Saturday, January 21, 2006

Dissecting GPLv3: Part I

The Free Software Foundation (I've linked to them from my side bar since this blog's inception) has finally released it's draft copy of the GNU General Public License Version 3. The FOSS community has been using GPLv2 since June of 1991. But as the software world has changed the critics of v2 became louder and louder, calling for a new license to meet today's technical and legal reality. Over the next month I plan on posting a series of comments on various new (or substantially altered) sections of v3.

Today I want to discuss the meaning and ramifications of Section 3 "Digital Restrictions Management." First, not the clever turn of acronyms here. DRM usually means "Digital Rights Management" but since the FSF is no friend of that kind of technology, they've switch Rights with Restrictions which I'll remind all you non-legal folks are necessary opposites. Anytime someone has a right, everyone else has an equal and opposite restriction. My right to speak means everyone else has a restriction on their ability to not have me speak. So, tip-of-the-hate to FSF for playing word games... now on to the meat of the section.

It breaks down into three sections which I'll will discuss in order.
As a free software license, this License intrinsically disfavors technical attempts to restrict users' freedom to copy, modify, and share copyrighted works. Each of its provisions shall be interpreted in light of this specific declaration of the licensor's intent.
This language has a curious legal impact that really won't be fully understood until the GPLv3 is litigated. Essentially, anytime there is ambiguity in language the parties can refer to this language for assistance in determining meaning. But it's also somewhat precatory in nature because the intent stuff only comes into play when there is honest ambiguity. If the license is clear, a party cannot come back in and say that the grant in question does not conform with this intent section. Tough luck. Clear grants cannot be overridden by even the clearest of intents. If the intent was so strong, they should have built it into the grants themselves.

The next section is part of the same paragraph as the first section. It reads.
Regardless of any other provision of this License, no permission is given to distribute covered works that illegally invade users' privacy, nor for modes of distribution that deny users that run covered works the full exercise of the legal rights granted by this License.
So, the first bit about denying permission to illegally invade users' privacy is interesting. It is tying rights granted by the license to the particular jurisdiction in which it is being used. So, permission is not granted if the software is a keylogger and used in a jurisdiction where such things are illegal... but just fine in a different jurisdiction. Strange. Doubly strange because what is, and is not, illegal is a decision for governments, groups that FSF has traditional spurned. It also creates great potential for legal confusion, because what makes something an illegal invasion of privacy as opposed to an illegal invasion of trust (a.k.a a fraud claim). Add in legal complexity of common law and you just asking for trouble.

On a philosophical level, I think I disagree with this provision. If the invasion is illegal than the courts will take care of it. Otherwise, I personally subscribe to the theory that use of technology should not be limited by its creators. The user should be the one who decides. BitTorrent is a great example here. BitTorrent can, and is, used for massive copyright violations. Should the developers prohibit such use in the license? No. The user should be the one who decide what activities they chose to engage in. By inserting this privacy language into the GPL, the FSF is saying that it will take the moral burden of protecting privacy, but leaves all other illegal activities in the hands of the users. The positions are inconsistent and blow holes in the argument that developers should not be liable for the illegal acts committed by their users.

The last section I agree with, but it took some careful reading. Here's the language.
No covered work constitutes part of an effective technological protection measure: that is to say, distribution of a covered work as part of a system to generate or access certain data constitutes general permission at least for development, distribution and use, under this License, of other software capable of accessing the same data.
Let's break this down into it's parts. The first sentence is in reference to the DMCA and we'll get to that in a moment, so put that aside and focus on everything after the colon. If I "distribute a covered work" (which means giving someone else a GPLed program) and that work is "part of a a system to generate or access certain data" (meaning the work controls access to copyrighted work, like how iTunes allows you access the iTunes Music Store) then I have given "general permission" to "develop, distribute, and use... other software capable of accessing the same data" (so, if iTunes was license under the GPL, then I would be allowed to develop software that could also access the iTunes Music Store).

Thought of it another context, WestLaw is a sophisticated legal database protected by technical measures. Because it's a database of essentially public domain documents, there is little (possible no) copyright protection. So, if WestLaw uses GPLed software in its access software, then other GPL developers can write software to access the WestLaw database and do so without fear of reprisal.

Such protection is necessary because of the Digital Millennium Copyright Act (DMCA) which makes it against the law to circumvent a "Technical Measure." This clause of the GPL waives a copyright holders DMCA rights to protect their TMs if they chose to use GPLed software. It's a fair trade in my mind. No one is required to use FOSS software, but if you are, then your contributions back to the system need to be usable by others. WestLaw might contribute all sorts of code, but if it remains illegal to use that code to access its databases, then its useful contribution is zero.

Expect more about the GPLv3 as the weeks go on... some earlier sections are still too confusing, and I'm not done reading the whole thing, so there should be lots to talk about.

No comments: