This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

2022

Akka Is No Longer Open Source.

Akka’s license, which was Apache-2.0, changed from version 2.7 to the Business Source License, which companies can no longer use for free.
By Haksung Jang / CC BY 4.0 |

There is a growing number of cases where software companies that started out as open source change their license policy. Lightbend, a US company that had maintained an Apache-2.0 open source license policy, announced in September 2022 that it would change Akka’s license to BUSL-1.1 (Business Source License). Let’s take a look at what the Business Source License is, and what the background and impact are of Lightbend changing Akka’s license to BSL.

What is Akka?

Akka is a toolkit that simplifies distributed applications, in which multiple threads work concurrently on the JVM, based on the Actor Model. It is reportedly used mainly in backend platforms that require high performance, such as live chatting.

The License Change

Lightbend, a US company, changed Akka’s license in September 2022.

The main points of the license change are as follows.

  • Akka, which was open source (Apache-2.0), will be under a new license starting with v2.7.
  • The new license is BUSL-1.1 (Business Source License).
  • It can be used for free for noncommercial purposes, but a license fee must be paid for commercial use.

Lightbend stated that it had supported the Akka open source project under Apache-2.0 for over a decade, but that it had become difficult to sustain this.

Over the years, Lightbend has steadily borne more of the support for Akka. With Akka now considered critical infrastructure for many large organizations, the Apache 2.0 model becomes increasingly risky when a small company solely carries the maintenance effort. Balancing the global demands of our corporate community while supporting these needs of a vast open source base is a tremendous weight to bear.

In the end, Lightbend also gave up sustaining the Apache-2.0 open source model, and instead introduced BUSL-1.1, a “Source Available” license, to disclose source code to the community while generating revenue by charging enterprise users a license fee. The number of cases where companies that develop software as open source change their license policy to improve profitability has been increasing since 2018. MongoDB’s SSPL is a representative example, and Elasticsearch introduced the Elastic License. You can find the details on this in the previous post, ‘Elastic License 2.0 (subtitle: The Evolving Open Source License)’. It can be inferred that Lightbend also decided to change its license considering this background and profitability.

BUSL-1.1 had already been applied to several projects that used to be open source, even before Akka.

Business Source License

How is BUSL-1.1 different from an open source license?

Grants the right to use only for non-production use

Unlike a typical open source license, BUSL-1.1 grants the right to copy, modify, and redistribute only for non-production use.

The Licensor hereby grants you the right to copy, modify, create derivative works, redistribute, and make non-production use of the Licensed Work.

If your use does not qualify as non-production use, you are required to purchase a commercial license from the Licensor.

If your use of the Licensed Work does not comply with the requirements currently in effect as described in this License, you must purchase a commercial license from the Licensor, …

Therefore, companies using the version of Akka to which BUSL-1.1 applies (v2.7 and later) can no longer use Akka for free and must purchase a commercial license from Lightbend.

Change Date, Change License

Another characteristic of BUSL-1.1 is the Change Date and Change License. Once the Change Date passes after a version of the software under BUSL-1.1 is released, the Change License applies and BUSL-1.1 no longer applies.

Effective on the Change Date, or the fourth anniversary of the first publicly available distribution of a specific version of the Licensed Work under this License, whichever comes first, the Licensor hereby grants you rights under the terms of the Change License, and the rights granted in the paragraph above terminate.

For Akka’s BUSL-1.1, the Change Date is 3 years after release, and the Change License is Apache-2.0.

For example, if Akka 2.8 were released on January 1, 2023, after 3 years, from January 1, 2026, Apache-2.0 would apply and companies could also use it for free. BUSL-1.1 provides this Change License provision so that you have to pay to use the new version, but even old versions can be used for free even for commercial purposes. This appears to reflect an intent to charge large companies, the heavy users of the software.

Additional Use Grant

BUSL-1.1 has an Additional Use Grant provision that allows the Licensor to grant rights to commercial users under certain conditions.

