SCC Statement on SELinux Patent Issues

Hawke writes "Secure Computing has announced a Statement of Assurance that they will not use the patents in question to limit the availability of SELinux. They continue to say: 'However, Secure Computing does not extend the Assurance to software that merely interoperates with SELinux, or is merely included with a distribution of SELinux.'" The original story was here.

Comments

Nor....

[Captain Pedantic]

can they guaranty that they won't be bought out by someone who wants to exploit the patent (eg Forgent).

Software Patents: Don't do them kids.

Re:Nor....

[rusty0101]

In their Statment of Assurance, they specifically allow that they may license, sell or re-assign any or all rights to a third party, who is not and would not be bound by the Statement of Assurance.

Basically this means that the parts of SELinux that they have a patent on, are free of licensing restrictions, so long as the distribution continues to be SELinux (you are free to modify it and re-distribute under the same name) and so long as they have not reassigned those rights on the patent to a third party.

Forgive me if I seem a bit less than touched by the assurance, but this assurance seems to me to be exceedingly self serving, and no assurance of anything.

-Rusty

Re:Nor....

[anonymous cowfart]

Last year in a show of how easy it was to disrupt and abuse the patent process by registering a common, every-day idea a Melbourne lawyer patented a "circular transportation facilitation device" with more info on the story here, here(pdf file), and here

Obviously it's too easy to get things patented these days, especially in areas of high technology as few if any patent officer workers are well versed in the areas of technology. Most of the patent office stampers would have little inclination as to how an intigrated circuit works or if an item of software recently designed is any different or unique from any other piece of similar software.

Sure, it's nice to be able to patent and protect your inventions and innovations, but when most of today's patent holders are larger corporations, it's hardly meant to protect the garage inventor anymore.

Re:Nor....

[Alan Cox]

Its actually useless. It allows them to sell it to a friend, sue everyone and buy their patent back one afternoon. The exemption excludes authorizing applicaitons or protocols (ie everything NSALinux does)

Utterly cynical. However it demonstrates how bad the US patent problem is. Even the NSA, the US ultimate investigative and spook agency can't get patent stuff sane. So now the US government has written a security system that only foreign governments can profit from due to bad USSA law and poor planning.

Its a pity Americans don't understand irony...

So they've effectively nullified the GPL?

[Tony Hoyle]

The GPL states that as long as I put my own code under GPL I can use any other GPL code without restriction - thus enforcing the freedom of free software.

Patents directly nullify this - with SELinux I can't modify it and make my own distro, or take the good bits of the code and use it in my own GPL project... making SELinux essentially proprietary.

Re:So they've effectively nullified the GPL?

[thales]

"Patents directly nullify this - with SELinux I can't modify it and make my own distro, or take the good bits of the code and use it in my own GPL project... making SELinux essentially proprietary."

Not entirely true. As long as SELinux refrains from enforcing the patent or collecting royalities you can make your own distro. The problem is you can do it today but there is nothing in the bogus statement that would prevent them from changing their minds tomorrow.

The only way you and any people who use your distro or SELinux's distro would be safe is if they included a non exclusive license that insured royality free use and redistrubition rights. The statement clearly states they aren't licensing the Patents, so any redistrubition could be hazzardous to your finical health in the future.

It dosen't seem to violate the letter of the GPL, but it makes a mockary of the spirit of the License, and I hope The FSF closes this loophole ASAP

Re:So they've effectively nullified the GPL?

[mindstrm]

Okay.. so say they are distributing a derivitave GPL work that is patent encumbered.

Then one day the company changes hands, and the new owners want to enforce the patent.

They would have just negated theri ability to distribute the code in the first place, as, under the GPL, tehy have no right to do this if it's encumbered.

Re:This raises the important question:

[tanveer1979]

Well its pretty obvious
"why do they release this statement?"
If they dont ppl avoid SElinux,
but now people wont really avoid it.. and once it becomes common they can actually hold ppl to ransom.

This is called corporate skills. This is what is taught in a B'School. I have friends from B'school and they tell me ethics are passe do anything to get marketshare!

So its pretty simple here, and i wont be using it unless those patens vanish *sigh*

The MS'ian Loophole

[Anonymous Coward]

The following paragraph totally voids the whole thing. It also would create a terribly dangerous submarine patent.

