Contributing as a company

Question

At my employer we use open source software in our products. Eventually it came to the point that someone in the company fixed an issue in an oss library (a performance thing, not a big deal but important for the way we use the library). According to the license it wasn't necessary to contribute this modification, however we like to contribute it: we benefit from the use of this library and we want to give something back and - not that altruistic but also important - we don't want to apply the same patch again and again when new upstream versions of the library arrive.

Management now has the idea to contribute via a more or less anonymous - or at least: not personal - company account, something like "[email protected]", of course with the real company name but without the name of the individual developer. Management wants to avoid insights into company internals by this approach.

When discussing this topic with our legal department we came to the conclusion that this would actually be a nessecary approach: the employee gives by her or his contract the rights on her or his work to the employer - the written code is owned by the employer. If now the employee personally signs a contribution agreement or contributes under her or his own name, she or he would give away rights on something which are owned by someone else.

However, when browsing through some repos on Github I only see real names at commits. Is the approach we are thinking about that uncommon or would it even not be accepted by oss projects? Or do other companies use some kind of "proxy persons" hiding the internal structures?

Answer 1

There are two issues here:

1. Managing copyright and licensing of the company's contributions in a legally rigorous way, including corporate agreement to the project's CLA, if any.

2. The use of a single company account to interact with the project, used by multiple employees.

Copyright ownership of the code is completely separate from the display name of the account used to participate in online discussions and enter commits into a version control system. Regardless of how you choose to resolve issue #2, it has no bearing on issue #1.

One helpful practice is to ensure your copyright notices read "Copyright {year} The Foo Corporation" instead of an individual name like "Copyright {year} Wolfgang Smith". Since the copyright is owned by the company, ensure you represent that fact in any copyright notices you add. Copyright notices don't have much of a modern function anymore, but this would at least easily ensure everyone understands the ownership of the copyright (including the project maintainers, the contributors themselves, and third parties who download the code).

The usual way projects deal with corporate contributions in a legally rigorous way is to have a company officer agree to a corporate contributor licensing agreement (CCLA) that has an attached list of employees. A CCLA works pretty much the same as an individual CLA: a person agrees to let the project use their contributions under certain terms, but the person here is a corporate "person" rather than a natural person. A CCLA requires the extra step of maintaining a current list of employee contributors, so the project knows which individual contributors are already covered by their company's CCLA.

As for the social and policy question of a single GitHub account for your company, I've never seen this done, and I'd certainly find it strange and at least a little suspicious. Whether it will be a problem in practice will vary from project to project. It also presents problems of scaling, though your company may never encounter such an issue. (Imagine, for example, if every employee at Google or Microsoft had to orchestrate their corporate FLOSS contributions through a single GitHub account!)

Answer 2

The author of a work and the copyright holder of the work don't need to be the same entity.

An example of this is music - a song is written by an artist, but the copyright on it may be held by a distributor. We still credit the artist with creating the song.

When an employee writes code as work for hire, the employee is still frequently recognized as the author of the work, although according to law the employer may claim authorship (as well as copyright and other rights). It is up to the employer to decide whether, and how, the employee is acknowledged as the author.

In any event, the employer generally holds the legal rights to the work, for example copyright. When projects ask for copyright assignment (i.e. signing a CLA), they generally use language which makes the contributor either state that they own copyright (i.e. the work is not a work for hire), or get the employer to sign off on the copyright assignment. For example, the Facebook CLA says:

"You" (or "Your") shall mean the copyright owner or legal entity authorized by the copyright owner that is making this Agreement with Facebook.

The ASF CLA goes into more detail on what is expected from both individuals and corporations.

Depending on what the requesting project requires, names of developers who produced the code may not need to be published:

• The employer (in the US, other jurisdictions may vary) owns all interest in the work.
• The employer designates a person who is legally allowed to sign copyright assignment on behalf of the employer.
• Subsequently, this person can submit the code as "being produced by FooWidgets Inc."

In practical terms the code submitted by an employer still needs to be associated with a person (either the one who signed the copyright assignment, or someone who the employer designated as being allowed to submit code). But this person can, in principle, be someone from legal team and not a developer.

Therefore,

If now the employee personally signs a contribution agreement or contributes under her or his own name, she or he would give away rights on something which are owned by someone else.

The employee can legally sign the copyright assignment agreement extending to whatever code they own copyright to (such as work done on their own time). The employee would not be legally allowed to contribute code that they don't own copyright to (such as work done for hire) even if they signed such an agreement, because they don't own the rights.

when browsing through some repos on Github I only see real names at commits.

