The answer is, no right exists, unless an act of "distribution of a copy" took place by the valid licensee to the taker. But that could quite possibly have happened in many situations.
Analysis follows (Note IANAL).
Full relevant text of GPLv2:
Note: I've removed anything related to side-issues such as modification, and split sections 4 and 7 into sub-points for ease
0) This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed
under the terms of this General Public License. Each licensee is
addressed as "you". Activities other than copying, distribution and
modification are not covered by this License; they are outside its
scope.
1) You may copy and distribute verbatim copies of the Program's source code as you receive it, provided that you give any other recipients of
the Program a copy of this License.
3) You may copy and distribute the Program under the terms of Section 1 above provided that you also do one of the following: a)
Accompany it with the source code; or, b) Accompany it with a written
offer to give any third party the source code; or, c) Accompany it
with the information you received as to the offer to distribute the
source code.
4.1) You may not copy, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy,
sublicense or distribute the Program is void, and will automatically
terminate your rights under this License.
4.2) Parties who have
received copies, or rights, from "you" [means "any licensee", see s.0] under this License will not have
their licenses terminated so long as such parties remain in full
compliance.
5) You are not required to accept this License. However, nothing else grants you permission to distribute
the Program. These actions are prohibited by law if you do not accept
this License. Therefore, by distributing the Program you indicate your
acceptance of this License to do so, and all its terms and conditions
for copying or distributing the Program.
6) Each time you [means "any licensee", see s.0] redistribute the Program, the recipient automatically receives a license from the original licensor to copy or distribute
the Program subject to these terms and conditions. You are not
responsible for enforcing compliance by third parties.
7.1) If, as a consequence of a court judgment or for any other reason [emphasis added], conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot
distribute so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you
may not distribute the Program at all.
7.2) If any portion of this section
is held invalid or unenforceable under any particular circumstance,
the balance of the section is intended to apply and the section as a
whole is intended to apply in other circumstances.
12) In no event unless required by applicable law [emphasis added] will any copyright holder, or any other party who may
redistribute the program as permitted be liable to you for damages,
including any damages arising out of the use or inability to use the
program.
Legal analysis:
Suppose a bona fide member of the public who sees the code and its full and correct GPLv2 information on a website and (not knowing it was illicitly obtained) makes use of it, and then redistributes it as they believe GPLv2 allows them to do.
Note these are slightly out of order to make the argument flow better
- Section 2 is irrelevant (deals with modifications only) and the clause in section 12 "agreed in writing" is plainly irrelevant (they haven't done so).
- The term "copy" would be legally important here. Has the legitimate user "copied" it by merely having it on one or more servers for internal use? Or in context ("copy and distribute") does it refer only to copying in the context of distribution?
That would be important legally, because it determines whether the legitimate user was required to keep the notices with the software when only used internally without plans to distribute, or whether that was also a "copy" and section 2 required them to keep it "as [they] receive[d] it".
- Section 0: the notice on the software, as obtained by the legitimate user, was "placed by the copyright holder". So the license applied to the software that was illicitly taken. The original author voluntarily chose a license that applies to all members of the public, so whether the license inherits or some terms do, in the hands of the bona fide re-user, is down to the rest of GPLv2. The last sentence does not distinguish copying/distribution with or without permission, or even with/without intention, so that's irrelevant.
- Sections 1+3: does not impose any restrictions. On the surface seems to say that anyone may copy or distribute, again without reference to any permission being needed. The only relevant requirement is section 3 which is complied with, so that's not an issue either.
- Section 5: forbids all use and distribution unless user has "accept[ed] the license" and complies with it. The license cannot be accepted if it has not been validly offered. Therefore we need to consider whether anything constitutes a valid offer of license to the bona fide re-user, in law, because if not, "Nothing else grants you permission" and "these actions are prohibited if you do not accept the license" - and you cannot "accept" what has not been offered. I think this is a crucial point.
If the bona fide user [was offered a license and] can legitimately accept the license, then they have the rights in it, so they are safe.
- Section 4.1: mostly irrelevant because s.5 says it all anyway. If the bona fide user [was offered and] accepted a license this allows them to distribute, if they don't then this doesn't apply to them anyway. So the issue above, from section 5, governs and overrides this clause. But 4.1 does underline s.5 and that is crucial too.
- Section 4.2: irrelevant for same reason - if the bona fide user [was offered and] accepted a license then they are "any licensee" (see section 0) so this grants them full permission and they are safe. If they don't have a valid license then under section 5+4.1 they have no rights.
- Section 7.1: seems irrelevant. Any attempt to claim an implied term about legally obtaining the software seems to be overruled by the actual wording of the GPLv2 which governs, the fact that GPLv2 is clearly drafted with a view to widest possible distribution and avoidance of later discovery of inadequate grant, and has no stated need to check validity, and that anything due to earlier illicit activity would not be a "condition imposed [emphasis added] on you". Again, if you could validly accept the license then all is well, if not then everything is forbidden. Section 5+4.1 therefore governs this as well.
- Section 7.2: irrelevant. Nothing seems likely to be affected by this, or likely to be "held invalid or unenforceable" in the context.
- Section 6: This (along with sections 5+4.1) is crucial. It determines when a license is validly created, and therefore how section 5+4.1 will work in the context.
But section 6 starts by saying Each time you [an existing valid licensee] redistribute the Program...".
