For client side code, even if it is obfuscated or is just a binary, I can imagine there might be ways of doing this, but if I have some server-side AGPL licensed code, how am I supposed to know that the copyright is not being infringed by someone else? Put differently, if someone is running/selling a service and I suspect that it is using my AGPL licensed code, how could I ever be sure of this?

up vote 5 down vote accepted

TL;DR: You don't detect one. You hypothesize one based on circumstantial evidence, and then start negotiation and/or legal action.

Regardless of the license -- this issue applies equally to all OSS licenses except the most liberal -- it can be hard, and in some circumstances, impossible to figure out who is infringing your license in a server-side service. Instead, you gather circumstantial evidence until you have a solid case, and then contact an attorney.

The first hard part is knowing who to suspect of violations in the first place. The primary reasons for you to investigate a site would be (a) downloads and/or forks by people from that company, and (b) staff and/or customers saying things in social media to indicate that they may be running a modified version of your software.

Once you have a suspect, then the next step is to gather technical evidence. Depending on the nature of your software and the potential violator's service, this could consist of:

  • remarks by employees, ex-employees, contractors and/or customers who have seen the code;
  • any exposed code, such as Javascript or Protobufs;
  • API analysis of any public APIs

For example, with a fully public API, you could map all of the API calls and demonstrate that they are identical to the API calls of your software with a few extensions and/or small modifications. Be wary doing this in some jurisdictions, though, lest you run afoul of anti-hacking laws.

Once you have what you feel is sufficient evidence, the next step is to engage an attorney to query the potential violator. While most such violations are innocent (i.e. some developer injected your code without telling their boss), and can be settled with a code release, removal, and/or payment, some end in court and you want to be on solid legal footing from your first interaction.

  • 2
    Civil lawsuits have phases that include discovery (where you can request documents from the other party) and depositions (where you can ask questions of the other party) and ultimately you should win if you can show it's more likely than not that they infringed. – David Schwartz Oct 24 at 22:09

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.