Re: [Spi-private] IRC log from 2003-02-04 SPI Board meeting

Hello, Mr. Oberg:

I am forwarding this message to the spi-general list for discussion
among our membership.

Thanks for writing!

On Sun, Feb 23, 2003 at 09:23:32PM +0100, Jonas Oberg wrote:
> Hi Branden, could you forward this to whoever is appropriate?
>
> I read from the IRC log from the board meeting of the 4th of february
> that the SPI is considering accepting "copyright assignments", similar
> to those that the Free Software Foundation North America uses.
>
> This seems like a good idea to me and I encourage it. I would however
> also point you to http://www.fsfeurope.org/projects/fla/ which is the
> Fiduciary Licence Agreement (FLA) developed by the FSF Europe in
> coordination with, among others, Eben Moglen.
>
> It addresses the same issues as the Copyright Assignment that the FSF
> NA uses, but is crafted in a way that allows it to be used also for
> the continental European Droit d'Auteur authorship tradition, which is
> different than the anglo-american copyright system used by the US.
>
> The FSF NA is currently looking at using the FLA, or some derivative
> thereof, for their own "copyright assignments", but they have not
> decided yet and it is a low-proprity issue since the normal "copyright
> assignments" work well enough.
>
> If the SPI would accept similar contracts, I would recommend that you
> have a look at the FLA. I believe that it will be more useful for you
> than the older "copyright assignment" contracts. Please see the web
> pages for more information, and email fla(at)fsfeurope(dot)org with any
> questions. They can also assist you if you would be interested in
> using the FLA as a contract for the SPI.

--
G. Branden Robinson, Treasurer
Software in the Public Interest, Inc.
treasurer(at)spi-inc(dot)org
http://www.spi-inc.org/

One comment about the U.S. versions of such a copyright assignment. I
would strongly suggest that any such legal wording be similar to the
one which the FSF accepted from IBM when IBM donated the s390 changes
to the binutils package:

http://sources.redhat.com/ml/bug-binutils/2000-q3/msg00000.html

... and not based on the default templates distributed by the FSF. In
particular, the offending words which you will note the IBM lawyers
removed from the assignment agreement referenced above are:

"... I hereby indemnify and hold harmless the Foundation, its
officers, employees, and agents against any and all claims, actions or
damages (including attorney's reasonable fees) asserted by or paid to
any party on account of a breach or alleged breach of the foregoing
warranty."

Why is this bad? An explanation can be found at this web page:
http://ohwg.cap.gov/jag/indemnify.html. In part:

"Indemnification means you agree to step into the shoes of the
person you have agreed to indemnify and suffer in their place whatever
consequences they were to suffer because of something happening
(literally to protect them from being "damned"). That includes
financial suffering - paying the bills to repair or replace damaged
things; paying the judgment a court assesses them for injury to a
third party; sometimes paying a fine levied against them; anything
short of imprisonment for their own direct criminal conduct. Anyone
want to bet their own house and savings?"

A good rule of thumb is that any time you see a legal agreement with
the word "indemnify", that should be an immediate red flag, and you
should ideally refuse to sign such an agreement before getting
competent legal advice.

If I'm going to write software, and donate my efforts and my
intellectual property the Open Software community, that's my choice.
I've done this on many occasions. But one thing that I will NOT do
after making such a free donation of my efforts is to sign something
which explicitly puts my house and all of my savings at risk. If IBM
refused to put its corporate assets at risk when it donated the s390
binutils changes to the FSF, why should I risk mine? As a result, I
will refuse to donate code to any project which requires me to sign an
agreement with similar language.

- Ted

On Tue, Feb 25, 2003 at 12:54:36PM -0500, Theodore Ts'o wrote:
> If I'm going to write software, and donate my efforts and my
> intellectual property the Open Software community, that's my choice.
> I've done this on many occasions. But one thing that I will NOT do
> after making such a free donation of my efforts is to sign something
> which explicitly puts my house and all of my savings at risk. If IBM
> refused to put its corporate assets at risk when it donated the s390
> binutils changes to the FSF, why should I risk mine? As a result, I
> will refuse to donate code to any project which requires me to sign an
> agreement with similar language.

Fair enough. But on the other hand, I guess SPI has to decide whether
*it* wants to take up any risks and stand up for whatever code it
accepted. What happens if some company decides they have a patent on
something and tries to sue us into oblivion?

Michael

On Wed, Feb 26, 2003 at 01:28:46AM +0100, Michael Banck wrote:
> On Tue, Feb 25, 2003 at 12:54:36PM -0500, Theodore Ts'o wrote:
> > If I'm going to write software, and donate my efforts and my
> > intellectual property the Open Software community, that's my choice.
> > I've done this on many occasions. But one thing that I will NOT do
> > after making such a free donation of my efforts is to sign something
> > which explicitly puts my house and all of my savings at risk. If IBM
> > refused to put its corporate assets at risk when it donated the s390
> > binutils changes to the FSF, why should I risk mine? As a result, I
> > will refuse to donate code to any project which requires me to sign an
> > agreement with similar language.
>
> Fair enough. But on the other hand, I guess SPI has to decide whether
> *it* wants to take up any risks and stand up for whatever code it
> accepted. What happens if some company decides they have a patent on
> something and tries to sue us into oblivion?

