What usage restrictions can we place in a free software license?

[mjg59]

Growing awareness of the wider social and political impact of software development has led to efforts to write licenses that prevent software being used to engage in acts that are seen as socially harmful, with the Hippocratic License being perhaps the most discussed example (although the JSON license's requirement that the software be used for good, not evil, is arguably an earlier version of the theme). The problem with these licenses is that they're pretty much universally considered to fall outside the definition of free software or open source licenses due to their restrictions on use, and there's a whole bunch of people who have very strong feelings that this is a very important thing. There's also the more fundamental underlying point that it's hard to write a license like this where everyone agrees on whether a specific thing is bad or not (eg, while many people working on a project may feel that it's reasonable to prohibit the software being used to support drone strikes, others may feel that the project shouldn't have a position on the use of the software to support drone strikes and some may even feel that some people should be the victims of drone strikes). This is, it turns out, all quite complicated.

But there is something that many (but not all) people in the free software community agree on - certain restrictions are legitimate if they ultimately provide more freedom. Traditionally this was limited to restrictions on distribution (eg, the GPL requires that your recipient be able to obtain corresponding source code, and for GPLv3 must also be able to obtain the necessary signing keys to be able to replace it in covered devices), but more recently there's been some restrictions that don't require distribution. The best known is probably the clause in the Affero GPL (or AGPL) that requires that users interacting with covered code over a network be able to download the source code, but the Cryptographic Autonomy License (recently approved as an Open Source license) goes further and requires that users be able to obtain their data in order to self-host an equivalent instance.

We can construct examples of where these prevent certain fields of endeavour, but the tradeoff has been deemed worth it - the benefits to user freedom that these licenses provide is greater than the corresponding cost to what you can do. How far can that tradeoff be pushed? So, here's a thought experiment. What if we write a license that's something like the following:

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:

1. All permissions granted by this license must be passed on to all recipients of modified or unmodified versions of this work
2. This work may not be used in any way that impairs any individual's ability to exercise the permissions granted by this license, whether or not they have received a copy of the covered work

This feels like the logical extreme of the argument. Any way you could use the covered work that would restrict someone else's ability to do the same is prohibited. This means that, for example, you couldn't use the software to implement a DRM mechanism that the user couldn't replace (along the lines of GPLv3's anti-Tivoisation clause), but it would also mean that you couldn't use the software to kill someone with a drone (doing so would impair their ability to make use of the software). The net effect is along the lines of the Hippocratic license, but it's framed in a way that is focused on user freedom.

To be clear, I don't think this is a good license - it has a bunch of unfortunate consequences like it being impossible to use covered code in self-defence if doing so would impair your attacker's ability to use the software. I'm not advocating this as a solution to anything. But I am interested in seeing whether the perception of the argument changes when we refocus it on user freedom as opposed to an independent ethical goal.

Thoughts?

Edit:

Rich Felker on Twitter had an interesting thought - if clause 2 above is replaced with:

2. Your rights under this license terminate if you impair any individual's ability to exercise the permissions granted by this license, even if the covered work is not used to do so

how does that change things? My gut feeling is that covering actions that are unrelated to the use of the software might be a reach too far, but it gets away from the idea that it's your use of the software that triggers the clause.

Comments

[(Anonymous)]

The original version looks too far, as it places a restriction on use. However, Rich's modified version actually seem quite reasonable to me. It doesn't feel like a use restriction anymore, it feels like a prohibition on infringing user's rights. More importantly, it's phrased as "your rights under this license terminate if". You don't need a license to *use*; you need a license to do anything *else*, like copy or redistribute. That seems like a reasonable balance.

Getting the details right will require a lot more clarity, but the general principle seems much closer to sound.

Unintentional conseqences?

[(Anonymous)]

That second form would (at least in my reading of it) e.g. terminate the license for parents who restrict their children's computer time. So yes, I am on the side of this potentially reaching too far :)

[damerell]

It seems to me that any time I am doing something involving preventing unauthorised use of computers - which is to say, always - I am impairing "any individual's ability to exercise the permissions granted by this license"; but inserting (say) "lawfully" there has other unwanted consequences the most obvious of which is the government can now pass a law against you using the software with impunity.

[(Anonymous)]

The modified version still removes your ability to use the software if you're attacked by somebody and defend yourself, in the process causing enough damage to them that their ability to use the software would be impaired - i.e. you kill them, but maybe also if you break their arm, which would undeniably impair their ability to use a computer. Yet this might be perfectly legal in your country - it certainly can be in the UK if it falls under the idea of a proportionate response to an imminent threat.

So really it's just broader - in your original version, you'd only have a problem if you injured them using the software itself.

I'm totally on board with an idea of moral rightness, hard though that is to define, and I think the idea of somebody's ability to use the software the same way you do is an interesting place to explore because it's morally neutral in all matters other than that they get to use the software.

And no I don't spend all my time in fights, but I am a martial arts instructor so we do have to think about these things.

Acceptance of license not necessary to run/use the program?

[grok_mctanys]

One thing that the A/GPL has always been fairly clear on was that you are not required to accept a license in order to run a program. The license is triggered when you provide a work to someone, not when you receive a work from someone. From the GPL2:

Activities other than copying, distribution and modification are not covered by this License; they are outside its scope. The act of running the Program is not restricted [...]

From the AGPL3:

You are not required to accept this License in order to receive or run a copy of the Program. [...] However, nothing other than this License grants you permission to propagate or modify any covered work. These actions infringe copyright if you do not accept this License. Therefore, by modifying or propagating a covered work, you indicate your acceptance of this License to do so.

