Return-Path: X-Original-To: apmail-legal-discuss-archive@www.apache.org Delivered-To: apmail-legal-discuss-archive@www.apache.org Received: from mail.apache.org (hermes.apache.org [140.211.11.3]) by minotaur.apache.org (Postfix) with SMTP id 81F0C11724 for ; Fri, 16 May 2014 19:00:48 +0000 (UTC) Received: (qmail 6698 invoked by uid 500); 16 May 2014 11:51:35 -0000 Delivered-To: apmail-legal-discuss-archive@apache.org Received: (qmail 16413 invoked by uid 500); 16 May 2014 11:42:26 -0000 Mailing-List: contact legal-discuss-help@apache.org; run by ezmlm Precedence: bulk List-Help: List-Unsubscribe: List-Post: Reply-To: legal-discuss@apache.org List-Id: Delivered-To: mailing list legal-discuss@apache.org Received: (qmail 45575 invoked by uid 99); 16 May 2014 11:14:17 -0000 Received: from Unknown (HELO nike.apache.org) (192.87.106.230) by apache.org (qpsmtpd/0.29) with ESMTP; Fri, 16 May 2014 11:14:17 +0000 X-ASF-Spam-Status: No, hits=2.2 required=5.0 tests=HTML_MESSAGE,RCVD_IN_DNSWL_NONE,SPF_PASS X-Spam-Check-By: apache.org Received-SPF: pass (nike.apache.org: domain of lrosen@rosenlaw.com designates 69.89.30.42 as permitted sender) Received: from [69.89.30.42] (HELO gproxy3-pub.mail.unifiedlayer.com) (69.89.30.42) by apache.org (qpsmtpd/0.29) with SMTP; Fri, 16 May 2014 04:03:40 +0000 Received: (qmail 31719 invoked by uid 0); 16 May 2014 04:03:15 -0000 Received: from unknown (HELO CMOut01) (10.0.90.82) by gproxy3.mail.unifiedlayer.com with SMTP; 16 May 2014 04:03:15 -0000 Received: from box597.bluehost.com ([66.147.242.197]) by CMOut01 with id 2U3B1o00Z4GF2VN01U3EDG; Thu, 15 May 2014 22:03:15 -0600 X-Authority-Analysis: v=2.1 cv=EOmVjTpC c=1 sm=1 tr=0 a=NRJ8aB/FPT4S3utBguGD+g==:117 a=NRJ8aB/FPT4S3utBguGD+g==:17 a=cNaOj0WVAAAA:8 a=f5113yIGAAAA:8 a=7xXQEuv9rCMA:10 a=CAIbOuo8jNoA:10 a=4F77bVRYAAAA:8 a=FxJxCPAPh0wA:10 a=AqkBdCNi7UMA:10 a=DAwyPP_o2Byb1YXLmDAA:9 a=Zr7miEi8wWIA:10 a=cKsnjEOsciEA:10 a=mV9VRH-2AAAA:8 a=qyDxTJV7AAAA:8 a=93Ubh6UdAAAA:8 a=CeUk9CaGAAAA:8 a=BSXodE9zH3Jro69jmmoA:9 a=iqio0AJdgt6Ymcys:21 a=46XmCM4BQQ7OnUHb:21 a=QEXdDO2ut3YA:10 a=SqxYWZjetj4A:10 a=TImqNlVd7iMA:10 a=vKkKvlSAFbAA:10 a=53mUTW9PLbcA:10 a=lEQbRIFZIaUA:10 a=EzPOsg9IdncA:10 a=88iI8knYSJUA:10 a=X-ZP5U48djcA:10 a=yMhMjlubAAAA:8 a=SSmOFEACAAAA:8 a=1ZYx-KcLhCP4SPxGtbQA:9 a=OmUI5NrSvDv5IDwk:21 a=ghU-gYUMkzCyKDcN:21 a=89A4it5rT35vkHbX:21 a=gKO2Hq4RSVkA:10 a=UiCQ7L4-1S4A:10 a=hTZeC7Yk6K0A:10 a=frz4AuCg-hUA:10 a=thHE6Pxf1GwA:10 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=rosenlaw.com; s=default; h=Content-Type:MIME-Version:Message-ID:Date:Subject:In-Reply-To:References:Cc:To:From:Reply-To; bh=yyAnv5fyAJPEFfKcjbn7UKhQY5BchI1PQ2jJVSae2+A=; b=JcoAxCT+UAt9j5qYqruG/2+N4LffxgG6HlAlar5oHHilthFDHy8pWAPbpMl9a8nw1h8xVZdBrfComh44+nuPuAu/kYQ+/Kdz0M6bmREoTG+HHlcYvD+SQ/74uIickx8r; Received: from [70.36.224.178] (port=6717 helo=Lawrencei) by box597.bluehost.com with esmtpsa (TLSv1.2:DHE-RSA-AES256-GCM-SHA384:256) (Exim 4.82) (envelope-from ) id 1Wl9MP-0001rT-Dt; Thu, 15 May 2014 22:03:05 -0600 Reply-To: From: "Lawrence Rosen" To: Cc: "Lawrence Rosen" References: <531792EA.7080409@nrl.navy.mil> <5318F26F.10109@nrl.navy.mil> <531A17D0.4090004@nrl.navy.mil> <99fc889d8341e8f17c61ec281766fb27@scarlet.be> <531B26B2.1080909@spaceroots.org> <79DC387F-6FA0-4038-9812-161DC2FA554B@dslextreme.com> <4a718a37aa02dd65b2b446d792cec605@scarlet.be> <531CBC2D.1090708@spaceroots.org> <531F697F.8060504@nrl.navy.mil> <532C8D60.7010406@nrl.navy.mil> <532C9775.1050602@spaceroots.org> <53342BC4.9090403@nrl.navy.mil> <5342C404.1080001@nrl.navy.mil! > <536937 49.3030508@nrl .navy.mil> <048a01cf697f$a3ade780$eb09b680$@rosenlaw.com> <5373A191.1090406@nrl.navy.mil> In-Reply-To: <5373A191.1090406@nrl.navy.mil> Subject: RE: ICLA US Government Date: Thu, 15 May 2014 21:03:01 -0700 Message-ID: <03c501cf70bb$bcf17610$36d46230$@rosenlaw.