If someone else uploads my GPL'd code to Github without my permission, do they not put it at risk of being stolen by Microsoft?

Question

I was alarmed to see that someone uploaded one of my old GPL'd projects to Github. Github has refused to remove it however, and suggests I contact the uploader who is completely anonymous and cannot be contacted. Even though the GPL allows copying, this is alarming because Microsoft is a malicious company, both now and in the past.

The act of uploading could be used by their corporate lawyers to claim that they can automatically abscond with my copyright.

Or what if Microsoft attempts to give itself rights that are not addressed by the GPL?

Years ago, the "fine print" on Sourceforge literally said that by uploading code you are assigning copyright to them. It was a clear attempt at theft-by-lawyer. All Microsoft has to do is change their fine print for 1 day and they can claim that my code is theirs.

In summary:

1. Was GitHub correct to reject my takedown request?

2. Is there any plausible legal theory or strategy by which Microsoft could lay claim to my code/copyright, based on the actions of this anonymous uploader?

Answer 1

Your question concerns a case where Author A publishes original work under the GNU GPL, and then Person B uploads it to GitHub. You ask whether it would be possible for the transaction between Person B and GitHub to affect the ownership of copyright title to the work by Author A.

Simply put: no. Person B does not have standing to perform a transfer of title to GitHub, since they don't hold ownership of the copyright title. Therefore, even if Microsoft drafted an agreement that required Person B to transfer copyright title to GitHub/Microsoft, Person B couldn't fulfill their end of such an agreement, even if they erroneously misrepresented their ability to do so. Person B can't under any circumstances sell or give away a copyright for which they do not hold the title. You might as well also worry that Person B will sell the house you own without owning the deed: Person B doesn't hold any property rights for the property in question, and so does not have standing to transfer those rights.

If Microsoft tried to rely on Person B's grant of copyright title to use Author A's work in other software under terms incompatible with the GPL, Author A would have standing to sue for Microsoft's unauthorized distribution of a derivative work. In such a case, it would be Microsoft's responsibility to ensure they didn't infringe copyright, and their misplaced agreement with Person B does not eliminate their liability for infringing Author A's copyright, especially since the work would be marked with Author A's copyright notices rather than notices with Person B's name. Any agreement with Person B affords no legal defense to Microsoft, so if Microsoft had an interest in violating Author A's copyright, it would be much faster and just as (in)valid to use the work illegally outright, without spurious justifications about some unrelated third party.

Corporations use tools like chains of title and contributor licensing agreements when using outside code (including open source software) to mitigate liability that the outside code might include improperly-licensed parts whose author did not license its use. The idea that a corporation might actively seek out or deliberately engineer such risk within their codebase seems nothing sort of an attempt at legal self-destruction.

Person B does have rights under your GPL license grant, but those rights decidedly do not include the ability to transfer title or even to grant a permissive license to Microsoft to use the software outside the conditions of the GPL. However, those rights do include redistribution rights, so Microsoft was correct to decline your DMCA takedown. Generally, anyone who receives software under the GNU GPL may redistribute it however they please^*, and those recipients have the right to distribute it further, etc. This definitely allows recipients to post copies of the software to online servers to facilitate further distribution. You gave permission for your software to be redistributed in this way when you licensed it under the GPL.

The GPL FAQ further clarifies that the GPL does not even require a redistributor to notify you (nor does any FLOSS license require this).

In the case of GitHub in particular, there has been some speculation that their terms of service are technically incompatible with the GPL, but even the FSF itself has found the possibility very unlikely. (See Are the new GitHub Terms of service a kiss of death for open source projects?)

All Microsoft has to do is change their fine print for 1 day and they can claim that my code is theirs.

A much more plausible (but still hardly airtight) formulation of the problem would be if Author A directly uploaded the work to a site that did require transfer of copyright title, as you hypothesize in your "1 day" case. If Author A agrees to be bound by such terms of service, then there is at least a glimmer of plausibility that Microsoft could receive copyright title or a permissive license grant. (I still think there could be serious obstacles to a court upholding such a usage agreement, but it is at least plausible.) As the situation actually is, though, Author A has not uploaded their work to GitHub, and Person B (who is not a rights holder of the work in question) cannot even begin to give Microsoft the necessary rights for this scheme to succeed.

---

^* Redistribution is allowed as long as they meet the requirements to preserve the GPL notices/permissions downstream and that any binaries are accompanied by source; see MadHatter's answer as well.

Answer 2

APSillers' answer is excellent, but I'd add one thing: although by licensing under the GPL you gave permission to anyone to redistribute your code, you by the same mechanism required that such redistribution be under the relevant version of the GPL. If this github repository isn't clearly GPL'ed, then a copyright violation is occurring, and you as the rightsholder have every right to have this repository taken down.