===
No Third Party Restrictions.
This Statement of Assurance is made by Secure
Computing alone, and does not bind or obligate any other person or party. Secure
Computing may license or otherwise transfer any or all of its rights in the Subject Patents,
including the Subject Patent Rights, without any restriction or condition. The recipients
of such rights are not bound by this Statement of Assurance, and may assert any rights
acquired from Secure Computing without any limitation or restriction.

===

If the patents are transfered, they can then be enforced. Any existing distributions and installations of SELinux will become subject to unilateraly imposed lisence and royalty fees imposed by a new owner.

No way is this:
"Our assurance is subject to certain limitations that we believe are consistent with the spirit of open source. "

No License

[thales]

The Statement of Assurance explictly states that they aren't licensing the Patents to SELinux users. This places the statement in the same catagory as propriatary EULAS that contain a clause allowing them to change the license terms at any time.

It's just a PR move. There is nothing that would prevent SELinux from modifying or abbandoning this statement at any time. It provides no protections to users if SELinux is sold, or the Patent sold. They can even grant a third party a license that would enable the third party to collect the license fees that SELinux is pretending to abbandon.

The level of dishonesty shown by this statement has lowerd my leval of trust in SELinux, and made me more unlikely to use the software on a personal basis and reinforced my view that it would be a mistake to use SELinux in a commerical setting.

Re:No License

[Rogerborg]

+lots, insightful, and the exact same situation applies to the Red Hat patents, or any patents owned by "friendly" companies who's friendship stops just short of giving explicit licenses.

Just because Secure Computing and Red Hat have agreed not to press their patents under certain circumstances doesn't mean that the patent isn't still a sword of Damocles. Indeed, this "Assurance" isn't very assuring at all, as it makes it very clear that the patent can be sold at any time, with no restrictions on the purchaser.

Companies change. Their directors change. They find a sudden need for money. They go bust, and when they do, their patents are sold to the highest bidder by the liquidators, and their good intentions are ignored.

Consider what would happen if Secure Computing and/or Red Hat went bankrupt? Could the FSF outbid Microsoft for the patents? I very much doubt it.

Re:No License

[thales]

"To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all"
from the GPL Preamble

The FSF has failed to take the chilling effect of an unlicensed unenforced patent into consideration. As long as Red Hat and SELinux don't enforce patents on GPLed software they are in compliance with the GPL, but the danger that the patent could be enforced at some future date makes it risky to make a derritive work based on patented GPL software, or even to redistrubite it. The practice clearly goes against the spirit of the GPL.

The GPL needs to be modified so that there is a ban on including any patented code unless it also includes a royality free license with redistrubition rights. Simply refraining from enforcing patent rights (for now) does nothing to insure that users will retain the right to redistrubite and modify in the future.

Re:Nooo..

[Tony Hoyle]

Untrue. The GPL *requires* that the rights that it gives are passed on to all derived GPL code.

This patent has directly overriden this. If I took the patented code and created a GPL app based on it I would be sued for patent infringement.

They have only dropped royalties for SELinux, not apps derived from it.

type enforcement

[Alien54]

You can find information on type enforcement here:

http://www.securecomputing.com/index.cfm?sKey=738

As it turns out, this is the problem child. SCC has a patent on this technology, and seems to have used it in SE Linux

hrmm their statement has a typo in the patent

[Vicegrip]

number: 4,6211,231

It doesn't exist in any of the searches I made .... maybe I made a mistake.

Re:hrmm their statement has a typo in the patent

[Phurd Phlegm]

It doesn't exist in any of the searches I made .... maybe I made a mistake.

Someone made a mistake, but it wasn't you. The right number is 4621321. I wonder if the mistake was intentional, so they could later enforce that patent and claim they're still in compliance with their statement. That doesn't make much sense, but I guess it isn't impossible.

To sum up

[flacco]

So, let's see - an operating system produced by the NSA, with the threat of future patent claims on its core technology.

Where do I sign up?

Re:To sum up

[Anonymous Coward]

So, let's see - an operating system produced by the NSA, with the threat of future patent claims on its core technology.

Please don't start this again. Paranoia over the nation's most powerful spy agency aside, Security Enhanced Linux has introduced a myriad of useful security ideas into the Linux world. SELinux uses type enforcement and role-based access control to secure the operating system from the ground up; instead of relying on applications to perform their own security, SELinux ensures that programs only have access to the system resources that they SHOULD have, and nothing more.

