194

As a mobile developer I am currently building an App to go live on the AppStore.

The designs include a link that goes off to show all attribution used. This app uses MIT & Apache 2.0 licensed source code.

After discussing these with my boss, it comes to light that he is unwilling to place any software attribution in the app as it will negatively affect the way the app looks, regardless of where it is placed.

I have tried several times to iterate the legal requirement to display copyright notices, but they are dismissed.

I could remove the copyrighted code already in the project and rewrite the same functionality, but again my boss would not sign off on this considering the amount of work needed.

I don't feel comfortable using other peoples work without giving credit, any help here would be appreciated.

  • 2
    Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Mar 8 '17 at 22:04
  • 4
    @Myles Actually, I think it'd be better suited for the OSS SE, but I agree it hardly belongs here. – phyrfox Mar 9 '17 at 0:17
  • 64
    Questions shouldn't be closed because they're more on topic elsewhere. They should only be closed if they're actually off-topic where they are. Neutral to whether this is on topic here - just pointing it out. – Aza Mar 9 '17 at 4:15
  • 13
    @Myles "Resolve this conflict with my boss" seems like a workplace goal. – jpmc26 Mar 10 '17 at 1:15
  • 8
    This is still missing information about the communications process with the boss. My reading is as follows: Step 1. Employee decided to put some third party code in the company product; assumed it would be OK because it is "open source". Step 2. The boss said it was not OK for (reasons). Step 3. Employee posts a complaint on the Internet claiming the boss "won't allow attribution". Clarify the post please. – Brandin Mar 10 '17 at 9:16

11 Answers 11

183

If your company has a lawyer, or an ethics overseer, talk to them. It is usually considered the duty of any employee to bring to their attention any practice that might be unethical, or make the company vulnerable to lawsuits.

If there is no such person I would write to your boss pointing out that you believe failing to acknowledge copyright may make the company vulnerable to lawsuits, and asking them to confirm in writing that they want you to go ahead. Make sure you keep a copy of the email or letter where they agree. Keep it somewhere you can access it if you were denied access to your work computers and accounts.

  • 180
    Make sure you keep a copy of the email or letter OFF SITE ... – Wesley Long Mar 8 '17 at 0:07
  • 25
    I wouldn't trust an email to be unimpeachable, unless it's digitally signed with a reliable certificate. A letter with a good old hand-written signature is worth more in court I'd guess. And as @WesleyLong steates, put it somewhere safe. – Tobias Kienzler Mar 8 '17 at 7:06
  • 39
    +1 @TobiasKienzler The simple act of printing out a letter detailing the issue and getting his boss to sign it might even cause his boss to reconsider how seriously he should be taking this issue himself. – Steve-O Mar 8 '17 at 16:08
  • 9
    @Ferrybig What signatures are you referring to? Anything in an email header can be spoofed, the only thing nearly impossible to fake is an actual digital signature which has nothing to do with the email header but with the contents. – Tobias Kienzler Mar 9 '17 at 8:07
  • 11
    While this will get the job done, it really is a last resort. This will cause tension in the workplace and should only be done if the other options don't work. – corsiKa Mar 9 '17 at 17:40
400

The other answers are decent, but to me they seem like unnecessary escalation.

If you go along with this, then yes, you need to cover yourself legally.

However, have you tried the simple approach?

He says it will negatively affect how the app looks. Ask him to open up his iPhone, and navigate to "Settings" -> "General" -> "About" -> "Legal" and see how much textual info is dumped out on his screen.

Then say that you don't want to open up the company for a lawsuit, and you just need to include a "legal" page buried somewhere in the settings of your app.

Point out that iOS itself does this, and most people never notice it—but it prevents lawsuits.

Find some other excellent apps (preferably ones that you know that he uses) and find the legal notices in them, and show him.

  • 150
    A simple approach which makes a person say "I now realize" is my favorite, as I used to be a manager I can tell you this approach works much better than frightening people with the legal consequences. +1 – RanST Mar 8 '17 at 7:21
  • Comments are not for extended discussion; this conversation has been moved to chat. – Jane S Mar 9 '17 at 0:13
  • If you put the attributions in the application Settings (accessed though the Settings app) would that be acceptable? (I believe CocoaPods has this as a feature.) I couldn't find many apps which do this, but Hyperlapse, Seene, Vidgets and WWDC do. – ThomasW Mar 9 '17 at 9:55
  • 35
    Same for Android (7.1.1): "Settings" > "System" > "About" > "Legal" > "Open source licenses". – Someone Mar 9 '17 at 10:54
33

Check the licenses of any external code and libraries being used. If they request attribution, then to not do so is in contravention of the license; it doesn't matter what your boss feels about it. If attribution is not required, but you're doing it so you feel good, then your boss's viewpoint should prevail.

Point out to your boss that if the app is successful, the original writers of the code will eventually know about it and will look for their appropriate credits.

  • 25
    It should also be brought up that the open source community is bound by a common belief/principle, and if it is determined that you violated that community's trust, they will rally against you. That's a PR nightmare you don't want. See the Mozilla CEO story if you want to know just how powerful a community rallying against you can become. Different scales, to be sure, but why make an enemy of a group as your first step? – Wesley Long Mar 7 '17 at 21:34
  • 16
    In addition to being mad at you, if you are using free software without abiding to the license, you can be sued as if you had used any proprietary software without license. You are likely to lose more than all the benefits your app could ever produce. – Pere Mar 8 '17 at 1:17
  • "appropriate credits"? If you violate the terms and don't even give them attribution then there's no longer any license giving you permission to use their code. They could just sue for copyright infringement like if he'd ripped-off a chunk of closed source code. – Murphy Mar 13 '17 at 15:02
22

The other answers are all good, and I'm going to repeat a lot of what's in them for emphasis, but I think a couple of other things need to be said.

First, if all else fails and you are faced with an ultimate directive to include the code without attribution, you should get real legal advice from a real lawyer, not just some guesswork from laypeople on SE. Don't assume that just having a paper trail will absolve you from all liability, and don't take SE posts (including this one!) as legal advice.

Second, you should point out that code can be released and used under multiple licenses, and that the rightsholders might be willing to let you include it without displaying notices for a fee, depending on who they are. It might be worth looking into.

Third, if, after all the gentler arguments and paper-trail establishment has been done, and if you're really sure that the notices must be included, your boss still insists that you publish an app containing the copyrighted code without the legally required copyright notices, you can simply refuse to publish the app.

You absolutely should make darn certain that you're right about the legal situation before you push this. It sounds pretty cut-and-dry, but I'm not there and I don't know every tiny detail; it might not be.

You absolutely should attempt to find a conciliatory way to convince your boss either to include the requisite copyright notices or to give you the time to re-implement the necessary functionality in-house. Wildcard's suggestion, in particular, is excellent. Pointing out the legal liability and potentially devastating consequences of including the code without attribution is also a good way to go—you can do this in such a way as to show that you're trying to look out for the good of the company and of your boss, in particular, that your objections come out of supportiveness, not out of argumentativeness.

You absolutely should involve any department at your company that exists to handle matters of this sort—legal or ethical departments, etc. If you have such a resource, then that's their job, and they have authority you don't both to prevent a crime and to protect you. If this department exists and doesn't agree with you, then you should probably listen to what they have to say—they're experts in this sort of thing, and you're not, so they're probably right. Still get your paper trail (see next point), but they're probably right.

You absolutely should also establish a paper trail to protect yourself from retaliation. Get everything you can in hard copy, and keep it off site. Make sure it's very explicit in this documentation that what is being asked of you is illegal, and make your boss state very explicitly that he wants you to do it in spite of the fact that it's illegal if, in fact, that is what he wants.

But, after all this, if you still find yourself in the same situation, then you have the option to refuse. The consequences may be extremely severe; it might destroy your relationship with your boss or get you fired. All the other answers here seem to be focused on preserving your job and limiting your personal liability; these are great things to do, and it's completely understandable that you would choose to do them. You are, according to what you have said, being asked to break the law and to violate what are clearly your ethics, though, and it needs to be said that you have the choice not to.

Please note that I'm not advocating either way; this is your life, and your job, and it has to be up to you.

12

Create a paper trail and cover yourself completely.

Some people are happy to verbally instruct somebody else to do something ethically questionable - but not so happy to have it in writing and very unhappy when there is a paper trail leading back to them.

1) Ask your boss to put the request into writing in the form of an email.

You now have it in writing that it is your boss made the decision and is liable. You can also wait until you recieve this confirmation before continuing.

2) When the email arrives, reply, "this is probably illegal, are you sure".

You now have it in writing that you disapprove and have done your legal duty and raised the issue.

3(a) Boss probably gives up and quietly hates you.

You may need to find a new job. The typical cowboy boss doesn't like staff who won't break the law for them on a whim.

3(b) Boss sends and angry reply, gets HR involved, etc.

You are highly likely to need a new job. You may get a discplinary, or be put on a PIP, probably justified by vague, non words like "failure to follow reasonable instructions".

It's not all doom and gloom - there is a good chance that your boss will just be annoyed for a while, and vow never to promote you into a decision making role - but you may be in a toxic workplace here, so I wouldn't lose any sleep over it.

  • 3
    Not email, too easily forged unless you use a reliable digital signature. Paper trail means real paper with a signature. – Tobias Kienzler Mar 8 '17 at 7:08
9

As an individual employee of a incorporated company, you have no personal legal obligation to comply with copyright and licensing laws. These are civil, not criminal, matters. The liability is all upon the company. Unless you are a partner, or somehow not acting as an employee or a contractor producing 'work for hire', you concerns are not legal. Your concerns are with your company's policies and your personal ethical status. (I am sure that someone will reply to this and try to tell you a story about 'piercing the corporate veil. No one, but no one, is going to go on that sort of witch-hunt over a matter of failing to follow the attribution requirements of an open source license.)

If your company has policies that require compliance with licensing, following orders could leave you exposed to unpleasant consequence inside the company. However, before you pick a bigger fight with your manager (demanding written instructions, etc.), I recommend that you find out if there are any such policies. Find someone in legal, and ask them, quietly, for advice. Choose your course of action according to the answer you receive.

As far as your personal ethics are concerned, well, that's personal. You have to ask yourself what level of stress, or even unemployment, you are willing to accept. Your personal best course of action might be to quietly seek another job while complying rather than starting a pitched battle.

  • 3
    Many civil matters involve personal liability. This would benefit from an explanation of why this does not, preferably with a reference. – Matthew Read Mar 9 '17 at 6:35
6

This answer may not apply

I posted this answer before I read that the code the OP is trying to include and attribute is his own code. There is a very large difference between refusing to deploy something using someone else's lib because you can't meet licence needs, and refusing to deploy something using your own code because of the same.

Original Answer left for those that come across this question later.

There are two important issues that you need to address.

First, it's not your job, place, or responsibility to uphold copyright laws. These are complex laws that there are specialized fields for. You are not in a position that make that decision. You don't know all the deals, or emails, or legal checks that went into the "owners" decision not to include attribution. Matter of fact it's perfectly fine for them to decide to risk it, and handle the lawsuits later. (I don't think that's a good call on their part, but again it's their call.)

Second, you're not comfortable. This is the important one. Right or wrong you need to be comfortable with what you put your name on. I can tell you right now, that us developers are a small group of people. We run in small circles. You will run into other developers time an time again if your any good at your job. How do you want to be known? As the developer that abused licences, or as the developer that stood up for licences? If you're not comfortable doing something, THEN DON'T DO IT! You may lose your job over it, but you can always find another job.

"Why did you get fired from your last job?" "I refused to deploy code that I felt violated several legal issues." Is a pretty decent start to an interview to me.

A real solution, before you go resigning over this, is to show examples of how other companies handle the same issue. Trying to convince your "owner" is always better then taking a flat stance. Even if that come off as a list of options:

  • We can not use libfoo and rewrite it. It will take 6 months.
  • We can attribute libfoo like Competitor does, see here.. and here for examples
  • I can resign and you can hire a developer that doesn't care as much.

Your "owner", if they are half way decent should be able to look at their list of choices and choose the one that they like the best. It very well could be you resigning, but again, if your that uncomfortable, then what does it really matter.

  • I just read the comment that the code your trying to attribute is your own code. way to murky up the waters. This answer I will leave for others but it almost 100% doesn't apply if it's your own code. – coteyr Mar 8 '17 at 15:32
  • 1
    My understanding is that his code as-implemented today is relying on the 3rd party (licensed) code, and could be rewritten without it. In that case, I think your comment is highly appropriate. – Jimmy Mar 8 '17 at 19:03
4

Here is what you might tell your boss: We are talking about Apple here. If the copyright owner of the software that you are using without attribution calls Apple and tells them that your company is using his software without permission, then your software will be promptly removed from the store, and it won't be easy to get it back on the store. And impossible to get it back without attribution.

2

I originally posted an answer based on the OP question of not being comfortable including code when not meeting it's licence requirements. However there was an important comment that I didn't see that really invalidates that answer.

PeterM Yes & Yes. It's my own code in question, the clean room approach is possible but it would take many weeks. My boss would not sign off on spending that much time on something like that sadly –

You are beyond screwed!

This will really depend on three factors.

  • First can you 100% prove (you can't) that you worked on 0% of this code while employed at this company. If you worked on any of it, then the code belongs to them, not you. This is a tricky legal situation, but if you so much as added a comma to the source what you were "on the clock" then the entire source could wind up belonging to them. Get a lawyer now. Keep in mind that there are several high profile cases, where "I worked on it after hours at home" has failed to be enough isolation. Same with "but I build libfoo before I even started at Widgets inc."

  • Second, can you 100% prove that you have permission to use this lib, that you discussed this decision, and it's ownership issues ahead of time with not just your manager, but with ALL of the correct corporate licencing entities in the company. If you can't then you need to get a lawyer right now. You could be liable for any losses the company has while they "fix" your "attempt to extort" them. You have a grave conflict of interest here.

  • Third, can you 100% prove that your lib is the best lib to use for this (You can't). If this goes to a judge of some kind and your company can find even one person that can say your lib was a valid choice but libBar was also a valid choice, then your back in extortion land.

In short, unless you approached this topic up front (and even then it could be tricky) your essentially extorting your employer. You are effectively saying "You will put my name on this product or it will cost you money." Not a bit different then if you walked into a meeting and said, "I will not deploy this app unless you call it "Coteyr's App" or give me $500,000!"

A way out

I highly advise you to take this way out, but IANAL. Hire someone that doesn't need to say IANAL, then transfer all rights to the lib, as needed to the company. You can do this by making the code public domain (if you can) or by transferring ownership, or by "creating a branch" just for your company and making the licencing on that branch whatever they want. You will need a lawyer to make sure that you know all your options, that you choose the best one, and that your new license doesn't conflict with other licences that your lib may depend on.

  • 2
    This answer is just focusing too much on that one comment, not the question as a whole. Better would be to give an overall answer, and then zero in on the comment. – Brandin Mar 8 '17 at 16:52
  • 1
    I guess I imagine answer and then place a small section below to adress the comment. Right now you have two answers, one for the question without the comment and one for just the comment (and without the question?). – Brandin Mar 8 '17 at 16:53
  • 1
    It's why I left the other answer. Sadly the difference is pivitol. If the OP is the licence holder, then nothing in the other answer applies. If he is not the license holder then nothing in this answer applies. It's a one or the other situation. When the "ownership" issue is addressed I will delete one of the answers. – coteyr Mar 8 '17 at 16:56
  • 1
    That quote sounds like means it is code he has written, not that he is claiming ownership of it. I can't find that comment though, and there certainly appears to be zero evidence of "extortion". – Matthew Read Mar 9 '17 at 6:40
0

It's not true to say being an employee absolves you of all legal responsibility.

Nor will a paper trail saying you knew what you were doing was wrong, even if under your employer's instruction.

It sounds like you are being employed for your expertise so the expectation is that you will understand the implications and act accordingly.

There will be an implied contract between the author of the source code and the user by virtue of you copying it. If you break the terms of that contract by not publishing an attribution, the part that allows free use will also be void.

In civil law the appellant has to prove damages, as well as liability. Setting aside direct damage, such as lost reputation, to the original author; your liability may be limited to what you earned (salary) from using their work. Your employer, as respondeat superior, stands to gain more and have the greater means to pay damages, but they can slope off at least some of the responsibility if you were acting outside your remit: breaking copyright law and licence agreements won't be considered to be part of your lawful employment, especially if you have the qualifications and experience to understand them.

Lister v Romford Ice & Cold Storage Co. Ltd.

-3

Neither the MIT License nor the Apache 2.0 License requires attribution in application user interfaces.

It's true that there are licenses that require such attribution (e.g. some of the Creative Commons licenses), but again MIT and Apache 2.0 aren't those.

  • 2
    This is misleading. The Apache license for example requires attribution "in any redistribution you may make" FAQ. Whether it is in the UI or not does not matter, but it must be given in some way that is considered to be "included with the software". For a boxed product it could be with the manuals, for example. Not sure how it should be done with mobile apps that have no manuals. – Brandin Mar 10 '17 at 9:25
  • Yeah, my response is specifically intended to address mobile apps as the OP asked about that. There are a lot of mobile apps out there and I'm unaware of even one example where the UI has a link to a bunch of software library attributions. Same goes for websites--occasionally you'll see something like "Powered by jQuery" or whatever, but rarely do you see a list of all the libraries on the app UI. I have to believe that it's because "redistribution" here means redistribution of the sources. If I'm mistaken about that I'd be interested to know. – Willie Wheeler Mar 14 '17 at 5:39
  • So where is the suggestion to comply with the license for a mobile app? Saying that you are "unaware of even one example" does not mean that those apps were complying. – Brandin Mar 14 '17 at 8:07

protected by Jane S Mar 11 '17 at 12:27

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.