7

I'm working in a company and in my job contract there are confidential clauses concerning code, documents, etc...

In the company we are working on an open source project (GPL V3). The project is not shared yet to the public.

Do I have the right to share the code of the project with people (out from the company)?

Ellouze Anis
  • 217
  • 1
  • 3
  • 3
    Ask your management and/or legal department. Expect a "no" answer. – Dan Pichelman Jul 18 '13 at 16:28
  • 1
    For clarification, is this (A) a third party library/application that is GPL'ed that you are modifying? or (B) an in house application that you are going to release as GPL at a later point? Not that it matters too much, but they are different questions. –  Jul 18 '13 at 16:29
  • good question. And I want to add another question. what will be the situation if the company sold the product (binary + source) to its customers? – MOHAMED Jul 18 '13 at 16:51
  • 1
    Whatever answers you receive here, always keep in mind that trusting strangers on the Internet with legal advice can have serious consequences. The answers here are just a guideline, since the full context of your question is unknown. The best you can hope for from Programmers.SE is figuring out who to ask for help and if it's worth it. If this is something important for you, contact a lawyer and discuss it with him/her. Your company probably has some legal department that you can ask for help on this. – Radu Murzea Jul 18 '13 at 19:21

5 Answers5

18

You very likely do not have the right to distribute the code.

The GNU Project's GPL FAQ has this to say on the topic:

Is making and using multiple copies within one organization or company “distribution”?

No, in that case the organization is just making the copies for itself. As a consequence, a company or other organization can develop a modified version and install that version through its own facilities, without giving the staff permission to release that modified version to outsiders.

However, when the organization transfers copies to other organizations or individuals, that is distribution. In particular, providing copies to contractors for use off-site is distribution.

If someone steals a CD containing a version of a GPL-covered program, does the GPL give him the right to redistribute that version?

...If the version in question is unpublished and considered by a company to be its trade secret, then publishing it may be a violation of trade secret law, depending on other circumstances. The GPL does not change that. If the company tried to release its version and still treat it as a trade secret, that would violate the GPL, but if the company hasn't released this version, no such violation has occurred.

Assuming you are an employee, you have received the code as an agent of the company and not as an individual. Thus, the company has not yet participated in an act of distribution (as the GPL defines "distribution"), so the rights of the GPL have not been granted to you personally. You only receive rights under the GPL when you are the recipient of a distribution.

If you really want to distribute this code, talk to your manager or company's legal department to ask for some kind of approval to release the code. Expect the answer to be a resounding "no" unless you have a compelling business argument for why the code should be released.

Addendum: what about after the company starts distributing the code to clients?

Once your company distributes the software to any clients outside of itself, it would seem the nothing has really changed for you. As long as you are not one of the clients that participates in a GPL software distribution, you continue to have the same access you did before (i.e., still an agent of the company, not a recipient of a distribution), and it would appear that the same rules apply.

The only thing that seems to change once any distribution has occurred is detailed in this GPL FAQ entry:

If someone steals a CD containing a version of a GPL-covered program, does the GPL give him the right to redistribute that version?

If the version has been released elsewhere, then the thief probably does have the right to make copies and redistribute them under the GPL, but if he is imprisoned for stealing the CD he may have to wait until his release before doing so.

Several issues here:

  • In the best case, sharing the code would still violate your employee contract, even if your actions are permissible under the GPL, acting in the role the thief from the above example. You've entered into a contract not to share your company's code, regardless of whether you have a legal right to do so otherwise. You will get fired and may face legal action.

  • This particular FAQ entry might assume "has been released elsewhere" to mean the software is generally available. However, if your company only distributes its code to a few trusted associate companies, who have no interest in sharing their copies, then a different conclusion may apply.

  • Even in this example, I'm not sure by what legal mechanism the thief is granted GPL rights. The victim never willingly participated in a distribution, and some comments below note that this situation means that neither the thief nor any of his recipients have grounds to sue if their GPL rights are violated, e.g., they don't get a corresponding copy of the source. Whatever legal mechanism is at play here (assuming this FAQ entry is correct -- I've never seen any case law to confirm or deny it) may not apply to you as an employee who already has access to the code.

I'm not a lawyer, this is hardly legal advice. If you're seriously interested in the answers here, talk to a lawyer.

Community
  • 1
apsillers
  • 5,143
  • even if the company sold the product (binary + source) to its customers? – MOHAMED Jul 18 '13 at 16:41
  • 2
    @MOHAMED In this case, the OP clearly says that "The project is not shared yet to the public." That is an interesting question, however -- I'll add an addendum to my answer. – apsillers Jul 18 '13 at 16:44
  • 1
    The GPL rights extend only to the receivers of derived works. So if a company sells such derived works to another company, only that other company can assert GPL rights. An employee cannot do so on his own. Copyright of course still lies with all original authors. – MSalters Jul 18 '13 at 23:58
  • @MSalters That's my reading as well, but I was hesitant to do so, because it disagrees with the general sentiment of the FAQ. The FAQ suggests enough legal nuances here that I wanted to be pretty reserved in my analysis, but my personal layman perspective agrees with yours. – apsillers Jul 19 '13 at 12:08
  • Check Jonathan Klinger's answer (who apparently is a lawyer): " infringing the GPLv3, meaning that it distributes the software to its clients without granting them the rights and freedoms under the GPLv3". – MSalters Jul 19 '13 at 13:53
  • @MSalters Indeed, I don't see anything in Klinger's answer (which is quite good) that is inconsistent with mine. – apsillers Jul 19 '13 at 14:09
  • @MSalters In my addendum, the main problem I can't resolve without a law degree is this: in the FAQ, trade secret law seems to be the only factor keeping a thief from sharing stolen code. If the company starts selling the code, it is no longer a trade secret -- they cannot sell the code under terms necessary to maintain its status as a trade secret so it seems trade secret protection no longer applies. If an outside thief can share the code, it is possible for an employee to "steal" the code and take on the role of thief? – apsillers Jul 19 '13 at 14:10
  • @apsillers: The GPL does not have to explain basic contract law. Say that party X receives the binary, but not the source from a thief/employee not acting on behalf of his employer. This means that no contract exists between X and the employer, so X has no standing to sue. A contract does exist between the employer and the original authors (including the terms of the GPL, and possibly others) but those authors cannot sue because the employer did not convey a modified work and therefore the employer is not bound by the requirements for conveying (section 5). – MSalters Jul 19 '13 at 14:15
  • @MSalters I'd like to continue this discussion in chat, if you're interested. I'm very interested in what you're saying, since I seem to agree with virtually everything you're said, but I can't quite grasp precisely which point you take issue with. – apsillers Jul 19 '13 at 14:45
  • @MSalters I have added an into paragraph to my addendum that clearly spells out that distribution to a particular client does not mean that all employees are suddenly granted GPL rights. However, I still think that the thief-example might imply that an employee could unlawfully lay claim to GPL rights by violating his contract. Again, I welcome you to continue in chat if you object to my edited answer. – apsillers Jul 19 '13 at 22:10
3