The Licensor may make an Additional Use Grant, above, permitting limited production use.

Therefore, the Licensor can permit users to use the software for commercial purposes as needed. For example, Lightbend permitted the use of Akka when developing an application using Play Framework that utilizes akka.

Additional Use Grant: If you develop an application using a version of Play Framework that utilizes binary versions of akka-streams and its dependencies, you may use such binary versions of akka-streams and its dependencies in the development of your application only as they are incorporated into Play Framework and solely to implement the functionality provided by Play Framework; provided that, they are only used in the following way: Connecting to a Play Framework websocket and/or Play Framework request/response bodies for server and play-ws client.

Akka License FAQ

Lightbend provides an FAQ related to the Akka license change, and here are a few of the key points.

Free for startup-sized companies

First, looking at Akka’s pricing, it is provided for free to startup companies with annual revenue under $25 million.

Can I keep using older versions of Akka?

The license of older versions remains unchanged as Apache-2.0. However, additional features, improvements, non-critical security updates, and non-critical bug fixes will not be provided. For version 2.6.x, only critical security updates and critical bug fixes will be provided under Apache-2.0 for the next year, i.e., until September 2023.

We use it for production, as well as for development, testing, and staging. In which cases do we need a commercial license?

You only need a commercial license for the copies of the software used for production.

If Akka is used in production rather than for non-production use, a commercial license purchase is required even for government departments.

Government departments using Akka in production will require a commercial license.

Can I backport parts of BUSL-1.1 software to an older version under Apache-2.0?

No. This would violate Lightbend’s copyright, as well as Apache-2.0.

No. In this circumstance, you would either violate Lightbend’s copyright by re-releasing the code under Open Source, or you would violate the earlier Akka version’s Apache license by introducing incompatible BSL code (i.e., code subject to a use limitation not allowed by the Open Source Apache 2.0 license).

Closing

The role of corporate open source governance is becoming increasingly important. Using open source in products while complying with open source license obligations, such as attribution notices and source code disclosure, is a basic compliance activity that companies must maintain. However, there has recently been an increase in cases where software that used to be open source changes to a license that requires a commercial purchase, such as BUSL-1.1. Therefore, companies developing products/services using open source need to respond quickly to such license changes. Otherwise, it should be remembered that a license violation could result in significant losses.

In particular, companies should build an SBOM (Software Bill of Materials) management system so that, when they identify a license change case like this one with Akka, they can immediately determine which products/services or internal systems within the company use Akka and which version, and take the necessary action (using an older version, or purchasing a commercial license).

Thank you.

A Quick Look at the SFC v. Vizio Ruling

Let’s look at the background and issues of the SFC and Vizio GPL lawsuit.
By Haksung Jang / CC BY 4.0 |

Hello, this is Haksung Jang.

SFC (Software Freedom Conservancy) filed suit against Vizio, a US smart TV manufacturer, alleging violations of the GPL. On May 13, 2022, a US federal court issued a ruling related to this case.

I have put together a superficial summary of the background and implications of this ruling. Since I am not a legal expert, there may be errors in terminology or interpretation. I would appreciate it if experts could provide feedback. ^^

References

First, I would like to disclose the references I consulted while writing this article.

1. Background

On May 18, an article titled “US court holds ‘GPL is a contract too’ … recognizes consumers’ right to demand code” was published. The following sentence seemed to convey something important, but I did not quite understand exactly what it meant.

Out of curiosity, I looked into some materials and summarized what I understood in my own way. I hope this helps others who have had similar questions.

  • A licensee may use a work within the scope of the methods and conditions of use permitted by copyright law.
    • Here, “use” refers only to acts granted by economic rights under copyright, such as reproduction, public transmission, distribution, and the creation of derivative works; it does not include “usage” in the ordinary sense.
    • If there is a method or condition attached to an act of “usage” and it is violated, this does not constitute infringement of economic rights under copyright; only liability for breach of contract arises.
  • If a licensee acts outside the scope of the methods and conditions of use permitted by copyright law, this constitutes copyright infringement.
  • If it constitutes copyright infringement, criminal punishment and injunctive relief are possible for violation of copyright law.

