Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm
Precedence: bulk
Reply-To: legal-discuss@apache.org
Received-SPF: neutral (athena.apache.org: local policy)
Reply-To: <lrosen@rosenlaw.com>
From: "Lawrence Rosen" <lrosen@rosenlaw.com>
To: <legal-discuss@apache.org>
Subject: FW: Contributing to an Open Source project
Date: Sat, 14 Mar 2009 19:45:13 -0700
Organization: Rosenlaw & Einschlag
Message-ID: <AAC048DADF324B3B880A88855AF5AEB0@LROSENTOSHIBA>
MIME-Version: 1.0
Content-Type: text/plain;
	charset="us-ascii"
Content-Transfer-Encoding: 7bit
Thread-Index: AcmkRRBNuhysmO+VS7eksXRz2BhbSwAf27yQABRoabA=

Below are copies of four emails on another list between Bruce Perens and me
relating to Apache's license and attribution policies. I've reordered the
emails into chronological order for easier reading. Anyone who wants to
follow this from now on should just subscribe to issues@opensource.org.
/Larry


*EMAIL 1**********

> > -----Original Message-----
> > From: Bruce Perens [mailto:bruce@perens.com]
> > Sent: Friday, March 13, 2009 6:35 PM
> > To: lrosen@rosenlaw.com
> > Cc: issues@opensource.org
> > Subject: Re: Contributing to an Open Source project
> >
> > Lawrence Rosen wrote:
> > > As I understand the way it works in Apache (and someone will surely
> tell
> > me
> > > if I'm wrong!), individual copyright and other notices from individual
> > > contributions are gathered into NOTICE files.

> > Only when a particular party chooses to edit the NOTICE file. It isn't
> > an accurate list of all of the copyright holders.
> >
> > So, here's my theory:
> >
> > A is a licensee to Apache code copyrighted by B.
> > A sues B over a patent of A that is infringed in B's Apache code and in
> > other products of B.
> > B attempts to terminate A's license to B's Apache code.
> > A petitions for relief: "B did nothing to inform me that I was their
> > licensee when I obtained the software. Their name does not appear in the
> > software package in question."
> > Judge quashes B's attempt to terminate A's license.
> >
> >     Thanks
> >
> >     Bruce


*EMAIL 2***************
> -----Original Message-----
> From: Lawrence Rosen [mailto:lrosen@rosenlaw.com]
> Sent: Saturday, March 14, 2009 12:26 PM
> To: 'issues@opensource.org'
> Subject: RE: Contributing to an Open Source project
> 
> Bruce, you've turned my defense of Apache's attribution policy into a
> complicated different question about defensive termination as a
> consequence of a patent infringement lawsuit. Rather than engage in fake
> litigation between A and B, I'll just make a few points:
> 
> 1. Patent infringement is a factual matter and the lawsuit doesn't concern
> itself initially with intent. If B infringes A's patent, that's too bad
> for B whether he was informed about the possibility in advance or not.
> That is why I recommend that open source contributors and projects
> understand the patent landscape in which they operate.
> 
> 2. When A sued B for patent infringement, he should have looked to see if
> B had any potential defenses, such as defensive termination of B's
> copyright/patent licenses to Apache and through Apache to A. That is one
> way that the open source community protects itself against patents, by
> making patent infringement lawsuits potentially more costly for patent
> owners who sue. I don't feel sorry for A if he tries to assert a patent
> against B without understanding the facts and the risks of being a
> litigious patent owner.
> 
> 3. When B defensively attempts to terminate A's copyright license, I
> presume that the court would consider whether that license came from B
> (for the contribution) or from Apache Software Foundation (for the
> collective work). The court would look to the language of the contributor
> agreement (between B and Apache), the Apache License 2.0 (between A and
> Apache), and the relationship between the patent claims and the software
> itself. The defense portion of the patent infringement litigation would be
> an interesting and complicated analysis of the equities and the agreement
> language. Perhaps you'd like to hire an attorney to play that game?
> 
> 4. Copyright owners like B might someday attempt to insulate themselves
> against patent lawsuits by contributing lots of valuable software to
> Apache for distribution to the world. As an Apache member, I encourage
> that. Perhaps to make that strategy work they ought to ask for inclusion
> in the NOTICE file. But they needn't ask for a copyright notice or even
> attribution.
> 
> Best regards,
> 
> /Larry