[unlike the others, I am a lawyer, so my answer will be a bit legalese].

First, there is a difference between your confidentiality obligations (which, without seeing the exact clause, I cannot address specifically) and the terms of the licenses granted to your company (or to you, as their agent). However, I do assume that when posting here, you are letting people already know this, and might be in violation of these confidentiality obligations.

If you feel that your company is infringing the GPLv3, meaning that it distributes the software to its clients without granting them the rights and freedoms under the GPLv3, then I suggest you call your employer's counsel. Otherwise, I remind you that the GPLv3 deals with distribution of the code.

As long as you do not distribute the code (either object or source) and only using it in your own quarters, then you don't have to release it to anyone (think about how many projects Google / Facebook has that are web-based and are GPL'd).

Here is the specific section of the GPLv3 (not the FAQ, but the agreement): Article 2 (basic permissions) allow you to do whatever you want as long as you do not distribute:

"You may make, run and propagate covered works that you do not convey, without conditions so long as your license otherwise remains in force. You may convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright. Those thus making or running the covered works for you must do so exclusively on your behalf, under your direction and control, on terms that prohibit them from making any copies of your copyrighted material outside their relationship with you."

Article 6 relates to distribution, and states that "You may convey a covered work in object code form under the terms of sections 4 and 5, provided that you also convey the machine-readable Corresponding Source under the terms of this License, in one of these ways". Note the "may". "May" means that you do not "have to", but if you do, then there are terms.

-- Jonathan.

BTW: Check out my "Open Sourcing Your Code" presentation here.

Jonathan Klinger
  • 31
  • 2
2

Just because something is open source does not mean you can freely distribute it to anyone you want to. The GPL, and other licenses, are permissions granted to end users. In the case of the GPL, it grants end users the right to look at, use, and modify the software how they see fit. If the software is not distributed to someone as an end user, the GPL doesn't apply.

Thomas Owens
  • 82,739
  • even if the company sold the product (binary + source) to its customers? – MOHAMED Jul 18 '13 at 16:45
  • 1
    @MOHAMED Yes. The end user would be the entity who bought the product. In the case where it was a product sold to a company, even employees of the company could not, on their own, release the source code obtained through the GPL. – Thomas Owens Jul 18 '13 at 16:47
1

No, unfortunately, you do not have that right.

Technically, you won't have the "right" to share the code, even after the product is distributed out to the public. The company will at that time incur a legal obligation to release the source code to anyone who requests it.

Now, what you CAN do is politely lobby your management to "do what's right" and release your company's changes back to the original project. You do this by pointing out, diplomatically, that the availability of the GPL project in the first place saved the company a LOT of money, in that they didn't have to develop the whole thing from scratch, and this is a way for them to say "Thank you" to the original developers, and to "pay it forward" and encourage others to do the right thing.

John R. Strohm
  • 18,173
  • Well, you can also go grab, as a user, the product that they distribute and then sue the company for violating the GPL license if they don't hand over the source. But yeah, as a developer, you shouldn't hand out the source to anyone without the company's approval. – Philip Jul 18 '13 at 16:36
  • @Philip that is assuming that the product is being released externally. There is a significant amount of code being used in house that never is visible to the world (intranet sites and in house applications with tweaked GPL libs). –  Jul 18 '13 at 16:42
  • even if the company sold the product (binary + source) to its customers? – MOHAMED Jul 18 '13 at 16:43
  • @MichaelT That assumption was built into the answer. "even after the product is distributed out to the public" is the same thing as releasing it externally. – Philip Jul 18 '13 at 20:49
  • @MOHAMED Most DEFINITELY if the company took a GPL'd project, modified it, and sold the binary and source to it's customers. They are OBLIGATED to share that source code. That's the sort of locking away of software that Stallman fought against. That code has been freed by the GPL, and it will not suffer chains. – Philip Jul 18 '13 at 20:53
1

The GPL requires the company to make the source code available to anyone that the company distributes the product to. It does NOT have to make it available to anyone else. And the company is well within it's rights to refuse to distribute to anyone else.

The ONLY way that it's OK for you to distribute the source generally is if the company is distributing the PRODUCT generally. Of course, the better way to proceed in that case is for the COMPANY to distribute the source along side the product and be done with it.

Note that even if you satisfy the legalities, if you distribute source that your company wants hidden, I guarantee you'll be out of a job.

Michael Kohne
  • 10,046