Open-source Software, otherwise known as OSS, has become an integral part of many businesses’ daily operations. This will not only drive innovation but also reduce development costs and foster collaboration between parties and open a world of possibilities for UK businesses. However, despite these benefits and OSS’s growing popularity, the use of OSS must be carefully traversed and is not without its legal complexities and pitfalls. OSS has a heavy crossover with copyright, licensing and Intellectual Property and presents significant challenges, particularly for UK businesses that need to ensure that they are fully compliant with the law.
In this article, I will explore the key issues surrounding using an OSS and Intellectual Property with a focus on the implications for UK companies. This comprehensive guide outlines the key aspects you, as a business owner, need to know and understand about copyright, licensing, and risk management when integrating OSS into your business.
What is Open-Source Software?
Open-Source Software refers to Software whose source code is made freely available to the public for modification, enhancement and redistribution. Source code is the backbone of a software program, written in programming languages and acting as a blueprint from which the Software is built. It will contain the logic, algorithms, and commands that dictate how the Software will react to the user’s inputs and process the user’s data.
However, source code is not “open source” merely because it is accessible. For Software to qualify as OSS, it must be licensed under a recognised open-source licence that grants the rights to use, modify, and redistribute the code. This is different to proprietary Software because the source code is protected and not shared. The main fundamental idea of an OSS is the idea of collaboration and community-driven software development, allowing users not only to use and modify but also to redistribute the Software, governed by specific licenses that dictate these rights.
Open-Source Licenses
The legal framework for OSS is built on the license that governs its use. These licences define the permissions and obligations that the users have for the Software and typically fall into two categories: either permissive licences or copyleft licences.
A permissive licence is generally more flexible and will allow users to modify, distribute and use the Software with minimal restriction. An example of a permissive licence would be an MIT Licence, which permits the integration of OSS into proprietary Software, provided the copyright notice and disclaimer are included.
A copyleft licence will strictly impose far more stringent conditions on the use and distribution of the Software. One of the most well-known copyleft licences is the GPL, otherwise known as the GNU General Public Licence. If a company has a GPL licence, if that company then uses or modifies the code, it is required to release the modified code under the same license. This aims to ensure that derivative works remain open source, even when incorporated into a proprietary product.
Copyright and Open-Source Software
OSS is still protected under copyright law, meaning the creators of the Software will still withhold exclusive rights to the code unless those rights are explicitly waived or modified by the license. In the United Kingdom, copyright law is governed by the Copyright, Designs and Patents Act 1988 (CDPA). This act establishes that the owner of the copyright has complete control over how the work is reproduced, distributed and modified, and it’s vital for UK businesses to understand and comply with these regulations when using OSS.
One of the key challenges for businesses using OSS is understanding the sometimes-complex relationship between the copyright ownership and the licence terms. A common misconception is that an OSS is freely available and is exempt from copyright restrictions. This is not always the case, as while the Software may be free to use, modify and distribute, it is still legally protected by copyright, and businesses must comply with the terms set out in the licence. The consequence of failing to follow these terms can be very severe.
Risk Management
When using or attempting to incorporate OSS into your company, there are associated risks, so businesses must adopt a proactive approach to comply with the law, mitigating and preventing unnecessary legal and financial risks. By taking control of the situation, companies can ensure they are on the right side of the law when it comes to OSS.
One of the primary risks that a business could face is failing to comply with the terms of an OSS licence. This could range from using OSS without proper attribution to violating copyleft requirements by failing to release the source code of a derivative work.
Regarding non-compliance with these licences, damages can be inflicted upon the company that has not followed these rules and in some cases, the company can lose the right to use the Software. To minimise or entirely mitigate this risk, UK companies must conduct their actions with due diligence before using any OSS. This means they should thoroughly research to identify the licence, verify attribution, and ensure they understand and can comply with the terms of the licence.
There is also another risk regarding security and liability risks because, whilst OSS is often reviewed and tested by large companies and by teams of developers, it is not immune to vulnerabilities. A company may unknowingly incorporate Software which contains security vulnerabilities and flaws, exposing them to cyberattacks by malicious parties. The company can be found liable for this, as they have not maintained proper security controls, and the OSS may include a disclaimer of liability.
Often, OSS licences contain provisions stating that the Software is provided without warranty or guarantee, meaning a business does not hold the original developers liable for any damages. Due to this, companies should regularly update and patch their Software to limit or prevent vulnerabilities. They should also conduct thorough code audits and testing before publishing to a public environment, review indemnity positions in the OSS, and assess potential liability risks.
One element that is often overlooked is the complexity of complying with an OSS and managing its integration with proprietary Software. Suppose a business combines OSS and proprietary code. In that case, they must be mindful of the implications of GPL-licensed code and that the entire software product may need to be released under the GPL, including the in-house proprietary components.
This, in turn, publishes potentially specialised company code and Software, which gives them a competitive edge over other competitors. To avoid risks of this happening, UK companies must conduct clear, open-source audits of the Software, keeping track of the licences and obligations of each OSS, educate the employees who are using the Software, particularly on the legal responsibilities associated with licensing, use open-source compliance tools and seek legal advice when in doubt of their standing and legal position.
Conclusion
OSS offers substantial benefits to UK companies, including cost savings, increased flexibility, and access to a wealth of company-driven innovation. However, there are complex legal minefields when using OSS regarding the specific licences and copyright laws that require careful audit and attention to avoid any potential risks. By understanding the various OSS licenses and managing the associated risks, businesses can harness the full power of OSS and drive innovation.
