33

Let's say some company is developing a software component licensed under GPLv2. The company never intends to release the software to the public because they are only installing it on their internal servers, which are not exposed to people outside of the company. Hence, the software is never "distributed" in the conventional GPLv2 sense (notice I am not referring to the AGPL here).

What would happen if an intruder hacked into the company, found the software, and exposed it to the public? Would the public be allowed to accept the terms of the GPLv2 and use, modify, and distribute the software in compliance the terms and conditions outlined by the GPLv2?

2
  • 1
    I don't think that in practice a company would develop a GPL software without intending any distribution or publication. Choosing a GPL license for a software in a professional setting is a very active choice (you'll need to convince your company's managers and lawyers). It does not happen by chance. So I think your question is a complete fiction and never happens in practice. Once the GPL license is internally accepted, it is the interest of the developer and of the project to actively publish the code (e.g. on github...) even if the software is alpha-stage Nov 24, 2017 at 6:06
  • 2
    What might happen is a company changing an existing GPL project, adapting that software to its needs, and running that adapted code internally. But that makes a very different question. When a manager accepts to use GPL code he knows the legal consequences. Read the GPL FAQ Nov 24, 2017 at 6:11

5 Answers 5

47

The Free Software Foundation thinks not. From the GPL FAQ:

If someone steals a CD containing a version of a GPL-covered program, does the GPL give the thief the right to redistribute that version?

If the version has been released elsewhere, then the thief probably does have the right to make copies and redistribute them under the GPL, but if the thief is imprisoned for stealing the CD, they may have to wait until their release before doing so.

If the version in question is unpublished and considered by a company to be its trade secret, then publishing it may be a violation of trade secret law, depending on other circumstances. The GPL does not change that. If the company tried to release its version and still treat it as a trade secret, that would violate the GPL, but if the company hasn't released this version, no such violation has occurred.

So, in other words, the FSF believes that you can redistribute stolen software if it was already published, but (probably) not if it was an unpublished trade secret.

In the comments, Federico Poloni quite correctly points out that the FSF could be mistaken. They wrote the license and employ quite a few lawyers who are well versed in copyright law generally and the GPL in particular, so they are probably in at least as good a position to answer this question as anyone else. But only a court can determine the answer to this question with absolute certainty (and then only with respect to a particular jurisdiction). To my knowledge no such case has yet arisen.

6
  • 1
    Excellent find, and facepalm on me for not looking there first!
    – airfishey
    Nov 21, 2017 at 23:28
  • 9
    Note, though, that "what the FSF believes" does not necessarily coincide with the law. The only binding source is the text of the license. Nov 22, 2017 at 13:34
  • 1
    Also, the questioner is asking about software that included GPL code, but other in-house code and had never been "distributed" in terms of the license. IE, I break into your house, adn steal your computer, which contains code you've written that is modifying or including GPL code, but you've never uploaded it, etc. Do I have a right to that code? No.
    – ivanivan
    Nov 22, 2017 at 23:57
  • Note also that this doesn't answer the question as asked. The FSF's position starts "If the version has been released elsewhere", but the question stipulates "The company never intends to release the software to the public". Copyleft redistribution of something that is unquestionably already available under GPL, albeit elsewhere, is arguably not the same thing as theft of something that someone has one day suggested will be so available. The FSF clearly thinks so, anyway.
    – MadHatter
    Jan 5, 2018 at 8:34
  • @MadHatter: Please read the last paragraph of the block quote again.
    – Kevin
    Jan 5, 2018 at 13:58
34

The usual caveat: IANAL/IANYL. That said, a statement of intent is not usually considered a binding undertaking, and stolen goods are stolen goods.

A licence does not inhere in software, it is associated with it through the act of conveyance (as defined in GNU GPL v3). One receives a piece of code under GPLv3, or MIT, or CDDL, or whatever licence it is conveyed under, and thereafter the recipient of that copy is bound by those obligations.

