[tlug] GPL question (again!)

["Stephen J. Turnbull" <turnbull@example.com>]

Josh Glover writes:

 > I have a completely hypothetical question for the GPL experts on the
 > list (I'm looking at you, Steve).
 > 
 > Let's say that some company has a piece of backend software with a
 > REST interface. Let's also say that some idiotic developer stuck a GPL
 > notice at the top of some of the source code files, despite the fact
 > that no GPL code is linked in.
 > 
 > Can the company legally remove the GPL notice from the source
 > files?

Yes, on copies remaining inside the company.  The GPL says nothing
about those copies, so the question is moot.  Otherwise....

If the company holds copyright or a license permitting them to
redistribute under other conditions incompatible with the GPL or a
license to sublicense, they may also distribute those modified copies
and derivative works (eg, binaries) under other terms, and remove the
GPL permission notice.  If they don't, they can't.  End of story.

                           ****************

Not really, of course, since you don't say what the developer's
contractual relationship with the company was at the time of the
insertion of permission notice.  That will determine whether the
company holds copyright (and/or the necessary license to remove the
GPL) or not.

There are many possibilities here.  There may have been an implied or
verbal contract, in which case it's company's word against
developer's.  You need a real lawyer to sort that one.  Once the terms
of the actual contract have been determined (possibly by a court), you
know who holds what rights, then see below.

There may have been a written contract, assigning all work by the
developer to the company.  Open and shut, the company owns the
copyright.  (Raymond has the right of this.  There are issues about
validity of such contracts concerning work done not on company time
using hardware not owned by the company on software not used by the
company, and you'd need a real lawyer, and maybe have to bet on a
judge.  But that evidently does not apply in the case in point.)

There may be a contract that the developer signed, but he's never seen
the terms, and they change at the whim of the employer as long as they
remain within customary usage (hello, Japanese organization
employees).  Anything's possible, and in Japan, it has gone both ways.
For patents, most of the time the inventor employee loses, but there
was the "blue diode" case where the company decided to fight in
principle and got smacked hard -- my guess is they could have escaped
with oku-en on a cho-en product, but they tried to go with "usual
practice is 100 man-en and an attaboy letter from the kaicho, why
should he get more", and ended up having to pay about 1000 oku-en.

If you worked for a Japanese national university or research institute
(which mostly no longer exist, now they're all "special public
corporations"), then the deal used to be true joint copyright in the
work held by the Ministry of Finance and the developer.  This is like
a song by Lennon *and* McCartney with lyrics by Lennon and music by
Lennon and McCartney: only Lennon or his agents or assigns can license
the lyrics, but both Lennon and McCartney have full rights in the
music and either can individually license (including exclusively!) the
music.

Another possibility is that the developer showed work done *before* or
*outside* of his employment contract to his boss, and the boss said
"we can use that!"  In which case the usual "author holds copyright"
principle holds and the GPL is valid, and the company needs to show an
explicit license or assignment of copyright.

So things can get really complex.  But for reasonably large US
companies in the past 2 decades, there's at least an "work done on
company projects with company resources is automatically assigned to
the company" clause in the employment contract, so most likely the
employee never had the right to license in the first place.  (I think
there's actually a presumption in US law that work done under those
conditions is implicitly work for hire, unless the contract explicitly
says otherwise.)

So I would put money on your friend having no legs to stand on, at
least not in court.

 > This source has never been distributed in any way, nor have the
 > compiled binaries. The binaries have only ever run on servers
 > belonging to the hypothetical company for which the idiotic
 > developer no longer works.

All this is irrelevant to the validity of the GPL.  This means that
the company has used the code in a way conformant to the GPL, but it
doesn't imply that they were under any obligation to do so.

A few comments on other posts:

 > (But, for your broader question, my *guess* would be that there has
 > never been a licensee, so no license exists yet either.)

No, if the GPL is valid, there is a licensee -- any and all members
of the public.  Existence of a license is independent of whether it
has, or even physically can be, exercised.

 > The copyright holder(s) of the software can relicense it, given
 > unanimous approval from all copyright holders.

Inaccurate.  In software it is common that each slice (in the Python
sense, it need not be contiguous) of the source was introduced by a
specific developer, and that slice is "owned" by that developer or his
assigns.  Thus to relicense the whole, you need consent from all
copyright holders.  However, you can always remove dissenters' slices
and relicense the rest.  This might be trivial or nearly useless, of
course.

On the other hand, it is possible (eg, under some of the "agile"
development processes) that authorship would be construed to be joint,
and in that case multiple authors have full and independent copyright
in the whole.  (If you think dealing with that would be as messy as a
divorce, you're right.)

 > All subsequent versions of the software will be under the new
 > license, while prior versions remain under the GPL.

That's the FSF's position.  However, at least one respected lawyer
(Larry Rosen, who is one of the OSI's lawyers and also attorney for
some FLOSS projects IIRC) believes that the GPL can in principle be
revoked, under US law.

This is difficult to accomplish in practice for two reasons.  First,
since the FSF is quite public about its interpretation that the GPL is
a perpetual grant, you'd have a difficult time arguing otherwise under
contract law (the FSF claim that the GPL is a *unilateral* grant, not
a contract, is legally a lie -- it's whatever the parties agree it to
be).  Second, in US law there is a principle called "reliance", which
says that if commitments are made based on a justified belief in the
term of the license, and premature revocation of the license would
make those commitments "unreasonably" hard to fulfil, the license
remains valid despite the attempted revocation.

 > However the former dev, having a copy of the source, can release it
 > anytime. Or has already.

Physically, can.  Legally, it depends on whether the developer held
copyright at the time the notice was added, and (as Raymond points
out, whether that copy was legally obtained or kept).  Whether code is
licensed under the GPL depends on the existence of a valid GPL, not on
the presence or absence of the GPL notice.

Of course if the GPL is valid, once the code is "outed" only the
developer is liable (eg, if he was under a valid NDA for that code),
and at best the company can try to show that outside users have
received stolen property and force them to return it.  Ask a lawyer, I
have no idea if that works.  The developer stole, but the license is
valid.  Either way the developer might be liable for many millions of
dollars in damages (legal expenses or worse, lost revenue).

 > Company can try to seek employment misconduct, but will be hard.

No, there is no serious misconduct involved, as the software in
question is not derived from GPL software.  Either the GPL is valid
because the developer had the right to grant it, or it's just
mischief, on the order of comments deriding the skills of a certain
Emacs developer that used to be sprinkled all over the XEmacs code.
(Of course such "mischief" could have real economic consequences for
the company, if it had to initiate lawsuits to stop others from using
leaked copies of the faux-GPL code or defend a libel suit.)

If there was a written contract with the developer in question,
assigning copyright to the company, or granting a license to
sublicense to the company, it's open and shut.  You can try to break
the contract, but *that* is hard.

 > Especially now that we have a record of intent (you asking for
 > legal advice on public ML), hypothetically.

 > Does the hypothetical company have proper development standards,
 > documented and enforced? If they are hypothetical, would be hard to
 > go after a hypothetical employee that hypothetically could have
 > carried hypothetically GPL code in a hypothetical job misconduct.

None of these hypotheticals affect the basic question of copyright
ownership or contractual license held by the company, and that is all
that matters here.  (Exception: if things are sufficiently murky, it
might not be possible for the developer to prove he wrote the code,
and in that case he might have no standing to enforce the GPL
whatsoever even if it were theoretically valid.)

Steve