How to force disgruntled worker not to publicly disclose "GPLed code"

Question

I'm currently the only HR worker at a medium sized engineering firm in Canada. There should normally be 2 additionally HR workers on-staff more senior than me, but one is on parental leave and the other position isn't currently filled, and I'm in over my head.

We are selling a product with a "custom Linux kernel installed". Our engineers say that "most of the product is GPL code we've modified", and that since we are selling a product with this software in place, "we're shipping GPLed code". Our company owns the copyright, but from a reading of how "GPL licenses" work, it sounds like some of our code is indeed GPLed. The plan was to never let the customer know GPL code was present in the product.

We have a senior engineer, "Francis", who doesn't get along with a more senior engineer, "Lee". In short, Francis pointed out a serious technical flaw in Lee's designs, and tried to encourage Lee to change his designs based on this information. Lee took it as a personal insult, and attempted to "squash" Francis (i.e. get him written up, even fired). Francis raised the issue with the entire engineering department, and embarrassed Lee significantly (i.e. Lee made a serious technical mistake, and his attempts to squash dissent made him look bad). We put the two on separate teams to prevent any further issues about 6 months ago.

Francis has since excelled on his new team, and was up for a significant promotion. However, a senior manager, "Ling", vetoed the promotion, citing Francis wasn't "mature enough" for the role (and didn't provide an indication as to when Francis would be mature enough). Lee and Ling are close personal friends, hence I sense a conflict of interest here. Somehow Francis found out about the veto (he shouldn't have access to this information). It turns out Lee gloated over the issue and disclosed it to Francis, and we promptly fired Lee (gave him half the normal severance he's entitled too as an alternative to firing with cause and getting nothing), and attempted to smooth things over with Francis. This caused substantial embarrassment for Ling.

We've started getting calls (addressed to Francis' colleagues and supervisors) for job references (pretty bold, since people rarely use their current employer as a reference while job hunting), and have determined that many of the companies calling are direct competitors. We called in Francis for a meeting, and he spelled out, bluntly, that he's looking for a new job, he's pissed over the veto debacle, and that we're welcome to give him severance (8 months' pay) to go away here and now. We don't want to lose him, but he has made unreasonable demands for a counter offer:

• The promotion (we'd consider it).
• 2 years guaranteed unconditional severance arrangement (even if he quits) (partially accepted: 2 years, unless he's fired with cause or quits).
• Guarantee of another promotion within the next 4 years (to ensure this isn't just a temporary counter offer to buy time before eventually firing him, and ensure he can still move up the ranks) (rejected, but promised the well wasn't poisoned.).
• Ling being further reprimanded/punished by the directors (rejected; we can only pass the details up to directors; they choose whether or not to discipline managers).

Francis seemed to be displeased with the results of his "negotiation", and indicated he'd continue job hunting on personal time. We reminded Francis of his non-compete clause, and he then retorted with something that raised red flags by the senior engineering team:

• He plans to move from Canada to the US (dual citizenship), which he feels would invalidate his non-compete significantly.
• He plans to work with a direct competitor, and re-create the work he's been doing for our company for the past 6 months.
• He plans to make large portions of the code, much of which is in "Linux Kernel" and "Docker" code, public, due to "an obligation to the FOSS community".

This last point would be disastrous, and suing Francis would not recover the lost potential profit. We stressed that he would be receiving correspondence from the legal team unless he took back what he said. He refused to speak any more after that point. We have him working remotely on "research tasks" (no access to servers) while we try and figure this out.

Anything that's sent to Legal has to be retained for at least 3 years. The engineering director has ordered me not to send any emails with "GPL" or "GNU" in it.

Is there anything we can do to prevent Francis from disclosing code out of spite? Are "super injunctions" real (i.e. like when celebrities want to prevent embarrassing news from being published)? Or are there other uncommon benefits that can be offered besides cash and extra vacation time (large raises are allowed, but not large bonuses)? Whether we throw a bigger/different bone, or find a way to forcibly stop him, we need to prevent disclosure.

