Can Employer Usurp Copyright On GPL-Derived Work? 504
An anonymous reader writes "I am a recent graduate, and I've been working on my own on a project that uses GPL-licensed libraries. Later a university department hired me, on a part-time basis, to develop this project into a solution that they needed. The project's size increased over time and soliciting help from the open source community seemed like the obvious thing to do. However, when I suggested this, my boss was not interested, and it was made clear to me that the department's position was that copyright of the whole thing belonged to them. Indeed, by default work created for an employer belongs to the employer, so I may have gotten myself in the same trap discussed here years ago. Even though I want to release my code to the public I don't know whether I have the legal right to do so. I did start the project on my own. And, since no written or verbal agreement was ever made to transfer copyright over to my employer, I question whether they can claim that they now own the extended version of the project. Also, the whole project relies on GPL libraries, and without those libraries it would be useless. Can they still claim copyright and prevent me from publishing the source code even though it is derived from GPL software?" Some early commenters on the submission pointed out that it matters whether the libraries were licensed under the LGPL vs. the GPL.
Yes, but it may not mean what you think it means (Score:5, Informative)
All the work you did for them belongs to them. However, they may not be legally entitled to use it how they'd like. If it's based on GPL code and they don't want to release the whole thing under the GPL, they'll need to rewrite the sections under the GPL before they can have their way with it.
Let's be clear. You have no rights to do whatever you want with the code you wrote for them.
Re:Yes, but it may not mean what you think it mean (Score:4, Informative)
I'd also like to note that I work for a large company that knowingly pays me to do exactly this all day. I write proprietary software using GPL libraries and such all day. We just don't distribute it.
Ask a lawyer (Score:5, Informative)
Gah. Every time this kind of story gets posted to Slashdot we go through the same conversations.
You entered into the employment and provided them with the code base, they most likely have a claim to it.
All the work you did for them is work-for-hire, they own it.
There's nothing wrong with using GPL libraries for internal proprietary software.. the GPL is a *distribution* license, you haven't said anything about distribution so I'm assuming they're not distributing it, in which case the GPL is irrelevant.
There's lots and lots of source code in the world, plenty of it is free for you to hack on, move on.
If project is not distributed, GPL doesn't apply (Score:4, Informative)
If your project is only used internally, i.e. if it's not distributed, the GPLedness of the libraries you're using plays no role. If you're not distributing, the GPL places no restrictions whatsoever on what you do with the libraries. Now, since you started the project before getting paid to do so, it might be the case that the step where you so to say 'gave' it to the university counts as distribution, and then there would be no alternative to an at-least-GPL-Free license for your project, but that is something you should ask a lawyer about, not slashdot.
Re:Yes, but it may not mean what you think it mean (Score:5, Informative)
Before they can have their way with it, yes - but they can use it internally - just as I can make derived works from GPL code and use them however I want, myself or in my company. What I can't do is distribute it, sell it, etc... but if I base my employers in-house time-tracking system on some GPL code - the company is under no usage restriction whatsoever, and is under no obligation to share those changes with anyone else.
If they do want to distribute the stuff outside their organisation, they'll have to do so under the terms of the GPL - other than that scenario, they can do whatever they want internally.
Re:Lawyer time? (Score:5, Informative)
No. If I hire someone to extend the linux kernel (or something else that is GPL licensed), I own those changes. If I choose to distribute them, I'm required to distribute them under the GPL, but I am not obligated to distribute them and my employees have no right to distribute them. To put it simply: the code aint under the GPL until the copyright owner says it is. The copyright owner can even choose to distribute it under some other more restrictive license.. it would be a copyright violation, and third parties could possibly sue me, but that's my choice. Nothing is "automatically" GPL.
If you are a contractor... (Score:1, Informative)
you own your work by default. This applies in the absence of any other agreement. If you are an employee, your employment contract may override this.
Re:It was GPL before, so is GPL now (Score:5, Informative)
He doesn't need to change the license.
1. Alice starts a GPL project.
2. Bob hires Alice to write an extension to the GPL project.
3. During her employ (or before, it doesn't matter) Alice uses some GPL libraries written by Claire.
4. Alice leaves Bob's employ.
FACT 1: Bob owns all the changes Alice made while in his employ.
FACT 2: Alice had no right to distribute changes owned by Bob.
FACT 3: Bob is not obligated to distribute the changes.
FACT 4: As the GPL only relates to distribution, not use, Bob is free to use the software.
FACT 5: If Bob later distributes the changes without placing those changes under the GPL, both Alice and Claire can sue him.
Nothing "automatically" becomes GPL software.
