26

I was alarmed to see that someone uploaded one of my old GPL'd projects to Github. Github has refused to remove it however, and suggests I contact the uploader who is completely anonymous and cannot be contacted. Even though the GPL allows copying, this is alarming because Microsoft is a malicious company, both now and in the past.

The act of uploading could be used by their corporate lawyers to claim that they can automatically abscond with my copyright.

Or what if Microsoft attempts to give itself rights that are not addressed by the GPL?

Years ago, the "fine print" on Sourceforge literally said that by uploading code you are assigning copyright to them. It was a clear attempt at theft-by-lawyer. All Microsoft has to do is change their fine print for 1 day and they can claim that my code is theirs.

In summary:

  1. Was GitHub correct to reject my takedown request?

  2. Is there any plausible legal theory or strategy by which Microsoft could lay claim to my code/copyright, based on the actions of this anonymous uploader?

110

Your question concerns a case where Author A publishes original work under the GNU GPL, and then Person B uploads it to GitHub. You ask whether it would be possible for the transaction between Person B and GitHub to affect the ownership of copyright title to the work by Author A.

Simply put: no. Person B does not have standing to perform a transfer of title to GitHub, since they don't hold ownership of the copyright title. Therefore, even if Microsoft drafted an agreement that required Person B to transfer copyright title to GitHub/Microsoft, Person B couldn't fulfill their end of such an agreement, even if they erroneously misrepresented their ability to do so. Person B can't under any circumstances sell or give away a copyright for which they do not hold the title. You might as well also worry that Person B will sell the house you own without owning the deed: Person B doesn't hold any property rights for the property in question, and so does not have standing to transfer those rights.

If Microsoft tried to rely on Person B's grant of copyright title to use Author A's work in other software under terms incompatible with the GPL, Author A would have standing to sue for Microsoft's unauthorized distribution of a derivative work. In such a case, it would be Microsoft's responsibility to ensure they didn't infringe copyright, and their misplaced agreement with Person B does not eliminate their liability for infringing Author A's copyright, especially since the work would be marked with Author A's copyright notices rather than notices with Person B's name. Any agreement with Person B affords no legal defense to Microsoft, so if Microsoft had an interest in violating Author A's copyright, it would be much faster and just as (in)valid to use the work illegally outright, without spurious justifications about some unrelated third party.

Corporations use tools like chains of title and contributor licensing agreements when using outside code (including open source software) to mitigate liability that the outside code might include improperly-licensed parts whose author did not license its use. The idea that a corporation might actively seek out or deliberately engineer such risk within their codebase seems nothing sort of an attempt at legal self-destruction.

Person B does have rights under your GPL license grant, but those rights decidedly do not include the ability to transfer title or even to grant a permissive license to Microsoft to use the software outside the conditions of the GPL. However, those rights do include redistribution rights, so Microsoft was correct to decline your DMCA takedown. Generally, anyone who receives software under the GNU GPL may redistribute it however they please*, and those recipients have the right to distribute it further, etc. This definitely allows recipients to post copies of the software to online servers to facilitate further distribution. You gave permission for your software to be redistributed in this way when you licensed it under the GPL.

The GPL FAQ further clarifies that the GPL does not even require a redistributor to notify you (nor does any FLOSS license require this).

In the case of GitHub in particular, there has been some speculation that their terms of service are technically incompatible with the GPL, but even the FSF itself has found the possibility very unlikely. (See Are the new GitHub Terms of service a kiss of death for open source projects?)

All Microsoft has to do is change their fine print for 1 day and they can claim that my code is theirs.

A much more plausible (but still hardly airtight) formulation of the problem would be if Author A directly uploaded the work to a site that did require transfer of copyright title, as you hypothesize in your "1 day" case. If Author A agrees to be bound by such terms of service, then there is at least a glimmer of plausibility that Microsoft could receive copyright title or a permissive license grant. (I still think there could be serious obstacles to a court upholding such a usage agreement, but it is at least plausible.) As the situation actually is, though, Author A has not uploaded their work to GitHub, and Person B (who is not a rights holder of the work in question) cannot even begin to give Microsoft the necessary rights for this scheme to succeed.