While I think your ideas are definitely moving in the right direction, I'm not sure that terminating Free Software licences for certain use cases will actually provide a legal barrier against people being able to run such software in ways that restrict others' freedoms.

In order to make that move, we'll have to start making a claim that running a program you have legally acquired requires a license. Now, there are some closed-source programs which claim that because the act of running them causes them to be copied from disk into memory, running a program infringes copyright without a valid license. I personally feel that this is utter bullshit, and it would make my skin itch to have that kind of reasoning added to Free Software licenses. However, it could just be that I don't like the idea because of where it came from, and it's actually the kind of judo move, like copyleft, that could help. My instincts say "No", but my brain has learned to question my instincts.

In the US, merely running a program does not require a license

[(Anonymous)]

17 USC 117 (a)

Notwithstanding the provisions of section 106, it is not an infringement for the owner of a copy of a computer program to make or authorize the making of another copy or adaptation of that computer program provided ... that such a new copy or adaptation is created as an essential step in the utilization of the computer program in conjunction with a machine and that it is used in no other manner...

This became law all the way back in 1980. Granted, other jurisdictions may have other views on this.

Absent any sort of binding contract or overriding law, you can't impose any use restrictions on a recipient of software (or any other copyrighted material) Redisribution is another matter, but any limitations on that still fall to the distributor rather than the recipient, as the latter has not actually agreed to anything.

(Tesla uses Ubuntu in their cars. Let's say someone driving a Tesla kills a pedestrian, thereby depriving them of their fundamental right to life, liberty, and quasi-Free Software. Should the driver, the car owner, Tesla, its hardware OEM/ODM, the organization providing the download mirror, Canonical, or GitHub lose their rights under this proposed license text?)

Driving and software licences

[bens_dad]

If the *car* drives over a pedestrian, I would have sympathy with Ubuntu stopping Tesla from using Ubuntu.

If Ubuntu believed that a bug in Ubuntu was responsible, would it not have a *duty* to temporarily revoke rights to use (this version of) their software for relevant purposes, just as a car manufacturer has a duty to recall a dangerous car ?

Re: In the US, merely running a program does not require a license

[bens_dad]

Doesn't "merely running a program" cover (some) SaaS ?

If I modify a GPL program and make a web interface which allows my customers to interact with my modified program, is it not the desire and intent of the GPL that I must provide my customers with my modifications ?

Re: In the US, merely running a program does not require a license

[grok_mctanys]

The GPL does not cover this, no. The AGPL does, in §13:

Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) an opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. This Corresponding Source shall include the Corresponding Source for any work covered by version 3 of the GNU General Public License that is incorporated pursuant to the following paragraph.

...which is the only significant difference between the two licenses. That is the use case that the AGPL was written to cover.

I think both are going to go over

[smooge.id.fedoraproject.org]

I think that both are going to end up as being seen as over-reach. Take the case of conjoined twins which have to be separated for one of them to survive. The action of separation will mean every nurse/doctor who were part of the operation can no longer use the software. The parents for either allowing the operation (and one of their children dieing) or not allowing the operation (and both dieing) and finally the surviving twin have all done something that under either license means their rights have been terminated.

Going further, every action you do at some point will impair some one's ability to exercise the permissions. The "I can't tell my kid to get off the computer anymore." but also "I allowed my kid to use the computer to 6 am and they were impaired in the ability to use the software the next day". You can't serve alcohol or any other item which impairs reasoning ability. You can't stop someone from getting hit by a truck NOR can you allow them to be hit by the truck. [I expect that some of my examples are going way too far legally.. but I also expect that they may be close to what a legal argument would be that a court would say whether the license was 'valid' in the first place.]

Bad idea

[(Anonymous)]

The license is curious, but it is ultimately a very wrong thing to do. This is a copyright license. People should not be able to use copyright law to essentially write their own laws. GPL's distribution restrictions work because distribution of copyrighted works *is* something that the copyright law normally covers. Enforcement for such licenses would be just crazy and unworkable. I wish people would just stop using copyright to solve all your problems. DRM is bad enough already.

[mc776]

but it would also mean that you couldn't use the software to kill someone with a drone (doing so would impair their ability to make use of the software)

I don't see any court seriously interpreting such a clause that broadly. You might get a dissent here and there but Antonin Scalia is no longer with us and I just don't see any majority *not* reading in some kind of common-sense implication that the impairment must be against someone who could reasonably be expected to be willing and able to use the software, possibly even that the impairment must be more or less specific to using the software, or at least software in general, and not just a general impairment of doing anything at all. And this is all before considering the other commenters' objections about reasonable impairment like parents or network administrators.


Felker's modification is the worst kind of ticking time bomb that no lawyer would ever advise someone to touch, unless that lawyer is confident that the rightsholder is unable to sue and the illegality won't affect anything else in the project.


Overall I have some sympathy for the underlying motivations for these efforts but legally I agree with this commenter.

This is like thinking you can make a law that people have to leave each other alone

[m50d.wordpress.com]

This is some kind of software license libertarianism. It falls down because the distinction between a negative and positive right isn't objectively defined; in any conflict between people, both sides will be able to argue that they just wanted to be left alone and it's the other person who's infringing on their rights.

If someone uses the software in a CCTV system, can someone else claim they're being stressed out from being spied on and that's impairing their ability to use the software? If someone sells plugins for the program and someone asks them to make a plugin for their gay wedding and they don't want to, who's preventing whom from exercising their permissions? Someone who doesn't believe in property rights could argue that anyone who uses this software on a computer that they don't allow other people to use and administer is violating this license.