What happens if a company releases third-party confidential code as open source?

Question

This is very similar to this question: What happens if stolen software is published as Open Source? – but it doesn't exactly answer my question. This is also a thought experiment with no real companies.

Say there is a company: Acme Corporation. They've released a new IoT device that uses a technology made by the company Foobar Inc.

Cool as they are, Acme Corp. decided to release the whole source code for this new IoT device – including confidential source code from Foobar Inc.

Now, let's say Wile E. Coyote, Acme's most loyal customer, bought this IoT device and downloaded the source that's publicly and officially available on Acme's website, and then Mr. Coyote found the confidential Foobar Inc. source code. Some of the code from Foobar Inc. is under GPL, but others are marked as confidential. Some of the code from Foobar Inc. only has copyright headers, but has no GPL license nor Confidential headers and is also available.

Should Mr. Coyote report this leaked source code to Foobar Inc.? Let's say most of the code is under GPL, should he report it to the Free Software Foundation? Or should he contact Acme Corporation and ask them whether the code that they publicly released was meant to be released?

Answer 1

Mr. Coyote should talk to his lawyers ASAP. While he was unaware that the code he was using was a copyright violation, he could make a reasonable defense against punitive damages. However, now he is aware (or has a strong suspicion) it is a copyright violation and continues to use it, a court will look far less favourably on him.

Unrelated to that:

Let's say most of the code is under GPL, should he report it to the Free Software Foundation?

No; the FSF do not police the use of the GPL. If code is distributed under the GPL which should not have been, that is a matter between the copyright holder (Foobar Inc.) and the person distributing the code.

Answer 2

Acme Corp. has created an unholy legal mess, both for themselves, Mr. Coyote, and Foobar, Inc.

Acme Corp. has committed two acts of copyright infringement: Obviously Foobar's code, which they were not allowed to copy at all. But also all the GPL licensed code: Acme created a derived work of the GPL licensed code. They couldn't distribute it under the GPL license because they had no right. And because the couldn't distribute it under the GPL license, distributing the GPL licensed code was also copyright infringement.

In addition their claim that the software is GPL licensed is false (Mr. Coyote might have bought the product just to get the GPL licensed source code, so was defrauded), so Mr. Coyote might sue them, and it puts Mr. Coyote in a position where he might unknowingly commit copyright infringement.

Acme, Inc. should have done one of two things: Either negotiate a license from Foobar to allow distributing Foobar's code under the GPL. Or release their product without Foobar's code. What they did instead was illegal, stupid, and most definitely not cool.

Answer 3

First, I AM NOT A LAWYER. Nothing I say should be used as legal advice. Now on to my answer.

It depends

If Wile E. Coyote isn't interested in changing the code, but just download it to view it he should just delete the code from his computer. In most jurisdictions there is no legal requirement to report spreading confidential code. As long as Mr. Coyote isn't using it to build his own software, and makes sure it's deleted he shouldn't end up in trouble. He doesn't know if Acme Corp. have a license to use the code in their product, and he can continue to use the device without problems.

If he is interested in developing the code he could give up those thoughts.

If he still wants to develop the code, or already have updated the IoT device with his version derived from the downloaded version, he should follow the suggestion from @PhilipKendall to contact a lawyer.