Contract Law

  • A contract is generally an agreement between a licensor (in the case of open source, the copyright owner) and a licensee.
  • To impose liability under contract law, it is first required that a contract was validly formed between the two parties.
  • If a party breaches an obligation it bears by virtue of the contract’s (agreement’s) effect, only contractual liability for non-performance arises.
    • There is no risk of criminal punishment or injunctive relief, as with copyright infringement, but the agreed-upon amount of damages must be paid.
    • Whether a work under an open source license constitutes formation of a contract is disputed depending on jurisdiction.
  • Damages amounts and remedies are limited.

Examples

  • Copyright holders of GPL software have filed suit alleging copyright infringement
    • e.g., Harald Welte, Patrick McHardy
  • Jacobsen v. Katzer precedent
    • If a copyright license imposing license conditions is not complied with, this constitutes copyright infringement.
    • If a license provision is a condition, copyright law applies; if it is merely a covenant, contract law applies.
  • Hancom vs. Artifax
    • Hancom argued that there was no breach of contract because there was no act such as signing a contract or a process of mutual agreement.
    • The court ruled that this constituted a breach of contract.

1-2 US Federal Courts and State Courts

  • The United States has federal courts and state courts, each handling cases of a different character.
    • State courts: generally handle cases affecting the personal lives of residents (family law, probate law, etc.)
    • Federal courts
      • Consist of District Courts, Appellate Courts, and the Supreme Court.
      • Handle only a limited set of cases: constitutional matters, federal crimes, military law, intellectual property, etc.
      • Copyright law (the Copyright Act) is handled in federal court.
  • In the United States, federal courts have exclusive jurisdiction over copyright claims.
    • Accordingly, in the past, nearly all claims in US GPL litigation were brought in federal court, which has exclusive jurisdiction over copyright law.
  • If a complaint is filed in the wrong court, the case will be dismissed or transferred to another court.
    • That is, an action filed in state court can be removed if it is preempted by federal court jurisdiction.

2. History of the SFC v. Vizio Lawsuit

SFC filed suit against Vizio in October 2021. The contents of the suit at the time and the subsequent history are as follows.

2021-10-19

  • SFC filed suit in state court against Vizio, alleging violations of the GPL and LGPL in connection with SmartCast TVs.
    • plaintiff: Software Freedom Conservancy, Inc. ("SFC")
    • defendant: Vizio, Inc. ("Vizio")
    • allege:
      • Vizio uses “at least twenty-five programs, including the Linux kernel software” in its smart TVs that are covered by the GPL Agreements,
      • Vizio does not make the corresponding source code for these programs available to purchasers of its smart TVs.
    • seek:
      • to enforce SFC’s right to have access to the source code corresponding to the executable code resident on Vizio’s devices covered by the GPL Agreements.
      • as a remedy to its breach of contract claim, SFC seeks to compel Vizio to make the source code available
    • claim:
      1. breach of contract and
      2. declaratory relief
        • Declaratory relief is a procedure within US civil procedure whereby a judge declares the rights, obligations, and responsibilities of the parties in a civil suit, without ordering any performance, action, or compensation. In patent and similar litigation, it is used by an alleged infringer as a claim or counterclaim against a patent holder to seek a declaration of non-infringement, invalidity, or unenforceability.
    • See: “Recent litigation cases: Stockfish v. ChessBase, SFC v. Vizio (Wonjae Park)”

2021-11-29

Vizio responded to this as follows.

  • Violating the GPL constitutes copyright infringement.
  • Because copyright law is preempted by federal courts, this is not a matter for state courts.
  • Under copyright law, only the copyright owner has the right to request source code under the GPL and LGPL, and SFC, as a consumer, has no right to demand source code.

