Insuring Contributed Code is Legal?

WanderingGhost asks: "Suppose you start a free software project and have people from all over the world wanting to contribute (hey, that's good eh?) How can you tell if they actually have the right to contribute at all? Contributors may live in different countries and work for different companies, and that means different laws and different contractual agreements. Aside from asking the person (I've found that this doesn't always work), what else would you do? Is there some place where you can find all information about IP laws of different countries (for example Japan, India, China, Russia) just so you can tell what would be the 'default holder of copyright' if a work contract says nothing about IP rights?"

Comments

Not quite...

[asklepius]

I think you mean ENsuring.

This grammatic lesson brought to you by the letter, "e".

Re:Not quite...

[maxume]

If nit picking is going to be done, there is something to be said for worrying about correctness while doing it...I completely agree that ensure is a much better fit, but the error was anything but grammatical.

Re:Not quite...

[DoktorSeven]

Wrong. The two mean completely different things:

"Insuring Contributed Code Is Legal?" -- Asks the question "What is the legality of purchasing insurance on contributed code?"
"Ensuring Contributed Code Is Legal?" -- Asks how to make sure code that is contributed is legal.

Given the context of the article, only #2 is correct.

I've seen a lot of "common usage" and "evolution of the language" bullcrap about errors like this, and they don't make sense. If the use of a word is stupid and doesn't make sense, then maybe it should be changed, but we have a clear distinction between the two words "insure" and "ensure". Sure, they sound similar, but so do a lot of other words. That doesn't give you an excuse to declare that they are the same in meaning. Any dictionary that tells you differently is wrong.

And yeah, you might find an error or two in anything I say. Sorry. The error in the headline didn't bother me so much because I know someone made a mistake. Mistakes happen, we're all human. It's the fact that someone is actually *DEFENDING* the mistake that bugs the hell out of me.

Re:Not quite...

[alibo]

The narrow definition of insure as 'protect by insurance' seems fairly recent. OED2 has citations from 1724, 1825 and 1864 of insure as 'To make safe, to secure, to guarantee (against, from): = ASSURE v. 1c, ENSURE v. 6', see insure v. 6. Merriam-Webster's dictionary of English Usage (1994) has several citations of insure as ensure, from 1969, 1982, and 1986:

• '... would insure against any akward second marriage' -- Mollie Hardwick, Emma, Lady Hamilton, 1969
• '... his sudden fame probably insured a backlash' -- Calvin Tomkins, New Yorker, 6 Dec. 1982
• '... held that school officials had the right to insure that a high-school assembly proceed in an orderly manner' -- William Safire, N.Y. Times, 24 Aug. 1986

The Columbia Guide to Standard American English, Merriam-Webster's Unabridged (3rd ed.), the American Heritage Book of English Usage, the American Heritage Dictionary (4th ed.), Random House Unabridged Dictionary (2nd. ed.), the Oxford American Dictionary of Current English, the Oxford Dictionary of English (2nd. ed), and the Century Dictionary (1889) all have the definition of insure as ensure.

Garner's The Oxford Dictionary of American Usage and Style and Pocket Fowler's Modern English Usage (by Burchfield/Allen) both restrict insure to the financial sense. Insure as ensure is not accepted by everyone, but insure as ensure is certainly no recent development or attempt to generate more sales by adding fake 'new words'.

You may not want to use insure this way (like Garner and Allen), but that doesn't make anyone who disagrees with you wrong or uneducated.

Re:Not quite...

[arose]

Don't you mean iditors?

Re:Not quite...

[thc69]

I didn't think the word "thou" was involved.

But how do I Ensure that my Insured Code is Legal?

[NeMon'ess]

Anyone?

Signed affidavits are the answer!

[GrizlyAdams]

Before allowing commit access to your repository, or accepting patches from someone, have them submit a signed affidavit specifically stating that they will not contribute any code they do not have the rights to. This is likely to result in less developers offering to contribute though as many folks can't be bothered to go through the hassle. Solves both your problems the way I see it (too many developers and legal liabilities.)

