5

I am in a situation where a company is interested in running an application of mine licensed under the AGPLv3. The company will repeatedly take inputs from multiple customers, and then return the outputs of the application to the customers. But instead of setting up a web app to do this, the company is thinking of asking customers to email in their inputs (as Excel sheets, in case that's relevant). The outputs will be emailed back, and also specify the sale of goods to the customers.

The AGPL licence is clear that it covers services offered over a network (e.g. a web app). But would this convoluted method over communicating via email still count as "interacting over a network"?

Any pointers, or thoughts, welcome!

Improve this question
8
  • 1
    When a customer emails a spreadsheet, will it be automatically digested by the software, or will it get unpacked by a human, and fed to the software?
    – MadHatter ♦
    Jun 8 at 10:53
  • Most likely the spreadsheets from all customers will be converted to JSON by an Excel macro, and then concatenated to one big input file (by a human). For now, I assume that all steps are manual.
    – grapher
    Jun 8 at 11:15
  • If the steps are manual, then the person interacting with the program is the operator who concatenates the data and feeds it to the program, so the question of the customer's rights under AGPL doesn't arise, surely?
    – MadHatter ♦
    Jun 8 at 11:25
  • 1
    No, it's just that AGPLv3 s13 gives rights to anyone who remotely interacts with the software. It says nothing about anyone who interacts with someone who in turn interacts with the software.
    – MadHatter ♦
    Jun 8 at 11:56
  • 1
    Are you ok with how the company intends to deploy your software- or do you feel it violates the reasons why you put it under the AGPL (regardless of any actual license violations)? If you ask them nicely, do you think you can come to a mutually acceptable agreement?
    – Bart van Ingen Schenau
    Jun 8 at 12:25

1 Answer 1

Reset to default
4

I don't see any difference between using SMTP (email) versus HTTP (web) to submit inputs to the software. They are both application-level protocols used over a computer network; I don't see the license applying differently merely because of a change in network protocol.

One possible difference, though, is whether the user's input is supplied directly into the program or not. Requests submitted via either HTTP or SMTP could equivalently be (1) fed directly into the program or (2) placed in a queue, where they are eventually interpreted and handled by a human, who employs the program to produce (and possibly share) output. Admittedly, this second case sounds more likely for inputs supplied over email.

There are certainly cases of the second category that I would not expect to carry AGPL obligations. If you email a photo to a person and ask, "Please run this photo through your AGPL program that applies various color filters to images, and send me back your top three favorite outputs," then I think it's crystal-clear that the original person submitting the photo and receiving the three outputs back is not the person interacting with the AGPL photo-manipulation program. There are also cases that seem much closer to direct interaction: suppose the human in the middle doesn't apply any discretion or decision-making, but merely double-clicks on a script file twice a day to process an input queue. In such a case, it certainly sounds like the original submitter has a much more meaningful interaction with the program than the human who is merely acting as a biological cron job.

That said, there is (as far as I know) currently no case law that approaches the question of what does or does not constitute "interaction over a computer network" under the AGPL, so I cannot begin to supply a legal test of what would fall inside or outside this category. Frankly, it's not clear to me if invoking the program via an actual twice-daily cron job to consume network-supplied input, with no human involved, is sufficient to disconnect a user from "interaction" with the program. I can imagine different hypothetical standards that would include or exclude it, but no such standard exists yet in actual legal fact.

Also note that the AGPL's network-based source-sharing obligations in section 13 only come into effect "if you modify the Program," so if the company is only privately executing an unmodified copy of the program, they cannot have copyleft obligations, even if their case constitutes network interaction.

Improve this answer
3
  • This is very helpful, thank you!
    – grapher
    Jun 9 at 13:05
  • In your last paragraph: well, technically they have copyleft obligations, but only for the people who actually interact with the software. I.e. the people who actually feed the output in the program may have an obligation to get access to the source code (if the program was "modified" according to the license definition).
    – Brandin
    Jun 9 at 14:08
  • I believe the important point here is in the last paragraph of apsillers' answer. Based on the description by the OP, the company (grapher's customer) is unlikely to modify the application, and interaction between the different software parts (e-mail reception, conversion to JSON, concatenation to one big input file) are interactions via the file system and thus are typical examples for 'mere aggregation' (not a modified version), and therefore there is no obligation to share any source code (would anyhow be difficult for MS Excel source code).
    – Martin_in_AUT
    Jun 10 at 15:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.