How to manage source code if there are doubts about the licence?

Question

Even if the subject involves the MIT licence, my question is not strictly limited to that license.

Working for a private company, I found in their private repository some projects apparently licensed under the MIT licence.

Looking at the configuration files for those project I had the impression that most part of them are the output of a generic initialization script or pasted from a quick-start found on the Internet; some fields have not been tailored to the project as it's reasonable to expect; one of those fields specify, as licence, MIT; nowhere in the project there is the text of the MIT licence (nor any other licence).

That company never released open source code; the person that wrote those projects has left the company and is not currently reachable for comments; people working with that person at the time of the development guess that those source code were never publicly released and his contract probably didn't allow to use an open source licence.

Until he can comment on the code he wrote: 1) how should be treated that code (open or closed source)? 2) what if confirmed that his contract didn't allow to use an open source licence?

Would it change something if he would say he didn't want to use the MIT?

Answer 1

Until he can comment on the code he wrote: 1) how should be treated that code (open or closed source)?

It is quite common for boilerplate texts to slip in when you use project templates, project generation tools or else (such as cookie cutter, autotools, etc). Short of any other clues that the code has a foreign origin and if the company policy is not to redistribute code as open source, you should therefore consider first that this was just an honest mistake. You can further research a possible origin (first with a scan such as with my scancode-toolkit, then check the version control history for clues then eventually search the web, Github, searchco.de, etc. for clues that it may come from a thirdparty).

2) what if confirmed that his contract didn't allow to use an open source licence?

Again, the most likely case is oversight rather than any wrongdoing. And since you have an employment contract, in most countries these would cover proper assignments of the rights of the software created by employees to the employers.

Would it change something if he would say he didn't want to use the MIT?

It may or not, but this does not matter too much IMHO here as I think the most likely case is one of a mistake or oversight. (because I saw this happen several times). In any case if the code is your employer's, then that person unlikely had authority to decide on the licensing terms.

If after research you determine that this person reused code from a third-party origin and that this code is indeed MIT-licensed, then this is not a big deal either as this one of the most permissive license with very few requirements and is furthermore sublicenseable including under proprietary terms.

Answer 2

Your company has a hard road ahead, if they want to legally release any product based on this code. When you don't know the provenance of some code, you have to either throw it away and write it again, or find the Open Source original (with the license it has) and go from there.

On the other hand, if this is for entirely internal projects within the company, then you are probably safe. Possibly not fully legal, but the exposure is small.