Version 3 of the GNU General Public License: Major Changes for Open Source Software Licensing

The Free Software Foundation ('FSF') this summer published the final, official new version of the GNU General Public License, GPLv3. The new version is the result of extensive public comment and heated debate, and could have far-reaching effects on the use of open source software. GPLv3 is the successor to GPL version 2 (GPLv2), first published in 1991, used extensively today, and among the most popular open source licenses available.

GPLv3's key changes include:

• A new approach to patents, including an explicit patent license and a patent non-assertion clause,
• A new requirement that companies conveying GPL-covered code in 'user products' provide the information necessary to install modified versions on those products (a.k.a. 'anti-tivoization'),
• A new approach to digital rights management ('DRM'), including an express waiver of anti-circumvention rights, and
• New language implementing the GPL's 'viral effect,' affecting when it applies and what is required.

New Terms for Patents

Responding to what it calls the 'unwise and ill-considered application of patent law to software' in the years since it released GPLv2, the FSF includes in GPLv3 provisions focused on patents that address in different ways the patents of: 1) entities that modify or otherwise contribute to software that is covered by the GPL, 2) entities that distribute GPL-covered software (whether or not they also modify or otherwise contribute to the software), and 3) non-contributing, non-distributing entities that enter into patent-related agreements with contributors or distributors. See Free Software Foundation, GPLv3 First Discussion Draft Rationale, p.3, at http://gplv3.fsf.org/gpl-rationale-2006-01-16.html.

1) Contributors: GPLv3 provides that those who modify or otherwise contribute to GPL-covered software and distribute that software are deemed to grant a royalty-free, non-exclusive, worldwide patent license under their 'essential patent claims,' those claims which the contributors own or control that others would infringe if they were to use, make, or sell the software as the GPL permits them to do. See GPLv3, '11 ”1-3. This license is deemed to apply to the entire 'contributor version' of the programs the contributors distribute, not just the portions they contribute. This patent license is a significant change from GPLv2, which had no express patent license and included, at best, only implied rights of uncertain scope and effect.

2) Mere Distributors: GPLv3 also imposes clearer patent non-assertion obligations on those who distribute GPL-covered software, whether or not they also modify or otherwise contribute to it (i.e., mere distributors). Specifically, GPLv3 provides that even mere distributors of GPL-covered software cannot 'initiate litigation … alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing' the software, or any portion of the software. See GPLv3, '10 '3. Unlike contributors, whose required express patent license is deemed perpetual, patent non-assertion by mere distributors is only a condition to continued exercise of their GPL rights. Therefore, mere distributors can escape their non-assertion obligations by ceasing distribution of the GPL-covered code.

3) Third Parties: GPLv3 also seeks to address the patents of patent holders who may not contribute to or distribute GPL-covered software but who enter into patent-related agreements with entities that do. In particular, GPLv3 provides that an entity may not distribute GPL-covered software 'knowingly relying' on a patent license or other patent non-assertion commitment unless, in effect, the distributing entity ensures that the corresponding source code for the software is publicly available free of charge. See GPLv3, at '11 '5. In addition, GPLv3 includes two provisions responding to the open source community's concern about the Microsoft-Novell deal announced in November 2006. See Free Software Foundation, GPLv3 Discussion Draft FAQ, at http://gplv3.fsf.org/dd3-faq (explaining that 'We attack the Microsoft-Novell deal from two angles'). First, GPLv3 provides that if an entity distributes or procures the distribution of GPL-covered software and, in connection with the same transaction or arrangement, grants a patent license or other patent non-assertion commitment with respect to specific copies of the software, then the patent license or non-assertion commitment is deemed extended automatically to every recipient of the software or modifications of the software. See GPLv3, '11 '6. According to the FSF, this provision means that the patent non-assertion covenants extended by Microsoft to Novell's customers in the Microsoft-Novell deal extend to anyone who uses software that Novell provides under GPLv3 (although Microsoft has said in a public statement that it is not subject to GPLv3 and that this provision has no effect on its patents). See Free Software Foundation, GPLv3 Discussion Draft FAQ, at http://gplv3.fsf.org/dd3-faq (stating 'This means that the patent protection Microsoft has extended to Novell's customers would be extended to everyone who uses any software Novell distributes under GPLv3.'); Microsoft, Microsoft Statement About GPLv3, July 5, 2007, at http://www.microsoft.com/presspass/misc/07-05statement.mspx ('Microsoft is not a party to the GPLv3 license and none of its actions are to be misinterpreted as accepting status as a contracting party of GPLv3 or assuming any legal obligations under such license.'). Second, GPLv3 provides that a distributor of GPL-covered software cannot enter into an arrangement with another software vendor under which the other software vendor grants a patent license or other non-assertion commitment to any of the distributor's customers in connection with the GPL-covered software (or primarily for products containing the GPL-covered software) if, as part of the arrangement, the distributor makes payment to the other software vendor based on the 'extent' of the distributor's activity in distributing the GPL-covered software. See GPLv3, '11 '7. This provision has a 'grandfather' provision that makes it inapplicable to the Microsoft-Novell deal itself (or other arrangements entered into before March 28, 2007), but is intended to discourage similar patent arrangements in the future.

