Dealing With a GPL Violation?

Sortova writes "For many years now I've been maintaining OpenNMS, a free and open source network management framework published under the GPL. A couple of years ago it came to our attention that a company called Cittio was using OpenNMS as part of their proprietary and commercial network management application. I talked with Jamie Lerner, the Cittio founder, and he assured me that Cittio was abiding by the GPL. However, we were recently contacted by a potential client who was also considering Cittio's Watchtower, and it appears that they are not disclosing that they are using GPL'd code or at least not in the clear and concise fashion required by the GPL, including the offer of source code for all of the code they are including and any changes being made to that code. Since the copyright for OpenNMS is held by a number of commercial companies, the Software Freedom Law Center is not able to help us defend or even investigate a potential violation. I was curious if anyone here on Slashdot had experienced anything similar or has any advice?"

Comments

You don't know they are in violation

[QuantumG]

For a start you claim:

When I brought up the fact that parts of Watchtower are based on OpenNMS, the client replied "I could not find one ounce of mention on their website to OpenNMS or any other Open Source code that is running on this product. That really irritates me." So what's all this then?

You also make the claim:

I should also mention that this client is in final negotiations with Cittio (they dropped their initial price considerably) so we're not talking a first contact cold call here - they are ready to close this deal without a single detail concerning their use of open source. Yes, and? They are not required to make any such disclosures. The GPL requires them to provide the source code or an offer to provide the source code when they distribute the software. As they haven't distributed any software yet, they are not required to provide any source code or offers to provide the source code.

FAIL.

Re:You don't know they are in violation

[LingNoi]

Not only that, they only have to provide the source code to the person they're redistributing to under the same license if they changed anything, that doesn't include you, because you're not their customer.

If there's something they've changed in your project then purchase a copy and put the changed code in your version, since any modified GPL code must be re-distributed as GPL code.

Re:You don't know they are in violation

[rsax]

From the linked site

"postgresql-8.0.2.tar.gz ... GNU General Public License (GPL)"

Wrong license. As mentioned on the PostgreSQL site page, the project uses the BSD license.

Re:You don't know they are in violation

[cbhacking]

Very true. A simple Google search for OpenNMS on cittio.com comes up with two pages (one linked in the parent). Each lists, with licenses, the open source projects they use. At the bottom of both pages they have "Contact us" info, one of them (not the one linked above) even has a mailto: link for questions about their open source components.

I'm a little surprised they don't provide links to the projects directly - either by project site or downloadable tarball - but it doesn't exactly look like they're hiding their use of OSS code. Technically just announcing that they use OSS (especially without linking to the projects, let alone any modifications they made) isn't enough for compliance, but the summary gave the impression that Cittio gave no indication that they use any OSS. This is patently false.

Re:You don't know they are in violation

[LingNoi]

You're not their customer so they don't have to give you anything.

Only Cittio's customers (the ones receiving the product) could ask for the source code, because they're redistributing to them, not you. Cittio's customers could then re-distribute that GPL code however they wished.

Re:You don't know they are in violation

[Azh Nazg]

question: who defines distribution?

answer: whoever has more money

-- Anonymous Coward

The GPLv3 is much, much more specific about that. Specifically:

c) You must license the entire work, as a whole, under this License to anyone who comes into possession of a copy. This License will therefore apply, along with any applicable section 7 additional terms, to the whole of the work, and all its parts, regardless of how they are packaged. This License gives no permission to license the work in any other way, but it does not invalidate such permission if you have separately received it.

-- GPLv3, section 6

The GPLv3 also defines what 'distribution' is, by using the terms 'conveying' and 'propagating', instead, and then defining those (for some reason, redefining distribution is not kosher, legally speaking). Thus:

To "propagate" a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. Propagation includes copying, distribution (with or without modification), making available to the public, and in some countries other activities as well.

To "convey" a work means any kind of propagation that enables other parties to make or receive copies. Mere interaction with a user through a computer network, with no transfer of a copy, is not conveying.

-- GPLv3, Section 0

Though I wonder why you are apparently anti-GPL, whatever your thoughts on it, I must insist that you at least discuss points relevant to the license itself. Thank you, however, for sharing your thoughts and opinions: if nothing else, you'll provide someone out there something good to think about.

