OSS Licensing

OSS LICENSING
Disclaimers
DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited.

U.S. GOVERNMENT DISCLAIMER NOTICE. The views expressed in this presentation are those of
the author and do not necessarily reflect the official policy or position of the Department of the
Army, Department of Defense, or the U.S. Government. The information appearing on this
presentation is for general informational purposes only and is not intended to provide legal advice
to any individual or entity. Please consult with your own legal advisor before taking any action
based on information appearing in this presentation or any sources to which it may cite.

UNLESS OTHERWISE STATED

Who is this guy?
MARCUS A. STREIPS
Attorney-Advisor (Intellectual Property)
United States Army Medical Research & Materiel Command
Fort Detrick, MD

Why are we here?
OSEHRA Mission

“BUILD and SUPPORT an OPEN SOURCE COMMUNITY of users, developers,
service providers, and researchers engaged in advancing electronic health record
software and related health information technology.”OSEHRA’s mission includes
the creation of a VENDOR-NEUTRAL community for the creation, evolution,
promotion and support of an open source Electronic Health Record (EHR). This
community will operate with the TRANSPARENCY and AGILITY that characterize
open source software initiatives. This entails not only the development of a
community of software experts, clinicians, and implementers, but also a robust
ecosystem of complementary products, capabilities and services. OSEHRA is a
service organization. In one sense, our “product” is a thriving open source EHR
community. However, a more practical description of our products would list the
services OSEHRA provides to SUPPORT that community, such as our software
repository, testing, certification, and working group support. ”
Why are we here?

• BUILD
• SUPPORT
• TRANSPARENT
• AGILE
• VENDER-NEUTRAL
• OPEN SOURCE
• COMMUNITY


OSEHRA Mission (Abridged)

Open Source Principles
1. Innovation comes from the outside. It must be channeled inside.
2. Software is knowledge transformed into code. It needs an engaged Community.
3. Software is never a finished product. Its evolution requires an involved Community.
4. Attract interested people with shared goals. Earn their trust.
5. Transparency: remove any obstacles to the free flow of information
6. Meritocratic governance driven by: Autonomy, Mastery, and Purpose
7. Release Early, Release Often.
8. Avoid Private Discussions.
9. Establish Credibility. Build relationships with Open Source Communities.
10.Welcome the unexpected. Listen carefully to the Community.
SOURCE: http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
How do we make that happen?
1. Open Source Ecosystem: Patents, Data, Standards and Software
2. Open Source Software (OSS) Licenses Overview
3. OSS Compatibility: Aggregation, Integration, Linking
4. “Don’t Do it Yourself (DIYs)”: OSS Best Practices
How do we make that happen?
Part I: Open Source Ecosystem:
Patents, Data, Standards and Software
OSEHRA System Architecture
SOURCE: http://architecture.osehra.org/
OSEHRA System Architecture
SOURCE: http://architecture.osehra.org/
• Data & Docs
• Standards
• Software
• Architecture
• Patents
Licensing Landscape
SOURCE: http://www.acq.osd.mil/log/mr/psm/09_technical_data_rights_acquisition_strategy_guertin_2nov2011_v2.pdf
OSEHRA System Architecture
Patents
Standards
(copyrights)
Data
(data rights)
Software
(copyrights)
OSEHRA System Architecture
Patents
Standards
(copyrights)
Data
(data rights)
Software
(copyrights)
Defn. Patent
• Intangible Property
• Concepts & Ideas
• Social Contract
• Hedge against risk
• Inventive concept covering “Anything under the Sun”
• NOT laws of nature, natural phenomena or abstract idea
• Government sanctioned monopoly to make, use, sell, import
• 20 years from earliest effective filing date
Patents
The first patent was granted on July 31, 1790 to Samuel Hopkins of Philadelphia for a method
of producing potash (potassium carbonate), an essential ingredient used in making soap,
glass, and gunpowder.