For this reason, Vizio requested that the case, filed in state court, be handled by federal court instead (NOTICE of REMOVAL of ACTION to FEDERAL COURT).

If the federal court approves this, the case would need to be reviewed under US copyright law, and since SFC is not the copyright holder, it would not even have standing as a plaintiff.

In Response,

SFC rebutted Vizio’s arguments and filed a Motion to Remand with the federal court to have the case sent back to state court.

2022-05-13

The federal court granted SFC’s Motion to Remand (ORDER GRANTING PLAINTIFF’S MOTION TO REMAND) and remanded the case to state court.

3. Points Worth Noting

This lawsuit has several new aspects compared to prior GPL litigation. Heather Meeker, a US open source attorney, explained this as follows.

3-1. Breach of Contract and Specific Performance

  • In the past, nearly all GPL litigation was brought as a claim of copyright infringement.
  • However, this lawsuit is a claim under contract law, not copyright law.
  • Rather than seeking monetary damages, it seeks to require that all TV purchasers be provided with the technical information required by the copyleft license (disclosure of source code).
    • Rather than compensation for “damages,” it seeks disclosure of source code: “specific performance.”
  • Under contract law, any remedy sought other than monetary damages amounts to a demand for specific performance (specific performance is an unusual remedy under contract law).
  • Generally, a plaintiff seeks specific performance instead of compensation from a defendant who breached a contract when the plaintiff wants something that money cannot replace.

3-2. Claim Brought in State Court

  • In the United States, federal courts have exclusive jurisdiction over copyright claims.
  • Accordingly, in the past, nearly all claims in US GPL litigation were brought in federal court, which has exclusive jurisdiction over copyright law.
  • However, this lawsuit brought by SFC was filed in state court in Orange County, California.
  • State court litigation, compared to federal court, is less predictable, less consistent in outcome, and more likely to produce unexpected views on novel legal theories.

3-3. No Author as Plaintiff

  • SFC filed suit as a purchaser of the product.
  • In past GPL litigation, the plaintiff was the copyright owner of the GPL software.
  • In contrast, the plaintiff in this lawsuit is SFC, filing suit as a consumer who purchased a Vizio TV.
  • SFC aims to establish that not only copyright owners but also consumers of a product have the right to receive GPL source code.

3-4. Declaratory Relief

  • This lawsuit essentially asks the court to declare that the GPL and LGPL are legally enforceable and that Vizio violated them.
  • Even treating the GPL as a contract, since a contract is generally an agreement between a licensor (i.e., the code copyright owner) and a licensee, it is difficult to view SFC as a party to the contract.
  • For this reason, SFC brought suit under the theory that it, along with all consumers, is a third-party beneficiary of the contract.
    • Third Party Beneficiary: a person who is not a party to a contract but who can sue to enforce the contract — that is, a person who, although not a party to the contract, is directly involved in the benefit of the contract.
    • Third-party beneficiaries of the GPL: those who are not parties to the GPL contract, but who can obtain a benefit when the parties to the GPL contract perform it faithfully. One example of such a benefit is receiving the source code of GPL software.

4. Key Contents of the Federal Court Ruling (2022-05-13)

Let’s look at what the federal court ruled on May 13, 2022.

4-1. The Central Question

The court first explained the central question that the federal court needed to decide, as follows.

  • The only issue the court needs to decide is whether the federal Copyright Act completely preempts SFC’s claims (breach of contract and declaratory relief) so as to create federal jurisdiction.
  • If the claims are equivalent to rights within the general scope of copyright covered by federal copyright law (such as the exclusive rights of reproduction, distribution, and display of derivative works), they are preempted by federal copyright law and therefore create federal jurisdiction.
  • To argue that a case is not preempted by federal copyright law, the cause of action must protect rights other than those protected by copyright, and there must be an “extra element” that changes the nature of the suit.

