For client side code, even if it is obfuscated or is just a binary, I can imagine there might be ways of doing this, but if I have some server-side AGPL licensed code, how am I supposed to know that the copyright is not being infringed by someone else? Put differently, if someone is running/selling a service and I suspect that it is using my AGPL licensed code, how could I ever be sure of this?
Do you have access to interact with the software provided by the suspected infringer?– BrandinOct 16, 2018 at 11:44
2Very closely related: AGPL v3 licensing: How does external party determine if modifications were made?– apsillers ♦Oct 16, 2018 at 15:23
I would argue that this question is a duplicate of the other question, effectively. However, i'm going to take a stab at it because the other answer has more factors.– Josh BerkusOct 23, 2018 at 16:41
TL;DR: You don't detect one. You hypothesize one based on circumstantial evidence, and then start negotiation and/or legal action.
Regardless of the license -- this issue applies equally to all OSS licenses except the most liberal -- it can be hard, and in some circumstances, impossible to figure out who is infringing your license in a server-side service. Instead, you gather circumstantial evidence until you have a solid case, and then contact an attorney.
The first hard part is knowing who to suspect of violations in the first place. The primary reasons for you to investigate a site would be (a) downloads and/or forks by people from that company, and (b) staff and/or customers saying things in social media to indicate that they may be running a modified version of your software.
Once you have a suspect, then the next step is to gather technical evidence. Depending on the nature of your software and the potential violator's service, this could consist of:
- remarks by employees, ex-employees, contractors and/or customers who have seen the code;
- API analysis of any public APIs
For example, with a fully public API, you could map all of the API calls and demonstrate that they are identical to the API calls of your software with a few extensions and/or small modifications. Be wary doing this in some jurisdictions, though, lest you run afoul of anti-hacking laws.
Once you have what you feel is sufficient evidence, the next step is to engage an attorney to query the potential violator. While most such violations are innocent (i.e. some developer injected your code without telling their boss), and can be settled with a code release, removal, and/or payment, some end in court and you want to be on solid legal footing from your first interaction.
2Civil lawsuits have phases that include discovery (where you can request documents from the other party) and depositions (where you can ask questions of the other party) and ultimately you should win if you can show it's more likely than not that they infringed. Oct 24, 2018 at 22:09