Slashdot Mirror
Some Linux Users Violate Sarbanes-Oxley
Goyuix writes "According to the IT Observer, publicly owned companies who are using Linux, could be violating the federal securities laws as part of Sarbanes-Oxley. The article goes on to say that companies are required to "disclose ownership of intellectual property to their shareholders." How are these companies supposed to really list out all the IP owners if they were to install a full desktop or server environment - there could be literally thousands of parties listed! What are the current Fortune 500 companies doing, as many of those use Linux in one form or another?" update several people have pointed out that this is about companies who are violating the GPL, not everyone.
Preventive War is like committing suicide for fear of death. - Otto Von Bismarck
Did the OP even read the article he submitted? It says that if a company violates the GPL, that this might also be a violation of Sarbanes-Oxley if they claim that they still have a right to use Linux despite the GPL violation. There is nothing about listing the IP holders. On an aside, I didn't think there was any violation to the GPL that could stop you from being able to use Linux. A GPL violation would make you lose your right to distribute it, right?
Shockwave Flash movies are the greatest thing to happen to non-sequitur humor since Japan.
Instead of "Might Linux Violate Sarbanes-Oxley?" which it doesn't, it should be "Non-compliance to terms of GPL might violate Sarbanes-Oxley".
Which makes sense.
I.e., if you claim to have the right to use Linux for your product, but you aren't complying with the license, you might be violating Sarbanes-Oxley.
Rather new at it, it's true, but so far if we find a company has a problem of this sort, it's generally not a very big deal especially if they rectify it before their fiscal year ends. This is just one little piece of the huge SOX pie and often there are other controls in place that mitigate the effect of a finding anyway. Now if the company practiced systemic licensing violations then that's a different matter.
12:50 - press return.
Come on people, let's pay attention to the article. Contrary to the poster's headline, nothing in it even hints that using Linux would violate Sarb-Ox. Sarb-Ox is supposed to make investing a bit safer by forcing companies to audit their practices and disclose potential problems.
If someone is building products on GPL code (like, say broadband router/NAT boxes based on Linux) then they are supposed to disclose that tidbit to their investors. The important part is that they don't own all of the intellectual property for that product and investors should know since that could change the company's value. If they fail to disclose the data, then they have violated Sarb-Ox.
This is because they are required to list what intellectual property the company owns to shareholders and if it is later found out that the company doesn't really own it, because it is based on a GPL'd software, then is that a Sarbanes-Oxley violation.
Wrong.
A corporation is required to account for intangible assets that the company owns, and timely and accurately report the acquisition cost, book value, and sale value, if any, in aggregate as part of its normal financial reporting. Refer to SOx sec 302 and FASB statements 141 and 142. SOx requires that existing financial reports be more accurate, not more detailed, in general. Those assets will be reported in categories, as part of particular transactions, or both, but not item by item in most corporate financial reports. IBM does not list the value of the individual patents held in its portfolio in its reports to investors, and I can fairly confidently say that it never will. GPL software is no different in that respect.
GPL software is different in that it should not even be an issue in most cases because it has no intrinsic acquisition cost, no book value, and no sale value. If a corporation pays for GPL software, they are almost certainly paying for a SERVICE supporting the GPL software, which is an expense, not an asset. Remember all those "You really can make money off GPL software" discussions that have cropped up on Slashdot over the years? This point alone makes the SOx argument almost laughable.
The issue is not whether a company has violated the GPL, but whether a corporation knows that is has violated the GPL and failed to account for the potential liability, artificially inflating the value of the corporation. This information is not necessarily even going to be public, as it can be lumped into a litigation reserve along with every other potential liability associated with identified assets. Assuming that there is no pending or probable litigation, you are not going to find a corporate report that identifies the separate 'potential liability' associated with, say, products liability suits over Tickle-Me-Elmo dolls as well. It's the same reporting detail issue described above.
Remember, SOx is about accuracy and certification -- it's requires that corporations display an accurate external appearance, not provide a CAT-scan like view of the entire workings of the business. You are not gaining additional transparency, you are supposedly gaining assurance that the corporation is not lying about the gross and net numbers under the existing reporting style. If there's no accounting irregularity, the software compliance issue is almost meaningless to SOx (although still important to operations).
This really seems to apply to companies that incorporate Linux into a product. Well known examples include Tivo and the Linksys WRT54G (v4 and below). In such a case, Linux is an important part of those companies' product portfolio and thus and important factor in assessing the tangible and intangible worth of that company. For the companies that only use Linux in operational capacities, it wouldn't have any impact unless SCO wins. (yea, right)
Put another way: ownership of a patent on a hammer is important for a tool maker, but not for the construction company that uses it.
This is a boring sig