The GNU General Public License Version 2 (GPLv2) continues to be the most widely used and most important license for free and open source software. Black Duck Software estimates that 16 billion lines of code are licensed under GPLv2. Despite its importance, the GPLv2 has been the subject of very few court decisions, and virtually all of the most important terms of the GPLv2 have not been interpreted by courts.
This lack of court decisions is about to change due to the five interrelated cases arising from a dispute between Versata Software, Inc. ("Versata") (its parent company, Trilogy Development Corporation, is also involved, but Versata is taking the lead) and Ameriprise Financial, Inc. ("Ameriprise"). The courts in two separate cases issued decisions on November 25, just before Thanksgiving.
Aaron Williamson provided an excellent overview of the critical cases in his July 30 post, Lawsuit threatens to break new ground on the GPL and software licensing issues. I suggest you read that post for background. I will summarize, but most of the cases are in the pleading stage, so my summary describes these allegations. For the most part, the courts have not ruled on the allegations.
Ameriprise is in the business of providing financial products to its network of independent financial advisors and receives a commission from the financial advisors. Versata licensed its DCM software to Ameriprise to calculate commissions for the financial advisors. And, Versata agreed to permit Ameriprise to use third-party contractors to modify the DCM software subject to stringent terms. One of those third-party contractors was Infosys Technologies, Ltd. ("Infosys"). Ameriprise, in turn, distributed the DCM software to the third party financial advisors who were its customers to assist in calculating commissions.
Versata claimed that Infosys was using the DCM software not only to develop functions for Ameriprise, but also to develop a competitive product. According to Versata, Ameriprise did not terminate the relationship with Infosys even though Infosys was violating the terms of the license to DCM which permitted Ameriprise to use certain third party consultants. Versata claimed that this failure to terminate Infosys breached the license. Ameriprise denied these claims and raised several defenses, including that Versata violated the DCM license because the DCM software included XimpleWare VTD XML software ("XimpleWare Software") which was licensed under GPLv2. The DCM license stated that Versata had the right to license the DCM software and that it did not include any software that was "encumbered."
The XimpleWare software reads and parses XML and is available under both GPLv2 and commercial licenses. In addition, according to Ameriprise, Versata had failed to comply with the terms of the GPLv2 by failing to include the text of the GPLv2 license, the required copyright notices and a copy of the source code of the XimpleWare Software to its licensees. Consequently, Versata did not have the right to include the XimpleWare Software in its DCM software.
Ameriprise also claimed that the XimpleWare Software was integrated into DCM software in a manner which made all of the DCM software a "derivative work" under the GPLv2, and thus, the DCM software was subject to GPLv2. Ameriprise demanded that Versata make the DCM software available under the GPLv2 and provide the source code of the DCM software to Ameriprise. Ameriprise also reported these violations of the GPLv2 to XimpleWare. XimpleWare then sued Versata, Ameriprise, and other alleged Versata licensees for copyright and patent infringement.
There are now five cases arising from these allegations. Because the cases are interrelated, I am enclosing a brief description of each of them:
1. Versata v. Infosys, Case No. 1:10cv792, U.S. District Court, Western District of Texas.
Versata sued Infosys for breach of contract and copyright infringement. The parties agreed to a dismissal with prejudice in 2014.
2. Versata, Trilogy Software, Inc. and Trilogy Development Group v. Ameriprise, Ameriprise Financial Services, Inc. and American Enterprise Investment Services, Inc., Case No. D-1-GN-12-003588; 53rd Judicial District Court of Travis County, Texas.
This is the original case in which Versata asserted breach of its license for the DCM software with Ameriprise and tried to terminate the license. It also resulted in case 3 in which Ameriprise removed the case to federal court based on Versata’s defense of copyright preemption in this case.
3. Versata v. Ameriprise et al., Case No. 1:14-cv-12, U.S. District Court, Western District of Texas.
Ameriprise removed the case to federal court based on Versata’s defense of copyright preemption in the Texas case. The parties agreed to a dismissal with prejudice in 2014 after the court ruled that the state law claims of Versata in its defense were preempted, but that Ameriprise’s defense based on the GPLv2 was not preempted. The parties agreed to have the case remanded to the Texas state court.
4. XimpleWare v. Versata, Aurea Software Inc., Trilogy Development Group, Inc., Ameriprise Financial Services, Inc., Ameriprise Financial, Inc., United HealthCare Services, Inc., Waddell & Reed, Inc., Aviva USA Corporation, Metropolitan Life Insurance Company, Pacific Life Insurance Company, The Prudential Insurance Company of America, Inc. (subsequently dismissed), Wellmark, Inc., Case No. 5:13cv5161, U.S. District Court, Northern District of California (San Jose).
XimpleWare has sued all defendants for direct patent infringement and declaratory relief and the Versata Defendants for contributory and inducement of patent infringement.
5. XimpleWare v. Versata, Trilogy Development Group, Inc., Ameriprise Financial, Inc., Ameriprise Financial Services, Inc., Aurea Software, Inc., Case No. 3:13cv5160, U.S. District Court, Northern District of California.
XimpleWare has sued the defendants for direct copyright infringement, unjust enrichment, unfair competition, and declaratory relief and sued the Versata Defendants for contributory copyright infringement, violation of the Lanham Act, breach of contract, breach of implied covenant of good faith and fair dealing and international interference with prospective economic advantage.
These cases are dealing with four important terms in the GPLv2:
1. What are the remedies for breach of the terms of the GPLv2?
2. What is a "distribution" under the GPLv2 that triggers the obligations under the GPLv2?
3. Does the GPLv2 include a patent license?
4. What type of integration between proprietary code and GPLv2 licensed code will result in creating a “derivative work” and subject such proprietary code to the terms of the GPLv2?
Copyright decision
The judge in the copyright case brought by XimpleWare against Versata and the Ameriprise entities (Case number 5 above) issued a decision on November 25, 2014, in response to XimpleWare’s motion for a preliminary injunction. XimpleWare had requested a preliminary injunction barring (1) Versata from delivering new copies of the DCM software to its customers or otherwise publishing the DCM and (2) Ameriprise from deploying the DCM to new or existing users.
The court had initially denied a similar motion for a temporary restraining order in the fall of 2013, in part based on representations from Versata that it would replace the XimpleWare software with new code for existing DCM licensees and that it did not anticipate distributing its DCM software to new customers. Based on these representations, the court determined that XimpleWare had not suffered irreparable injury. In response to the motion by XimpleWare, Versata stated that it had provided the patch to all eight of its licensees and installed the patch for four of those customers, but could not represent that it had been installed for the four other customers.
The court ordered that by no later than February 28, 2015, Versata must provide evidence to the court that its patch is commercially installed and functioning for the remaining four customers. This decision reflects the dramatic change in remedies for copyright infringement which was started by the Supreme Court decision in eBay v. MercExchange LLC in 2006: (a patent case) and resulted in the subsequent decision in Ninth Circuit that injunctive relief in copyright cases depended on proving "irreparable injury," and such injury should no longer be presumed in copyright cases Flexible Lifeline Sys., Inc. v. Precision Lift, Inc., 654 F.3d 989, 994 (9th Cir. 2011). Until the Flexible decision, "irreparable injury” was presumed in the case of copyright infringement, and preliminary injunctions were standard remedies for all copyright infringements. However, the court has not yet addressed the issue of the damages payable to XimpleWare for copyright infringement (and violation of the GPLv2) by Versata and other defendants.
This decision is important for open source licensors because it reflects the reluctance of courts to grant injunctive relief in copyright cases even in the case of clear copyright violations.
Patent decision
The judge in the patent case against Versata and its customers (Case number 4 above) issued a decision on November 25, 2014. The second amended complaint by Ximpleware against Versata had alleged direct patent infringement against all of the defendants and contributory and inducement of infringement against Versata and its parent. XimpleWare claimed that both Versata and its customers were liable for direct patent infringement because they had "distributed" the DCM software, including the XimpleWare software, without complying with the GPLv2. (Because Versata was not aware that the DCM software included the XimpleWare software, it is not surprising that the customers were also not aware of the potential GPLv2 obligations.)
The court in its order on May 16, 2014, dismissed the following claims in the first amended complaint: (1) direct infringement against each Customer Defendants (United HealthCare Services, Inc., Waddell & Reed Financial, Inc., Pacific Life Ins. Co., Metropolitan Life Ins. Co., Wellmark, Inc. and Aviva USA Corp); (2) inducement and contributory infringement against the Versata Defendants (the Customer Defendants and the three Versata companies); and (3) that the Versata Defendants’ infringement was willful.
The court noted that the direct patent infringement did not apply because the defendants had a license under the GPLv2 for internal use: "The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program)." And the court further stated that, "Because an express license is a defense to patent infringement, XimpleWare’s direct infringement claims against Versata’s customers turn on whether the customers’ distribution is licensed under the GPL. The reason is that the GPL provides that even if the original licensee—here, one of the Versata entities—breaches its license for whatever reason, third-party customers of that original license retain the right to use XimpleWare’s software so long as the customer does not itself breach the license by 'distributing' XimpleWare’s software without satisfying attendant conditions."
However, the court found that XimpleWare had adequately alleged direct patent infringement against Ameriprise and the Versata Defendants, and denied their motions to dismiss as to the direct infringement claims.
This May decision was very important because it confirms that the structure of the GPLv2 works: Because the GPLv2 is a direct license from the owners of the intellectual property in the software, a violation by one entity in the distribution chain (Versata) does not affect the rights of its customers (the Customer Defendants) unless they separately breach the GPLv2.
In addition, this decision states that "use" of the software is permitted under the GPLv2 which would only be correct if the "right to run" in the GPLv2 includes an implied patent license. "The act of running the Program is not restricted, and the output from the Program is covered only if its contents constitute a work based on the Program (independent of having been made by running the Program)." This conclusion is supported by the court’s statement in footnote 60 of the November 25 decision (described below) in which the court reiterated its holding that licensees had the right to "run" the program if it was not distributed. The court did not reach the issue of whether the GPLv2 provides an implied patent license for the rights other than "use" and this issue remains unresolved.
The May decision gave XimpleWare leave to amend its complaint to provide additional factual allegations relating to its claims about "distribution": "The only real issue to resolve is whether XimpleWare has sufficiently alleged that its software was ‘distributed’ by the customers when they shared the software with their independent contractors, franchisees, and producers."
The November 25 decision found that, once again, XimpleWare had not sufficiently alleged distribution by the Customer Defendants and that its allegations regarding the Versata Defendants for inducement of infringement and contributory infringement were insufficient (Ameriprise and the Versata Defendants did not challenge the other claims). The court also dismissed new claims for declaratory relief. The court once again noted that XimpleWare’s assertion that use alone of the XimpleWare software by the Customer Defendants resulted in patent infringement was wrong because "use" is permitted under the GPLv2: "As use is expressly permitted under the GPL, the court’s conclusion on this point is likewise unchanged: the second amended complaint fails to state a claim for direct infringement against the Customer Defendants based on their use of XimpleWare’s code included in the DCM software."
The court also rejected claims that the "use" of the XimpleWare software for the benefit of third parties violates the GPLv2. Finally, the court rejected XimpleWare’s attempt to add to the second amended complaint for the first time an allegation that the GPLv2 does not grant a patent license to users of the software: Footnote 60 of the decision reiterated the holding in its prior order that "use" was permitted under the GPLv2 and noted that the court had granted limited leave to amend the first amended complaint which did not include leave to assert new claims. Consequently, the important holdings from the May decision remain unchanged.
These cases will continue to provide importance guidance to complying with the GPLv2. By coincidence, two of the most important organizations enforcing the GPLv2 recently provided guidance on GPLv2: on October 30, the Software Freedom Law Center published the second version of their Practical Guide to GPL Compliance, and a few days later, the Software Conservancy and the Free Software Foundation published the first version of their guide, the Copyleft and the GNU General Public License: A Comprehensive Tutorial and Guide.
Anyone who is managing FOSS compliance needs to read these guides and the Versata cases. These developments are particularly important for companies that are distributing software and they should take the following steps:
1. Understand what FOSS is included in your products: Most companies simply don’t know and need to use one of the scanning products, such as Black Duck, Palamida, or fossology.
2. Develop a FOSS use (and management) policy to ensure that you understand your obligations and can comply with them (for an overview of FOSS and FOSS governance, you can listen to my webinar on these issues).
3. Review your distribution agreements to ensure that they take into account any terms imposed by FOSS in your product.
5 Comments