The recently-proposed "Version 3" of the General Public License (GPLv3) could dramatically change the business environment for Google, Amazon, and other prominent web businesses that use servers running the Linux operating system, by forcing them to make their technology available to competitors.

The change is controversial and, perhaps for that reason, subject to uncertainty. In this brief I explain how the change would work and why the evidence seems to confirm that GPLv3 does indeed carry this meaning.

One of the important requirements of the current GPL is that, when companies make improvements or changes to GPL software such as Linux, they make those improvements available to anyone else who might want them.

This requirement is triggered if the company sells or otherwise redistributes the modified software. Consequently, it does not apply to web companies such as Google and Amazon, which run their software only on their in-house servers, without distributing the code to anyone else. In the case of Google, the improvements engrafted onto the operating system include the powerful search technology that has propelled the company to a February 2006 net worth of $70 billion.

Some open source people feel that, since the provision of web services is a commercial use of software equivalent to the selling of software packages, it should trigger the same redistribution requirements. This is called "closing the ASP loophole." (ASP means a web company, and stands for application service provider.)

For example, Mike Olson, CEO of open source company Sleepy Cat Software, told Internet News in 2005 that:

My concern is that we run into a tragedy of the commons. There is this notion of quid pro quo, but if the vendor doesn't ship his software, he doesn't need to show his source code. That means a bunch of innovation is being taken out. This is an important problem for us working on the new GPL to get right. ... ...Yahoo, eBay, IBM, Amazon, Google have all sunk millions into the GPL infrastructure. Not only are we changing the rules, we are changing them retroactively.

Richard Stallman, the head of the FSF and the final arbiter of the provisions of the GPL, has foreshadowed closing the ASP loophole on numerous occasions, such as in NewsForge in 2000, Cnet in 2004, ZDNet in 2005 and OnLamp in 2005. In 2005, Stallman told ZDNet that:

We're looking at an approach where programs used in this way (on a public server) will have to include a command for the user to download the source for the version that is running.

Web companies are averse to disclosing valuable technology and might be expected to oppose any attempts to compel them to do so. Sun's open source advocate, Simon Phipps, wrote in his blog that: "A crude and explicit ASP clawback would have raised a riot." In its explanation of GPLv3, the Free Software Foundation (FSF), the body that controls the GPL, acknowledged the problem, and made this comment on the ASP issue:

Consider the treatment of software designed for public use on network servers. Given the variety of needs and concerns in this area, in which different parties have disparate and strongly-held positions, we have chosen not to add requirements about public use of modified versions in the GPL itself. Instead we have made a variety of possible license requirements compatible with the GPL, through an enhanced compatibility provision; thus we leave individual developers scope for choosing among requirements to apply for public use of their code. We have intentionally done nothing that might threaten to divide free software developers from free software users.

This has prompted the suggestion that the FSF is understating the true impact of its changes on this point. Phipps notes that his initial impression was that "the new GPL funked out on the provision to rein in the ASPs," but that he has changed his mind, and thinks that the drafters have been far more subtle, disowning the intent to rein in the ASPs while inserting several provisions that will in fact lead to that affect by letting the individual developers of GPL code achieve this result.

This view seems correct, because GPLv3 clearly provides tools to allow developers to force web companies to disclose their technology. Section 7(d) of the 16 Jan 2006 draft stipulates that, where the developer of a package includes a command to make source code available, web companies must honour that command. [1]Since many developers of GPL software are ideologically committed to free software principles, it's likely many would avail themselves of this facility in the new license.

In practice this could be as simple as the developer including a button labeled, "Download source code for this web site." Web sites using that developer's package would then be required, under the GPLv3, to honour the intent of that command, and provide their source modifications for download when the button was clicked. It's not a technical feature, but a legal one.

If Linux included that command, say, and adopted the new GPLv3 licence, then Google, if it wanted to continue using new versions of Linux, would be required to make its search technology available for public download.

Phipps points out that section 5(c) of GPLv3, which specifies that copyright notices must be provided through each interactive user interface of the package, requires that any terms under section 7 be displayed. [2] Since section 7 includes the download feature, section 5(c) is effectively ensuring such download capability will be visible in all normal ways that users interact with the web company's web site.

He bolsters this claim by pointing to section 1's reference to "intimate data communication" between sub-programs, interpreting this as an attempt to ensure that all web usages, including programs called service oriented applications, which are clients that talk back to the server's operating system, fall within the scope of the GPLv3 and are thus subject to the disclosure requirement. [3] This suggests the FSF is being very careful to ensure that companies have no ways to escape any download requirements imposed by developers in connection GPLv3.

In my view, Phipps is right in his interpretation, and the GPLv3 subtly includes strong measures aimed at Google, Amazon and their ilk.

The Free Software Foundation's Eben Moglen has disputed this interpretation, and so has Sleepycat Software's Olson, but without addressing the concerns about Section 7(d). Moglen's alleged rebuttal predates the draft document, but only refers to the general aim, which is a long standing one within FSF. Also, read carefully, Moglen's denial of an intent to interfere with ASPs doesn't exactly say that the rules will remain the same; it refers only to a desire to retain the freedoms that exist under the license, and would be consistent with allowing individual developers to impose requirements that ASPs reveal their code. Olson contends that the year long public review process for the GPLv3 will expose any attempts to target web companies, but I am not so sure. The question remains, if the quoted sections of GPLv3 do not allow developers to add license terms forcing ASPs to reveal their source code, then why are there?

The fly in the ointment for GPL ideologues is that Linus Torvalds, who controls the Linux kernel, has explicitly rejected using GPLv3 for Linux. He plans to continue using GPLv2. Thus web services companies are safe for now -- unless Torvalds changes his mind, and he has not slammed the door on v3 --, so long as they are not dependent on other GPL software that does adopt GPLv3 and invoke the redistribution requirement. If Google or Amazon are in fact dependent on any GPL tools or applications apart from Linux, their future rides on whether the developers of those tools also reject GPLv3.

UPDATE: http://weblog.ipcentral.info/archives/2006/03/gplv3_web_compa_1.html

* Tony Healy is a software engineer based in Sydney, Australia, and a research fellow with the Institute for Policy Innovation (http://www.ipi.org/). The views expressed are his own and do not necessarily reflect the views of PFF's board of directors, officers, or staff.