* Redistribution is allowed as long as they meet the requirements to preserve the GPL notices/permissions downstream and that any binaries are accompanied by source; see MadHatter's answer as well.

58

APSillers' answer is excellent, but I'd add one thing: although by licensing under the GPL you gave permission to anyone to redistribute your code, you by the same mechanism required that such redistribution be under the relevant version of the GPL. If this github repository isn't clearly GPL'ed, then a copyright violation is occurring, and you as the rightsholder have every right to have this repository taken down.

Whether that's happening in this case we have no hope of saying without knowing the exact repo in question.

  • Just to clarify "every right to have this repository taken down", do you mean that OP could require GitHub to remove it, or the person who posted it? – JBentley Aug 7 at 17:32
  • 3
    @JBentley either, as the OP chooses. GitHub must act promptly on receipt of notification that it's distributing infringing content in order to retain safe harbor status under OCILLA. – MadHatter Aug 7 at 19:16
  • @MadHatter Maybe, maybe not. I know that Microsoft/GitHub will not take any action against projects that are represented as being AGPL but actually have additional licensing terms that are not part of the AGPL. Though that may be because the actual violation is against the copyright of the AGPL itself, so only the FSF can file a formal copyright complaint. – TKK Aug 7 at 21:34
  • 1
    @TKK that is likely because the only people who can issue a meaningful OCILLA takedown notice are the rightsholders (or their designated agents), which in your example is probably not the FSF, but in this case is the OP. Anyone else complaining may lawfully be ignored. – MadHatter Aug 8 at 5:01
43

To address some of the questions in the follow-up edit(s), since the GPL redistribution aspects are well covered by other answers.

For instance, what if Microsoft does something illegal

If someone is going to break the law and steal your code, then they are going to break the law and steal your code. It makes absolutely no difference whether the code is hosted on Github or any other site. Even if the code is only available on your personal website, somebody could download it from there and use it in violation of the open source license, for example by incorporating it into a closed-source project.

Licenses are not magic spells; they don't prevent somebody from using the code in an unlawful way. What they do is give you the ability to take that person to court if they violate your rights (assuming you find out about it).

like assign the copyright of my work to itself, or give itself rights that are not addressed by the GPL?

Microsoft cannot "assign" copyright of your work, nor can Microsoft "give itself rights" to your code, because it is not their copyright to assign in the first place. Only you as the copyright owner can legally assign your copyright to somebody else, and only you can choose to grant rights to other people through the choice of an open-source license.

If Microsoft were to claim rights to your code which you hadn't granted (either individually to Microsoft, or generally to everybody via the GPL) then they would be making a false claim and possibly breaking the law, at which point they could be sued or prosecuted depending on exactly what they did and which legal jurisdiction they did it in.

The act of uploading could be used by their corporate lawyers to claim that they can automatically abscond with my copyright.

No they could not, because even if Github had a clause requiring copyright assignment (which it doesn't), the person who uploaded your code to Github was not the copyright owner (you), and therefore had no authority to assign copyright to Microsoft. Unless Microsoft's corporate lawyers are shockingly incompetent, they are not going to make such a clearly false claim.

All Microsoft has to do is change their fine print for 1 day and they can claim that my code is theirs.

It doesn't work like that. Changing the terms on their website doesn't magically seize ownership of all code that is currently hosted on that site. If Microsoft did wish to change the terms of Github to require copyright assignment (which I'm 100% sure they will never do, because nobody would use it on these terms and the site would be dead in a heartbeat), the change would only apply to code that was uploaded after the new terms were put into effect, and would require explicit agreement by the copyright holder at the point where they uploaded the code. This would mean that Microsoft would probably need to delete all existing projects (including yours) that did not agree to copyright re-assignment.

