Questioning SCO: A Hard Look at Nebulous Claims

by Eben Moglen ^[*]

Friday 1 August 2003

Users of free software around the world are being pressured to pay The SCO Group, formerly Caldera, on the basis that SCO has “intellectual property” claims against the Linux operating system kernel or other free software that require users to buy a “license” from SCO. Allegations apparently serious have been made in an essentially unserious way: by press release, unaccompanied by evidence that would permit serious judgment of the factual basis for the claims. Firms that make significant use of free software are trying to evaluate the factual and legal basis for the demand. Failure to come forward with evidence of any infringement of SCO's legal rights is suspicious in itself; SCO's public announcement of a decision to pursue users, rather than the authors or distributors of allegedly-infringing free software only increases doubts.

It is impossible to assess the weight of undisclosed evidence. Based on the facts currently known, which are the facts SCO itself has chosen to disclose, a number of very severe questions arise concerning SCO's legal claims. As a lawyer with reasonably extensive experience in free software licensing, I see substantial reason to reject SCO's assertions. What follows isn't legal advice: firms must make their own decisions based upon an assessment of their particular situations through consultation with their own counsel. But I would like to suggest some of the questions that clients and lawyers may want to ask themselves in determining their response to SCO's licensing demands.

Where's the Beef?

What does SCO actually claim belongs to it that someone else has taken or is misusing? Though SCO talks about “intellectual property,” this is a general term that needs specification. SCO has not alleged in any lawsuit or public statement that it holds patents that are being infringed. No trademark claims have been asserted. In its currently-pending lawsuit against IBM, SCO makes allegations of trade secret misappropriation, but it has not threatened to bring such claims against users of the Linux OS kernel, nor can it. It is undisputed that SCO has long distributed the Linux OS kernel itself, under the Free Software Foundation's GNU General Public License (GPL).[1] To claim that one has a trade secret in any material which one is oneself fully publishing under a license that permits unlimited copying and redistribution fails two basic requirements of any trade secret claim: (1) that there is a secret; and (2) that the plaintiff has taken reasonable measures to maintain secrecy.

So SCO's claims against users of the Linux kernel cannot rest on patent, trademark, or trade secret. They can only be copyright claims. Indeed, SCO has recently asserted, in its first specific public statement, that certain versions of the Linux OS kernel, the 2.4 “stable” and 2.5 “development” branches, have since 2001 contained code copied from SCO's Sys V Unix in violation of copyright.[2]

The usual course in copyright infringement disputes is to show the distributor or distributors of the supposedly-infringing work the copyrighted work upon which it infringes. SCO has not done so. It has offered to show third parties, who have no interest in Linux kernel copyrights, certain material under non-disclosure agreements. SCO's press release of July 21 asserts that the code in recent versions of the Linux kernel for symmetric multi-processing violates their copyrights. Contributions of code to the Linux kernel are matters of public record: SMP support in the kernel is predominantly the work of frequent contributors to the kernel employed by Red Hat, Inc. and Intel Corp. Yet SCO has not shown any of its code said to have been copied by those programmers, nor has it brought claims of infringement against their employers. Instead, SCO has demanded that users take licenses. Which lead to the next question.

Why Do Users Need Licenses?

In general, users of copyrighted works do not need licenses. The Copyright Act conveys to copyright holders certain exclusive rights in their works. So far as software is concerned, the rights exclusively granted to the holder are to copy, to modify or make derivative works, and to distribute. Parties who wish to do any of the things that copyright holders are exclusively entitled to do need permission; if they don't have permission, they're infringing. But the Copyright Act doesn't grant the copyright holder the exclusive right to use the work; that would vitiate the basic idea of copyright. One doesn't need a copyright license to read the newspaper, or to listen to recorded music; therefore you can read the newspaper over someone's shoulder or listen to music wafting on the summer breeze even though you haven't paid the copyright holder. Software users are sometimes confused by the prevailing tendency to present software products with contracts under shrinkwrap; in order to use the software one has to accept a contract from the manufacturer. But that's not because copyright law requires such a license.

This is why lawsuits of the form that SCO appears to be threatening—against users of copyrighted works for infringement damages—do not actually happen. Imagine the literary equivalent of SCO's current bluster: Publishing house A alleges that the bestselling novel by Author X topping the charts from Publisher B plagiarizes its own more obscure novel by Author Y. “But,” the chairman of Publisher A announces at a news conference, “we're not suing Author X or Publisher B; we're only suing all the people who bought X's book. They have to pay us for a license to read the book immediately, or we'll come after them.” That doesn't happen, because that's not the law.

But don't users of free software make copies, and need a license for that activity? The Copyright Act contains a special limitation on the exclusive right to copy with respect to software. It does not infringe the copyright holder's exclusive right to copy software for the purpose of executing that software on one machine, or for purposes of maintenance or archiving. Such copying also requires no license. But what if a firm has gotten a single copy of the Linux kernel from some source, and has made many hundreds or thousands of copies for installation on multiple machines? Would it need a license for that purpose? Yes, and it already has one.

Do Users Already Have a License?

The Linux kernel is a computer program that combines copyrighted contributions from tens of thousands of individual programmers and firms. It is published and distributed under the GPL, which gives everyone everywhere permission to copy, modify and distribute the code, so long as all distribution of modified and unmodified copies occurs under the GPL and only the GPL. The GPL requires that everyone receiving executable binaries of GPL'd programs must get the full source code, or an offer for the full source code, and a copy of the license. The GPL specifies that everyone receiving a copy of a GPL'd program receives a license, on GPL terms, from every copyright holder whose work is included in any combined or derived work released under the license.

SCO, it bears repeating, has long distributed the Linux kernel under GPL, and continues to do so as of this writing. It has directly given users copies of the work and copies of the license. SCO cannot argue that people who received a copyrighted work from SCO, with a license allowing them to copy, modify and redistribute, are not permitted to copy, modify and distribute. Those who have received the work under one license from SCO are not required, under any theory, to take another license simply because SCO wishes the license it has already been using had different terms.

In response to this simple fact, some SCO officials have recently argued that there is somehow a difference between their “distribution” of the Linux kernel and “contribution” of their copyrighted code to the kernel, if there is any such code in the work. For this purpose they have quoted section 0 of the GPL, which provides that “This License applies to any program or other work which contains a notice placed by the copyright holder saying it may be distributed under the terms of this General Public License.” The Linux kernel contains such notices in each and every appropriate place in the code; no one has ever denied that the combined work is released under GPL. SCO, as Caldera, has indeed contributed to the Linux kernel, and its contributions are included in modules containing GPL notices. Section 0 of the GPL does not provide SCO some exception to the general rule of the license; it has distributed the Linux kernel under GPL, and it has granted to all the right to copy, modify and distribute the copyrighted material the kernel contains, to the extent that SCO holds such copyrights. SCO cannot argue that its distribution is inadvertent: it has intentionally and commercially distributed Linux for years. It has benefited in its business from the copyrighted originality of tens of thousands of other programmers, and it is now choosing to abuse the trust of the community of which it long formed a part by claiming that its own license doesn't mean what it says. When a copyright holder says “You have one license from me, but I deny that license applies; take another license at a higher price and I'll leave you alone,” what reason is there to expect any better faith in the observance of the second license than there was as to the first?

Conclusion

Users asked to take a license from SCO on the basis of alleged copyright infringement by the distributors of the Linux kernel have a right to ask some tough questions. First, what's the evidence of infringement? What has been copied from SCO copyrighted work? Second, why do I need a copyright license to use the work, regardless of who holds copyright to each part of it? Third, didn't you distribute this work yourself, under a license that allows everyone, including me, to copy, modify and distribute freely? When I downloaded a copy of the work from your FTP site, and you gave me the source code and a copy of the GPL, do you mean that you weren't licensing me all of that source code under GPL, to the extent that it was yours to license? Asking those questions will help firms decide how to evaluate SCO's demands. I hope we shall soon hear some answers.

Footnotes

Linux kernel source under GPL was available from SCO's FTP site as of July 21, 2003.
See SCO Press Release, July 21, 2003.