15

I have a question regarding code which was originally under GPL. The code was used and was built upon and used as a service. The code was kept private, which seems okay under GPL.

However, if one of the developers was to steal the code or it was leaked. How does this work? I can't really find any information regarding this situation online.

Ryan1986
  • 159
  • 1
  • 3

2 Answers2

16

The code of the service has multiple copyright holders. Some published code under the GPL, others didn't publish the code at all. If the service code were to be published, it could only be published under the terms of the GPL license.

However, it is the right of each copyright holder to decide whether their code shall be published. If the code were to become public against their will, that would be copyright infringement. The right to control whether a creative work is published is more fundamental than the GPL. Therefore, the illegally published code would not have a valid GPL license attached to it.

The GPL FAQ has a related entry:

If someone steals a CD containing a version of a GPL-covered program, does the GPL give the thief the right to redistribute that version?

[…] If the version in question is unpublished and considered by a company to be its trade secret, then publishing it may be a violation of trade secret law, depending on other circumstances.

I think that the FSF's reference to trade secrets is correct but not necessary, and that the illegal publication is already prevented by copyright law. So what the thief is doing is illegal whether or not they are stealing from a company that has trade secrets.

Jurisdiction-specific arguments for the US (but this is going to be similar anywhere):

Distributing copies of a copyrighted work is the exclusive right of the copyright holder(s) under 17 USC 106. A thief has not received permission from the copyright holders of the service, therefore the thief is performing copyright infringement (17 USC 501(a)). The GPL restricts the service's copyright holders that they must license the code under the GPL if they distribute it, but does not compel them to distribute it in the first place.

Possible counterargument: if the service is a joint work then all joint authors might have full rights to the work. A joint author cannot “steal” their own work by publishing it. However, a lot here would depend on the specifics.

If the service was created as a work for hire, the developers are not copyright holders and have no rights in the software. Joint authorship cannot apply in that case, and this would be plain copyright infringement.

amon
  • 38,880
  • 1
  • 86
  • 113
  • (1) Does the author of a work have to do something in order to obtain copyright of their work? for example, the company for which I work is adamant at having a copyrigt line in each source file. – Peter - Reinstate Monica Mar 07 '19 at 14:42
  • (2) Even if stealing (and, (2b), possibly publishing) the GPL-derived work in binary form violates the copyright of the company: Is this copying also a violation of the GPL, i.e. would the FSF have independent standing in court, in addition to the company? I think the OP is aiming at the question whether a third party (not the person who produced the GPL-derived work) can violate the GPL. – Peter - Reinstate Monica Mar 07 '19 at 14:46
  • 1
    @PeterA.Schneider If in doubt, ask a separate question :) (1) Copyright is automatic as soon as a creative work is created, in all countries that signed the Berne Convention (= nearly every country). Per-file notices are not necessary, but mostly a relic from before the US joined Berne. They also reduce confusion about the copyright status. Btw Germany is a bit special because copyright is not transferable: a company doesn't hold the copyright itself but only an automatic exclusive license. – amon Mar 07 '19 at 15:16
  • (2) The FSF is not party to most GPL licenses and does not generally have standing. If the work was stolen then no valid GPL license was issued, hence the license cannot have been violated. Think of the license as a contract that must be offered and accepted – the case of theft lacks an offer. But yes, it's possible to violate the GPL without modifying the work, for example by conveying a copy without source code + license. – amon Mar 07 '19 at 15:17
  • Arguably, if the organization within which the derived work was produced is making copies and distributing them internally, that is an act (at least the copying) which is forbidden by copyright law without a license to do so. (Note: software industry has always argued that it's copyright infringement to make copies for yourself, even if you don't distribute them to others, except possibly a single backup.) It's a legal gray area whether employees handling these copies have received them personally and are entitled to license under the GPL; however... – R.. GitHub STOP HELPING ICE Mar 07 '19 at 17:38
  • ...if any third-party contractors are being given copies, they should clearly receive the rights that must be granted for derived works under the GPL, and per the GPL, no terms of their contract may forbid them from exercising those rights (these would be additional restrictions). If their contract does contain such restrictions, then giving them a copy of the GPL'd work/derivative is copyright infringement. – R.. GitHub STOP HELPING ICE Mar 07 '19 at 17:39
  • 1
    @R.. The GPLv3 brings clarity in both of these issues. First, v3 triggers only on conveyance, not on any copy. Second, v3 explicitly allows contractors to work on the software without receiving full rights under the GPL. They do receive the upstream software under the GPL, but any modifications may be private to the client. The GPLv2 does not discuss this explicitly but can be interpreted in the same way. – amon Mar 07 '19 at 17:52
  • @amon: So contrary to FSF propaganda on the topic, the GPLv2 is possibly stronger... – R.. GitHub STOP HELPING ICE Mar 07 '19 at 18:15
  • @R.. Possibly, but likely not. In any case v3 is much clearer, and also provides stronger “protection” in other areas (embedded devices, patents). For the vast majority or issues, the licenses are virtually identical. – amon Mar 07 '19 at 19:29
  • @amon: It seems to me at least that in this case, as the copyright holder you could sue for their act of copying as infringement, seek injunction preventing further copying and use of derived works as well as damages, and aim for a settlement where they would agree to relese the derived work under GPL, whereas with GPLv3 this might not/would not be possible. – R.. GitHub STOP HELPING ICE Mar 07 '19 at 19:57
9

Based on my understanding of copyright licenses (local to the U.S.), it seems to me that if Alice modified some GPL-licensed program Foobar, and Bob stole and distributed her unpublished modified version, then

  • Alice never issued a license for anyone to distribute her modified version of Foobar
  • The modified version is not licensed under the GPL, since it is not licensed to anyone under any terms whatsoever

Consider a different case where Alice violates the GPL herself by distributing a modified version of Foobar but clearly licenses her parts of the work under a GPL-incompatible license. In that case, her parts don't become GPL licensed without her say-so by some legal magic. Instead, she's simply committed copyright infringement by distributing a derivative of Foobar in a way that Foobar's author did not allow. The author of Foobar could sue her for damages, seek an injunction against her to stop distribution of her modified version, etc. but cannot decide that Alice has licensed her work differently from how she actually licensed it. Alice holds the exclusive right to distribute her own copyrighted work (and therefore holds exclusive ability to license that right to others), and her having run afoul of someone else's copyright rights does not change that fact for her own work.

To return to the case where Bob steals and redistributes Alice's modifications, there once again seems to be no reason that Alice's work would be licensed under the GPL. Thus, no one may make use of Alice's work under the terms of the GPL, and neither is Alice liable for the distribution of her work in a GPL-incompatible way, since she never authorized such redistribution.

The above is my own layman legal understanding, and may be wrong and/or vary by jurisdiction.

GPL FAQ does not comment about the copyright situation of an unpublished derivative, but it does note an additional issue in Alice's favor about trade secrets

If someone steals a CD containing a version of a GPL-covered program, does the GPL give the thief the right to redistribute that version?

[...] If the version in question is unpublished and considered by a company to be its trade secret, then publishing it may be a violation of trade secret law, depending on other circumstances. The GPL does not change that. If the company tried to release its version and still treat it as a trade secret, that would violate the GPL, but if the company hasn't released this version, no such violation has occurred.

Community
  • 1
apsillers
  • 35,995
  • 4
  • 94
  • 131