Summary

Regardless of how you may personally feel about Microsoft, your concerns are unwarranted. Your code does not become vulnerable to some kind of "copyright seizure" simply by being on Github, because there is no such concept.

The only rights Microsoft have to your code is the rights you have chosen to grant via releasing the code as GPL. If you did not want them to have those rights, you shouldn't have released it as GPL in the first place.

  • 1
    "then they would be making a false claim and possibly breaking the law" Yes, but if someone used the code in a closed-source software, you'll never know that they broke the law. – Tobias Knauss Aug 6 at 17:49
  • 1
    @TobiasKnauss Not necessarily true. High level code compiles to patterns that can be detected. It just requires using all versions of a compiler to generate the patterns. Furthermore assembly language code assembles to the same specific patterns. – user15474 Aug 7 at 16:27
  • 1
    @derik If you were the one who uploaded the code to github, perhaps it would be theoretically possible, but it is dubious. Github TOS only affect its users, changing it still would not allow them to demand to be given rights from people who can't give those rights in the first place. – Pablo Aug 8 at 7:59
  • 3
    @derik If you have asked a lawyer and know something not covered in the answers here, feel free to provide your own answer. Self-answering questions is not only allowed but encouraged. – Polygnome Aug 8 at 8:00
  • 1
    @derik - I've read a lot of absurd claims in software TOS and license agreements, e.g. "The copyright of anything created with this tool automatically falls to us." and "We can stop providing the service [you paid for in advance] at any time without stating a reason. Your only legal remedy is to stop using the service." This is jsut not how the law works. They're merely speculating that some poorly informed users will take it at face value and not insist on their rights. There's little difference between MS writing "we now own your code" in their TOS or on their christmas wishlist. – Ruther Rendommeleigh Aug 8 at 9:13
17

Short answer: Probably not a violation.

Long answer (using the relevant part from GPL - since you did not specify the version):

You may copy and distribute verbatim copies of the Program's source code as you receive it, in any medium, provided that you conspicuously and appropriately publish on each copy an appropriate copyright notice and disclaimer of warranty; keep intact all the notices that refer to this General Public License and to the absence of any warranty; and give any other recipients of the Program a copy of this General Public License along with the Program.

Did the uploader comply with the requirements above? Then it is not a copyright/license violation.

For the (new) second part of the question (which was added after this answer was posted) I can only refer to apsillers' excellent answer. (In short: No, there isn't any plausible legal way for them to do that)

  • 3
    There is no "probably" here. Your quoted paragraph is straight from GPL v1. The current v3 contains the same (with different wording and some extensions, none of which restrict the right to copy and distribute). OP does not mention anything about missing copyright notices, but is clearly asking about the simple fact that someone published the GPLed code on github. – AnoE Aug 7 at 8:46
  • @AnoE Agreed with you that there is no violation if the upload was done in compliance with the license (the highly likely scenario in my mind). But - since OP did not give additional details - there is the (miniscule) chance that the uploader did not include e.g. the copyright notice, which would violate the licensing terms. Thus I felt the need to include the "probably" in my short answer; there are enough details to make an educated guess, but (at least for me) not enough to be 100% certain – CharonX Aug 9 at 7:34
4

The ability to redistribute the source code code (to a site like GitHub) is a fundamental aspect of the GNU/GPL licence. If you wish to prevent someone from doing this, then perhaps releasing the project / code under a different licence would be worth while.

  • 1
    That wasn't really my question. Please read it more closely. – user15474 Aug 7 at 22:00
  • 1
    @derik Your question was "If someone else uploads my GPL'd code to Github without my permission, is that a copyright violation?" and you opened by saying you were "alarmed to see" that this had occurred. This answer addresses both parts. The first sentence tells you (by implication) that it is not a copyright violation. The second sentence implies that you don't have a justification to be alarmed, because you made the choice to use GPL and therefore authorised this kind of scenario. I therefore think this is a perfectly valid answer to your question. – JBentley Aug 7 at 22:21
  • That wasn't really my question. Please read it more closely. – user15474 Aug 7 at 22:23
  • @derik You do realise that I directly copy and pasted from your question, right? You can't claim it isn't your question when it is exactly what you wrote, word for word. – JBentley Aug 8 at 0:19
  • 1
    @derik if you feel it's been edited away from what you were asking, you should edit it back! If you choose to let the edits stand, you can't be upset at people who answer it as-is. (Note: I see you've edited it, good for you, though I fear the anti-MS ranty bits may yet get removed again.) – MadHatter Aug 8 at 5:04
4