IANAL, but I did sleep in my own bed last night. (Tis a joke and a serious statement in one.)

Re:Signed affidavits are the answer!

[julesh]

I think the idea is to get contributors to send you something, signed, on a piece of paper. This is what the FSF does, and a few other large projects have followed their lead. In FSF's case, the piece of paper is also a copyright assignment, which you probably don't want as it puts a lot of potential contributors off. What you want to do is check out something like the following with a lawyer:

I hereby certify that the work I have submitted to is my own work, which I am entitled to licence under the provisions of , and that I am not aware of any patents or other legal issues that may prevent its use in . I hereby grant a licence to distribute the work under the terms of (attached).

You possibly also want to include a similarly phrased paragraph to cover future submissions by the same contributor, if you expect any.

What this does is (again, IANAL, so this isn't legal advice, check it with a professional, actual facts may vary from jurisdiction to jurisdiction):

1. Means you've performed "due diligence" before accepting the work. You've got a signed statement from somebody stating that there wouldn't be any issues. If you do have legal expenses insurance (and I'd recommend it; at least where I live it isn't expensive) your insurers will almost certainly want to see something like this before they'll agree to defend you in a court case. In a court case, I think it would be enough to show that you hadn't knowingly infringed any copyrights, which may be enough to prevent any damages being awarded against you. You'd have to cease distribution, of course, but in the end it would probably not actually cost you anything. It's probably not as good in the case of a patent infringement, where I believe strict liability rules apply, but that's substantially less likely to affect you, fortunately.

2. Means you've got a clear, easy to prove licence to distribute, so your contributor can't turn around and sue you. Yes, this is unlikely, but it's great to cover all angles.

A GPG-signed e-mail may be adequate, but check with a lawyer. In my jurisdiction, I believe it would be iff I could prove the key belonged to the person I believe it to, which can be a quite tricky proposition. In yours, it might not be acceptable at all. Check everything. A signed fax may be better than an e-mail. This is the kind of knowledge you pay a lawyer for.

Re:But how do I Ensure that my Insured Code is Leg

[A beautiful mind]

You don't.

That's why you insure, to rest assured that if sued good legal defense is ensured.

Now, can anyone come up with a good haiku for this?

Universal Problem

[Anonymous Coward]

Scroll to A Brief History of Windows NT/2000/XP by Andrew Tanenbaum. This is a problem regardless of software license. The unique problem that open source faces is that people do it as well as working at the same time.

If it's a small project I wouldn't worry too much in any case. Otherwise, make the programmers agree to some statement before you'll accept their work (it could be an "informal" email). And always remember that estoppel is your best friend.

IANAL, but my key fear with using any copyrighted material is authors being able to revoke a license. Copyright and licensing laws are quite strong after all.

Re:Universal Problem

[WanderingGhost]

Scroll to A Brief History of Windows NT/2000/XP by Andrew Tanenbaum. This is a problem regardless of software license. The unique problem that open source faces is that people do it as well as working at the same time.

I see your point...

If it's a small project I wouldn't worry too much in any case. Otherwise, make the programmers agree to some statement before you'll accept their work (it could be an "informal" email). And always remember that estoppel is your best friend.

The problem is that the contributor himself may not fully understand what he can and what he cannot do. And then after something comes up, I'd have a big company telling me to shut down my project (because it may not be possible to revert a big, findamental patch, for example).

IANAL, but my key fear with using any copyrighted material is authors being able to revoke a license. Copyright and licensing laws are quite strong after all.

Not in the case of the GNU GPL, as far as I understand. I have asked a lawyer about this once (last year I guess).

Re:Universal Problem

[julesh]

And then after something comes up, I'd have a big company telling me to shut down my project (because it may not be possible to revert a big, findamental patch, for example).