Patents and OSS
• VERY IMPORTANT to keep patents out of OSS code
• Restrict software use and distribution
• Undermine emergence of a commercial marketplace
• Raise suspicion of costly litigation
• Goes against principles of vendor-neutrality, agility and community
SOURCE: http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
Patent Reciprocity and Open Standards
“Most users of software probably don’t realize how integral industry standards are to their
business and financial applications, nor how disruptive it might be to them if the standard
suddenly became more expensive or less available.”


Open standards should be made available under reasonable reciprocal licenses that
require licensees to share under the same terms their own patent claims reading on the
standard, or the standard should not be called open.
SOURCE: http://www.rosenlaw.com/pdf-files/DefiningOpenStandards.pdf
Copyright 2013 Lawrence Rosen. Licensed under the Open Software License version 3.0 (“OSL 3.0”)
Patent Reciprocity and Open Standards
• Create a common pool of patent claims that are available for all who share the standard.
• Condition reciprocity for participation in the standards process
• Condition reciprocity for commercial distribution of software that implements the specification.
• Explicit in license conditions
• Implicit through defensive termination provisions
• Covenants not to sue (Sun/Microsoft XML standard) – but see Microsoft's Open Specification Promise: No Assurance
for GPL, Copyright 2008, Software Freedom Law Center licensed under licensed CC-BY-SA 3.0.
SOURCE: http://www.rosenlaw.com/pdf-files/DefiningOpenStandards.pdf
Copyright 2013 Lawrence Rosen. Licensed under the Open Software License version 3.0 (“OSL 3.0”)
Patent Reciprocity and Open Standards
SOURCE: http://www.hl7.org/legal/patentinfo.cfm
Copyright 2007-2013 Health Level Seven International
Patent Reciprocity and Open Standards
SOURCE: http://www.hl7.org/legal/patentinfo.cfm
Copyright 2007-2013 Health Level Seven International
OSEHRA System Architecture
Patents
Standards
(copyrights)
Data
(data rights)
Software
(copyrights)
Defn. Copyright
• Intangible Property
• Expression
• Social Contract
• Monopoly to copy, distribute, modify an original “Work”
• literary, visual and musical works, sound recordings and software
• Term? (70/95/120) see http://copyright.cornell.edu/resources/publicdomain.cfm
Copyrights


A Little History:

The earliest recorded historical case-law on the right to copy comes from ancient Ireland. The Cathach is
earliest example of Irish writing. Around 560 AD St. Columba copied it from St. Finnian causing a
controversy that precipitated the Battle of Cúl Dreimhne in 561 AD (3000 dead).
King Diarmait Mac Cerbhaill gave the judgment :

"To every cow belongs her calf, therefore to every book belongs its
copy
Copyright and Open Systems
• Standards (HL7, ISO)
• Data/Databases (US vs. EU/AU/CA)
• Schema
• Documentation
• Design Concepts/GUI/Trade Dress
• Software
Defn. Open Work (Knowledge/Data/Content/Service)
SOURCE: http://opendefinition.org/okd/
1. Access Agile
2. Redistribution Vendor-Neutral
3. Reuse Agile
4. Absence of Technological Restriction Transparent
5. Attribution Agile
6. Integrity Agile
7. No Discrimination Against Persons or Groups Vendor-Neutral
8. No Discrimination Against Fields of Endeavor Agile/Vendor-Neutral
9. Distribution of License Agile
10. License must NOT be Specific to a Package Agile/Vendor Neutral
11. License must NOT Restrict the Distribution of Other Works Agile
See Also: upcoming lecture: “Open Data” Dr. Fred Prior
Open Work Conformant Licenses
SOURCE: http://opendefinition.org/okd/
SOURCE: http://opendatacommons.org/licenses/
Open Work Conformant Licenses
SOURCE http://creativecommons.org/choose/
Open Work NON-Conformant Licenses
SOURCE http://opendefinition.org/licenses/nonconformant/
Government Data Rights
SOURCE: http://www.acq.osd.mil/log/mr/psm/09_technical_data_rights_acquisition_strategy_guertin_2nov2011_v2.pdf
OSEHRA System Architecture
Patents
Standards
(copyrights)
Data
(data rights)
Software
(copyrights)
Open Standards Requirement of OSS
• Users of open standards aren’t locked into a particular implementation.
• Easily switch to a different implementation – Proprietary/FLOSS implementation.
• The standard itself helps developers know what to do.
SOURCE: http://www.dwheeler.com/essays/open-standards-open-source.html
Copyright 2013 David A. Wheeler and licensed under the Creative Commons “Attribution-Share Alike 3.0 License”; the GNU Free
Documentation License; or the GNU GPL (version 2 or later)
Open standards aid FLOSS projects, and it’s not hard to see why:

Open Standards Requirement of OSS
1. No Intentional Secrets Transparent
2. Availability Agile/Vendor-Neutral
3. Patents Vendor-Neutral
4. No Agreements Agile/Transparent
5. Attribution Agile
6. No OSR-Incompatible Dependencies Agile/Vendor-Neutral
SOURCE: http://opendefinition.org/okd/
Open Standards Requirement of OSS
SOURCE: http://www.hl7.org/documentcenter/public_temp_B65E8487-1C23-BA17-0CA344F46F3417A2/pressreleases/HL7_PRESS_20120904.pdf
Copyright 2013 Health Level Seven International
OSEHRA System Architecture
Patents
Standards
(copyrights)
Data
(data rights)
Software
(copyrights)
How do we make that happen?
Part II: Open Source Software (OSS)
Licenses Overview
A Defn. Open Source Software
SOURCE: http://opensource.org/osd
See Also: http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
See Also: http://www.gnu.org/philosophy/free-sw.html
1. Free Redistribution Vendor-Neutral
2. Source Code Transparent
3. Derived Works Agile
4. Integrity of the Author’s Source Code Agile
5. No Discrimination Against Persons or Groups Vendor-Neutral
6. No Discrimination Against Fields of Endeavors Agile/Vendor-Neutral
7. Distribution of License Agile
8. License Must Not be Specific to A Product Agile
9. License Must Not Restrict other Software Agile
10. License Must be Technology-Neutral Vendor-Neutral
OSS License Category
SOURCE: http://flosscc.opensource.org/content/spread-the-word content on this site is licensed under a Creative Commons Attribution 2.5 License
3 Types of Licenses
1. Reciprocal (aka “Viral”, “Copyleft”, “Restrictive”)
- if you change the code and redistribute it, you must also
redistribute the source code; the code will remain open source.
- all code linked to the code with a reciprocal license must remain
with the same reciprocal license

2. Partially Reciprocal (“Weak Copyleft”)
- similar to the reciprocal but you can distribute a singe component
of your code with this license and link it to code with other license
(even proprietary)

3. Academic (aka “Commercial Friendly”, “Permissive”)
- you may relicense your derivative work under any license of your
choice, or even make it proprietary
OSS License Category
SOURCE: http://flosscc.opensource.org/content/spread-the-word content on this site is licensed under a Creative Commons Attribution 2.5 License
Popular and Widely Used License
1. Reciprocal (aka “Viral”, “Copyleft”, “Restrictive”)
- GNU General Public License (GPL)

2. Partially Reciprocal (“Weak Copyleft”)
- Eclipse Public License (EPL)
- GNU Lesser General Public License (LGPL)
- Mozilla Public License 2.0 (MPL)

3. Academic (aka “Commercial Friendly”, “Permissive”)
- Apache License 2.0
- BSD
- MIT License
OSS License Category
SOURCE : http://www.openfoundry.org/en/foss-license-category
OSS License Category
SOURCE : http://www.openfoundry.org/en/comparison-of-licenses
OSS License Category
SOURCE : http://www.openfoundry.org/LicenseWizard/index.htm?en
See also: http://home.ccil.org/~cowan/floss/
Rank of OSS Licenses by Popularity
SOURCE: http://osrc.blackducksoftware.com/data/licenses/
Copyright 2013 Black Duck Software,. Inc
SOURCE: http://johnhaller.com/jh/useful_stuff/open_source_license_popularity/
Copyright 2011 John T. Haller