Re:IANAL but... (Score:5, Informative)
According to the GPL FAQ over at gnu.org, internal corporate use does not count as distribution: http://www.gnu.org/licenses/gpl-faq.html#GPLRequireSourcePostedPublic [gnu.org]
Re:It was GPL before, so is GPL now (Score:3, Informative)
This isn't stealing. Almost all programming jobs will contain a clause saying your employer owns any code you write while you are at work there. It sucks sometimes but it is sort of fair depending on how you look at it. The whole notion of working for an employer revolves around you giving up something in exchange for money. In this case it is your freedom and your intellect/creativity/etc.
The issue here is that if your employer does not wish to make your changes public (and comply with the GPL) then these changes need to be removed from the public work...so that the public work can still meet the terms of the GPL.
They can indeed continue to use it in-house provided it is not "distributed" from one party to another.
As correctly pointed out in other posts in this thread, the GPL only comes into play when the work is copied/distributed. You can do whatever you like with GPL code in-house. It is only when you later distribute that work to another party, that you become bound by the terms of the GPL.
Also consider this: Releasing code publicly that your employer owns the copyright to, is actually stealing from your employer.
Re:GPL Violation? (Score:5, Informative)
This is what it boils down to, and what people often forget or misunderstand about GPL. You can do with GPL code whatever you want internally as long as you don't distribute it. It is a license that specifies how the party someone distributes to has to distribute it when he/she does.
The code OP wrote on his own is on his copyright and he can distribute under the GPL. The extensions he wrote for his employer are owned by the employer (he has the copyright). If he wants to distribute it, the employer has to respect the GPL.
They can claim copyright because they own what you produced at the time you were employed there (usually, may depend on the contract).
Since you are at a university it might be smart to see if there are any regulations or memos that recommend or require that department-developed software becomes open source. I know that some countries, particularly in the EU, see that tax-payed software should become publicly available. Try make some suggestions in this direction.
Re:If you are a contractor... (Score:3, Informative)
Re:IANAL but... (Score:5, Informative)
I've heard solid arguments in both directions as to whether internal corporate use counts as distribution,
By whom? The only time I've ever heard anyone suggest that internal corporate use counts as distribution was by the MySQL morons as an attempt to scare up business. The FSF even came out against them saying they were wrong and their arguments were damaging to the community.
Re:GPL Violation? (Score:4, Informative)
Any work done before he worked for them is his copyright and he could release that but any work done after his hire is theirs and as long as they keep it in house, there is no violation.
This varies very much from country to country. In many European countries the work you do outside work is your own. In the US that should also be true, but your employer is allowed to create contracts which take away everything you should own. So, the summary doesn't give us enough information. You need to know a) where exactly this is happening b) what contracts were in place c) what exactly the guy did; what discussions he had and exactly what comments are in the code. Generally he shouldn't post that information since his posting would be discoverable in any lawsuit. He should discuss everything with his lawyer since, in civilised countries, that kind of discussion protects any speculative things he may say that might be harmful to him from being available to his opponents.
Re:If you are a contractor... (Score:4, Informative)
It is legislation, not case law. Section 35(6) of the Australian Copyright Act 1968: "Where a literary ... work ... is made by the author in pursuance of the terms of his or her employment by another person under a contract of service or apprenticeship, that other person is the owner of any copyright subsisting in the work ... ." Computer Software is a 'literary work' for the purposes of the act.
Note that it isn't all code written by an employee, just code written for your job.
IANAL, but you can look at the law yourself: http://www.austlii.edu.au/au/legis/cth/consol_act/ca1968133/s35.html [austlii.edu.au]
Re:If you are a contractor... (Score:3, Informative)
Contractors are not employees.
But the other point about this that is never mentioned is that contractors implicitly give licenses to whoever is paying them. Without a written contract that license is often interpreted VERY broadly.
Legal questions should be answered by a lawyer (Score:5, Informative)
This is a question that can only really be answered by a lawyer familiar with your circumstances and the laws in your jurisdiction. For example, by default, in Canada, if you're hired as a contractor to produce a work, you retain the copyright on that work (or so I was taught in my 100-level Business Law class). However, I don't believe this is true in the US. It's also not true in either country if you're hired as a salaried employee.
But really, plenty of other people will be offering legal advice, and the reality is that this matter won't go to court because it's not worth the time or money for you or the university. You can get a lawyer's opinion that you're in the clear to release your work, but even that's only so helpful to you -- if you threaten or bully your employer, that may just set them against you. (On the other hand, it may be just the thing! Maybe they need to see that you won't be pushed around. Different people respond to different tactics.)