4-2. Relevant Precedent: “Versata Software vs. Ameriprise”

  • The GPL’s requirement to disclose source code for a derivative work is separate from copyright obligations.
  • The defendant was not sued for copyright infringement.
    • It was sued by the plaintiff for violating an “additional obligation” — failure to comply with the source disclosure obligation — regarding a derivative work incorporating an open source program.
  • In this way, an “additional contractual promise” that does not correspond to a right provided by copyright law constitutes an “extra element.”

4-3. Whether SFC’s Claim Is an “Extra Element”

  • The purpose of copyright protection is the exclusive right to restrict who may reproduce, distribute, and display a work.
  • However, copyright law does not grant a right to receive source code. Such a right is, if anything, the opposite of the exclusive rights protected by copyright law.
  • SFC’s assertion, as a non-copyright-holder, of standing as a third-party beneficiary of the GPL agreement is distinct from rights arising under copyright law.
  • In other words, SFC’s claim that it is entitled to receive source code as a third-party beneficiary of the GPL agreement is an “extra element.”

4-4. Whether Vizio’s Argument Is Valid

  • Vizio argues that violating an open source license is copyright infringement, but SFC did not make a claim of copyright infringement in this lawsuit.
    • There is no reason for the court to rule on a matter the plaintiff did not claim.
    • Furthermore, since SFC is not the copyright holder, it could not even make such a claim.
    • SFC is not trying to use copyright law to restrict Vizio’s ability to reproduce or create derivative works; it is merely requesting that Vizio provide source code.
  • Vizio argued that since providing source code is a “condition” of the license, violating it is not a “breach of contract” but “copyright infringement.”
    • Accordingly, Vizio argued that SFC’s “contract claim” should be converted into a claim of copyright infringement.
    • However, only the violation of a “condition” — defined as “an act or event that must occur before a duty of performance arises” — can constitute copyright infringement; violations of all other license terms and covenants can only be litigated under contract law.
    • Furthermore, ambiguous contract provisions are interpreted as covenants, not conditions.

4-5 Ruling

  • SFC’s claims were not completely preempted by copyright law.
    • A GPL agreement functions both as a copyright license and as a contractual agreement.
  • Accordingly, the federal court lacks jurisdiction, and the Motion to Remand to state court is GRANTED.

5. Implications

SFC stated regarding this ruling that, while many people believe the GPL functions only as a copyright license, this decision marks a watershed moment in the history of copyleft licensing, showing that it functions as a contract as well as a copyright license. SFC also stated that this lawsuit is the first legal case to focus on the rights of individual consumers as third-party beneficiaries of the GPL, and that it looks forward to the opportunity to establish these consumer rights in state court.

Honestly, when I skimmed only the domestic (Korean) news coverage, I thought SFC had won the lawsuit and that ordinary consumers now had a legal right to demand GPL source code from companies. But this ruling was not a final decision on that question. As I understand it, it is a ruling that grants an opportunity to litigate this matter in state court going forward.

Finally, Heather Meeker’s commentary on this is a useful reference.

  • SFC is trying to establish a new standard for GPL litigation. This is welcome, but there are also concerns about a backlash.
    • Over the past 25 years, many companies that build products using GPL software have not been greatly worried about GPL litigation.
    • If SFC prevails in this lawsuit, companies could become burdened in using GPL code, which could become an obstacle to the spread of free software.
    • Also, if the general public becomes able to bring GPL litigation, trolls seeking purely financial gain could emerge.
  • It is also not yet known whether SFC’s attempt will succeed.
    • The fact that the federal court did not dismiss the case but instead remanded it to state court can be seen not as fully accepting SFC’s arguments, but simply as a determination that the case was not appropriate for federal court and therefore there was no basis for dismissal.
    • For now, SFC has gained a foothold to argue that it is entitled, as a third-party beneficiary of the GPL, to demand disclosure of source code from the defendant.
    • However, this lawsuit could become complex, prolonged, and costly going forward.
    • Most GPL litigation is often resolved quickly through settlement.

