Telstra violating open source licence, claims developer

22

Update: See Telstra’s response here.

Telstra could be about to receive an avalanche of complaints from the global open source software community, after a local developer accused the company over the weekend of violating the terms of the popular GNU General Public License in its T-Hub, T-Box and potentially T-Touch Tab products.

The telco launched the products this year and has already achieved a degree of success with the T-Hub integrated telephone and T-Box media centre products, selling a total of around 100,000 units combined by the end of September. The T-Touch Tab is one of a wave of tablets based on Google’s Android operating system to hit Australia over the past several months.

However, in an extensive blog post published yesterday, Angus Gratton — who appears to be an open source software developer and a technician at the Australian National University’s Department of Nuclear Physics — pointed out that all three products were based on the Linux operating system, which has substantial portions licensed under the GNU General Public License.

Gratton also posted a link to his claim to the GPL violations mailing list, which aims to track and rectify problems where companies are using the licence.

The GPL violations site interprets the GPL as requiring that companies who distribute products based on GPL-licenced software must make source code to the software available to customers — for example, include a zip file of relevant files on a documentation CD. In addition, a copy of the GPL licence should be included with licence documentation.

“I investigated the T-Hub and found it is built on a variety of open source software, including GPL licensed software like Linux and busybox. However, Telstra are not mentioning this anywhere and are not distributing source code, or notices to obtain source code,” wrote Gratton on his blog.

“By doing this, Telstra are violating the licenses and also robbing the authors of their rightful attribution. They appear to be regarding open source as a free-for-all that they can exploit without giving back even the small amount required legally by the various license terms … to the best of my knowledge, the T-Box is not GPL-compliant either, which gives me little hope for the upcoming T-Tab.”

The developer wrote that he had been attempting to contact Telstra about the issue, to no avail. Ultimately he said he was planning to notify as many rights-holders as he could for the software the telco was using, and encourage them to get in touch with Telstra themselves.

Telstra does not manufacture the T-Hub, T-Box or T-Touch Tab itself. The T-Box is made by European company Netgem, while the T-Hub is made by French electronics giant Sagem, and the T-Touch Tab by Chinese giant Huawei. The telco has not yet responded to a request for comment on the issue.

Image credit: Telstra

22 COMMENTS

  1. > Telstra does not manufacture the T-Hub, T-Box or T-Touch Tab itself.

    The products were clearly commissioned by Telstra and as such Telstra would have been involved at almost every step of the way, including initial specs and final sign-off.

    The question of what operating system to use would have come up early on on the piece.

    Shame on you Telstra!

    • To be honest, I’m not sure that it’s realistic to expect Telstra to held responsible for this sort of issue — it’s more the sort of thing that should be tackled at the manufacturer level, if there truly is a breach. At the very least, the manufacturer should make whoever is re-badging the equipment aware of the underlying code base and responsibilities etc.

      That said, I Am Not A Lawyer, and I don’t know whether there actually is a breach here.

      • I’m not a lawyer either, but if Telstra commissions something, then commonsense dictates that it is responsible for the end result.

        > In Central Local Court, Sydney, yesterday Mr Medich’s charge sheet had a new entry: ”That Ronald Edward Medich on 3 September, 2009, did murder Michael McGurk.”

        > Mr Medich, who has been described in court as ”the mastermind”, is not alleged to have been present at the murder but the charge stems from the allegation that he was the principal behind the murder.

      • The obligation is on distributors, so possibly the only way telstra would be exempt is if the manufacturer is doing it all, and telstra doesnt touch it, even for shipping.

        But if its got a telstra bradge on it, then they have something to do with it somewhere.

        • I believe that Australian copyright law has a thing called “exhaustion of rights”, which is similar to what in the US is called the “first sale doctrine”. The basic idea is that the legal owner of a legitimate copy can redistribute that copy WITHOUT needing permission of the copyright owner.

          This is what makes things like used bookstores legal. With “exhaustion of rights” or “first sale”, you would need the copyright owner’s permission to sell your used books to a used bookstore, and the used bookstore would need permission to resell them.

          If Telstra is simply receiving finished products made by third-party manufacturers, and redistributing those without copying any of the software contained therein, then they may be protected by exhaustion of rights/first sale. GPL only applies to people doing things that require copyright permission.

          (This is also why if you go down to some general merchandise retail store and buy something like a TV or DVR that contains Linux-based firmware, and you want the source, you have to deal with whoever made the TV. The store that sold the TV has no GPL obligation, even though they are redistributing the TV and the GPL code it contains).

          If the devices are custom made for Telstra, then there might be some kind of argument that the third party is an agent operating under the control of Telstra, and so Telstra counts as the ones making the copies when the devices are manufactured. It would probably come down to the exact nature of the relationship between the manufacturer and Telstra, and exactly what is done to the software.

          • I understand the Exhaustion of Rights theory, but in this case there was probably no product sold.

            Unless Telstra have changed their practices, they’re renting the phones out to the users rather than directly selling them. I can’t sell my T-Whatever to you because it isn’t mine. Pretty much every single piece of software you’ve ever used is the same: you’re granted a licence in return for your cash.

            Now, back to the GPL argument:

            In the case of the GPL, there is nothing prohibiting the exchange of cash for either a sale or a licence-to-use. The problem comes from *distributing* GPL licenced software without providing access to the source code. It doesn’t matter who you get the phone from, be it Sagem or be it Telstra, if they’re distributing GPL software, they must provide access to the source code.

            Telstra can say “we get the phone from Sagem” but it must also provide the details on how to access the source code for the software it is distributing. Normally in this sort of situation, they’d put small print in the manual that the source code can be requested directly from Sagem. That fulfils their obligation — so long as it really is available from Sagem.

            IANAL (but I look dashing in a powdered wig)

            Cheers!
            Rick

      • In terms of re-badging, Telstra authored all of the documentation and marketing material, and provide all of the support. These are the places where one would expect to find open source licensing information. Sagem is just the label next to the part number on the back of the device, there is no other end user information available from Sagem.

        So it’s quite different from buying, say, an HTC phone from Telstra.

        Legally, however, I believe the two cases are actually identical. In both cases the vendor is “distributing a product based on GPL licensed software”, regardless of who made it and who supports it, so they still have to comply – even if compliance is just reprinting Sagem’s GPL notice and Sagem’s offer for source code.

        – Angus

        • Telstra re-badges the product, therefore they need to acknowledge use of software under GNU GPL and comply with the requirements of the license.

          In my opinion, they can’t just include a copy of the OEM manufacturers GPL notice and offer for source code.

          Telstra took direct responsibility the moment they put their name on the product, they now need to step up to the plate.

          On the separate issue, if Telstra resells a HTC handset to an end user, then they are under no obligation to give coverage to the GNU GPL as it is not classed as a Telstra product even though sold by Telstra (reseller) as it is not ‘badged’ as a Telstra product.

          This now gives rise to the question of responsibility where a product such as a android device is co-badged by a Telco i.e. a HTC device which is clearly badged as a HTC device yet also bears the logo of the Telco. Would the telco be in part for GNU GPL compliance?

  2. Im a busybox copyright holder, i tried making a few noises in the last few weeks, emailed Netgem, Software Freedom Law Center, and another local legal person who understands the GPL. I didnt get anywhere.

    We cant prove telstra is violating the GPL because they encrypt their firmware, which comes from netgem.

    Netgem do provide source, but there is no way of verfiying it relates to the devices.

    Irrespective i think the NetGem and Telstra _might_ be violating this clause of the GPL, “For an executable work, complete source code means all the source code for all modules it contains, plus any associated interface definition files, plus the scripts used to control compilation and installation of the executable.”

    To be able to compile and install the executable (say busybox) they would need ot prove the busybox Makefiles (which they removed) and a way to generate the firmware. But i suspect there would be lots of legal arguments about what it means to “install an executable” as it relates to embedded devices.

    Its a bit like the TiVo case that lead to the GPLv3, although in this case they might be just encrypting the firmware rather than signing the binaries.

    There is a thread on whirlpool about trying to get into the firmware, its at
    http://forums.whirlpool.net.au/forum-replies.cfm?t=1483297

    • Glenn – it’s good to hear from a busybox copyright holder on this. Unlike the T-Box, the T-Hub firmware is just a JFFS2 filesystem image so at least in that case you can clearly see Busybox installed there.