We say we didn't know and remove the code ?

Friendly,

Sven Luther

On Wed, Feb 26, 2003 at 01:28:46AM +0100, Michael Banck wrote:
> Fair enough. But on the other hand, I guess SPI has to decide whether
> *it* wants to take up any risks and stand up for whatever code it
> accepted. What happens if some company decides they have a patent on
> something and tries to sue us into oblivion?

Well, life is full of tradeoffs. One advantage of a distributed
copyright ownership is that it makes life a lot harder for some
company who has a patent on something to sue someone into oblivion.
To take a concrete example, which would get elicit more world-wide
sympathy, and which would be harder to do?

1) For an big, multi-billion dollar U.S. company to sue an innocent
17-year boy in Norway, under Norwegian laws? (Replace 17-year boy
with 26-year old Russian with two children, aged two-and-a-half and
three months for another example.)

2) Or for that same company to sue a faceless non-profit corporation
which most people (and certainly all non-geeks) haven't heard of
before, in a U.S. courtroom?

Think about that, for a moment.

If you want to protect the assets of the SPI, then contact a good
lawyer, and ask him/her to help you set up a subsidary, or sister
corporation to hold the IPR that you're so interested in centralizing,
but which otherwise has little to no assets. It needs to be separate
enough that lawsuits against it can't pierce the corporate liability
shield, but which SPI (and other non-profit organizations) could
choose to funnel money to it via donations if it needs to defend
itself in court. (Or such organizations could donate legal help
directly to specific cases, as the EFF has done from time to time.)

The bottom line is a good lawyer should be able to help the SPI use
corporations they way they were meant to be used; to help individuals
to duck out of being held personally liable. It's important to
remember that the same legal rules that allow a company to be sued for
millions for making coffee too hot also has provisions that allow rich
people to shield their personal wealth from much of that liability.
If the SPI wants to do something like centralize copyright holdings
(and I'm really not convinced it's worth it), the least it can do is
to use similar techniques to protect individual open source
contributors' assets as much as possible.

- Ted

On Wed, Feb 26, 2003 at 10:02:06AM +0100, Sven Luther wrote:
> > Fair enough. But on the other hand, I guess SPI has to decide whether
> > *it* wants to take up any risks and stand up for whatever code it
> > accepted. What happens if some company decides they have a patent on
> > something and tries to sue us into oblivion?
>
> We say we didn't know and remove the code ?

Well, we can do that once or twice. But assume that the threat is really
questionable (like, a trivial patent or a so-called DMCA-violation) but
they have more lawyers than we do? I thought the purpose of assigning
copyright is so that the organisation that holds up the transferred
copyright can easier cope with threats. If we just drop any code that
makes problems, I could imagine that not many people will see the point
in assigning copyrights to us.

So my point rather was: Do we promote that we'll fight for people
willing to assign copyrights, provided that we think the cause is just?
Do we have the resources for this?

Michael, IANAL of course

On Fri, Feb 28, 2003 at 12:30:24PM +0100, Michael Banck wrote:
> On Wed, Feb 26, 2003 at 10:02:06AM +0100, Sven Luther wrote:
> > > Fair enough. But on the other hand, I guess SPI has to decide whether
> > > *it* wants to take up any risks and stand up for whatever code it
> > > accepted. What happens if some company decides they have a patent on
> > > something and tries to sue us into oblivion?
> >
> > We say we didn't know and remove the code ?
>
> Well, we can do that once or twice. But assume that the threat is really
> questionable (like, a trivial patent or a so-called DMCA-violation) but

We have to take care about not letting patent or DMCA violations we know
about in, or something such, or move these to free repositories outside
the US or whatever. If we act in good faith, and respond aprprietely to
a cease-and-desist move or whatever, there is nothing that whoever is
going to sue us can do. After all, we are no patent lawyers.

There was also an jurisprudence or whatever saying that you cannot
prosecute people that didn't know they were violating patents.

> they have more lawyers than we do? I thought the purpose of assigning
> copyright is so that the organisation that holds up the transferred
> copyright can easier cope with threats. If we just drop any code that
> makes problems, I could imagine that not many people will see the point
> in assigning copyrights to us.

Mmm, that is a different issue.

> So my point rather was: Do we promote that we'll fight for people
> willing to assign copyrights, provided that we think the cause is just?
> Do we have the resources for this?

