When Versata Software sued Ameriprise Financial Services for breaching its software license, it unwittingly unearthed a GPL violation of its own and touched off another lawsuit that could prove to be a leading case on free and open source software licensing. This post takes a look at the legal issues raised by both cases and what they mean for FOSS producers and users.
Versata v. Ameriprise
Versata provides software for the financial services industry and for 13 years had licensed its Distribution Channel Management software (DCM) to Amerprise, which used the software to manage its network of independent financial advisors. A dispute arose between the two companies regarding Ameriprise's use of third-party contractors to produce customizations to DCM. Versata claims the contractors' activities (specifically decompiling Versata's software) were prohibited by the license agreement; Ameriprise claims Versata had approved its use of contractors for years, and was objecting now only to force Ameriprise to Versata's newer, more expensive cloud-based software. Versata sued Ameriprise in Texas state court for breach of the software license agreement (but not for copyright infringement).
During the discovery process, Ameriprise obtained documents from Versata showing that DCM contained third-party free and open source software, including an XML parsing utility called VTD-XML, which is produced by a company called XimpleWare and licensed under GPL version 2. (XimpleWare also offers proprietary licenses to customers who do not wish to apply the GPL to their own software, but Versata did not have a proprietary license to VTD-XML.) Armed with these facts, Ameriprise countersued, alleging that Versata's inclusion of VTD-XML caused the whole of DCM to be licensed under the GPL, and that Ameriprise's modifications and decompilation were consistent with the GPL.
GPL, FUD, and the CDC
Lawyers for commercial software vendors have feared a claim like this for essentially the entire 20-odd-year lifetime of the GPL: a vendor incorporates some GPL-licensed code into a product—maybe naively, maybe willfully—and could be compelled to freely license the entire product as a result. The documents filed by Amerprise in the case reflect this fearful atmosphere, adopting the classically fear-mongering characterization of the GPL as a "viral" license that "infects" its host and "requires it to become open source, too." It's unfortunate that these ideas are still in circulation, even among lawyers who should know better. The "virus" analogy in particular is badly flawed. The GPL isn't communicated invisibly: whether it's used correctly, incorrectly, or not at all is a matter of basic education and diligence. And the likelihood that a court will order a party to release its infringing product under the GPL is exceedingly slim—money damages or an injunction against further distribution are far likelier outcomes.
But for procedural reasons, this won't be the case that settles this issue. When Ameriprise counterclaimed in state court that Versata breached the GPL's copyleft requirement, Versata argued that the claim could not be heard by the court because it was a copyright claim, and the federal Copyright Act preempts any state claim within the Act's ambit. Ameriprise removed the case to federal district court, which took the case up solely to resolve the issue of whether the breach-of-copyleft claim was preempted. The court held that the GPL's copyleft provision imposed an obligation over and above what the Copyright Act requires—an affirmative obligation to provide source, rather than simply an obligation not to copy the software without permission. Because the Copyright Act does not specifically protect the right of a software licensee to receive source code, the court ruled, it does not preempt a claim in state court to enforce that right.
Finding the claim not preempted, and finding no other basis for federal jurisdiction, the federal court remanded the case back to Texas state court. If the case is litigated to final judgment, then, it will have no precedential effect in any federal copyright action.
Revisiting Jacobsen v. Katzer
One inevitable question the district court's ruling raises is how, if at all, it relates to the Federal Circuit's ruling in Jacobsen v. Katzer. Jacobsen held that the breach of a free/open source software license was an infringement of the underlying copyrights if the breach was of a "condition," or a term that "limits the scope" of the license, rather than a "covenant," or a promise made in return for the license. The answer is very important for software producers: if a breach of the license is copyright infringement (i.e., because the provision breached was a condition), the copyright holder can sue in federal court, request an injunction preventing further distribution of the software, and seek statutory damages; if it's merely a breach of contract (i.e., because the relevant provision was a covenant), these remedies are not available to the copyright holder. Jacobsen held that the licensee's obligations in an open source license (specifically the Artistic License, used mainly by the Perl community) are conditions, in part because they are essential to preserving the essential purpose of the license, which is to secure the benefits of downstream development to the original developers.
Despite touching on similar issues, the Versata ruling doesn't say anything about whether the GPL's copyleft provision is a covenant or a condition. Unlike in Jacobsen, Ameriprise does not involve an open source developer suing a licensee. Ameriprise is a licensee of both Versata's software and the third-party GPL-licensed software. Consequently, it couldn't bring a claim for copyright infringement, because it doesn't own any of the copyrights at issue. Rather, Ameriprise claimed that, as a third-party beneficiary of the GPL, it had the right to enforce the GPL's copyleft provision.
XimpleWare v. Versata and Ameriprise
Ameriprise had precious little opportunity to enjoy its clever GPL jujitsu. A few months after Ameriprise brought its counterclaim against Versata, XimpleWare filed a new lawsuit accusing both Versata and Ameriprise of infringing its patents on VTD-XML: Versata, by distributing DCM to Ameriprise in violation of the GPL; and Ameriprise, by providing copies of DCM to independent financial advisors, also in violation.
When is a distribution a 'distribution'?