The most elegant solution to your problem is politics. Convince your boss's boss and your boss's respected colleagues that your work would be better off shared -- people's opinions are ultimately derived from the opinions of the people they respect. You've made good use of an open-source base, right? Make sure they understand that there's value in tapping into that community. Allay their fears. Show them the positive side. Get people on your side.
If you can swing this right, it won't matter what the legalities are because the one of the university's officers will sign a waiver disclaiming interest in the code and you'll be in the clear for sure -- and your boss will be pleased at having done something good.
Sure, you should have got the signature before you started working; then you wouldn't have to spend cycles on this problem. Still, it may be fixable.
And if that doesn't work, just remember: the implementation is twice as good and ten times as quick to write when you've done it once before!
Re:This is a nice question (Score:3, Informative)
Just a guess, but I'd say their lawyers would nail said employee to the proverbial wall. Theft of trade secrets comes immediately to mind. Bear in mind that, as a company employee, the fact that he has a copy of the code/binary in his possession does not count as distribution. As I understand it, this is because he would be considered as part of the corporate "person" while under the employment of the said corporation. If he leaves the company with the code in his possession it would almost certainly be considered theft and not distribution. This would leave him with no rights to the code at all.
The contract didn't convey copyrights (Score:2, Informative)
The contract didn't convey copyrights, therefore the copyrights are still his, NOT his employer.
Copyrights must be transferred by explicit contract. Not "oh, you paid me, so I guess your demand must be right".
Since the work contains GPL stuff, the university get a non-transferrable license to the combined work and a transferrable right to distribute/sell to others under the GPL.
Absent any contract specifying ownership transfers, it's still the author owns copyright.
NOTE: if the university don't abide by the GPL they are in license violation even if the contract DID convey copyrights unless they have the GPL part taken out.
This is no different tan any other copyright license.
An easier problem than they have with BSA (Score:2, Informative)
An easier problem than they have with BSA. After all, the spun off company won't have the original license and that original license will have the parent company on it not the spin-off. Therefore they'll need a new license for all commercial software.
This is an additional cost for the company when spinning off a branch.
NOTE: the GPL is satisfied if BOTH the parent and the spin-off get GPL rights to the code. This doesn't cost anything.
Re:GPL Violation? (Score:2, Informative)
This should answer your question: http://www.gnu.org/licenses/gpl-faq.html#GPLRequireSourcePostedPublic [gnu.org]
"The GPL does not require you to release your modified version, or any part of it. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization."
Re:It was GPL before, so is GPL now (Score:3, Informative)
It's not a gray area as the GPL explicitly says that it does not cover use, only distribution.
Re:GPL Violation? (Score:3, Informative)
Re:GPL Violation? (Score:4, Informative)
Even better answer: http://www.gnu.org/licenses/gpl-faq.html#InternalDistribution [gnu.org]
No, in that case the organization is just making the copies for itself. As a consequence, a company or other organization can develop a modified version and install that version through its own facilities, without giving the staff permission to release that modified version to outsiders.
FSF has no automatic standing to sue. (Score:2, Informative)
The FSF does not have standing to sue unless they own Alice's work that Bob is distributing. Alice would have to assign copyright of her code to the FSF [gnu.org] for them to be able to do so.
Re:GPL Violation? (Score:3, Informative)
What if the organization, eg CorpInc, took software released under the GPL and made modifications to it. Then they installed the modified versions to their own computers. The modified version is clearly under the GPL, because it is a derivative work. However is CorpInc required to give it's employees that use those computers the source to the modified version? If they are, then by the terms of the GPL the employees can give the source, and binaries, to others.
I don't believe so, since you have a company installing its own software on its own computers. That's not distribution/propagation/release/whatever.