Answer 1

This situation is spiraling out of control out of anger and frustration. I can't speak to the legal aspect, but it should not have gotten to this stage. You basically gave him nothing in negotiation and then now that he wants to leave, you are acting to trap him in his current position. He is a wounded animal fighting back.

The promotion (we'd consider it).

He got nothing there.

2 years guaranteed unconditional severance arrangement (even if he quits) (partially accepted: 2 years, unless he's fired with cause or quits).

Cause can always be found when someone wants to fire you. That's worthless.

Guarantee of another promotion within the next 4 years (to ensure this isn't just a temporary counter offer to buy time before eventually firing him, and ensure he can still move up the ranks) (rejected, but promised the well wasn't poisoned.)

This entire thing started due to management/HR at your company having limited integrity and now you want him to value your promise of integrity?

Ling being further reprimanded/punished by the directors (rejected; we can only pass the details up to directors; they choose whether or not to discipline managers).

So he got nothing there either.

The clearest course of action is to offer to largely waive the non-compete (plenty of places they cannot be enforced anyway) in exchange for confidentiality about company secrets and a nice reference letter.

Help him leave, offer him some severance money, and most likely he will be willing to agree to keep company secrets. Releasing the code is mutually assured destruction for both of you, so I doubt that is his goal and more just his leverage.

Heck, I would go even further and ask a member of the board to find him a cozy position at a similar (but not directly competing) company. He will go be happy and stop thinking about you day to day and have no interest in attacking your firm.

You lost him as soon as he was denied the promotion under questionable circumstances.

Answer 2

While I won't answer the original problem directly I wish to tackle something tangent to this. And I feel it is important enough to warrant an answer and not a comment.

From a comment (and the post) it is established that GPL'ed code is modified and distributed, without distributing also the modifications:

We are selling a product with a "custom linux kernel installed". Our engineers say that "most of the product is GPL code we've modified", and that since we are selling a product with this software in place, "we're shipping GPL'ed code"

The free software foundation (writers and maintainers of the GPL license) has a specific "faq" for this

The GPL does not require you to release your modified version, or any part of it. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.

But if you release the modified version to the public in some way, the GPL requires you to make the modified source code available to the program's users, under the GPL.

Thus, the GPL gives permission to release the modified program in certain ways, and not in other ways; but the decision of whether to release it is up to you.

Now you are hence violating the license, and since it is the linux kernel it is also "quite easy" to contact the original maintainers.

This creates a very vulnerable point for your company. Even if you manage to settle something with this employee, there will be another one after this. So you take the risk of each disgruntled employee to report it to the copyright holders.

I think a single employer is less of a problem than such a violation. I'd strongly urge you as company to either move away from using copyleft-licenses, or start decoupling the code from the GPL code and only work with lesser-gpl libraries (and don't modify them, use them). Or do something which google does with android: release to the public the modifications, but build upon those a personal layer; and make the profit not from the software but the service provided.

Answer 3

I know you did not ask anything on behalf of yourself but humanitarian considerations compel me to strongly advise you to avoid hanging around anywhere near the ass end of your company because that is where it is about to be badly bitten.

Your company has made some serious blunders. Not only have they irreparably mangled their relations with their employees, but they have committed a serious copyright violation against the authors of Linux. The reason for the blunders is obvious: your management is a bunch of unethical immoral lunatic idiots.

If they were essentially ethical and moral, they would have investigated the GPL before relying on it. There would be nothing to hide and a disgruntled employee would not have any leverage. If they were sane and clever, they would have fired the correct person 6 months ago and would not have created a whistleblower within their own staff. It is the combination of evil and stupid that will destroy the company.

Here are some red flags that tell me that a scapegoat will soon be needed:

• You are currently the entire HR staff, everyone else has scarpered

• Management is strongly focused on covering up instead of mitigating damage

• Management is insisting that HR (that's you and you alone) find a way to solve a dangerous legal problem without corresponding with the legal team

• The engineering director has ordered you not to send any emails with "GPL" or "GNU" in it

• The plan is to never let the customer know that GPL code is present in the product -- but you have just told us, on an indelible public platform, that there is

• You don't even know whether a confidentiality deal would be corrupt or illegal

• When the coverup fails, you will be the one who didn't make it succeed

• You've been reduced to seeking advice from random strangers on the internet

Your position may be untenable. I'll not rush to tell you to run away, but you should at least know the danger you are in.

Answer 4

Don’t retaliate against Francis. Talk to a lawyer.

Your company has been breaking the law with regard to your violations of the GPL, and now one of your employees wants to become a whistleblower. You’re already going to be in enough legal problems from your violations of copyright law; the last thing you want is to get in even more trouble from breaking whistleblower protection laws, and you’re going to need to talk to a lawyer to determine what your obligations under those are.

Answer 5

It's not in your interest to make this kind of decision. If something goes wrong, which is likely, the blame may fall on you.

This is a decision that has strategic and legal implications. And such a decision needs to be made by upper management in conjunction with your company's legal team.

As an HR person, your role is to make sure upper management is informed and your legal counsel is looped in.

Answer 6

Wow. This is a mess. Get lawyers and external consultants if you want to save your company.

I see many separate issues:

The plan was to never let the customer know GPL code was present in the product."

• That may or may not be Fraud. Ask a lawyer

We are selling a product with a "custom Linux kernel installed". Our engineers say that "most of the product is GPL code we've modified", and that since we are selling a product with this software in place, "we're shipping GPL'ed code".

• Your engineers are probably right, but ask a lawyer for ways around this (Ways around this have been good business in the past, but they require that you openly work with your customer)

i.e. Lee made a serious technical mistake, and his attempts to squash dissent made him look bad.

• Lee should have been fired back then since "squashing dissent" over something which turned out to be a serious problem is unprofessional

Somehow Francis found out about the veto (he shouldn't have access to this information). It turns out Lee gloated over the issue and disclosed it to Francis, and we promptly fired Lee (gave him half the normal severance he's entitled too as an alternative to firing with cause and getting nothing)

• Why was Ling not fired? He should have never disclosed this to Lee

and have determined that many of the companies calling are direct competitors.

• I really, really hope that your contracts are more watertight than your "We GPL code and don't tell the customer" approach

We called in Francis for a meeting, and he spelled out, bluntly, that he's looking for a new job, he's pissed over the veto debacle, and that we're welcome to give him severance (8 months' pay) to go away here and now.

• Nice and professional of him. He could probably sue you for much more.

Anything that's sent to Legal has to be retained for at least 3 years. The engineering director has ordered me not to send any emails with "GPL" or "GNU" in it.

• You must be f_ing kidding me. Not only that your company f_d up a central licensing issue for a core product and continued to lie to customers about it, you even admit that the company does not intent to fix the licensing issue but keep lying about it.

Is there anything we can do to prevent Francis from disclosing code out of spite?

Yes. Ask a lawyer versed in Canada and US law.

• The GPL gives the customer the right, not people working on it (IANAL), so it may or may not be that Francis is not entitled to obtain a copy of the code, ask a lawyer

• The problem here is not so much "taking away the code" (as you said, you have the copyright), but more the disclosure of your shady business practices to customers and public.

• Given what you wrote here, you currently maybe don't even have the license to distribute the product, which may (IANAL) or may note open you up to companies suing for compensation for re-licensing technologies which can not be technically separated from potentially alternatively licensed module

There are three essential ways to handle this:

• Continue lying and pay a lot to Francis in an exchange for an NDA and him leaving quietly (with glowing references)

• Come clean, let Francis go

• Come clean, fire Ling, give Francis shares of the company to give him some incentive for no going nuclear and make him the boss of the successors of Lee and Ling. Fire your compliance officer and fire the person responsible for the decision to lie to the customer.

I do not see that suing Francis is something which your company should put on their plate right now, it may do (IANAL) more damage than it prevents.

Answer 7

Not answering the question itself, my advice to you, if you say that your product solely relies on your modifications being kept a secret, is to find a new workplace, yesterday!

Why? Francis needs no more than going online via an internet-cafe and/or using the free WiFi of a "regular" cafe and using a strong, reliable VPN service, one that doesn't keep logs of users and your company's trade secrets are bust!

