I have an embedded Linux device. The company that developed and produced this device is now defunct, having been sold to Flex Ltd. When this acquisition occurred, it seems that the employees signed non-disclosure agreements about every aspect of their company (the one that was being sold).

The original company never released any GPL code for their product like they should have (they did list off the open source libraries used by the smartphone app that went along with the product, so they knew about this kind of obligation) and I didn't get involved with this until after they were sold. My question is, given that the original company was fully operational less than three years ago, both selling the product with GPL code and hosting firmware updates containing GPL code for that product; is the new owner Flex legally obliged to give me the GPL code if I request if from them?

Note that I'm asking another question about this body of code here.

  • You already asked this on opensource.stackexchange.com/questions/7366/… If you have more details about it, such as the fact that the original company has now been sold to another company, it is better to edit and include it in your original question. The same clarification needs to be made in this case -- Did the original device come with a Written Offer of the source code? And you also need to clarify which GPL version is involved; better to do the clarifications on one question though. – Brandin Sep 24 at 5:51
  • 12
    FWIW, @Brandin, I disagree. The two questions may arise from the same life situation, but they're different, albeit related. I don't like single SE postings that ask about eight different questions, so I personally appreciate that Billy has teased the two issues into two postings. I have cross-linked them, to try to minimise duplication of effort, and hopefully this makes things a bit clearer. – MadHatter Sep 24 at 6:54
  • Does the new company offer any customer support for the product? – curiousdannii Sep 24 at 13:47
  • @curiousdannii No, the new company has not even said anywhere that they made the acquisition, let alone selling more units of the product or providing customer support; I only know because the former employees and investors mentioned it. – Billy Sep 24 at 14:02
  • @Billy The GPL does not obligate them to provide service or customer support. Actually the GPL does not even obligate them to provide the source code with the product, as long as they supplied a Written Offer for the source along with the written materials of the product. – Brandin Sep 25 at 5:17
up vote 20 down vote accepted

Legal issues can be very jurisdictionally-dependent, and of course IANAL/IANYL, but the issue seems to me to relate to the circumstances of sale. If the original company was bought as a going concern, then its obligations transfer with its assets to the new owner. If it was bought from the official receiver (or local equivalent) after going into receivership, things are more complex.

Let's assume the former, in which case to my mind the new company has the obligations of the old. The big problem here is that those obligations aren't to you, but to the copyright holder(s) of the original code. When the company took GPL code written by (let's say) Alice, modified and redistributed it, they were either doing so under the terms of the GPL, or they were breaching Alice's copyright power to control the distribution of derivative works. If this company fails to hand over source code when asked, it's not you they've offended, it's Alice.

So let's assume you ask the company for the code, and it doesn't hand it over. If you're considering legal action, the issues that engage you are known as third-party distribution rights, and specific performance. The former relates to whether anyone other than Alice has standing to sue for breach of obligation, and the latter to whether a court has the power to order anything other than an award of cash damages, for example to order the company to hand over all the source code.

This was all very well covered in a talk at FOSDEM 2018, which (at the risk of tooting my own horn a bit) I summarised in an article for LWN. Three lawyers from different jurisdictions (US, UK, EU) considered these very issues, and the results are covered near the end of the article (and of the talk). What it boils down to is that, at the very least, it's complex, and that is very bad news for you: if you're going to sue someone, you really don't want to be forging new paths through the law to do so.

To my mind, your best option is to see if any of the umbrella rights organisations like the Software Freedom Conservancy currently has standing to pursue these issues for any of the code you're interested in, and if so, join them and try to engage them in pursuing this company.

  • Thanks for the answer. I'll try privately requesting the source code, and if they don't give it to me I'll report them to the Software Freedom Conservancy (they're responsible for most of the GPL software I've found in the device's firmware). – Billy Sep 24 at 12:07
  • 1
    @Billy That should be a last resort. Once you do that, any chance of an easy resolution is gone. – Terry Carmen Sep 24 at 20:28
  • 1
    @TerryCarmen Good to know. I'll wait a few weeks to see if I get a response and if not try sending another letter before I report them. – Billy Sep 24 at 20:44
  • 2
    Just a FWIW, Email someone technical, not their legal department and ask nicely, not using legal terms. If you ask a programmer or manager you'll probably get what you want. If you ask their legal department, or use legal sounding words, you'll get probably a chance to hire a lawyer. – Terry Carmen Sep 24 at 20:46
  • 1
    @TerryCarmen I don't think "probably" is the right word to describe an (IMO) very slim chance. If someone from outside asks me to send them some of my company's IP, no matter how politely, I'll most likely refuse and refer them to our legal department. – Dmitry Grigoryev Sep 25 at 8:04

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.