66

I'm currently the only HR worker at a medium sized engineering firm in Canada. There should normally be 2 additionally HR workers on-staff more senior than me, but one is on parental leave and the other position isn't currently filled, and I'm in over my head.

We have a senior engineer, "Francis", who doesn't get along with a more senior engineer, "Lee". In short, Francis pointed out a serious technical flaw in Lee's designs, and tried to encourage Lee to change his designs based on this information. Lee took it as a personal insult, and attempted to "squash" Francis (i.e. get him written up, even fired). Francis raised the issue with the entire engineering department, and embarrassed Lee significantly (i.e. Lee made a serious technical mistake, and his attempts to squash dissent made him look bad). We put the two on separate teams to prevent any further issues about 6 months ago.

Francis has since excelled on his new team, and was up for a significant promotion. However, a senior manager, "Ling", vetoed the promotion, citing Francis wasn't "mature enough" for the role (and didn't provide an indication as to when Francis would be mature enough). Lee and Ling are close personal friends, hence I sense a conflict of interest here. Somehow Francis found out about the veto (he shouldn't have access to this information). It turns out Lee gloated over the issue and disclosed it to Francis, and we promptly fired Lee (gave him half the normal severance he's entitled too as an alternative to firing with cause and getting nothing), and attempted to smooth things over with Francis. This caused substantial embarrassment for Ling.

We've started getting calls (addressed to Francis' colleagues and supervisors) for job references (pretty bold, since people rarely use their current employer as a reference while job hunting), and have determined that many of the companies calling are direct competitors. We called in Francis for a meeting, and he spelled out, bluntly, that he's looking for a new job, he's pissed over the veto debacle, and that we're welcome to give him severance (8 months' pay) to go away here and now. We don't want to lose him, but he has made unreasonable demands for a counter offer:

  • The promotion (we'd consider it).
  • 2 years guaranteed unconditional severance arrangement (even if he quits) (partially accepted: 2 years, unless he's fired with cause or quits).
  • Guarantee of another promotion within the next 4 years (to ensure this isn't just a temporary counter offer to buy time before eventually firing him, and ensure he can still move up the ranks) (rejected, but promised the well wasn't poisoned.).
  • Ling being further reprimanded/punished by the directors (rejected; we can only pass the details up to directors; they choose whether or not to discipline managers).

Francis seemed to be displeased with the results of his "negotiation", and indicated he'd continue job hunting on personal time. We reminded Francis of his non-compete clause, and he then retorted with something that raised red flags by the senior engineering team:

  • He plans to move from Canada to the US (dual citizenship), which he feels would invalidate his non-compete significantly.
  • He plans to work with a direct competitor, and re-create the work he's been doing for our company for the past 6 months.
  • He plans to make large portions of the code, much of which is in "Linux Kernel" and "Docker" code, public, due to "an obligation to the FOSS community".

This last point would be disastrous, and suing Francis would not recover the lost potential profit. We stressed that he would be receiving correspondence from the legal team unless he took back what he said. He refused to speak any more after that point. We have him working remotely on "research tasks" (no access to servers) while we try and figure this out.

Is there anything we can do to prevent Francis from disclosing code out of spite? Are "super injunctions" real (i.e. like when celebrities want to prevent embarrassing news from being published)? Or are there other uncommon benefits that can be offered besides cash and extra vacation time (large raises are allowed, but not large bonuses)? Whether we throw a bigger/different bone, or find a way to forcibly stop him, we need to prevent disclosure.

  • 26
    One important element: is this actually GPL code that your company should make available anyway? – Jeffrey supports Monica Oct 28 at 12:05
  • 19
    @Jeffrey Probably not. It seems Francis wants to publish the code. The GPL does not require the developer to make sources publicly availble, only to provide them to those who receive the code by them (which may be noone if they do SaaS...). Chances are Francis is going to be in a lot of trouble by publishing company secrets. IMHO if Francis was truly for FOSS and had a case he would simply "whistleblow" the situation to the FSF and they would proceed with proper legal battles to enforce GPL on OP's company. Making your own justice is rarely they right solution – Giacomo Alzetta Oct 28 at 13:04
  • 16
    @Snow Unfortunately this has caused in the removal of highly relevant comments which clarified the question. – Konrad Rudolph Oct 29 at 13:31
  • 12
    @KonradRudolph, indeed, that there is GPL code in a publicly released product is very relevant as it changes the equation completely. All Francis has to do to cause major problems is tell someone who has purchased the product to request the code. You would also struggle to prove he even told anyone. He could even buy it himself and request the code! – crobar Oct 29 at 14:13
  • 3
    Could you explain why you didn't fire Ling? Your post implies that Ling leaked the veto information to Lee. Therefore, your company would not be in this situation if it weren't for Ling's actions. He's already shown a willingness to ignore confidentiality and facilitate sabotage of a coworker's career. Keeping him on will reduce morale with other employees as word of this gets around. Francis may only be the first to leave if Ling remains with your company. – Starfish Oct 29 at 20:56
145

This situation is spiraling out of control out of anger and frustration. I can't speak to the legal aspect, but it should not have gotten to this stage. You basically gave him nothing in negotiation and then now that he wants to leave, you are acting to trap him in his current position. He is a wounded animal fighting back.