Rank of OSS Licenses by User
SOURCE: http://www.openlogic.com/news/bid/154646/OpenLogic-Scanning-Data-Reveals-OSS-Developers-Choose-GPL-Enterprises-Prefer-Apache
Copyright 2013 OpenLogic, Inc.
OSS License Category
BSD/MIT (“Commercial Friendly”, “Permissive”)
• The code is protected by copyright.
• code can be used in closed source projects.
• The code can be included in project with more restrictive licenses.
• The program that used this can be sold and licensed commercially.
• Derivative works need NOT be released (non-reciprocal).
• There is implicit permission to exercise patents.
• A number of terms that are left unspecified.

SOURCE: http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
OSS License Category
Apache 2.0 (“Commercial Friendly”, “Permissive”)
• The code is protected by copyright.
• The code can be used in closed source projects.
• The code can be included in project with more restrictive licenses.
• The program that used this can be sold and licensed commercially.
• Derivative works need NOT be released.
• The Apache license has a very explicit patent license.
• A clear list of definitions is provided in its preamble.
• Terms consistent in copyright, patent, trademark laws.
• A clause for contributor’s license agreements provides a low entry path for contributors
SOURCE: http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
OSS License Category
GPL 3.0 (“Viral”, “Copyleft”, “Restrictive”)

• “Viral” because the licenses spreads a continuing use of the licenses in its derivatives.
• The code can be sold and licensed commercially as long as the source code is under the same license.
• Derivative works, when distributed, must be distributed under the same license (reciprocity condition).
• Does not require you to release your modified version, or any part of it.
• Patent permissions are included more strongly than GPL 2.0.
• Hardware devices must allow modified versions to run.
• Prevents the practice of applying restrictive licenses to modifications of original source code.
• May NOT be distributed under any other license. Keep code “free forever”.


SOURCE: http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
OSS License Category
GPL 3.0 (“Viral”, “Copyleft”, “Restrictive”)
SOURCE: http://www.codinghorror.com/blog/2007/04/pick-a-license-any-license.html
© 2013 Jeff Atwood.
“The archetypal bearded, sandal-clad free software
license. Your code can never be used in any
proprietary program, ever! Take that, capitalism!”
OSS License Category
LGPL (“Lesser Copyleft”)

• The code is protected by copyright.
• Considered “halfway” point between “restrictive” and “permissive” licenses
• Allows combination with proprietary closed-source software impermissible under GPL
• Does not extend to LGPL license to works that link against the original code.
• Originally written to accommodate code libraries
Source: http://www.softwarefreedom.org/resources/2008/foss-primer.pdf
Copyright © 2006, 2007, 2008, Software Freedom Law Center, Inc. Verbatim copying and
distribution of this entire document is permitted in any medium; however, this notice must be
preserved on all copies.
How do we make that happen?
Part III: OSS Compatibility:
Aggregation, Integration, Linking
Non-GPL Compatibility w/ GPL
SOURCE: http://en.wikipedia.org/wiki/GNU_General_Public_License#Linking_and_derived_works
SOURCE: http://www.gnu.org/licenses/gpl-faq.html#MereAggregation
Text is available under the Creative Commons Attribution-ShareAlike License;
Aggregation – Software is bundled in a distribution GPL Compliant
Pipes, sockets and command-line arguments are
communication mechanisms normally used between two
separate programs.

GPL Compliant
Integration - Modules are included in the same executable file GPL NON-Compliant
Modules run linked together in a shared address space GPL NON-Compliant
Static and Dynamic Linking ?
OSS Aggregation
An "aggregate" consists of a number of separate programs, distributed
together on the same CD-ROM or other media. The GPL permits you to create
and distribute an aggregate, even when the licenses of the other software are
non-free or GPL-incompatible. The only condition is that you cannot release
the aggregate under a license that prohibits users from exercising rights that
each program's individual license would grant them.