I don't think this is avoidable, unfortunately. If you have to remove a fundamental piece of code due to copyright considerations, that's going to effectively mean reverting your codebase to the point it was added and starting again from there. Code added after it was may be a derivitive under copyright law, so you probably can't use a lot of that, either.

Not in the case of the GNU GPL, as far as I understand. I have asked a lawyer about this once (last year I guess).

Copyright laws vary from place to place; most lawyers only consider local issues. You may find that some regions have local laws that allow revocation of a licence even when that licence describes itself as irrevocable (as the GPL does). If you're worried, make sure the lawyer you consult is well versed in international copyright issues. Try to find a copyright specialist who deals worldwide, if you can afford one.

misspelling may provide the answer!

[plasmacutter]

insuring your project against copyright lawsuit might "ensure" you get to keep contributed code..

well.. it was just a thought..

Re:But how do I Ensure that my Insured Code is Leg

[WoLpH]

Personally, I don't really check. If the contributor says they've written it themselves then I believe it. If you can't trust the people you work with your project is doomed anyway.

Also, if you don't write code to something controversial (think encryption and similar technologies) then you won't get into problems so fast. And if some of the code would be copyrighted, then all they have to do is prove it and I'll remove it :)

Re:But how do I Ensure that my Insured Code is Leg

[nacturation]

Insure legal code
Lawyers battle like thunder
Assured rest ensured

Copyright assignment

[martinde]

Isn't this one of the reasons why the FSF requires all contributors to assign their copyrights to the FSF explicitly? I believe this puts the responsibility onto the authors, and not the FSF, to make sure they have the right to contribute.

More info here.

Re:Using the Linux kernel model

[RAMMS EIN]

``RedHat 6 used the BSD lp code and didn't fufill the 'advertising clause' (same with Microsoft and NT)''

Assuming that BSD lp is copyright the University of California, that shouldn't be a problem, because they scrapped the advertising clause (I think even if the license still includes the clause, it isn't valid anymore).

Don't worry about it.

[lagerbottom]

No one will help anyways unless it's a huge successful project, at which time you can have the foundation explore all that.

Slashdot . . .

[Dausha]

"Is there some place where you can find all information about IP laws of different countries (for example Japan, India, China, Russia) just so you can tell what would be the 'default holder of copyright' if a work contract says nothing about IP rights?"

You go to /., of course.

I'm in my last few days of law school, but IANAL, so this is not legal advice. However, I wrote a paper last year on what happens when the contract regarding an IP project is silent regarding the final holder of the IP (US specific). If you are an employee of the recipient of the IP, then you are not the IP holder, your employer is. When you're the independent contractor, then things get tricky. Depending on the amount of control the contractee has over your work (e.g. it tells you what to do more like an employer than a client who approves the final product), then at best you have the copyright, but the contractee has a non-exclusive license to do what it likes with the product. In 77 suits on the subject, an independent contractor tried to protect its IP rights and lost in all but a handful of cases owing to the non-exclusive license (which is governed by state contract law not IP law as Congress has excluded non-exclusive licenses by negative inference). The only trend I saw was that the larger the market capitalization of the infringing defendant, the greater likelihood that the court would find for the defendant.

The worst case was an architectural firm who drew up plans for a shopping mall development with intent to be the sole-source provider of architectural services. The plans were never on file with the city, but the plans were approved and the developer sold the project to another company. The other company hired its own architectural firm to redo the plans. The other firm erased all references to the original firm, made a few changes, and then submitted the plans as its own. Naturally, the first company sued, and the 9th Circuit said "you lose." The copyright was non-exclusively licensed to the original company through complete silence of the original contract, and so that license was transferred to the other company and finally to the other firm. The implication was that the architectural firm "intended" the other, competing firm to profit from its work---which is nonsense as no firm would want a competitor to turn its product into its own and profit without any compensation or acknowledgment.

Always, always, always get it in writing. Silence can be deadly.