The promotion (we'd consider it).

He got nothing there.

2 years guaranteed unconditional severance arrangement (even if he quits) (partially accepted: 2 years, unless he's fired with cause or quits).

Cause can always be found when someone wants to fire you. That's worthless.

Guarantee of another promotion within the next 4 years (to ensure this isn't just a temporary counter offer to buy time before eventually firing him, and ensure he can still move up the ranks) (rejected, but promised the well wasn't poisoned.)

This entire thing started due to management/HR at your company having limited integrity and now you want him to value your promise of integrity?

Ling being further reprimanded/punished by the directors (rejected; we can only pass the details up to directors; they choose whether or not to discipline managers).

So he got nothing there either.

The clearest course of action is to offer to largely waive the non-compete (plenty of places they cannot be enforced anyway) in exchange for confidentiality about company secrets and a nice reference letter.

Help him leave, offer him some severance money, and most likely he will be willing to agree to keep company secrets. Releasing the code is mutually assured destruction for both of you, so I doubt that is his goal and more just his leverage.

Heck, I would go even further and ask a member of the board to find him a cozy position at a similar (but not directly competing) company. He will go be happy and stop thinking about you day to day and have no interest in attacking your firm.

You lost him as soon as he was denied the promotion under questionable circumstances.

  • 8
    @MatthewGaiser In the Netherlands such settlements have surfaced as of late in the media, and were immediatelly shown to be "invalid". A person cannot be forced to not talk about criminal stuff. Now I do not know how far this extends, (there's a mile difference between copyright violation and criminal behaviour): but it's highly murky water and can come back much later. – paul23 Oct 27 at 23:37
  • 4
    @nick012000, out of curiosity, in what jurisdictions copyright violation is considered a crime? AFAIK (but IANAL), in the English-law countries it's not, and, since EU, NA, Australia and NZ are all in a well-working trade system, their laws are pretty well-harmonized. (And of the two predominantly-English-law EU members one is, ehm, still in the EU ;-) ). – kkm Oct 28 at 4:54
  • 4
    California non-competition contracts are not enforceable, I mention California, due to the relative (small) distance from Canada. Suppose your company will have to determine how strong the contract is and if the clause can be enforced. Trying to force an employee to stay will end poorly – Donald Oct 28 at 5:12
  • 8
    I strongly disagree with the following: "Releasing the code is mutually assured destruction for both of you". In fact, I'd argue the complete opposite. Usually, it's the party who releases the code first that gets the boost in reputation and the boost in customer sales/referrals. And even if you do not believe me, that's fine because I can assure you that this rogue software developer thinks the exact same way I do. Releasing it will be to his benefit. He's one of the few who understands it. Furthermore, by releasing it himself, he's making himself look like the de facto expert in it. – Stephan Branczyk Oct 28 at 8:21
  • 6
    @JMK he offered to walk away for 8 months in pay. He didn’t get it. – Matthew Gaiser Oct 28 at 13:12
154

While I won't answer the original problem directly I wish to tackle something tangent to this. And I feel it is important enough to warrant an answer and not a comment.

From a comment (and the post) it is established that GPL'ed code is modified and distributed, without distributing also the modifications:

We are selling a product with a "custom linux kernel installed". Our engineers say that "most of the product is GPL code we've modified", and that since we are selling a product with this software in place, "we're shipping GPL'ed code"

The free software foundation (writers and maintainers of the GPL license) has a specific "faq" for this

The GPL does not require you to release your modified version, or any part of it. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.

But if you release the modified version to the public in some way, the GPL requires you to make the modified source code available to the program's users, under the GPL.

Thus, the GPL gives permission to release the modified program in certain ways, and not in other ways; but the decision of whether to release it is up to you.

Now you are hence violating the license, and since it is the linux kernel it is also "quite easy" to contact the original maintainers.

This creates a very vulnerable point for your company. Even if you manage to settle something with this employee, there will be another one after this. So you take the risk of each disgruntled employee to report it to the copyright holders.

