Monday, September 13, 2010

FSF statement on Oracle vs. Google is a shame: misleads, puts GPL above freedom, spares IBM

The Free Software Foundation needed about one month after the announcement of Oracle's patent infringement suit against Google to issue this statement.

One month was apparently needed to come up with a statement that despite a few good points calls into question whether the FSF truly cares about the values it claims to advocate. The statement is designed to mislead people with propaganda; it demonstrates concern only for the GPL, not for the cause of software freedom; and it's disconcerting that the FSF turns a blind eye to what IBM (one of its sources of funding) does.

I commented on the FSF statement last week. You can find me quoted by ZDNet's Linux and open source blog and by V3.co.uk. I also posted comments to LinuxWeeklyNews (LWN.net).

Given the importance of not only the Oracle-Google case but also the more fundamental concerns I have about the FSF's statement, I decided to publish this analysis.

Before I go into detail, let me stress that I don't doubt the integrity of Richard Stallman (RMS). He's a true visionary and he's absolutely dedicated to his cause. I have seen him campaign against software patents, and he's the last person in the entire IT universe I'd ever suspect of being in whatever company's pocket. However, I fear he may sometimes rely on people who aren't equally true to those values, and when it comes to the funding of his organization and (even more so) of affiliated entities, Richard may have the attitude of certain Roman emperors.

1. Where I agree: appropriate criticism of Google

The FSF rightly notes that Google "still has not taken any clear position or action against software patents." I also wrote about that fact last month when I analyzed Google's amicus curiae brief in re Bilski & Warsaw v. Kappos.

I share the FSF's view that Google apparently wanted "to make proprietary software development easier on Android." I previously mentioned the "proprietary, closed-source strategies of certain vendors of Android-based phones" and linked to an external article entitled "The Sad State of Open Source in Android tablets".

2. Dangerous and misleading: GPLv2 touted as "strong defense" against patents

This is a passage of the FSF statement that I condemn as dangerous propaganda that's so misleading it's actually dishonest:

And [Google] could have avoided all this by building Android on top of IcedTea, a GPL-covered Java implementation based on Sun's original code, instead of an independent implementation under the Apache License. The GPL is designed to protect everyone's freedom — from each individual user up to the largest corporations — and it could've provided a strong defense against Oracle's attacks. It's sad to see that Google apparently shunned those protections [...]

Watch particularly the middle sentence. On its own, the claim that the GPL is designed to protect software freedom is acceptable as a mission statement. What's wrong is to give a vast majority of all recipients the impression that the GPL can be a "strong defense" against patent attacks. The FSF has every right to promote the GPL, but not by questionable means.

While the FSF doesn't claim so literally, that almost sounds like the GPL is to software developers what the cross and the wooden stake were to Buffy the Vampire Slayer – the lead character of the popular TV series who never left home without them. No version of the GPL can deter patent aggression by any third party who isn't bound to GPL terms itself. Not in any way. Sure, the FSF didn't say the GPL is a magic wand, but the passage I quoted reflects a desire to lead some people to think so.

At the most, the GPL can make things harder for a patent holder who published software under the GPL, provided that (i) the relevant program code reads on the patents asserted and that (ii) the alleged infringer uses that GPL'd software.

The limitations of an implicit patent license

The FSF argues Google should have used IcedTea. IcedTea was derived from Oracle/Sun's OpenJDK, so it's a fork of program code available under the GPLv2.

The GPLv2, however, only has an implicit (implied) patent license. It doesn't say explicitly "I, the patent holder, grant you, the licensee, a perpetual, worldwide, irrevocable license...". There are references to patents in GPLv2 but those are more like an encouragement not to publish patent-encumbered software under the GPL than an actual license grant.

Even when a software license doesn't contain an explicit patent license, it would obviously be unfair if a patent holder could make software available to many people as a trap only to later sue them all for patent infringement. Under US law, the legal theories according to which an "infringer" can argue that he was granted an implied patent license are called legal estoppel, equitable estoppel, conduct, and acquiescence. Other legal systems have similar theories in place.

So it comes down to a general fairness principle, which is easily applied if someone uses unmodified software published by the patent holder: in this case, the original OpenJDK code. But it's complicated and risky once we're talking about forks (derived versions), such as IcedTea or let alone whatever Google would have had to do to turn IcedTea into what its Dalvik virtual machine is for Android.

The FSF would like people to think that the GPLv2's implied patent license extends to forks. The problem is that if programmers rely on this assumption (which is just the FSF's position and absolutely unsupported by case law), they may have to pay the price.

There is indeed serious doubt about the extent to which the exercise of "freedom 3" (the right to distribute modified versions of a free program) is safe if there are patents in play. Dan Ravicher, a lawyer affiliated with the FSF, was honest enough to point out six years ago that this is a "gray area". Last month I already explained that the European Commission also voiced serious doubt about the scope of an implied GPLv2 patent license in its decision on Oracle's acquisition of MySQL as part of Sun. The Commission, too, was concerned about the extent to which forks would be covered.