Friendly,

Sven Luther

On Fri, Feb 28, 2003 at 12:56:37PM +0100, Sven Luther wrote:
> On Fri, Feb 28, 2003 at 12:30:24PM +0100, Michael Banck wrote:
> > On Wed, Feb 26, 2003 at 10:02:06AM +0100, Sven Luther wrote:
> > > > Fair enough. But on the other hand, I guess SPI has to decide whether
> > > > *it* wants to take up any risks and stand up for whatever code it
> > > > accepted. What happens if some company decides they have a patent on
> > > > something and tries to sue us into oblivion?
> > >
> > > We say we didn't know and remove the code ?
> >
> > Well, we can do that once or twice. But assume that the threat is really
> > questionable (like, a trivial patent or a so-called DMCA-violation) but
>
> We have to take care about not letting patent or DMCA violations we know
> about in, or something such, or move these to free repositories outside
> the US or whatever. If we act in good faith, and respond aprprietely to
> a cease-and-desist move or whatever, there is nothing that whoever is
> going to sue us can do. After all, we are no patent lawyers.

I have to say that I think this is bullshit. The DMCA has been used to
enforce people not to print such things as sale prices the day before
a sale. Its clear that the DMCA is so vague as to be almost impossible
for your average non lawyer human to determine what falls under it and
what doesn't.

Furthermore, SPI is one of the few organizations that has the
intellectual capability and the ethical awareness to stand up to such
a law, and few other organizations do. If we submit quietly to every
DMCA request for removal of code, then the DMCA just becomes stronger
and we lose the chance that it will be repealed.

Lastly, if we are threatened by some MagaCorp(TM) with being sued into
oblivion over a DMCA violation, I'm sure that the EFF and the ACLU
will be happy to help us fight that battle, just as I'm sure we would
get lotsof donations to our legal battle. Hell, if the slashdot crowd
will donate to save dimitri, I'm sure they'll donate to save debian.

cardenas

--
michael cardenas | lead software engineer, lindows.com
hyperpoem.net | GNU/Linux software developer
people.debian.org/~mbc | encrypted email preferred

"Are you seeking to know what is wrong with the world? All the
disasters that have wrecked your world, came from your leaders'
attempt to avoid the fact that A is A."
- Ayn Rand, Atlas Shrugged

On Fri, Feb 28, 2003 at 07:37:45AM -0800, Cardenas wrote:
> Furthermore, SPI is one of the few organizations that has the
> intellectual capability and the ethical awareness to stand up to such
> a law,

Actually, we've been advised by counsel to conceal all evidence that we
have either of these traits. ;-)

--
G. Branden Robinson, Treasurer
Software in the Public Interest, Inc.
treasurer(at)spi-inc(dot)org
http://www.spi-inc.org/

> On Fri, Feb 28, 2003 at 07:37:45AM -0800, Cardenas wrote:
> > Furthermore, SPI is one of the few organizations that has the
> > intellectual capability and the ethical awareness to stand
> up to such
> > a law,
>
> Actually, we've been advised by counsel to conceal all
> evidence that we have either of these traits. ;-)

Your counsel is probably right! But he should caution you not to reveal
attorney-client confidences. There may come a time when you want to
deny knowing anything about intellectual capability and ethical
awareness -- or want to hide the fact that you have a lawyer who warned
you of such things. :-)

/Larry Rosen

On Fri, Feb 28, 2003 at 12:56:37PM +0100, Sven Luther wrote:

> > > > Fair enough. But on the other hand, I guess SPI has to decide whether
> > > > *it* wants to take up any risks and stand up for whatever code it
> > > > accepted. What happens if some company decides they have a patent on
> > > > something and tries to sue us into oblivion?
> > >
> > > We say we didn't know and remove the code ?
> >
> > Well, we can do that once or twice. But assume that the threat is really
> > questionable (like, a trivial patent or a so-called DMCA-violation) but
>
> We have to take care about not letting patent or DMCA violations we know
> about in, or something such, or move these to free repositories outside
> the US or whatever. If we act in good faith, and respond aprprietely to
> a cease-and-desist move or whatever, there is nothing that whoever is
> going to sue us can do. After all, we are no patent lawyers.
>
> There was also an jurisprudence or whatever saying that you cannot
> prosecute people that didn't know they were violating patents.

Besides which is there any reason that being the copyright holder suddenly
makes you liable for people's distributing/using code in violation of whatever
patent? Or that someone assigning copyright to you suddenly puts you into
a situation where you're violating the DMCA? (oh, and two fingers to any
DMCA supporters who may happen to read this, BTW)

If we're distributing code, we may get into trouble. Debian does this all
the time. What difference does it make to that liability if SPI happens
to be the copyright holder? None, I'd guess.

But IANAL etc. etc.

Cheers,

Nick
--
Nick Phillips -- nwp(at)lemon-computing(dot)com
You have been selected for a secret mission.