ABA Open Source Panel in New York

While much of the open source community was in San Francisco last week at the LinuxWorld Expo , I was in New York at the 2008 Annual Meeting of the American Bar Association (ABA) speaking at the “Life after GPLv3: New Developments in Open Source Software Licensing” event organized by the ABA Section of Intellectual Property Law. My presentation covered an update on the lawsuits filed over the past 12 months by the Software Freedom Law Center (SFLC) on behalf of their clients Erik Andersen and Rob Landley (the two principal developers of the BusyBox open source utility) against Monsoon Multimedia, Xterasys Corporation, High-Gain Antennas, Verizon Communications, Bell Microproducts, Inc., Super Micro Computer, Inc. and Extreme Networks alleging copyright infringement based on a violation of version 2 of the GNU General Public License (GPL) in connection with BusyBox. In addition to discussing the history and resolution of the BusyBox cases (including my involvement with several of the cases), I also highlighted the similarities and differences between these cases and past open source software license enforcement efforts outside of the courts by the Free Software Foundation (FSF) and Harald Welte of gpl-violations.org. The presentation materials are now available online. I understand that the ABA will be posting the materials from the other presenters at the event, as well as a podcast of the entire event, on the ABA website in the coming weeks.

Many thanks to Mark Wittow and Gloria Archuleta, co-charis of ABA IP Section for organizing the event and inviting me to speak. Thanks also to my co-presenters Terry Ilardi of IBM Corporation, Jim Markwith of Microsoft Corporation, and Gabe Holloway of Leonard, Street and Deinard, as well as the moderator of the panel discussion portion of the event, Sue Ross of Fulbright & Jaworski L.L.P.

BusyBox Goes Extreme

Adding to the already substantial list of lawsuits filed on behalf of its clients Erik Andersen and Rob Landley (the two principal developers of the BusyBox open source utility), the The Software Freedom Law Center (SFLC) has announced today the filing of yet another suit alleging copyright infringement based on a violation of version 2 of the GNU General Public License (GPL) in connection with BusyBox.  The current suit has been filed against Ethernet solutions provider Extreme Networks.  As with the previous suits brought by Andersen and Landley (against Monsoon Multimedia, Xterasys Corporation, High-Gain Antennas, Verizon Communications, Bell Microproducts, Inc. and Super Micro Computer, Inc.) , the complaint against Extreme Networks alleges that Extreme makes and sells various products containing firmware in which BusyBox, or a modified version of BusyBox, is included.  Specifically, the complaint names the Summit X450 Series network switches as one of the offending products offered by Extreme.  According to the lawsuit, Extreme continues to distribute this product and others with firmware containing BusyBox without making the source code to BusyBox available in accordance with the terms of the GPL.   As the complaint notes, under the terms of the GPL, Extreme is obligated to provide the source code of the BusyBox software to recipients of products with firmware containing BusyBox.

According to the complaint, Extreme was first notified of the requirements of the GPL as early as July of 2006 by a “third party” who requested a copy of the Busy Box source code.  The complaint further alleges that the SFLC later contacted Extreme in February 2008 on behalf of the BusyBox developers and that the parties have had multiple interactions since that time in an attempt to settle the allegations against Extreme.  The complaint continues, however, that Extreme has failed to respond to the latest notice provided by the SFLC on June 26, thus prompting the lawsuit.  As with the complaints in previous cases, the complaint filed against Extreme  requests that an injunction be issued against the defendant and that damages and litigation costs be awarded to the plaintiffs.

The take away from this latest suit is fairly simple.  As the campaign of lawsuits brought by BusyBox continues to roll forward (and it appears safe to now call it a “campaign”), and as mentioned in connection with the previous BusyBox suits, product vendors (particularly in the wireless and terrestrial networking space) should take note of whether and to what extent the products distributed by their organizations (including products produced by third parties) contain BusyBox or other open source software.  And, as shown by the timeline in this and the other BusyBox cases, those vendors should take seriously any contact from the SFLC or other organizations inquiring about potential violations of the GPL or other open source licenses.