Whether that's happening in this case we have no hope of saying without knowing the exact repo in question.

Answer 3

To address some of the questions in the follow-up edit(s), since the GPL redistribution aspects are well covered by other answers.

For instance, what if Microsoft does something illegal

If someone is going to break the law and steal your code, then they are going to break the law and steal your code. It makes absolutely no difference whether the code is hosted on Github or any other site. Even if the code is only available on your personal website, somebody could download it from there and use it in violation of the open source license, for example by incorporating it into a closed-source project.

Licenses are not magic spells; they don't prevent somebody from using the code in an unlawful way. What they do is give you the ability to take that person to court if they violate your rights (assuming you find out about it).

like assign the copyright of my work to itself, or give itself rights that are not addressed by the GPL?

Microsoft cannot "assign" copyright of your work, nor can Microsoft "give itself rights" to your code, because it is not their copyright to assign in the first place. Only you as the copyright owner can legally assign your copyright to somebody else, and only you can choose to grant rights to other people through the choice of an open-source license.

If Microsoft were to claim rights to your code which you hadn't granted (either individually to Microsoft, or generally to everybody via the GPL) then they would be making a false claim and possibly breaking the law, at which point they could be sued or prosecuted depending on exactly what they did and which legal jurisdiction they did it in.

The act of uploading could be used by their corporate lawyers to claim that they can automatically abscond with my copyright.

No they could not, because even if Github had a clause requiring copyright assignment (which it doesn't), the person who uploaded your code to Github was not the copyright owner (you), and therefore had no authority to assign copyright to Microsoft. Unless Microsoft's corporate lawyers are shockingly incompetent, they are not going to make such a clearly false claim.

All Microsoft has to do is change their fine print for 1 day and they can claim that my code is theirs.

It doesn't work like that. Changing the terms on their website doesn't magically seize ownership of all code that is currently hosted on that site. If Microsoft did wish to change the terms of Github to require copyright assignment (which I'm 100% sure they will never do, because nobody would use it on these terms and the site would be dead in a heartbeat), the change would only apply to code that was uploaded after the new terms were put into effect, and would require explicit agreement by the copyright holder at the point where they uploaded the code. This would mean that Microsoft would probably need to delete all existing projects (including yours) that did not agree to copyright re-assignment.

Summary

Regardless of how you may personally feel about Microsoft, your concerns are unwarranted. Your code does not become vulnerable to some kind of "copyright seizure" simply by being on Github, because there is no such concept.

The only rights Microsoft have to your code is the rights you have chosen to grant via releasing the code as GPL. If you did not want them to have those rights, you shouldn't have released it as GPL in the first place.

Answer 4

Short answer: Probably not a violation.

Long answer (using the relevant part from GPL - since you did not specify the version):

You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this General Public License and to the absence of any warranty; and give any other recipients of the Program a copy of this General Public License along with the Program.

Did the uploader comply with the requirements above? Then it is not a copyright/license violation.

For the (new) second part of the question (which was added after this answer was posted) I can only refer to apsillers' excellent answer. (In short: No, there isn't any plausible legal way for them to do that)

Answer 5

The ability to redistribute the source code code (to a site like GitHub) is a fundamental aspect of the GNU/GPL licence. If you wish to prevent someone from doing this, then perhaps releasing the project / code under a different licence would be worth while.

Answer 6

The question title now reads, "do they not put [my code] at risk of being stolen by Microsoft?", and nobody has yet addressed that part of the question since all the previous answers were written when the question title was, "is that a copyright violation?" So I'll try to address the new part of the question.

No, Microsoft won't steal your code, because they would not benefit from doing so.

Let's assume for now that you're completely correct in characterizing Microsoft as a malicious company, who would steal code in violation of its license if they could get away with it. GitHub is a site used by millions of coders each day, many of whom are extremely cautious about legal terms and read them carefully. If GitHub's terms of service changed to, say, assign copyright to Microsoft, even for a few hours, people would notice. There would be news stories about it all over the Internet, and lots of people would be contacting their lawyers. Pretty soon there would be a class-action lawsuit going; you might not think that a single individual can afford to sue a big company with deep pockets, but that's exactly the situation that class-action lawsuits are designed for. (Class-action lawsuits can also be abused as a lawyer-enrichment mechanism, but that's a topic for a different Stack Exchange site and not on-topic here). If Microsoft were to change the GitHub terms of service to claim rights they're not actually entitled to, they'd be facing copyright lawsuits from thousands and thousands of people, with statutory damages of up to $150,000 per case (17 U.S.C. § 504(c)(2)) since it would be easy to prove intentional infringment in such a case. That adds up to billions of dollars, far more than Microsoft would gain from such a move.