'Anti-Tivoization'

GPLv3 also seeks to stop a practice that Richard Stallman, the GPL's original primary author, calls 'tivoization.' Tivoization refers to companies: 1) distributing devices (such as the TiVo digital video recorder) that run GPL-covered software while, 2) providing, as required by GPLv2, access to and copies of the corresponding source code for the software, but 3) using technical means like access keys to prevent users from installing modified code back onto the devices.

GPLv3's anti-tivoization provisions apply only to 'user products' ' e.g., consumer electronics products, the context in which the FSF views 'tivoization' as most problematic. See Free Software Foundation, GPLv3 Third Discussion Draft Rationale, p.10, at http://gplv3.fsf.org/gpl3-dd3-rationale.pdf (noting that earlier drafts applied the anti-tivoization clauses to all hardware sold running GPL covered software). The new provisions require that where a distributor a) conveys GPL-covered software, b) for use in a user product, c) in conjunction with the sale or lease of that product, then d) 'installation information' must accompany the corresponding source code. See GPLv3 '6 ” 3-6. Installation information includes methods, procedures, access keys, and any information required to install and run modified versions of the distributed code in the user product. GPLv3 exempts situations in which no one, including the distributor itself, can install modified code in the user product ' e.g., when the covered code is burned onto a chip and cannot be modified. In addition, for user products that access a network, the distributor retains the right to deny network access to user products running modified code if the 'modification itself' would have a material, adverse effect on operation of the network or violate that network's protocols and rules.

Express Waiver of Anti-Circumvention Rights upon Conveyance

GPLv3 provides that those who distribute GPL-covered software are deemed to waive their rights to prevent circumvention of DRM technology under the DMCA and other countries' similar laws 'to the extent such circumvention is effected by exercising rights under this License with respect to the covered work.' Thus, while GPL-covered software may be used to implement access or copy controls as a technical matter, those who do so are deemed to waive any legal right to prevent circumvention of those controls. GPLv3 also provides that distributors of GPL-covered software disclaim 'any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.' This provision seeks to prevent distributors from using anti-circumvention legal rights to prevent users from modifying GPL-covered code. See GPLv3 '3. The FSF added these terms because it views DRM as a set of 'nasty features' and DRM's widespread use as fundamentally contrary to the free software movement. See Richard Stallman, Why Upgrade to GPL Version 3, at http://gplv3.fsf.org/rms-why.html; see also Free Software Foundation, GPLv3 First Discussion Draft Rationale, p.3, at http://gplv3.fsf.org/gpl-rationale-2006-01-16.html (regarding the FSF's encouragement that users upgrade to the new version).

