Multi level license attribution problem

Question

Consider a scenario with three products. X, A and B:

• X belongs to my company and is not open source.

• A is also not open source, but they have free version and paid version with different licenses.

• B is under CC BY 3.0 US.

A uses B, and thus, it has to attribute B, which they do on their website.

Now X buys the paid version of A, so it gets a commercial redistribution license, which as per our understanding, does not require attribution to A given the product A is unchanged while being used in product X.

Product X is a paid, non a distributive product, but its services are used for others, but still not by others.

The question here is that do production X have to attribute to B, publicly? They clearly don't have to attribute to A publicly.

I asked this question on TNB and some discussion happened there.

For my specific case, product A is MaxMind GeoIP2 (scroll down for attribution to product B) and product B is Geonames and the commercial license of paid version of A, MaxMind GeoIP2, is here. But this question can be useful for anyone facing similar situation.

Answer 1

If you use A, which includes B, you need to follow the license of B insofar as you redistribute B as part of A. The authors of A can't legally give you the authority not to attribute B when you distribute A (unless A's authors worked out a separate licensing arrangement with the authors of B).

As for X, no attribution is necessary as long as no distribution occurs. Attribution requirements only apply when some copyrighted part of B is distributed to another party. If the company that owns X never distributes any part of B or any work that is a derivative of B under copyright law, then B's attribution requirements do not apply.

From the Creative Commonas FAQ (emphasis mine):

All of our licenses require that users provide attribution (BY) to the creator when the material is used and shared.

And from CC-BY 3.0 U.S., the attribution requirement in 4(b) states (emphasis mine):

If You distribute, publicly display, publicly perform, or publicly digitally perform the Work [...] or any Derivative Works [...] or Collective Works [...], You must [...] keep intact all copyright notices for the Work and provide, reasonable to the medium or means You are utilizing: (i) the name of the Original Author (or pseudonym, if applicable) if supplied, and/or (ii) if the Original Author and/or Licensor designate another party or parties [...] for attribution

The attribution requirement only applies to distribution or public display of the work, or of a derivative.

Answer 2

Just my opinion: Because "You ... publicly digitally perform the Work" of B, you must attribute B.

You can do that either by

1. explicitly atributing B in your documentation, or
2. by attributing A, even though that's not required, thereby implicitly attributing B.

I'd do (2) but it's your call. IANAL/TINLA (I am not a lawyer and this is not legal advice).

You should keep the copyright and original licensing intact in your source code, even though you are not distributing it, just in case you sell it or your company some time in the future. Since you are not distributing source, you will have to provide the attribution to your clients in any reasonable manner (such as your web site as your example A provided the code to you, documentation that accompanies your product, etc.).

Answer 3

A attributes B publicly because A is openly available and thus distributed publicly. A is available to everyone so the attribution to B must also be available to everyone.

You need to attribute B from X to everyone you distribute X to. If you only distribute X to a limited number of customers and not openly, you do not need to attribute B from X openly.