      It makes me sad that rather than expending effort to try and comply, companies will go to the effort of encrypting firmware instead.

      I agree with you on the “compile & install” clause probably applying. Although, as you say, OEM source code from Netgem is not the same as source code from Telstra. Unless Telstra explicitly affix a notice to the product explicitly saying that is the source code, as per GPLv2 clause 3(c).)

      – Angus

  3. The moment Testra badged the product/s in question and sold it as a Telstra product is the moment in time that made them directly responsible for compliance under the GNU GPL.

    As Renai has explained this product/s are not actually manufactured by Telstra, but in badging and selling as a Telstra product/s they can’t just pass the buck and claim it the problem of Sagem, Netgem etc being the OEM manufacturer/s.

    Telstra needs to step up to the plate and accept that they have cocked up and take appropriate steps to ensure that they are in compliance for the affected product/s and any further product/s that use Open Source software falling under the GNU GPL.

    Telstra and their Product Management & Marketing teams need to have a good hard read of the following:
    http://gpl-violations.org/faq/vendor-faq.html
    http://www.gnu.org/licenses/gpl.html

  4. The most insulting thing for me, is that at the end of user manual for the T-Box, in section 10. Legal Notifications it states.

    “In using your T-Box, you must not violate any intellectual property rights concerning
    a brand, design, photo, licence, software program, audiovisual work or any other form
    of intellectual property.
    Any violation of these intellectual property rights and, in particular, any act of piracy,
    will be subject to the penalty applicable within the legislation put in place.”

    It goes on to list trademarks of Telstra, HDMI and Dolby, but when it comes to respecting the Intellectual Property rights of the little bloke they are silent.

    They tell their users not to violate the software license (one of which is the GPL), but they are probably doing it themselves.

    I expect like all big companies its all about “risk management”, until they face real risks (with lawyers involved) they wont lift a finger to do the right thing.

  5. Problem here “I believe that Australian copyright law has a thing called “exhaustion of rights”, which is similar to what in the US is called the “first sale doctrine”. The basic idea is that the legal owner of a legitimate copy can redistribute that copy WITHOUT needing permission of the copyright owner.”

    GPL software was never sold. So both exhaustion of rights and first sale doctrine don’t apply to GPL. GPL never gives the right to sell the software. In fact selling the software would be a breach of GPL itself and all copies from there on would be copyright infringing so should be destroyed due to international agreements on IP protection that even china has signed off on. Instead places conditions on all distributors.

    So yes every shop that has sold one is at risk due to this kind of mistake.

    Yes out sourcing to china does not protect you from the requirements if GPL. If anything make it even more dangerous since someone can have you product destroyed at customs without even going to court and the rules of counterfeit products. Yes GPL software without matching source code is a counterfeit copy.

    It only a matter of time before GPL enforcement works out the IP agreements over the large section of the world is a double sided sword. One blocking patent covered items entering countries without paying the other making GPL enforcement even simpler. Customs can hold products and ask for proof of legal status in GPL case the source code if not provided destroy the item without requiring a court case. Since they are also a distributor in the chain. Yes highly over looked. GPL could take customs to court for being incompetent.

  6. oiaohm, you are even more mistaken than law_nerd.

    Exhaustion of rights is irrelevant — the GPL is a grant of _permission_ , not an assertion of rights. This permission is to use, modify, and distribute the code as one pleases, as long as you forward that permission to any “downstream” recipients.

    In other words, under the GPL the author(s) of the code promise(s) not assert his/her/their right(s) under copyright law, so as long as one passes on that permission whenever one distributes the software in question in turn, and also informs the recipient that they in fact are receiving that permission. In order to insure that the grant is meaningful, this includes making available to the recipient the full source code needed to actually take advantage of this permission.

    The GPL actually _does_ allow one to sell the software in question — in fact it specifically and explicitly says so, in very plain language. As long as the seller passes on the GPL grant along with the software, the seller can charge whatever he thinks appropriate. Hence the saying in GPL (General Public License) and FOSS (Free/Open Source Software) circles that GPL software is “Free as in Freedom, not as in Free Beer”).

