Linux Today: Linux News On Internet Time.
Search Linux Today
Linux News Sections:  Developer -  High Performance -  Infrastructure -  IT Management -  Security -  Storage -
Linux Today Navigation
LT Home
Contribute
Contribute
Link to Us
Linux Jobs


Top White Papers

More on LinuxToday


The APSL and Export Controls

Mar 27, 1999, 18:42 (2 Talkback[s])
(Other stories by Seth David Schoen)

The Open Source Definition and licenses that help implement national laws

by Seth David Schoen

Apple says:

Q. Does the Apple Public Source License qualify as an Open Source license?

Yes, the Open Source Initiative has determined that the Apple Public Source License is conformant to the "Open Source Definition:" http://www.opensource.org/osd.html.

The Apple Public Source License (APSL), version 1.0, says:
13.1 Export Law Assurances. You may not use or otherwise export or re-export the Original Code except as authorized by United States law and the laws of the jurisdiction in which the Original Code was obtained. In particular, but without limitation, the Original Code may not be exported or re-exported (a) into (or to a national or resident of) any U.S. embargoed country or (b) to anyone on the U.S. Treasury Department's list of Specially Designated Nationals or the U.S. Department of Commerce's Table of Denial Orders. By using the Original Code, You represent and warrant that You are not located in, under control of, or a national or resident of any such country or on any such list.
The Open Source Definition (OSD), version 1.0, says:
5. No Discrimination Against Persons or Groups.

The license must not discriminate against any person or group of persons.

I can't understand how all three of these things can be true at the same time. The APSL requires licensees to
warrant and represent that [they] are not located in, under control of, or a national or resident of any such country or any such list
-- but, since many persons and groups of persons cannot (truthfully) do that, the APSL discriminates against all of them. Therefore, as I see it, the APSL is not an Open Source license and the Open Source Initiative (OSI) should reconsider its decision about the current version of the APSL, asking Apple to fix this problem with its license.

I have had many discussions with people over the OSD and national export controls. I would be curious to learn the OSI's position on this subject.

My position is this:

"Must not discriminate" in the OSD should really mean "must not discriminate". Incorporating provisions of legislation which discriminates against any person or group of persons into a license means that the license necessarily itself discriminates against a person or group of persons, and is therefore not an Open Source license. The fact that discrimination is motivated by a government regulation or recommendation does not mean that it is not discrimination, and therefore does not mean that it ought to be sanctioned by the OSI. The fact that the license is prima facie discriminatory is readily acknowledged by Apple:

Q: Are there restrictions on the international use of the source code?

Yes. Export control laws may apply to certain portions of the source code and must be complied with.

"[M]ust be complied with"? Quo warranto? Certainly these laws "must be complied with" according to the Bureau of Export Administration (BXA), but we are also given to believe that these laws "must be complied with" according to Apple!

Further, since Open Source licenses do not necessarily require that a work be distributed to every person who requests it, the original distributor of a piece of Open Source software is free to follow local law by refraining from distributing the software directly to persons who are forbidden to receive it. However, if the original distributor attempts to use the license itself to prevent third parties from distributing the software as they see fit (whether or not such distribution is allowed by a particular country's law), the distributor is thus assisting in enforcing discriminatory laws, and thereby discriminating.

This particular export clause is even worse than most, because it requires anyone obtaining the software to abide by United States law, even people who would ordinarily not be subject to U.S. law. This practice and the practice of adding specific restrictions on the use of the software once a copy has already been obtained may also violate OSD 7:

7. Distribution of License.

The rights attached to the program must apply to all to whom the program is redistributed without the need for execution of an additional license by those parties.

Since the APSL makes users implicitly "represent and warrant" specific facts about their personal status even after they have received a copy of APSL-covered software, its requirements appear to run afoul of both OSD 5 and OSD 7. How is it possible for "rights attached to the program [to] apply to all to whom the program is redistributed" (emphasis mine) if users in certain countries are prohibited in advance from using the software at all?

There is, of course, always a difference between personally abiding by a law and personally assisting a government in enforcing it against others. When governments make laws which discriminate against particular persons or groups, Open Source authors can certainly follow those laws, but if they decide to help governments enforce those laws by writing them directly into their licenses, they are no longer in compliance with the letter or the spirit of the OSD.

In general, if export laws are discriminatory, and Open Source licenses must be non-discriminatory, then Open Source licenses must oppose or be neutral toward export laws, but should not support them.

I've managed to persuade other people that they needed to drop export control language from their public license (which aims at Open Source compliance) by presenting a version of the present argument, so I know that this interpretation of the OSD is at least plausible to someone other than myself.

