How to deal with an employer who refuses to allow copyright attribution in software

Question

As a mobile developer I am currently building an App to go live on the AppStore.

The designs include a link that goes off to show all attribution used. This app uses MIT & Apache 2.0 licensed source code.

After discussing these with my boss, it comes to light that he is unwilling to place any software attribution in the app as it will negatively affect the way the app looks, regardless of where it is placed.

I have tried several times to iterate the legal requirement to display copyright notices, but they are dismissed.

I could remove the copyrighted code already in the project and rewrite the same functionality, but again my boss would not sign off on this considering the amount of work needed.

I don't feel comfortable using other peoples work without giving credit, any help here would be appreciated.

Answer 1

If your company has a lawyer, or an ethics overseer, talk to them. It is usually considered the duty of any employee to bring to their attention any practice that might be unethical, or make the company vulnerable to lawsuits.

If there is no such person I would write to your boss pointing out that you believe failing to acknowledge copyright may make the company vulnerable to lawsuits, and asking them to confirm in writing that they want you to go ahead. Make sure you keep a copy of the email or letter where they agree. Keep it somewhere you can access it if you were denied access to your work computers and accounts.

Answer 2

The other answers are decent, but to me they seem like unnecessary escalation.

If you go along with this, then yes, you need to cover yourself legally.

However, have you tried the simple approach?

He says it will negatively affect how the app looks. Ask him to open up his iPhone, and navigate to "Settings" -> "General" -> "About" -> "Legal" and see how much textual info is dumped out on his screen.

Then say that you don't want to open up the company for a lawsuit, and you just need to include a "legal" page buried somewhere in the settings of your app.

Point out that iOS itself does this, and most people never notice it—but it prevents lawsuits.

Find some other excellent apps (preferably ones that you know that he uses) and find the legal notices in them, and show him.

Answer 3

Check the licenses of any external code and libraries being used. If they request attribution, then to not do so is in contravention of the license; it doesn't matter what your boss feels about it. If attribution is not required, but you're doing it so you feel good, then your boss's viewpoint should prevail.

Point out to your boss that if the app is successful, the original writers of the code will eventually know about it and will look for their appropriate credits.

Answer 4

The other answers are all good, and I'm going to repeat a lot of what's in them for emphasis, but I think a couple of other things need to be said.

First, if all else fails and you are faced with an ultimate directive to include the code without attribution, you should get real legal advice from a real lawyer, not just some guesswork from laypeople on SE. Don't assume that just having a paper trail will absolve you from all liability, and don't take SE posts (including this one!) as legal advice.

Second, you should point out that code can be released and used under multiple licenses, and that the rightsholders might be willing to let you include it without displaying notices for a fee, depending on who they are. It might be worth looking into.

Third, if, after all the gentler arguments and paper-trail establishment has been done, and if you're really sure that the notices must be included, your boss still insists that you publish an app containing the copyrighted code without the legally required copyright notices, you can simply refuse to publish the app.

You absolutely should make darn certain that you're right about the legal situation before you push this. It sounds pretty cut-and-dry, but I'm not there and I don't know every tiny detail; it might not be.

You absolutely should attempt to find a conciliatory way to convince your boss either to include the requisite copyright notices or to give you the time to re-implement the necessary functionality in-house. Wildcard's suggestion, in particular, is excellent. Pointing out the legal liability and potentially devastating consequences of including the code without attribution is also a good way to go—you can do this in such a way as to show that you're trying to look out for the good of the company and of your boss, in particular, that your objections come out of supportiveness, not out of argumentativeness.

You absolutely should involve any department at your company that exists to handle matters of this sort—legal or ethical departments, etc. If you have such a resource, then that's their job, and they have authority you don't both to prevent a crime and to protect you. If this department exists and doesn't agree with you, then you should probably listen to what they have to say—they're experts in this sort of thing, and you're not, so they're probably right. Still get your paper trail (see next point), but they're probably right.

You absolutely should also establish a paper trail to protect yourself from retaliation. Get everything you can in hard copy, and keep it off site. Make sure it's very explicit in this documentation that what is being asked of you is illegal, and make your boss state very explicitly that he wants you to do it in spite of the fact that it's illegal if, in fact, that is what he wants.

But, after all this, if you still find yourself in the same situation, then you have the option to refuse. The consequences may be extremely severe; it might destroy your relationship with your boss or get you fired. All the other answers here seem to be focused on preserving your job and limiting your personal liability; these are great things to do, and it's completely understandable that you would choose to do them. You are, according to what you have said, being asked to break the law and to violate what are clearly your ethics, though, and it needs to be said that you have the choice not to.

Please note that I'm not advocating either way; this is your life, and your job, and it has to be up to you.

Answer 5

Create a paper trail and cover yourself completely.

Some people are happy to verbally instruct somebody else to do something ethically questionable - but not so happy to have it in writing and very unhappy when there is a paper trail leading back to them.

1) Ask your boss to put the request into writing in the form of an email.

You now have it in writing that it is your boss made the decision and is liable. You can also wait until you recieve this confirmation before continuing.

2) When the email arrives, reply, "this is probably illegal, are you sure".

You now have it in writing that you disapprove and have done your legal duty and raised the issue.

3(a) Boss probably gives up and quietly hates you.

You may need to find a new job. The typical cowboy boss doesn't like staff who won't break the law for them on a whim.

3(b) Boss sends and angry reply, gets HR involved, etc.

You are highly likely to need a new job. You may get a discplinary, or be put on a PIP, probably justified by vague, non words like "failure to follow reasonable instructions".

It's not all doom and gloom - there is a good chance that your boss will just be annoyed for a while, and vow never to promote you into a decision making role - but you may be in a toxic workplace here, so I wouldn't lose any sleep over it.

Answer 6

As an individual employee of a incorporated company, you have no personal legal obligation to comply with copyright and licensing laws. These are civil, not criminal, matters. The liability is all upon the company. Unless you are a partner, or somehow not acting as an employee or a contractor producing 'work for hire', you concerns are not legal. Your concerns are with your company's policies and your personal ethical status. (I am sure that someone will reply to this and try to tell you a story about 'piercing the corporate veil. No one, but no one, is going to go on that sort of witch-hunt over a matter of failing to follow the attribution requirements of an open source license.)

If your company has policies that require compliance with licensing, following orders could leave you exposed to unpleasant consequence inside the company. However, before you pick a bigger fight with your manager (demanding written instructions, etc.), I recommend that you find out if there are any such policies. Find someone in legal, and ask them, quietly, for advice. Choose your course of action according to the answer you receive.

As far as your personal ethics are concerned, well, that's personal. You have to ask yourself what level of stress, or even unemployment, you are willing to accept. Your personal best course of action might be to quietly seek another job while complying rather than starting a pitched battle.

Answer 7

This answer may not apply

I posted this answer before I read that the code the OP is trying to include and attribute is his own code. There is a very large difference between refusing to deploy something using someone else's lib because you can't meet licence needs, and refusing to deploy something using your own code because of the same.

Original Answer left for those that come across this question later.

There are two important issues that you need to address.

First, it's not your job, place, or responsibility to uphold copyright laws. These are complex laws that there are specialized fields for. You are not in a position that make that decision. You don't know all the deals, or emails, or legal checks that went into the "owners" decision not to include attribution. Matter of fact it's perfectly fine for them to decide to risk it, and handle the lawsuits later. (I don't think that's a good call on their part, but again it's their call.)

Second, you're not comfortable. This is the important one. Right or wrong you need to be comfortable with what you put your name on. I can tell you right now, that us developers are a small group of people. We run in small circles. You will run into other developers time an time again if your any good at your job. How do you want to be known? As the developer that abused licences, or as the developer that stood up for licences? If you're not comfortable doing something, THEN DON'T DO IT! You may lose your job over it, but you can always find another job.

"Why did you get fired from your last job?" "I refused to deploy code that I felt violated several legal issues." Is a pretty decent start to an interview to me.

A real solution, before you go resigning over this, is to show examples of how other companies handle the same issue. Trying to convince your "owner" is always better then taking a flat stance. Even if that come off as a list of options:

• We can not use libfoo and rewrite it. It will take 6 months.
• We can attribute libfoo like Competitor does, see here.. and here for examples
• I can resign and you can hire a developer that doesn't care as much.

Your "owner", if they are half way decent should be able to look at their list of choices and choose the one that they like the best. It very well could be you resigning, but again, if your that uncomfortable, then what does it really matter.

Answer 8

Here is what you might tell your boss: We are talking about Apple here. If the copyright owner of the software that you are using without attribution calls Apple and tells them that your company is using his software without permission, then your software will be promptly removed from the store, and it won't be easy to get it back on the store. And impossible to get it back without attribution.

Answer 9

I originally posted an answer based on the OP question of not being comfortable including code when not meeting it's licence requirements. However there was an important comment that I didn't see that really invalidates that answer.

PeterM Yes & Yes. It's my own code in question, the clean room approach is possible but it would take many weeks. My boss would not sign off on spending that much time on something like that sadly –

You are beyond screwed!

This will really depend on three factors.

• First can you 100% prove (you can't) that you worked on 0% of this code while employed at this company. If you worked on any of it, then the code belongs to them, not you. This is a tricky legal situation, but if you so much as added a comma to the source what you were "on the clock" then the entire source could wind up belonging to them. Get a lawyer now. Keep in mind that there are several high profile cases, where "I worked on it after hours at home" has failed to be enough isolation. Same with "but I build libfoo before I even started at Widgets inc."

• Second, can you 100% prove that you have permission to use this lib, that you discussed this decision, and it's ownership issues ahead of time with not just your manager, but with ALL of the correct corporate licencing entities in the company. If you can't then you need to get a lawyer right now. You could be liable for any losses the company has while they "fix" your "attempt to extort" them. You have a grave conflict of interest here.

• Third, can you 100% prove that your lib is the best lib to use for this (You can't). If this goes to a judge of some kind and your company can find even one person that can say your lib was a valid choice but libBar was also a valid choice, then your back in extortion land.

In short, unless you approached this topic up front (and even then it could be tricky) your essentially extorting your employer. You are effectively saying "You will put my name on this product or it will cost you money." Not a bit different then if you walked into a meeting and said, "I will not deploy this app unless you call it "Coteyr's App" or give me $500,000!"

A way out

I highly advise you to take this way out, but IANAL. Hire someone that doesn't need to say IANAL, then transfer all rights to the lib, as needed to the company. You can do this by making the code public domain (if you can) or by transferring ownership, or by "creating a branch" just for your company and making the licencing on that branch whatever they want. You will need a lawyer to make sure that you know all your options, that you choose the best one, and that your new license doesn't conflict with other licences that your lib may depend on.

Answer 10

It's not true to say being an employee absolves you of all legal responsibility.

Nor will a paper trail saying you knew what you were doing was wrong, even if under your employer's instruction.

It sounds like you are being employed for your expertise so the expectation is that you will understand the implications and act accordingly.

There will be an implied contract between the author of the source code and the user by virtue of you copying it. If you break the terms of that contract by not publishing an attribution, the part that allows free use will also be void.

In civil law the appellant has to prove damages, as well as liability. Setting aside direct damage, such as lost reputation, to the original author; your liability may be limited to what you earned (salary) from using their work. Your employer, as respondeat superior, stands to gain more and have the greater means to pay damages, but they can slope off at least some of the responsibility if you were acting outside your remit: breaking copyright law and licence agreements won't be considered to be part of your lawful employment, especially if you have the qualifications and experience to understand them.

Lister v Romford Ice & Cold Storage Co. Ltd.