Furthermore, a presentation of SELinux by NSA officials at the 2.5 Linux Kernel Summit in March 2001 spurred Linus to propose an idea that has come to be the Linux Security Module, which will hopefully make it's way into the 2.5 kernel eventually. Under this system, and security module, not just SELinux, can be quickly loaded into the Linux kernel to provide whatever kind of security the user desires.

The fact that SCC has issued this statement, however cryptic, is a huge step in the right direction for the Linux world, and perhaps the entire UNIX world. It ensures the current development of SELinux by the NSA and its contributers, and allows Linux users to employ one of the more secure operating system implementations out there.

The National Security Agency has been making good strides towards making better public relations, and SELinux would appear to be a good weapon in giving them a better public image. If still paranoid, just download the source and view it yourself; it's not huge, and it's very clean-cut and understandable.

Limiting the Availability of SELinux...

[3seas]

Seems to me they are confused. FreeSoftware supporters will limit their
use of SELinux and that inturn will Limit ..... well let's just say they
can expect limited use of it, regardless of what dillusions they speak.

Pantents

[attobyte]

If a company releases the source to something that was patented under the GNU can the enforce it later?

They licensed it to us to use as we see fit, just as long as we release the source, right?

Mike

Let's tear this thing apart...

[AgTiger]

1. Three patent numbers are mentioned. Okay, fine... I'll look those up later, it's enough (for now) to know that Secure Computing claims they exist.

2. Non-Assertion section. "Subject to the limitations described in this Statement of Assurance, Secure Computing will not assert the Subject Patent Rights with respect to any use, modification or distribution of SELinux software that is permitted by, and is in compliance with, the terms and conditions of Version 2 of the GNU Public License (the "GPL")."

This is a catch-22. If they're already not in compliance with the GPL due to patent restrictions simply existing on their code, then according to this statement, they may very WELL assert the Subject Patent Rights. This whole clause is a sneakily worded contradiction of realities.

3. SELinux Limitation section.
"... However, Secure Computing does not extend the Assurance to software that merely interoperates with SELinux, or is merely included with a distribution of SELinux."

Translation: Unless they specifically _say_ your code may use their patented methods, forget it. The very nature of distributions is that the kernel is married with a distro's specific patches, custom scripts, custom installer, and a whole bunch of applications are "merely included".

4. Subject Patent Rights Limitation section.
"... Secure Computing does not waive, modify or release any of the Subject Patent Rights, or any other right in the Subject Patents, except as expressly provided in this statement of Assurance. ..."

(Which we're already seeing is "effectively nothing") This section goes on to say that Secure Computing reserves the right to assert their Subject Patent Rights with respect to anything remotely useful regarding security applications that you might want to use their patented software for!

5. No Third Party Restrictions section.
Just go read it. If we sell it, you're screwed.

6. Other Patents section. Again, go read it. We may have other Patent landmines related to SELinux. Here's your blindfold, now go play hopscotch in that legal minefield over there.

7. No Licence section.
"No license is granted in this Statement of Assurance with respect to the Subject Patents, or any other patent or intellectual property right, or software or other product."

Then what exactly am I assured of, other than "We have Patents, we have rights, and they remain ours" ?

8. Limited Assurance section.
More legal handwaving and Covering of asses.

This whole document ranks right up there with "The check is in the mail", "I'm here from the government to help you", and other infamous promises made just before you get screwed over.

GPL and patents don't mix

[twistedcubic]

If a GPLed project includes any patented code, then, under the GPL, I can take just the code from the project pertaining to the patent, create a derived work, sell it, and become rich. It is inconceivable that the company owning the patent would not sue me. Therefore, if they release patented code in a GPL project, they better give a royalty-free license to everyone.

Any Linux copyright holder can stop this

[SurfsUp]

8. If the distribution and/or use of the Program is restricted in certain countries either by patents or by copyrighted interfaces, the original copyright holder who places the Program under this License may add an explicit geographical distribution limitation excluding those countries, so that distribution is permitted only in or among countries not thus excluded. In such case, this License incorporates the limitation as if written in the body of this License.

Re:Any Linux copyright holder can stop this

[SurfsUp]

(Further to my previous post) Quoting from the preamble of the GPL:

Finally, any free program is threatened constantly by software patents. We wish to avoid the danger that redistributors of a free program will individually obtain patent licenses, in effect making the program proprietary. To prevent this, we have made it clear that any patent must be licensed for everyone's free use or not licensed at all.

Now you think that would be pretty clearcut, wouldn't you? Nonetheless, in the case of RTLinux, RMS did publicly state the patent holder could enforce his patent against users of non-GPL applications running under a modified Linux system containing code subject to the patent, without violating the GPL. Go figure. That doesn't sound like 'everyone's free use'.

In the case of the RTLinux patent, luckily a workaround was found, which is even superior to the patented method, so the question of whether the patent holder really was violating the GPL became moot. But, not too surprisingly, here is almost the same thing come up again. RMS needs to take a position.

Patents arent valid in all countries.

[Anonymous Coward]

Are the patents valid anywhere except the US ?

Re:Patents arent valid in all countries.

[Tomah4wk]

Simple answer - No.

The USA is the only country with such ill educated government officials

Re:Patents arent valid in all countries.

[Tony Hoyle]

Complex answer - some countries (such as the UK) have treaties which make patents enforcible in each others' countries (although such enforcement is apparently rare).

How is this legal?

[HiThere]

Did they write their whole distribution?

If not, then aren't they distributing GPL code written by others as a part of an assemblage that does not grant to others the right to freely modify and redistribute it?

Are they claiming that none of the patented code is linked?

Or is this just total FUD?

Whatever the answer to any of these, this is one company that deserves to die a quick death.

Re:How is this legal?

[SurfsUp]

Did they write their whole distribution?

If not, then aren't they distributing GPL code written by others as a part of an assemblage that does not grant to others the right to freely modify and redistribute it?

Perhaps they think that they can freely give the right to modify and redistribute the software, while imposing restrictions on the right to use it. Come to think of it, there's very little said in the GPL about the use of a program, versus distribution of it. Perhaps distribution means 'distribution for use', but I don't see that clearly stated.

Re:How is this legal?

[Hoxworth]

SELinux is not a distribution; it is rather a series of patches and utilities to the Red Hat 7.2 distribution. The National Security Agency cleary states that certain sections of the patches may or may not fall under the terms and conditions of the GPL, as shown by the following statement from the NSA SELinux website:

"All source code found on this site is released under the same terms and conditions as the original sources. For example, the patches to the Linux kernel, patches to many existing utilities, and new programs and libraries available here are released under the terms and conditions of the GNU General Public License (GPL). The patches to some existing utilities and libraries available here are released under the terms and conditions of the BSD license."

SELinux uses the idea of Type Enforcement, which is patented by SCC. This is one area that would not fall under the GPL, but SCC is deciding to ignore that fact for the time being.

Other Divisions of the NSA made this possible

[evilviper]

Why do I have a feeling, it was the other division of the NSA that made this possible. e.g. Perhaps the, umm, *hardware* division of the NSA *talked* with a certain someone, who then, spontaneously decided to do exactly what the NSA guys suggested.

See also:
Some guys from the mafia visited with me today. On a completely unrelated note, I've decided to switch ro another trucking firm that charges 3 times as much.

Comment from Alan Cox

[Russell Coker]

Here's what Alan had to say on the matter:
The assurance simply says you cannot use it. Using it for authorization
for applications, or services is excluded. That makes it useless
He seems to like it less than I do.

Oh well, it'll be good if this goes to court, having
the NSA (represented by the Justice Department)
defending the GPL would set a good precedent.

Re:Nooo..

[Ami Ganguli]

If that were true then any contributor to Linux could sue the NSA for Copyright Infringement.

You cannot take GPL software, write patent encumbered code into it, and distribute it with additional restrictions.

Re:That is why you have to read contracts

[SurfsUp]

The freedom to write GPLed versions of software - which can then become available for anyone's free use - is exactly what he wants to encourage. Your inability to write software that denies others their freedom to use it doesn't matter to him.

Hi Victor,

What he would like to encourage and what the license says are different things. The GPL states quite plainly: "we have made it clear that any patent must be licensed for everyone's free use or not licensed at all." No qualifications. In particular, nothing remotely like "for everybody's free use so long as all the software they use is GPL".