Do international sanctions have an impact on Open Source Software? Background Recently I was reading about embargoes and sanctions on Iran (also this link) and before Sudan, and it got me thinking about how they could impact Open Source Software. Sanctions being applied not only by USA but sometime by other states and unions of countries (EU for example). I know that equipment from, say, an American manufacturer, could not be supplied to North Korea (for example an Oracle Server or a Cisco router) pending legal action. Thus i wondered if there was anything that restricted the use of an American made Open Source Software in say, North Korea. What I understood On the Open Source Initiative website, they state that : Can I stop "evil people" from using my program? No. The Open Source Definition specifies that Open Source licenses may not discriminate against persons or groups. Giving everyone freedom means giving evil people freedom, too. The notion of "good people" and "evil people" is beyond the scope of this question, but this tells me that anybody, anywhere could in fact use it without any troubles at all (talking about only the usage of the software). However, naively, even if I would see the MIT License as an Open Source License, I see it as well, naively, as a License created under US Law by an American Institution (MIT License). My question is divided as this: Can developers from a state under such sanction, use Open Source Software as they want ? Could developers of the Open Source Software be sued for the use of their creation by the states under sanction ? If a team of developers of another country were to help the developers to use the Open Source Software (support, online help etc.), could they face legal action ? NB : I am a software developer in Europe, I do not have prior knowledge of international or laws in the USA.
Generally, such sanctions prevent certain sorts of transactions in goods and services with nationals or entities of the nation under sanction. The exact list of transactions prohibited or restricted varies. If Open source software were being provided as a service, so that the recipient paid directly for a license, or for customization or configuration work, or for some sort of consulting or assistance, such transactions could be banned or restricted by a sanctions regime, but might not be. (If the sanctions included that particular class of transactions.) However, if it is merely a matter of an open source product being published, for anyone to download, install, and use, I don't see how that would be barred or restricted by any sanctions of the sort recently in use.
OK, seems I was right to begin with, but after building some work with this I had to be sure. The problem seems to step from a lot of not-lawyers overinterpreting the reach and applicability of copyright law, which, with a few asides, is the full extent of the AGPL. Additionally, the software is not based in an English-speaking country, which may have thrown the interpreted meaning of &quot;derivative product&quot;, as opposed to simply &quot;product&quot;. The AGPL is indeed in almost all ways the same as the GPL version 3; in fact you can see this by diffing the two documents. The only extension of the GPLv3 made for AGPL applies to software being run on a server. While it is indeed possible to include code in the final files, which might, in theory, constitute a significant portion of this program, that does not happen. The AGPL is apparently also meant almost exclusively for software, though the wording does include the ambiguous phrase &quot;and other products&quot;; this concerned me as it felt as though it might apply to the resources created by the work. It, broadly speaking, does not. So, I've got nothing to worry about--unless I was distributing derivative software, which would be an entirely different question and subject to this.
I don't think the issue is that it is a violation of a law, but rather that it is a violation of the terms of service you agree to when you sign up for the site - which is a breach of contract. You can be sued for breach of contract, if the site can prove any damages based on your breach. So if you use a bot to make money on a site, in violation of the site's license agreement, then I believe the site could indeed sue you to get the money back. Also, the phrasing of your question ("creating a robot") raises a separate issue. It is not actually creating the bot that is illegal, but using it where not allowed can be a violation of contract. Suppose person A makes a poker bot, just as a programming exercise, and doesn't use it. But then suppose person B uses the robot created by person A on a site that forbids it. Although this could be a gray area, I do not believe the site would have any recourse against person A (even though they probably would against person B).
If the tool circumvents Windows' copy protection (which is a computer question, not a legal one, but I cannot imagine a circumstance in which this isn't access-circumvention), then it is a violation of 17 USC 1201, which forbids &quot;circumvent[ing] a technological measure that effectively controls access to a work protected under this title&quot;. It is both illegal to use, and to &quot;manufacture, import, offer to the public, provide, or otherwise traffic&quot; in such a program.
There is also the part that says &quot;except as expressly permitted by law&quot;. In the USA, you are allowed to run the software. This means the operating system making the copy that transfers the software from your hard drive to the RAM of the computer, and all necessary changes there. And this includes modifications to relocate the software, or to protect it against certain attacks by hackers, and I'm confident that Apple checked that it includes translating x86 machine code to ARM machine code and store the translated copy together with the original. Similar things have been done already around 2000 or so, and no software manufacturer has ever complained.
The problem is that open source licenses incl AGPL have legal force because copyright prevents copying + modifying software by default (software is treated as a “literary work” and therefore enjoys copyright protection). But copyright on datasets and ML models is very different – if it is even recognized at all. Thus, similar copyleft techniques would only work in particular jurisdictions. For example, the EU recognizes “database rights”. A copyleft license that accounts for this is CC-BY-SA-4.0, meaning that in an EU context, databases based on the original database would have to use the same license. However, database rights are not recognized in the US (facts are not copyrightable, and the “sweat of the brow” doctrine is not recognized). Thus, the CC-BY-SA-4.0 license would not have any copyleft effect with respect to databases in an US context. Independently of copyright in the database as a whole, the data in the database might be copyrighted material, for example if the database contains text or images, complicating matters further. Machine learning models derived from a data set are much more difficult. Clearly, ML models that have been trained are not a creative work and are therefore not eligible for independent copyright protection. At most, it can be argued that the model is an automatically transformed version of the input data, so that copyright in the input data implies copyright in the model.1 Perhaps hyperparameter choices could reflect some creative input. This is very much an active topic of debate. Given this uncertainty, it would be impossible to create a public license that works reliably. 1. An interesting discussion topic is the potential effect on Microsoft's Copilot ML model which was also trained on GPL-licensed source code. Instead of deriving force from copyright law, it would be possible to impose conditions via a contract, i.e. EULA-like terms that only provide access to the material after the terms have been accepted. But again, this is difficult. Contract law differs wildly between jurisdictions. For example, a contract is defined by the “meeting of minds” in some jurisdictions; by offer, acceptance, and consideration in others. But how does such a contract ensure appropriate consideration? How can acceptance be ensured if the material is publicly available? For these reasons, I think that unless broad international agreement emerges about IP protections for machine learning models, such a copyleft system for ML models is impossible. It is worth noting that the lack of such protections is probably quite good for innovation and research, since researchers are free to improve each other's work without legal concerns. The idea of copyleft is a hack to subvert the “everything is forbidden by default” system of copyright, but “everything is allowed by default” might be better.2 2. To continue the Microsoft Copilot example: some copyleft advocates like Bradley M Kuhn are sceptical about Copilot's GPL compliance, but remind us that copyleft maximalism means copyright maximalism, and that this is not the goal of open source. https://sfconservancy.org/blog/2022/feb/03/github-copilot-copyleft-gpl/
You have a false premise: "it offers the same conditions", and "MIT license is functionally equivalent to CC-BY". These premises are not true. CC-BY: applies to more than just software; it applies to artistic or literary work, databases, other material disclaims endorsement explicitly withholds moral rights explicitly does not license patent rights (MIT license gives anyone who obtains a copy of the software the right to use it, a patent right) prescribes the acceptable forms of attribution Those are just some of the differences.
We can't really know until the ruling is made. The Supreme Court might issue a ruling that encompasses all software APIs, or may predicate its ruling on this more specific situation, e.g. that because Oracle's library is so extensive its structure can be copyrighted even if that does not necessarily mean that any individual function signature can be copyrighted. They could also decide based on something unrelated to the heart of the copyright question - skimming through the petition for a writ of certiorari, they could make a decision based on the original implied license from Sun, for example. Hopefully their decision will answer the copyright question of function declarations completely, but it isn't required to.