My company is probably violating LGPL, and I think I may be complicit [closed]

Question

Background

I am one of the newer members (a bit over 2 years by now) to a small company based in the US that makes specialized hardware, with software that goes along with it. The company is around 20 people in the office, maybe another 5 or so working remotely. I do some programming work for the company, but also IT and shipping work. I was initially hired for that other work, but gradually they shifted me towards programming over the past year and a half.

A bit over a year ago, shortly after they started having me do some minor bugfixes, I noticed something funny with our dependencies. Our software suite (C# .NET) has several dependencies on three third-party libraries that are not developed by us. These are essential libraries that our core functionality depends upon; nearly all our end-user programs need them. I looked up these libraries and all three are licensed under some version of the LGPL, which is a copyleft license.

This was particularly concerning because of how we distribute our software. Customers do not download our software from a website, they receive it on a USB drive, with a .zip file containing a .msi installer that extracts all our programs and their dependencies onto the user's computer - including the LGPL'ed third-party libraries, as .dll files. I'm pretty certain this means we are redistributing the LGPL'ed software. Worse yet, I'm the one that prepares these USBs, so I am literally the one redistributing.

I spent several days gathering as much information as I could on the LGPL and how we make use of these libraries. I scoured the LGPL text itself, read numerous guides on what a proprietary program must and must not do with an LGPL'ed library. I put together a very detailed email, listing out how we use and distribute these libraries, what I believe is a violation, and presented a solution on what we need to do to fix it.

In most cases it should be a relatively easy fix. At the very least we should:

• Include a copy of the LGPL for each library we depend upon, on the USB we redistribute
• Include the source code (also on the USB) of the LGPL'ed library at the revision of the build that we link to (this one I'm a little uncertain of, and no matter how many times I read the section I still can't tell)
• Include notice in a Help > About or similar UI element in each of our distributed applications, declaring the dependency upon the LGPL'ed library

I also mentioned that it was possible that there was some agreement between the company and the authors of these libraries, that we had bought an "enterprise license" that I wasn't aware of. I asked that if that was the case, to let me know so I can rest my concerns. (Though I doubt this is the case with how lax and cowboy-ish this company is with software.)

I sent the email to the head of the company (who I report to directly and sometimes work with on software tasks, it's a small company), as well as HR. I printed a copy of what I sent and took it home.

Response

After two weeks of radio silence, HR pulled me aside for a conversation - verbally. They said that they understand my concern and that legal matters like this are taken seriously. They said that the company doesn't randomly grab libraries as dependencies without thinking.

They also said that when they started using open-source dependencies, they contacted the company lawyer and made sure it was okay to do so. They told me that according to the lawyer, as long as they simply acknowledged the dependency in our official documentation, we were abiding by the license. (We have about 5-6 different pdfs, it's only mentioned in one of them, the biggest and most outdated one. We don't even distribute documentation to all our customers.)

As someone who's had passion for open-source and free software, and has used the LGPL multiple times on my own projects, I was rather stunned. It was like a middle schooler going up to class and saying that so long as they "gave credit" they could do whatever they wanted.

I said there was probably a misunderstanding, because not all open-source licenses are alike. I said that some licenses are more strict than others, and LGPL is one of the stricter ones, and described how. I suggested they double-check with their lawyer to make sure that this license (LGPL, versions 2.1 and 3.0) does actually allow us to redistribute this software this way. They said they would do so and check back later, and I should not do anything about it yet, and the conversation ended there.

About 15min later I realized that because this whole conversation was verbal, I had no record of them making these claims. By that time they had already left (they tend to only be in the office for about an hour every couple days).

They never checked back later after that conversation. While at the time I believed I had done my "due diligence", I still don't believe what HR said was true. I think someone in that chain of discussion was either misinformed or is lying.

While it's perfectly plausible that the company does have an "enterprise license" or similar agreement with all three libraries allowing usage with minimal requirements, they never stated so even though I specifically asked about it in my email to give them an easy out. I can only assume the silence here means they do not; if they did then they would've told me.

However, I was in no position to press the issue further, I had to drop it.

Further Developments

A few months later, I noticed something far more egregious. It turns out, we also ship an "SDK", which is basically an API of a large portion of the library parts of our code (around 30-40 .dll binaries), all of it combined into a single dll, and obfuscated with Dotfuscator.

This .dll is sent to a reseller of our hardware (a much larger company), who uses it as a dependency for their own software suite, and sends it out to their customers. I don't believe the reseller is fully aware of our usage of LGPL'ed dependencies.

