Does license prohibition of illicit / malicious use or modification clash with GPL's freedom to modify?

Question

I am building a decentralized community service, where it is critical for each client to run a "legitimate" build version in order for the service to operate properly. The client versions do not have to be identical, but must be guaranteed to be compliant with the service in order to function as intended.

Unauthorized changes therefore will most likely have the intent to access information that the specific user is not authorized to access or alter functionality away from the intended. In the context of the client software, it just doesn't make practical sense for some modification to exist in one client, as it will be incompatible with the service on a network level anyway.

Such modifications are possible to not only tamper with the modifying user's copy of the program, but alter the functionality of other client's copies in unintended ways, which does constitute a violation of all those users ability to use the service as intended, and possibly even jeopardize their security, assets or intellectual property.

Therefore I would like to license my code in a way that explicitly prohibits any and all forms of illicit or malicious use or modification. Modifications are still possible, as long as they go through the official channel and are verified to be fully compliant by the community. The end user is still able to get his modifications in an approved code form and build and use that, but technically the user is not allowed to hack his copy of the client willy-nilly.

Can this license requirement work with GPL licensed code? Because I don't recall there being much emphasis on legality of use in GPL, if any, and quite a lot of focus on "you are free to do whatever you want as long as you share your code".

Where does the GPL stand in this de facto "usage limitations" that says "the user does not have the freedom to violate the freedoms of other users"? Maybe legality of use is outside of the GPL scope, and presumed that users are implicitly mandated to abide community or legal rules, or something like that?

To put it GPL-ish form, the user is free to make modifications to the product, provided that they do not impede other users' ability to use the product.

So, is this usage restriction compatible with GPL?

Answer 1

Simply put, a requirement to seek outside approval in order to make or deploy changes is not GPL-compatible, nor is it even a requirement within the definitions of free and open-source software.

Part of "freedom 1" that free-software licenses must afford is

The freedom to... change [the software] so it does your computing as you wish.

Here, "you" means each individual recipient of the software. If any license forbids a recipient from a particular kind of computation, it is not a free software license (and therefore also categorically not GPL-compatible).

You say this violates a very simple definition of "freedom" (namely, "you do whatever you want as long as it doesn't infringe on the freedom of others"), which is true: many kinds of freedom infringe on many other types of freedom all the time. The freedom of people to make modified clients without restriction conflicts with the freedom of other users to not encounter clients that have been modified in ways they don't like. This is a zero-sum game: you will never really have both freedoms at 100%. You prefer to optimize for the second freedom; free software licenses prefer to optimize for the first freedom.

You have also asked for a non-political example of why this matters, so here is one: suppose the authorizing body who blesses client modifications doesn't want clients to be able to transmit swear words. There might reasonably be a faction of users who want to be able to swear on the platform, and cannot. Or, in a less binary disagreement, there might be a spectrum of disagreement about what words are "bad enough" to be censored on the platform: is "crap" a swear that ought to be censored? Are regional swears (e.g., American-only, British-only, or Australian-only swears that don't even register as swear words to other English speakers) appropriate to censor, or is there only one region the authorizing body cares about?

It is easy to see that the authorizing body might reasonably draw a line anywhere on any of these issues that other users will bitterly disagree with. Use of the GPL (and all free/open licenses) indicates a wish for users to be able to roll their own versions of the software to fit their own needs and preferences. You have a need (i.e., that the authorizing body of your decentralized service should override those preferences, for the sake of users who don't want to modify their client), so you don't wish to use a free software license for your software.

There are many jurisdiction-specific statutory laws that prohibit misuse of software and computer networks. It is not clear to me that, broadly, communication in a decentralized system between independent parties that doesn't conform to an authoritative standard meets any standard for computer misuse. If a particular use is illegal under some statute, the GPL doesn't interfere with that, and if some use is not illegal, the GPL doesn't attempt to implement its own holistic criminal code from scratch. The GPL enforces one single issue, i.e., downstream ability to modify and redistribute the software. Its author, Stallman, cares very deeply about that issue, but he also has strong opinions about many, many other unrelated issues. Nevertheless, freedom to modify is the issue being targeted in the mechanics of the GPL. I appreciate you and Stallman disagree about the net social good that arises from the GPL's strategy.

It is also worth noting that if a client sends and receives sensitive information but you rely on client compliance not to reveal that information, people could simply read the information off their system's own network interface, without any modification to the client whatsoever. If you don't want a particular piece of information to be visible to a particular client, never send that information to a client (or encrypt it in a way that particular client lacks the keys/credentials to decrypt).

Answer 2

You are approaching this the wrong way.

