How do I detect an AGPL violation?

Question

For client side code, even if it is obfuscated or is just a binary, I can imagine there might be ways of doing this, but if I have some server-side AGPL licensed code, how am I supposed to know that the copyright is not being infringed by someone else? Put differently, if someone is running/selling a service and I suspect that it is using my AGPL licensed code, how could I ever be sure of this?

Answer 1

TL;DR: You don't detect one. You hypothesize one based on circumstantial evidence, and then start negotiation and/or legal action.

Regardless of the license -- this issue applies equally to all OSS licenses except the most liberal -- it can be hard, and in some circumstances, impossible to figure out who is infringing your license in a server-side service. Instead, you gather circumstantial evidence until you have a solid case, and then contact an attorney.

The first hard part is knowing who to suspect of violations in the first place. The primary reasons for you to investigate a site would be (a) downloads and/or forks by people from that company, and (b) staff and/or customers saying things in social media to indicate that they may be running a modified version of your software.

Once you have a suspect, then the next step is to gather technical evidence. Depending on the nature of your software and the potential violator's service, this could consist of:

• remarks by employees, ex-employees, contractors and/or customers who have seen the code;
• any exposed code, such as Javascript or Protobufs;
• API analysis of any public APIs

For example, with a fully public API, you could map all of the API calls and demonstrate that they are identical to the API calls of your software with a few extensions and/or small modifications. Be wary doing this in some jurisdictions, though, lest you run afoul of anti-hacking laws.

Once you have what you feel is sufficient evidence, the next step is to engage an attorney to query the potential violator. While most such violations are innocent (i.e. some developer injected your code without telling their boss), and can be settled with a code release, removal, and/or payment, some end in court and you want to be on solid legal footing from your first interaction.