I believe this to be a very, very blatant violation of the LGPL. One of the main points of the LGPL is to ensure end users can swap out and modify the FOSS library however they like; with a static-linked and obfuscated binary without source or separation tools they can't do this.

I know if something I wrote and licensed under LGPL was used like this, I'd be furious; I'd probably look at suing. And if one of the reseller's customers discovered this dependency, and notified the reseller that they are now unknowingly redistributing, they'd probably sue us for fraud.

But I was in no position to press the issue. HR had already stated that their lawyer said it was okay to just give notice in documentation. If I were to press the issue I'd be calling the lawyer wrong or HR a liar, and I feared anything I said further would be threatening legal action.

Current Status

The reason I'm worrying so much again now is that everyone in the office just got handed a "company handbook" from accounting yesterday. I am to sign an acknowledgement form stating I understand and agree to everything stated in the handbook, by this Friday. That handbook states the following:

If you become aware of any unauthorized distribution or copying of software or related documentation within the Company, notify your supervisor immediately.

My fear is that signing this acknowledgement form, in combination with my past report, would be to admit to being complicit to the LGPL violations in the company. I fear that my signature would be used as ammo against me if it comes to a lawsuit. I have write-access to the codebase. I prepare the USBs that we redistribute the LGPL'ed software to end users. I reported it once, but chose not to press the issue when the response wasn't satisfactory.

I have kept a careful eye on our dependencies and our build script in the source code repo, and nothing has changed in our dependencies or distribution method. If these were violations before, they're still violations now.

Lately the higher-ups have been especially busy, and most have taken to ignoring almost all of my emails. Even if I say something now, it'll probably just scroll past and get ignored.

I know that if this ever gets out, regardless of how, the company will instantly put the blame on me. I am the only one with interest in this kind of thing, and I am the one that stuck my neck out enough to say something.

As much as I'd like to fix these violations (a couple changes in the build script and UI would be easy), I was told not to do anything about it.

As much as I'd like to send an email to the authors of these libraries and the FSF about this (they aid free software project authors when it comes to violations), I know I'll be fired on the spot, and never be hired as a programmer ever again. Nobody wants to hire a rat.

As much as I'd like to leave proudly on principle, this job pays well, respects work-life balance, and doesn't give me an unreasonable workload, which is an extremely rare venn diagram. I've been told this by friends and family members on multiple occasions, that I need to hold on to this job as long as possible.

Additionally, I have no degree, no prior professional programming experience, no noteworthy FOSS projects under my name, and honestly I'm not a great programmer. I'd have a very hard time finding a programming job again if I leave, even more so if I'm fired.

Again, it is perfectly possible that the company has a business license for all three libraries. If that is the case, there is no infringement or wrongdoing. However, I specifically asked if that was the case both in the email and in conversation, and the question was sidestepped. Not "yes, we have a business license with these, there's nothing to worry about", but rather "we made sure with our lawyer that we were abiding by all licenses, and we only need to provide acknowledgement in documentation". This avoidance to answer, combined with refusal of proposed changes, feels like unspoken confirmation that we don't have the rights to do this.

What can I do?

So, a few questions:

• How screwed am I? Am I complicit in this? How urgently do I need to lawyer up?
• Can I safely sign the acknowledgement form without suddenly becoming more liable to the violation? Does it even matter?
• How doomed would my programming career be if this gets out?
• Is it possible to convince management that this is a real issue that shouldn't be dismissed, despite the fact that they've previously stated otherwise?

---

TL;DR I noticed we were redistributing LGPL dependencies with our code with nothing more than a subtle reference tucked away in documentation. Brought it up a year ago with president and HR, the latter of which dismissed it verbally, claiming their lawyer said it was okay. I didn't believe them, but only suggested they double-check. They never followed up. Later I discovered more blatant violation, finding we're static-linking and obfuscating these binaries into one dll, which we send to a reseller, who distributes it to customers with their software. I feared I couldn't report without risking my job. Now, after a document from payroll, I fear I've been complicit the entire time because I only spoke up once.

Answer 1

Generally speaking, you are not a lawyer and it is not your job to make sure your company complies with all licenses and other contracts it may have.

Your job is to see that there is a license attached and then inform the lawyer (or person that can contact the lawyer) to make sure the company complies with said license.