  7. Ok sorry Bernie please go and read GPL. At no point in the complete document are you granted the right to sell it.

    http://www.gnu.org/licenses/gpl.html Only sections to mention selling are sections 10 and 11.

    10. Automatic Licensing of Downstream Recipients. Says you must pass conditions down stream. No where in there does it say you can sell it.

    “You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License. For example, you may not impose a license fee, royalty, or other charge for exercise of rights granted under this License, and you may not initiate litigation (including a cross-claim or counterclaim in a lawsuit) alleging that any patent claim is infringed by making, using, selling, offering for sale, or importing the Program or any portion of it.”

    This is commonly miss read. Please show me where you have been granted the right to sell. You have not. This example here clearly is define as for a fee charged to use the software. Same is in section 11. Neither are a grant of the right to sell. Yes the evil of legal documents just because it talks about something in examples does not mean there is a matching grant.

    Authors of the program are truly allowed to get together as a collective and sell the program. The two clauses in GPL talking about selling allow Authors with this legal right to sell and not be attacked even if they are selling under a commercial license. But as a non Authors downstream receiver you don’t have the right of sale its never been granted.

    Basically “exhaustion of rights and first sale doctrine” Require a sale point to become operational. The right to sell under GPL was never granted. So by law both are void since the item has not been lawfully sold and the authors fully copyright is still in full effect ie pre first sale.

    You can look at GPL like a non expiring trial program when it comes to “exhaustion of rights and first sale doctrine”. You don’t get exhaustion of right or first sale doctrine on a trail application either due to the same reason a sale has not happen. It does not matter if I trail software on a hard-drive an sell you the computer. My sale of the computer does not alter the conditions the trail software has. In the same way it does not alter the conditions GPL software has. This is the problem even that GPL software was in the rom of the device it was never sold. The device was sold not the software. If you try to claim the software was sold you have a issue that GPL never granted the right to sell. So you sell support, setup time, disks, packaging, distribution costs… Basically sell everything bar the software. Since you don’t have the right to sell the software.

    “This permission is to use, modify, and distribute the code as one pleases, as long as you forward that permission to any “downstream” recipients.” Distribute as one pleases is not exactly right. Please find the exact block of text out of GPL that says you can distribute the code as one pleases. I am sorry no GPL does not. It has a list of conditions that must be meet even covering distribution failure is breach.

    Yes I am highly sick of people like Bernie. They have not read GPL fully and it god darn shows.

    • @ oiaohm

      While I am not a lawyer, it appears that you definitely aren’t either. However, I have actually read the GPL as well as what the legal experts have to say on this subject, including for example Eben Moglen , Professor of Law, Columbia Law School (http://emoglen.law.columbia.edu/) a co-author of the GPL, General counsel to the FSF, and Director-Counsel and Chairman of the Software Freedom Law Center (among other legal qualifications),.

      – – – – – – From the GPL: – – – – – – – – – – – – –

      Preamble

      The GNU General Public License is a free, copyleft license for software and other kinds of works.

      The licenses for most software and other practical works are designed to take away your freedom to share and change the works. By contrast, the GNU General Public License is intended to guarantee your freedom to share and change all versions of a program–to make sure it remains free software for all its users. We, the Free Software Foundation, use the GNU General Public License for most of our software; it applies also to any other work released this way by its authors. You can apply it to your programs, too.

      When we speak of free software, we are referring to freedom, not price. Our General Public Licenses are designed to make sure that you have the freedom to distribute copies of free software (and charge for them if you wish), that you receive source code or can get it if you want it, that you can change the software or use pieces of it in new free programs, and that you know you can do these things.

      To protect your rights, we need to prevent others from denying you these rights or asking you to surrender the rights. Therefore, you have certain responsibilities if you distribute copies of the software, or if you modify it: responsibilities to respect the freedom of others.

