Most companies hate being sued, let alone in a groundbreaking lawsuit with national press coverage. But that’s what happened to Monsoon Multimedia. The company, which makes devices that let users to stream video from their home televisions to laptops and cell phones, used the open-source utility BusyBox in some its products. BusyBox is licensed under the GNU Public License (GPL), a widely-deployed license for free software.
Open source licensing is commonly called “copyleft” because it is the opposite of copyright. Under the GPL, it’s legal to use the code, copy it, and modify it at will, but not to distribute modifications without making the source code publicly available — allowing “downstream” programmers to modify the modifications.
The experience of Monsoon Multimedia holds lessons for other small and mid-size businesses that have come to embrace open source code and believe that — because it’s free – there are no legal barriers to using it in products.
Access to source code
Monsoon Multimedia was “not very responsive” earlier this year when developers requested access to its source code, according to Daniel Ravicher, legal director of the Software Freedom Law Center, which represents BusyBox’s developers.
“We sent correspondence on behalf of our clients identifying the issue and asking them to work with us to resolve it,” Ravicher says. “After more than a week, we’d heard nothing. So our clients had no choice but to enlist the aid of the court.”
The BusyBox suit filed in September against Monsoon Multimedia gained immediate attention as the first-ever GPL litigation. Four days after the suit became public, Monsoon announced it would post the source code on its website “within weeks.” “We are confident that the matter will be quickly resolved,” added Graham Radstone, Monsoon Multimedia chairman and COO in a press release.
Maybe — but publishing the source code at this point probably won’t be enough to solve the problem. “Generally speaking, in a case like this, it wouldn’t be wise to settle the matter simply with the defendant now coming into compliance –because that would mean everyone is free to violate the license until caught,” Ravisher notes. Meanwhile, more than a month after the lawsuit was filed, Monsoon Multimedia still had not posted the source code to its site. (Monsoon Multimedia did not respond to requests for comment.)
Don’t let this happen to you
Monsoon Multimedia offers a perfect example of how not to deal with open source software. But how hard is it for other companies to stay on the right side of copyleft?
Not hard at all, it turns out. For one thing, most open source licenses put no restrictions whatever on software used for the company’s internal business. “If you do not compile code or redistribute code as part of you business, you are very safe,” notes Bob Walters, CEO of Untangle, which provides open source software to small and mid-size businesses.
Keep in mind that selling products containing open source is only one of many ways to distribute code, however. Let’s say your developers use open source components to create an application that tracks inventory at your warehouse. Then you give a copy to one or two of your suppliers so they can see when you need to re-order. According to Ravicher, this would count as distributing the software, so you’d need to give the suppliers access to the source code as well.
Staying out of trouble
Even if you are — or think you might be — distributing modified open source software, the steps for staying out of trouble are fairly straightforward:
- Find out what you’re using. Company executives don’t necessarily know what open source code might be in use within their organizations, according to Raven Zachary, open source research director at The 451 Group, a technology industry analyst company. “There can be a disconnect between executive IT and operational IT,” he says. If developers are writing code for your company, you may not know whether they’ve pulled any open source software off the Internet to help them. If you are selling products that contain software of any kind, Ravicher recommends conducting regular audits of the code in those products. “Otherwise, it’s like a restaurant serving food to the public without knowing what the ingredients are,” he says. There are third-party companies who specialize in scanning code for such audits.
- Know your licenses. The GPL is only one of many different open source licenses — and indeed there is more than one version of the GPL. Different licenses have different requirements (there’s one that says to buy the developer a beer if you encounter him in a bar), so make sure you know exactly how your software is licensed and what you have to do to comply.
- Make the source code available. If you are, or think you might be, distributing modifications of open source code, the safest course is to make the source code available to anyone who’s received a copy from you. Posting the code on your website is one easy way to accomplish this, but you may prefer– or some licenses may require you — to supply a copy of the code along with the software.
Above all, don’t let fear of a lawsuit scare you away from open source. After all, Monsoon Multimedia would have a much bigger problem if the code it infringed had been protected by a more traditional copyright, instead of a copyleft license. And open source applications can offer advantages in price and reliability, as well as access to a worldwide network of developers constantly updating the applications for free. “Open source is a great method for distributing software,” Ravicher says.