27

An interesting point came up on another thread about alleged misappropriation of a GPL project. In this case the enterprise software was used by some large companies who essentially took the code, changed the name, removed the GPL notices and used the result.

The point was - if the company did this and only used the software internally then there isn't any distribution and that's perfectly legal under GPL. Modifications by their own employees for internal use would also be allowed.

So At what point does it become a distribution?
Presumably if they brought in outside contractors under 'work for hire' their modifications would also be internal and so not a distribution.

If they hired an external software outfit to do modifications and those changes were only used internally by the company - would those changes be distributed? Does the GPL apply to the client or to the external developers?

If the company then give the result to another department, another business unit, another company? What if the other company is a wholly owned subsidiary?

ps. yes I know the answer is ask a lawyer. But all the discussion I have seen over GPL2/GPL3 distribution has been about webservices - not about internal use.

Improve this question
3

4 Answers 4

Reset to default
16

The essence of the GPL is that it does not limit what you can do with the software -- it imposes requirements on you when you Convey or Propagate the covered work. To quote the GPLv3:

To “propagate” a work means to do anything with it that, without permission, would make you directly or secondarily liable for infringement under applicable copyright law, except executing it on a computer or modifying a private copy. [emphasis added]

So if the only use is with a private copy you are not Propagating or Conveying the work so the conditions that allow you to Convey the work are not relevant.

See this FAQ:

Does the GPL require that source code of modified versions be posted to the public?

The GPL does not require you to release your modified version, or any part of it. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.

Improve this answer
5
  • 7
    So, making a closed source derivative and only distributing it within my "organisation" seems OK. But what if I let anybody become a member of my organisation? Employ them for a cent? Or even put a binary on my website and say "by downloading this I grant you membership in my organisation"? I wonder where you could draw the line.
    – jdm
    Apr 24, 2013 at 10:05
  • 2
    IANAL, but I think it is not so simple. You would need some sort of legal entity that is your organization. Without the legal entity it is just a bunch of individuals and you are in fact propagating or conveying the work. Figuring out who is and isn't a "member" is probably contract law or employment law. And, as always, just because what you are doing is legal and you would win a lawsuit doesn't mean you won't be sued.
    – Craig
    Apr 24, 2013 at 17:15
  • 2
    Accidentally downvoted and now vote is locked in :(
    – whatsisname
    Aug 2, 2017 at 4:59
  • 1
    I upvoted it for you ;)
    – axel22
    Apr 2, 2019 at 12:30
  • You're missing the point. If you distribute a binary to anyone (inside or outside your "organisation", however you choose to define that), you must also make available the source code to that recipient. The reason "organisation" comes up, is it is presumed you don't mind giving those people access to the source code, because they're in your "organisation".
    – Rob
    Nov 15, 2019 at 10:40
7

Look at it this way. It won't really matter if there are different departments, or subsidiaries. It only matters if you are going to distribute the binaries to another party and not give them the source.

If there is another department that will use the modifications, they will get the source to work on it. No big deal. You are complying with everything in the license. Anyone who can get a distribution needs the source.

Services over the network is not considered distribution.

Here is an attempt at a simple explanation of GPL:

If a GPL project produces awesomeProduct.jar, any place that awesomeProduct.jar exists, awesomeProduct_src.jar also needs to exist. If someone doesn't have awesomeProduct.jar they don't get awesemeProduct_src.jar

Improve this answer
7
  • Legally I suppose the question is "another party". eg for a giant multinational corp like Samsung or Mitsubishi there could be a lot of organisations that aren't considered "another party". My point was that mega-corp could take Linux, modify it, sell it to 1000s of users in 100s of subsidiary companies and still be within the GPL
    – Martin Beckett
    Aug 29, 2012 at 18:02
  • @MartinBeckett It doesn't matter. Unless you are suggesting that Department A would produce a product from GPL source and not give Department B the source.
    – Andrew T Finnell
    Aug 29, 2012 at 18:03
  • If I modify GPL code and give it to you, you also have to redistribute it. If you pay me to modify it - do you still have to distribute it? If you are Ford and give it Jaguar do you? Seemed an interesting point!
    – Martin Beckett
    Aug 29, 2012 at 18:08
  • - I think that point came up in Android. Did Google distribute the modified Linux Kernel just to the phone maker or to every end user of the phone? Can't remember if there was a conclusion.
    – Martin Beckett
    Aug 29, 2012 at 18:17
  • 1
    not really, if the business is geared to totally different subsidiaries then they will not be part of the same company. They'll have different accounts and suchlike. Distributing to them will be to a different company. Its quite easy to tell, do you have the same CEO? Do they publish different accounts? If Google UK is a totally different legal entity than Google US for example, and they pay Google US (or Google TaxHaven that is) a licence fee for their products, they'd not be able to distribute a GPL product without the source.
    – gbjbaanb
    Aug 30, 2012 at 21:43
3

If that is what the company wants to do, then there is a very simple method to avoid all obligations and all legal problems: Whenever you give a copy of the software to an employee, give them the complete source code at the same time. That is one of the three ways to fulfil your obligations under the GPL.

Tell the employees that they are not allowed to hand the software to anyone else, and that they are definitely not allowed to hand the source code to anyone. If they do, then they are in trouble with their employer. If they do without handing over the source code they are in legal trouble (and not the employer, because the employer didn't distribute the software).

Improve this answer
5
  • 1
    Unfortunately, directly contradicted by the GPL because the GPL means that on re-distribution you cannot change the license. This means obliging the receiver of the source code not to re-distribute it under GPL is expressively forbidden. "You may not propagate or modify a covered work except as expressly provided under this License." (GPLv3, Sect.8) And further: "You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License." (ibid., Sect. 10)
    – Unapiedra
    Dec 31, 2017 at 19:05
  • @Unapiedra Are you sure? The way I'm understanding this is that the employer is still distributing it to the employees under the GPL. They do have a legal right, as guaranteed by the license, to distribute the code. But the company still needs them to not exercise that right, so if they do, they'll be fired. That's all that will happen though; the employer won't have incurred any legal liability for leaking it, as they were specifically granted a legal license to do so. Risky for the company though—if the employee leaves the company, the company can't stop them from distributing the code.
    – Sparkette
    Sep 23, 2018 at 21:10
  • @flarn2006, doesn't this FSF FAQ make it sound like an employer could restrict an employee from leaking the code?
    – csrowell
    Jun 17, 2019 at 21:05
  • ah, I found an even better FAQ regarding internal distribution: "...As a consequence, a company or other organization can develop a modified version and install that version through its own facilities, without giving the staff permission to release that modified version to outsiders..."
    – csrowell
    Jun 17, 2019 at 21:14
  • Also, there is a FAQ regarding theft, which I think it would fall under if an employee released the code: "...If the version in question is unpublished and considered by a company to be its trade secret, then publishing it may be a violation of trade secret law, depending on other circumstances. The GPL does not change that. If the company tried to release its version and still treat it as a trade secret, that would violate the GPL, but if the company hasn't released this version, no such violation has occurred."
    – csrowell
    Jun 17, 2019 at 22:01
0

I would look at this quote from their website

If you commercially distribute binaries not accompanied with source code, the GPL says you must provide a written offer to distribute the source code later. When users non-commercially redistribute the binaries they received from you, they must pass along a copy of this written offer. This means that people who did not get the binaries directly from you can still receive copies of the source code, along with the written offer.

You have to pass the source all the way down the chain, just look at it as your external api is the customer of the internal api. The requirement to provide source is inherited by the external api's use of the internal api.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.