OPINION

Open Source and the Legend of Linksys

People often ask me how likely it is that an open-source license like the GNU General Public License will ever be enforced. When they ask that, they usually mean: “If I violate it will I get caught?” It’s a legitimate question, if one lays aside moral rhetoric, such as the idea that proprietary software companies are merely evil capitalist agents seeking to abuse the rights of free software developers.

It is the natural tendency of the citizens of a nation of laws to know exactly what the law allows them to do. Thus the legal profession, and thus the question: What can we get away with?

Now, even the most starry-eyed of us must acknowledge that with no enforcement there is no law. Anyone who has tried to train a dog to stay off the sofa knows that. So, no one will comply with the terms of a license agreement like the GPL, with which compliance can be challenging if not downright burdensome, unless they believe someone will enforce it.

Clear Picture

When open source first became popular, lawyers and businesspeople alike wondered about this. Would free software advocates be willing to police their rights? Would a group that was vocally opposed to intellectual property rights undertake the tedium and expense of intellectual property lawsuits?

After all, enforcement of IP rights has historically been the bailiwick of the media and the technology industry, not starry-eyed dreamers who believe in making the world safe for software. Did these people, who disdained hiring lawyers to write license agreements for them, really want to send lawyers out to sue people?

Eventually, the technology industry discovered that the answer was probably yes. But in the meantime, many people raised many questions and arguments about the GPL and its likely enforcement, most of which were ill-informed. Such as:

  • There is no “I accept” button on the GPL, thus no contract. In legal terms, this is known as a formation defense. However, the Free Software Foundation is right when it says without an express license to distribute, which you probably can’t get without accepting the GPL terms, you cannot distribute their code. So, this argument might work for people who are only users and not distributors of the GPL, but users are not the ones who want to challenge the “viral” GPL’s requirements, which only attach on distribution. Moreover, formation challenges to online agreements are weak, and as time goes on, they will get weaker. In the 1980s and early 1990s, formation defenses were a hot issue; now they’re pretty much dead.
  • The GPL “violates the U.S. Constitution.” Only SCO would be deranged enough to make this argument (which it made in the lawsuit with IBM). The sputtering explanation of this argument by SCO did make for droll reading, but if you read it, and were worried you were missing something, you weren’t. It’s wrong.
  • The GPL “has never been tested in court.” People who make this argument must not realize how fascist it sounds. There are probably regimes where private contracts are not valid until they are approved by a central governmental authority like a court. But none of us actually wants to live there because of that small detail of freedom of contract being an essential political freedom.

There are interesting arguments about enforcement of open-source licenses like the GPL, but no one ever seems to discuss them. Most lawyers, like me, are probably waiting for someone to actually get sued, and hoping to get hired to defend them so they can get paid for their ideas rather than thinking them up for free. But, in brief, there will be many challenges. What is a “reasonable royalty” for using software that is free of charge? Will statutory damages be available? Who has standing to enforce the agreement? Does the “viral” nature of the license constitute copyright misuse? There are others; these are the obvious ones.

The Important Questions

It is important to understand that there are two questions lurking here, not one: “Can the agreement be enforced?” and “Will the agreement be enforced?” The first is a purely legal question, and can be answered by any smart law student who is willing to put in a lot of research and analysis time. The second is the reason people don’t hire law students to answer the first question. Every attempt at enforcement of any open-source license generates a lot of buzz, but not because anyone believes it will resolve the first question. People want to know about the second: What, exactly, can we get away with?

To answer this, it’s important to understand how violations of the GPL appear on the enforcement radar screen, so here is how: Somebody rats on you, usually your competitors or disgruntled employees. Now, anyone who works in law enforcement knows that this is the way almost all violations of the law are reported. Drug dealers rat out other drug dealers and in doing so use the police as antitrust enforcers. But in the free software world, while people may rat on you because it is in their personal interest, they will also rat on you because it is their moral duty. So you will be reported not only by competitors and employees, but by true believers as well. As you might imagine, this is much more perilous.