Now, maybe your GPL'ed project is something that Microsoft could make trillions of dollars by stealing, but I doubt it. Most open-source projects are small, limited in purpose, and not all that valuable in objective terms. So the cost of the lawsuits Microsoft would face would far outweigh the money they would make by stealing GitHub-hosted code with an illegal ToS change.

So even if we grant the premises of your question (that Microsoft is malicious and will steal anything they can get away with), they would lose more than they would gain, so they won't do it.

Answer 7

Something I want to note is the GPL aspect of this question: If someone uploads your code to GitHub, and GitHub does not have terms of use that contradict the GPL, that someone is perfectly entitled - and indeed, licensed by you, to do so. GitHub are also licensed to further redistribute the code, as long as they are not in violation of the license.

That is, you cannot prevent someone giving a copy of your code to Microsoft even if you believe they are malicious, whether or not they are malicious, while simultaneously licensing it under the GPL, as long as that redistributor is acting within the license. You could even say that the GPL is explicitly designed to permit redistribution to and by all sorts of entities without regard to their general level of malice, as long as they do not act in violation of the license.

---

Other answers such as InfiniteDissent's one address the key points about licenses and terms of use not being magic spells. I would, however, like to add a few points.

First if a site were to require granting of rights you'd rather not, and then you agree to those terms and use the site, you have in fact granted those rights yourself, as outlined in the agreement you accepted when using the service. This does also mean that anyone who is not the copyright holder would be violating copyright when uploading works to such a service. Indeed, requiring worldwide perpetual non-exclusive licenses to redistribute, perform, display, sublicense (etc.) is a relatively common practise on a lot of websites, and probably millions of people commit minor copyright breaches in this manner every day.

Second, a site having such a clause in its terms of use without it being particularly called upon might seem underhanded, but is not by any means forbidden or illegal - the terms of use are at least ostensibly a legally binding contract that you are expected to read and that you indicate you have agreed to. What I want to note, though, is that this is materially different from Microsoft "changing their fine print for 1 day", for several reasons.

• If Microsoft were to change the GitHub terms of use without a 30 day notice, they would be in breach of the current terms which require such public notice
• They would have to make the wording retroactive for it to be retroactive, and even this would not automatically grant them new rights - and indeed, they almost certainly know that such an action would place them under immense legal liability by turning both themselves and a sizable amount of their users into copyright violators
• Even if they did not have the 30 day notice requirement, they could not do such a change discreetly, without notice, "for one day". As said, contracts, licenses and such are not magic spells - unilateral amendments to a contract are generally not enforceable without "reasonable notice". If they did not tell their users that the terms had changed, and then changed them back, it would simply seem like they were trying to claim that their terms of use had a clause it could easily be observed it did not
• Even if they somehow managed to completely unnoticed make everyone grant them such rights, and then they tried knowingly fraudulently enforcing those rights, they would likely do so by means of lawsuit, and a court of law would be relatively likely to find that they were indeed making a fraudulent copyright claim

Finally, even if you think Microsoft is a malicious entity out to steal your copyright, ultimately as a publicly traded corporation it seems quite unlikely that they would take such actions in full public view, destroying an "open source credibility" they have recently been building, as well as making a product (GitHub) completely unfit for the purpose they bought it for (at a price of $7.5 billion US dollars). That is, the people who control the corporation probably wouldn't sink over seven billion dollars down the drain for what appears to be no or minimal gain.

Answer 8

No, they can copy or fork your whole code into a new GPLed project, or copy or any parts of your code into other GPLed projects, and distribute it however they like.

I'm assuming that copyright notices remain intact on this copy of your project. Other answers cover the possible copyright violations if that wasn't the case.

I think the only possible offense here is plagiarism, if they claim to have written it. That's a separate thing from copyright violation.

To simplify, let's consider another case: I publish a book of plays and poems. I put my name on it. But the works inside are word-for-word copies of Shakespeare, whose name doesn't appear anywhere. The work is in the public domain so there's no copyright claim to be made, but I've committed a new offense by claiming to have written them. (This is a kind of fraud against society, as well as or instead of against Shakespeare.)

This may not actually be a crime, I'm not sure. But if the project doesn't credit you, that's probably why you're feeling offended even though (from what you've said) there's no sign of a copyright violation.

See also https://en.wikipedia.org/wiki/Moral_rights for more about the moral rights of authors to get credit for their work, regardless of copyright law. Some countries even have legislation supporting that.

Answer 9

Possibly. The GPL requires distribution of build scripts and so forth. If source code only was uploaded and this was not sufficient to build the system then the licence conditions have not been met, so there would be no permission to distribute the source code.