[vox] What is GPL "Distribution"?

[Jeff Newmiller]

On Tue, 10 Jun 2003, Mike Simons wrote:

> This is a legalish question about the GPL...

#include <std-disclaimer>  // IANAL

>   I don't expect to find an answer here but the risk that someone here will
> know the answer is much better me finding useful discussion on google
> (GPL+distribution hits about 360,000 documents).
>
>   I'm looking for a good place to ask this, if it's in a FAQ, or
> if some place already did a a discussion about this.
>
>
>   The questions centers on the definition of "distribution"... a company is
> free to modify a GPL'd program and not release the source provided that
> they do not "distribute"... So modified versions of the program can
> be used a company website or servers without releasing the code without
> a them needing to release their changes, paid subscriptions to the
> service could even be required to use.
>
> - Now what if the machine that company hosts the website on is wholly
>   owned by the co-location facility that hosts the machine (only being
>   rented by the company which made changes)?
> - What if the company develops all of their software with sub-contractors
>   who do the work on their own personal machines at home?
> - Is the transportation of the GPL'd code or binaries to those two places
>   "distribution" as far as the GPL is concerned?
>
> ...depending on how you look at it it is boarder line.

Or, depending on the circumstances of the purported transfer.

I am not sure these situations tweak the possibilities thoroughly
enough.  How about (all hypothetical, of course...):

 a) My company asks me to install a kiosk in our front lobby.  I modify
    GPL code to get it working.  Is physical access to a device
    implemented with GPL'd tools by the public considered "distribution"?

 b) My company wants to lease a hardware device with embedded firmware to
    customers ... they do not have the option to buy.  Again GPL software
    is involved. Is physical colocation on the customer premises
    "distribution"?

 c) My company leases a building for me to work in.  Is the GPL software I
    use being "distributed" to the owners of the building?

Option (c) is a little silly, but is intended to provide a frame of
reference for reviewing the colo example you gave... namely, that the
purported transfer has to be in a context that legally includes the
software.

The GPL2 states:

   Activities other than copying, distribution and modification are not
   covered by this License; they are outside its scope.  The act of
   running the Program is not restricted, and the output from the Program
   is covered only if its contents constitute a work based on the
   Program (independent of having been made by running the Program).
   Whether that is true depends on what the Program does.

Sentence 2 supports the idea that providing access to the kiosk (a) does
not constitute distribution.

Option (c) arguably involves no transfer... the media and hardware
associated with the software are not part of the building, and the
building owner had no direct involvement with the software.

Option (b) may involve transfer in the same way certain subcontractors are
considered to have transferred from "contractor" status to "employee
ststus" for tax purposes when their work environment is controlled by
their client.  If the devices never interact with the client and only
communicate with the leasing company, then I believe no transfer of
software has occurred.  However, if there is a local user interface for
the client, then the client may regard the devices as "theirs" (though the
leasing company would dispute that) and thereby claim that transfer had
occured.  This is also akin to the typical practice of proprietary
software vendors granting license for the use of their software, and would
seem to be balanced on the edge of the legal definition of "distribution"
(requiring a court to decide the issue).

(I think a well designed option (b) gizmo should be able to segment the
proprietary from the GPL portions, and be able to distribute the GPL
portions as specified in the GPL, though it may not be much good to them
without the proprietary portions.)

>
>
>   While writing this I got the idea to check for "GPL FAQ"... which
> came up with something useful.
>
>   http://www.gnu.org/copyleft/gpl-faq.html

>   A block of items in the FAQ near to this seem to cover the question...
>
>   http://www.gnu.org/copyleft/gpl-faq.html#TOCUnreleasedMods
> ====
> A company is running a modified version of a GPL'ed program on a web
> site. Does the GPL say they must release their modified sources?
>
>     The GPL permits anyone to make a modified version and use it
>     without ever distributing it to others. What this company is doing
>     is a special case of that. Therefore, the company does not have to
>     release the modified sources.
>
>     It is essential for people to have the freedom to make
>     modifications and use them privately, without ever publishing those
>     modifications. However, putting the program on a server machine
>     for the public to talk to is hardly "private" use, so it would be
>     legitimate to require release of the source code in that special
>     case. We are thinking about doing something like this in GPL version
>     3, but we don't have precise wording in mind yet.

That is, the answer is "no" but the authors don't like that answer.

>
>     In the mean time, you might want to use the Affero GPL for programs
>     designed for network server use
>
>
> Is making and using multiple copies within one organization or company
> "distribution"?
>
>     No, in that case the organization is just making the copies for
>     itself. As a consequence, a company or other organization can
>     develop a modified version and install that version through its
>     own facilities, without giving the staff permission to release that
>     modified version to outsiders.
>
>     However, when the organization transfers copies to other organizations
>     or individuals, that is distribution. In particular, providing copies
>     to contractors for use off-site is distribution.
> ===
>
>
>   There may still a little wiggle room for "distribution" to a rented
> co-location machine... but doesn't seem like much.  Comments?

(IANAL) I think that as long as the colo machine does not provide the use
of these modified sources to anyone outside the organization that modified
the source, providing the functionality of that software to the public is
covered by the paragraph of the GPL2 quoted earlier.  The sticky point is
whether the colo box is shared with others who can and do configure that
program for their own purposes.  That is, if you add "proprietary feature
x" to Apache on the colo box, and someone else uses the feature in their
virtual website, then transfer has occurred.  Unfortunately, since no
definition of transfer is provided in the GPL, the courts will probably
have to sort it out.

---------------------------------------------------------------------------
Jeff Newmiller                        The     .....       .....  Go Live...
DCN:<jdnewmil@dcn.davis.ca.us>        Basics: ##.#.       ##.#.  Live Go...
Work:<JeffN@endecon.com>              Live:   OO#.. Dead: OO#..  Playing
Research Engineer (Solar/Batteries            O.O#.       #.O#.  with
/Software/Embedded Controllers)               .OO#.       .OO#.  rocks...2k
---------------------------------------------------------------------------