Re:You don't know they are in violation

[cbhacking]

I'm aware of that. I'm just surprised that they bothered to list a bunch of OSS projects they use, but not link to them. I wouldn't expect a commercial entity to redistribute their modifications to non-customers, but I just found it curious. If nothing else, I'm surprised they don't link to the (descriptions of the) licenses themselves.

On a vaguely related note, if it turns out that this company is purely on the straight and level with regard to the GPL and other OSS licenses, I'd like to mention that I'm very pleased to see this kind of thing. The more exposure OSS gets, the better; some purists might complain about people who don't make their modifications open to literally everybody, but overall I believe commercial interest in (and, hopefully, support of) OSS projects is a good thing.

Re:You don't know they are in violation

[mysidia]

This is not entirely true.

For commercial distribution, the source has to either be included with every copy of the binary, OR the GPL requires a written offer which to any third party, including third parties who are not their customers.

If they chose option (b) for distribution of their source code, then they do have to give something to non-customers, in order to avoid violating the GPL.

That way their customers can re-distribute the binaries and pass along the offer to others.

See the GNU General Public license version 2 section 3.b: b) Accompany it with a written offer, valid for at least three years, to give any third party, for a charge no more than your cost of physically performing source distribution, a complete machine-readable copy of the corresponding source code, to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or,

Re:You don't know they are in violation

[Sortova]

I never claimed to be unaware of Cittio's use of OpenNMS. If you read my post my claim is that potential Cittio "clients", not me, are being kept in the dark about what open source software is being used as part of Watchtower. It is not up to the end user to suddenly find out that the code they are purchasing is based on open source work. The GPL clearly states "you must show them these terms so they know their rights." This is, apparently, not being done.

Re:You don't know they are in violation

[Ranger Rick]

"So what's all this then?"

Well, that link says they're running OpenNMS 1.0.2, which, given the questions Cittio employees have asked on the OpenNMS mailing lists in the past, seems very unlikely (although technically possible). If they *are* using 1.0.2, they very likely *have* made modifications, 'cause that code has plenty of bugs that have been fixed in later OpenNMS releases. ;)

One thing that Tarus didn't really mention is that we (The OpenNMS Group) have had a few folks come to us wanting quotes to compare us to Cittio, and they've been rather surprised that Cittio is in fact already using OpenNMS under the covers. The problem is not with them using OpenNMS, OpenNMS is all about sticking not only to the letter but also the spirit of the GPL, and they can do whatever they want with it as long as they're complying with the distribution requirements of the license. The problem is whether Cittio *is* upholding their side of the GPL, and it's unclear whether they are -- and there are some signs that they might not be.

As for them not having to offer the source until they distribute the software, yes, that's true, but from what we've heard from existing Cittio customers, that is not being made clear to them. Not only that, but while the wording of the GPL may not make it obvious, the FAQ does:

The difference between this and "incorporating" the GPL-covered software is partly a matter of substance and partly form. The substantive part is this: if the two programs are combined so that they become effectively two parts of one program, then you can't treat them as two separate programs. So the GPL has to cover the whole thing.

If the two programs remain well separated, like the compiler and the kernel, or like an editor and a shell, then you can treat them as two separate programs--but you have to do it properly. The issue is simply one of form: how you describe what you are doing. Why do we care about this? Because we want to make sure the users clearly understand the free status of the GPL-covered software in the collection.

It seems likely that they've incorporated OpenNMS into their software at a lower-level than just screen-scraping it's output and stuffing it into their own UI. At that point, they should be prepared to provide the modified OpenNMS source to their customers. Not only that, but considering how tough companies are on open-source developers accidentally "tainting" open-source code with IP from their closed-source employers, it's more than a tad annoying that many closed-source companies taking advantage of open-source software are happy to use it, but ignore the spirit of sharing that is part of being in the community. "We won't say anything, but if you do ask us for the source, we'll fax it to you." ;)

Again, all this is unproven, and that's part of the reason Tarus posted, the question is -- what's the next step?