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----=_NextPart_000_03C6_01CF7081.109695B0" X-Mailer: Microsoft Outlook 15.0 Thread-Index: AQIn7yHQasKJTUL1hizxvnfJnZaIbQIE4tSDAXIBTTsB4BBDpAMfJ6BkAexAb3EBAzgz/wF3+nFvAq+LYUwCiDWFMAKbHrefAnOUROoCc9o65gK2RRwPAfO4XQUCeBDLBgM9uZ41AcJc6QoCbGpYIQGNGdymAghNMEgCcB3U75kgKTkA Content-Language: en-us X-Identified-User: {1397:box597.bluehost.com:rosenla1:rosenlaw.com} {sentby:smtp auth 70.36.224.178 authed with lrosen@rosenlaw.com} X-Virus-Checked: Checked by ClamAV on apache.org ------=_NextPart_000_03C6_01CF7081.109695B0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Evan, =20 Perhaps a sarcastic argument from me will point out the silliness of = your refusal to sign an Apache ICLA. Shall Apache users who want your = public domain code simply file a Freedom Of Information Act (FOIA) = request to get it and ignore the ICLA and your department's approval and = your participation altogether?=20 =20 If your software is truly public domain, then we don't actually need you = to give us your code. It is ours regardless of what mechanism you use = to hand it over to us. [I'm not speaking of government *confidential* = code, so don't worry about my reckless grab!] =20 In that sense, your lawyers are right. The ICLA is a frivolity for = public domain contributions.=20 =20 But redundant or no, I believe I can describe Apache's mandatory = procedures this way: In order for any *individual* to become an Apache = contributor, *that person* must sign an ICLA.=20 =20 This is entirely nondiscriminatory, by the way. I am a lawyer and = haven't written a line of code in years. Yet I signed an ICLA when I got = here just like everybody else. And so my contributions here, such as = this email response, are licensed to Apache =E2=80=93 and hence to you = and to the US government -- under the Apache license. This is true even = if my emails quote US law, as I occasionally do here. The fact that US = law that I cite happens to be public domain is irrelevant. :-) =20 The ICLA is an individual requirement for you too if you want to become = an Apache contributor.=20 =20 Your lawyers are making a mountain out of a molehill. Is yours the only = US government department that objects to Apache's long-held = contribution requirements? Or do we have a bigger problem with US = government agencies that we need to address more broadly? =20 Good luck convincing your department to follow Apache's procedures and = to allow you personally to contribute =E2=80=93 with an ICLA. I'm = certain that this will serve the national interest in great *open = source* software regardless of your lawyers' concerns about free *public = domain* code of yours that everyone already has rights to.=20 =20 I'm more than happy to speak directly with your attorneys without = cluttering this list with legal arguments. I'd like to explain how = Apache and many other FOSS projects have dealt with the "joint work" = issue [17 USC 101] over the years. I might also help them understand why = Open Source Initiative, despite many requests over the years to do so, = has so far refused to certify the "public domain" as an "open source = license." Encourage them to contact me directly if they want to. =20 /Larry =20 Lawrence Rosen Rosenlaw & Einschlag ( www.rosenlaw.com)=20 3001 King Ranch Road, Ukiah, CA 95482 Cell: 707-478-8932 Fax: 707-485-1243 =20 From: Evan Ward [mailto:evan.ward@nrl.navy.mil]=20 Sent: Wednesday, May 14, 2014 10:02 AM To: legal-discuss@apache.org Subject: Re: ICLA US Government =20 Larry, I passed along your message to our legal department and I've included = the response below. They can provide a more detailed response sometime = next week, if you would like one. From what I understand existing Apache = code + my contributions can be released under the Apache license, but = the ICLA specifically references my contributions, which by themselves = can only be released in the public domain. Regards, Evan On 05/13/2014 05:51 PM, Kerry Broome wrote: Essentially we disagree with how they are interpreting the two = citations. The first citation is a memo about government employees using = open source software. It has nothing to do with government developed = software.=20 =20 In the second citation, the joint work release specifically says that = =E2=80=9Cthe resulting work is a =E2=80=9Cjoint work=E2=80=9D (see 17 = USC =C2=A7 101) which is partially copyrighted and partially public = domain and =E2=80=9C[t]he resulting joint work as a whole is protected = by the copyrights of the non-government authors and may be released = according to the terms of the original open-source license.=E2=80=9D = However, the ICLA language says that we are granting a copyright = liscense for our portion to them, which we don=E2=80=99t have and cannot = do. I read that statement as Apache would have copyright over a version = of their software with your code, which is correct, but we don=E2=80=99t = agree with the language of the ICLA on how we transfer that software to = them. =20 The question above their URL in the FAQ under =E2=80=9CQ: Can government = employees develop software and release it under an open source = license?=E2=80=9D specifically states our position on this. That is, = =E2=80=9CSoftware developed by US federal government employees = (including military personnel) as part of their official duties is not = subject to copyright protection and is considered =E2=80=9Cpublic = domain=E2=80=9D (see 17 USC =C2=A7 105). Public domain software can be = used by anyone for any purpose, and cannot be released under a copyright = license (including typical open source software licenses).=E2=80=9D = That=E2=80=99s essentially what we changed with our modified ICLA. =20 Kerry =20 =20 On 05/06/2014 07:05 PM, Lawrence Rosen wrote: Evan Ward = wrote: > After a long review by my counsel, going many levels above my head, = the > result is still the same: I am not authorized to sign the Apache ICLA. > ... > If Apache can accept the public domain ICLA then we can=20 > put all this behind us and get back to coding. =20 Evan, I'm confused by this analysis. Even the Chief Information Officer = of the U.S. Department of the Navy doesn't consider public domain = software a form of open source. See the memorandum entitled "Department = of the Navy Open Source Software Guidance = ". Here is what = it says about public domain:=20 =20 "Open Source Software: Computer software that includes source code that = can be used and modified by the user; this software has been copyrighted = and includes a license agreement restricting its use, modification, and = distribution. Open Source Software is software that is copyrighted and = licensed under a license agreement that is not public domain software or = freeware. The Open Source Initiative (OSI) web site = (http://opensource.org) contains more information on open source and = open source licenses." (Emphasis by underlining added.) =20 More particularly, I also refer your counsel to the DoD Open Source = Software (OSS) FAQ = , published by the CIO = of the U.S. Department of Defense, which specifically authorizes = government