New Approach to Viral Effect

GPLv3 lays out new terms relating to when software becomes subject to the GPL, i.e., what circumstances trigger the GPL's 'viral effect.' In particular, under GPLv3, the GPL's terms apply to 'modified' works, where the term 'modify' is defined to mean 'copy[ing] from' or 'adapt[ing]' any part of a work licensed under the GPL in such a way that would otherwise require copyright permission, other than making a verbatim copy. See GPLv3, '0. This new terminology departs from GPLv2, which focused on code 'derived' from, 'based' on, or 'containing' code distributed under the GPL. The FSF has suggested that this change in language is not intended to be substantive (rather, the FSF has indicated that the change is part of an effort to 'internationalize' the GPL by moving away from terminology identified with U.S. copyright law), but the change could turn out to be meaningful in some circumstances. See Free Software Foundation, GPLv3 Second Discussion Draft Rationale, p.4 (nn. 7-8), at http://gplv3.fsf.org/gpl3-dd1to2-markup-rationale.ps; Free Software Foundation, GPLv3 Third Discussion Draft Rationale, p. 40 (n. 13), at http://gplv3.fsf.org/gpl3-dd3-rationale.pdf; Free Software Foundation, Opinion on Denationalization of Terminology, at http://gplv3.fsf.org/denationalization-dd2.html.

GPLv3 also introduces the new term 'conveying' to describe, among other things, the activities that bring modified works under the GPL. See GPLv3, '0. To be deemed to have 'conveyed' code, a person must: 1) have 'propagated' the code, i.e., have done something that, without permission, would make the person liable for direct or secondary infringement under applicable copyright law (except executing the code on a computer or modifying a copy privately), and 2) have done so in such a way that enables others to 'make or receive copies.' The FSF has said that 'conveying' is essentially the same as 'distribution' (as understood under U.S. copyright law), but, as with other changes, it remains to be seen whether differences will emerge in application of the new language. See Free Software Foundation, Frequently Asked Questions about the GNU GPL, http://www.gnu.org/licenses/gpl-faq.html#WhyPropagateAndConvey (Question: 'Is 'convey' in GPLv3 the same thing as what GPLv2 means by 'distribute'?' Answer: 'Yes, more or less. During the course of enforcing GPLv2, we learned that some jurisdictions used the word 'distribute' in their own copyright laws, but gave it different meanings. We invented a new term to make our intent clear and avoid any problems that could be caused by these differences.').

The FSF rejected calls for GPLv3 to address the so-called applications service provider ('ASP') 'loophole' and treat software used on an ASP basis as the equivalent of distribution. Instead, GPLv3 specifically excludes from the definition of conveyance '[m]ere interaction with a user through a computer network, with no transfer of a copy.' GPLv3, '0. (As a compromise, the FSF issued a new version of the Affero GPL to address use of software over a computer network.)

Also, recognizing that many enterprise users engage contractors to modify and host software, GPLv3 now gives users explicit permission to 'convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright.' GPLv3, '2. This permission applies only where the contractors make or run the software 'under your direction and control, on terms that
prohibit them from making any copies of your copyrighted material outside their relationship with you.' Moreover, since transmission to contractors (even under these limited circumstances) is characterized as 'conveyance,' this permission does not necessarily allow users of GPL-covered software to treat their contractors as the equivalent of the users' own employees.

Another key change in the new version of the GPL involves what a distributor has to do once software it distributes comes under the license. GPLv3 more clearly defines the requirement to provide 'corresponding source code.' When distributors distribute works containing GPL-covered software, they must provide all the source code necessary to modify the works and to generate, install, and (for executable works) run their object code. That expressly includes providing the source code for any 'shared libraries and dynamically-linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work,' regardless of whether the distributor views such libraries or subprograms as part of the same work.

LGPLv3

The FSF also published a final, official new version of the GNU Lesser (or Library) General Public License.

Implications

The above categories reflect some of the main changes in GPLv3, but other nuances could affect your business. We still do not at this point know how broadly GPLv3 will be adopted. See Richard Stallman, Why Upgrade to GPL Version 3, at http://gplv3.fsf.org/rms-why.html (regarding the FSF's encouragement that users upgrade to the new version). Already, however, the Free Software Found-ation, the Samba Project, and some other key open source copyright holders have adopted GPLv3, and it is clear that many companies have to consider the issues it raises.

William I. Schwartz and Paul E. Jahn are partners, and Aaron P. Rubin is an associate, in the San Francisco office of Morrison & Foerster LLP. The views in this article are their own, not those of their firm or any clients of the firm.

The Free Software Foundation ('FSF') this summer published the final, official new version of the GNU General Public License, GPLv3. The new version is the result of extensive public comment and heated debate, and could have far-reaching effects on the use of open source software. GPLv3 is the successor to GPL version 2 (GPLv2), first published in 1991, used extensively today, and among the most popular open source licenses available.

GPLv3's key changes include:

• A new approach to patents, including an explicit patent license and a patent non-assertion clause,
• A new requirement that companies conveying GPL-covered code in 'user products' provide the information necessary to install modified versions on those products (a.k.a. 'anti-tivoization'),
• A new approach to digital rights management ('DRM'), including an express waiver of anti-circumvention rights, and
• New language implementing the GPL's 'viral effect,' affecting when it applies and what is required.

New Terms for Patents

Responding to what it calls the 'unwise and ill-considered application of patent law to software' in the years since it released GPLv2, the FSF includes in GPLv3 provisions focused on patents that address in different ways the patents of: 1) entities that modify or otherwise contribute to software that is covered by the GPL, 2) entities that distribute GPL-covered software (whether or not they also modify or otherwise contribute to the software), and 3) non-contributing, non-distributing entities that enter into patent-related agreements with contributors or distributors. See Free Software Foundation, GPLv3 First Discussion Draft Rationale, p.3, at http://gplv3.fsf.org/gpl-rationale-2006-01-16.html.

1) Contributors: GPLv3 provides that those who modify or otherwise contribute to GPL-covered software and distribute that software are deemed to grant a royalty-free, non-exclusive, worldwide patent license under their 'essential patent claims,' those claims which the contributors own or control that others would infringe if they were to use, make, or sell the software as the GPL permits them to do. See GPLv3, '11 ”1-3. This license is deemed to apply to the entire 'contributor version' of the programs the contributors distribute, not just the portions they contribute. This patent license is a significant change from GPLv2, which had no express patent license and included, at best, only implied rights of uncertain scope and effect.

2) Mere Distributors: GPLv3 also imposes clearer patent non-assertion obligations on those who distribute GPL-covered software, whether or not they also modify or otherwise contribute to it (i.e., mere distributors). Specifically, GPLv3 provides that even mere distributors of GPL-covered software cannot 'initiate litigation … alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing' the software, or any portion of the software. See GPLv3, '10 '3. Unlike contributors, whose required express patent license is deemed perpetual, patent non-assertion by mere distributors is only a condition to continued exercise of their GPL rights. Therefore, mere distributors can escape their non-assertion obligations by ceasing distribution of the GPL-covered code.

3) Third Parties: GPLv3 also seeks to address the patents of patent holders who may not contribute to or distribute GPL-covered software but who enter into patent-related agreements with entities that do. In particular, GPLv3 provides that an entity may not distribute GPL-covered software 'knowingly relying' on a patent license or other patent non-assertion commitment unless, in effect, the distributing entity ensures that the corresponding source code for the software is publicly available free of charge. See GPLv3, at '11 '5. In addition, GPLv3 includes two provisions responding to the open source community's concern about the Microsoft-Novell deal announced in November 2006. See Free Software Foundation, GPLv3 Discussion Draft FAQ, at http://gplv3.fsf.org/dd3-faq (explaining that 'We attack the Microsoft-Novell deal from two angles'). First, GPLv3 provides that if an entity distributes or procures the distribution of GPL-covered software and, in connection with the same transaction or arrangement, grants a patent license or other patent non-assertion commitment with respect to specific copies of the software, then the patent license or non-assertion commitment is deemed extended automatically to every recipient of the software or modifications of the software. See GPLv3, '11 '6. According to the FSF, this provision means that the patent non-assertion covenants extended by Microsoft to Novell's customers in the Microsoft-Novell deal extend to anyone who uses software that Novell provides under GPLv3 (although Microsoft has said in a public statement that it is not subject to GPLv3 and that this provision has no effect on its patents). See Free Software Foundation, GPLv3 Discussion Draft FAQ, at http://gplv3.fsf.org/dd3-faq (stating 'This means that the patent protection Microsoft has extended to Novell's customers would be extended to everyone who uses any software Novell distributes under GPLv3.'); Microsoft, Microsoft Statement About GPLv3, July 5, 2007, at http://www.microsoft.com/presspass/misc/07-05statement.mspx ('Microsoft is not a party to the GPLv3 license and none of its actions are to be misinterpreted as accepting status as a contracting party of GPLv3 or assuming any legal obligations under such license.'). Second, GPLv3 provides that a distributor of GPL-covered software cannot enter into an arrangement with another software vendor under which the other software vendor grants a patent license or other non-assertion commitment to any of the distributor's customers in connection with the GPL-covered software (or primarily for products containing the GPL-covered software) if, as part of the arrangement, the distributor makes payment to the other software vendor based on the 'extent' of the distributor's activity in distributing the GPL-covered software. See GPLv3, '11 '7. This provision has a 'grandfather' provision that makes it inapplicable to the Microsoft-Novell deal itself (or other arrangements entered into before March 28, 2007), but is intended to discourage similar patent arrangements in the future.

'Anti-Tivoization'

GPLv3 also seeks to stop a practice that Richard Stallman, the GPL's original primary author, calls 'tivoization.' Tivoization refers to companies: 1) distributing devices (such as the TiVo digital video recorder) that run GPL-covered software while, 2) providing, as required by GPLv2, access to and copies of the corresponding source code for the software, but 3) using technical means like access keys to prevent users from installing modified code back onto the devices.

GPLv3's anti-tivoization provisions apply only to 'user products' ' e.g., consumer electronics products, the context in which the FSF views 'tivoization' as most problematic. See Free Software Foundation, GPLv3 Third Discussion Draft Rationale, p.10, at http://gplv3.fsf.org/gpl3-dd3-rationale.pdf (noting that earlier drafts applied the anti-tivoization clauses to all hardware sold running GPL covered software). The new provisions require that where a distributor a) conveys GPL-covered software, b) for use in a user product, c) in conjunction with the sale or lease of that product, then d) 'installation information' must accompany the corresponding source code. See GPLv3 '6 ” 3-6. Installation information includes methods, procedures, access keys, and any information required to install and run modified versions of the distributed code in the user product. GPLv3 exempts situations in which no one, including the distributor itself, can install modified code in the user product ' e.g., when the covered code is burned onto a chip and cannot be modified. In addition, for user products that access a network, the distributor retains the right to deny network access to user products running modified code if the 'modification itself' would have a material, adverse effect on operation of the network or violate that network's protocols and rules.

Express Waiver of Anti-Circumvention Rights upon Conveyance

GPLv3 provides that those who distribute GPL-covered software are deemed to waive their rights to prevent circumvention of DRM technology under the DMCA and other countries' similar laws 'to the extent such circumvention is effected by exercising rights under this License with respect to the covered work.' Thus, while GPL-covered software may be used to implement access or copy controls as a technical matter, those who do so are deemed to waive any legal right to prevent circumvention of those controls. GPLv3 also provides that distributors of GPL-covered software disclaim 'any intention to limit operation or modification of the work as a means of enforcing, against the work's users, your or third parties' legal rights to forbid circumvention of technological measures.' This provision seeks to prevent distributors from using anti-circumvention legal rights to prevent users from modifying GPL-covered code. See GPLv3 '3. The FSF added these terms because it views DRM as a set of 'nasty features' and DRM's widespread use as fundamentally contrary to the free software movement. See Richard Stallman, Why Upgrade to GPL Version 3, at http://gplv3.fsf.org/rms-why.html; see also Free Software Foundation, GPLv3 First Discussion Draft Rationale, p.3, at http://gplv3.fsf.org/gpl-rationale-2006-01-16.html (regarding the FSF's encouragement that users upgrade to the new version).