The question title now reads, "do they not put [my code] at risk of being stolen by Microsoft?", and nobody has yet addressed that part of the question since all the previous answers were written when the question title was, "is that a copyright violation?" So I'll try to address the new part of the question.

No, Microsoft won't steal your code, because they would not benefit from doing so.

Let's assume for now that you're completely correct in characterizing Microsoft as a malicious company, who would steal code in violation of its license if they could get away with it. GitHub is a site used by millions of coders each day, many of whom are extremely cautious about legal terms and read them carefully. If GitHub's terms of service changed to, say, assign copyright to Microsoft, even for a few hours, people would notice. There would be news stories about it all over the Internet, and lots of people would be contacting their lawyers. Pretty soon there would be a class-action lawsuit going; you might not think that a single individual can afford to sue a big company with deep pockets, but that's exactly the situation that class-action lawsuits are designed for. (Class-action lawsuits can also be abused as a lawyer-enrichment mechanism, but that's a topic for a different Stack Exchange site and not on-topic here). If Microsoft were to change the GitHub terms of service to claim rights they're not actually entitled to, they'd be facing copyright lawsuits from thousands and thousands of people, with statutory damages of up to $150,000 per case (17 U.S.C. § 504(c)(2)) since it would be easy to prove intentional infringment in such a case. That adds up to billions of dollars, far more than Microsoft would gain from such a move.

Now, maybe your GPL'ed project is something that Microsoft could make trillions of dollars by stealing, but I doubt it. Most open-source projects are small, limited in purpose, and not all that valuable in objective terms. So the cost of the lawsuits Microsoft would face would far outweigh the money they would make by stealing GitHub-hosted code with an illegal ToS change.

So even if we grant the premises of your question (that Microsoft is malicious and will steal anything they can get away with), they would lose more than they would gain, so they won't do it.

  • Your assume Microsoft isn't a copyright troll. You assume the courts don't side with big corporations. You assume techies noticed when Sourceforge did the same stealing trick in their ToS. They didn't. – user15474 Aug 9 at 15:50
  • 3
    On the "courts don't side with big corporations" part of your comment — look up the McDonald's hot coffee verdict. Look at how many corporations settle out of court when sued because they don't want to go to court where they think they might lose. The actual interactions of the courts are actually quite interesting once you read them, and you might learn a thing or two about how the law actually functions in practice, as opposed to in theory. – rmunn Aug 9 at 19:43
4

Something I want to note is the GPL aspect of this question: If someone uploads your code to GitHub, and GitHub does not have terms of use that contradict the GPL, that someone is perfectly entitled - and indeed, licensed by you, to do so. GitHub are also licensed to further redistribute the code, as long as they are not in violation of the license.

That is, you cannot prevent someone giving a copy of your code to Microsoft even if you believe they are malicious, whether or not they are malicious, while simultaneously licensing it under the GPL, as long as that redistributor is acting within the license. You could even say that the GPL is explicitly designed to permit redistribution to and by all sorts of entities without regard to their general level of malice, as long as they do not act in violation of the license.


Other answers such as InfiniteDissent's one address the key points about licenses and terms of use not being magic spells. I would, however, like to add a few points.

First if a site were to require granting of rights you'd rather not, and then you agree to those terms and use the site, you have in fact granted those rights yourself, as outlined in the agreement you accepted when using the service. This does also mean that anyone who is not the copyright holder would be violating copyright when uploading works to such a service. Indeed, requiring worldwide perpetual non-exclusive licenses to redistribute, perform, display, sublicense (etc.) is a relatively common practise on a lot of websites, and probably millions of people commit minor copyright breaches in this manner every day.