So much for the informants. Now for the cops. Here is some advice from the Free Software Foundation’s FAQ on the GNU GPL:

What should I do if I discover a possible violation of the GPL? You should report it. First, check the facts as best you can. Then tell the publisher or copyright holder of the specific GPL-covered program. If that is the Free Software Foundation, write to license-violation@gnu.org. Otherwise, the program’s maintainer may be the copyright holder, or else could tell you how to contact the copyright holder, so report it to the maintainer.

Fair enough: This instructs you to report a violation to the copyright owner. Given that in the U.S., no one can enforce intellectual property rights but their owner, that makes sense. However, the FSF also acts as a de facto enforcer of any violation of the GPL, even when FSF is not the copyright owner: “We encourage others to share with us any technical information about this or any other GPL violation …” (quoted from a FSF posting signed by David Turner, GPL Compliance Engineer, FSF Bradley M. Kuhn, Executive Director, FSF, about the Linksys matter discussed later in this article). In the free software world, the FSF owes this de facto enforcement role in part to practicality — it has more resources than most free software developers — but also thought leadership, because the FSF has thought long and hard about what the license means, and has detailed policies and FAQs on compliance.

The FSF’s enforcement resources are significant, though they may not equal the war chests of some of the larger patent enforcers. The FSF, through its “Compliance Lab,” conducts, according Forbes in 2003, 30 to 40 investigations at a time. That is quite a bit of work, which in a private company would take up at least a full time lawyer or two.

The FSF’s actions to enforce the GPL are conducted largely in confidential discussions:

This isn’t the first GPL violation we have dealt with; we’ve been actively enforcing the GPL for over ten years. Our usual practice is not to publicly announce details of ongoing violation negotiations, because we find that private negotiation yields quicker and better cooperation.

Again, fair enough. This is how all infringement lawsuit threats are handled. Public announcement of an infringement threat takes away a significant bargaining chip of any IP enforcer. In the world of private IP enforcement, where people threaten suits to enforce patents or proprietary software, the threat of public exposure means a falling stock price for public companies, or a bitter pill to investors of private companies. In the free software world, the emphasis is more on public embarrassment, but the mechanism is essentially the same.

So far, on a macro scale, enforcement actions are similar for the FSF and for private IP owners, but now the cases diverge. The FSF seeks different remedies from private IP enforcers. “Our number one goal in any GPL violation case is to get proper and full compliance with the license; everything else is secondary.”

Indeed, everything else may be impossible. The FSF’s position that the GPL is “a license not a contract” probably means that the FSF cannot successfully seek injunctive relief to force anyone to lay open-source code. The fact that it does not charge license fees for its software probably means it cannot seek damages based on the amount of a reasonable royalty — though it could still rely on statutory damages. So the FSF’s position — comply or stop using our stuff — is, quite neatly, mostly what they could get under the law. The FSF publicly states they do not seek to force laying open of code, only compliance. And they do not seek damages, though a check written to augment their enforcement funds is understood not to be unwelcome.

The Legend of Linksys

The “Legend of Linksys” is a metonymy for this second question, in the reverse: What have people not gotten away with? The legend has at least two sides to it: the legal and the factual. First, the facts.

I have no personal knowledge of any of the facts I am about to describe; if I did, I would not be writing an article about it. But the facts here may be murky, and I welcome correction; my lack of personal knowledge is further complicated by the legendary nature of the story — legendary, because the negotiations to resolve it were non-public. The sources I used to put this together were mainly the Forbes article “Linux Hit Men” dated October 14, 2003, an article of the same date in Linuxdevices.com quoting Bruce Perens, and several random bulletin board postings about the Linksys product.

Linksys is a very successful purveyor of WiFi routers, in particular the WRT54G 802.11g wireless home gateway. In March, 2003, Cisco Systems bought Linksys for US$500 million. After the acquisition, in June 2003, complaints appeared on discussion boards such as LKML and Slashdot claiming that Linksys was violating the GPL by not providing source code for certain code used in its WRT54G wireless access point. (See for instance this posting.) The Linksys product included both the Linux kernel and other GPL code.

This is the nightmare scenario for an acquiror worried about open source. In the trade this is known as “buying a lawsuit.”