Given that the product already used this software that has a license before you came along, you can safely assume your company complies. Just as you can assume the company car wasn't stolen and your desk wasn't bought with a bounced cheque. Even if it were, that is not your personal fault or responsibility.

Given that you did your duty and informed your employer of potential problems (which is implicitly part of your job, whether your contract says so or not), when your employer says "our lawyer cleared this", then that is as good as it gets.

Well, if your employer says it in writing that is. If they argue about it, talk to you in the hallway, and do everything to not put it into writing, instead of typing this little sentence into an email and be done with their annoying employees questions for good, you know this is fishy and illegal. What you make of that is your decision.

If you really want to cover your rear end, you can put it in writing.

Hello Boss, you informed me earlier that our lawyer has cleared our current procedure of [...]. If anything changes, please let me know. As of now, we will continue with the above mentioned steps to comply with the license terms.

It is your duty to inform your boss in no uncertain terms about what you do. It is not your duty to dive into deep legalese and find out if your company is allowed to do what it does. In any sane legal system, you cannot be held accountable for what your company does, even if you are the employee doing it.

Answer 2

You have two concerns: (1) a concern about your personal legal liability, and (2) a concern about your employer's ethics. It's helpful to keep those two things separate in your mind.

Regarding your legal liability: Find a lawyer who will give you personal legal advice. Don't trust message boards or your intuition about what you should or shouldn't be culpable for. The law is often surprising. Lay out your situation to someone who can give you a good assessment of your situation and your options.

Regarding your employer's ethics: It seems clear that, legal issues aside, your employer doesn't share your commitment to FOSS and is willing to operate in ways that you don't condone. It's up to you to decide what to do about that. Many people work for companies they don't entirely approve of; many people leave good jobs because they don't approve of what their employer is doing or asking them to do.

Answer 3

I’d read the LGPL license carefully. It is not the same as GPL. Also many packages are available under a GPL and a commercial license.

If the company openly admits using the software so that any customer can see it then chances are 99% they do it legally.

PS “They acknowledged the dependency in their official documentation”.

Answer 4

My gut feeling is that you have two very, very different situations going on:

Licensing of Company Product

This is your original issue. It is a real concern. Documentation of your communications on the topic, paper trail, etc. are important to protect yourself, but that will likely only be relevant if your company is sued by the author of one of the LGPL libraries. I actually doubt that will happen, but that is just my guess. On the other hand, if the company is in a position where it may someday be acquired by a larger firm then intellectual property issues may go under the microscope at that time.

I would keep pushing, gently, to higher ups to make sure they understand the potential seriousness of the problem. A key point is that if it is resolved properly before any legal issues crop up then the cost is close to $0 - distribution of licenses, source code, etc. essentially cost nothing and the only real issue may be paying for a license that would allow distribution in an obfuscated/combined manner, which may not actually cost very much.

Company Handbook

The line in the company handbook:

If you become aware of any unauthorized distribution or copying of software or related documentation within the Company, notify your supervisor immediately.

is absolutely typical of a boilerplate "build your own company handbook" package. I am 99% certain that is meant to refer to making illegal copies of Microsoft Office, Microsoft Windows, Adobe Acrobat or other commercial end-user software. Not about distributing libraries with your product. But the language is indeed ambiguous enough, though likely unintentionally so, to cover your product as well.

My hunch is that somebody, possibly for very good reasons, decided "after all these years of casual rules, we need an official company handbook", and this was simply one of the things that people say every good company handbook should have. Along with vacation and sick leave policies and restricting computer use to company business, etc. Literally boilerplate stuff.

But to cover yourself, you could simply follow up (same day as you sign for the handbook = "immediately") with a short email about your ongoing concerns. Then you should be covered.

Answer 5

I personally admire your viewpoint, and efforts for detecting the gaps and standing up for what is right. However, unless you have the authority to dictate the process, there is limited options about what you can do about it.

As long as we view it from the workplace issue: I'd look at it as a problem working with an employer who is careless about ethics and future of their product, and even after someone pointed out the gaps, they are reluctant in correcting it.

To keep it short: If I were you, I'd look for an employer who understand what is being done and what are the implications.

Answer 6

Really, you don't have to do anything. You don't want to have a heart attack about it. Take my word for it.

Or, you could just include the LGPL's as you suggest on the USB, anyway. It's easier to apologize later then get permission ahead of time. It's up to you. And it is your employer's, not your, legal obligation to attach those LGPL licenses whether or not they have an agreement from the authors of the libraries. You aren't liable for anything. Your employ does not make you liable.

Working through the company to resolve issues is not an option I would even consider based on two past experiences. They know what they're doing better than you do. Your supervisor may be a great guy but, you don't sign his paycheck. If things go really badly, I've known people turn in their employer after they were fired. And, if you have to find a new job, old employers would just as soon say you were a great guy so, they're rid of you. I've seen it and heard if from supervisors more than once.

GPL's are great because they don't force folks to have a license to use the code or not. And so things get built with it. But, some managers do what an endless parade of crooks have done before, take the attitude of, "we'll take care of that later," the licensing that is. And, they don't. And that make them crooks.

The original GPL (copyleft) was invented by Stallman back when we had to go back to the major corporation that made the computer and the software to get their stuff fixed at all. It wasn't about money, it was about getting things done and getting more skilled. If a person wanted to hack on some GPL'd code, big deal, they just sent a diff to the owner. So, we had emacs, gcc, bash, etc on the Apollos, the HPs, the Silicon Graphics machines and the Z machines. So, if someone published something with a GPL-type license we owed them and we appreciated that. Times have changed. Now, it is about making money. And people fantasize about making tons of it.

You should start a conversation with the Free Software Foundation. They can give you better information about the legal obligations in writing and explain it to you. You should do that just so you'll know. Who's going to know unless you tell them?

If you feel your work situation is making you physically or mentally ill talk to a doctor, right now. A nice Psychiatrist, some aren't nice, is the best option, whether it's physical or mental, companies don't argue with psychiatrists. Have them write something up for your supervisor. Even if you don't get a prescription for Xanax, they can write something up. The company will be liable if they don't help you. If your supervisor doesn't get on it HR will do something. Do it before things progress.

If you have emails or recordings of anyone at work cussing you, threatening you or your job in any way take it to HR. And, no those people don't have to know you're recording them.

I wish you luck.

Answer 7

I think the most important action right now is written documentation of your concerns. You are no legal professional, so it is very probable that you are indeed misunderstanding something and everything is fine actually.

But for the case that it's not, you need written proof that you informed your employer about your findings. After that, you aren't responsible anymore. As a lowly IT engineer you don't have the authority to change your used libraries or dictate how they are shipped.

If someone contacts you about this verbally, write a followup mail while the conversation is fresh on your mind and send it to them as a meeting minute. Blindcopy to your own private mail address and keep your copy safe.

Adressing your questions at the end:

• How screwed am I? Am I complicit in this? How urgently do I need to lawyer up?

You aren't screwed if the decision about all this was not yours, and you can prove that you have done your part in assessing the legality if it all.

• Can I safely sign the acknowlegement form without suddenly becoming more liable to the violation? Does it even matter?

No lawyer, but the acknowledgement seems to be more about intellectual property of the company, not distribution of third party stuff.

• How doomed would my programming career be if this gets out?

Companies are constantly in lawsuits with each other. No HR representative will look up your company during an interview process and say "hey, this company has a licensing lawsuit right now. I can't hire any IT staff from there because of that". If it's really a huge thing you may be asked about it in an interview. At most.

• Is it possible to convince management that this is a real issue that shouldn't be dismissed, despite the fact that they've previously stated otherwise?

You can be persistent. Ask again, if a lawyer has looked at it yet. As always, create a paper trail. Other than that you are out of options. And it becomes "not your problem".

Answer 8

Notify the original authors of the LGPL'd libraries. It is up to them to decide whether legal action is warranted. Don't include proprietary information in your report; explain how to reproduce your findings, and leave it to them to gather their own evidence.

Talk to an attorney before signing anything else from your employer; it sounds like your employer uses contracts in bad faith, so you need to be advised of how any contract would bind you.

Answer 9

Not adhering to proper licenses is a potential legal liability of your company and an extra risk factor. A lot of tools that scan for vulnerabilities (like outdated packages with known vulnerabilities) and other risk factors in your codebase can also look for licensing issues as well (they usually check for included code which is AGPL licensed but can be made to check for others as well).

If your company is not using such tools already you might want to suggest to them to invest or at least try out one of them. Once they have a report they might be surprised by the amount of issues such tools might uncover from unsecure old packages down to licensing issues that might affect your entire codebase. It is perfectly possible that the one you raised above might not be the only issue.

How they resolve the problems raised in the report is a different question and you might base whether you wish to continue working with this company or not based on both whether they are open to have an assessment, and if yes and it uncovers bad stuff how they plan on address them.