You are viewing a plain text version of this content. The canonical link for it is here.
Posted to legal-discuss@apache.org by "Karan, Cem F CIV USARMY RDECOM ARL (US)" <ce...@mail.mil> on 2017/09/19 13:19:08 UTC
RE: [Non-DoD Source] Apache Daffodil Incubation Code Donation
> -----Original Message-----
> From: Steve Lawrence [mailto:slawrence@apache.org]
> Sent: Tuesday, September 19, 2017 8:39 AM
> To: legal-discuss@apache.org
> Subject: [Non-DoD Source] Apache Daffodil Incubation Code Donation
>
>
> The Daffodil project recently entered incubation and is currently working
> getting the SGA's/CLA's signed and donating the code to ASF, but
> could use some clarification. For background and a little more detailed
> information on where we are at, we have a thread on
> dev@daffodil.a.o here:
>
> Caution-
> https://lists.apache.org/thread.html/24d7d783e1c748da5a9a42ed12ef908abf4230748080ed54b1d64b7f@%3Cdev.daffodil.apache.org%
> 3E
>
> The quick overview is that we have 4 main contributors, plus some relatively
> minor contributions from other entities.
>
> The main contributors are the National Center for Super Computing
> Applications (NCSA), Tresys Technology, IBM, and Michael Beckerle.
> We are working to get SGA's in place for these entities and we think this
> will cover the majority the the Daffodil codebase.
>
> The other contributors include members of the Navy Research Lab (NRL), the
> Air Force Research Lab (AFRL), and the Department of
> Defense (DoD).
> Our understanding is that these contributions are from the US federal
> government and so are Public Domain. As such, does this mean that
> SGA/CLA's are not required for their contributions? Do the SGA's need to
> mention this? We have since lost contact with these entities so
> getting an SGA in place may require some extra effort/delay if required.
>
> Related to the SGA effort, some files (specifically a library called
> "passera", snippets from the Scala library, and test examples taken from a
> specification) in the Daffodil codebase were not authored by any of the
> above entities, but were included in Daffodil with a permissive
> license like BSD. Since these licenses will not change and will not be
> covered by the SGA's, is there a standard text to clarify that the SGA
> does not cover these files? Does the SGA need to specifically list the files
> need, or is something more broad like "This SGA covers the code
> in the Daffodil git repository located at URL tagged as TAGNAME, excluding
> the passera library, the Scala library, and code examples from
> specification XYZ" sufficient?
Hi, my name is Cem Karan. I work for the Army Research Laboratory, and have
had to deal with issues regarding copyright, etc. as it relates to the US
Government (I cowrote ARL's policy on Open Source at
https://github.com/USArmyResearchLab/ARL-Open-Source-Guidance-and-Instructions/tree/develop).
Note that anything I say here is neither legal advice, nor does it represent
the US Government in any way. I am not a lawyer.
My STRONG suggestion to you is that you contact NFRL, AFRL, and any other
Federal agencies that are donating code to make sure that they've done their
due diligence to get the necessary rights to donate the code. While works
created by Federal employees in the course of their official duties do not
have copyright attached within the jurisdiction of the United States of
America, those works may have copyright attached in foreign jurisdictions[1].
Moreover, works created by non-Federal workers (contractors and such) will
have copyright attached; unless the copyright was assigned to the Federal
Government, or there were adequate clauses in the contracts, the contractors
may still possess rights in the work, and they may wish to assert them[2].
For more on this, you can read through the policy linked to above, or you can
search either for my email address or for "ARL" on the license-discuss
archives at (https://lists.opensource.org/pipermail/license-discuss/). The
discussions go back to about October 2015, so there is a lot to go through.
Thanks,
Cem Karan
[1] I have asked the Justice Department for clarification of this in the past.
The official position is that US Government works do have copyright in foreign
jurisdictions, but the person I talked with was unable to find any case law
supporting this claim. Even if there was case law supporting the position in
one country, a different country could have a different position. I have no
idea how this would affect Open Source or Apache.
[2] The Government sometimes negotiates Government-purpose clauses in
contracts; these ensure that the Government has the necessary rights to use
the work, but it doesn't assign ownership of the copyright to the Government.
Moreover, some contractors negotiate to retain the ownership of the work so
that they can commercialize the code in the private market. If the Government
makes the mistake of donating the code, there may be legal consequences.
Consult competent legal counsel for more on this.
RE: [Non-DoD Source] Apache Daffodil Incubation Code Donation
Posted by "Karan, Cem F CIV USARMY RDECOM ARL (US)" <ce...@mail.mil>.
> -----Original Message-----
> From: Wheeler, David A [mailto:dwheeler@ida.org]
> Sent: Wednesday, September 20, 2017 2:05 PM
> To: legal-discuss@apache.org
> Subject: RE: [Non-DoD Source] Apache Daffodil Incubation Code Donation
>
> David A. Wheeler:
> > > That said, this is not an insurmountable barrier. The NSA (for
> > > example) has already released software as OSS to both the ASF and to
> > > the Linux kernel project, so it's been done before.
>
> Karan, Cem F CIV USARMY RDECOM ARL (US):
> > Was the software written by contractors, or other non-Federal employees?
> > I.e., people whose works will have copyright attached?
>
> (I'm still not a lawyer, but what the heck.)
>
> In some cases the software was written exclusively by US government
> employees as part of their official duties (a "work of the US
> Government"), which is the issue you're focusing on.
>
> Also, a reminder: US law does *NOT* say there is no copyright in works of
> the US government. It just says there is no copyright in the
> United States. Not the same thing. The carve-out is very specific, and
> there'd be no reason to be that specific and thus makes it
> *possible* to claim copyright in other countries.
>
> This isn't just me saying this. The US government *itself* says this:
> "While a U.S. government work is not protectable under U.S. copyright
> laws, the work may be protected under the copyright laws of other
> jurisdictions when used in these jurisdictions. The U.S. government
> may assert copyright outside of the United States for U.S. government
> works." <Caution-https://www.usa.gov/government-works>
>
> I think it's often unwise for the US government to assert copyrights in
> other countries when it can't do so in its own country. In such
> cases, the US government has to go to foreign courts to assert rights that
> *everyone* knows it doesn't have in its own back yard... which
> looks bad to foreign courts. But if the government is asserting copyright
> to make sure the work can be released to everyone, then I can't
> imagine any foreign court complaining.
>
> The weirder problem is when the US government doesn't have copyright, but
> has all the same rights as a copyright holder... then it can't
> transfer rights, but it can license the software any way it wants to. But
> that wasn't what you're focusing on here, so I'll stop on that point.
I agree with you, and I think I've brought up similar points in the past.
> > > One way is for the US government to assert that it holds copyrights
> > overseas (because it
> > > can if it's a work of the US government), and then transfer *those*
> > copyrights.
> >
> > That may cause issues. As far as I know, this is not an official
> > Government position, but I suspect that trying that trick may imply
> > that foreign laws are superior to US law within US jurisdiction.
>
> No one is claiming that foreign laws are superior to US law within US
> jurisdiction, so that would be an irrelevant argument to make. The
> issue here is different.
>
> Copyright law, like almost all other law, is *local* to a jurisdiction. In
> the case of copyright there are treaties and other multilateral
> agreements that cause them to have many similarities between most nations,
> but there's it. It's possible to have copyright within the
> jurisdiction of country 2, and not of country 1, because of differences in
> the two countries' laws and what treaties (if any) are signed.
>
> The US government can, without contradiction, say that "there is no
> copyright in country 1, and there's a copyright in country 2, so I'm
> handing the copyright in country 2 to someone else". Now it's true that if
> there's no copyright in country 1, there's no copyright to hand
> over. But since there *is* a copyright in country 2, so you *can*
> legitimately say you're transferring copyright. I think the Apache
> Software Foundation's documents could be worded more clearly on this point,
> because they don't acknowledge that there might not be a
> copyright in some jurisdictions. But nothing prevents the US government
> from *transferring* copyrights where the US *has* the
> copyright, and since that's all there is, we're done.
That is debatable, and is crux of the problem. I accept the argument that US
Government works may have copyright protections outside of the US, but since
copyright depends on the jurisdiction, I'm not sure if you can transfer
copyright from e.g. Germany into the US. As I understand it (I'm not a
lawyer), both the US and Germany have agreements on how to treat copyrights
from each other (Berne convention), but that is different from saying that the
copyright is attached to the work regardless of the jurisdiction. The nearest
analog I can think of is putting stickers on works; you're saying that the
sticker is permanently attached, my belief is that one country's sticker is
stripped off and replaced at the border by the second country's sticker. In
most cases, the new sticker is similar to original, but it isn't the same.
For USG works, there may not even **be** a sticker to replace the German one.
Another example; German copyright law includes moral rights, which cannot be
transferred to another entity. Do those same moral rights apply when the work
is moved into the US? If I understand the Berne convention correctly, the
only requirement is that the German work be given the same level of protection
it would have had if it were originally created within the US. But US law
doesn't recognize moral rights in copyright, so what happens to the German
moral rights? Do they even exist within the US? The German sticker was
removed and replaced by the US sticker...
> The per-country situation is complex, e.g., see the Wikipedia page <Caution-
> https://en.wikipedia.org/wiki/Wikipedia:Copyright_situations_by_country>.
> E.g., it's unclear what relations exist between the US and Tajikistan
> regarding copyright. But that doesn't prevent the Apache Software
> Foundation from accepting copyright assignments.
>
>
> > Thank you for the link to your article, I've passed it along to our
> > lawyers to read through. I suspect that they'll agree with you that
> > the contract must be reviewed in every case.
>
> :-).
>
> > What encoding are you using for your emails??? Your signature block
> > DEFINITELY got garbled on my end!
>
> It wasn't an encoding issue. My system wants to sign emails, even when I
> don't want it to. Hopefully this email is fine :-).
>
> --- David A. Wheeler
Oh, the wonders of technology... :P
Thanks,
Cem Karan
RE: [Non-DoD Source] Apache Daffodil Incubation Code Donation
Posted by "Wheeler, David A" <dw...@ida.org>.
David A. Wheeler:
> > That said, this is not an insurmountable barrier. The NSA (for example) has
> > already released software as OSS to both the ASF and to the
> > Linux kernel project, so it's been done before.
Karan, Cem F CIV USARMY RDECOM ARL (US):
> Was the software written by contractors, or other non-Federal employees?
> I.e., people whose works will have copyright attached?
(I'm still not a lawyer, but what the heck.)
In some cases the software was written exclusively by US government employees as part of their official duties (a "work of the US Government"), which is the issue you're focusing on.
Also, a reminder: US law does *NOT* say there is no copyright in works of the US government. It just says there is no copyright in the United States. Not the same thing. The carve-out is very specific, and there'd be no reason to be that specific and thus makes it *possible* to claim copyright in other countries.
This isn't just me saying this. The US government *itself* says this: "While a U.S. government work is not protectable under U.S. copyright laws, the work may be protected under the copyright laws of other jurisdictions when used in these jurisdictions. The U.S. government may assert copyright outside of the United States for U.S. government works." <https://www.usa.gov/government-works>
I think it's often unwise for the US government to assert copyrights in other countries when it can't do so in its own country. In such cases, the US government has to go to foreign courts to assert rights that *everyone* knows it doesn't have in its own back yard... which looks bad to foreign courts. But if the government is asserting copyright to make sure the work can be released to everyone, then I can't imagine any foreign court complaining.
The weirder problem is when the US government doesn't have copyright, but has all the same rights as a copyright holder... then it can't transfer rights, but it can license the software any way it wants to. But that wasn't what you're focusing on here, so I'll stop on that point.
> > One way is for the US government to assert that it holds copyrights
> overseas (because it
> > can if it's a work of the US government), and then transfer *those*
> copyrights.
>
> That may cause issues. As far as I know, this is not an official Government
> position, but I suspect that trying that trick may imply that foreign laws are
> superior to US law within US jurisdiction.
No one is claiming that foreign laws are superior to US law within US jurisdiction, so that would be an irrelevant argument to make. The issue here is different.
Copyright law, like almost all other law, is *local* to a jurisdiction. In the case of copyright there are treaties and other multilateral agreements that cause them to have many similarities between most nations, but there's it. It's possible to have copyright within the jurisdiction of country 2, and not of country 1, because of differences in the two countries' laws and what treaties (if any) are signed.
The US government can, without contradiction, say that "there is no copyright in country 1, and there's a copyright in country 2, so I'm handing the copyright in country 2 to someone else". Now it's true that if there's no copyright in country 1, there's no copyright to hand over. But since there *is* a copyright in country 2, so you *can* legitimately say you're transferring copyright. I think the Apache Software Foundation's documents could be worded more clearly on this point, because they don't acknowledge that there might not be a copyright in some jurisdictions. But nothing prevents the US government from *transferring* copyrights where the US *has* the copyright, and since that's all there is, we're done.
The per-country situation is complex, e.g., see the Wikipedia page <https://en.wikipedia.org/wiki/Wikipedia:Copyright_situations_by_country>.
E.g., it's unclear what relations exist between the US and Tajikistan regarding copyright. But that doesn't prevent the Apache Software Foundation from accepting copyright assignments.
> Thank you for the link to your article, I've passed it along to our lawyers to
> read through. I suspect that they'll agree with you that the contract must be
> reviewed in every case.
:-).
> What encoding are you using for your emails??? Your signature block
> DEFINITELY got garbled on my end!
It wasn't an encoding issue. My system wants to sign emails, even when I don't want it to. Hopefully this email is fine :-).
--- David A. Wheeler
---------------------------------------------------------------------
To unsubscribe, e-mail: legal-discuss-unsubscribe@apache.org
For additional commands, e-mail: legal-discuss-help@apache.org
RE: [Non-DoD Source] Apache Daffodil Incubation Code Donation
Posted by "Karan, Cem F CIV USARMY RDECOM ARL (US)" <ce...@mail.mil>.
> -----Original Message-----
> From: Wheeler, David A [mailto:dwheeler@ida.org]
> Sent: Tuesday, September 19, 2017 3:27 PM
> To: legal-discuss@apache.org
> Subject: RE: [Non-DoD Source] Apache Daffodil Incubation Code Donation
>
> Karan, Cem F CIV USARMY RDECOM ARL (US):
> > My STRONG suggestion to you is that you contact NFRL, AFRL, and any
> > other Federal agencies that are donating code to make sure that
> > they've done their due diligence to get the necessary rights to donate the code.
> > While works
> > created by Federal employees in the course of their official duties do
> > not have copyright attached within the jurisdiction of the United
> > States of America, those works may have copyright attached in foreign jurisdictions[1].
>
> The US Government is not *obligated* to assert copyright outside its jurisdiction. Even if it does assert copyright, the US Government can
> (of course) decide to release software under an open source software license if it holds the copyright - just like anyone else.
>
> I do wish the Apache Software Foundation (ASF) would more directly acknowledge that some software doesn't *have* a copyright,
> because this situation always complicates things. I've posted about this before, & noted that other organizations (like the IEEE) make it
> much easier to handle this situation.
>
> That said, this is not an insurmountable barrier. The NSA (for example) has already released software as OSS to both the ASF and to the
> Linux kernel project, so it's been done before.
Was the software written by contractors, or other non-Federal employees? I.e., people whose works will have copyright attached?
> One way is for the US government to assert that it holds copyrights overseas (because it
> can if it's a work of the US government), and then transfer *those* copyrights.
That may cause issues. As far as I know, this is not an official Government position, but I suspect that trying that trick may imply that foreign laws are superior to US law within US jurisdiction. This may upset the US State Department. Again, I haven't contacted anyone within the State Department to see if this is true or not, so at this point it is just something to ask someone about.
> > Moreover, works created by non-Federal workers (contractors and such)
> > will have copyright attached; unless the copyright was assigned to the
> > Federal Government, or there were adequate clauses in the contracts,
> > the contractors may still possess rights in the work, and they may wish to assert them[2].
>
> There can be problems, but much depends on the contract clauses involved, contract amendments, and contracting officer (KO) decisions.
> Even if the contractor possesses rights, that doesn't necessarily limit the US government from releasing the software as open source
> software. It's quite common for both the contractor *and* the US government to have rights in software when the US government pays
> for its development. For example, the default clause used by the Department of Defense (DoD) is DFARS 252.227-7014; in the normal
> case the contractor holds the copyright, but the government has all the same rights as if it were the copyright holder (so it can release the
> software as open source software).
>
> For more detail than you probably want, see my paper: "Publicly Releasing Open Source Software Developed for the U.S. Government" by
> David A. Wheeler, Software Tech News, Volume 14 Number 1, Caution-https://www.csiac.org/journal-article/publicly-releasing-open-
> source-software-developed-for-the-u-s-government/
>
> Caveat: I’m not a lawyer, and I'm certainly not a government lawyer. But I've talked with a lot of lawyers, and painfully drilled down
> details in discussion with them to try to understand what they mean.
>
> --- David A. Wheeler
Thank you for the link to your article, I've passed it along to our lawyers to read through. I suspect that they'll agree with you that the contract must be reviewed in every case.
> B KKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKKCB [ X ܚX KK[XZ[
>
> Y [
> Y\ \ ][ X ܚX P\X K ܙ B ܈Y][ۘ[ [X[ K[XZ[
>
> Y [
> Y\ \ Z[ \X K ܙ B B
What encoding are you using for your emails??? Your signature block DEFINITELY got garbled on my end!
Thanks,
Cem Karan
RE: [Non-DoD Source] Apache Daffodil Incubation Code Donation
Posted by "Wheeler, David A" <dw...@ida.org>.
Karan, Cem F CIV USARMY RDECOM ARL (US):
> My STRONG suggestion to you is that you contact NFRL, AFRL, and any other
> Federal agencies that are donating code to make sure that they've done their
> due diligence to get the necessary rights to donate the code.
> While works
> created by Federal employees in the course of their official duties do not
> have copyright attached within the jurisdiction of the United States of
> America, those works may have copyright attached in foreign jurisdictions[1].
The US Government is not *obligated* to assert copyright outside its jurisdiction. Even if it does assert copyright, the US Government can (of course) decide to release software under an open source software license if it holds the copyright - just like anyone else.
I do wish the Apache Software Foundation (ASF) would more directly acknowledge that some software doesn't *have* a copyright, because this situation always complicates things. I've posted about this before, & noted that other organizations (like the IEEE) make it much easier to handle this situation.
That said, this is not an insurmountable barrier. The NSA (for example) has already released software as OSS to both the ASF and to the Linux kernel project, so it's been done before. One way is for the US government to assert that it holds copyrights overseas (because it can if it's a work of the US government), and then transfer *those* copyrights.
> Moreover, works created by non-Federal workers (contractors and such) will
> have copyright attached; unless the copyright was assigned to the Federal
> Government, or there were adequate clauses in the contracts, the
> contractors may still possess rights in the work, and they may wish to assert them[2].
There can be problems, but much depends on the contract clauses involved, contract amendments, and contracting officer (KO) decisions. Even if the contractor possesses rights, that doesn't necessarily limit the US government from releasing the software as open source software. It's quite common for both the contractor *and* the US government to have rights in software when the US government pays for its development. For example, the default clause used by the Department of Defense (DoD) is DFARS 252.227-7014; in the normal case the contractor holds the copyright, but the government has all the same rights as if it were the copyright holder (so it can release the software as open source software).
For more detail than you probably want, see my paper: "Publicly Releasing Open Source Software Developed for the U.S. Government" by David A. Wheeler, Software Tech News, Volume 14 Number 1, https://www.csiac.org/journal-article/publicly-releasing-open-source-software-developed-for-the-u-s-government/
Caveat: I’m not a lawyer, and I'm certainly not a government lawyer. But I've talked with a lot of lawyers, and painfully drilled down details in discussion with them to try to understand what they mean.
--- David A. Wheeler