Most tech companies allow their employees to retain authorship/credit of the work they have done, even when the company owns all rights to the work. This serves to motivate the employees, and doesn't usually cost the company anything.

That said, I worked for a company that allowed open source contributions as long as they did not have any association with the company. (The thinking as I understood it was the company did not want to provide the impression of "giving away" their IP.) I was allowed to contribute if I did so under a fake name and the company's name was not mentioned anywhere. A project that does not require copyright assignment typically won't bother checking whether the name that someone gives is real - there is no way to do that, really, short of asking for government-issued ID which I think many people would balk at.

This isn't a 100% legally sound way of running a software project (which is why copyright assignments are required by large companies) but the majority of free software/open source projects operate in this way. Also, the Github terms of service state that a contribution to a repository is made under the repository's license, which is satisfactory for most projects.

Or do other companies use some kind of "proxy persons" hiding the internal structures?

Given that many people post their company & position at LinkedIn, hiding corporate structure by preventing developers from putting their name on their contributed code probably doesn't accomplish much. The managers who are, one might argue, the actual hierarchy often don't write code and are even less likely to submit it to a project outside of the company.

Answer 3

While it's true that a CLA by an individual employee would be of no use, I'd question the assertion that individual employees can't contribute under their own names - as you have yourself found, there are many examples of this happening out there right now. However, that's perhaps slightly irrelevant if your employer, for reasons of their own, doesn't want individual names on contributions.

Is the approach we are thinking about that uncommon

Yes, in that the vast majority of companies contributing to open source projects seem happy for their employees to contribute under their own names.

would it even not be accepted by oss projects

That's a question you'd have to ask the project in question. I can't see a fundamental reason why such contributions would be rejected - however it's attributed, the legal entity contributing to the project is the company, not the employee.

Or do other companies use some kind of "proxy persons" hiding the internal structures?

That's obviously a very difficult question to answer as anybody doing it isn't likely to shout about it, but I would at the very least regard it as a disreputable practice.

Answer 4

Management now has the idea to contribute via a more or less anonymous - or at least: not personal - company account,

I believe this could be illegal, at least in France (where I live and work), unless the physical person agree on not being mentioned. Since here the moral rights of a software developer as an author (even if he/she is paid to do that at work) is not transferable.

I also believe that mentioning open source developer's name is good for morale and is a matter of respecting their work.

I do professionally contribute to open source project, and I certainly would refuse to do that if my name did not appear in the source code.

I strongly suggest your company to pay for a lawyer.

I am not a lawyer

NB: authorship is not the same as copyright ownership, and open source software can routinely be dual-licensed.

PS: My past contributions to GCC -with my name- appear both in the source code and on my resume. AFAIK, my employer (CEA LIST) is not much directly mentioned in the source code. It is mentioned in the copyright agreement (signed between my employer and the FSF), and that document is not public. My employer owns the copyright of most of my other free software contributions and could re-license them.

Answer 5

As mentioned in all previous answers, there is a difference between the author and the copyright holder. And this distinction usually is quite clear:

If a person contributes to a project with an e-mail address of [email protected] then it is - IMHO - very clear that example-company is the copyright holder while Joe Doe is the author who did the work as part of his work contract; thus no-one will be unclear about this.

Additionally it has several benefits, if people contribute in a way that they can be identified. Contributions usually need to go through a review process in any project - thus it needs personal communication via e-mail or other means.

If a company has several contributors, they might have different views on issues and different expertise - and it gets very confusing, if they communicate from the same e-mail address. It's similar when I do business with a company... I might address info@ or call the general service number initially... but I usually get a reply from a non-anonymous person whom I henceforth can actually talk to. Thus having a face and a name is a bonus for your company to the outside. But definitely also to the inside in terms of motivation for your employees as it grants them respect and reward in terms of recognition.

Answer 6

It's generally frowned upon in open source culture to make contributions under what is essentially an anonymous identity. Contributions often require authentication mechanisms like SSH keys, and like a password the sharing of private keys among who knows how many individuals is a gaping security hole ripe for nefarious exploitation. Few open source projects want to wake up one day to find their name in the news as a vector for an infamous infection.

That said, it's not a hard-and-fast rule and many projects would prefer anonymous contribution over no contribution. People vary.

Most companies recognize both this culture and the difficulty of maintaining a shared secretive anonymous identity among many employees. The compromise is that employees are required to contribute using their corporate email, and such contributions are generally recognized as coming from the company not the person. Often some sort of corporate legal acknowledgement is required to be on file before accepting such code contributions to protect the project from later claims.

What you need to do is discuss this with the upstream project to see how they feel about it.