Declaring copyright anonymously

Question

I want to release some software anonymously.

My first idea was to release it to the public domain, but I have found out that it is not a safe practice due to incompatibilities with the legislation of some countries.

After some research I concluded that the license I need is ISC. Its problem is that it needs a copyright holder and I do not want to publish my full name.

Is there a way to hold a copyright anonymously?

Mathematically, attributing the copyright to base64(sha3_256(<my real name> | <long secret nonce>)) is as strong as putting my real name directly.

Will it be enough in on a court?

EDIT

Due to the confusion generated, I clarify that the algorithm base64(sha256(<my real name> | <long secret nonce>)) means the base64 encoding of the result of applying SHA-256 hash to the concatenation of my name and a long enough (256 bits) secret random nonce.

Because SHA-256 is prone to length extension attacks, I will replace it with the safer SHA3-256 for extra safety.

Answer 1

You are free to publish works anonymously. This case is well-covered by international copyright laws (e.g. Art 7 (3) of the Berne Convention). Publishing anonymously is largely equivalent to publishing pseudonymously, except that the identity of a pseudonymous person is known. For example, what I publish here under the name "amon" is pseudonymous and keeps all my rights as if I had published under my real name. In contrast, the inventor of Bitcoin “Satoshi Nakamoto” has used a pseudonym with unknown identity, and is therefore (still?) anonymous.

Unfortunately anonymous works are a legal headache for users. The work is still copyright-protected like any other work. In most jurisdiction the copyright term ends 70 (or 50) years after the death of the author. For anonymous works the author is not known, and the term ends 70 (or 50) years after publication. However, the author may be identified later. If you (or later copyright holders such as your heirs) claim the copyright before it is expired, then the life + 70 years term applies again. A related problem are orphan works where the copyright holder is not known, therefore the copyright term cannot be calculated reliably.

So if you don't want to exercise your copyright it is best to actively disclaim copyright to the fullest extent possible, i.e. dedicate the work to the public domain and issue a fallback license for jurisdiction where this is not possible. The CC-0 is the best available legal instrument for that purpose.

You could in principle also use a MIT-style license such as the ISC which keeps the copyright intact. The copyright notice doesn't have to hold your real name, using "anonymous" should be fine. Compared to CC-0 users are required to keep the notice, which may actually be desirable as it becomes less likely that the work becomes an orphaned work. There ISC also includes a disclaimer which the CC-0 lacks. Of course trying to hold an anonymous author of a public domain work liable for anything is a bit silly, but you may still enjoy the minimal legal protection of a disclaimer.

Your idea of using a hash of your identity would allow you to publish anonymously, and would allow you to claim the copyright of the anonymous work later. However, this is not necessary for publishing anonymously, and only makes sense if you do plan to disclose your identity later. If you have published anonymously under the CC-0 you will already have disclaimed your copyright to the fullest extent possible, so disclosing your identity would have minimal value.

Answer 2

For copyright law, there is no difference between an anonymous copyright holder and a copyright holder who operates under a pseudonym that is not known to be related to a particular person.

This means that you don't have to use your real name in the copyright statement, but you can just use "user3368561" or "anonymous" instead.

The hash you proposed will probably also be accepted as a pseudonym, but I don't see the point in going to that length unless you expect that you will need to break anonymity at some point in the future and that would usually be over a lawsuit regarding copyright infringement.

Answer 3

I agree with another answer that a pseudonymous work is covered under copyright equally as an anonymous work. Furthermore, your proposed system will probably allow you to prove to a court your identity as the original author, if you later decide to come forward to enforce your copyright.

However, I'll add that if you really don't want the ISC license, because it requires preserving a copyright notice, you might controversially consider the CC0 license, which both

1. commits your work to the public domain where applicable, and
2. licenses your work under an ultra-permissive license (which does not carry attribution requirements) in jurisdictions where you cannot fully commit your work to the public domain.

These two features in tandem ensure there is no copyright difficulty for others using your work. However, CC0 explicitly does not grant patent rights to any patented systems embodied in your code, so users may be wary of reusing it out of fear that you might silently hold a patent on some system that your code implements, putting them at risk for patent infringement. That doesn't appear to be the case from your question, but the point is that recipients of the code have no way to be sure of that.

For this reason, I don't actually recommend CC0, but offer it as a possibility if you object strongly to requiring a pseudonymous copyright notice and few sentences of licensing information. If you have no such objection, or that objection does not outweigh the perception of secret-patent risk CC0 would cast onto recipients, I recommend pseudonymous use of the ISC license.͏͏͏͏͏

Answer 4

I have very recently addressed the issue of anonymous and pseudonymous copyright here, so I won't go over that ground again. The advice being given here about CC0 seems good to me, so I won't comment on that, either.

What I will do is warn you against rolling your own crypto, as it never ends well. In this case, you propose to identify yourself with a hash which is sha256(name|nonce) (I'm leaving out the base64 as it's just a shortening exercise). Should you ever need to prove your ownership, you will produce name and nonce, to show that the ORed result sha256s to give your hash.

Problem is, once you've done that, it's trivial to produce another name with a different nonce that gives the same result. So as soon as you've proved ownership you're open to any number of challengers each of whom has proof of ownership equal to yours, and who need only claim that they didn't know the ownership was in question until they (eg) saw your proof in the papers, and realised you had stolen their name and nonce and that it was time for them, the true owner, to come forward. This will be difficult to disprove.

Instead, as I do in the linked answer, consider generating a custom gpg keypair, and using it to sign the pseudonymous declaration. Your distributed software should include a copy of the public key. You can at a later time prove ownership of the private key without compromising it.