GPL attacks - is it possible?

[paddy]

I just had an odd thought... what if some guy at Microsoft pasted in some code into a Vista patch or whatever, that was actually out in the GPL world with the intension of making the argument later that "Vista had integrated GPL code, and now must itself be legally GPL?"

Granted this would be an extreme scenario, but I wonder what liabilities there are when you are building an application or a game, and some lazy junior developer sneaks in some code he found in the open source world so he could get off early that Friday night... its a scary thought. A disgruntled employee could even do it on purpose to sabotage the financial viability of the project.

Anyone know how such a scenario would likely unfold?

[steven]

I doubt this can happen.

Usually when you sign your contract you pass to the company all your rights by signing a Contributor License Agreement (CLA) and a copyright assignment (CA). See the two links on my post to find a reference on CLA, CA and a legal primer.

IANAL but I am sure that if the programmer did put such a license it would be invalid because he previously signed the CA.

On a practical matter Microsoft is so big that even if such a situation occurred (and I am convinced there are part of the code they use that are under such license) nobody has the financial and political power to enforce the license.
They would simply lose all (money, time, life) in court and legal procedures.

[paddy]

IANAL but I am sure that if the programmer did put such a license it would be invalid because he previously signed the CA.

Okay, but lets say for the sake of argument, some programmer copied a bunch of Ogre (LGPL) code and pasted it into a commercial game engine product's source under development (no external links), without his boss knowing he didn't write it himself (he didn't paste in the license info obviously) and later is exposed.

I am curious what the remedy would be in that situation, would the company be required to choose between removing the offending code -or- complying with LGPL?

I've read a lot of discussion about keeping closed code from being 'infected' with GPL licensing - but what happens when it occurs without the knowledge of those directing the project?

The product would still have made money off of stolen code before exposure, so I doubt a "yeah oops sorry, we'll try harder next time" would cut it entirely.

I am sure something would end up mediated but what would the legal leverage be for the two sides in the issue?

[steven]

There is the legal concept of "good faith".
Those agreements an employee must sign is that he hasn't the right to copy and use such code (without the knowledge of the company).
If such a copy occurs without the knowledge of the company it can say it acted in good faith and didn't want to infringe. It must then either find an agreement with the copyright holder, remove the code or buy the company (we are speak about M$).

How all this unravels depends in which legislation all this happens.
In some like Switzerland your or the company must prove your innocence (contrary to what believes most Swiss because of Hollywood films) in other the plaintiff -in this case the copyright holder- will need to prove that the company is faulty (such AfAIK the USA). Both types of legislation has its merits and pitfalls.

Some legislation don't even recognise open-source license at all (nor any copyright btw but this is becoming rare).

[btmorex]

As I understand it, once it has been established that a company is distributing something with GPL (for example) code they have 2 options:

1.) Comply with the GPL and release their code.
2.) Remove offending GPL code.

Now, in option #1, that's probably the end of it. If they choose option #2, then the owner of the copyrighted GPL code can sue for damages.

That opens up all sorts of questions about what the damages are (monetary value). In some cases, it might be easy to find out. Take for example some middleware software that is sold with 2 different licenses: one for "non commercial" use and then another one that costs far more for "commercial" use. The actual damages would be the cost of the commercial license(s).

Also, on top of all that, there are likely to be punitive damages as well. Obviously, if the worst that could happen to a company for copyright infringement is to pay what they should have been paying in the first case, it would be much more common. So, typically, the total damages would be actual damages (cost of license) + punitive damages (some multiple of the actual damages). I believe the law provides for some cap on punitive damages, but I don't know what it is.

BTW, I'm not a lawyer. Some of the above may be wrong, but I believe that the gist of it is correct.

[Kencho]

My guess is that, even if someone does that, a QA department or someone alike would check the code before releasing.

In case that code makes its way to a final release, then I would say that most probably the contract makes the employee responsible for every license infringement of any code he/she uses.

[ScurvyKnave]

a QA department or someone alike would check the code before releasing.

Unless you're using substantial, unmodified portions of the open-source code (in which case it would be easier to identify, the coding conventions may differ etc), I think it is unlikely that anybody would recognize code as having been 'stolen'.

However, I think the issue is slightly exaggerated. Most people, when implementing something new, will research it by reading a book, looking it up on the internet, or looking how an existing open-source project does it. They will then generally repeat what they've seen, perhaps modifying it to suit their needs, make it consistent with their existing code etc. This is standard (it's how we all learn, and learning is a continuous process).

In fact, I thought that was the whole point of open-source projects. So if a programmer gets help by looking at an open-source project, I really don't see anything wrong with that.

Simply copying and pasting substantial portions of code is another story, but where do you draw the line? Is copying a single line of code acceptable? What happens if you read the line elsewhere, then retype it yourself, and it ends up looking similar because there's really only one way of doing something?