The FSF stepped in, stating publicly that it was spearheading enforcement for multiple copyright holders who had licensed materials under the GPL: “[W]e are leading a coalition of many copyright holders in the WRT54G, as Linux is only one part of a large body of GPL’ed software in the product. We formed this coalition because, having done enforcement cases for a product with a broad range of copyright holders before, we have found that separate enforcement actions and/or law suits from individual copyright holders make attainment of compliance more difficult.”

Undoubtedly informal enforcement actions are easier with fewer parties involved. However, this statement as it relates to “law suits” is a bit disingenuous, for two reasons: first, FSF has never actually led a formal defense group to enforce the GPL in court, and second, if it did so, it would likely do so based not on convenience, but necessity, as separate suits might be impossible due to legal due process requirements.

What Can Be Learned

Linksys eventually released the source code at issue. Various Web reports place the release at three to four months after the first demand by the FSF. It is amusing to read the morally outraged postings on this subject that describe this result as glacially slow. It seemed fast to me. The only way to do it faster would have been a scorched earth TRO action or some jackbooted GPL police.

The first take-away from this case is the difficulty of doing enough diligence on software development in an age of vertical dis-integration. Cisco knew nothing about the problem, despite presumably having done intellectual property diligence on Linksys before it bought the company. But to confound matters, Linksys probably knew nothing of the problem either, because Linksys has been buying the culprit chipsets from Broadcom, and Broadcom also presumably did not know, because it in turn outsourced the development of the firmware for the chipset to an overseas developer.

To discover the problem, Cisco would have had to do diligence through three levels of product integration, which anyone in the mergers and acquisitions trade can tell you is just about impossible. This was not sloppiness or carelessness — it was opaqueness.

There is no way around this problem if one approaches open-source diligence from a provenance angle. Finding the ultimate source of code is too difficult. This argues for “back-end” risk management like insurance and code matching, which are becoming more and more attractive alternatives as the complexity and prevalence of open source assets increases.

Accepting Controversy

The second take-away is that this was a strong case for the FSF, but to understand why takes us into some of the more excruciating details of kernel development. One online complaint said:

I am unable to build a working Linux kernel based on your tree due to source code missing from arch/mips/brcm-boards/ and other directories. You also seem to have modified the kernel module loading process, as standard kernel modules built from your tree load without warnings on a running WRT54G, but apparently do not function properly. … I believe it is a violation of the GPL to distribute versions of the Linux kernel that are missing critical, non-modular kernel code.

I quote the above not for the truth of its assertions, but to point out why Linksys got tagged. The writer was unable to build a working kernel. He characterized the undisclosed code as “critical” and “non-modular.” Engineers are practical folks, and they don’t tend to quibble over adhering to the letter of a license if they can reap its benefits. He could not reap. Consider also this comment (cited above) on the LKML board:

I know that traditionally, Linux has allowed binary-only modules.However, I was always under the impression that this required that the final customer be allowed to remove them at will. That is to say, you couldn’t choose to implement a portion of the kernel critical to the system’s operation in a module, and then not release that module under the GPL. In this particular case, I would argue that the wireless drivers are critical to this device’s operation …

This writer is making a crucial point: There is some controversy in the free software world over whether some kinds of kernel modules escape GPL terms. But Linksys was not in one of these gray areas. Linksys not only included kernel modules in their code, they included statically linked kernel modules that could not be separated from the kernel. For the FSF, this was game, set and match.

Several commentators have noted that GPL compliance issues are particularly problematic in embedded applications, as well as code developed by overseas developers. The Legend of Linksys bears out both these observations.

It’s a Small Welte After All

Across the wide ocean, other enforcement of the GPL runs along a different trail. Harald Welte, a self-appointed enforcer of the GPL who operates a GPL Web site filed two actions with the District Court of Munich to enforce the license. In both cases, Welte was the author of code that had appeared in the defendant’s product. The court granted Welte an injunction against Sitecom Deutschland GmbH, prohibiting Sitecom from distributing a wireless networking router until it complied with the GPL. Sitecom appealed the injunction, but lost, and Sitecom later posted the terms of the GPL on its FAQ Web page for the router. Welte also filed for an injunction against Fortinet UK Ltd. based on its firewall products, with similar results.

