14 Mai 2010 Validity of GPL License

1. A GPL is per se valid and shall therefore bind the licensee which sublicenses the GPL to its client.

2. Provided that it may trigger infringement lawsuits against the sublicensee, any alteration of the software source code which is contrary to the terms and conditions of the GPL (and is likely to create a security loophole) can be construed as a breach of the contract concluded between the licensee and its client.

3. The completion of its obligations by the licensee shall be verified upon validation of the software, with no possibility for the latter to fulfil such obligations later.

Court of Appeal of Paris, September 16, 2009 (arrêt)

Société EDU 4 v. AFPA (Association nationale pour la Formation professionnelle des adultes).

Facts

A client whose activity is to run adult education establishments (AFPA) ordered a private company, through the French administrative procedure applicable to calls for tenders, to installation of in-built high-tech classrooms in numerous establishments. The installation of such classrooms encompassed the provision of a complex technological solution, appropriate furniture, a computer, a network, and dedicated communication and educational software.

The selected company was first expected to set up the said classrooms in three test establishments. During the process of verification and validation of the software, the client raised concerns about the « legal nature of the delivered software ».

Three months after this discussion on the « legal nature of the delivered software », the software vendor delivered a « corrected » version of the software.

Considering itself deceived with regards to some features of the software, AFPA refused to pay and a lawsuit was initiated. The selected company was claiming the payment of its services, and AFPA requested the appointment of a judicial expert. The first instance court judged in 2004, on the basis of a first report by a judicial expert, that the client had to pay the software vendor, for a total amount exceeding € 900.000.

Upon the request of AFPA, the court of appeal appointed a second judicial expert considering that the first report was not clear on some issues.

The client requested the Court of appeal to reverse the first decision, claiming (i) that the inclusion of a software distributed under the GPL had been concealed to him, (ii) that there was a violation of the GPL (because of the suppression of the copyright notices and the replacement of the names of the true authors), thus exposing him to a copyright infringement lawsuit and that the security loophole was a serious breach of contract.

The software vendor claimed that the presence of a GPL software was clear from the beginning, that the software delivered was a preliminary version, still in the course of development and that the final version, delivered after the client raised questions on the « legal nature of the software » was in compliance with the GPL. As to the security loophole, the vendor asserted that it was not a serious one.

The software in question is VNC which is well known and used by technology providers to control computers at long range mainly to perform maintenance tasks. In the normal course of action, the software can be activated only with the consent of the PC user.

The expert appointed by the court of appeal found that the software vendor had deleted the copyright notices and the text of the GPL in the source code. The software vendor had also inserted its name in the copyright mentions. The expert also found that the original software had been modified, creating a security loophole.

Held

The court found that the presence of GPL software had never been hidden, because the contractual documents were clear on that point. The court of appeal nevertheless ruled that the client had been entitled to refuse payment, for three main reasons:

First, the delivered software to be taken into account was the software provided to the client at the date of the validation procedure, and not the « corrected » software, delivered three months later. No preliminary version had ever been mentioned in the contractual documentation.

Second, the violation of the GPL exposed the client to a copyright infringement lawsuit, and thus the vendor was in breach of contract.

Third, the security loophole made the software unacceptable, and therefore legitimates the termination of the contract for a breach of its obligations by the vendor.

Comments

It is the first time a French court of appeal has decided that the GPL license is a valid license, and that the violation of the terms of the GPL could expose to a copyright lawsuit. It is a standard application of French property laws regarding ejectment. Indeed, pursuant to Article 1626 of the French Civil Code, the seller of a good ought to, inter alia, warrant its purchaser against any third party claim.

It is also interesting to note that a security loophole makes the software not suitable from a legal standpoint, even if that solution is not innovative.

The court of appeal was quite severe in deciding that the situation could not be remedied even so few weeks after the foreseen date of delivery. Indeed, software developers running out of time may sometimes use GPL and replace it a while later, upon request of their client, when the insertion of GPL in the software code has been discovered. Pursuant to this decision of the Court of Appeal of Paris, such scenario would not be likely to thrive, as the code must be adequate upon delivery to the client of the ordered software.

Finally, one must bear in mind that the section of Paris Court of Appeal which rendered this decision is not the section which is usually referred to in cases regarding intellectual property issues. Consequently, there is a risk, although a limited one, that such decision may not become a unanimous case law in France.

It is also interesting to note that the two previous court decisions  ([1] rendered in France on the validity of the GPL license concern educational projects.

In all three cases, the core issue is not the license of GPL from the first author of a software to a company which uses it directly, but the sublicense of a GPL software from a licensee company to one of its clients. With this decision, there is no further doubt that, while concluding the second license, the licensee company shall strictly abide by the terms and conditions of the first GPL.

As the legal validity of the GPL is now ascertained, great care should be taken by software developers when using it within more complex software solutions. Indeed, the present case demonstrates that the consequences of non-compliance with the GPL can be tremendous.

For more information, you can read my white paper « The law of  Open Source Licenses » .

This article was published  the 15 june 2010 in the journal  » Computer Law Review International CRI « .