Subject: Re: JBoss aquired by Red Hat
From: simo <s@ssimo.org>
Date: Sun, 30 Apr 2006 00:49:38 -0400

On Sat, 2006-04-29 at 19:06 -0700, Thomas Lord wrote:
> On the question of what happens if Consultant distributes a
> modified work to Customer under an NDA:
> 
> Richard Stallman wrote:
> >       2. I will have distributed a modified work under a license
> > 	 that is not necessarily valid for all third parties.
> >
> > I don't see how.
> >
> >   
> 
> While I am not a lawyer, I will try presenting it in (roughly) legal
> vocabulary so that you can ask for your council to comment
> on it.

Thomas,
to understand why you got it wrong you must pay attention on the fact
that distribution is one way, and that matters. The distributor and the
recipient have different obligations and rights under the GPL. And the
original author has no obligations, he can use it's own code as he wish
(of course if he want to combine his own work with that of others he
will have to agree a license with them before he can distribute the
derived work, but that license apply only to the derived work and only
for the recipient of the derived work, not for the author on his own
code).


> Step 1:  Consultant obtains a distribution of a program under
>              the GPL and modifies it, creating  The Derived Work.
> 
> Step 2:  Consultant distributes The Derived Work to Customer
>              under an NDA, promising to distribute The Derived
>              Work to nobody else (treating The Derived Work as a
>               trade secret of Customer).
> 
> Step 3: Consultant breaks the NDA agreement and distributes a
>              copy to an innocent third party.   Quickly, several other
>              other innocent third parties receive distributions from
>              earlier innocent third parties.
> 
> Step 4: Customer notices this and tracks down all innocent third
>              parties, noticing them that they are in possession of a trade
>              secret.

Step 4 is wrong. Customer just sue the Consultant for the breach of the
NDA and that's all.

> Consequences:
> 
> a) Consultant is in a hell of a lot of hot water.  Duh.

Sure, he broke a contract, must be a stupid and unprofessional
consultant to do that.

> b) The innocent third parties may no longer use or further
>      distribute the software unless they make a special deal
>      with Customer.

No, the third party has received the work under the GPL, which the
author agreed to adopt as he made a derivative work of a GPLed program.
The customer does not own any copyright (unless the consultant also
transferred the copyright in which case he violated the NDA and also the
copyright of customer which may decide to keep any modification for it's
own internal use).

> All of that, as far as I know, is settled law.   Consequence (b)
> has further implications:

As far as I can see you got it wrong, sorry.

> Because of (b), the program is no longer licensed to the formerly
> innocent third parties under the GPL.

I don't see how you infer this.

> Therefore, Consultant has failed to cause the The Derived Work
> to be licensed to all third parties under the terms of the GPL.

Neither this.

> Therefore, by clause 2(b) of the GPL, Consultant had no right
> to distribute The Derived Work to Customer in the first place.

The consultant can distribute the work to Consultant _only_ under the
GPL. The NDA between Customer and Consultant is not about the
distribution Consultant->Customer so the GPL has nothing to do with that
NDA and viceversa.

> It may be true that Consultant had no right to distribute
> to the first innocent third party.  But the consequences
> of her having done so prove that she *also* had no right
> to distribute to Customer.

NO, the consequences are only a breach of contract with Customer, the
license of the code is always the GPL without any doubt.

> -----------------------------------
> 
> Now one question is, did the Consultant have no right to
> distribute The Derived Work to the Customer in the first
> place only because the Consultant himself then broke the
> NDA?

The Consultant can only distribute the work under the GPL.
The NDA is about Consultant not distributing his own work to anybody
else. These are 2 separate things.

> Not at all.   Customer's employee X might have been the
> one who passed the program on to innocent third parties.

In this case is Customer employee X that is in troubles, and Consultant
has no problems at all, as he did't break the NDA.

> The outcome is still the same:  innocent third parties have
> received distributions under the GPL only to have their GPL
> rights invalidated.  _Consultant_ has failed to satisfy 2(b) of
> the GPL.

Again no, Consultant has no obligations over it's own code under the
GPL.

> Distributing a modified form of a GPLed program under
> an NDA violates the GPL, pure and simple.

No, it depends on who is the subject of the NDA.
If the subject is the author, the GPL don't, and more importantly can't,
say anything, because copyright is about regulating distribution and
copy, not about ownership or detention or use.

Simo.