Though much has been made of these two cases, there are reasons why Welte has already obtained injunctions in Germany while the FSF has not yet sought one in the US. Injunctive enforcement in Germany is so simple and quick that it makes Americans suspicious about piddling legal details like legal due process. In Germany, a preliminary injunction can be obtained ex parte — in other words, without giving the defendant the chance to defend itself. (This has the appropriately scary sounding name einstweilige Verfuegung.)

Also, in Germany, an author of a component piece of software can enjoin an infringer from distributing the entire program, not just the part he owns. In the US, any injunctive relief requires that the defendant have the ability to present a defense. Moreover, in the U.S., a plaintiff seeking a temporary restraining order must post a bond to compensate the defendant in case the TRO is wrongly issued. In Germany, there are no such niceties. So, before you start flushing your proprietary loadable kernel modules down the commode, remember that the path to an injunction here in the U.S. — and indeed in most common law countries — is much more treacherous. This is why injunctions in Germany are likely to happen long before — or in lieu of — injunctions in the U.S.

More interesting to U.S. companies are Welte’s informal enforcement actions, which have included sending letters to over a dozen large commercial software and appliance products including Motorola, Acer, Micronet, and Buffalo. The problem is that Welte apparently does not hold the copyright to the code that is the subject of these letters. Welte’s approach is to send public letters and announcements first, rather than seek confidential action.

The Landscape Evolves

Anyone who decries the enforcement actions of the FSF only need read Welte’s blog to appreciate the FSF’s restraint. Some of Welte’s targets have complied voluntarily, but one suspects that is because they were simply unaware of the problem. Welte apparently has no authority to enforce these copyrights. These actions are not really legal enforcement — more the equivalent of picketing companies that use cheap overseas labor. It is an attempt to embarrass, not enforce.

It is also impossible to avoid observing that Welte often proceeds without the benefit of legal analysis. For instance, he targeted AOpen, which responded, that he “should have directed that letter to their Taiwanese mother company, since the products that I claim are in violation of the GPL are not sold in Germany. They don’t get it. Its their problem if they don’t comply with the license. Its they who are liable for copyright infringement. I don’t care which particular subsidiary of a multinational corportation [sic] is responsible. It is in the best mutual interest of any subsidiary to assure that they comply with license conditions.”

Actually, AOpen’s point was probably that there was no action under German law because lack of an infringing product in Germany meant it was not within German jurisdiction. But, it so happened, that AOpen was actually compliant, having offered the source code on a German Web site, as Welte later noted in his blog. Nevermind.

This kind of stuff gives lawyers the willies, on the one hand. Lay commentators who post on blogs or bulletin boards about open source legal issues without the benefit of legal reasoning are a dime a dozen, but at least they don’t usually sue people. On the other hand, who would you rather be sued by: Welte or the FSF? Given that most of Welte’s complaints would fail in the U.S. on procedural grounds that would allow a defendant to jettison the case quickly, he is my plaintiff of choice.

Other enforcement of the GPL has been of less note. The MySQL case, which is the only lawsuit ever filed in the U.S. regarding GPL code, was disposed of on unrelated grounds. The FSF has conducted regular informal enforcement, but none has garnered quite the press of the Linksys matter. In 2002, the FSF engaged in a GPL enforcement action against OpenTV, a San Francisco company that ships a set-top box containing Linux. According to Forbes, OpenTV ended up paying the FSF $65,000. But OpenTV also reportedly complied by making available the requested code, so the purpose of the payment is unclear. The FSF’s stated mission is not to demand money damages for GPL violations.

Meanwhile, we are all waiting for the other shoe to drop. And while rumors occasionally circulate that lawsuits will be filed — as in the case of OpenTV — there is a big difference between making threats and filing lawsuits. So, get used to standing on one foot, while legend of Linksys lives on.


Heather Meeker is a shareholder at the international law firm GreenbergTraurig, LLP, and specializes in intellectual property transactions for software and other technology clients. Ms. Meeker is the co-chair ofthe Open Source Committee of the Science and Technology Section of theAmerican Bar Association. She advises clients regularly on open-sourcelicensing issues and open-source business strategies.