employees to contribute code to open source software projects = under the license(s) used by the existing project(s). That FAQ explains = several ways that the government's public domain software can be = contributed for FOSS, none of which involve a public domain dedication. =20 I'm sure the rest of the Apache community will be delighted when we can, = as you say, "put all this behind us and get back to coding." But it is = your lawyers, not ours, who are standing in the way. /Larry =20 =20 -----Original Message----- From: Evan Ward [mailto:evan.ward@nrl.navy.mil]=20 Sent: Tuesday, May 6, 2014 12:26 PM To: legal-discuss@apache.org =20 Cc: private@commons.apache.org =20 Subject: Re: ICLA US Government =20 Hi All, =20 After a long review by my counsel, going many levels above my head, the result is still the same: I am not authorized to sign the Apache ICLA. My agency decided it would not take the NSA's position that the subtlety of it was not worth arguing over ("de minimis non curat lex"). =20 I can still sign the modified ICLA I proposed earlier that puts all contributions in the public domain. It seems contradictory that Apache projects can include public domain works, but Apache will not accept a public domain ICLA. If I post my public domain work to GitHub and an Apache commiter commits it, then Apache finds that perfectly acceptable. If I sign an agreement with Apache placing all of my work in the public domain and I commit it directly to Apache, then Apache would reject it! Which situation has less risk? If Apache can accept the public domain ICLA then we can put all this behind us and get back to coding. =20 Best Regards, Evan =20 On Mon 07 Apr 2014 11:28:04 AM EDT, Evan Ward wrote: >=20 > Update: Heard back from Daniel Risacher today. Apparently the NSA had > the same concerns we have, but decided not to argue about subtle > differences ("de minimis non curat lex"). Still waiting to hear if = this > agency will take the same position. >=20 > Best Regards, > Evan >=20 > On Thu 27 Mar 2014 03:10:55 PM EDT, Doug Cutting wrote: >>=20 >> On Thu, Mar 27, 2014 at 6:46 AM, Evan Ward < = evan.ward@nrl.navy.mil> >> wrote: >>>=20 >>> As Luc, said I can post the contributions to github (or JIRA) and = make >>> clear that the project as a whole is under the Apache License, and = my >>> patches are in the public domain. Then based on the Apache's legal = FAQ >>> and Larry's earlier comments Apache is both able and glad to accept = the >>> contributions. >>=20 >>=20 >> If you can do this, then you can sign an ICLA and commit these = changes >> directly. When you attach to Jira, intentionally submitting to an >> Apache-licensed project, you agree to the same terms as the ICLA. >> What makes you think these are different? >>=20 >>>=20 >>> As I mentioned before, If someone from Apache wants to talk directly = to >>> the people here with the power to make a decision, I can provide = contact >>> information. >>=20 >>=20 >> You do not need your employer's permission to sign an ICLA. You need >> your employer's permission to contribute software under the Apache >> License. Once you have that permission, whether you choose to attach >> to Jira or sign an ICLA and commit directly makes no legal difference >> to you or to your employer. >>=20 >> Doug >>=20 >> --------------------------------------------------------------------- >> To unsubscribe, e-mail: = = legal-discuss-unsubscribe@apache.org >> For additional commands, e-mail: = legal-discuss-help@apache.org >>=20 >=20 =20 =20 ------=_NextPart_000_03C6_01CF7081.109695B0 Content-Type: text/html; charset="utf-8" Content-Transfer-Encoding: quoted-printable

Evan,

 

Perhaps a sarcastic = argument from me will point out the silliness of your refusal to sign an = Apache ICLA. Shall Apache users who want your public domain code simply = file a Freedom Of Information Act (FOIA) request to get it and ignore = the ICLA and your department's approval and your participation = altogether?

 

If your software is = truly public domain, then we don't actually need you to give us your = code. =C2=A0It is ours regardless of what mechanism you use to hand it = over to us. [I'm not speaking of government *confidential* code, = so don't worry about my reckless grab!]

 

In that sense, your = lawyers are right. The ICLA is a frivolity for public domain = contributions.

 

But redundant or no, I = believe I can describe Apache's mandatory procedures this way: In order = for any *individual* to become an Apache contributor, *that = person* must sign an ICLA.

 

This is entirely = nondiscriminatory, by the way. I am a lawyer and haven't written a line = of code in years. Yet I signed an ICLA when I got here just like = everybody else. And so my contributions here, such as this email = response, are licensed to Apache =E2=80=93 and hence to you and to the = US government -- under the Apache license. This is true even if my = emails quote US law, as I occasionally do here. The fact that US law = that I cite happens to be public domain is irrelevant. = :-)

 

The ICLA is an = individual requirement for you too if you want to become an Apache = contributor.

 

Your lawyers are making = a mountain out of a molehill. Is yours the only US government department = that objects to Apache's =C2=A0long-held contribution requirements? Or = do we have a bigger problem with US government agencies that we need to = address more broadly?

 

Good luck convincing = your department to follow Apache's procedures and to allow you = personally to contribute =E2=80=93 with an ICLA. I'm certain that this = will serve the national interest in great *open source* software = regardless of your lawyers' concerns about free *public domain* = code of yours that everyone already has rights to. =

 

I'm more than happy to = speak directly with your attorneys without cluttering this list with = legal arguments. I'd like to explain how Apache and many other FOSS = projects have dealt with the "joint work" issue [17 USC 101] = over the years. I might also help them understand why Open Source = Initiative, despite many requests over the years to do so, has so far = refused to certify the "public domain" as an "open source = license." Encourage them to contact me directly if they want = to.

 

/Larry

 

Lawrence = Rosen

Rosenlaw & Einschlag (www.rosenlaw.com) =

3001 King Ranch Road, Ukiah, CA = 95482

Cell: 707-478-8932=C2=A0=C2=A0 = Fax: 707-485-1243

 

From: Evan Ward [mailto:evan.ward@nrl.navy.mil] =
Sent: Wednesday, May 14, 2014 10:02 AM
To: = legal-discuss@apache.org
Subject: Re: ICLA US = Government

 

Larry,

I passed along your message = to our legal department and I've included the response below. They can = provide a more detailed response sometime next week, if you would like = one. From what I understand existing Apache code + my contributions can = be released under the Apache license, but the ICLA specifically = references my contributions, which by themselves can only be released in = the public domain.

Regards,
Evan

On 05/13/2014 05:51 PM, Kerry Broome = wrote:

Essentially we disagree with how they are interpreting = the two citations. The first citation is a memo about government = employees using open source software. It has nothing to do with = government developed software.

 <= /o:p>

In the = second citation, the joint work release specifically says that = =E2=80=9Cthe resulting work is a =E2=80=9Cjoint work=E2=80=9D (see 17 = USC =C2=A7 101) which is partially copyrighted and partially public = domain and =E2=80=9C[t]he resulting joint work as a whole is protected = by the copyrights of the non-government authors and may be released = according to the terms of the original open-source license.=E2=80=9D = However, the ICLA language says that we are granting a copyright = liscense for our portion to them, which we don=E2=80=99t have and cannot = do. I read that statement as Apache would have copyright over a version = of their software with your code, which is correct, but we don=E2=80=99t = agree with the language of the ICLA on how we transfer that software to = them.

 <= /o:p>

The = question above their URL in the FAQ under =E2=80=9CQ: Can government = employees develop software and release it under an open source = license?=E2=80=9D specifically states our position on this. That is, = =E2=80=9CSoftware developed by US federal government employees = (including military personnel) as part of their official duties is not = subject to copyright protection and is considered =E2=80=9Cpublic = domain=E2=80=9D (see 17 USC =C2=A7 105). Public domain software can be = used by anyone for any purpose, and cannot be released under a copyright = license (including typical open source software licenses).=E2=80=9D = That=E2=80=99s essentially what we changed with our modified = ICLA.

 <= /o:p>

Kerry

 <= /o:p>

 

On = 05/06/2014 07:05 PM, Lawrence Rosen = wrote:

Evan Ward <evan.ward@nrl.navy.mil>= wrote:

> After a long review = by my counsel, going many levels above my head, the

> result is still the same: I am not authorized = to sign the Apache ICLA.

> = ...

> If Apache can accept the = public domain ICLA then we can

> put all this behind us and get back to = coding.