With that, I will wrap up this summary and take another look at the domestic article that I had trouble understanding earlier.

Now it seems to make sense. However, I still don’t understand why it says the case was remanded “(to a higher court).” A US district court is a federal court, and this case was remanded to state court — so why does it say remanded “(to a higher court)”? Is it a typo? Do Americans refer to state courts as a “higher court”? Or am I misunderstanding something? I would welcome an opinion from a legal expert. :)

Thank you.

Challenges and Effects of Adopting InnerSource

By Haksung Jang / CC BY 4.0 |

Hello, this is Haksung Jang.

InnerSource is a method of introducing open source development methodology inside an organization to maximize cross-team sharing and collaboration, and to gain effects such as faster development speed, transparent communication, and improved code quality.

Several documents explain methods for InnerSource. Today I have briefly summarized the ways to start InnerSource and the expected effects as described in the following material, so please refer to it.

1. Key Open Source Practices

First, let’s look at the key practices emphasized in open source development methodology. How can a massive open source project grow through voluntary participation? Why is it said that participating in an open source project can lead to individual developer growth? This is because open source projects have the following key practices.

(1) Cross-Team Collaboration

  • In open source projects, code is shared with the whole world, so anyone can freely view, learn from, and improve it.
  • There are rules for freely creating and merging branches, and tools that make this possible.
  • This allows people to work on the same code regardless of their work location.

(2) Documentation

  • Open source projects document code in as much detail as possible.
  • This documentation leads to improvements in software architecture. When explaining something through documentation, you come to empathize with the need to change a complex, unintuitive architecture.
  • Well-documented projects also make it easier for new contributors to join.

(3) Continuous Test

  • Open source projects generally build a strict system for objectively testing each contribution. This maintains trust among collaborators and guarantees code quality.
  • In other words, there are tools and procedures to verify quality before committing a change.
    • unit test
    • continuous integration
    • code coverage
    • static analysis, etc.
  • Each developer must write unit tests for their own code.

(4) All Communication and Decision-Making Is Made Transparently Public

  • In open source projects, all communication is made public and left as a record.
  • Decisions are mostly made based on discussions on mailing lists.
  • Because all communication is documented and left as a record, anyone can understand the project through the documentation and newly join it.

(5) Developers Can Have Their Skills Recognized, and Mentor Other Developers

  • A developer who has contributed many commits can be regarded as a developer with a deep understanding of the project.
  • Such a developer comes to be recognized as a Trusted Committer.
  • A Trusted Committer is given the qualification to review / approve other developers’ work.
  • They also play a role in growing contributors into excellent developers by providing them with mentoring.

2. Effects of Adopting InnerSource

When a company introduces the open source practices described in section 1 internally, this is called InnerSource. For reference, InnerSource has its techniques and practices developed more systematically by communities such as InnerSource Commons.

So what effects can a company expect when it adopts InnerSource?

  1. Code reuse increases across the organization as a whole.
    • Developers on each team can understand, use, and contribute to modules and architecture developed by other teams.
  2. Code quality improves.
    • Quality improves through unit tests, code coverage, CI (continuous integration), static analysis, code review, and so on.
  3. Development speed increases.
    • As developers learn unit tests, code coverage, and CI (continuous integration), bugs decrease and development speed increases.
    • Communicating through written comments may seem to take time at first, but it helps new developers learn the system faster, which further improves development speed.
  4. As developers learn new skills in code design, testing, and documentation, they come to think about code design more comprehensively.
  5. Developers become better at documentation, which helps other team members understand the project better and make more contributions.
  6. Empowering developers can increase their intellectual growth and job satisfaction.

3. Challenges to Adopting InnerSource

Now let’s look at the challenges a company must consider when trying to adopt InnerSource.