Re:You don't know they are in violation

[JoelKatz]

This is not the FSF's position, nor is it sane. What the GPL intends, and what makes sense, is that you cannot be refused the source code simply because you aren't the person the offer was originally extended to. That is, the offer must be transferable.

The distribution could include a "coupon" for the source code, so long as the coupon is transferable. That wouldn't mean they'd have to give anyone the source code just because they asked for it.

Re:You don't know they are in violation

[sumdumass]

Wow.. What FSF are you thinking of?

I found this on their site in the faqs about licensing page you can go look too.

What does "written offer valid for any third party" mean in GPLv2? Does that mean everyone in the world can get the source to any GPL'ed program no matter what?

        If you choose to provide source through a written offer, then anybody who requests the source from you is entitled to receive it.

        If you commercially distribute binaries not accompanied with source code, the GPL says you must provide a written offer to distribute the source code later. When users non-commercially redistribute the binaries they received from you, they must pass along a copy of this written offer. This means that people who did not get the binaries directly from you can still receive copies of the source code, along with the written offer.

        The reason we require the offer to be valid for any third party is so that people who receive the binaries indirectly in that way can order the source code from you.


They have attempted to narrow it down a bit, but it still says the same sentiment. Any third party means just that.

Re:You don't know they are in violation

[JoelKatz]

I guess my recollection was in error. The FSF does take a nonsensical position about this. I'll add this to the long list of nonsensical positions the FSF takes.

The clearest way to see that this is nonsense is to ask yourself this question -- without a copy of the written offer and without having directly distributed to how, how could the distributor possibly know exactly what source code to give you?

It only makes sense if they can be required to show you a copy of the written offer.

Thanks for the correction.

Asked before -- the answer is the same

[whoever57]

If you want legal advice, get a lawyer.

Check out the SFLC guidelines.

[Estanislao Mart�nez]

The SFLC's Legal Issues Primer for Open Source and Free Software Projects covers this. You probably want to give it a read.

Still, if it's really important, ask a lawyer, don't ask Slashdot.

Re:Check out the SFLC guidelines.

[Protonk]

You you really listen to legal advice on slashdot? I wouldn't. I would not listen to advice that came from someone where I had no means of verifying their credentials, no recourse if they were wrong and no good way to show people later that I operated in good faith.

Re:Check out the SFLC guidelines.

[42forty-two42]

They wouldn't dare admit it, for fear of being held liable for it as legal advice.

Re:Check out the SFLC guidelines.

[Kjella]

Oh, I've seen several lawyers here but they always point out that they're not your lawyer and that this is not legal advice. Can't really blame them either, if someone took a fairly unqualified slashdot post and applied that uncritically as legal advice in a specific case I wouldn't want to stand responsible for it either. It'd be like taking a doctor's general advice and applying it as your personal medical diagnosis, what's in general good advice may not be for you.

Bye bye my application

[icepick72]

I understand the joy of coding and excitement of creating your own applications for free, but I can never understand how programmers stand to watch their creations being usurped for commercial purposes. Whether it's abiding by the GPL or not, somebody else is making money from your creation. You would think the original programmer would have the wherewithal to market their own creation instead of leaving it for someone else. Even if you don't take the money for yourself, donate it back to the FSF or to another worthwhile cause. Maybe it's a case of lack of resources to start your product running. Maybe we need a group that can fill this niche for open source products. Maybe they already exist. If so I'd like to see discussion about it.

Re:Bye bye my application

[QuantumG]

Cause selling a solution is just as much, if not more, work than creating one?

And it is something that is done by sales people, not programmers?

Re:Bye bye my application

[Improv]

So long as they're not making it proprietary, what's the problem? We can both destroy markets and help the world by opening our source, and that's pretty awesome. If someone happens to make some money (maybe consulting, whatever), so be it.

Re:Bye bye my application

[mOdQuArK!]

Also, most solutions aren't going to be "perfect" for everyone, and if you're a demonstrably good programmer, you can contract your services at fairly healthy price levels to provide all sorts of custom solutions to the people who really like your open source software, but just want "a few tweaks".