Promoting the GPL and the FSF's power rather than "freedom 3" and the truth

That's why I really object to the FSF's claim that the GPLv2 "could've provided a strong defense": the GPLv2's ability to protect against patent attacks is reversely proportional to the extent software developers exercise the said "freedom 3" (redistribution of derived works). If you don't modify any patent-encumbered GPL'd code, you're presumably protected; if you make changes to the existing code base, you enter a dangerous gray area (in which IcedTea probably already is, even though the GPL apparently tries to reassure IcedTea users that they're safe); and once you add completely new code on top, it's pretty certain that the GPL can't do anything for you if that code infringes any patents.

The GPL shows that defending software freedom and telling people the whole truth are at best secondary objectives. What the FSF really wants is promote the GPL, spur its adoption and thereby expand its influence. That is, regrettably, the way I interpret that part of the FSF's statement.

One could argue that the FSF only said "could've" (provided a strong defense). But "could've" isn't "might have". The way many people will reasonably interpret it is that if Google had opted for IcedTea under the GPL, it would have been safe (or if it opted for it now, it might be safe in the future). But there's far too serious doubt about that assumption, as I just explained. So it's dishonest to suggest that there could have been a "strong defense."

On the contrary, if Sun had published its OpenJDK under the Apache license 2.0, and if Google had used such code on those terms, there would be a much stronger protection because that license contains an explicit patent grant.

3. Email to Larry Ellison: the wrong approach

The FSF's call on people to send email to Oracle founder and CEO Larry Ellison to protest against software patents is inappropriate. Those are spam tactics. There are email addresses to which it's legitimate to send messages, such as to members of parliaments because they are the elected representatives of citizens and should take direct input from their electorate. It's also OK to send messages to email addresses that are set up for the receipt of input from large numbers of people. But an orchestrated email campaign shouldn't target someone's personal address.

I fought against Oracle's acquisition of Sun, and believe me, that company is a really tough opponent. Still I believe one can deal with controversy in a more civilized way than what the FSF proposes.

I don't think even a million messages would change Oracle's stance on this. But every such email will discredit the FOSS movement in the eyes of serious people.

4. The FSF conspicuously spares IBM

Considering how hard the FSF tries to pressure Oracle and (rightly) criticizes Google for its position on freedom and patents, it doesn't sit well with me that IBM, one of the primary financiers of the FSF and some of its affiliated entities, gets away with much worse behavior.

IBM's patent threats against Hercules, a mainframe emulator that is available under a license recognized by the FSF as a free software license and by the OSI as an open source license, are actually much worse. Those threats became known five months ago, and there's been deafening silence on the part of many free software entities, to the extent that I conclude they are only selectively free.

One can argue that IBM has not (at least not yet) gone to court. However, litigation is always just the last resort for any patent holder. Whether a patent holder has strategic objectives or just wants to make money (like a "patent troll"), everyone prefers to get their way without having to go to court. Most of the damage that patents do is actually done outside the courts.

In IBM's case, there's a clear case of exclusionary strategic use: Big Blue uses those patents to draw a line in the sand and maintain its hugely lucrative mainframe monopoly, keep customers locked in with respect to mainframe legacy workloads, and to expand and extend that lock-in to enterprise cloud computing.

By contrast, there's no indication so far that Oracle wouldn't be willing to negotiate a license deal with Google.

But this isn't just about Oracle as compared to IBM. The FSF's criticism of Google, which I support, would also apply to IBM.

It's true that Google's Bilski brief didn't speak out against the patentability of software; it was basically just a request for slightly higher quality standards. But IBM's Bilski brief was much worse, claiming that software patents liberated programmers and were key to the rise of FOSS. The FSF should have taken Big Blue to task over this. Such unbelievable cynicism would actually have been more of a reason for a pressure campaign against a company than Oracle's dispute with Google, about which there are so many unknowns for now.

Finally, the FSF criticizes Google for having built Dalvik on top of (a part of) "an independent [Java] implementation under the Apache License". What the FSF means is a project named Harmony, which Google decided to fork. I said before that Google probably did this to facilitate closed-source Android products. But you know which company actually started Harmony and isn't mentioned by the FSF? IBM.

On the Harmony project's contributor page, about every second person (ten out of two dozen) is an IBM employee, about half of them from China and half of them from the UK. Plus, IBM is known to fund the Apache Foundation in general.

That doesn't excuse Google in any way. But IBM started this and the fact that it isn't even mentioned raises questions about the FSF's independence from Armonk.

If you'd like to be updated on patent issues affecting free software and open source, please subscribe to my RSS feed (in the right-hand column) and/or follow me on Twitter @FOSSpatents.