Simply opening and sharing source code internally cannot be expected to produce the effects of InnerSource on its own. The following must necessarily accompany it.

  1. Documentation of all code in the repository
  2. Providing a collaboration environment and guides, such as GitHub, for collaboration
  3. Building a test environment and establishing rules: to guarantee the quality of newly incoming code
    • Running a code coverage test on at least 90% of the code before it is committed
    • Triggering an automatic build when a commit is made
  4. Defining modular architecture and APIs to encourage contributions from other organizations
  5. Giving participants pride in the work they have done, and actively encouraging them to present at conferences or contribute blog posts

4. Why Should Developers Participate in InnerSource Projects?

Even after an InnerSource environment has been built internally, developers who are busy with tasks within their own team may find it daunting to look at or contribute to another team’s code. However, participating in InnerSource projects is helpful for developers’ own growth.

  1. By participating in an internal InnerSource project before jumping straight into an external open source project, developers can learn and become familiar with open source practices.
    • In InnerSource, code review, commits, and testing are carried out in the open source way.
    • Developers become accustomed to documentation.
    • By learning new skills in testing and documentation, they can become excellent developers who think about code design more comprehensively.
  2. Simply observing the communication between a Trusted Committer and a Contributor is itself helpful.

For why developers should contribute to open source, please also refer to the following blog post: “Why Developers Should Contribute to Open Source”

Thank you.

Can I Use a Publicly Available Dataset to Build a Commercial AI Service?

Can I use this publicly available dataset to build commercial AI software?
By Haksung Jang / CC BY 4.0 |

Hello, I’m Haksung Jang.

AI has become such an essential technology in modern business that virtually no company operates without using it. Building an AI service requires large volumes of data, and publicly available datasets are also widely used for this purpose. However, even a publicly available dataset carries copyright, so using it in a commercial AI service requires checking its license to minimize legal risks such as copyright infringement.

Today, I want to introduce a recently published paper on this topic: Can I use this publicly available dataset to build commercial AI software? – A Case Study on Publicly Available Image Datasets: https://arxiv.org/abs/2111.02374

“Can I use this publicly available dataset to build commercial AI software? – A Case Study on Publicly Available Image Datasets”

- Gopi Krishnan Rajbahadur, Erika Tuck, Li Zi, Dayi Lin, Boyuan Chen, Zhen Ming (Jack)Jiang, Daniel Morales German

I hope this post gives some insight into the efforts and procedures needed to minimize copyright infringement when building an AI service that relies on publicly available datasets.

1. Intro

The paper first explains that, unlike open source licenses, licenses for using publicly available datasets present several difficult problems.

GitHub Copilot

Let me briefly touch on the debate surrounding GitHub Copilot here. The U.S.-based Software Freedom Conservancy (SFC) recently published a post titled “If Software is My Copilot, Who Programmed My Software?” pushing back against the claims made by Microsoft and GitHub.

Copilot is an AI service that GitHub trained on publicly available source code to help developers write code, and because this includes copyleft software, it has become a legal issue. In response, GitHub CEO Nat Friedman made the following counterargument:

However, the SFC warned that this position taken by GitHub could cause significant harm to Copilot users in the following ways. It therefore took the position that, in order to avoid infringing on someone else’s copyright, it is best not to use Copilot.

The SFC further argued that Microsoft and GitHub must prove why training on copylefted code qualifies as “fair use” and that the trained model is not a “work based on GPL’d software.”

2. Background

Let’s return to today’s paper. It explains copyright law and contract law as they relate to datasets.

In the end, the paper emphasizes that, for companies developing AI services using publicly available datasets (except in cases that can be judged as fair use), a rigorous approach to confirming the rights and obligations tied to the dataset and ensuring license compliance is important in order to prevent copyright infringement, breach of contract law, and the like.