On the face of it, the illicit taking of the program did not invoke this, because the valid licensee did not actually "distribute" the software to the taker, and cannot be deemed to have done so. It was copied off their server without any implied or actual consent. So therefore they did not actually "distribute" the program, which would be a wilful, deliberate, act of intention and volition (this would be like a thief who enters an open door claiming they were "given" the item by the owner or that it was implicitly "given" because the door was open and the item unprotected) - and in the first instance that is the answer to the question.
Because the valid licensee did not "redistribute" the program, the taker did not "receive a license" under section 6 when they obtained the code, no matter what GPLv2 text was included with it. Because the taker did not have a valid license, they could not validly offer a license to the bona fide user, because in copyright law, offering a license is a right that requires permission from the author, and the only such permission is contained in GPLv2 (which expressly excludes all other sources of permission in s.5+4.1) or through individual consent by the author. They couldn't have accepted GPLv2 because the prerequisite of "distribution" by an existing licensee was absent, and they don't have personal consent of the author. So they have nothing.
By exactly the same reasoning, the taker cannot have offered a license to the bona fide user, so the bona fide user cannot have "accepted" what wasn't offered, either.
They may have a defence of good faith belief in an actual litigation, but that's different - what they do not have is an actual license.
So in the absence of an act of "distribution of a copy" by the valid licensee to the taker, there is no license or other right acquired by the taker, the bona fide re-user, or anyone subsequent.
Section 6 requires an act that legally constitutes, in some form, a "distribution" to the taker, because only then could the taker have "accepted". So it all hinges on whether the valid licensee did something that would be deemed to create a "distribution" of a "copy".
Nothing more is required under GPLv2 than the mere act of "distribution", to create a legally valid license to the recipient. This is the wish of the copyright holder, and the condition under which the valid licensee was allowed to use the software in the first place. So the valid licensees wishes/intentions are irrelevant. If "distribution of a copy" took place, the recipient didn't have to do more than use the software to be deemed to accept it.
The taker might be liable for breach of contract, but the terms of section 6 (and therefore section 5+4.1) would be met, and the act of "distribut[ing] a copy" would have taken place to the taker by the valid licensee, even if they did not mean the taker to do as they did once distributed to (which GPLv2 explicitly says they can).
But that's not the whole story. There are three other issues to consider.
1) Impact of legal meaning of "copy" and "distribute"
If the valid licensee or taker didn't (or couldn't legally have) created a license in law by doing some act that was "distributing a copy" then the "recipient" couldn't "accept" it, so section 6+5 govern as above.
As noted, these are legal terms, and a court would decide if an act of "copying" and/or an act of "distribution" had been undertaken by the valid licensee in any case.
This might, in theory, include copies made internally or automatically. Just by downloading the software from the author's website or placing it on some computer internally might be deemed to be "distributing" or "making a copy".
(For example, child porn images are captured under a law that forbids "distributing" and/or "making a copy" under various UK and US laws even if the "copy" was merely a cached copy in a browser or server cache, or even just temporarily placed in RAM, rather than a deliberate "for actual use" copy. So there is precedent for wide meaning for these terms.)
So if the valid licensee placed a copy of the software on a computer given to an employee for work purposes, or gave an outside party a copy to review, they may be deemed to have "distributed a copy" to that person. That is all that s.6 requires to create a full GPLv2 license to the recipient, and intent to license is not required.
So as stated, intent to license is irrelevant. An act that counts as "distribution" by the valid licensee to the taker is everything.
2) If the illicit taker had in fact acquired that right under GPLv2, in which case....
If the taker could claim there had been an act of distribution, then s.6 would be satisfied, and therefore so would s.5+4.1. In that case the taker, and therefore the bona fide user and anyone subsequent, would indeed be able to claim they had a licence.
This could be deemed to have happened in many "real world" scenarios, as described above. It might happen if, for example, the taker is an in-house employee of the valid licence holder, with permission from the valid license holder to have a copy of the program (for development) or its binary code on their laptop (for business use), or something similar. It could even be that they implicitly "distributed a copy" because the taker is a service agent who manages their system backups, or was given a disk with it on, to be destroyed.
So it hinges on whether the valid licensee had "distributed a copy" in some way to the taker, even if only the binary code, in any way that invokes GPLv2. if so - even if they did not intend further distribution or if it was a breach of contract that the taker did so - then the GPLv2 license chain is satisfied according to s.0+5+4.1+6 (even if the valid licensee did not wish the taker to then pass it to others) -- because that is basically the entire right that GPLv2 is created to enforce: the right of any valid licensee to pass the code to any other person under suitable terms set by the author, and not restricted by previous licensees in the "chain".
3) Validity of section 12's upstream protection:
By the same reasoning as section 6 above, section 12's usual protection would not apply either, to the valid licensee, the taker, the bona fide re-user, or any subsequent user if a valid license didn't exist.
Section 12 protects the "copyright holder" (the author) and "any other party who may redistribute the program as permitted". But as no "distribution" took place by the valid licensee, they aren't within any category protected by section 12's wording. In any case the taker and the bona fide user and anyone subsequent, are not licensees so section 12 doesn't bind them, as they don't have a license agreement containing such a clause (or any license agreement whatsoever).
This might be an unexpected gap in GPLv2. It means that in theory at least, the bona fide user and anyone subsequent would not be excluded by GPLv2 from suing the valid licensee (for example on spurious grounds of "You didn't protect your servers and if you had, I wouldn't have been able to be offered this software and invested £30,000 making a business only to find the license didn't cover me as it should have done").