If it were not so, then the same program could not be conveyed by its copyright holder to different individuals under different licence terms, as happens with (eg ) MySQL.

So the GPL is not associated with that software until it is lawfully conveyed, with the blessing of the copyright holder, and that has not happened in this case. The software is stolen goods, pure and simple, and you should not have a copy if you can avoid it. Even less should you be thinking of modifying and propagating further copies.

Edit: David Schwarz is making an interesting argument in the comments that is a bit long for a comments field, so I address it here. If I understand aright, he claims that a licence must inhere in software because otherwise you could not e.g. bind and permit the recipient of GPLed software to themselves be obliged, when they convey it, to convey it under GPL.

I am unpersuaded. When I buy a house, I am obliged to pay the previous owner a sum of money in order to possess the house lawfully. This requirement is not inherent in the house, otherwise (inter alia) a given house would have only one price, at which it would be exchanged until demolished. The requirement is instead solely in the conveyance of the house: as part of this conveyance, I agree to give the seller a certain amount of money on a certain date, and (s)he agrees to let me take freehold possession of the house, usually on that same date. An open-ended forward requirement can form part of this, eg I can undertake never to paint the house pink, and to require a similar consideration of any future purchasers.

My contention is that the GPL functions similarly: when I convey the software to you, you agree to be bound by certain conditions (one of which is to perform further conveyances under GPL) in exchange for certain considerations (in brief, the four freedoms). There is a complication in that unlike a house purchase it's not a contractual arrangement between two parties, it's a licence offered to anyone who wants to accept it. But the nature of your acceptance is made very clear in both GPLs (v2 s5, v3 s9), and it is through this acceptance that you take on board the obligations. I repeat my assertion that licences do not inhere in software any more than prices inhere in houses; you acquire the obligation (redistribution must be under GPLv3, must pay Mrs. Smith £100,000 on 25th inst.) by accepting the licence or the contract.

I note a claim in comments that US law explicitly forbids permission to relicense open-endedly, but no authority is quoted, which makes it hard to comment upon. Also, I'm in England and Wales.

17
  • This is not what the GPL says, "You must cause any work that you distribute or publish, that in whole or in part contains or is derived from the Program or any part thereof, to be licensed as a whole at no charge to all third parties under the terms of this License." (Emphasis added.) This is from GPLv2, but GPLv2 is even more explicit. And it can't be right as a matter of US law for reasons that don't quite fit into this comment. Nov 22, 2017 at 6:53
  • 3
    @DavidSchwartz I think the key in your quotation is actually "that you distribute or publish": in this case the script was neither distributed nor published, but stolen. Nov 22, 2017 at 7:22
  • 1
    @DavidSchwartz I would certainly agree with that, as I hope my original answer makes clear: stolen goods are stolen goods.
    – MadHatter
    Nov 22, 2017 at 11:57
  • 1
    Re: "when I convey the software to you, you agree to be bound by certain conditions": I'm no lawyer but as I've heard it, you don't agree to anything just by receiving software under the GPL. My understanding is that, basically, the GPL only kicks in once you try to redistribute the software - an act which is normally prohibited under US law, but can be permitted by contractual agreement. Receiving a piece of code under the GPL entails making such an agreement. Is that consistent with what your answer is meant to say? If so, I think the phrase I quoted could be improved a bit.
    – David Z
    Nov 22, 2017 at 12:23
  • 1
    @DavidSchwartz: IANAL but my understanding is that the license "inheres" in the copy of the work that you have. If you obtain a byte-by-byte copy of the software with a different license, then that license would inhere in that copy of the work. Now it may be impossible for anyone to prove which copy came from where, and it may be moot to a court in cases where you have multiple copies that are indistinguishable, but legally speaking that is the interpretation that makes sense to me. The license is not a function of the bytes, but a function of the particular copy of the bytes you have.
    – user541686
    Nov 23, 2017 at 12:17
16

I think the problem here is at a more fundamental level than the GPL.

