determine the risk of acquisitions.  Those handling M\&A issues should pay

particular attention to the requirements of GPLv2~\S7 and GPLv3~\S10--12 ---

focusing on how they relate to the acquired assets may be of particular

importance.

For example, GPLv3\S10 clarifies that in business acquisitions, whether by

sale of assets or transfers of control, the acquiring party is downstream

from the party acquired.  This results in new automatic downstream licenses

from upstream copyright holders, licenses to all modifications made by the

acquired business, and rights to source code provisioning for the

now-downstream purchaser.  However, despite this aid given by explicit

language in GPLv3, acquirers must still confirm compliance by the acquired

(even if GPLv3\S10 does assert the the acquirers rights under GPL, that does

not help if the acquired is out of compliance altogether).  Furthermore, for

fear of later reprisal by the acquirer if a GPL violation is later discovered

in the acquired's product line, the acquired may need to seek a waiver and

release of from additional damages beyond a requirement to comply fully (and

a promise of rights restoration) if a GPL violation by the acquired is later

uncovered during completion of the acquisition or thereafter.

Finally, other advice available regarding handling of GPL compliance in an

M\&A situation tends to ignore the most important issue: most essential

copylefted software is not wholly copyrighted by the entities involved in the

M\&A transaction.  Therefore, copyleft obligations likely reach out to the

customers of all entities involved, as well as to the original copyright

holders of the copylefted work.  As such, notwithstanding the two paragraphs

in GPLv3\S10, the entities involved in M\&A should read the copyleft licenses

through the lens of third parties whose software freedom rights under those

licenses are of equal importance to then entities inside the transaction.

\section{User Products and Installation Information}

\label{user-products}

GPLv3 requires you to provide ``Installation Information'' when v3

software is distributed in a ``User Product.''  During the drafting of v3,

the debate over this requirement was contentious.  However, the provision

as it appears in the final license is reasonable and easy to understand.

If you put GPLv3'd software into a User Product (as defined by the

license) and \emph{you} have the ability to install modified versions onto

that device, you must provide information that makes it possible for the

user to install functioning, modified versions of the software.  Note that

if no one, including you, can install a modified version, this provision

does not apply.  For example, if the software is burned onto an

non-field-upgradable ROM chip, and the only way that chip can be upgraded

is by producing a new one via a hardware factory process, then it is

acceptable that the users cannot electronically upgrade the software

themselves.

Furthermore, you are permitted to refuse support service, warranties, and

software updates to a user who has installed a modified version.  You may

even forbid network access to devices that behave out of specification due

to such modifications.  Indeed, this permission fits clearly with usual

industry practice.  While it is impossible to provide a device that is

completely unmodifiable\footnote{Consider that the iPhone, a device

  designed primarily to restrict users' freedom to modify it, was unlocked

  and modified within 48 hours of its release.}, users are generally on

notice that they risk voiding their warranties and losing their update and

support services when they make modifications.\footnote{A popular t-shirt

  in the software freedom community reads: ``I void warranties.''.  Our community is

  well-known for modifying products with full knowledge of the

  consequences.  GPLv3's ``Installation Instructions'' section merely

  confirms that reality, and makes sure GPL rights can be fully exercised,

  even if users exercise those rights at their own peril.}

GPLv3 is in many ways better for distributors who seek some degree of

device lock-down.  Technical processes are always found for subverting any

lock-down; pursuing it is a losing battle regardless.  With GPLv3, unlike

with GPLv2, the license gives you clear provisions that you can rely on

when you are forced to cut off support, service or warranty for a customer

who has chosen to modify.

% FIXME-soon: write a full section on Javascript compliance.  Here's a

%             potentially useful one-sentence introduction for such a

%             section.

