Manufacturers of Android mobile devices may soon find themselves struggling to answer searching copyleft licence questions

Recently published data has confirmed that the Android operating system continues to build its market-share lead in the smartphone and mobile device field. It is estimated that, in the second quarter of 2011, Android’s share of the market increased to more than 43% of smartphone sales – some 46 million units worldwide – up from 36% in Q1 2011 and 17 percent in the same period last year.

This makes all the more surprising the serious Android licensing compliance issues recently highlighted by the Free Software Foundation and other free software organisations.

Copyleft in a nutshell

The problems stem from the licence under which part of the Android operating system is distributed, including most notably the Linux kernel upon which Android is founded.

This licence – the GNU General Public Licence version 2 (“GPLv2”) is a free, so-called “copyleft” licence, published by the Free Software Foundation (“FSF”). According to FSF,  the GPLv2 licence is intended to guarantee users freedom to share and change all versions of a program, to make sure that it remains “free” software to all users (note that “free” in this context refers to freedom to reproduce, adapt and distribute the software, rather than to price).

As one would expect, when the software is distributed, the distributor is required to comply with the conditions set forth in the GPLv2 licence itself. Although the full GPLv2 licence is lengthy, the key tenet can be simply stated: if you include code subject to this licence in a larger program, or adapt the code in some way, any subsequent distributions of the code (whether free of charge or commercial) must be subject to the same GPLv2 licence terms. In other words, you must pass on to the recipients the same freedoms that you received. The underlying intention is to give anyone who receives the software both the legal permission and the practical tools necessary to change and share the software themselves if they wish.

Importantly for the present purposes, section 3 of GPLv2 provides that distributors must in practice also:

  • ensure that those in receipt of the software are provided with the “complete corresponding machine-readable source code” behind the software, or receive a written offer to that effect. The obligation to provide source code is personal to each company or person in the supply chain. Manufacturers cannot rely on others to provide the relevant source code; and
  • provide the terms of the GPLv2 licence, in order that those receiving the software know their rights.

One strike and you’re out

The strategy deployed in GPLv2 licence for ensuring compliance is at the same time commendably simple and unusually brutal. Section 4 of the GPLv2 states:

You may not copy, modify, sublicense, or distribute the Program except as expressly provided under this Licence. Any attempt otherwise to copy, modify, sublicense or distribute the Program is void, and will automatically terminate your rights under this Licence. However, parties who have received copies, or rights, from you under this Licence will not have their licences terminated so long as such parties remain in full compliance.

Dissecting this clause, the first sentence refers to all of the obligations that licensees have under GPLv2, including the source code disclosure obligations contained in section 3.  The second sentence imposes a drastic sanction for distributors that fail to comply with all of the licence terms: that non-compliance will automatically terminate their rights under GPLv2.

Worse, it is no excuse for manufacturers to say that they did the right thing 99% of the time, or even for each of the millions of handsets sold bar one. Non-compliance automatically terminates the GPLv2 licence, regardless of whether or not the same manufacturer complies in any future distributions of the same open source software. The licence has been lost to that manufacturer once and for all from the date of the first infringement, and any further act of copying or distribution (regardless of whether those subsequent activities were in compliance with licence) would be without the authors’ permission and hence infringes the authors’ copyright.

In other words, one strike and you’re out. Permanently.

And here’s the most extraordinary point: almost all manufacturers of mobile devices running Android have fallen out of compliance at some point. Very few are able to demonstrate that they have always complied – a point that GPL activists and organisations like FSF are rapidly becoming alive to.

Nervous times for Android device makers

The practical consequences of this problem are potentially huge. The Linux kernel at the heart of Android was written in the early 1990s. Since then, many thousands of individuals have contributed to the development of that code and other software vital to Android’s increasingly sophisticated operation.

Potentially, any one of these thousands of authors could argue that, by a manufacturer losing its original grant of the GPLv2 licence, any subsequent distribution was (and is) unlicensed and hence that manufacturer needs to come to a settlement with him for both past infringements and future rights. In respect of the latter, that agreement would of course only protect the manufacturer in respect of that particular author’s (possibly tiny) contribution. There would still be thousands more individuals with potential causes of action.

If a few of these authors came together to pursue their claims and enforced their rights in unison, it is not difficult to imagine matters rather quickly getting somewhat serious for Android device makers, particularly if FSF or other free software organisations weighed in to support the action.

In some cases, and if the authors complaining were few, it is conceivably possible for manufacturers to replace the code those particular authors contributed. However, this would provide no answer to past infringement, and such replacement might well take longer than the time needed for an aggrieved contributor to seek an injunction preventing further sales.

For new software in the future, FSF has inserted much more forgiving termination provisions for GPL version 3, but that will be no comfort to manufacturers facing the present difficulties who are stuck with devices that have been built around GPLv2 code. In theory, the only safe option for Android device manufacturers appears to be to secure agreement (and a new licence) from each and every contributor over the years.  The sheer logistical effort is unlikely to be appealing, even if it is assumed that all such contributors could be traced. In the absence of such steps, it is difficult to see how manufacturers will answer the claims that seem almost inevitable to arise sooner or later.

It is anyone’s guess how this matter will play out over the coming months and years, but it seems unlikely the issue will simply disappear – much as the manufacturers of Android mobile devices might wish it would.

Lessons to be learned

The fact that large multinationals find themselves facing such serious issues should serve as a salutary lesson for the wider sector. Businesses licensing software incorporating an open source element, however minor, should:

  • take care to fully understand the licence terms upon which that open source code is made available;
  • consider whether those licence terms are appropriate both at the present time and for the future, by which upgrades and developments might mean that your software bears little relation to its current form; and
  • produce a written policy on incorporation of open source software, to ensure that employees understand the issues that must be considered, and the potentially far-reaching consequences if they are not.