The GPL does not force you to publish your code under the GPL. It is still the right of the copyright holder to decide whether the software shall be published at all. But if the software is published, it can only be under the GPL.

The intruder never lawfully obtained a license to the GPL program, therefore they are unable to distribute it under the GPL. While the source code may have the GPL license attached, it was never published under that license.

The GPLv2 does not address this point explicitly, since in this scenario local laws would likely take precedence over provisions in the GPL. In contrast, the GPLv2 allows you to “distribute verbatim copies of the Program's source code as you receive it, in any medium”. But my take is that the license would not have taken effect and such terms would be inapplicable.

The GPLv2 section 4 is:

You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this License. However, parties who have received copies, or rights, from you under this License will not have their licenses terminated so long as such parties remain in full compliance.

This protects downstream license recipients from having their license terminated if an intermediary violates the license, e.g. starts distributing the software in a non-compliant way. But in this scenario, the intruder never received a valid license and therefore never had the ability to issue licenses to downstream recipients. I would therefore assume that any use of the stolen software would be a copyright violation, regardless of the GPL.

8
  • Let's thing a step further: Thief A steals the software and redistributes it to B. B is unaware that A stole it and has not the right to redistribute it, so B redistributes it to C. Thus, A violates the license, but do B and C the same?
    – glglgl
    Nov 22, 2017 at 8:21
  • 3
    I would say yes, but unknowingly. The law generally takes intent into account (not including strict liability offences), so their good-faith redistribution, while not lawful, would be unlikely to attract much punishment if discovered. However, the law also takes reasonableness into account; if B knew that A was no coder but instead an accomplished industrial spy, B's wide-eyed acceptance of A's offer of a large but previously-unpublished professional program's source under GPL might be viewed askance.
    – MadHatter
    Nov 22, 2017 at 9:02
  • 2
    @MadHatter:_Criminal_ law takes intent into account, but civil law isn't about punishment. The copyright owner can still go after B, and claim damages. B might in turn sue A, of course.
    – MSalters
    Nov 22, 2017 at 12:02
  • 1
    How would unpublished software be licensed under the GPL unless a license file bundled in one of the usual places with the files would be considered a valid license? Also, GPLv2 explicitly does not make any claims to unpublished derivate works, no? Nov 22, 2017 at 15:15
  • 5
    @rackandboneman That unpublished code is not governed by the GPL is my exact point. A possible scenario is: I clone a GPL software and make extensive modifications in exercise of my GPL rights. I am the copyright holder of those changes, and therefore have the right to decide whether to publish them. I am still bound by the GPL in that if I were to publish my changes, I could only do that under the GPL. So there's a GPL license file next to my changes on my personal storage, but I never published my changes under that license. At that point the GPL only applies to software without my changes.
    – amon
    Nov 22, 2017 at 15:37
3

It would be confidential information (and probably a trade secret too) and protectable on that basis - GPLv2 or no GPLv2.

The remedy against the thief is known as a springboard injunction whether the confidentiality had been lost or not by the exposure to the public.

Also, once the members of the public that had obtained a copy from the thief or through the thief (ie an intermediary) had been notified that it was confidential information, they'd be in the firing line as well.

Just because it was exposed to the public as you say doesn't necessary result in a loss of confidentiality (in UK law at least). There's not enough information in your question to tell.

I'd add that any licence in this case is probably tainted - permission under the GPLv2 isn't given by the copyright owner. No copyright owners (the company that developed it) gave the licence contemplated by GPLv2, because it didn't distribute it in the first place. The thief did.