% Non-compliance with GPLv3 in the

% distribution of Javascript on the Web is becoming more frequent

%FIXME-soon: END

\section{Beware The Consultant in Enforcers' Clothing}

There are admittedly portions of the GPL enforcement community that function

somewhat like the

\href{http://en.wikipedia.org/wiki/Hacker_%28computer_security%29#Classifications}{computer

  security and network penetration testing hacker community}.  By analogy,

most COGEO's consider themselves

\href{http://en.wikipedia.org/wiki/White_hat_%28computer_security%29}{white hats},

while some might appropriately call

\hyperref[Proprietary Relicensing]{proprietary relicensing} by the name ``\href{http://en.wikipedia.org/wiki/Hacker_%28computer_security%29#Black_hat}{black hats}''.

And, to finalize the analogy, there are indeed few

\href{http://en.wikipedia.org/wiki/Grey_hat}{grey hat} GPL enforcers.

Grey hat GPL enforcers usually have done some community-oriented GPL

enforcement themselves, typically working as a volunteer for a COGEO, but make

their living as a ``hired gun'' consultant to find GPL violations and offer

to ``fix them'' for companies.  Other such operators hold copyrights in some

key piece of copylefted software and enforce as a mechanism to find out who

is most likely to fund improvements on the software.

A few companies report that they have formed beneficial consulting or

employment relationships with developers they first encountered through

enforcement.  In some such cases, companies have worked with such consultants

to alter the mode of use of the project's code in the company's products.

More often in these cases, the communication channels opened in the course of

the inquiry served other consulting purposes later.

Feelings and opinions about this behavior are mixed within the larger

copyleft community.  Some see it as a reasonable business model and others

renounce it as corrupt behavior.  Regardless, a GPL

violator should always immediately determine the motivations of the

enforcer via documented, verifiable facts.  For example, COGEOs such as the FSF and Conservancy have made substantial

public commitments to enforce in a way that is uniform, transparent, and

publicly documented.  Furthermore, since these specific organizations are

public charities in the USA, they

are accountable to the IRS (and the public at large) in their annual Form 990

filings.   Everyone may examine their revenue models and scrutinize their

work.

However, entities and individuals who do GPL enforcement centered primarily

around a profit motive are likely the most dangerous enforcement entities for

one simple reason: an agreement to comply fully with the GPL for past and

future products --- always the paramount goal to COGEOs --- may not suffice as

adequate resolution for a proprietary relicensing company or grey hat GPL

enforcer.  Therefore, violators must consider carefully who has

made the enforcement inquiry and ask when and where the enforcer made public

commitments and reports regarding their enforcement work and perhaps even ask

the enforcer to directly mimic CEOGEO's detailed public disclosures and

  resolution} found in this document.

\chapter{Conclusion}

GPL compliance need not be an onerous process.  Historically, struggles

have been the result of poor development methodologies and communications,

rather than any unexpected application of the GPL's source code disclosure

requirements.

Compliance is straightforward when the entirety of your enterprise is

well-informed and well-coordinated.  The receptionists should know how to

route a GPL source request or accusation of infringement.  The lawyers

should know the basic provisions of Free Software licenses and your source

disclosure requirements, and should explain those details to the software

developers.  The software developers should use a version control system

that allows them to associate versions of source with distributed

binaries, have a well-documented build process that anyone skilled in the

art can understand, and inform the lawyers when they bring in new

software.  Managers should build systems and procedures that keep everyone

on target.  With these practices in place, any organization can comply

with the GPL without serious effort, and receive the substantial benefits

of good citizenship in the software freedom community, and lots of great code

ready-made for their products.

\vfill

% LocalWords:  redistributors NeXT's Slashdot Welte gpl ISC embedders BusyBox

% LocalWords:  someone's downloadable subdirectory subdirectories filesystem

% LocalWords:  roadmap README upstream's Ravicher's FOSSology readme CDs iPhone

% LocalWords:  makefiles violator's Michlmayr Stallman RMS GPL'd Harald LGPL

%%  LocalWords:  GPL's resellers copylefted sublicenses GPLv unmanaged MySQL

%%  LocalWords:  misassessments licensor COGEOs COGEO LGPLv CCS Requestors

%%  LocalWords:  codebase Yocto distributees COGEO's Coreboot ERP reseller

%%  LocalWords:  redistributor reinstatements decompilation acquired's grey

%%  LocalWords:  upgradable unmodifiable Relicensing relicensing