SOURCE: http://www.gnu.org/licenses/gpl-faq.html#MereAggregation
Copyright © 2007, 2008, 2010, 2013 Free Software Foundation, Inc.
Licensed under a Creative Commons Attribution-NoDerivs 3.0 United States License
OSS Integration
SOURCE: http://www.gnu.org/licenses/gpl-faq.html#MereAggregation
Copyright © 2007, 2008, 2010, 2013 Free Software Foundation, Inc.
Licensed under a Creative Commons Attribution-NoDerivs 3.0 United States License
“If you integrate module Q, and release the combined program P+Q under the GPL,
that means any part of P+Q can be used under the GPL.”


P : GPL Code
Q: Your Code

P+Q = P+Q = P = Q
OSS Linking
The Problem of “Derivative Works”
SOURCE: http://www.linuxjournal.com/article/6366
Copyright © 1994 – 2013 Linux Journal.
The Copyright Act, at 17 U.S.C. §101, is a little vague and doesn't say anything at
all about software:

A “derivative work” is a work based upon one or more pre-existing works, such
as a translation, musical arrangement, dramatization, fictionalization, motion
picture version, sound recording, art reproduction, abridgment, condensation
or any other form in which a work may be recast, transformed or adapted. A
work consisting of editorial revisions, annotations, elaborations or other
modifications which, as a whole, represent an original work of authorship, is a
“derivative work”.

OSS Linking
SOURCE: http://www.cs.binghamton.edu
See Also: http://www.gnu.org/licenses/gpl-faq.html#LGPLStaticVsDynamic
OSS Linking
SOURCE: http://en.wikipedia.org/wiki/GNU_General_Public_License#Linking_and_derived_works
Text is available under the Creative Commons Attribution-ShareAlike License;
1. Dynamic and static linking violate GPL (FSF, LGPL, Stallman)
2. Static linking violates GPL but unclear as to dynamic linking (Torvalds, Novell)
3. Linking is does not automatically create a derivative work (OSI, Rosen)


Point of view:
OSS License Compatibility
SOURCE : http://www.openfoundry.org/en/compatibility-of-licenses

Here the term “compatibility” refers to the two following
conditions:

1. When a software developer makes use of more than one
external module in the development of a single project, and
when the licenses of used modules do not conflict with each
other, we say these licenses are compatible with each other.

2. When a software developer modifies a given program, and
the modified part makes use of other modules; when the
licenses of the modules do not conflict with the license of the
modified program, we say the licenses are compatible with
each other.
OSS Compatibility
SOURCE: http://www.dwheeler.com/essays/floss-license-slide.pdf
Copyright 2013 David A. Wheeler and licensed under the Creative Commons “Attribution-Share Alike 3.0
License”; the GNU Free Documentation License; or the GNU GPL (version 2 or later)

OSS Compatibility
SOURCE: http://en.wikipedia.org/wiki/GNU_General_Public_License#Linking_and_derived_works
Text is available under the CC-BY-SA-3.0; Released under the GNU Free Documentation License.
So which one?
Apache License 2.0
SOURCE: http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
How do we make that happen?
Part IV: “Don’t Do it Yourself (DIYs)”:
OSS Best Practices
OSHERA OSS Key Features

1. Allow use in non-open source code (no reciprocity condition in license)
2. No licensing royalties
3. No Dual Licensing
4. Maximize business model diversity
5. Encourage, but NOT require contribution of improvements and modifications
6. Allow for project forking, but AVOID it
7. Share maintenance cost of code base
SOURCE: http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
Don’t “DIYs”
• A GRAM license makes user and developer adoption quicker and easier.
• A GRAM license has substantial licensing knowledge and support.
• Many GRAM licenses are shepherded by professional organizations (e.g., FSF, OSI, Apache)
• Developers have a understanding and consensus of how the GRAM license models work.
• Too many different licenses makes it difficult for licensors to choose
• License compatibility is a complex issue
• Multi-License distributions are complex and hard to understand

SOURCE: http://www.softwarefreedom.org/resources/2008/foss-primer.pdf
SOURCE: http://opensource.org/proliferation-report
all content licensed CC-BY-SA 3.0.

