7

On the download page of Fedora, one finds this text:

By downloading Fedora software, you acknowledge that you understand all of the following: Fedora software and technical information may be subject to the U.S. Export Administration Regulations (the “EAR”) and other U.S. and foreign laws and may not be exported, re-exported or transferred (a) to any country listed in Country Group E:1 in Supplement No. 1 to part 740 of the EAR (currently, Cuba, Iran, North Korea, Sudan & Syria); (b) to any prohibited destination or to any end user who has been prohibited from participating in U.S. export transactions by any federal agency of the U.S. government; or (c) for use in connection with the design, development or production of nuclear, chemical or biological weapons, or rocket systems, space launch vehicles, or sounding rockets, or unmanned air vehicle systems. You may not download Fedora software or technical information if you are located in one of these countries or otherwise subject to these restrictions. You may not provide Fedora software or technical information to individuals or entities located in one of these countries or otherwise subject to these restrictions. You are also responsible for compliance with foreign law requirements applicable to the import, export and use of Fedora software and technical information.

This would appear to be a "further restriction" within both versions of the GPL. Does this mean Fedora is not being legally distributed? What impact does that have on the users?

  • 3
    I don't have the legal knowledge to answer this, but my assumption would be that the GPL is trumped by the laws of the land... – Tim Malone Nov 10 '16 at 6:15
5

These kinds of notices are broadly addressed in the GPL FAQ entry about export restrictions:

Some distributors of GPLed software require me in their umbrella EULAs or as part of their downloading process to “represent and warrant” that I am located in the US or that I intend to distribute the software in compliance with relevant export control laws. Why are they doing this and is it a violation of those distributors' obligations under GPL?

This is not a violation of the GPL. Those distributors (almost all of whom are commercial businesses selling free software distributions and related services) are trying to reduce their own legal risks, not to control your behavior. Export control law in the United States might make them liable if they knowingly export software into certain countries, or if they give software to parties they know will make such exports. By asking for these statements from their customers and others to whom they distribute software, they protect themselves in the event they are later asked by regulatory authorities what they knew about where software they distributed was going to wind up. They are not restricting what you can do with the software, only preventing themselves from being blamed with respect to anything you do. Because they are not placing additional restrictions on the software, they do not violate section 10 of GPLv3 or section 6 of GPLv2.

More specifically, this very issue came up in 2007 on the Fedora mailing list:

Correct me if I wrong - this statement seriously violates GPL - I read it and find no mentions about Cuba and Iraq.

The final message in the thread links to a Fedora wiki page with a response from the FSF:

> > Fedora as a distribution is affected by export control regulations as
> > any software subjected to US laws from the legal perspective.
> >
> > http://fedoraproject.org/wiki/Distribution/Download/ExportRegulations
> >
> > Clause 8 in GPL mentions that such regulations are compatible with the
> > license but can you confirm FSF's viewpoints on this?

Section 8 of GPLv2 doesn't make the sort of sweeping policy statement you're suggesting here. You'll note that we took this clause out of GPLv3 -- but you're not suddenly going to get into export restriction trouble because of it.

The question to ask is: what requirement of the GPL does the law prevent you from fulfilling? When it comes to export restrictions, the answer is none. If you comply with local export restrictions, you will not run afoul of any requirements in the GPL. Therefore, there's no conflict.

Export restrictions limit who you can give the software to. The GPL has no problem with you being picky about who you give the software to: if you want, you can decide that you'll only distribute to paying customers, or people with blue hair. So the fact that you also decide not to distribute to Iranians and Syrians is no problem as far as the license is concerned.

To summarize, it seems the FSF understands such an export-restriction notice as this as merely an informative statement about laws that may exist in your jurisdiction. Furthermore, the export restriction laws are not strictly in conflict with the GPL: you can follow both export law and the GPL simultaneously. Certainly, export laws narrow some of the rights you would otherwise have under the GPL, but the GPL can't ever give you meaningful permission to take actions that are outright illegal in your jurisdiction.

This seems right to me (not that my legal opinion counts for anything) since the language used at the top of the notice is:

Fedora software... may be subject to the U.S. Export Administration Regulations...

Such conditional language like "may" does not sound like language that actually imposes a restriction, but rather sounds like language that warns about a restriction that might exist elsewhere.

  • Can you talk about this sentence in particular? "You may not provide Fedora software or technical information to individuals or entities located in one of these countries or otherwise subject to these restrictions." – Kevin Nov 20 '16 at 18:54

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.