BusyBox is Back, Back Again

The Software Freedom Law Center (SFLC) has announced today that it has filed a new round of lawsuits on behalf of its clients Erik Andersen and Rob Landley (the two principal developers of the BusyBox open source utility) alleging copyright infringement based on a violation of version 2 of the GNU General Public License (GPL). The defendants in the new lawsuits are Bell Microproducts, Inc. (dba “Hammer Storage“) and Super Micro Computer, Inc., each well-established distributors of a wide range of storage and other computer hardware products and components. These two new suits bring the total of lawsuits brought by the SFLC on behalf of the BusyBox developers to six (the previous four having been filed against Monsoon Multimedia, Xterasys Corporation, High-Gain Antennas, and Verizon Communications.

The complaints against Bell Micro and Super Micro were filed on June 10, 2008 in the United States District Court for the Southern District of New York and are available online at — Erik Andersen and Rob Landley v. Bell Microproducts, Inc. d.b.a. Hammer Storage and Erik Andersen and Rob Landley v. Super Micro Computer, Inc. The complaints are similar in many respects to the complaints previously filed by filed in the Monsoon Media, Xterasys, High-Gain and Verizon suits. In each case the complaint alleges that the defendant “makes and sells various communications and hardware devices” containing firmware that contains BusyBox (either directly or in modified form). In the case of Bell Micro, the complaint specifically targets the Bell’s “MyShare HN1200 network attached storage device” and with Super Micro the complaint specifically names the “AOC-SIM1U+ IPMI 2.0 System Management Card“. Under the terms of the GPL, each complaint alleges that the defendant is obligated to provide the source code of the BusyBox software to recipients of the named products containing the firmware containing BusyBox. According to each lawsuit, Bell Micro and Super Micro continue to distribute products containing firmware containing BusyBox without source code in violation of the GPL, despite having been contacted by SFLC. Each complaints seek an injunction against each company and requests that damages and litigation costs be awarded to the plaintiffs.

It remains to be seen if the current cases will be settled out of court (as has happened in each of the prior cases brought by BusyBox to date) or continue on and become the first lawsuit alleging a violation of the GPL ever to go to trial in the U.S. Regardless, these cases signal that after a brief hiatus Eric Andersen and Rob Landley (and the SFLC) appear again to be interested in enforcing the GPL against alleged violators in court rather than pursuing out of court settlements. As mentioned in connection with the previous BusyBox suits, now is the time to take steps to identify whether and to what extent your organization is using BusyBox and other open source software and to ensure that you are in compliance with the open source software licenses applicable to that software.

SFLC Settles With Verizon – Lessons Learned

The Software Freedom Law Center (SFLC) announced on Monday that an agreement has been reached to dismiss the lawsuit brought by Eric Andersen and Rob Landley, the two principal developers of the BusyBox open source software utility, against telecommunications giant Verizon Communications alleging that Verizon violated version 2 of the GNU General Public License (GPL) through the distribution of BusyBox in the firmware of the Actiontec MI424WR wireless router provided by Verizon to customers of Verizon’s “FiOS” fiber-optic Internet and television service. To date Andersen and Landley have also brought and settled similar suits alleging violations of the GPL against Monsoon Multimedia, Xterasys, and High-Gain Antennas. The Verizon settlement marks the end of the last of the suits brought by Andersen and Landley to date.

While the full terms of the settlement were not announced (other than as summarized in the press release issued by the SFLC), the terms appear to track those included in the settlement of the other cases. In particular, in return for reinstating the rights of Actiontec and Verizon to distribute BusyBox under the GPL, Actiontec has agreed to:

– Appoint an Open Source Compliance Officer within its organization to “monitor and ensure GPL compliance”;
– Publish the source code for the version of BusyBox it previously distributed on the Actiontec web site;
– Undertake substantial efforts to notify previous recipients of BusyBox from Actiontec and its customers, including Verizon, of their rights to the software under the GPL; and
– Pay an undisclosed amount of financial consideration to the plaintiffs.

The settlement does appear to be unique from the settlements reached in the other BusyBox cases in at least one respect. Each of the previous settlements (as announced on the SFLC web site) imposed obligations directly on the party named in the lawsuit — this despite the fact that in at least two of the other three BusyBox cases the allegedly offending device was provided to that party by a third party vendor. The settlement in the Verizon case, however, appears to impose obligations directly on Verizon’s third party vendor Actiontec. The reason for this appears to be related to the fact that, while Actiontec was not named as a defendant in the lawsuit, the agreement under which Actiontec provides its MI424WR wireless router to Verizon is rumored to include a clause under which Actiontec agreed to indemnify Verizon for liability relating to claims and lawsuits by third parties against Verizon relating to the router. If accurate, the indemnification clause would help explain why Actiontec (and not Verizon) played a central role in the settlement of the lawsuit against Verizon and appears to have agreed to bear the majority of the obligations under the settlement.

The presence of an indemnification clause in Verizon’s procurement agreement with Actiontec also underscores the value of being proactive in open source (and other) technology procurement measures. Open source compliance measures (and intellectual property and license compliance measures in general) are certainly not uniform across all companies — and companies cannot always depend on their suppliers to be as diligent as they themselves have been in their own compliance efforts. As a result, taking the step of reviewing procurement agreements to help ensure that suppliers of software and other technology agree in advance to stand behind their products and services in the event of an intellectual property infringement, license violation or other issue is an increasingly important practice (and one that appears to have paid dividends for Verizon in their BusyBox lawsuit).

Busy Box Settles Another Case

News today from the Federal District Court for the Southern District of New York that Eric Andersen and Rob Landley, the two principal developers of the BusyBox open source utility, have moved to voluntarily dismiss the case they brought again High-Gain Antennas alleging that High-Gain had violated the GNU General Public License (GPL) by distributing the Busy Box software without complying with the terms of the GPL. The dismissal itself was officially approved by Judge Leonard B. Sand on March 3, 2008. While no press release has yet been issued by the Software Freedom Law Center (SFLC) , the non-profit legal group that represented the Andersen and Landley in the case, the strong presumption in a situation such as this is that the dismissal signals that case against High-Gain Antenna has reach a settlement. To date Andersen and Landley have brought similar suits alleging violations of the GPL against Xterasys Corporation, High-Gain Antennas, and telecommunications giant Verizon Communications. A settlement in the case against High-Gain Antenna would mark the third such settlement leaving only the case against Verizon still pending.

While Busy Box and the SFLC have not brought another suit since filing their case against Verizon back on December 6, 2007, action in the Verizon case looks to be coming soon as Verizon currently has until March 14, 2008 to answer or otherwise respond to the complaint filed against them in the case. It remains to be seen if the case against Verizon will be settled out of court or continue beyond this date and become the first lawsuit alleging a violation of the GPL ever to go to trial in the U.S. Regardless, the cases brought by Busy Box remain significant in demonstrating that open source licensors have the will and the ability to successfully enforce the GPL against alleged violators in court, rather than limiting themselves to pursuing other means of enforcing violations outside of court. What changes these and any future cases drive in the open source license enforcement landscape and open source compliance largely remains to be seen, but for certain they are driving changes. For additional information on the previous settlements, please refer to my prior posts (here, here, here, here, and here).

BusyBox Settlement #2

The Software Freedom Law Center (SFLC) has announced that it has reached an agreement to settle and dismiss the lawsuit filed by Erik Andersen and Rob Landley, two of the principal developers of the popular BusyBox set of open source utilities, against Xterasys Corporation (a manufacturer of wireless routers and other networking products) alleging a violation of version 2 of the GNU General Public License (GPL). This leaves two pending suits by Andersen and Landley, against High-Gain Antennas, LLC (a manufacturer of antennas and other products for use in wireless networking applications) and telecommunications giant Verizon Communications.

As was the case with the settlement with Monsoon Multimedia, Inc., the terms of the Xterasys settlement were not released. However, based on the SFLC press release regarding the settlement, the terms appear to be nearly identical to those in the Monsoon case. While this is yet another case in which we will not see the establishment of binding legal precedent regarding the enforceability and legal interpretation of the GPL here in the U.S. (as has already taken place in Germany), it does appear that we are starting to see the establishment by the SFLC of a de facto precedent for settling cases alleging violations of the GPL. In each of its settlements to date, the SFLC has consistently imposed the following requirements on the defendant:

— The appoint an “Open Source Compliance Officer” to monitor and ensure GPL compliance;

— Publishing of the source code for the version of BusyBox previously distributed in violation of the GPL;

— Undertaking “substantial” efforts to notify previous recipients of BusyBox of their rights to the software under the GPL; and

— The payment of an “undisclosed amount” of financial consideration to the plaintiffs.

Of course, these settlement terms do not carry with them the same legal precedent as would a decision of a court of law. As a practical matter, however, by imposing a consistent set of settlement terms over time, the SFLC has begun to create a sort of standard for resolving future lawsuits alleging violations of the GPL. Defendants in future GPL violation lawsuits (and we are likely to see future suits) will not be legally bound to accept these terms and certainly will be free to attempt to forge their own paths to settlement. However, over time, the terms imposed by the SFLC are likely to represent an increasingly strong lure to those defendants to relatively quickly and cleanly resolve the GPL violation lawsuits against them through an accepted path of least resistance. Not legal precedent, but a strong practical guide for certain.

Stay tuned. The BusyBox cases are driving changes in the open source license enforcement landscape and open source compliance will need to evolve right along with those changes.

BusyBox Gets Busy with Verizon

The Software Freedom Law Center (SFLC) has announced that it has filed yet another lawsuit on behalf of its clients Erik Andersen and Rob Landley (the two principal developers of the BusyBox open source utility) alleging copyright infringement based on a violation of version 2 of the GNU General Public License (GPL). The defendant in this latest lawsuit is Verizon Communications. The lawsuit against Verizon is the fourth in a recent string of suits brough by the SFLC on behalf of Andersen and Landley. However, unlike the previous suits brought against Monsoon Multimedia, Xterasys Corporation and High-Gain Antennas, this suit is the first such suit against a major public company.

The complaint against Verizon was filed December 6, 2007 in the United States District Court for the Southern District of New York and is available online at — Erik Andersen and Rob Landley v. Verizon Communications, Inc. The complaint is similar in many respects to the complaints filed in the Monsoon Media, Xterasys and High-Gain suits, but specifically centers on Verizon’s distribution of a third party product containing the BusyBox open source software utility (as opposed to a product developed by Verizon).  In particular, the complaint against Verizon alleges that Verizon distributes the Actiontec MI424WR wireless router to customers of its “FiOS” fiber-optic Internet and television service and that the router contains the BusyBox software. Under the terms of the GPL, the complaint further alleges that Verizon is obligated to provide the source code of the BusyBox software to recipients of the Actiontec router. According to the lawsuit, Verizon continues to distribute BusyBox without source code in violation of the GPL, despite having been contacted by SFLC. The complaint likewise seeks an injunction against Verizon and requests that damages and litigation costs be awarded to the plaintiffs.

It remains to be seen if the current case against Verizon will be settled out of court (as happened in the case against Monsoon) or continue on and become the first lawsuit alleging a violation of the GPL ever to go to trial in the U.S. Regardless, this case is a highly significant indication that Andersen and Landley (and the SFLC) appear increasingly willing seek to enforce the GPL against alleged violators in court rather than pursuing out of court settlements. As I mentioned in connection with the previous BusyBox suits, now is the time to take steps to identify whether and to what extent your organization is using BusyBox and other open source software and to ensure that you are in compliance with the open source software licenses applicable to that software.