3
  • 2
    Is there any particular reason for using scare quotes around "licence"?
    – MadHatter
    Oct 2, 2019 at 9:50
  • It's not a licence unless the copyright owner grants it. The thief doesn't have title to grant the ... "licence". You could substitute "The licence under the GPL v 02 isn't granted because the permission under the GPL v02 isn't given by the copyright owner." for the words "I'd add the GPL v02 "licence" is probably "tainted" - the basis of the permission under the GPL v02 isn't given by the copyright owner." Think purported licence.
    – lellis
    Oct 4, 2019 at 9:50
  • 1
    Thanks, that makes good sense. Now I think I see what you're getting at, I've tidied up the English to avoid possible misunderstandings. I hope that's OK; feel free to revert it if not.
    – MadHatter
    Oct 4, 2019 at 9:59
-2

The answer is, no right exists, unless an act of "distribution of a copy" took place by the valid licensee to the taker. But that could quite possibly have happened in many situations.

Analysis follows (Note IANAL).

Full relevant text of GPLv2:

Note: I've removed anything related to side-issues such as modification, and split sections 4 and 7 into sub-points for ease

0) This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License. Each licensee is addressed as "you". Activities other than copying, distribution and modification are not covered by this License; they are outside its scope.

1) You may copy and distribute verbatim copies of the Program's source code as you receive it, provided that you give any other recipients of the Program a copy of this License.

3) You may copy and distribute the Program under the terms of Section 1 above provided that you also do one of the following: a) Accompany it with the source code; or, b) Accompany it with a written offer to give any third party the source code; or, c) Accompany it with the information you received as to the offer to distribute the source code.

4.1) You may not copy, sublicense, or distribute the Program except as expressly provided under this License. Any attempt otherwise to copy, sublicense or distribute the Program is void, and will automatically terminate your rights under this License.

4.2) Parties who have received copies, or rights, from "you" [means "any licensee", see s.0] under this License will not have their licenses terminated so long as such parties remain in full compliance.

5) You are not required to accept this License. However, nothing else grants you permission to distribute the Program. These actions are prohibited by law if you do not accept this License. Therefore, by distributing the Program you indicate your acceptance of this License to do so, and all its terms and conditions for copying or distributing the Program.

6) Each time you [means "any licensee", see s.0] redistribute the Program, the recipient automatically receives a license from the original licensor to copy or distribute the Program subject to these terms and conditions. You are not responsible for enforcing compliance by third parties.

7.1) If, as a consequence of a court judgment or for any other reason [emphasis added], conditions are imposed on you (whether by court order, agreement or otherwise) that contradict the conditions of this License, they do not excuse you from the conditions of this License. If you cannot distribute so as to satisfy simultaneously your obligations under this License and any other pertinent obligations, then as a consequence you may not distribute the Program at all.

7.2) If any portion of this section is held invalid or unenforceable under any particular circumstance, the balance of the section is intended to apply and the section as a whole is intended to apply in other circumstances.

12) In no event unless required by applicable law [emphasis added] will any copyright holder, or any other party who may redistribute the program as permitted be liable to you for damages, including any damages arising out of the use or inability to use the program.

Legal analysis:

Suppose a bona fide member of the public who sees the code and its full and correct GPLv2 information on a website and (not knowing it was illicitly obtained) makes use of it, and then redistributes it as they believe GPLv2 allows them to do.