Re:GPL Violation? (Score:3, Informative)
Actually the copyright on any code written "during work time" (or otherwise understood to be part of a job, be careful with that), is not the coder's to licence as he pleases, so it does not even matter what is in the employment contract. The code will be considered a "work for hire" (google that exact term for more information : it is the term used in copyright law, and is legal jargon)
His employer owns all rights to the code, except for 2 things :
1) the employer cannot deny the coder actually wrote that code (up-front attribution is not required, on-demand confirmation is required, e.g. "I want to hire person X, did he actually do the work in his CV on project Y ?" must be answered truthfully)
2) the coder gets to show, demonstrate, explain the functionality of the code to anyone he pleases*, **
(and -but be more careful- the coder is free to distribute extracts out of these materials for educational purposes)
* which can include limited distribution, e.g. in a job interview conducted over mail, however it must be clearly understood to not be used for anything other than portfolio work
** this explain bit can be used to get the code into the GPL program legally. The essential point is that the coder gets the work in, with his only involvement being explaining what it does to someone else, WITHOUT exchanging any of the protected work. In response to specific questions you can then (afterwards) use things like pseudocode. The coder cannot legally do this himself, but there's no law against him guiding -no matter how closely- another to do it. Given legal precedent, it would be very wise not to touch the computer of the guy doing the commit for any reason. If possible, document the exchanges made (do them over email ?, note down somewhere (in your gmail box for example) that you talked over the phone and what you talked about, or provide small "meeting reports", again mailed to yourself, that'd be a great help to any lawyer if it ever becomes a legal case)
Distribution, creation of derivative works (a second implementation of it by the same coder of the same thing would most likely be considered a derivative work, especially if parts of the code would turn out to match perfectly), and/or use in any manner other than described above is a violation of copyright law (and most likely also a serious violation of your employment contract)
And, frankly, don't tell your boss you're doing this. There's no legal necessity here, just common sense. Oh nothing in this post is legal advice for any case at all, it is merely a small summary of part of copyright law for informational purposes. It might be wrong, not applicable in your state, ... so use at your own risk. Contact a lawyer for legal advice.
Re:Yes, but it may not mean what you think it mean (Score:1, Informative)
I don't know which country you are in but in the UK for example, this is just not true. Copyright absolutely rests with the creator unless there is an explicit transfer of ownership stated in the employment contract. Any part of the work he created before joining them is his. Anything he created while working for them only belongs to them if the appropriate clause is in the employment contract.
Re:Yes, but it may not mean what you think it mean (Score:3, Informative)
Also doesn't every recipient of the binary+source get permission to redistribute that?
Yes, they retain that right. The main point he was making is that you are only required to make the source code available to someone you gave the binaries to, not the general public. That is one point of the GPL that often gets misunderstood, you do not have to give your GPL code to the public per se, only to those who you selected to have the binaries. If they further distribute the binaries, you are not responsible to provide the source code to those 3rd parties. This means you can sell GPL binaries, and only provide direct copies of the source to those customers, and never the "public". This is a feature of the GPL, not a bug.
Re:It was GPL before, so is GPL now (Score:1, Informative)
Also consider this: Releasing code publicly that your employer owns the copyright to, is actually stealing from your employer.
I see by your /. id that you may have just arrived this afternoon, but how can you not already understand the legal difference between "stealing" and simple "copyright violation"?
Re:Yes, but it may not mean what you think it mean (Score:3, Informative)
Someone else answered it in a long fashion, but to put it short: You only have to provide the source code to those entities you provided the binaries to, NOT the general public. Otherwise would create an undue burden on the original programmers.
If you make Program A, give me a copy with source, and I sell the binaries for $10 each (or just hand them a disk free), you are NOT responsible for providing the source code to those customers, *I* am, and you would have the legal right to force me to give them the source code since *I* distributed the binaries. I don't have to provide a copy of the source to anyone else, only those I gave/sold the original binaries to.
Re:teach them a lesson (Score:4, Informative)
IANABM (Score:5, Informative)
I am not a bookmark manager, but what the hell [gnu.org]. Those folks actually spent a bit of time thinking about this shit, you know. If you're still confused after reading the FAQ, direct your question to GNU or FSF, not bloody slashdot.
Re:GPL Violation? (Score:3, Informative)
That's not correct. Unless you did the work as a university employee, or someone compensated by the university for doing the work, there is no transfer of copyright or assignment of any rights, just because you were a student at the time.
Now if you have been granted a scholarship, assistanceship, or employment with the UNI. There may be some term of the contract that assigns ownership to the university.
There may also be some matters that have special terms -- for example, students conducting a masters or P.h.D. thesis, may be required to assign or sign certain rights to the school, over their final submission (such as the right to publish), before it can be accepted.
But that is an exception to the rule.
IANAL (Score:2, Informative)
This sort of question is exactly what the Software Freedom Law Center [softwarefreedom.org] is for.
Re:GPL Violation? (Score:2, Informative)
BTW, you don't need a written employment contract to require that everything you do as an employee belongs to the company you work for either. Same for students - your enrollment is sufficient to say that you agree with the policy, and therefore give up your rights. Don't like it - enroll elsewhere.
It's not the same. By law, when you do work for another company who commissions and pays for the work, if there is not a contract, then 'work for hire' is assumed. The company who paid for and commissioned the work receives the copyright.
If you are a student, then you are not paid for any work. There is no automatic transfer of IP, regardless of someone else's "policy". By law a transfer of copyright can only be made with a signed agreement. There is no such thing as implicit transfer of ownership of copyright exclusive rights, there must be a signed contract.