Open Source Software and Litigation Risks

Please join partners Doug Crisman and Corey Houmand as they explore the history of open source litigation and how companies can best deal with the technical and legal issues that are expected to arise in future disputes concerning open source software.

Key Takeaways

• Adopt an open source software (OSS) policy addressing use and contribution of OSS and educate developers and business and legal teams on the policy.
• Allow for legal team review of proposals to use (internally or externally) or contribute OSS.
  • Review of some proposals can be fast-tracked due to white-listed low-risk factors (e.g., permissive OSS licenses and safe uses) associated with proposal.
• Identify core legal and developer team members with OSS expertise to evaluate and advise on mitigation of potential risks associated with proposed OSS use.
• Document proposals and approvals to use OSS.
• Be alert to possible OSS license violations in code that a company distributes, uses in a product, or uses as part of a customer/end user service.
• When negotiating an inbound software license, consider asking the licensor for a list of copyleft OSS in the software and open source indemnity to protect against misuse of the OSS by the licensor.
• When using a contractor to develop code, consider reviewing its policies, processes, and training for working with OSS; reviewing/auditing its use of copyleft OSS during the engagement; and/or asking for an open source indemnity to protect against its misuse of OSS.
• Regarding OSS subject to copyleft licenses (e.g., GNU General Public License (GPL)-like licenses), consider that safer uses of such OSS avoid modification of the OSS, distribution of the OSS or derivatives, and/or combination of the OSS with proprietary code.
• When negotiating an outbound software license, resist providing a broad OSS indemnity—especially if the company did not develop or integrate OSS that might be provided with the licensed code.
• When distributing OSS subject to a GPL license, be prepared to provide the corresponding source as required (e.g., GPL v.2, section 3, GPL v.3, section 3).