However, as I will mention again later, checking the license of every dataset, data source, and even individual data point involved in using a publicly available dataset, and complying with each obligation, is close to impossible in practice. Personally, I think a realistic approach is to accept a certain amount of license risk in order to use a publicly available dataset, or to build a legal basis on which fair use can be argued.

Now let’s look at what rigorous approach the paper proposes for using publicly available datasets in commercial AI services.

3. Approach

The paper emphasizes that an AI engineer who wants to use a publicly available dataset must identify the applicable license, and a lawyer must analyze the rights and obligations of that license to determine whether it can be applied to a commercial AI service.

First, Phase 1 is the process in which the AI engineer confirms the license. The paper explains the details as follows.

That covers Phase 1, and there is quite a lot for an AI engineer who wants to use a publicly available dataset to confirm. A bigger problem is that no matter how much effort is put in, if a website provides no license information or provides incorrect information, the scope of what the AI engineer can confirm will inevitably be limited. In any case, let’s look further into the paper. Next is Phase 2, the stage in which a lawyer or other legal professional confirms the rights and obligations of the license.

Going through Phase 2, we’ve looked at how a legal professional documents license rights and obligations in the Enhanced MDL format and how this is used. The paper explains that checking not just the dataset’s license but also the licenses of its data sources matters, because if a data source’s license restricts commercial use, using the dataset commercially carries risk as well.

Using this same approach, the paper conducted case studies on other datasets as well. Let’s look at what it found.

4. Case Study Details

All six of these datasets are image datasets, and their licenses have the following characteristics.

DatasetDataset licenseData Source
CIFAR-10No license stated (citation only required)Multiple data sources
ImageNetcustom licenseMultiple data sources
Cityscapescustom licenseOne data source
FFHQCC-NC-SA-4.0Multiple data sources
VGGFaces2CC-NC-SA-4.0Multiple data sources
MS COCOCC 4.0Multiple data sources

Now let’s look at the results of the paper’s research on these six datasets.

Even just from the results described above, using a publicly available dataset in a commercial AI service carries the potential to cause a license compliance violation. Moreover, the paper further explains that there are additional aspects this study did not consider.

5. THREATS TO VALIDITY

Considering, as described above, both the difficulty of confirming the license of individual data points and the difficulty of confirming a license from inaccurate information, I think it may be fair to conclude that using a publicly available dataset in a commercial AI service without any license risk is genuinely close to impossible. That said, publicly available datasets cannot be excluded entirely from AI product research either. Just as GitHub is preparing the Copilot service despite the copyright infringement issues — accepting a certain degree of legal risk and, where necessary, continuing to fight it out in court — it seems worth considering that a company should be willing to bear some degree of potential copyright infringement risk in order to make use of AI technology. In fact, there is also a view that using a dataset solely for machine learning training does not constitute copyright infringement.

  • Under Article 35-2 of the Copyright Act, temporary reproduction of a work on a computer is permitted. Based on this, there is room to argue that temporarily copying a publicly available dataset into memory during machine learning training is likewise permitted.
  • Article 35-3 of the Copyright Act permits the use of a work as fair use when the use does not conflict with the work’s normal exploitation and does not unreasonably prejudice the legitimate interests of the author. Using a publicly available dataset made up of image data solely for machine learning training does not conflict with the normal way pictures or photographs are exploited and does not harm the author’s interests, so it could be argued that this qualifies as fair use.

That said, since there is still no clear case law on this point, it cannot be said that there is no risk at all. (And by the way, I am not a lawyer, so please note that none of this carries any legal effect. ^^)

Overseas, countries such as those in Europe, Japan, and the United States have amended their laws to allow the use of big data for AI training, and I understand that a bill to amend the Copyright Act for this purpose has also been introduced in Korea’s National Assembly. I hope the government moves quickly to pass the necessary legislation so that domestic companies can use publicly available datasets more easily and accelerate innovation in AI technology.

Thank you.