First, you are assuming any wish to modify the software will be malicious, while in reality people will want to make all kinds of changes you hadn't anticipated at all, from having prefilled fields to a different background on Christmas season.

Second, if a is possible for a malicious client to alter the functionality of other client's copies jeopardizing their security it is a vulnerability in your program (the original one). You cannot rely on the other clients being honest.

You see, attackers won't care about your license. If they can modify their client to profit from their other clients, sooner or later they will do so. Even if that violates the code license. Even if they have no source code at all.

Those who care about the license are precisely those that are following the rules, the ones that want to improve the system so that e.g. Scunthorpe locals can use it, "bypassing" a profanity filter. Or making it work with their weird workflows.

By the way, the community that would have to approve the modifications wouldn't be able to test them to verify them, as they are not approved by the community. You may not reach to this catch-22, though, since no one would be able to (legally) modify the software to write the modification to begin with.

Answer 3

Modifications are still possible, as long as they go through the official channel and are verified to be fully compliant by the community.

This would make the software definitely not open source as it violates criterion 5 of the Open Source Definition:

5. No Discrimination Against Persons or Groups

The license must not discriminate against any person or group of persons.

as the hypothetical group on a desert island cannot modify the software.

Answer 4

If I received GPL licensed software and pass it to someone else, that is copyright infringement unless I follow the GPL license conditions. Telling the receiver they cannot use the software for criminal purposes is against the GPL and I can’t do that.

On the other hand, using GPL licensed software to commit a crime is criminal. As is using proprietary software, or a gun, or a screwdriver to commit a crime. You don’t need to tell the recipient not to use the software for crime. And if you did, that wouldn’t stop them anyway. ("Don't do this or you go to jail" might stop someone. "Don't do this or you violate my license" won't stop a criminal).

On the third hand, if I add such a requirement, then the worst consequence for me is that the copyright holder sues me for copyright infringement. But would they do that? Is that a freedom for the end user that the copyright holder cares about? Some might out of principle. The mafia might have created open source software and intends to use it for criminal purposes. But most copyright holders wouldn't care.

(And last, I'm not sure how legally binding such a restriction would be anyway. I'm very sure that I can't give you GPL licensed software and allow you to do things that GPL doesn't allow, meaning any such license that I give you is worthless. If I add restrictions you can try to get the software elsewhere without the restrictions, but I think my restrictions would be legally binding to you until then, although they might get me into trouble. )

Answer 5

Modifying and using the software is not the same thing as connecting to my network.

The GPL and related free software licenses are about the rights to modify and distribute the software, not to connect to online services against the will of service administrators. Nowhere in the GPL does it give a licensee the right to connect to a network or server or use privately-owned online services. The fact that I have a GPL-licensed copy of GNU Emacs running on my PC does not give me the right to take over the servers of the GNU Project or FSF and use them to mine cryptocurrency or execute a Denial of Service (DoS) attack against a group I don't like. The appropriateness of such actions are defined by server/network policy and local law, not the GPL.

So, your distributed network has policies. These policies are set and enforced through some sort of political process that you and your users will establish. Users who wish to modify your software in an "unauthorized" or "malicious" way are free to do so, but are not allowed to connect their modified clients to your network. Your network will enforce this policies with warnings or bans as applicable.

For example, suppose your distributed network is for a massively multiplayer game. You and the community of players establish a vote-to-ban system where users caught using clients with "unauthorized" aimbots, map hacks, keyboard macros, or DoS functionality will be booted from the network and prevented from connecting their clients to the network in the future. These users will be free to start their own parallel "cheating allowed" network using their own computing resources if they wish to do so, and connect to that network using whatever modified versions of your client they wish to allow.

One might consider the possibility that a majority of users of your network will develop pro-cheating viewpoints and refuse to assist in the banning of "cheaters", or even use the vote-to-ban system against those they feel are policing their behavior. This is an inherent problem in distributed networks, one that no policy or license will fix. If you find yourself in a struggle with your users over what the policies or practices of the distributed network you all built on top of your software should be, then congratulations, you're a politician! Politicking is hard!

As Ángel mentioned, malicious users (who intend to cause trouble on your network) will not be deterred from doing so because it is against a license. The same argument applies in physical space - putting a "don't steal this" policy bumper sticker on your car won't protect you against car theft. If a municipality puts up a "Drunk drivers please do not hit children in crosswalk, City Code § 32.33.a" sign, will that actually prevent injuries and deaths? This places you right back in the role of policy enforcer that I mentioned above. If you want a network free of "cheating", "exploits", or "hacks", then you've got to administer and police it or find someone who will.