[gentoo-project] GLEP76, legal liability around misrepresentation in copyright, real names, how it's handled at FSF, SFC & at the US copyright office!

[Robin H. Johnson]

(I think I need to have lots more IANAL disclaimers in every paragraph
of this).

I apologize for the late response, but giant threads on the mailing list
have NOT been high on my priority list. I do have some answers for you,
but also further points to make.

Please read on for my inputs about examples of legal liability around
the DCO, as well as how other organizations handle it.

On Tue, Apr 09, 2019 at 08:46:00PM +0000, Gokturk Yuksek wrote:
> Alec Warner:
> > I think it is reasonable to try to pursue a more inclusive policy where
> > identity is more flexible (as I discussed in a different message on this
> > thread), but keep in mind the Council (and really a few key members) spent
> > over a year working on the policy we have; so I'm not certain its a trivial
> > change. You are free to dislike the policy we have and you are free to
> > suggest we pursue a more inclusive policy, but at least here as a trustee
> > who voted for it we made a deliberate choice here and barring some middle
> > ground where we somehow understand that contributions to Gentoo are done in
> > a low-risk way, we will continue to reject commits from obvious
> > contributors.
I would like this part to be heard and followed. I too have personal
objections against publicly disclosing the identity of people who have
genuine reasons to not have that public (In a very recent example, I
have a coworker who can't contribute to open source anymore due to
harassment from a ex-spouse).

At the same time, the steps for another body to REALLY safely shield
their identity are not trivial, and have not really been done in a
sustainable manner before.

I don't LIKE the real name requirement, and I will help pursue a better
policy, but I also object to moving backwards, including the suggestions
of grandfathering in existing developers.

> > What I refuse to engage in is an incessant debate about the policy we have;
> > please accept that we made it in good faith to reduce legal risk for the
> > project and, if an alternative is presented that keeps risk low while
> > accepting a broader set of contributions we will consider it in the same
> > good faith.
If there were some identity escrow service, that provided reliable
pseudonymous identities, and it met the standards of law, while not
exposing further liability issues, I would be VERY happy to use it and
enable more contributions to Gentoo. This IS a hot field of business:
https://securid.ca/ is one local Vancouver startup that I'm personally
aware of looking at the concept (disclaimer: the CEO is a friend, and I
have answered his questions about conceptual ways to protect privacy
within the scope of court-demanded access to data).

> I don't doubt people's good faith in proposing this policy and I'm sure
> it's done with the best interest in mind. I apologize for not doing the
> homework for the following question: did the Foundation pay for any kind
> of legal counsel on this matter?
As the Foundation treasurer, to the best of my knowledge, the Foundation
did not pay for any legal counsel on this matter. I cannot state with
certainty if any Council member or Trustee other than myself consulted
legal counsel (and if they paid for the answer or not).

While at a open source conference, I did informally consult two lawyers
who specialize or previously specialized in the field of open source
licensing. I "paid" each of them with a drink, at my own expense (cash
to the bar, no paper trail), and got 3 different opinions. I did ask
about a formal opinion, but they were NOT willing to issue a full formal
opinion, as it didn't align with their interests at the time.

IANAL, but I will summarize their informal opinions. They did also point
me to written material that was superb:
"Practical Guide to Software Licensing: For Licensees and Licensors",
published by the American Bar Association, ISBN 978-1616328139

> I think one thing most of us struggle
> with is that we are not lawyers. It would help to put people's mind at
> ease if the Foundation consulted a lawyer that clearly explained:
>
> - What exactly is the legal liability being addressed here?
To put a specific concern to words:
- "A" is a legal entity, individual or corporate.
- Work "X" is copyrightable work, with a COMPLETED copyright
  registration held** by "A", in the form of source code.
- Work "X" has NOT been released publicly at all, esp. has not been
  released under an open source license by "A"
- Entity "M" contributes work "X" to Gentoo, claiming terms (a) or (b)
  of the DCO. "M" could be identified, anonymous or pseudonymous (see
  below).
- "A" discovers Gentoo distributing "X", and sues Gentoo for copyright
  infringement.

** "Copyright held": This enters the debate of EU moral rights. Debate
over the semantics of the term is not relevant to this point.
** The copyright registration MUST be completed; there is caselaw

What laws & regulations have been violated here? These are primarily
civil infringements.
This is NOT a complete list, only a potential list.
- 17 U.S.C. § 504(c)(2); Gentoo is an "innocent" copyright infringer:
  https://www.law.cornell.edu/uscode/text/17/504
  "infringer was not aware and had no reason to believe that his or her
  acts constituted an infringement of copyright"
- 17 U.S.C. § 504(c)(2); "M" is a "willful" copyright infringer: they KNEW about the origin &
  license of the work.
- 15 U.S.C. § 1125(a) (Lanham act, section 43(a), "False designations of
  Origin, False Descriptions, and Dilution Forbidden"): 
  Both "Gentoo" and "M" have made false claims. 
- § 525. Liability For Fraudulent Misrepresentation
  http://blogs.kentlaw.iit.edu/perrittcivpro/fraudulent-misrep-rest525-html/
  "M" has fraudulently misrepresented themselves under the DCO.
- Negligent misrepresentation:
  This is where the anonymous/pseudonymous side comes back. Was Gentoo
  negligent by not verifying the identity 

Depending on how much preparation "A" does, their lawyers could start
off just filing lawsuit against Gentoo for the above portions, and later
amending the lawsuit to also include "M"; or naming "M" up-front.