Note these are slightly out of order to make the argument flow better

  • Section 2 is irrelevant (deals with modifications only) and the clause in section 12 "agreed in writing" is plainly irrelevant (they haven't done so).
  • The term "copy" would be legally important here. Has the legitimate user "copied" it by merely having it on one or more servers for internal use? Or in context ("copy and distribute") does it refer only to copying in the context of distribution?
    That would be important legally, because it determines whether the legitimate user was required to keep the notices with the software when only used internally without plans to distribute, or whether that was also a "copy" and section 2 required them to keep it "as [they] receive[d] it".
  • Section 0: the notice on the software, as obtained by the legitimate user, was "placed by the copyright holder". So the license applied to the software that was illicitly taken. The original author voluntarily chose a license that applies to all members of the public, so whether the license inherits or some terms do, in the hands of the bona fide re-user, is down to the rest of GPLv2. The last sentence does not distinguish copying/distribution with or without permission, or even with/without intention, so that's irrelevant.
  • Sections 1+3: does not impose any restrictions. On the surface seems to say that anyone may copy or distribute, again without reference to any permission being needed. The only relevant requirement is section 3 which is complied with, so that's not an issue either.
  • Section 5: forbids all use and distribution unless user has "accept[ed] the license" and complies with it. The license cannot be accepted if it has not been validly offered. Therefore we need to consider whether anything constitutes a valid offer of license to the bona fide re-user, in law, because if not, "Nothing else grants you permission" and "these actions are prohibited if you do not accept the license" - and you cannot "accept" what has not been offered. I think this is a crucial point.
    If the bona fide user [was offered a license and] can legitimately accept the license, then they have the rights in it, so they are safe.
  • Section 4.1: mostly irrelevant because s.5 says it all anyway. If the bona fide user [was offered and] accepted a license this allows them to distribute, if they don't then this doesn't apply to them anyway. So the issue above, from section 5, governs and overrides this clause. But 4.1 does underline s.5 and that is crucial too.
  • Section 4.2: irrelevant for same reason - if the bona fide user [was offered and] accepted a license then they are "any licensee" (see section 0) so this grants them full permission and they are safe. If they don't have a valid license then under section 5+4.1 they have no rights.
  • Section 7.1: seems irrelevant. Any attempt to claim an implied term about legally obtaining the software seems to be overruled by the actual wording of the GPLv2 which governs, the fact that GPLv2 is clearly drafted with a view to widest possible distribution and avoidance of later discovery of inadequate grant, and has no stated need to check validity, and that anything due to earlier illicit activity would not be a "condition imposed [emphasis added] on you". Again, if you could validly accept the license then all is well, if not then everything is forbidden. Section 5+4.1 therefore governs this as well.
  • Section 7.2: irrelevant. Nothing seems likely to be affected by this, or likely to be "held invalid or unenforceable" in the context.
  • Section 6: This (along with sections 5+4.1) is crucial. It determines when a license is validly created, and therefore how section 5+4.1 will work in the context.
    But section 6 starts by saying Each time you [an existing valid licensee] redistribute the Program...".
    On the face of it, the illicit taking of the program did not invoke this, because the valid licensee did not actually "distribute" the software to the taker, and cannot be deemed to have done so. It was copied off their server without any implied or actual consent. So therefore they did not actually "distribute" the program, which would be a wilful, deliberate, act of intention and volition (this would be like a thief who enters an open door claiming they were "given" the item by the owner or that it was implicitly "given" because the door was open and the item unprotected) - and in the first instance that is the answer to the question.
    Because the valid licensee did not "redistribute" the program, the taker did not "receive a license" under section 6 when they obtained the code, no matter what GPLv2 text was included with it. Because the taker did not have a valid license, they could not validly offer a license to the bona fide user, because in copyright law, offering a license is a right that requires permission from the author, and the only such permission is contained in GPLv2 (which expressly excludes all other sources of permission in s.5+4.1) or through individual consent by the author. They couldn't have accepted GPLv2 because the prerequisite of "distribution" by an existing licensee was absent, and they don't have personal consent of the author. So they have nothing.
    By exactly the same reasoning, the taker cannot have offered a license to the bona fide user, so the bona fide user cannot have "accepted" what wasn't offered, either.
    They may have a defence of good faith belief in an actual litigation, but that's different - what they do not have is an actual license.

So in the absence of an act of "distribution of a copy" by the valid licensee to the taker, there is no license or other right acquired by the taker, the bona fide re-user, or anyone subsequent.

Section 6 requires an act that legally constitutes, in some form, a "distribution" to the taker, because only then could the taker have "accepted". So it all hinges on whether the valid licensee did something that would be deemed to create a "distribution" of a "copy".