New Approach to Viral Effect

GPLv3 lays out new terms relating to when software becomes subject to the GPL, i.e., what circumstances trigger the GPL's 'viral effect.' In particular, under GPLv3, the GPL's terms apply to 'modified' works, where the term 'modify' is defined to mean 'copy[ing] from' or 'adapt[ing]' any part of a work licensed under the GPL in such a way that would otherwise require copyright permission, other than making a verbatim copy. See GPLv3, '0. This new terminology departs from GPLv2, which focused on code 'derived' from, 'based' on, or 'containing' code distributed under the GPL. The FSF has suggested that this change in language is not intended to be substantive (rather, the FSF has indicated that the change is part of an effort to 'internationalize' the GPL by moving away from terminology identified with U.S. copyright law), but the change could turn out to be meaningful in some circumstances. See Free Software Foundation, GPLv3 Second Discussion Draft Rationale, p.4 (nn. 7-8), at http://gplv3.fsf.org/gpl3-dd1to2-markup-rationale.ps; Free Software Foundation, GPLv3 Third Discussion Draft Rationale, p. 40 (n. 13), at http://gplv3.fsf.org/gpl3-dd3-rationale.pdf; Free Software Foundation, Opinion on Denationalization of Terminology, at http://gplv3.fsf.org/denationalization-dd2.html.

GPLv3 also introduces the new term 'conveying' to describe, among other things, the activities that bring modified works under the GPL. See GPLv3, '0. To be deemed to have 'conveyed' code, a person must: 1) have 'propagated' the code, i.e., have done something that, without permission, would make the person liable for direct or secondary infringement under applicable copyright law (except executing the code on a computer or modifying a copy privately), and 2) have done so in such a way that enables others to 'make or receive copies.' The FSF has said that 'conveying' is essentially the same as 'distribution' (as understood under U.S. copyright law), but, as with other changes, it remains to be seen whether differences will emerge in application of the new language. See Free Software Foundation, Frequently Asked Questions about the GNU GPL, http://www.gnu.org/licenses/gpl-faq.html#WhyPropagateAndConvey (Question: 'Is 'convey' in GPLv3 the same thing as what GPLv2 means by 'distribute'?' Answer: 'Yes, more or less. During the course of enforcing GPLv2, we learned that some jurisdictions used the word 'distribute' in their own copyright laws, but gave it different meanings. We invented a new term to make our intent clear and avoid any problems that could be caused by these differences.').

The FSF rejected calls for GPLv3 to address the so-called applications service provider ('ASP') 'loophole' and treat software used on an ASP basis as the equivalent of distribution. Instead, GPLv3 specifically excludes from the definition of conveyance '[m]ere interaction with a user through a computer network, with no transfer of a copy.' GPLv3, '0. (As a compromise, the FSF issued a new version of the Affero GPL to address use of software over a computer network.)

Also, recognizing that many enterprise users engage contractors to modify and host software, GPLv3 now gives users explicit permission to 'convey covered works to others for the sole purpose of having them make modifications exclusively for you, or provide you with facilities for running those works, provided that you comply with the terms of this License in conveying all material for which you do not control copyright.' GPLv3, '2. This permission applies only where the contractors make or run the software 'under your direction and control, on terms that
prohibit them from making any copies of your copyrighted material outside their relationship with you.' Moreover, since transmission to contractors (even under these limited circumstances) is characterized as 'conveyance,' this permission does not necessarily allow users of GPL-covered software to treat their contractors as the equivalent of the users' own employees.

Another key change in the new version of the GPL involves what a distributor has to do once software it distributes comes under the license. GPLv3 more clearly defines the requirement to provide 'corresponding source code.' When distributors distribute works containing GPL-covered software, they must provide all the source code necessary to modify the works and to generate, install, and (for executable works) run their object code. That expressly includes providing the source code for any 'shared libraries and dynamically-linked subprograms that the work is specifically designed to require, such as by intimate data communication or control flow between those subprograms and other parts of the work,' regardless of whether the distributor views such libraries or subprograms as part of the same work.

LGPLv3

The FSF also published a final, official new version of the GNU Lesser (or Library) General Public License.

Implications

The above categories reflect some of the main changes in GPLv3, but other nuances could affect your business. We still do not at this point know how broadly GPLv3 will be adopted. See Richard Stallman, Why Upgrade to GPL Version 3, at http://gplv3.fsf.org/rms-why.html (regarding the FSF's encouragement that users upgrade to the new version). Already, however, the Free Software Found-ation, the Samba Project, and some other key open source copyright holders have adopted GPLv3, and it is clear that many companies have to consider the issues it raises.

William I. Schwartz and Paul E. Jahn are partners, and Aaron P. Rubin is an associate, in the San Francisco office of Morrison & Foerster LLP. The views in this article are their own, not those of their firm or any clients of the firm.