Gentoo could also file lawsuit(s) against "M".

What could the outcomes be? It would come down to penalties as well as
the damages suffered by "A" in the publication of Work "X". 

The one thing you can be certain of is that lawyers and the legal system
will walk away being paid, and somebody else's bank account will be
emptier!


> - Have there been any precedent cases of copyright infringement
> (constrained to the context of copyrighted ebuilds, or code of similar
> nature) to make this a more realistic threat for the Foundation?
In an open source context specifically, not that I'm aware of, or found
in generous searching.

In commercial software, YES, there have been lawsuits claiming copyright
infringement via stolen source code. They sound like they have ALL been
messy.

> - In the case of a potential court case, how is the liability
> distributed among involved parties? Would we be legally required to
> track down the contributor (whose identity we may or may not have
> confirmed yet)?
Yes, the Foundation could be forced to disclose what we know, and/or
share liability that could not otherwise be transferred.

> The reason why I'm suggesting this is because I've talked to a friend of
> mine, who is a software patent lawyer, about the DCO and GLEP. Their
> first impression was that the DCO itself has no clause for requiring a
> legal name, so signing it with a fake name may not violate the DCO
> itself. So the (informal) conclusion is that as long as nobody sues you
> for copyright infringement, there is no legal problem with using a fake
> name to sign the DCO. I know it sounds very obvious but the point is
> that legal people have a better grip of the situation than we do, and
> the community is more likely to take their word and justification for it.
They are correct: the DCO itself doesn't have any clause to that effect.
This is why lawyers can be pedantic about the questions you ask.

In the case of the kernel it's not the DCO specifically that prohibits
pseudonyms or anonymous contributions, it's the tiny line of POLICY just
below it:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst#n462
"using your real name (sorry, no pseudonyms or anonymous contributions.)"

Similarly, GLEP76 is the equivalent Gentoo policy that requires real
names.

Many others have raised that the Foundation can/should/does accept
contributions if the Foundation is itself aware of the real identity of
the contributor.

This DOES have a legal standing:
The Berne Convention does state that anonymous & pseudonymous
copyright is possible. It does not go into an implementation detail
about how to achieve it.

Copyright registration in many countries, even for anonymous &
pseudonymous requires SOME identifying information:
- US & Canadian law don't require the real name registering copyright,
  but they do require you to give a real address and pay registration
  fees. BUT...
- Check out the form: https://www.copyright.gov/forms/formtx.pdf
  Section 2(a) NAME OF AUTHOR is optional
  Section 8 & 9, name and address ARE required.

As such, while the registration itself is anonymous/pseudonymous, the
government DOES know the identity of the copyright registrant.

Other open source organizations DO accept it, but place disclaimers on
it. Besides copyright assignments, CLAs, there are ALSO copyright
enforcement agreements.

The Software Freedom Conservancy has a very good example of this
in the context of their Linux Enforcement Agreement:
https://sfconservancy.org/docs/blank_anonymous-linux-enforcement-agreement.pdf
"The parties acknowldege that Conservancy may be required to disclose
Contributor's identity and participation in the Project in the context of
litigation. Contributor hereby releases Conservancy from any liability
associated with the disclosure of Contributor's identity in the
context of litigation and/or any discussions related hereto."

I believe that their Debian Copyright Enforcement Agreement 
https://sfconservancy.org/news/2015/aug/17/debian/
is available with similar language, but I have not been able to find a
copy of that document.

As dilfridge noted, the FSF also has a process for the work to be known
under a pseudonym: the FSF publishes the pseudonym, but registers under
the real name.
https://www.gnu.org/prep/maintain/html_node/Copyright-Papers.html

This only transfers accountability. The FSF does NOT accept anonymous
contributions. The rest of that link suggests that the FSF also has a
verification process in place that the FSF ensures they have sufficient
legal standing for a copyright assignment, and THEIR process can require
a copy of your employment contract. It doesn't specify if it includes
asking for ID, but it doesn't rule it out either.

The Foundation does know the identity of some past contributors who did
not disclose their identity publicly at the time; some of these
contributors later DID disclose their identity. This pretty much exists
only in old email; and is probably a privacy and GDPR mess (I could
assert it comes under something we are required to hold onto out of
legal need right?)

This comes back to what I said much earlier about an identity escrow
service: the Foundation would not be the holder of the identity
information (and probably shouldn't be).

-- 
Robin Hugh Johnson
Gentoo Linux: Dev, Infra Lead, Foundation Treasurer
E-Mail   : robbat2@g.o
GnuPG FP : 11ACBA4F 4778E3F6 E4EDF38E B27B944E 34884E85
GnuPG FP : 7D0B3CEB E9B85B1F 825BCECF EE05E6F6 A48F6136