How to enforce CC-BY in data generated by a program, if I open-source that program as well?

Question

I'm running a data journalism operation, and as part of our business, we generate a lot of datasets. We're fine with these datasets being used by just about everyone, as long as they give us credit. So we're licensing them under CC-BY 4.0.

However, we also want to publish the source code that generated these datasets, so that people can spot bugs and keep us accountable. And since we can't copyright the output of a program, I wonder if this would essentially nullify the CC-BY protection of our data, since people could just download our R scripts, generate the data for themselves, and call it their own.

I can see two solutions:

• Maybe I do in fact hold copyright over the data anyway, even if it can be independently generated by others through open-source code. I wonder what international law might have to say about this (I'm outside the United States).

• Alternatively, I could publish the source code under a proprietary license that restricts users' right to use the software or its output. I'm thinking something along the lines of applying GPL-like terms to non-commercial use; and stripping commercial users (i.e. news organizations who may want to copy our work without attribution) of the right to run the software.

Does that sound right? Is there another option I'm not seeing?

Answer 1

There is a concept called database right. I am not sure whether this would apply in your case though - the idea behind database rights is to protect investment in creating the database, but if a user of your program creates the database by running it, you haven't invested anything into creating the database itself (for example, the user running the program bears the electricity costs to operate the computer that runs the program).

Note also that the wikipedia page says:

On the other hand, any lawful user of the database has a right under regulation 19(1) "to extract or re-use insubstantial parts of the data for any purpose", and that right cannot be restricted by the database owner (regulation 19(2)).

This answer says data is not generally copyrightable.

I imagine there are ways for other organizations to use this dataset without explicitly crediting you if they really want to. Depending on how malicious you think your competitors are (or said differently, if attribution is part of your/their culture and how much you think they would honor the attribution request) simply requesting attribution in all references to the code and data may be sufficient to get it.

Similarly, if a competing news organization uses a small piece of data that is "yours", they may not consider that worthy of mentioning you as their competitor even if technically you could legally require such a thing. (There is a parallel to this in software licensing as well, where a tiny fragment of code is often considered not copyrightable.)

Answer 2

That's a tricky question and a good question - and I'm not sure there is one solution which will work under all circumstances. I can share a (probably legally-not-too-sound) procedure for similar cases which I see in my environment being employed.

In scientific context consider someone wrote a programme which allows to simulate to allow to gain insight in processes depending on assumptions accessible as input parameters or easily and slightly modified code.

This is IMHO similar to your case where you also have an analysis programme and you use it to work on data - but the outcome is different depending on what you search for / filter for / how you aggregate the data.

In these cases I often find a note in the source code (which often is GPL, MIT - licensed or similar) which gives a suggestion on how to reference the original authors' contribution to the work for all work which relies on this programme being used for independent analysis. Usually this is given in form of a reference paper / article being cited which describes the method.

This method only works when people work with good intent and follow good scientific behaviour - it does not prevent legally malitious intent and makes it hard to legally enforce the attribution in cases you describe.

As an additional note: Mind that an re-implementation of your analysis programme would be considered a derivative of your programme, so that it needs proper attribution. However for open-source licenses that does not solve your problem with reference when data are being generated. With an OSI license you can only ask for that.

Answer 3

And since we can't copyright the output of a program, I wonder if this would essentially nullify the CC-BY protection of our data, since people could just download our R scripts, generate the data for themselves, and call it their own.

I am not sure of the claim "we can't copyright the output of a program"

Have you asked your lawyer about that claim?

I am not a lawyer

But I do know a lot of programs whose output can and is copyrighted.

A compiler produces an executable, and in some legal systems, that file is or can be protected by copyright laws. For example, both GCC and Clang or the Linux kernel are open source (millions of lines of code), and they are mostly written by developers paid for that work.

A transpiler such as Chicken Scheme produces C files, and you need these C files to build it since Chicken Scheme is a bootstrapped compiler from Scheme to C. In the chicken-5.2.0 tarball, the chicken-5.2.0/chicken.process.signal.import.c file is obviously generated, since its start with:

 /* Generated from chicken.process.signal.import.scm by the CHICKEN compiler
    http://www.call-cc.org
    Version 5.2.0 (rev 317468e4)
    linux-unix-gnu-x86-64 [ 64bit dload ptables ]
    command line: chicken.process.signal.import.scm -optimize-level 2 -include-path . -include-path ./ -inline -ignore-repository -feature chicken-bootstrap -no-warnings -specialize -consult-types-file ./types.db -feature chicken-compile-shared -dynamic -no-trace -output-file chicken.process.signal.import.c
    uses: library eval expand
 */
 #include "chicken.h"

My Bismon project produces C code and requires the previously produced C code to be built. The generated C files contain a copyright notice. My past GCC MELT project did generate C++ code (from some Lisp dialect) and kept copyright notices in them.