I think a single employer is less of a problem than such a violation. I'd strongly urge you as company to either move away from using copyleft-licenses, or start decoupling the code from the GPL code and only work with lesser-gpl libraries (and don't modify them, use them). Or do something which google does with android: release to the public the modifications, but build upon those a personal layer; and make the profit not from the software but the service provided.

  • 132
    THIS, thank you. The main and the only purpose of the GPL license is to make what the OP's company is doing illegal. If they are distributing the modified Linux kernel installed in a device (an internet router, a smart watch, anything), they are legally obligated to disclose the modified source. And if their whole business model depends on it (complying with the law “would be disastrous,” in OP's words), Francis is likely the least of their problems. – kkm Oct 28 at 4:25
  • 11
    Note, that they are only obligated to disclose the source code upon request, so while their legal position seems iffy, they've likely haven't broken any laws/licensing terms yet (unless such requests were made and they've refused or otherwise violated GPL). – Dan M. Oct 28 at 13:35
  • 13
    They are also obliged to inform their users about the licensing terms of the GPL. I wouldn't be surprised if such a company didn't do it, so they would have broken the terms already. – Didier L Oct 28 at 14:08
  • 11
    @paul23 The Linux Kernel isn't from the FSF - it's from Linus Torvalds and thousands of other contributors. The copyright in the kernel belongs generally to its authors, and in some parts I expect to its' authors employers. You can see many authors listed at github.com/torvalds/linux/blob/master/CREDITS – bdsl Oct 28 at 14:09
  • 15
    @DanM.: There are two obligations here; the first is that the company must actively tell their customers that they're using GPL software (Article 1), and then the company must offer sources. The first obligation is not on request, but it is mandatory to distribute the GPL'ed code either in binary or source form. I agree: the company urgently need a lawyer, and you need to bypass the manager that's keeping Legal out of the loop. This is an existential threat to the company. Handle it badly and the company stops to exist. – MSalters Oct 28 at 14:11
80

I know you did not ask anything on behalf of yourself but humanitarian considerations compel me to strongly advise you to avoid hanging around anywhere near the ass end of your company because that is where it is about to be badly bitten.

Your company has made some serious blunders. Not only have they irreparably mangled their relations with their employees, but they have committed a serious copyright violation against the authors of Linux. The reason for the blunders is obvious: your management is a bunch of unethical immoral lunatic idiots.

If they were essentially ethical and moral, they would have investigated the GPL before relying on it. There would be nothing to hide and a disgruntled employee would not have any leverage. If they were sane and clever, they would have fired the correct person 6 months ago and would not have created a whistleblower within their own staff. It is the combination of evil and stupid that will destroy the company.

Here are some red flags that tell me that a scapegoat will soon be needed:

  • You are currently the entire HR staff, everyone else has scarpered

  • Management is strongly focused on covering up instead of mitigating damage

  • Management is insisting that HR (that's you and you alone) find a way to solve a dangerous legal problem without corresponding with the legal team

  • The engineering director has ordered you not to send any emails with "GPL" or "GNU" in it

  • The plan is to never let the customer know that GPL code is present in the product -- but you have just told us, on an indelible public platform, that there is

  • You don't even know whether a confidentiality deal would be corrupt or illegal

  • When the coverup fails, you will be the one who didn't make it succeed

  • You've been reduced to seeking advice from random strangers on the internet

Your position may be untenable. I'll not rush to tell you to run away, but you should at least know the danger you are in.

  • 17
    Management doesn't seem to be rational enough to have planned to set Thoma up, but when the brown stuff hits the spinney thing, they are going to frantically compose a list of peasants to blame -- and lo! Thoma's name will lead all the rest. – A. I. Breveleri Oct 28 at 4:42
  • 19
    "Management is insisting that HR (that's you and you alone) find a way to solve a dangerous legal problem without corresponding with the legal team" - Gotta love this part. They're doing illegal stuff they don't want to reveal to their own lawyers, piss off probably the one person in a position to reveal everything and are asking a single junior HR person to fix everything. popcorn.gif – JollyJoker Oct 28 at 13:41
  • 3
    Please withdraw language over management. They have faults but do not deserve insulting – usr-local-ΕΨΗΕΛΩΝ Oct 28 at 14:06
  • 8
    @usr-local-ΕΨΗΕΛΩΝ His judgement of management is sound, in my opinion. Company culture comes from the top. The company has been poisoned by the personalities in charge, and OP will keep having to deal with such problems if he stays there. – Z. Cochrane Oct 28 at 14:36
  • 5
    @usr-local-ΕΨΗΕΛΩΝ: My characterization of Thoma's management is clearly supported by the reported evidence. - I know my language is colorful but I like it that way. – A. I. Breveleri Oct 29 at 1:53
44

Don’t retaliate against Francis. Talk to a lawyer.

Your company has been breaking the law with regard to your violations of the GPL, and now one of your employees wants to become a whistleblower. You’re already going to be in enough legal problems from your violations of copyright law; the last thing you want is to get in even more trouble from breaking whistleblower protection laws, and you’re going to need to talk to a lawyer to determine what your obligations under those are.

  • And keep in mind that GPL violations can usually be fixed quite cheaply: by adhering to the GPL going forward. Most authors of GPL software prioritize "following the license" over "punishing wrongdoers". – Mark Nov 1 at 23:43
20

This is not your decision.

Do not threaten someone legally if you're not a lawyer. The only person making legal threats, implied or otherwise, should be your legal team.

Also, this is not an HR decision. This is a strategic decision that has to be decided by upper management in conjunction with its legal team.

As an HR person, your role is to make sure upper management is informed and your legal counsel is looped in, but once a decision is made, you should get out of their way.

3

Summary: Shit happened. A lot of it was due to Lee (who got himself fired) and Ling (who got himself reprimanded) at the expense of Francis. Francis would be a valuable employee, but is now pissed off (understandably) and shows behaviour that threatens your company (not a good move, and not a clever move).

Before Francis went off the rails, the best solution, and the fairest solution, would have been to keep him happy and keep him employed. With the situation now, I would say that you cannot possibly keep him as an employee.

But it seems that Francis misunderstands what GPL-licensed code is. Even if your code is derived from GPL-licensed code, nobody can force you to publish it. In the worst case, if your company was in violation of its license, the copyright holder of the GPL-licensed code could sue you, but they cannot force you to publish your code. (They can give you arguments why it would be wiser to publish your code, but they cannot force you).

Francis however has no right whatsoever to publish your code. It is your copyrighted code. Nobody but your company has the right to publish it. If he publishes it, it's copyright infringement. You can sue him for actual damages. You can sue anyone using that code for copyright infringement and actual damages, so nobody will touch it. Of course you won't be able to recover all the damages from him, but you can make his life a misery for the rest of his life. That's what your legal department can tell him (in a cleaned up form, that's why they are lawyers).

I also must really recommend that you sort out your use of GPL-licensed code. Even though Francis has no right to publish your code, there is no way to prevent him from telling the world what you're doing. So you could find yourself in trouble.

(The GPL license basically says: You are allowed to use this code if you do A, B, C. If you don't follow the rules you are not allowed to use the code. And apparently you don't. That gives the copyright owner the right to sue you for copyright infringement. It doesn't give anyone the right to publish your code).

PS. You are allowed to use and modify GPL licensed source code if everyone receiving your software inside your product is given the complete source code. If customer A doesn't want to give the source code to potential customer B because B is a competitor of A, then you can do this and pray. Your customers would have a right to publish the source code in this case but hopefully don't want to.

And the problem doesn't go away when you have sold your products unless you want to close down the company and run away with the money.

  • 21
    Francis has a moral duty to go against the company. This is not a bad employee: this is a whistleblower and needs protection from human resource in said company. - Read the comments: customers are sent the (compiled) code as executable. So legally they have to release, and as employee you cannot be forced to do illegal things. The copyright owner might not notice it: so Francis being the whistleblower needs protection to show the world the violation. – paul23 Oct 27 at 22:58
  • 9
    Telling the world a company is violating a license is kind of the definition, and showing the source is just "showing proof" in my eyes. – paul23 Oct 27 at 23:07
  • 19
    “ It is your copyrighted code.” -- If what @Thoma says (We are selling a product with a "custom linux kernel installed". Our engineers say that "most of the product is GPL code we've modified" in a comment under the post) is taken at the face value, it's a GPL-copyrighted code, crystal clear, even thought IANAL. GPL is infectious as f**k, and has been explicitly designed with that goal in mind. Any Linux-based home router has a GPLed modified source code download link in the documentation. But if the modifications are the “secret sauce,” that's looking very bad for the company's future. – kkm Oct 28 at 5:05
  • 8
    “Nobody can force you to release your code”--this is true. Nobody can force you not to steal or not to murder; it's all about the consequences. License is not a recommendation or advise; it's a legally accepted, binding and enforcible agreement. Linux kernel license violations, in particular, are handled by the Software Freedom Conservancy. And they do sue violators. Also, some jurisdictions consider explicit claims of not using parts of licensed code as fraud, which is easier to prosecute. – kkm Oct 28 at 10:47
  • 19
    "Even if your code is derived from GPL-licensed code, nobody can force you to publish it" Yes, they can. If you distribute binaries built from GPL-derived code, you are legally obligated to share the whole source code, with only the limitations imposed by GPL itself (aka: if a recipient make it public, you have no recourse). People can and do get sued (successfully) for GPL breaches. – 520 says Reinstate Monica Oct 28 at 12:40
3

Not answering the question itself, my advice to you, if you say that your product solely relies on your modifications being kept a secret, is to find a new workplace, yesterday!

Why? Francis needs no more than going online via an internet-cafe and/or using the free WiFi of a "regular" cafe and using a strong, reliable VPN service, one that doesn't keep logs of users and your company's trade secrets are bust!

Even if you try legal action against him, unless he's a complete and total idiot, which he doesn't sound like, you'll have no proof, and all the while the milk would have been spilled.

Basically, your current company is in deep doo-dee.
Bail. Bail now.

Also, as I commented above, but to summarize my above comment: as long as you are with the company, start keeping all correspondence you have, in relation to this case and Francis, backed up in at least two storages not controlled by your company.
As someone else noted, you, through no fault of your own, have become the perfect patsy for your shitty management, should they need it.
It's not even loss of work, like I said, bail today. It's the possibility of becoming the legal face of your company. Against the FSF, owners of the Linux Kernel... want to take a guess how you fare up?

Good luck, and sorry for you that your crappy managers brought you to be in legal danger.
I hope your next place will be less crappy.

2

He plans to make large portions of the code, much of which is in "Linux Kernel" and "Docker" code, public, due to "an obligation to the FOSS community".

Your question is mainly about the human resource aspect, but there is an important piece of information that should be clarified.

The GPL license does not force you to make the code "public", you only needs to provide the modified source code to the program's user, so basically your customers that are owning and running the device. This is a subtle but important distinction.

It means that if tomorrow rather than shipping a device, you ship the device and CD containing the source code, and some instruction how to build it your are compliant (for GPLv2, for GPLv3 you should provide installation instructions if this is a User Product)

So the code does not have to be "public", "Francis" is likely trying to fudge the issue to make it more threatening.

You should definitely consult with an IP lawyer first.

  • 2
    If someone buys the device, they are by default being distributed a binary of the GPL software. As such, anyone who buys the device has the right to demand to access the source code for that binary distribution. – crobar Oct 29 at 17:20
  • @crobar : this is correct, but it does not mean, that I, random internet person, can ask company X for its source code. That's how I would understand the code being "public". So you don't actually have to disclose to the FOSS community, but to your users/customers. – Xavier T. Oct 29 at 17:23
  • 2
    @XavierT.: Yes and no. First, the GPL absolutely requires the company in this case to notify their customers that the code is licensed under GPL and that they have the absolute right to the source code, if they want it. They are currently violating this requirement. Second, the GPL absolutely forbids the company from restricting the further distribution of the BINARY, as well as the source. If they give a binary to Al, and Al gives a copy to Betty, and then Betty calls them up and says "I want the source", they are required to comply with Betty's request. – John R. Strohm Oct 29 at 17:29
  • @XavierT.: There are TWO ways they can comply with Betty's request. They can give her the source outright, or they can say "Get it from Al." At that point, when she replies "Al told me to get it from you", they are stuck between a rock and a hard place. – John R. Strohm Oct 29 at 17:31
  • 1
    @XavierT.: Read the GPL. GPLv3 paragraph 6b says that a distributor of the binary may comply by offering "to give anyone who possesses the object code" (verbatim) either a copy of the source code or access to a download facility. The key word "anyone" has the same meaning in legalese as it has in everyday English, and this means that the author must honor the request from Betty. Similar provisions are found in GPLv2 paragraphs 3b and 3c. The key phrase in GPLv2 paragraph 3b is "any third party", and legalese very strongly emphasizes that "any third party" means "ANY third party". – John R. Strohm Oct 30 at 14:09
1

Neither side is looking good in this situation, but Francis has already poisoned the office - he needs to go.

Advise your directors to sort this as soon as possible. You do not want people like him inside your company. Your company may suffer in the short term, by losing talent, but it'll be less of a problem than you imagine. If it costs eight months salary to get rid of him - that's cheaper than a long lawsuit on either side.

  • 10
    Sounds like it's company management and corruption that has poisoned the office. Everything else you've said is correct. An amicable settlement is in order. – Z. Cochrane Oct 28 at 14:40

Not the answer you're looking for? Browse other questions tagged or ask your own question.