6 Comments

  • http://ganesha.gnumonks.org/~laforge/weblog/2005/07/02/#20050702-meeker-article
    .
    The article is radically misinformed about Harald Welte and his activities. It is a shame, almost AM ounting to slander, that since Welte has provided verifiable corrections to the text of the article, it remains unamended.
    .
    Excerpt:
    .
    The truth is: AOpen Germany offered the _object_ code of the GPL licensed software on their German ftp-server, without complying to the GPL license terms. My blog clearly states "Firmware" (which is by definition object code, not source code). This means that in fact they are even legally responsible, since they distributed GPL licensed software without adhering to the license conditions.
    .
    (End excerpt)
    .
    That is, in contrast to the suggestion of the article that AOpen had provided source code, they in fact distributed binaries and by doing so engendered on themselves the obligation to distribute the source code. Obviously the author has hold of an inappropriate end of the stick, here!
    .
    Excerpt:
    .
    Two other quotes from your article: "The problem is that Welte apparently does not hold the copyright to the code that is the subject of these letters."
    "Some of Welte’s targets have complied voluntarily, but one suspects that is because they were simply unaware of the problem. Welte apparently has no authority to enforce these copyrights."
    This is again wrong. I have never enforced any copyright that I don’t own. What has happened is that some other Linux kernel developers have transferred their copyright to me, so I can take action in cases where my own copyright is not involved. (which by the way is also a good indication that gpl-violations.org is not some lone lunatic but backed by the development community).
    .
    (End excerpt)
    .
    Welte goes on to say that he has submitted comments to this page, and the editor of the site has not yet approved them for publication. I regard this as singularly unfortunate, and I believe it reflects very badly on the integrity of this site.

  • "Linksys probably knew nothing of the problem either, because Linksys has been buying the culprit chipsets from Broadcom [which] in turn outsourced the development of the firmware for the chipset to an overseas developer."<P>
    Who did the work is completely irrelevant. We’re talking about the Linux kernel. The question is: was the kernel modified, and/or were modules added? In order to ship its product, Linksys had to build its code from source. Even if the infringing code were in fact written elsewhere, it would still be in-house, else the product could not be compiled. Only inexcusably sloppy source code management would fail to keep proprietary code separate from GPL code; if that’s what happened, I’d say Linksys got off lightly. Just imagine the consequences if it had been, say, Microsoft’s code that had been used in exception to the license.
    GPL or not, every company keeps very careful track of source code for shipped binaries. There is no chance Linksys didn’t know what it was shipping.
    "To discover the problem, Cisco would have had to do diligence through three levels of product integration, which anyone in the mergers and acquisitions trade can tell you is just about impossible. This was not sloppiness or carelessness — it was opaqueness."
    I don’t know where you get that impression. If an ordinary user — technically competent but without access to any proprietary information — can discover Linksys’s infringement, how can it be "just about impossible" to ensure compliance?
    A better explanation would be that Linksys tried to see what they could get away with, and used their de facto "proprietary period" to competetive advantage. Six months on the market while your competitors don’t have your source code is surely an advantage, wouldn’t you say?

  • As someone who is thoroughly involved with the matter of GPL violations, some additional comments:
    |
    1. It’s not your competitors or disgruntled former employees. From my experience, in almost all cases it’s your customers. Users who look at your product and find out that they actually had the right to read, modify, recompile the source code but who have been deprived of this right. In the remaining few cases it’s actual current employees of the particular company. Employees who have previously informed their superiors (with no result) about the copyright infringement they perform by not adhering to the GPL.
    |
    2. Regarding the "money was paid in addition to the source code made available" issue: Publishing the source code can only prevent further GPL violations from distributing the product now and in the future. I suspect the money was paid as compensation for the number of copies that had alrady been made in the past and distributed without license compliance. Sometimes there is also a "grace period" in which already-produced license-incompliant copies of the software can still be sold license incompliant for a certain period of time.