XimpleWare raises the question of whether, when Ameriprise distributed GPL-licensed software to franchisees, it made a "distribution" under Section 3 of GPLv2 and was therefore required to provide the recipients with source code and the other things the GPL requires. This issue was lightly briefed by the parties for Ameriprise's motion to dismiss, which the judge ruled on in May, but won't be fully resolved until a later stage. Nonetheless, the parties' briefs preview their arguments.
Ameriprise's primary defense is that providing DCM to its independent franchisees was not "distribution," because the recipients—even the independent contractors—were all "personnel" of Ameriprise. The support for this argument is fairly weak. Ameriprise cites two copyright cases where the use of independent contractors was explicitly provided for in the applicable license agreement. GPLv2, by contrast, does not distinguish distribution to independent contractors from distribution to other third parties. Ameriprise also cites a third case which merely states a long-standing principle of patent law, that a license to "make" a patented article includes a license to have that article made by a third party, unless the license explicitly says otherwise. But if Ameriprise breached its license to XimpleWare's copyrights under the GPL, it automatically lost its license to both XimpleWare's copyrights and patents under GPLv2 Section 4. And in any case, Ameriprise doesn't allege that its distribution of DCM to independent advisors was for the purpose of having anything made.
However it comes out, this issue is an important one both for developers and corporate consumers of GPL-licensed software, because it will determine to what extent companies can restrict their contractors' redistribution of GPL-licensed software. For its part, the Free Software Foundation has always maintained that "providing copies to contractors for use off-site is distribution."
Motions to dismiss
Versata's customers all moved to dismiss XimpleWare's infringement claims against them, pointing to Section 0 of GPLv2, which says that "[t]he act of running the Program is not restricted." Because they had not distributed DCM, they argued, they had not breached the license passed on to them by Versata. The judge agreed that XimpleWare had not sufficiently alleged distribution by any Versata customer except Ameriprise and dismissed XimpleWare's direct infringement claims against those customers.
The judge also dismissed XimpleWare's induced and contributory infringement claims against Versata. Both claims require that the defendant be aware of the patents allegedly infringed, but XimpleWare did not claim in its complaint that Versata knew its patents existed. For the same reason, the judge dismissed XimpleWare's claim that Versata's infringement was willful, because "a party cannot be found to have 'willfully' infringed a patent of which the party had no knowledge."
The judge gave XimpleWare leave to amend its complaint, which XimpleWare did, adding allegations that each of the Versata customers worked with third parties who were "beneficiaries of the DCM software," and also that Versata knew of XimpleWare's patents. Whether these new allegations are sufficient to save XimpleWare's claims will depend on the outcome of a new round of motions to dismiss filed last week by the defendants.
A dangerous new issue: Does GPLv2 contain a patent license?
XimpleWare also makes a new, controversial argument in its amended complaint: that regardless of whether Versata's customers distributed VTD-XML in violation of the GPL, they infringed XimpleWare's patents by using the software, because GPLv2 does not grant a patent license-only a copyright license. Several of Versata's customers point out the consequences of this argument in their renewed motion to dismiss:
In essence, XimpleWare is saying that it can entice users to download VTD-XML under the GPL and then immediately sue them from patent infringement. This goes against the letter and the spirit of the GPL.
GPLv2 is one of the most widely used FOSS licenses, if not the most. It is the license for some of the most important and commercially valuable FOSS projects, including the Linux kernel, whose contributors include such uncomfortable bedfellows as Oracle and Google, Intel and AMD, and Cisco and Huawei. If XimpleWare is right, and a license under GPLv2 offers no protection from the licensor's patents, Linux would be a landmine for these companies, and really for any company with fewer patents than IBM.
Even without an explicit patent grant, lawyers advising businesses on FOSS issues generally agree that GPLv2 protects licensees (at least those in compliance with the license terms) from patent suits by licensors. This is because the law provides for an implied license (or judicial estoppel) where a licensor's conduct leads the licensee to believe it will not be sued, or where fairness otherwise demands that the licensor should be prevented from suing. Because the GPL encourages licensees to copy, modify, and distribute the licensed software—all conduct that would infringe any patents on the software absent a license—licensees can reasonably expect that the software's producers won't sue them for doing those things. (Adam Pugh and Laura A. Majerus of Fenwick & West discuss GPLv2's implied patent license in greater detail in this paper.)
United Healthcare Services, one of the Versata customers sued by XimpleWare, states the case for estoppel succinctly in its reply:
Plaintiff chose to distribute its software to the public under the GPL for its own commercial reasons. In so doing, Plaintiff represented to the consuming public that mere use of its software was "not restricted." Plaintiff cannot wish that representation away now that it inconveniences its litigation strategy. Plaintiff's argument's amount to a "bait and switch," seeking to recover payment for mere use that Plaintiff, through its adoption of the GPL, told the world would be unrestricted.
Those who depend on GPLv2 software should watch this case carefully. While XimpleWare's argument is unlikely to succeed, if it did it could fundamentally destabilize the millions of relationships built upon GPLv2, and upon any FOSS license that doesn't contain an explicit patent license.
(More documents from this case are available from RECAP's docket reports for Versata v. Ameriprise and XimpleWare v. Versata.)
23 Comments