Pick Generally Recognized as Mature (GRAM) Licenses:
Don’t “DIYs”

The OSEHRA will only consider existing OSI-Approved licenses. There is already enough
variety of open source licenses to satisfy most common licensing situations. The Open
Source Initiative repeatedly discourages projects from creating new licenses. The effort of
devising a new license will drain a significant amount of resources and distract the OSEHRA
from more pressing issues while providing no benefit for the open source stance of the
project at large.

SOURCE: http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
Encouraged Practices
• Individuals contributing bug fixes and improvements
• Commercial companies contributing bug fixes and improvements
• Commercial companies contributing large modules of source code
• Commercial companies building a profitable and competitive marketplace
• Educational use of the software
• Use of the software for research purposes
• Innovation ranging from small variations to radical disruptive concepts
• High quality by continuous reduction of software defects
• An environment of trust conducive to cooperation and collaboration
SOURCE: http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
Discouraged Practices
• Continuous tension and fractioning of the Community
• Forking of the project into diverging branches (beyond experimental and exploratory purposes)
• Litigation and uncertainty on potential future litigation
• Entrenchment of the software and use of it by only a small niche of users
• Unbalanced influence on the software by a small fraction of actors in the ecosystem
SOURCE: http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
FIN
Sources
http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
http://architecture.osehra.org
http://www.acq.osd.mil/log/mr/psm/09_technical_data_rights_acquisition_strategy_guertin_2nov2011_v2.pdf
http://www.rosenlaw.com/pdf-files/DefiningOpenStandards.pdf
http://www.hl7.org/legal/patentinfo.cfm
http://copyright.cornell.edu/resources/publicdomain.cfm
http://opendefinition.org/okd
http://opendatacommons.org/licenses
http://creativecommons.org/choose
http://opendefinition.org/licenses/nonconformant/
http://www.dwheeler.com/essays/open-standards-open-source.html
http://www.hl7.org/documentcenter/public_temp_B65E8487-1C23-BA17-0CA344F46F3417A2/pressreleases/HL7_PRESS_20120904.pdf
http://opensource.org/osd
http://osehra.org/sites/default/files/osehra_licensing_terms_v.1.0.pdf
http://www.gnu.org/philosophy/free-sw.html
http://flosscc.opensource.org/content/spread-the-word
http://www.openfoundry.org/en/foss-license-category
http://www.openfoundry.org/en/comparison-of-licenses

Sources (cont.)
http://www.openfoundry.org/LicenseWizard/index.htm?en
http://home.ccil.org/~cowan/floss
http://osrc.blackducksoftware.com/data/licenses/
http://johnhaller.com/jh/useful_stuff/open_source_license_popularity
http://www.openlogic.com/news/bid/154646/OpenLogic-Scanning-Data-Reveals-OSS-Developers-Choose-GPL-Enterprises-Prefer-Apache
http://www.codinghorror.com/blog/2007/04/pick-a-license-any-license.html
http://www.softwarefreedom.org/resources/2008/foss-primer.pdf
http://en.wikipedia.org/wiki/GNU_General_Public_License#Linking_and_derived_works
http://www.gnu.org/licenses/gpl-faq.html#MereAggregation
http://www.linuxjournal.com/article/6366
http://www.cs.binghamton.edu
http://www.gnu.org/licenses/gpl-faq.html#LGPLStaticVsDynamic
http://www.openfoundry.org/en/compatibility-of-licenses
http://www.dwheeler.com/essays/floss-license-slide.pdf
http://en.wikipedia.org/wiki/GNU_General_Public_License#Linking_and_derived_works
http://opensource.org/proliferation-report