  • There is nothing wrong with press articles and commentaries about the GPL, the gpl-violations.org project or myself, no matter how critical they are – as long as they are based on facts. Spreading lies is however not acceptable to me.
    The most obviously wrong statement is "But, it so happened, that AOpen was actually compliant, having offered the source code on a German Web site, as Welte later noted in his blog. Nevermind.".
    The truth is: AOpen Germany offered the _object_ code of the GPL licensed software on their German ftp-server, without complying to the GPL license terms. My blog clearly states "Firmware" (which is by definition object code, not source code). This means that in fact they are even legally responsible, since they distributed GPL licensed software without adhering to the license conditions.
    Two other quotes from your article:
    "The problem is that Welte apparently does not hold the copyright to the code that is the subject of these letters."
    "Some of Welte’s targets have complied voluntarily, but one suspects that is because they were simply unaware of the problem. Welte apparently has no authority to enforce these copyrights."
    This is again wrong. I have never enforced any copyright that I don’t own. What has happened is that some other Linux kernel developers have transferred their copyright to me, so I can take action in cases where my own copyright is not involved. [which by the way is also a good indication that gpl-violations.org is not some lone lunatic but backed by the development community].
    Obviously I reserve the right to inform any organization about illegal copyright infringement they might be committing, even if I’m not the copyright holder. This must not be confused with legal GPL enforcement by an actual
    copyright holder through in or out-of-court legal action.
    Specifically, regarding to the "CeBIT letter action", I could have started legal procedings in all those cases. In fact, my legal team an I were planning to personally hand over a preliminary injunction at one of the CeBIT booths. Rather than doing so, I thought I could save the respective infringing companies the trouble of legal charges and legal expenses by first writing them an informal letter.
    — Harald Welte <laforge@gpl-violations.org>

  • I have a couple annoyances with this article. For one, it works from the presumption of violation, as if the author were telling us, "Things to consider when you are stealing code…"
    |
    For another, it portrays source code released under the GPL as somehow different and more dangerous (??) than other copyrighted works. This is just disingenuous. Any software shy of public domain is going to carry licensing terms. Why does Ms. Meeker presume GPL code is something that will or should be pilfered within a corporation?
    |
    It also, mind bogglingly, fails to present the optimum, most used route available to companies interested in using GPL code — Hey, don’t cheat! Play nice and reap the same rewards as companies like Red Hat, IBM, and gangs of others enjoying Linux’s multi-billion dollar markerplace.
    |
    And for Pete’s sake, why must GPL authors always be portrayed as loony and starry eyed zealots. Doesnt Ms. Meeker realize these are intelligent, professional software developers? This zealot-card is getting old.
    |
    "The fact that it does not charge license fees for its software probably means it cannot seek damages based on the AM ount of a reasonable royalty — though it could still rely on statutory damages."
    |
    I disagree. The GPL implies an equity of exchange — you can have mine as long as you share yours. Failure to share yours breaks this exchange and, as mentioned, means you are using my copyrighted work without permission. A software author could reasonably demand remuneration if you are profiting from his labor.
    |
    "This is the nightmare scenario for an acquiror worried about open source. In the trade this is known as ‘buying a lawsuit.’"’
    |
    Shouldn’t an acquirer be concerned about ANY copyright infringement? Shouldnt they be concerned about THOUSANDS of issues? Why is open source the boogeyman in the scenario?
    |
    Quoting a Daniel Lyons article from Forbes is also serious blow to this credibility of this piece. Mr. Lyons is a well known for his shallow, ad hominen attacks, hated of all things Linux, and all around shabby reporting.
    |
    Lastly, Ms. Meeker greatly understates the FSF approach to violations as compared to a commercial outfit. Would you rather have a discreet phone call from Mr. Kuhn hoping to resolve (at no expense) the violation OR have a company like SCO sue you for billions because they *think but cant show* that maybe you took something?

  • An interesting sidelight to the Linksys story is that nowadays the WRT54G series of WiFi routers is the weapon of choice for Linux gurus because the source code is freely available under the GPL. WRT54G routers can be made to do just about anything in the WiFi world, and certainly far more than the original or current owners dreamed of.
    I hazard the guess that far more WRT54Gs are sold than would have been the case were the source code not available.

Leave a Comment

Please sign in to post or reply to a comment. New users create a free account.

LinuxInsider Channels