*EMAIL 3*********************
> From: Bruce Perens [mailto:bruce@perens.com]
> Sent: Saturday, March 14, 2009 5:49 PM
> To: lrosen@rosenlaw.com
> Cc: issues@opensource.org
> Subject: Re: Contributing to an Open Source project
> Lawrence Rosen wrote:
> Bruce, you've turned my defense of Apache's attribution policy into a 
> complicated different question about defensive termination as a 
> consequence of a patent infringement lawsuit.

I wrote that I was concerned regarding the patent terms in the initial
message on this topic.
That's really the only thing that has ever concerned me about this issue, as
with the exception of the patent terms it's a maximally permissive license.

> 2. When A sued B for patent infringement, he should have looked to see 
> if B had any potential defenses, such as defensive termination of B's 
> copyright/patent licenses to Apache and through Apache to A.

The problem is that there isn't a way for A to tell that B has potential
defenses. A review of the source code control system, which is no small
task, might reveal a check-in from bruce@gmail.com, without any information
of who Bruce's employer is or that Bruce's employer is the copyright holder
for his work.

> The defense
> portion of the patent infringement litigation would be an interesting 
> and complicated analysis of the equities and the agreement language. 
> Perhaps you'd like to hire an attorney to play that game?

My approach, in dealing with my customers and their attorneys, has not been
to equip them to simply win a litigation. Rather, I like to do as much as
possible to head off any possible litigation before it happens. 
If Apache were my customer, I would be asking the attorneys involved to
repair the process so that it is unambiguous who the copyright holders are.
With this repaired process, a diligent party would reliably learn that their
own license could be terminated, and might thus decide not to litigate.
Currently, a diligent party may learn nothing useful.

    Thanks

    Bruce


*EMAIL 4******************
> -----Original Message-----
> From: Lawrence Rosen [mailto:lrosen@rosenlaw.com]
> Sent: Saturday, March 14, 2009 7:32 PM
> To: 'issues@opensource.org'
> Subject: RE: Contributing to an Open Source project
> 
> Bruce Perens wrote:
> The problem is that there isn't a way for A to tell that B has 
> potential defenses. A review of the source code control system, which 
> is no small task, might reveal a check-in from bruce@gmail.com, 
> without any information of who Bruce's employer is or that Bruce's 
> employer is the copyright holder for his work.

Tears well in my eyes. Are you the same person who complains (and rightly
so) that it is almost impossible for B to determine that he possibly
infringes A's patent? And now you complain that A might find it difficult to
determine that B has valuable defenses to a patent infringement lawsuit? 

Maybe they should negotiate before suing each other over patent
infringement.


> If Apache were my customer, I would be asking the attorneys involved 
> to repair the process so that it is unambiguous who the copyright 
> holders are. With this repaired process, a diligent party would 
> reliably learn that their own license could be terminated, and might 
> thus decide not to litigate. Currently, a diligent party may learn nothing
useful.

I'm sure that a few folks from Apache are reading your suggestion. Apache
hides none of its contribution records. There is no reason to assume that
Apache doesn't advise its users, in NOTICE files, of any known patent or
copyright encumbrances or risks. We're very careful about all that.

Please note another very important point: The Apache License 2.0 has a
balanced defensive termination provision that ties the patent litigation
directly to the specific work being licensed. 

      If You institute patent litigation against any entity (including 
      a cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed. [See section 3]

Not every OSI-approved license is so balanced. Very broad defensive
termination provisions, coupled with the absence of effective notice, may
lead to anticompetitive behavior by patent-owning companies. Bruce has
already noted that possibility, although I urge you not to think of Apache
in that context. 

Some of you who insist on reducing the number of open source licenses may
not realize the subtle differences among the defensive termination
provisions of some of those licenses and the patent risks that they each
pose.

/Larry


---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org