The RefPerSys project is generating C++ files with a copyright notice.

The GNU bison parser generator is generating C files with a copyright notice. The GNU emacs editor is writing files and can be (and usually is) used to edit its own code.

The ocaml compiler is distributed with binary bytecode files generated by ocaml. You won't be able to build Ocaml from sources without these generated files.

Most Linux relational databases (sqlite, PostgreSQL) can dump their content as *.sql textual files. With an easy sed(1) script you can prepend a copyright notice to these files.

Text formatters like LaTeX or Lout (both are open source programs) are routinely used to produce PDF files with a copyright on them, and the copyright on the produced output is unrelated to the copyright on these LaTeX or Lout software.

The CAIA system by the late J.Pitrat generates all its C code (about 500KLOC in 3834 C source files and 5976 small binary data files, generated in an hour of computer time), and is copyrighted and GPLv3+ licensed. Typical generated C code (I just reformatted it) looks like:

  #include "dx.h"
  void
  SPC0 (void)
  /* Copyright (C) 2000-2012 Jacques Pitrat

  This generated file SPC0.c is part of CAIA.  

  CAIA is free software: you can redistribute it and/or modify it under
  the terms of the GNU General Public License as published by the Free
  Software Foundation, either version 3 of the License, or (at your
  option) any later version.  CAIA is distributed in the hope that it
  will be useful, but WITHOUT ANY WARRANTY; without even the implied
  warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See
  the GNU General Public License for more details.  You should have
  received a copy of the GNU General Public License along with CAIA.  If
  not, see <http://www.gnu.org/licenses/>. */
  {
    int V1 = 0;
    int I, X;
    int J;

    I = pile[v[22]];
    X = pile[v[22] + 1];
    v[22] += 3;
    V1 = I + 1;
    c[v[1]][I] = X;
    J = V1;
    v[22] -= 3;
    pile[v[22] + 2] = J;
    return;
  }

Of course, you can write your own Quine program (by definition they are outputting their own source code when being run) which generates a copyright notice.

You could study the copyright notices related to the LinuxFromScratch project. Many Linux distributions (e.g. Debian or Ubuntu) are self-building: with a big enough computer and weeks of your time, you can produce their *.iso image, redistributable on various media (e.g. as LiveCD....)

Of course, copyright laws are different in France (where I live and work) and in the USA. Some French lawyers at work (one of them being an author of the CeCILL license) did told me that generated output at work can be copyrighted.

Your application might be a web service (under GPLv3), with your business model being IaaS. You would sell the access to the data, and publish its "specification" as open format. Read a lot more about open data, and the Big Other: Surveillance Capitalism and the Prospects of an Information Civilization and Simple Economics of Open Source papers.

Read also more about code obfuscation techniques.

Is there another option I'm not seeing?

Yes, using a code obfuscator. I don't say it is a good idea.

You might apply them to your program (e.g. redistribute some "obfuscated" variant of your source code). If your code is written in standard C11 and compiled by a recent GCC - e.g. GCC 10, writing your own GCC plugin which obfuscate your code is a matter of a few months of work. So (assuming you are legally allowed to do that) you could obfuscate all your source code and publish only its obfuscated variant.

Be however aware that it is likely that your program won't be used much, even if you open source it.

And most open source programs, even non-obfuscated, are rarely used. Most large open source programs (such as GCC or the Linux kernel - I am using Linux since 1993, and probably have used less than half of its source code lines - think of the countless drivers for hardware I never seen) have lots of code which is rarely used....

Philosophically and ethically, and for the FSF, obfuscated source code is not really source code anymore, but if you own it you could redistribute only an obfuscated variant. Legally obfuscated source code can obtain copyright protection.

^{(I spent 20 years of my career in writing professionally open source programs -funded, perhaps indirectly, by the European Union or the French Republic - that have in practice never been used, with the exception of my past contributions to GCC. Most open source code produced by computer science academics is almost never used in real life: most programming languages implementations have very few users outside of academia: did you ever use a program coded with Agda or GCC MELT? How many persons have you met using that programming language? But its implementation is open-source and developed by paid more or less academics)}

How to enforce CC-BY in data generated by a program

By going to court when that data is mis-used. You'll have to pay a lawyer (or be one).