"May" versus "must"

The OSD says that a license isn't allowed to "restrict any party from selling or giving away" the software. This idea was earlier made explicit in the GNU General Public License (GPL), which says that you have to allow "all third parties" to obtain all the rights that you have. Note that this doesn't say that you must give a copy of the software to anyone who asks! It merely says that you may give a copy to anyone -- and that you must not add any restrictions which prevent other people from doing so.

Someone who writes GPL-covered software isn't required to violate local law by giving the software to people who aren't allowed to receive it. On the other hand, the GPL doesn't allow software authors to add additional constraints or obligations on recipients of the software. Thus, receipients of the software may distribute it to whomever they choose, regardless of the original governing law(s) of the circumstances in which the software was originally created or distributed.

The OSD seems to pick up on this implicitly in paragraphs 1, 3, 5, 6, and 7. As I read those paragraphs, there is no obligation on a software distributor under an Open Source license to violate the law by distributing software illegally. Equally importantly, however, the OSD will not allow a software distributor under an Open Source license to place conditions on others which prevent them from making their own choices.

Thus, I conclude that the OSD does not require Apple to violate United States export laws, but does require it to remain neutral toward others' violations of those laws.

What Apple should do

Apple should remove paragraph 13.1 from the APSL entirely. On the web page where users download the software, Apple should, if it believes this is necessary, have an export status check, which asks users to verify their legal eligibility to receive the software. This change guarantees that Apple itself will not take legal action for copyright infringement or breach of contract against people in any country who ultimately receive, distribute, or use APSL-covered Original Code in violation of US law.

Of course, Apple is under no obligation to do this; however, this change would help bring the APSL into compliance with the OSD, which is intended to express an approximate summary of some of the values of the free software community. (Recall that the OSD is descended from the Debian Free Software Guidelines, which represent a set of ethical suggestions and value judgments rather than legal criteria.)

Questions and clarifications about this position

Deirdre Saoirse said:
As for the export laws, it says "except as authorized by United States Law." I'm not sure they can change that as it is an implicit part of ANY software developed in the US. :(
I disagree, because of what I was trying to explain above about helping enforce discriminatory laws. Consider the difference between these two cases:

Case 1: A license does not specifically require compliance with a law.

When someone violates the law, this means:
  1. A violation of the law, if the violation happens within the jurisdiction that created the law (or if the law is extraterritorial).

Case 2: A license specifically requires compliance with a law.

When someone violates the law, this means:
  1. A violation of the law, if the violation happens within the jurisdiction that created the law (or if the law is extraterritorial).
  2. Also a violation of copyright or a breach of contract, depending on whether software licenses are construed as existing inside of copyright law or contract law.

There are at least two classes of people whose behavior would therefore be affected by any license which requires compliance with a law:

  • People who respect the license terms or the author's copyright, but do not respect the law (e.g. people who believe the law is unjust and intend to disobey it).
  • People who respect the license terms or the author's copyright, but are outside of the jurisdiction of the law (e.g. people who live in other countries).
From a legal point of view, people who are in some jurisdiction are always subject to its laws, whatever a software license does or does not say. But, by including politically-motivated restrictions within the text of a license itself, the software author codifies the policy of one jurisdiction at a particular time as a permanent part of the license for all users, anywhere in the world, forever.

If an Orthodox Jew wanted to put a clause into a license that said that the software must not be used on Saturday, how could you answer? He would certainly say that he was just alluding to the law which was already binding on all Jews anyway. One good way to answer might be that (1) that law does not claim to bind everyone; (2) not everyone that law claims to bind actually intends to follow it; and (3) mostly importantly, a free license should not incorporate extraneous material and restrictions, since this takes away from users' ability to make these decisions for themselves.

It's not software authors' job to help governments enforce their laws, and, if they do so to the detriment of software users' freedom to use, modify, copy, or distribute software, I think the existing OSD already provides reason enough to say that the result is not Open Source.

Since not every piece of software in the US is released with a license prohibiting the software from being used for illegal purposes, it's pretty clearly not a legal requirement to do so. (A requirement that software authors actually exhort people to follow the law would probably not be allowed in the US because of "compelled speech" interpretations of the First Amendment. If such a requirement were actually in place, however, it would simply prevent US developers from writing Open Source software.)

It should not be assumed that this line of thought applies only to export laws. In fact, there are a great many ways in which governments may attempt to regulate software in the future. It is important that software developers not be forced to pass on local conditions for the use of their code to the entire world via the terms of their software licenses.

A further < a href="http://www.linuxtoday.com/">discussion on this subject with someone who read this document is available. On request, I'll be glad to post others' comments or questions, with or without my answers.


Seth David Schoen / schoen@loyalty.org