Re:Bye bye my application

[GrahamCox]

You would think the original programmer would have the wherewithal to market their own creation instead of leaving it for someone else

Why would you think that? People are usually good at some things, not at others. I think it's very likely that a person good at programming and software design wouldn't necessarily be good at (or even interested in) running a business, accounting, marketing, all the legal stuff, etc. It's also very hard to find people to come in with you who are, based only on your software/coding expertise. I speak from experience.

Re:Bye bye my application

[wolf87]

I recently developed a small package of statistical tools & made it available under lesser GPL. I made the decision to open-source it for several reasons. First, I wanted to make it easily available to other researchers wrestling with the same problem I was. Second, I wanted to see if anyone could take what I had done and extend it into a better set of tools. Third, having it freely available, code and all, helps to get my name out there and build my reputation. There are plenty of reasons to put out applications without making money from it.

Re:Bye bye my application

[theophilosophilus]

So long as they're not making it proprietary, what's the problem? We can both destroy markets and help the world by opening our source, and that's pretty awesome. If someone happens to make some money (maybe consulting, whatever), so be it. Why is destroying markets a good goal? I think a better choice of words would be "revolutionize" or "reinvigorate." OSS doesn't destroy a market - it just makes it more competitive. See this post.

Re:Bye bye my application

[fr0st0]

I agree [GrahamCox]. Also, the ultimate underlying motivation of the programmers and the GPL, CCL, etc. is to increase information. Open and Free programmers are like anyone else in that they do what they do for a multitude of reasons (social, relative notoriety, etc. [see the first few chapters of 'Wealth of Networks']) but at the end of the day it all serves to expand the knowledge horizon of everyone, indirectly or directly. That combination of selfishness(in that more information benefits you) and selflessness (in that it also benefits everyone else) is the underlying sense of purpose that attracts the users and motivates the developers alike.

Do a little digging yourself, get a lawyer

[cbhacking]

First issue: are you SURE they're in violation? This could be as simple as calling their support line and asking how you can get the source code (this assumes you've confirmed that GPLed code is included). If you can't get to the support people without being a customer, search their website for any indications and/or try and get a demo.

Once you're reasonably sure they're in violation, consult a lawyer who knows IP law, preferably one familiar with the GPL in particular. Even on Slashdot, I'm not going to try giving you advice beyond that. It's not cheap, but there's a decent chance of getting legal expenses awarded in court.

Re:Do a little digging yourself, get a lawyer

[cbhacking]

Oh, and document EVERYTHING. Every email, every phone call (you may need to tell the other party if you record the call, I don't know the law in your area), every letter, every step of your research. I'm guessing a single subpoena would get all the evidence you need, but no point taking risks when money is at stake (as it will be if this goes to court).

Re:Do a little digging yourself, get a lawyer

[QuantumG]

He's already screwed himself by posting to Slashdot. If he is lucky Cittio will just ignore him. If he's not, they'll probably sue him for libel. His only defense then will be to show that he is right, and that will be pretty hard to do after Cittio have cleaned up any discrepancies they might have had in their distribution.. which they are sure to do before calling the lawyers.

This is well documented already!!!

[jamesh]

The instructions for what to do if you think you have found a gpl violation are here. There is no mention of posting to slashdot on that page. There is a mention of checking your facts first... some companies get a bit cross (eg they'll take you to court) if you write anything bad about their product which isn't completely true. (i'm not saying it isn't, i'm just saying you don't appear to have done your homework yet).

You've achieved your desired goal

[Bruce Perens]

You got your concern on the front page of Slashdot. That means that the company will make sure they're doing everything right, because all of their customers are going to ask them about it now.

That said, it's not at all clear that you had anything to complain about. If SFLC won't help you for the reason you gave, that means you don't have any standing in the matter. You can't sue anyone about it. So, there's not much use in complaining.

IMO, you should make real sure that you at least own the copyright of your own work before you contribute any more.

Bruce

Re:You've achieved your desired goal

[Bruce Perens]

Dunno why you're replying to me instead of the OP

It's slashdot strategy. If late to a discussion, a reply to a high-ranked post will apppear higher than a reply to the article. But yes, it's really a reply to the article.

if he has been contributing code and not signing it over, then he owns the copyright on the work, period.

SFLC appears to have treated him as if he did not have a very significant portion of the program under his own copyright. I know that they have represented other authors who did not own the entire copyright of a program, but did own a significant portion of the work.

I don't think the OP even bothered to contact the SFLC..

That's possible, but the reason for rejecting him sounded like it could be for real.

Re:You've achieved your desired goal

[Sortova]

The history of OpenNMS is pretty long and convoluted. It was started by a company called Oculan, and I was an employee of theirs when they decided to stop publishing their code under the GPL. I wanted to keep the project alive, and thus I took over maintaining the code in 2002. So all of the original "1.0" code is copyright Oculan (and that IP is now owned by Raritan) while almost all of the other changes are copyright "The OpenNMS Group". Both companies are commercial entities, although OpenNMS is never licensed outside of the GPL. According to Daniel B. Ravicher at the SFLC (who I contacted in 2005): "SFLC unfortunately cannot generally represent for profit entities". The fact that the SFLC won't defend us doesn't mean that we "don't have any standing in the matter". We do own the copyright to our work, but it is a derivative work based on the GPL and it is very unclear how such things can be defended since it is based on the work of other (duly noted in every copyright notice in the OpenNMS code).

Re:You've achieved your desired goal

[Rary]

Ya know, for folks like you Bruce there should just be an automatic moderation of +10 "well known and trusted to be insightful and informative" to any post you make...

They should just give him his own personal karma rating.

"Karma: I'm Bruce fucking Perens".

Re:You've achieved your desired goal

[Bruce Perens]

I pointed to your comment only because _after_ more information was made available, it didn't seem so insightful

But it did get the original article author to give us the missing information :-)

The problem with being held very highly by some folks is that if some day they decide they disagree with me, I immediately go to the opposite pole and they consider me to be evil incarnate. Fortunately, most of them grow up eventually. I'd be most happy to be accepted as an often-knowledgable human being with faults. My notoriety is important, though, because it helps me to get people to listen about issues that are important to us.

I can live with Slashdot moderation. What I do have a problem with is that I can't get my damn submissions approved when they're important. Slashdot actually rejected a submission on the California "Open Voting" bill.

Bruce

As has been said: They don't have to give the code

[Anonymous Freak]

...out on the web. Nothing in the GPL says that a licensee has to freely offer the code to absolutely anyone free of charge, to anyone that asks, in the manner the asker chooses. It says that they have to offer the code, in a manner of their choosing to anyone that asks.

In a commercial hardware product, that means that the company can insist on only distributing the code by sending it to you as a bunch of floppy disks, for all the GPL cares.

Now, once someone has the code, that person can then re-distribute the GPLed code however they feel.

One example: My Toshiba HD DVD Player (don't laugh, it was a present,) contains GPL code. Toshiba doesn't make this fact obvious. It's buried in the manual for the product. Toshiba doesn't make the code available on their website, because they're not required to. To quote the GPL 2.0 that my Toshiba uses:

b) Accompany it with a written offer, valid for at least three
        years, to give any third party, for a charge no more than your
        cost of physically performing source distribution, a complete
        machine-readable copy of the corresponding source code, to be
        distributed under the terms of Sections 1 and 2 above on a medium
        customarily used for software interchange...

The internet isn't the only medium customarily used for software interchange. And they are allowed to charge a reasonable fee for duplication and distribution. (See GPL section 1.) If they really felt ornery, they would be perfectly within their rights to charge you for the physical cost of a bunch of floppies, and the time (at minimum wage, or even higher,) some flunky had to spend copying onto those floppies.

Additionally

[einhverfr]

In addition to getting a lawyer, you also want to get other OpenNMS copyright holders (particularly the commercial companies) in the loop. This helps increase the leverage and the resources available to fight. And they will bring in more lawyers, in all liklihood.