 

Evan, I'm confused by this analysis. Even the Chief = Information Officer of the U.S. Department of the Navy doesn't consider = public domain software a form of open source. See the memorandum = entitled "Department = of the Navy Open Source Software Guidance". Here is what it = says about public domain:

 

"Open Source Software: Computer software = that includes source code that can be used and modified by the user; = this software has been copyrighted and includes a license agreement = restricting its use, modification, and distribution. Open Source = Software is software that is copyrighted and licensed under a license = agreement that is not public domain software or freeware. The = Open Source Initiative (OSI) web site (http://opensource.org) contains more = information on open source and open source licenses." (Emphasis by = underlining added.)

 

More = particularly, I also refer your counsel to the DoD Open Source = Software (OSS) FAQ, published by the CIO of the U.S. Department of = Defense, which specifically authorizes government employees to = contribute code to open source software projects under the license(s) = used by the existing project(s). That FAQ explains several ways that the = government's public domain software can be contributed for FOSS, none of = which involve a public domain dedication.

 

I'm = sure the rest of the Apache community will be delighted when we can, as = you say, "put all this behind us and get back to coding." But = it is your lawyers, not ours, who are standing in the = way.

/Larry

 

 

-----Original Message-----
From: Evan Ward [mailto:evan.ward@nrl.navy.mil]=
Sent: Tuesday, May 6, 2014 12:26 PM
To: legal-discuss@apache.org
= Cc: private@commons.apache.org=
Subject: Re: ICLA US Government

 

Hi = All,

 

After a long review by my counsel, going many = levels above my head, the

result = is still the same: I am not authorized to sign the Apache = ICLA.

My agency decided it would = not take the NSA's position that the subtlety

of it was not worth arguing over ("de minimis = non curat lex").

 

I can = still sign the modified ICLA I proposed earlier that puts = all

contributions in the public = domain. It seems contradictory that Apache

projects can include public domain works, but = Apache will not accept a

public = domain ICLA. If I post my public domain work to GitHub and = an

Apache commiter commits it, = then Apache finds that perfectly acceptable.

If I sign an agreement with Apache placing all of = my work in the public

domain and I = commit it directly to Apache, then Apache would reject = it!

Which situation has less risk? = If Apache can accept the public domain

ICLA then we can put all this behind us and get = back to coding.

 

Best = Regards,

Evan

 

On Mon = 07 Apr 2014 11:28:04 AM EDT, Evan Ward wrote:

> 

> Update: Heard back from Daniel Risacher today. = Apparently the NSA had

> the = same concerns we have, but decided not to argue about = subtle

> differences ("de = minimis non curat lex"). Still waiting to hear if = this

> agency will take the = same position.

> 

> Best Regards,

> Evan

> 

> On Thu 27 Mar 2014 03:10:55 PM EDT, Doug = Cutting wrote:

>> 

>> On Thu, Mar 27, 2014 at 6:46 AM, Evan Ward = <evan.ward@nrl.navy.mil>

>> = wrote:

>>> 

>>> As Luc, said I can post the = contributions to github (or JIRA) and make

>>> clear that the project as a whole is = under the Apache License, and my

>>> patches are in the public domain. Then = based on the Apache's legal FAQ

>>> and Larry's earlier comments Apache is = both able and glad to accept the

>>> contributions.

>> 

>> 

>> If you can do this, then you can sign an = ICLA and commit these changes

>> directly. When you attach to Jira, = intentionally submitting to an

>> Apache-licensed project, you agree to the = same terms as the ICLA.

>> = What makes you think these are different?

>> 

>>> 

>>> As I mentioned before, If someone from = Apache wants to talk directly to

>>> the people here with the power to make = a decision, I can provide contact

>>> information.

>> 

>> 

>> You do not need your employer's permission = to sign an ICLA. You need

>> = your employer's permission to contribute software under the = Apache

>> License. Once you = have that permission, whether you choose to attach

>> to Jira or sign an ICLA and commit = directly makes no legal difference

>> to you or to your = employer.

>> 

>> Doug

>> 

>> = ---------------------------------------------------------------------

>> To unsubscribe, e-mail: legal-discuss-unsubscribe= @apache.org

>> = For additional commands, e-mail: legal-discuss-help@apache= .org

>> 

> 

 

 

------=_NextPart_000_03C6_01CF7081.109695B0--