Even if you try legal action against him, unless he's a complete and total idiot, which he doesn't sound like, you'll have no proof, and all the while the milk would have been spilled.

Basically, your current company is in deep doo-dee.
Bail. Bail now.

Also, as I commented above, but to summarize my above comment: as long as you are with the company, start keeping all correspondence you have, in relation to this case and Francis, backed up in at least two storages not controlled by your company.
As someone else noted, you, through no fault of your own, have become the perfect patsy for your shitty management, should they need it.
It's not even loss of work, like I said, bail today. It's the possibility of becoming the legal face of your company. Against the FSF, owners of the Linux Kernel... want to take a guess how you fare up?

Good luck, and sorry for you that your crappy managers brought you to be in legal danger.
I hope your next place will be less crappy.

Answer 8

Summary: Shit happened. A lot of it was due to Lee (who got himself fired) and Ling (who got himself reprimanded) at the expense of Francis. Francis would be a valuable employee, but is now pissed off (understandably) and shows behaviour that threatens your company (not a good move, and not a clever move).

Before Francis went off the rails, the best solution, and the fairest solution, would have been to keep him happy and keep him employed. With the situation now, I would say that you cannot possibly keep him as an employee.

But it seems that Francis misunderstands what GPL-licensed code is. Even if your code is derived from GPL-licensed code, nobody can force you to publish it. In the worst case, if your company was in violation of its license, the copyright holder of the GPL-licensed code could sue you, but they cannot force you to publish your code. (They can give you arguments why it would be wiser to publish your code, but they cannot force you).

Francis however has no right whatsoever to publish your code. It is your copyrighted code. Nobody but your company has the right to publish it. If he publishes it, it's copyright infringement. You can sue him for actual damages. You can sue anyone using that code for copyright infringement and actual damages, so nobody will touch it. Of course you won't be able to recover all the damages from him, but you can make his life a misery for the rest of his life. That's what your legal department can tell him (in a cleaned up form, that's why they are lawyers).

I also must really recommend that you sort out your use of GPL-licensed code. Even though Francis has no right to publish your code, there is no way to prevent him from telling the world what you're doing. So you could find yourself in trouble.

(The GPL license basically says: You are allowed to use this code if you do A, B, C. If you don't follow the rules you are not allowed to use the code. And apparently you don't. That gives the copyright owner the right to sue you for copyright infringement. It doesn't give anyone the right to publish your code).

PS. You are allowed to use and modify GPL licensed source code if everyone receiving your software inside your product is given the complete source code. If customer A doesn't want to give the source code to potential customer B because B is a competitor of A, then you can do this and pray. Your customers would have a right to publish the source code in this case but hopefully don't want to.

And the problem doesn't go away when you have sold your products unless you want to close down the company and run away with the money.

@viraptor: No, Francis doesn't have any rights whatsoever to the source code. Nobody distributed the code to him. The copyright holder of the GPL licensed code has the right to sue the company, nobody else has any rights.

Answer 9

He plans to make large portions of the code, much of which is in "Linux Kernel" and "Docker" code, public, due to "an obligation to the FOSS community".

Your question is mainly about the human resource aspect, but there is an important piece of information that should be clarified.

The GPL license does not force you to make the code "public", you only needs to provide the modified source code to the program's user, so basically your customers that are owning and running the device. This is a subtle but important distinction.

It means that if tomorrow rather than shipping a device, you ship the device and CD containing the source code, and some instruction how to build it your are compliant (for GPLv2, for GPLv3 you should provide installation instructions if this is a User Product)

So the code does not have to be "public", "Francis" is likely trying to fudge the issue to make it more threatening.

You should definitely consult with an IP lawyer first.

Answer 10

Neither side is looking good in this situation, but Francis has already poisoned the office - he needs to go.

Advise your directors to sort this as soon as possible. You do not want people like him inside your company. Your company may suffer in the short term, by losing talent, but it'll be less of a problem than you imagine. If it costs eight months salary to get rid of him - that's cheaper than a long lawsuit on either side.