Show and Tell ( ... anyone? )

[remitaylor]

You must have been absent all of those days in kindergarten when they emphasized *sharing*

Typical situation:
  * programmer needs X (to "scratch own itch")
  * programmer makes X and realized that, wow, other people might want to use it or contribute to it
  * programmer releases source
  * FIN

A few things might happen:
  * people contribute to X and make it better, for friggin FREE!
  * companies use X - programmer helped out other human beings
      * depending on license X was released under, if companies make their own improvements, they have to release the source code ... once again ... making your software better for FREE

You can be a douche bag and spend lot of time packaging EVERY projects you EVER make, and charging $19.95 for it ... or you can be productive, not worry about trying to sell every piece of code you've EVER written, and release the code as open source to help other programmers.

Make something seriously cool that's worth marketing and selling ... SELL IT.

But if you don't get how anyone might want to ... I dunno ... share with the community to help others ... then what the friggin Hell are you doing on slashdot? Seriously? Well. Nevermind ... I suppose we all need some flamebait, now and again, eh?

As a side note ... the more open source software you release, the better the chances of someone actually being helped by it, the better the chance of it becoming well known or used ... the more visitors your site gets ... the more you SELL SELL SELL to your visitors ( commercial software or support or consulting )

I follow a lot of what the writers of my favorite libraries do/blog and I'd love nothing more than to, one day, release projects that help others, as I've been helped by so, so, so many open source projects.

Finally, I'd reiterate that a lot of the open source projects our there are there because someone made something to scratch his/her own itch ... then released it. Many of these projects would be VERY hard to sell, and would take TIME to sell ... so, instead, people offer them up to others to use / improve / etc. But, for those of use who prefer licenses like the GPL, the code is offered up such that any improvements need to be open source, as well ... thus, everyone can work to make it better! If you want to be able to sell your own "Professional" or "Advanced" version of your software, release it under a license that lets you do so.

A lot of these projects would NOT SELL on their own. Other people use them because they exist, but, if they didn't exist for free, the companies would likely program it themselves. When a company uses your code in their software, you simply end up getting more exposure and ... hell ... they might even hire you for programming / consulting. Honestly, where's the downside?

People like you would rather have an apple rot than give it away to others. If your apple's ripe and you're not going to eat it ... see if someone else wants it. If you're a programmer, I bet you've got atleast a dozen finished or half-finished project that you're not making ANY money from, nor are you ever likely to. Don't you understand that you could open source them and ... maybe someone'll find them via google one day and you'll have helped someone else? You might even get a patch in the email one day from someone who's dramatically improved your code ... or just from someone thanking you for releasing it! At the very least, it'll make you feel good about yourself whereas, if you hadn't released the code, you never would've felt good about helping that person. It's really that simple.

</rant>

Re:What's the menu path to that?

[ribman]

Found the answer to my own question ....
It's not under Products - Watchtower
It's at: Technology - Open Source Components, so yes, that's up on the main menu, though sideways from Watchtower.

Re:Just write it up

[Jedi Alec]

Also, writing a polite email which details exactly how they are breaking the GPL and which steps they should take to correct the issue, might help a lot. It's sometimes just simple misunderstanding of the GPL. Sometimes on the part of the author, sometimes on the part of the user - but in any case, the act of detailing the alleged breach of license will clarify the issue.

Why go straight on the offensive? By detailing their offenses, you're pretty much saying you're already convinced they're in the wrong, which tends to put people on the defensive.

What's wrong with simply asking "Hey guys, i see you're using GPL'd software, which is great. Could you give me some more information on how you make the source code available to your customers?"

Re:As has been said: They don't have to give the c

[jamesh]

In a commercial hardware product, that means that the company can insist on only distributing the code by sending it to you as a bunch of floppy disks, for all the GPL cares.

This goes against the spirit of the GPL.... To take your example to the extreme, suppose that they made the code available via 3of9 barcode in printed format? stone tablet (mailed to you via overnight delivery at your expense)? 8" floppy disks? download via modem @ 300bps at $19.95/minute? Maybe stone tablets aren't machine readable but the rest are.

It's the "complete machine-readable copy of the corresponding source code" and "a medium customarily used for software interchange" you quoted that explain it. How many computers have floppy disks these days? Mine doesn't. When was the last time you saw anyone exchange code on a floppy disk?