Nothing more is required under GPLv2 than the mere act of "distribution", to create a legally valid license to the recipient. This is the wish of the copyright holder, and the condition under which the valid licensee was allowed to use the software in the first place. So the valid licensees wishes/intentions are irrelevant. If "distribution of a copy" took place, the recipient didn't have to do more than use the software to be deemed to accept it.

The taker might be liable for breach of contract, but the terms of section 6 (and therefore section 5+4.1) would be met, and the act of "distribut[ing] a copy" would have taken place to the taker by the valid licensee, even if they did not mean the taker to do as they did once distributed to (which GPLv2 explicitly says they can).

But that's not the whole story. There are three other issues to consider.

1) Impact of legal meaning of "copy" and "distribute"

If the valid licensee or taker didn't (or couldn't legally have) created a license in law by doing some act that was "distributing a copy" then the "recipient" couldn't "accept" it, so section 6+5 govern as above.

As noted, these are legal terms, and a court would decide if an act of "copying" and/or an act of "distribution" had been undertaken by the valid licensee in any case.

This might, in theory, include copies made internally or automatically. Just by downloading the software from the author's website or placing it on some computer internally might be deemed to be "distributing" or "making a copy".

(For example, child porn images are captured under a law that forbids "distributing" and/or "making a copy" under various UK and US laws even if the "copy" was merely a cached copy in a browser or server cache, or even just temporarily placed in RAM, rather than a deliberate "for actual use" copy. So there is precedent for wide meaning for these terms.)

So if the valid licensee placed a copy of the software on a computer given to an employee for work purposes, or gave an outside party a copy to review, they may be deemed to have "distributed a copy" to that person. That is all that s.6 requires to create a full GPLv2 license to the recipient, and intent to license is not required.

So as stated, intent to license is irrelevant. An act that counts as "distribution" by the valid licensee to the taker is everything.

2) If the illicit taker had in fact acquired that right under GPLv2, in which case....

If the taker could claim there had been an act of distribution, then s.6 would be satisfied, and therefore so would s.5+4.1. In that case the taker, and therefore the bona fide user and anyone subsequent, would indeed be able to claim they had a licence.

This could be deemed to have happened in many "real world" scenarios, as described above. It might happen if, for example, the taker is an in-house employee of the valid licence holder, with permission from the valid license holder to have a copy of the program (for development) or its binary code on their laptop (for business use), or something similar. It could even be that they implicitly "distributed a copy" because the taker is a service agent who manages their system backups, or was given a disk with it on, to be destroyed.

So it hinges on whether the valid licensee had "distributed a copy" in some way to the taker, even if only the binary code, in any way that invokes GPLv2. if so - even if they did not intend further distribution or if it was a breach of contract that the taker did so - then the GPLv2 license chain is satisfied according to s.0+5+4.1+6 (even if the valid licensee did not wish the taker to then pass it to others) -- because that is basically the entire right that GPLv2 is created to enforce: the right of any valid licensee to pass the code to any other person under suitable terms set by the author, and not restricted by previous licensees in the "chain".

3) Validity of section 12's upstream protection:

By the same reasoning as section 6 above, section 12's usual protection would not apply either, to the valid licensee, the taker, the bona fide re-user, or any subsequent user if a valid license didn't exist.

Section 12 protects the "copyright holder" (the author) and "any other party who may redistribute the program as permitted". But as no "distribution" took place by the valid licensee, they aren't within any category protected by section 12's wording. In any case the taker and the bona fide user and anyone subsequent, are not licensees so section 12 doesn't bind them, as they don't have a license agreement containing such a clause (or any license agreement whatsoever).

This might be an unexpected gap in GPLv2. It means that in theory at least, the bona fide user and anyone subsequent would not be excluded by GPLv2 from suing the valid licensee (for example on spurious grounds of "You didn't protect your servers and if you had, I wouldn't have been able to be offered this software and invested £30,000 making a business only to find the license didn't cover me as it should have done").

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.