      For example, if you distribute copies of such a program, whether gratis or for a fee, you must pass on to the recipients the same freedoms that you received. You must make sure that they, too, receive or can get the source code. And you must show them these terms so they know their rights…

      I’d say that’s pretty clear

      10. Automatic Licensing of Downstream Recipients.

      You’re right, it does say that you must pass conditions down stream. And nowhere does it say you can sell it. And nowhere does it say you can’t sell it. What it does say is that you can’t require license fees, royalties, etc, to exercise any of their rights to the software (because that would after all be restricting their freedoms already granted by the GPL).

      Your comments about Section 11 are similarly off the mark; this section is simply about ensuring that the author’s own relevant patents can not be asserted against the code he himself releases under the GPL. In other words, the relevant patent licenses must accompany the code — you can’t give with one hand (via GPL) and take back with the other (via patent assertion). The nutshell summary is this paragraph:

      “Each contributor grants you a non-exclusive, worldwide, royalty-free patent license under the contributor’s essential patent claims, to make, use, sell, offer for sale, import and otherwise run, modify and propagate the contents of its contributor version.”.

      but the rest of the section is worth reading.

      If you still have doubts about “my interpretation”, here is what the GNU organization itself says about the GPL:

      – – – – – – From the Gnu.org FAQ – – – – – – – – – – – – – – – – – –

      “Frequently Asked Questions about the GNU Licenses”

      http://www.gnu.org/licenses/gpl-faq.html#DoesTheGPLAllowMoney

      Does the GPL allow me to sell copies of the program for money?

      Yes, the GPL allows everyone to do this. The right to sell copies is part of the definition of free software. Except in one special situation, there is no limit on what price you can charge. (The one exception is the required written offer to provide source code that must accompany binary-only release.)

      Does the GPL allow me to charge a fee for downloading the program from my site?

      Yes. You can charge any fee you wish for distributing a copy of the program. If you distribute binaries by download, you must provide “equivalent access” to download the source—therefore, the fee to download source may not be greater than the fee to download the binary.

      Does the GPL allow me to require that anyone who receives the software must pay me a fee and/or notify me?

      No. In fact, a requirement like that would make the program non-free. If people have to pay when they get a copy of a program, or if they have to notify anyone in particular, then the program is not free. See the definition of free software.

      The GPL is a free software license, and therefore it permits people to use and even redistribute the software without being required to pay anyone a fee for doing so.

      If I use a piece of software that has been obtained under the GNU GPL, am I allowed to modify the original code into a new program, then distribute and sell that new program commercially?
      You are allowed to sell copies of the modified program commercially, but only under the terms of the GNU GPL. Thus, for instance, you must make the source code available to the users of the program as described in the GPL, and they must be allowed to redistribute and modify it as described in the GPL.

      These requirements are the condition for including the GPL-covered code you received in a program of your own.

      – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – – –

      Yes, I too am highly sick of people who have not read GPL fully and it god darn shows.
      ;-)

      I am assuming honest ignorance, rather than deliberate mis-representation. Considering how much deliberate FUD is purposefully fomented around the topics of Free Software, the GPL, Linux, and “Intellectual Property”, etc, it is unfortunately easy enough to be an unwitting victim of such FUD, and consequently mis-interpret or overlook important details, through unconscious bias.

  8. This comes as no surprise to me, let’s be honest (Telstra can’t) there’s commercial interests that are driving the cash cow! and who knows, it could have been a deliberate act to see if anyone. 1. Complained 2. Noticed 3. Cared.

    Even if any prosecution takes place I personally doubt that anything other than a “oops sorry” will take place because they (Telstra) will want the end user to remain on their firmware etc…

    Similar has happened with Telstra supplied Android mobile phones, they hide behind HTC and don’t provide source code to the open source portions of the firmware used. The only thing different is that the GPL licences are included in the rom.

  9. I am pretty sure that T-Hub is produced by *Sagemcom* and not Sagem.

    This is the same thing that “Tabbee by Orange”.

    See http://tabbee.fr/ (This is in french but it is obviously the same product.

    Sagemcom is a former division of Sagem, which no longer exists, and was recently know as Sagem Communication.

    http://www.sagemcom.com/EN/about-sagemcom.html

    See also here:
    http://www.lemondenumerique.com/article-17520-sagemcom-homescreen-la-tabbee-without-sans-orange.html

Comments are closed.