Copyright and Contributing to an Open Source Project

Question

I'm a little confused by copyright notices on open source projects.

Let's say that a particular project is covered by a very permissive license, such as MIT or BSD. A copyright notice appears from the company that originated the source code.

But let's say that the project leader leaves the company, but continues to contribute to the project. Should s/he add a new copyright notice, to indicate that portions are copyright from the original company and portions from the author no longer employed by that company?

It seems to me that anyone who touches a file essentially invalidates the copyright claims of anyone prior, because the file becomes a "new creative expression" based on those modifications. How is the copyright supposed to be managed in a legally (and morally) robust manner as more and more people contribute?

Answer 1

This is where the problem (or advantage) of multiple copyright owners comes in with open projects. There are two scenarios, based on whether a Copyright Transfer Agreement (CTA) is required to contribute to the project.

If a CTA is required to make contributions, then the issue is moot as the organization running the project becomes the copyright holder.

Otherwise, a common practice is to have multiple copyright lines within each affected file.

Thus you might see the following:

// Copyright 1998..2015 Myorganization
// Copyright 2013 Fred Coder
// Copyright 2011 A N Other

Indicating that the file has been modified throughout its life by the official 'organization', but has also been touched by two different developers.

The copyright in this case exists in the entire file, as a combination of all contributions, rather than in specific lines of code.

Another approach is to have a single file (often named something like CONTRIBUTORS.txt) in the project root which identifies everyone who has some copyright claims to the source code.

Answer 2

By default under international copyright law, all copyright is owned by the person who wrote the code (or owned by the company they work for if they are an employee, or owned by the client who hired them if they are a subcontractor).

With open source projects, there can be dozens or hundreds or even thousands of people who own copyright on a project. This means all of them own the copyright and any copy must be authorised by all of them.

There's no one person who owns copyright, the original company who previously owned all the copyright now only owns part of it and therefor they have to get permission from all other contributors to make copies.

By having a well written license (such as MIT or GPL) attached to the project all of the copyright holders have clearly given the world permission to make copies with certain restrictions, and this means that anybody can do so without having to ask for permission from everybody.

The only time this really becomes a problem is when you do not want to comply with the restrictions of MIT or GPL. For example the VLC project tried to put their product on Apple's Store but this isn't allowed in their license and somebody sent a legal threat to Apple, resulting VLC being from the store. Since the license doesn't allow deploying on the store the only way to do so is with written permission from everybody who has ever contributed to the project.

Another (less common) way to approach the issue is for all contributors to assign copyright to the company/foundation who runs the project using a "Copyright Transfer Agreement". This way there is only one copyright holder and they can do anything without having to comply with the license, since they own all of the copyright.

An example of this is the Java project which was created by Sun and later purchased by Oracle. It is released under the GPL license, but Sun/Oracle also sell the product under a proprietary license that does not include GPL's "copyleft" restrictions. They need to own all of the copyright to take that approach.

Something else to keep in mind is most projects use a good version control system such as Git and this allows you to know exactly who wrote every line of code in the project. This can be used to find who wrote some code so you can contact them for permission, and if they don't respond you could delete all of their code (and also any other code that "derives" from their code... talk to a lawyer to find out exactly how that works).