Second, a site having such a clause in its terms of use without it being particularly called upon might seem underhanded, but is not by any means forbidden or illegal - the terms of use are at least ostensibly a legally binding contract that you are expected to read and that you indicate you have agreed to. What I want to note, though, is that this is materially different from Microsoft "changing their fine print for 1 day", for several reasons.

  • If Microsoft were to change the GitHub terms of use without a 30 day notice, they would be in breach of the current terms which require such public notice
  • They would have to make the wording retroactive for it to be retroactive, and even this would not automatically grant them new rights - and indeed, they almost certainly know that such an action would place them under immense legal liability by turning both themselves and a sizable amount of their users into copyright violators
  • Even if they did not have the 30 day notice requirement, they could not do such a change discreetly, without notice, "for one day". As said, contracts, licenses and such are not magic spells - unilateral amendments to a contract are generally not enforceable without "reasonable notice". If they did not tell their users that the terms had changed, and then changed them back, it would simply seem like they were trying to claim that their terms of use had a clause it could easily be observed it did not
  • Even if they somehow managed to completely unnoticed make everyone grant them such rights, and then they tried knowingly fraudulently enforcing those rights, they would likely do so by means of lawsuit, and a court of law would be relatively likely to find that they were indeed making a fraudulent copyright claim

Finally, even if you think Microsoft is a malicious entity out to steal your copyright, ultimately as a publicly traded corporation it seems quite unlikely that they would take such actions in full public view, destroying an "open source credibility" they have recently been building, as well as making a product (GitHub) completely unfit for the purpose they bought it for (at a price of $7.5 billion US dollars). That is, the people who control the corporation probably wouldn't sink over seven billion dollars down the drain for what appears to be no or minimal gain.

  • It is strange that you think a company will behave ethically just because it is publicly traded. Do you live in a bubble? – user15474 Aug 9 at 15:53
  • 1
    @derik I don't read anything about ethics in this answer. (What language here is ethics-related in your reading?) I see only an explanation of how such a strategy to underhandedly acquire copyright of submissions would permanently destroy their credibility as a a player in the open source community, which would put them at a massive practical disadvantage. – apsillers Aug 9 at 16:30
  • That's correct; I believe they think the github product and userbase is worth more than seven billion dollars, because that's what they paid for it. You don't need to consider ethics when weighing whether to throw seven billion dollars away for no reason or not, though hopefully you would. It's a matter of legal liability and huge amounts of money, which are things the owners will definitely care about because it directly effects the value of their investment. – user10186512 Aug 10 at 16:19
3

No, they can copy or fork your whole code into a new GPLed project, or copy or any parts of your code into other GPLed projects, and distribute it however they like.

I'm assuming that copyright notices remain intact on this copy of your project. Other answers cover the possible copyright violations if that wasn't the case.

I think the only possible offense here is plagiarism, if they claim to have written it. That's a separate thing from copyright violation.

To simplify, let's consider another case: I publish a book of plays and poems. I put my name on it. But the works inside are word-for-word copies of Shakespeare, whose name doesn't appear anywhere. The work is in the public domain so there's no copyright claim to be made, but I've committed a new offense by claiming to have written them. (This is a kind of fraud against society, as well as or instead of against Shakespeare.)

This may not actually be a crime, I'm not sure. But if the project doesn't credit you, that's probably why you're feeling offended even though (from what you've said) there's no sign of a copyright violation.

See also https://en.wikipedia.org/wiki/Moral_rights for more about the moral rights of authors to get credit for their work, regardless of copyright law. Some countries even have legislation supporting that.

2

Possibly. The GPL requires distribution of build scripts and so forth. If source code only was uploaded and this was not sufficient to build the system then the licence conditions have not been met, so there would be no permission to distribute the source code.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy