Company policy says no code under license requiring sharing source can be used. Stack Overflow is CC-BY-SA. Does this mean we can't use SO at work?

Question

Training at work regarding software licensing instructed us that we should not use code from any project using a license that requires sharing modifications such as the GPL. We can use Linux as an OS for example, but we can't make a change to the kernel to support a work project since that would require sharing that change in code form. We can use LGPL libraries, MIT-licensed libraries, etc. since they allow linking from closed source code, but we can't make changes to those libraries to support work projects for the same reason (if the license requires changes to the library itself to be open-source).

We're a relatively new org so our departments aren't yet "mature". We have a single legal consultant (who did this training) who is not an employee. One question that came up more than once was use of code on Stack Overflow. Stack Overflow states that code posted to the site is licensed under CC-BY-SA. The "SA" part is the problem, as it is generally interpreted to be similar to the GPL.

If I take a snippet of code from SO in unchanged format, I can state that I acquired it from SO and place a link to the post in the code (that covers the "BY" part). But CC-BY-SA doesn't make it clear if this now requires the entire code base to be licensed under CC-BY-SA, or just the part that I pasted.

It's even grayer if I use SO code but modify it to suit my purposes. In the broad sense, CC-BY-SA would then require me to release my changes (although I'm not sure exactly where I'd do that). However, if the changes made to the code involved anything proprietary, that of course presents a problem for the org. But even something as simple as changing a string in the code could be seen as a modification.

So far, our "consultant" has no solid advice because of the ambiguity of CC, but suggests "you might want to consider perhaps not using code from StackOverflow". (The consultant didn't even really seem to know much about SO itself, suggesting he's likely not a developer and focuses strictly on legal issues) As developers, we all of course heavily rely on SO even if for advice and guidance on how to perform some task in code. Amongst us devs, barring use of SO is enough to make some of us seek employment elsewhere because it is such a valuable resource. Of course, SO is not the only website that publishes sample code; even some books license their sample code under CC licenses.

To make things even more complicated, sometimes a snippet of code from SO is a single line of code. Sometimes this single line of code is the best or most efficient way to perform the task at hand in the language in question. Now that I've looked on SO and learned that technique, is using the code now considered CC-BY-SA?

Essentially, I can't imagine how you could develop code these days under these conditions. If you can't use any code you got from SO in a closed-source project, and if even learning how to do something from SO might require you to license your implementation under CC, basically we can never work for an organization that requires closed-source code! (This may seem to be a logical extreme, but then again, the legal consultant did basically tell us to always assume the worst case and steer clear of any ambiguities.)

Naturally, I'm not seeking actual legal advice, but am interested in how others have approached or addressed this situation. SO is so popular that I haven't yet met a modern developer who hasn't used it for advice. But closed-source software is alive and well all over the place. From a legal perspective, is it honestly the case that everyone writing closed-source code for a business cannot legally use code (or even reference code) from SO?

Answer 1

You are broadly correct that if your program includes CC BY-SA code from someone else, you must license the entire program under CC BY-SA. Note that this doesn't actually force source disclosure -- unlike the GPL, you may place your binary only under CC BY-SA, and keep your source code private -- but it would require unrestricted downstream redistribution of your binary under CC BY-SA terms, which your company might not like if you were hoping to have a monopoly on selling it.

sometimes a snippet of code from SO is a single line of code. Sometimes this single line of code is the best or most efficient way to perform the task at hand in the language in question. 

This is the heart of the theory under which you can sometimes redistribute CC BY-SA code from Stack Overflow in your closed-source project. We know the CC BY-SA license places conditions on your reuse of copyrightable material, but it is also true that copyright protects only creative expression, not ideas. Under the merger doctrine in copyright legal theory, if there are a very limited number of ways to express an idea, then those expression are not copyrightable: the expression and the idea are the same.

The line between ideas an expression is not simple, and copyright can protect code that has been completely rewritten but is structurally similar, if the structure being preserved contains creative expression. However, very simple tasks usually only have one or two sensible expressions in any given programming language, so they are not protectable under copyright. Another way of considering it is that code is copyrightable insofar as it deviates from the obvious or creatively synthesizes multiple ideas into a new program.

At one end of the spectrum, looking up how to sort a list in descending order or draw a rectangle to a screen in a particular language or library is not protectable under copyright, so you may use it without abiding by a copyright license. If the code is more complex, it is probably copyrightable. However, most code on Stack Overflow is meant to be didactic: it is meant to demonstrate some kind of general approach or algorithm. In that case, the text of any particular implementation is copyrightable, but the logic of the algorithm is not. If you can understand the algorithm and then implement it yourself, you could possibly have your own novel copyrightable expression.

In the United States, the line between the "idea" of a program versus "expression" is decided by the courts using the Abstraction-Filtration-Comparison test, which abstracts out the ideas from the expression, filters out the non-copyrightable components, and then compares the remainder. The particulars of where case law draws lines between protectable and non-protectable expression is far outside the scope of this answer; Wikipedia links to relevant case law.

In the case of Stack Overflow code, you might ask, "If I understood the concept being represented in this answer perfectly, what would my implementation look like?" If the answer is obviously that your implementation would necessarily be identical (because it's a matter of calling foo.sort(reverse=True) and that's it) then you may certainly use the code as-is. If the code is more complex, and your implementation would likely differ, then write your own implementation based on a robust comprehension of the principles demonstrated in the answer.