLv3 more clearly defines the requirement to provide "corresponding source code." When distributors distribute works containing GPL-covered software, they must provide all the source code necessary to modify the works and to generate, install, and (for executable works) run their object code. That expressly includes providing the source code for any "shared libraries and dynamically-linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work," regardless of whether the distributor views such libraries or subprograms as part of the same work.

The FSF also published a final, official new version of the GNU Lesser (or Library) General Public License on June 29.

The above categories reflect some of the main changes in GPLv3, but other nuances could affect your business. We do not at this point know who will adopt GPLv3 or how quickly they will do so.²⁰ It is clear, however, that the Free Software Foundation, the Samba Project, and some other key open source copyright holders will adopt GPLv3 and that many companies will have to consider the issues it raises.

Footnotes: