Subject: Re: What's the definition of "distribution"?
From: Mark Shewmaker <mark@primefactor.com>
Date: Thu, 20 Jun 2002 15:21:08 -0400

On Thu, Jun 20, 2002 at 03:17:16AM -0400, Jonathan S. Shapiro wrote:
> On Thu, 2002-06-20 at 00:57, Mark Shewmaker wrote:
> > 
> > So does it follow then that one employee providing a copy of Microsoft
> Word
> > for (the additional) use by another employee would not be considered a
> > distribution of Microsoft's code?
> > 
> > If not, why is it a distribution when such a copy is of non-free code
> > but not when such a copy is of GPL'd code?
> 
> Indeed it follows that this is so.
> 
> Your question is misplaced. The Word license is expressed in terms of
> copying, not in terms of distribution. If memory serves me, a single
> entity is permitted to make only one archive copy of Word.
> 
> So the question about "distribution" in the context of Word isn't really
> relevant.

Short version of response:  Woah!  So then Microsoft doesn't have
separate grounds for compliant if you distributed a copy of Word
that you made to a coworker, apart from any complaints they may
have about making the copy in the first place?  Shocking!

Greg Broiles pointed out 17 USC 106, which makes it look as
if it's a distribution either way, but that copyright law doesn't
care about distributions of unmodified works that aren't
"to the public":  (!)

|Sec. 106. - Exclusive rights in copyrighted works
|
|Subject to sections 107 through 121, the owner of copyright under
|this title has the exclusive rights to do and to authorize any of
|the following:
|
|(1) to reproduce the copyrighted work in copies or phonorecords;
|
|(2) to prepare derivative works based upon the copyrighted work;
|
|(3) to distribute copies or phonorecords of the copyrighted work
|    to the public by sale or other transfer of ownership, or by rental,
     ^^^^^^^^^^^^^
|    lease, or lending;
|
|[...]

I hadn't known about the "to the public" restriction in exclusive
rights.

I guess I can see what grounds the folks that say the GPL is not
enforceable among completely-internal-use might be basing their
viewpoints on.  (Though I disagree, as below.)

<sigh>

(It's still a bit weird that there's this "to the public" thing in there.)

However, to get back to the GPL, and to bring up a commonly-pondered-notion,
for modified works under the GPL: 

|2. You may modify your copy or copies of the Program or any portion
|of it, thus forming a work based on the Program, and copy and
|distribute such modifications or work under the terms of Section 1
|above, provided that you also meet all of these conditions:

[...]

|    b) You must cause any work that you distribute or publish, that in
|                               ^^^^^^^^^^^^^^^^^^^
|    whole or in part contains or is derived from the Program or any
|    part thereof, to be licensed as a whole at no charge to all third
|    parties under the terms of this License.  

To me that implies that *at the very least*, that once a work is
distributed from one legal entity to another, that the first entity has
implicitly released its employees from any NDA's associated with the
distributed code itself, as not doing so means that they wouldn't have
caused the work to be licensed ("You may do thus-and-such") to all third
parties (ie, even their employees who might have previously agreed
to not distribute information without permission) at no charge.

However, that section 2(b) requires licenses to all third parties
when works are distributed, not just "distributed to the public",
but just plain "distributed."  Even though copyright law might not
restrict the *private* distribution of *unmodified* copies, GPL section
2(b) looks like it's requiring the licensing (ie, "you may now do
thus-and-such, even if I've previously said you can't") of modified
code when there is any distribution, whether public or not.

To me that looks like it throws a wrench into the whole it's-all-internal-
to-our-company,and-employees-can't-redistribute-it-until-corp-policy-makers-
decide-that-we-will idea, because they can either already publicly
distribute the unmodified GPL'd copies since they can get them from
the outside world anyway, or they can publicly distribute these modified 
copies because the GPL would require their employer to implicitly
give them permission to, in order for their employer to have the GPL's
permission to internally, non-publicly, distribute the modified code
in the first place.

I've always wondered how that sort of situation would work out legally,
if it ever became a real legal issue.

(Though in practice the social pariah effect of rudely taking advantage
of such an ability, if it exists, is probably enough to dissuade folks
from doing such.  An FSB can likely be dependent on collaboration with
another group being temporarily secret, so an employee that reveals
internal work, even if he has the legal right to do so, may not be
thought of as the best team player internally or externally.  I've
wondered if the reason that we never hear of this sort of legal argument
being decided upon by a court is that the likely social repercussions are
a sufficient deterrent.  Even the GPL IMHO shouldn't have the right to
restrict a friendly, non-binding "would you please not redistribute
my security patches to xxx until I've properly tested them myself and
notified and discussed them with the project maintainer" limitation
that's based more on social niceties than on legal rights.)

 -Mark Shewmaker
  mark@primefactor.com